najm-auth 1.1.39 → 1.1.42

package/dist/index.js

@@ -67,9 +67,9 @@ var permissionsTable = pgTable("permissions", {
 });
 var tokensTable = pgTable("tokens", {
   ...baseFields(10),
-  userId: text("user_id").references(() => usersTable.id, { onDelete: "cascade" }).unique().notNull(),
+  userId: text("user_id").references(() => usersTable.id, { onDelete: "cascade" }).notNull(),
   token: text("token").notNull(),
-  tokenFamily: text("token_family"),
+  tokenFamily: text("token_family").notNull().unique(),
   previousHash: text("previous_hash"),
   previousValidUntil: timestamp("previous_valid_until", { mode: "string" }),
   previousUsedAt: timestamp("previous_used_at", { mode: "string" }),
@@ -77,6 +77,7 @@ var tokensTable = pgTable("tokens", {
   status: tokenStatusEnum("status").default("active"),
   expiresAt: timestamp("expires_at", { mode: "string" }).notNull()
 }, (table) => ({
+  userIdIdx: index("tokens_user_id_idx").on(table.userId),
   expiresAtIdx: index("tokens_expires_at_idx").on(table.expiresAt)
 }));
 var rolePermissionsTable = pgTable("role_permissions", {
@@ -134,9 +135,9 @@ var permissionsTable2 = sqliteTable("permissions", {
 });
 var tokensTable2 = sqliteTable("tokens", {
   ...baseFields2(10),
-  userId: text2("user_id").references(() => usersTable2.id, { onDelete: "cascade" }).unique().notNull(),
+  userId: text2("user_id").references(() => usersTable2.id, { onDelete: "cascade" }).notNull(),
   token: text2("token").notNull(),
-  tokenFamily: text2("token_family"),
+  tokenFamily: text2("token_family").notNull().unique(),
   previousHash: text2("previous_hash"),
   previousValidUntil: text2("previous_valid_until"),
   previousUsedAt: text2("previous_used_at"),
@@ -144,6 +145,7 @@ var tokensTable2 = sqliteTable("tokens", {
   status: text2("status").$type().default("active"),
   expiresAt: text2("expires_at").notNull()
 }, (table) => ({
+  userIdIdx: index2("tokens_user_id_idx").on(table.userId),
   expiresAtIdx: index2("tokens_expires_at_idx").on(table.expiresAt)
 }));
 var rolePermissionsTable2 = sqliteTable("role_permissions", {
@@ -161,87 +163,6 @@ var authSchema2 = {
   rolePermissions: rolePermissionsTable2
 };
 
-// src/schema/mysql.ts
-import { mysqlTable, varchar, boolean as boolean2, timestamp as timestamp2, mysqlEnum, primaryKey as primaryKey2, int, index as index3 } from "drizzle-orm/mysql-core";
-import { sql as sql3 } from "drizzle-orm";
-import { nanoid as nanoid3 } from "nanoid";
-var baseFields3 = /* @__PURE__ */ __name((idLength = 5) => ({
-  id: varchar("id", { length: 21 }).primaryKey().$defaultFn(() => nanoid3(idLength)),
-  createdAt: timestamp2("created_at", { mode: "string" }).defaultNow(),
-  updatedAt: timestamp2("updated_at", { mode: "string" }).defaultNow().$onUpdate(() => sql3`CURRENT_TIMESTAMP`)
-}), "baseFields");
-var rolesTable3 = mysqlTable("roles", {
-  ...baseFields3(5),
-  name: varchar("name", { length: 255 }).notNull(),
-  description: varchar("description", { length: 1e3 })
-});
-var usersTable3 = mysqlTable("users", {
-  ...baseFields3(8),
-  name: varchar("name", { length: 255 }),
-  email: varchar("email", { length: 255 }).notNull().unique(),
-  emailVerified: boolean2("email_verified").default(false),
-  phone: varchar("phone", { length: 255 }).unique(),
-  phoneVerified: boolean2("phone_verified").default(false),
-  password: varchar("password", { length: 255 }).notNull(),
-  image: varchar("image", { length: 255 }).default("noavatar.png"),
-  status: mysqlEnum("status", [...USER_STATUS]).default("pending"),
-  roleId: varchar("role_id", { length: 21 }).references(() => rolesTable3.id),
-  lastLogin: timestamp2("last_login", { mode: "string" }),
-  failedLoginAttempts: int("failed_login_attempts").default(0),
-  lockoutUntil: timestamp2("lockout_until", { mode: "string" })
-}, (table) => ({
-  roleIdx: index3("users_role_id_idx").on(table.roleId)
-}));
-var permissionsTable3 = mysqlTable("permissions", {
-  ...baseFields3(5),
-  name: varchar("name", { length: 255 }).notNull().unique(),
-  description: varchar("description", { length: 1e3 }),
-  resource: varchar("resource", { length: 255 }).notNull(),
-  action: varchar("action", { length: 255 }).notNull()
-});
-var tokensTable3 = mysqlTable("tokens", {
-  ...baseFields3(10),
-  userId: varchar("user_id", { length: 21 }).references(() => usersTable3.id, { onDelete: "cascade" }).unique().notNull(),
-  token: varchar("token", { length: 500 }).notNull(),
-  tokenFamily: varchar("token_family", { length: 16 }),
-  previousHash: varchar("previous_hash", { length: 500 }),
-  previousValidUntil: timestamp2("previous_valid_until", { mode: "string" }),
-  previousUsedAt: timestamp2("previous_used_at", { mode: "string" }),
-  type: mysqlEnum("type", [...TOKEN_TYPE]).default("refresh"),
-  status: mysqlEnum("status", [...TOKEN_STATUS]).default("active"),
-  expiresAt: timestamp2("expires_at", { mode: "string" }).notNull()
-}, (table) => ({
-  expiresAtIdx: index3("tokens_expires_at_idx").on(table.expiresAt)
-}));
-var rolePermissionsTable3 = mysqlTable("role_permissions", {
-  roleId: varchar("role_id", { length: 21 }).notNull().references(() => rolesTable3.id, { onDelete: "cascade" }),
-  permissionId: varchar("permission_id", { length: 21 }).notNull().references(() => permissionsTable3.id, { onDelete: "cascade" }),
-  createdAt: timestamp2("created_at", { mode: "string" }).defaultNow()
-}, (table) => ({
-  pk: primaryKey2({ columns: [table.roleId, table.permissionId] })
-}));
-var authSchema3 = {
-  users: usersTable3,
-  tokens: tokensTable3,
-  roles: rolesTable3,
-  permissions: permissionsTable3,
-  rolePermissions: rolePermissionsTable3
-};
-
-// src/auth/index.ts
-var auth_exports = {};
-__export(auth_exports, {
-  AUTH_MODULE: () => AUTH_MODULE,
-  AuthController: () => AuthController,
-  AuthGuard: () => AuthGuard,
-  AuthResolver: () => AuthResolver,
-  AuthService: () => AuthService,
-  CookieManager: () => CookieManager,
-  EncryptionService: () => EncryptionService,
-  isAuth: () => isAuth,
-  runAsUser: () => runAsUser
-});
-
 // src/auth/EncryptionService.ts
 import { Inject, Injectable } from "najm-core";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
@@ -452,15 +373,16 @@ CookieManager = __decorate2([
 ], CookieManager);
 
 // src/auth/AuthController.ts
-import { Controller } from "najm-core";
-import { Get, Post, ResMsg } from "najm-core";
-import { Body, User as User2, Headers } from "najm-core";
+import { Controller as Controller2 } from "najm-core";
+import { Get as Get2, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
+import { Body as Body2, User as User3, Headers } from "najm-core";
 
 // src/auth/AuthService.ts
 import { Injectable as Injectable7, Inject as Inject8 } from "najm-core";
 import { Err as Err6, Log } from "najm-core";
 import { I18n as I18n5, I18nService as I18nService2 } from "najm-i18n";
-import { EmailService, passwordResetTemplate } from "najm-email";
+import { EmailService, passwordResetTemplate, accountInviteTemplate } from "najm-email";
+import { nanoid as nanoid5 } from "nanoid";
 
 // src/users/UserService.ts
 import { Injectable as Injectable5, Inject as Inject5 } from "najm-core";
@@ -469,7 +391,7 @@ import { I18nService } from "najm-i18n";
 import { I18n as I18n3 } from "najm-i18n";
 
 // src/users/UserRepository.ts
-import { eq as eq2, ne, sql as sql4 } from "drizzle-orm";
+import { eq as eq2, ne, sql as sql3 } from "drizzle-orm";
 import { Repository, Inject as Inject3 } from "najm-core";
 import { DB } from "najm-database";
 
@@ -639,7 +561,7 @@ var UserRepository = class UserRepository2 {
     return updatedUser;
   }
   async incrementFailedAttempts(id) {
-    const [updatedUser] = await this.db.update(this.users).set({ failedLoginAttempts: sql4`coalesce(${this.users.failedLoginAttempts}, 0) + 1` }).where(eq2(this.users.id, id)).returning();
+    const [updatedUser] = await this.db.update(this.users).set({ failedLoginAttempts: sql3`coalesce(${this.users.failedLoginAttempts}, 0) + 1` }).where(eq2(this.users.id, id)).returning();
     return updatedUser;
   }
   async resetFailedAttempts(id) {
@@ -1044,7 +966,7 @@ RoleService = __decorate7([
 ], RoleService);
 
 // src/users/UserService.ts
-import { nanoid as nanoid4 } from "nanoid";
+import { nanoid as nanoid3 } from "nanoid";
 
 // src/shared/index.ts
 import * as fs from "fs/promises";
@@ -1254,7 +1176,7 @@ var UserService = class UserService2 {
       Err4("Password is required");
     }
     this.userValidator.validatePasswordStrength(password);
-    let userId = id || nanoid4(10);
+    let userId = id || nanoid3(10);
     await this.userValidator.checkEmailUnique(data.email);
     await this.userValidator.checkUserIdIsUnique(userId);
     const hashedPassword = await this.encryptionService.hashPassword(password);
@@ -1336,7 +1258,7 @@ var UserService = class UserService2 {
       await this.delete(existingUser.id);
     }
     const newAdminUser = await this.create({
-      id: nanoid4(10),
+      id: nanoid3(10),
       // Random ID instead of predictable 'USR00'
       name: config.name || "System Administrator",
       email: config.email,
@@ -1378,10 +1300,10 @@ import { I18n as I18n4 } from "najm-i18n";
 import { CacheService } from "najm-cache";
 import { createHash } from "crypto";
 import jwt from "jsonwebtoken";
-import { nanoid as nanoid5 } from "nanoid";
+import { nanoid as nanoid4 } from "nanoid";
 
 // src/tokens/TokenRepository.ts
-import { and, eq as eq4, isNull } from "drizzle-orm";
+import { and, eq as eq4, isNull, lt } from "drizzle-orm";
 import { Repository as Repository3, Inject as Inject6 } from "najm-core";
 import { DB as DB3 } from "najm-database";
 var __decorate9 = function(decorators, target, key, desc) {
@@ -1410,12 +1332,17 @@ var TokenRepository = class TokenRepository2 {
   get q() {
     return this.queryHelper ??= new AuthQueries(this.db, this.schema);
   }
+  /**
+   * Upsert the refresh-token row for a session, keyed on `tokenFamily` (the
+   * per-login session identifier, unique). A brand-new login inserts a fresh
+   * family row; a refresh rotation updates only that family's row, leaving the
+   * user's other sessions untouched.
+   */
   async storeRefreshToken(tokenData) {
     return await this.db.insert(this.tokens).values(tokenData).onConflictDoUpdate({
-      target: this.tokens.userId,
+      target: this.tokens.tokenFamily,
       set: {
         token: tokenData.token,
-        tokenFamily: tokenData.tokenFamily,
         expiresAt: tokenData.expiresAt,
         previousHash: tokenData.previousHash ?? null,
         previousValidUntil: tokenData.previousValidUntil ?? null,
@@ -1424,27 +1351,37 @@ var TokenRepository = class TokenRepository2 {
     }).returning();
   }
   /**
-   * Claim the previous-token grace slot. Conditional on BOTH the stored
-   * previousHash still matching the presented token AND previousUsedAt being
-   * NULL. Gating on the hash (not just the flag) closes the rotation race: the
-   * winner's rotation rewrites previousHash via storeRefreshToken, so a loser
-   * whose UPDATE lands after that rotation no longer matches and gets zero
-   * rows — exactly one caller ever claims the slot.
+   * Claim the previous-token grace slot for a single family. Conditional on
+   * BOTH the stored previousHash still matching the presented token AND
+   * previousUsedAt being NULL. Gating on the hash (not just the flag) closes
+   * the rotation race: the winner's rotation rewrites previousHash via
+   * storeRefreshToken (and resets previousUsedAt to NULL), so a loser whose
+   * UPDATE lands after that rotation no longer matches and gets zero rows —
+   * exactly one caller ever claims the slot.
    */
-  async markPreviousUsed(userId, previousHash) {
-    return await this.db.update(this.tokens).set({ previousUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and(eq4(this.tokens.userId, userId), eq4(this.tokens.previousHash, previousHash), isNull(this.tokens.previousUsedAt))).returning();
+  async markPreviousUsed(tokenFamily, previousHash) {
+    return await this.db.update(this.tokens).set({ previousUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.previousHash, previousHash), isNull(this.tokens.previousUsedAt))).returning();
   }
-  async getRefreshTokenWithFamily(userId) {
-    const [token] = await this.db.select().from(this.tokens).where(eq4(this.tokens.userId, userId));
+  /** Look up a single session's token row by its family identifier. */
+  async getByFamily(tokenFamily) {
+    const [token] = await this.db.select().from(this.tokens).where(eq4(this.tokens.tokenFamily, tokenFamily));
     return token ?? null;
   }
-  async revokeToken(userId) {
-    const [deletedToken] = await this.db.delete(this.tokens).where(eq4(this.tokens.userId, userId)).returning();
-    return deletedToken;
-  }
-  async revokeByFamily(tokenFamily) {
+  /** Revoke a single session (one family). */
+  async revokeFamily(tokenFamily) {
     return this.db.delete(this.tokens).where(eq4(this.tokens.tokenFamily, tokenFamily)).returning();
   }
+  /** Revoke every session for a user (password change/reset, logout-all). */
+  async revokeAllForUser(userId) {
+    return this.db.delete(this.tokens).where(eq4(this.tokens.userId, userId)).returning();
+  }
+  /**
+   * Opportunistic cleanup: with one row per family (no unique userId), expired
+   * and abandoned sessions accumulate. Delete every expired row.
+   */
+  async deleteExpired() {
+    return this.db.delete(this.tokens).where(lt(this.tokens.expiresAt, (/* @__PURE__ */ new Date()).toISOString())).returning();
+  }
   async isUserExists(userId) {
     const [user] = await this.db.select({ id: this.users.id }).from(this.users).where(eq4(this.users.id, userId)).limit(1);
     return !!user;
@@ -1559,19 +1496,22 @@ var TokenService = class TokenService2 {
       Err5(this.t("errors.tokenVerificationFailed"));
     }
     const sessionKey = this.sessionVersionKey(payload.userId);
-    let activeSessionVersion;
-    if (payload.jti) {
-      const [blacklisted, sessionVersion] = await this.getCacheValues([
-        `${this.blacklistPrefix}${payload.jti}`,
-        sessionKey
-      ]);
-      if (blacklisted !== null) {
-        Err5(this.t("errors.tokenRevoked"));
-      }
-      activeSessionVersion = this.parseSessionVersion(sessionVersion);
-    } else {
-      activeSessionVersion = this.parseSessionVersion(await this.cache.get(sessionKey));
+    const blacklistKey = payload.jti ? `${this.blacklistPrefix}${payload.jti}` : null;
+    const familyKey = payload.tokenFamily ? this.revokedFamilyKey(payload.tokenFamily) : null;
+    const keys = [
+      ...blacklistKey ? [blacklistKey] : [],
+      sessionKey,
+      ...familyKey ? [familyKey] : []
+    ];
+    const values = await this.getCacheValues(keys);
+    const valueByKey = new Map(keys.map((key, i) => [key, values[i]]));
+    if (blacklistKey && valueByKey.get(blacklistKey) != null) {
+      Err5(this.t("errors.tokenRevoked"));
     }
+    if (familyKey && valueByKey.get(familyKey) != null) {
+      Err5(this.t("errors.tokenRevoked"));
+    }
+    const activeSessionVersion = this.parseSessionVersion(valueByKey.get(sessionKey) ?? null);
     const tokenSessionVersion = payload.sessionVersion ?? 0;
     if (tokenSessionVersion !== activeSessionVersion) {
       Err5(this.t("errors.tokenRevoked"));
@@ -1579,15 +1519,19 @@ var TokenService = class TokenService2 {
     return payload;
   }
   verifyRefreshToken(token) {
+    let decoded;
     try {
-      const decoded = jwt.verify(token, this.config.jwt.refreshSecret);
-      if (decoded.type && decoded.type !== "refresh") {
-        Err5(this.t("errors.tokenVerificationFailed"));
-      }
-      return decoded.userId;
+      decoded = jwt.verify(token, this.config.jwt.refreshSecret);
     } catch {
       Err5(this.t("errors.tokenVerificationFailed"));
     }
+    if (decoded.type && decoded.type !== "refresh") {
+      Err5(this.t("errors.tokenVerificationFailed"));
+    }
+    if (!decoded.tokenFamily) {
+      Err5(this.t("errors.tokenVerificationFailed"));
+    }
+    return { userId: decoded.userId, tokenFamily: decoded.tokenFamily };
   }
   static PREVIOUS_GRACE_SECONDS = 120;
   /**
@@ -1606,9 +1550,9 @@ var TokenService = class TokenService2 {
     if (!refreshToken) {
       Err5(this.t("errors.refreshTokenMissing"));
     }
-    const userId = this.verifyRefreshToken(refreshToken);
-    const stored = await this.tokenRepository.getRefreshTokenWithFamily(userId);
-    if (!stored) {
+    const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
+    const stored = await this.tokenRepository.getByFamily(tokenFamily);
+    if (!stored || stored.userId !== userId) {
       Err5(this.t("errors.refreshTokenInvalid"));
     }
     const presentedHash = this.hashToken(refreshToken);
@@ -1653,7 +1597,7 @@ var TokenService = class TokenService2 {
     return jwt.decode(token);
   }
   async signAccessToken(data) {
-    const jti = nanoid5(16);
+    const jti = nanoid4(16);
     const sessionVersion = await this.getUserSessionVersion(data.userId);
     const expiresAt = this.expiresAt(this.config.jwt.accessExpiresIn);
     if (sessionVersion > 0) {
@@ -1670,30 +1614,33 @@ var TokenService = class TokenService2 {
     return (await this.signAccessToken(data)).token;
   }
   /**
-   * Generate refresh token with unique jti
+   * Generate refresh token with unique jti. The token carries its session's
+   * family so rotation/revocation can target a single session.
    */
   signRefreshToken(data) {
-    const jti = nanoid5(16);
+    const jti = nanoid4(16);
     const expiresAt = this.expiresAt(this.config.jwt.refreshExpiresIn);
     const token = jwt.sign({ ...data, jti, type: "refresh", exp: expiresAt }, this.config.jwt.refreshSecret);
     return { token, expiresAt };
   }
   generateRefreshToken(data) {
-    return this.signRefreshToken(data).token;
+    return this.signRefreshToken({ userId: data.userId, tokenFamily: data.tokenFamily ?? nanoid4(16) }).token;
   }
   async generateTokens(userId, tokenFamily) {
-    const family = tokenFamily ?? nanoid5(16);
+    const family = tokenFamily ?? nanoid4(16);
     const { roleName, permissions } = await this.tokenRepository.getRoleAndPermissions(userId);
     const accessTokenData = {
       userId,
       roles: roleName ? [roleName] : [],
-      permissions: permissions ?? []
+      permissions: permissions ?? [],
+      tokenFamily: family
     };
     const access = await this.signAccessToken(accessTokenData);
-    const refresh = this.signRefreshToken({ userId });
+    const refresh = this.signRefreshToken({ userId, tokenFamily: family });
     await this.storeRefreshToken(userId, refresh.token, family);
     return {
       userId,
+      tokenFamily: family,
       roles: accessTokenData.roles,
       permissions: accessTokenData.permissions,
       accessToken: access.token,
@@ -1743,7 +1690,7 @@ var TokenService = class TokenService2 {
   async storeRefreshToken(userId, refreshToken, tokenFamily) {
     const expireInSecond = timestring2(this.config.jwt.refreshExpiresIn, "s");
     const hashedToken = this.hashToken(refreshToken);
-    const existing = await this.tokenRepository.getRefreshTokenWithFamily(userId);
+    const existing = await this.tokenRepository.getByFamily(tokenFamily);
     const previousHash = existing?.token ?? null;
     const previousValidUntil = previousHash ? new Date(Date.now() + TokenService_1.PREVIOUS_GRACE_SECONDS * 1e3).toISOString() : null;
     await this.tokenRepository.storeRefreshToken({
@@ -1765,28 +1712,45 @@ var TokenService = class TokenService2 {
     if (!refreshToken) {
       Err5(this.t("errors.refreshTokenMissing"));
     }
-    const userId = this.verifyRefreshToken(refreshToken);
-    const stored = await this.tokenRepository.getRefreshTokenWithFamily(userId);
-    if (!stored) {
+    const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
+    const stored = await this.tokenRepository.getByFamily(tokenFamily);
+    if (!stored || stored.userId !== userId) {
       Err5(this.t("errors.refreshTokenInvalid"));
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
-      return this.generateTokens(userId, stored.tokenFamily ?? void 0);
+      return this.generateTokens(userId, tokenFamily);
     }
     const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
     if (canRecover) {
-      const claimed = await this.tokenRepository.markPreviousUsed(userId, presentedHash);
+      const claimed = await this.tokenRepository.markPreviousUsed(tokenFamily, presentedHash);
       if (!claimed?.length) {
         Err5(this.t("errors.refreshTokenInvalid"));
       }
-      return this.generateTokens(userId, stored.tokenFamily ?? void 0);
+      return this.generateTokens(userId, tokenFamily);
     }
-    await this.revokeSuspectRefreshFamily(userId, stored.tokenFamily ?? null);
+    await this.revokeSuspectRefreshFamily(userId, tokenFamily);
     Err5(this.t("errors.refreshTokenInvalid"));
   }
-  async revokeToken(userId) {
-    return this.tokenRepository.revokeToken(userId);
+  /** Revoke every refresh session for a user (password change/reset, logout-all). */
+  async revokeAllForUser(userId) {
+    return this.tokenRepository.revokeAllForUser(userId);
+  }
+  /** Revoke a single refresh session (one family). */
+  async revokeFamily(tokenFamily) {
+    await this.markFamilyRevoked(tokenFamily);
+    return this.tokenRepository.revokeFamily(tokenFamily);
+  }
+  /**
+   * Opportunistic cleanup of expired/abandoned sessions. With one row per
+   * family (no unique userId), abandoned logins would otherwise accumulate.
+   * Best-effort — never let cleanup failure break the calling flow.
+   */
+  async deleteExpiredSessions() {
+    try {
+      await this.tokenRepository.deleteExpired();
+    } catch {
+    }
   }
   async invalidateUserAccessTokens(userId) {
     const nextVersion = await this.getUserSessionVersion(userId) + 1;
@@ -1802,47 +1766,135 @@ var TokenService = class TokenService2 {
     }
     return user;
   }
+  get revokedFamilyPrefix() {
+    return "auth:revoked-family:";
+  }
+  revokedFamilyKey(tokenFamily) {
+    return `${this.revokedFamilyPrefix}${tokenFamily}`;
+  }
+  /**
+   * Mark a family as revoked in cache for the access-token TTL, so every
+   * access token minted for that family (not just the presented one) is
+   * rejected by verifyAccessToken until it would have expired anyway.
+   */
+  async markFamilyRevoked(tokenFamily) {
+    await this.cache.set(this.revokedFamilyKey(tokenFamily), "1", this.accessTokenTtlMs());
+  }
+  /**
+   * Revoke only the suspect family — NOT the whole user. Bumping the global
+   * per-user session version here would kill every device's access tokens on a
+   * single family's reuse detection. Instead drop the family's refresh row and
+   * mark the family revoked so its access tokens stop verifying.
+   */
   async revokeSuspectRefreshFamily(userId, tokenFamily) {
-    await this.invalidateUserAccessTokens(userId);
     if (tokenFamily) {
-      await this.tokenRepository.revokeByFamily(tokenFamily);
+      await this.revokeFamily(tokenFamily);
       return;
     }
-    await this.revokeToken(userId);
+    await this.invalidateUserAccessTokens(userId);
+    await this.revokeAllForUser(userId);
   }
   /**
-   * Logout user - blacklist access token and revoke refresh token
+   * Logout the CURRENT session only — blacklist the presented access token,
+   * mark its family revoked, and delete that family's refresh row. Other
+   * devices/sessions for the same user keep working. Use a password change or
+   * reset (revoke-all) to terminate every session.
+   *
+   * The family is resolved from, in order: a verified Bearer access token's
+   * `tokenFamily` claim, then a verified refresh cookie whose hash still
+   * matches the current family row. If neither is available, fall back to
+   * revoke-all.
    */
   async logout(userId, authorization) {
+    let tokenFamily = null;
     if (authorization) {
+      let accessToken = null;
       try {
-        const accessToken = this.extractAccessToken(authorization);
-        await this.blacklistCurrentToken(accessToken);
+        accessToken = this.extractAccessToken(authorization);
       } catch {
       }
+      if (accessToken) {
+        try {
+          const decoded = await this.verifyAccessToken(accessToken);
+          if (decoded.userId === userId && decoded.tokenFamily) {
+            tokenFamily = decoded.tokenFamily;
+          }
+        } catch {
+        }
+        await this.blacklistCurrentToken(accessToken);
+      }
+    }
+    if (!tokenFamily) {
+      tokenFamily = await this.resolveRefreshCookieFamily(userId);
+    }
+    if (tokenFamily) {
+      await this.revokeFamily(tokenFamily);
+      return;
     }
     await this.invalidateUserAccessTokens(userId);
-    await this.revokeToken(userId);
+    await this.revokeAllForUser(userId);
+  }
+  /**
+   * Resolve a logout target from the refresh cookie only if the cookie maps to
+   * the user's current/valid family row. This mirrors resolveUserFromCookie()
+   * without throwing, because logout can still fall back to revoke-all.
+   */
+  async resolveRefreshCookieFamily(userId) {
+    const refreshToken = this.cookieManager.getRefreshToken();
+    if (!refreshToken)
+      return null;
+    try {
+      const decoded = this.verifyRefreshToken(refreshToken);
+      if (decoded.userId !== userId)
+        return null;
+      const stored = await this.tokenRepository.getByFamily(decoded.tokenFamily);
+      if (!stored || stored.userId !== userId)
+        return null;
+      const presentedHash = this.hashToken(refreshToken);
+      if (presentedHash === stored.token) {
+        return decoded.tokenFamily;
+      }
+      const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
+      return canRecover ? decoded.tokenFamily : null;
+    } catch {
+      return null;
+    }
   }
   // ============ PASSWORD RESET TOKENS ============
   /**
-   * Generate secure password reset token
-   * Returns both the plain token (to send via email) and userId for identification
+   * Generate a one-time set-password token (used by both password reset and
+   * account invites). Stores the jti in cache so the token can only be used
+   * once, with a TTL matching the JWT expiry.
    */
-  async generateResetToken(userId) {
-    const jti = nanoid5(16);
-    const resetData = {
+  async generateSetPasswordToken(userId, type, expiresIn) {
+    const jti = nanoid4(16);
+    const data = {
       userId,
-      type: "reset",
+      type,
       jti,
       timestamp: Date.now()
     };
-    const token = jwt.sign(resetData, this.config.jwt.refreshSecret, {
-      expiresIn: "1h"
+    const token = jwt.sign(data, this.config.jwt.refreshSecret, {
+      expiresIn
     });
-    await this.cache.set(`${this.resetTokenPrefix}${userId}`, jti, 36e5);
+    await this.cache.set(`${this.resetTokenPrefix}${userId}`, jti, timestring2(expiresIn, "ms"));
     return { token, userId };
   }
+  /**
+   * Generate secure password reset token
+   * Returns both the plain token (to send via email) and userId for identification
+   */
+  async generateResetToken(userId) {
+    return this.generateSetPasswordToken(userId, "reset", "1h");
+  }
+  /**
+   * Generate secure account-invite token.
+   * Longer expiry (3d) than reset because an invited user may not check
+   * their email immediately. Consumed via the same reset-password endpoint.
+   */
+  async generateInviteToken(userId) {
+    return this.generateSetPasswordToken(userId, "invite", "3d");
+  }
   /**
    * Verify password reset token
    * Returns userId if valid, throws error if expired/invalid
@@ -1854,7 +1906,7 @@ var TokenService = class TokenService2 {
     } catch {
       Err5(this.t("errors.resetTokenExpired"));
     }
-    if (decoded.type !== "reset" || !decoded.jti) {
+    if (decoded.type !== "reset" && decoded.type !== "invite" || !decoded.jti) {
       Err5(this.t("errors.invalidResetToken"));
     }
     const key = `${this.resetTokenPrefix}${decoded.userId}`;
@@ -1943,6 +1995,38 @@ var AuthService = class AuthService2 {
   async registerUser(body) {
     return await this.userService.create(body);
   }
+  /**
+   * Admin-initiated account creation. The user is created with a random,
+   * unusable password (the schema requires one) and then emailed a one-time
+   * link to set their own. They can't log in until they do, since they never
+   * learn the random password.
+   *
+   * Email is best-effort: a send failure logs a warning but never rolls back
+   * account creation (and with the console provider, nothing is actually sent).
+   */
+  async inviteUser(body) {
+    const randomPassword = `${nanoid5(24)}Aa1!`;
+    const user = await this.userService.create({
+      name: body.name,
+      email: body.email,
+      roleId: body.roleId,
+      image: body.image,
+      password: randomPassword,
+      status: "active",
+      emailVerified: false
+    });
+    const { token } = await this.tokenService.generateInviteToken(user.id);
+    const inviteLink = `${this.config.frontendUrl}/reset-password?token=${token}`;
+    try {
+      await this.emailService.sendHtml(body.email, this.t("emails.accountInvite.subject"), accountInviteTemplate({
+        inviteLink,
+        userName: user.name || body.email
+      }));
+    } catch (error) {
+      this.logger.warn("Account invite email failed", { email: body.email, error });
+    }
+    return user;
+  }
   async loginUser(body) {
     const { email: email2, password } = body;
     const user = await this.userService.findByEmail(email2);
@@ -1972,6 +2056,7 @@ var AuthService = class AuthService2 {
     if ((user.failedLoginAttempts ?? 0) > 0 || user.lockoutUntil) {
       await this.userService.resetFailedAttempts(user.id);
     }
+    await this.tokenService.deleteExpiredSessions();
     const generated = await this.tokenService.generateTokens(user.id);
     this.cookieManager.setRefreshToken(generated.refreshToken);
     await this.userService.updateLastLogin(user.id);
@@ -1982,7 +2067,7 @@ var AuthService = class AuthService2 {
       roles,
       permissions
     });
-    const { userId: _userId, roles: _roles, permissions: _permissions, ...tokens } = generated;
+    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, ...tokens } = generated;
     return { ...tokens, user: sanitized };
   }
   async refreshTokens() {
@@ -1996,7 +2081,7 @@ var AuthService = class AuthService2 {
         permissions: generated.permissions
       });
     }
-    const { userId: _userId, roles: _roles, permissions: _permissions, ...tokens } = generated;
+    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, ...tokens } = generated;
     return tokens;
   }
   async logoutUser(userId, authorization) {
@@ -2005,6 +2090,15 @@ var AuthService = class AuthService2 {
     this.cookieManager.clearSessionCookie();
     return { data: null, message: this.t("auth.success.logout") };
   }
+  /**
+   * Prune expired refresh sessions for every user. Login already prunes
+   * opportunistically; expose this so consumers can also run it from a
+   * scheduled job (cron / queue) to reclaim rows from users who never return.
+   * Best-effort — safe to call repeatedly.
+   */
+  async pruneExpiredSessions() {
+    await this.tokenService.deleteExpiredSessions();
+  }
   async getUserProfile(userData) {
     const lang = this.i18nService.getCurrentLanguage();
     return {
@@ -2077,7 +2171,7 @@ var AuthService = class AuthService2 {
     this.userValidator.validatePasswordStrength(newPassword);
     await this.userService.update(userId, { password: newPassword });
     await this.tokenService.invalidateUserAccessTokens(userId);
-    await this.tokenService.revokeToken(userId);
+    await this.tokenService.revokeAllForUser(userId);
     this.cookieManager.clearRefreshToken();
     this.cookieManager.clearSessionCookie();
     return { message: this.t("success.passwordChanged") };
@@ -2087,7 +2181,7 @@ var AuthService = class AuthService2 {
     this.userValidator.validatePasswordStrength(newPassword);
     await this.userService.update(userId, { password: newPassword });
     await this.tokenService.invalidateUserAccessTokens(userId);
-    await this.tokenService.revokeToken(userId);
+    await this.tokenService.revokeAllForUser(userId);
     this.cookieManager.clearRefreshToken();
     this.cookieManager.clearSessionCookie();
     return { message: this.t("success.passwordReset") };
@@ -2146,63 +2240,33 @@ AuthGuard = __decorate12([
 ], AuthGuard);
 var isAuth = createGuard(AuthGuard);
 
-// src/auth/AuthController.ts
-import { Validate } from "najm-validation";
-import { RateLimit } from "najm-rate";
-import { createHash as createHash2 } from "crypto";
-
-// src/users/UserDto.ts
-import { z } from "zod";
-var emailField = z.string().email("Invalid email format");
-var passwordField = z.string().min(8, "Password must be at least 8 characters");
-var optionalDateField = z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be in YYYY-MM-DD format").nullable().optional();
-var createUserDto = z.object({
-  name: z.string().max(100).optional(),
-  email: emailField,
-  password: passwordField,
-  roleId: z.string().min(1).optional(),
-  image: z.string().nullish(),
-  emailVerified: z.boolean().default(false),
-  status: z.enum(["active", "inactive", "pending"]).optional()
-});
-var updateUserDto = createUserDto.partial();
-var userIdParam = z.object({
-  id: z.string().min(1, "User ID is required")
-});
-var loginDto = z.object({
-  email: emailField,
-  password: passwordField
-});
-var changePasswordDto = z.object({
-  currentPassword: passwordField,
-  newPassword: passwordField
-});
-var resetPasswordDto = z.object({
-  email: emailField
-});
-var confirmResetPasswordDto = z.object({
-  token: z.string().min(10, "Invalid reset token"),
-  newPassword: passwordField
-});
-var languageParam = z.object({
-  language: z.string().min(2)
-});
-var emailParam = z.object({
-  email: emailField
-});
-var userIdInParam = z.object({
-  userId: z.string().min(1, "User ID is required")
-});
-var assignRoleParams = z.object({
-  userId: z.string().min(1, "User ID is required"),
-  roleId: z.string().min(1)
-});
-var userListQuery = z.object({
-  limit: z.coerce.number().int().min(1).max(100).default(50),
-  offset: z.coerce.number().int().min(0).default(0)
+// src/roles/index.ts
+var roles_exports = {};
+__export(roles_exports, {
+  ROLES: () => ROLES,
+  ROLE_GROUPS: () => ROLE_GROUPS,
+  Role: () => Role,
+  RoleController: () => RoleController,
+  RoleGuard: () => RoleGuard,
+  RoleRepository: () => RoleRepository,
+  RoleService: () => RoleService,
+  RoleValidator: () => RoleValidator,
+  assignRoleDto: () => assignRoleDto,
+  createRoleDto: () => createRoleDto,
+  defineRoles: () => defineRoles,
+  isAdmin: () => isAdmin,
+  isAdministrator: () => isAdministrator,
+  roleIdParam: () => roleIdParam,
+  updateRoleDto: () => updateRoleDto
 });
 
-// src/auth/AuthController.ts
+// src/roles/defineRoles.ts
+import { composeGuards as composeGuards2, createGuard as createGuard3 } from "najm-guard";
+
+// src/roles/RoleGuards.ts
+import { Service as Service3 } from "najm-core";
+import { GuardParams, User as User2 } from "najm-core";
+import { composeGuards, createGuard as createGuard2 } from "najm-guard";
 var __decorate13 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -2217,156 +2281,431 @@ var __param4 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a8;
-var hashKeyPart = /* @__PURE__ */ __name((value) => createHash2("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
-var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
-  const cookie = ctx.req.raw.headers.get("cookie") ?? "";
-  const fingerprint = cookie ? hashKeyPart(cookie) : "none";
-  return `${ip}:${fingerprint}`;
-}, "cookieFingerprint");
-var ipAndEmail = /* @__PURE__ */ __name(async (ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
-  try {
-    const body = await ctx.req.json();
-    if (body?.email && typeof body.email === "string") {
-      const normalizedEmail = body.email.trim().toLowerCase();
-      if (normalizedEmail)
-        return `${ip}:${hashKeyPart(normalizedEmail)}`;
-    }
-  } catch {
-  }
-  return ip;
-}, "ipAndEmail");
-var AuthController = class AuthController2 {
+var RoleGuard = class RoleGuard2 {
   static {
-    __name(this, "AuthController");
-  }
-  authService;
-  constructor(authService) {
-    this.authService = authService;
-  }
-  async registerUser(body) {
-    return this.authService.registerUser(body);
-  }
-  async loginUser(body) {
-    return this.authService.loginUser(body);
+    __name(this, "RoleGuard");
   }
-  async refreshTokens() {
-    return this.authService.refreshTokens();
+  canActivate(allowedRoles, userRole) {
+    if (!userRole)
+      return false;
+    const requiredRoles = Array.isArray(allowedRoles) ? allowedRoles : [allowedRoles];
+    const hasRole = requiredRoles.some((r) => r.toLowerCase() === userRole.toLowerCase());
+    if (hasRole) {
+      return { role: userRole };
+    }
+    return false;
   }
-  async logoutUser(userId, authorization) {
-    return this.authService.logoutUser(userId, authorization);
+};
+__decorate13([
+  __param4(0, GuardParams()),
+  __param4(1, User2("role")),
+  __metadata13("design:type", Function),
+  __metadata13("design:paramtypes", [Object, String]),
+  __metadata13("design:returntype", void 0)
+], RoleGuard.prototype, "canActivate", null);
+RoleGuard = __decorate13([
+  Service3()
+], RoleGuard);
+var Role = createGuard2(RoleGuard);
+var isAdmin = composeGuards(isAuth(), Role(ROLES.ADMIN));
+var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
+
+// src/roles/defineRoles.ts
+var Role2 = createGuard3(RoleGuard);
+function defineRoles(roles, options) {
+  const ROLES2 = roles;
+  const superRoleKeys = options?.superRoles ?? [];
+  function resolveRoleValues(keys) {
+    return Array.from(new Set([...keys, ...superRoleKeys].map((key) => roles[key])));
   }
-  async changePassword(userId, body) {
-    return this.authService.changePassword(userId, body.currentPassword, body.newPassword);
+  __name(resolveRoleValues, "resolveRoleValues");
+  const guards2 = {};
+  for (const [key, value] of Object.entries(roles)) {
+    const name = `is${key.charAt(0).toUpperCase()}${key.slice(1).toLowerCase()}`;
+    const allowedValues = resolveRoleValues([key]);
+    guards2[name] = composeGuards2(isAuth(), Role2(allowedValues.length === 1 ? value : allowedValues));
   }
-  async userProfile(authorization) {
-    return this.authService.getMe(authorization);
+  function createGroupGuard(keys) {
+    const values = resolveRoleValues(keys);
+    return composeGuards2(isAuth(), Role2(values));
   }
-  async forgotPassword(body) {
-    return this.authService.forgotPassword(body.email);
+  __name(createGroupGuard, "createGroupGuard");
+  function hasRole(userRole, ...keys) {
+    if (!userRole)
+      return false;
+    const normalized = userRole.toLowerCase();
+    return resolveRoleValues(keys).some((role) => role === normalized);
   }
-  async resetPassword(body) {
-    return this.authService.resetPassword(body.token, body.newPassword);
+  __name(hasRole, "hasRole");
+  function isInGroup(userRole, keys) {
+    return hasRole(userRole, ...keys);
   }
-};
-__decorate13([
-  Post("/register"),
-  RateLimit({ limit: 5, window: "15m", key: ipAndEmail }),
-  Validate(createUserDto),
-  ResMsg("auth.success.register"),
-  __param4(0, Body()),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [Object]),
-  __metadata13("design:returntype", Promise)
-], AuthController.prototype, "registerUser", null);
-__decorate13([
-  Post("/login"),
-  RateLimit({ limit: 5, window: "15m", key: ipAndEmail, message: "Too many login attempts. Please try again later." }),
-  Validate(loginDto),
-  ResMsg("auth.success.login"),
-  __param4(0, Body()),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [Object]),
-  __metadata13("design:returntype", Promise)
-], AuthController.prototype, "loginUser", null);
-__decorate13([
-  Post("/refresh"),
+  __name(isInGroup, "isInGroup");
+  return { ROLES: ROLES2, createGroupGuard, hasRole, isInGroup, ...guards2 };
+}
+__name(defineRoles, "defineRoles");
+
+// src/roles/RoleController.ts
+import { Controller } from "najm-core";
+import { Get, Post, Put, Delete, ResMsg } from "najm-core";
+import { Params, Body } from "najm-core";
+import { Validate } from "najm-validation";
+
+// src/roles/RoleDto.ts
+import { z } from "zod";
+var nameField = z.string().min(2, "Name must be at least 2 characters").max(50, "Name too long");
+var descriptionField = z.string().max(255, "Description too long").optional();
+var createRoleDto = z.object({
+  name: nameField,
+  description: descriptionField
+});
+var updateRoleDto = createRoleDto.partial();
+var roleIdParam = z.object({
+  id: z.string().length(5, "Role ID must be 5 characters")
+});
+var assignRoleDto = z.object({
+  userId: z.string().length(8, "User ID must be 8 characters"),
+  roleId: z.string().length(5, "Role ID must be 5 characters")
+});
+
+// src/roles/RoleController.ts
+var __decorate14 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata14 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param5 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var _a8;
+var RoleController = class RoleController2 {
+  static {
+    __name(this, "RoleController");
+  }
+  roleService;
+  constructor(roleService) {
+    this.roleService = roleService;
+  }
+  async getRoles() {
+    return this.roleService.getAll();
+  }
+  async getRole(params) {
+    return this.roleService.getById(params.id);
+  }
+  async createRole(body) {
+    return this.roleService.create(body);
+  }
+  async updateRole(params, body) {
+    return this.roleService.update(params.id, body);
+  }
+  async deleteRole(params) {
+    return this.roleService.delete(params.id);
+  }
+};
+__decorate14([
+  Get(),
+  isAdmin(),
+  ResMsg("roles.success.retrieved"),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", []),
+  __metadata14("design:returntype", Promise)
+], RoleController.prototype, "getRoles", null);
+__decorate14([
+  Get("/:id"),
+  isAdmin(),
+  Validate({ params: roleIdParam }),
+  ResMsg("roles.success.retrieved"),
+  __param5(0, Params()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object]),
+  __metadata14("design:returntype", Promise)
+], RoleController.prototype, "getRole", null);
+__decorate14([
+  Post(),
+  isAdmin(),
+  Validate(createRoleDto),
+  ResMsg("roles.success.created"),
+  __param5(0, Body()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object]),
+  __metadata14("design:returntype", Promise)
+], RoleController.prototype, "createRole", null);
+__decorate14([
+  Put("/:id"),
+  isAdmin(),
+  Validate({
+    params: roleIdParam,
+    body: updateRoleDto
+  }),
+  ResMsg("roles.success.updated"),
+  __param5(0, Params()),
+  __param5(1, Body()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object, Object]),
+  __metadata14("design:returntype", Promise)
+], RoleController.prototype, "updateRole", null);
+__decorate14([
+  Delete("/:id"),
+  isAdmin(),
+  Validate({ params: roleIdParam }),
+  ResMsg("roles.success.deleted"),
+  __param5(0, Params()),
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object]),
+  __metadata14("design:returntype", Promise)
+], RoleController.prototype, "deleteRole", null);
+RoleController = __decorate14([
+  Controller("/roles"),
+  __metadata14("design:paramtypes", [typeof (_a8 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a8 : Object])
+], RoleController);
+
+// src/auth/AuthController.ts
+import { Validate as Validate2 } from "najm-validation";
+import { RateLimit } from "najm-rate";
+import { createHash as createHash2 } from "crypto";
+
+// src/users/UserDto.ts
+import { z as z2 } from "zod";
+var emailField = z2.string().email("Invalid email format");
+var passwordField = z2.string().min(8, "Password must be at least 8 characters");
+var optionalDateField = z2.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be in YYYY-MM-DD format").nullable().optional();
+var createUserDto = z2.object({
+  name: z2.string().max(100).optional(),
+  email: emailField,
+  password: passwordField,
+  roleId: z2.string().min(1).optional(),
+  image: z2.string().nullish(),
+  emailVerified: z2.boolean().default(false),
+  status: z2.enum(["active", "inactive", "pending"]).optional()
+});
+var updateUserDto = createUserDto.partial();
+var inviteUserDto = z2.object({
+  name: z2.string().max(100).optional(),
+  email: emailField,
+  roleId: z2.string().min(1).optional(),
+  image: z2.string().nullish()
+});
+var userIdParam = z2.object({
+  id: z2.string().min(1, "User ID is required")
+});
+var loginDto = z2.object({
+  email: emailField,
+  password: passwordField
+});
+var changePasswordDto = z2.object({
+  currentPassword: passwordField,
+  newPassword: passwordField
+});
+var resetPasswordDto = z2.object({
+  email: emailField
+});
+var confirmResetPasswordDto = z2.object({
+  token: z2.string().min(10, "Invalid reset token"),
+  newPassword: passwordField
+});
+var languageParam = z2.object({
+  language: z2.string().min(2)
+});
+var emailParam = z2.object({
+  email: emailField
+});
+var userIdInParam = z2.object({
+  userId: z2.string().min(1, "User ID is required")
+});
+var assignRoleParams = z2.object({
+  userId: z2.string().min(1, "User ID is required"),
+  roleId: z2.string().min(1)
+});
+var userListQuery = z2.object({
+  limit: z2.coerce.number().int().min(1).max(100).default(50),
+  offset: z2.coerce.number().int().min(0).default(0)
+});
+
+// src/auth/AuthController.ts
+var __decorate15 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata15 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param6 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var _a9;
+var hashKeyPart = /* @__PURE__ */ __name((value) => createHash2("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
+var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
+  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+  const cookie = ctx.req.raw.headers.get("cookie") ?? "";
+  const fingerprint = cookie ? hashKeyPart(cookie) : "none";
+  return `${ip}:${fingerprint}`;
+}, "cookieFingerprint");
+var ipAndEmail = /* @__PURE__ */ __name(async (ctx) => {
+  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+  try {
+    const body = await ctx.req.json();
+    if (body?.email && typeof body.email === "string") {
+      const normalizedEmail = body.email.trim().toLowerCase();
+      if (normalizedEmail)
+        return `${ip}:${hashKeyPart(normalizedEmail)}`;
+    }
+  } catch {
+  }
+  return ip;
+}, "ipAndEmail");
+var AuthController = class AuthController2 {
+  static {
+    __name(this, "AuthController");
+  }
+  authService;
+  constructor(authService) {
+    this.authService = authService;
+  }
+  async registerUser(body) {
+    return this.authService.registerUser(body);
+  }
+  async loginUser(body) {
+    return this.authService.loginUser(body);
+  }
+  async inviteUser(body) {
+    return this.authService.inviteUser(body);
+  }
+  async refreshTokens() {
+    return this.authService.refreshTokens();
+  }
+  async logoutUser(userId, authorization) {
+    return this.authService.logoutUser(userId, authorization);
+  }
+  async changePassword(userId, body) {
+    return this.authService.changePassword(userId, body.currentPassword, body.newPassword);
+  }
+  async userProfile(authorization) {
+    return this.authService.getMe(authorization);
+  }
+  async forgotPassword(body) {
+    return this.authService.forgotPassword(body.email);
+  }
+  async resetPassword(body) {
+    return this.authService.resetPassword(body.token, body.newPassword);
+  }
+};
+__decorate15([
+  Post2("/register"),
+  RateLimit({ limit: 5, window: "15m", key: ipAndEmail }),
+  Validate2(createUserDto),
+  ResMsg2("auth.success.register"),
+  __param6(0, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
+], AuthController.prototype, "registerUser", null);
+__decorate15([
+  Post2("/login"),
+  RateLimit({ limit: 5, window: "15m", key: ipAndEmail, message: "Too many login attempts. Please try again later." }),
+  Validate2(loginDto),
+  ResMsg2("auth.success.login"),
+  __param6(0, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
+], AuthController.prototype, "loginUser", null);
+__decorate15([
+  Post2("/invite"),
+  isAdmin(),
+  RateLimit({ limit: 20, window: "15m", key: "user" }),
+  Validate2(inviteUserDto),
+  ResMsg2("auth.success.accountInviteSent"),
+  __param6(0, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
+], AuthController.prototype, "inviteUser", null);
+__decorate15([
+  Post2("/refresh"),
   RateLimit({ limit: 15, window: "15m", key: cookieFingerprint() }),
-  ResMsg("auth.success.tokenRefreshed"),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", []),
-  __metadata13("design:returntype", Promise)
+  ResMsg2("auth.success.tokenRefreshed"),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", []),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "refreshTokens", null);
-__decorate13([
-  Post("/logout"),
+__decorate15([
+  Post2("/logout"),
   isAuth(),
   RateLimit({ limit: 10, window: "15m", key: "user" }),
-  __param4(0, User2("id")),
-  __param4(1, Headers("authorization")),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [String, String]),
-  __metadata13("design:returntype", Promise)
+  __param6(0, User3("id")),
+  __param6(1, Headers("authorization")),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String, String]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "logoutUser", null);
-__decorate13([
-  Post("/change-password"),
+__decorate15([
+  Post2("/change-password"),
   isAuth(),
-  Validate(changePasswordDto),
-  ResMsg("auth.success.passwordChanged"),
-  __param4(0, User2("id")),
-  __param4(1, Body()),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [String, Object]),
-  __metadata13("design:returntype", Promise)
+  Validate2(changePasswordDto),
+  ResMsg2("auth.success.passwordChanged"),
+  __param6(0, User3("id")),
+  __param6(1, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String, Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "changePassword", null);
-__decorate13([
-  Get("/me"),
+__decorate15([
+  Get2("/me"),
   RateLimit({ limit: 30, window: "1m", key: cookieFingerprint() }),
-  ResMsg("auth.users.success.retrieved"),
-  __param4(0, Headers("authorization")),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [String]),
-  __metadata13("design:returntype", Promise)
+  ResMsg2("auth.users.success.retrieved"),
+  __param6(0, Headers("authorization")),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "userProfile", null);
-__decorate13([
-  Post("/forgot-password"),
+__decorate15([
+  Post2("/forgot-password"),
   RateLimit({ limit: 3, window: "15m", key: ipAndEmail, message: "Too many password reset requests. Please try again later." }),
-  Validate(resetPasswordDto),
-  ResMsg("auth.success.passwordResetSent"),
-  __param4(0, Body()),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [Object]),
-  __metadata13("design:returntype", Promise)
+  Validate2(resetPasswordDto),
+  ResMsg2("auth.success.passwordResetSent"),
+  __param6(0, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "forgotPassword", null);
-__decorate13([
-  Post("/reset-password"),
+__decorate15([
+  Post2("/reset-password"),
   RateLimit({ limit: 5, window: "15m", key: "ip", message: "Too many password reset attempts. Please try again later." }),
-  Validate(confirmResetPasswordDto),
-  ResMsg("auth.success.passwordReset"),
-  __param4(0, Body()),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [Object]),
-  __metadata13("design:returntype", Promise)
+  Validate2(confirmResetPasswordDto),
+  ResMsg2("auth.success.passwordReset"),
+  __param6(0, Body2()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "resetPassword", null);
-AuthController = __decorate13([
-  Controller("/auth"),
-  __metadata13("design:paramtypes", [typeof (_a8 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a8 : Object])
+AuthController = __decorate15([
+  Controller2("/auth"),
+  __metadata15("design:paramtypes", [typeof (_a9 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a9 : Object])
 ], AuthController);
 
 // src/auth/AuthResolver.ts
-import { APP, Container, DI, Inject as Inject9, LOGGER, Meta, Service as Service3 } from "najm-core";
+import { APP, Container, DI, Inject as Inject9, LOGGER, Meta, Service as Service4 } from "najm-core";
 import { USER, ROLE, PERMISSIONS } from "najm-guard";
-var __decorate14 = function(decorators, target, key, desc) {
+var __decorate16 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata14 = function(k, v) {
+var __metadata16 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a9;
+var _a10;
 var AuthResolver = class AuthResolver2 {
   static {
     __name(this, "AuthResolver");
@@ -2464,20 +2803,20 @@ var AuthResolver = class AuthResolver2 {
     await authService.warmupPasswordHash();
   }
 };
-__decorate14([
+__decorate16([
   DI(),
-  __metadata14("design:type", typeof (_a9 = typeof Container !== "undefined" && Container) === "function" ? _a9 : Object)
+  __metadata16("design:type", typeof (_a10 = typeof Container !== "undefined" && Container) === "function" ? _a10 : Object)
 ], AuthResolver.prototype, "container", void 0);
-__decorate14([
+__decorate16([
   Inject9(APP),
-  __metadata14("design:type", Object)
+  __metadata16("design:type", Object)
 ], AuthResolver.prototype, "app", void 0);
-__decorate14([
+__decorate16([
   Inject9(LOGGER),
-  __metadata14("design:type", Object)
+  __metadata16("design:type", Object)
 ], AuthResolver.prototype, "log", void 0);
-AuthResolver = __decorate14([
-  Service3(),
+AuthResolver = __decorate16([
+  Service4(),
   Meta({ layer: "plugin", order: 30 })
 ], AuthResolver);
 
@@ -2526,6 +2865,7 @@ __export(users_exports, {
   confirmResetPasswordDto: () => confirmResetPasswordDto,
   createUserDto: () => createUserDto,
   emailParam: () => emailParam,
+  inviteUserDto: () => inviteUserDto,
   languageParam: () => languageParam,
   loginDto: () => loginDto,
   resetPasswordDto: () => resetPasswordDto,
@@ -2539,233 +2879,6 @@ __export(users_exports, {
 import { Controller as Controller3 } from "najm-core";
 import { Get as Get3, Post as Post3, Put as Put2, Delete as Delete2, ResMsg as ResMsg3 } from "najm-core";
 import { Params as Params2, Body as Body3, Query } from "najm-core";
-
-// src/roles/index.ts
-var roles_exports = {};
-__export(roles_exports, {
-  ROLES: () => ROLES,
-  ROLE_GROUPS: () => ROLE_GROUPS,
-  Role: () => Role,
-  RoleController: () => RoleController,
-  RoleGuard: () => RoleGuard,
-  RoleRepository: () => RoleRepository,
-  RoleService: () => RoleService,
-  RoleValidator: () => RoleValidator,
-  assignRoleDto: () => assignRoleDto,
-  createRoleDto: () => createRoleDto,
-  defineRoles: () => defineRoles,
-  isAdmin: () => isAdmin,
-  isAdministrator: () => isAdministrator,
-  roleIdParam: () => roleIdParam,
-  updateRoleDto: () => updateRoleDto
-});
-
-// src/roles/defineRoles.ts
-import { composeGuards as composeGuards2, createGuard as createGuard3 } from "najm-guard";
-
-// src/roles/RoleGuards.ts
-import { Service as Service4 } from "najm-core";
-import { GuardParams, User as User3 } from "najm-core";
-import { composeGuards, createGuard as createGuard2 } from "najm-guard";
-var __decorate15 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata15 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param5 = function(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-};
-var RoleGuard = class RoleGuard2 {
-  static {
-    __name(this, "RoleGuard");
-  }
-  canActivate(allowedRoles, userRole) {
-    if (!userRole)
-      return false;
-    const requiredRoles = Array.isArray(allowedRoles) ? allowedRoles : [allowedRoles];
-    const hasRole = requiredRoles.some((r) => r.toLowerCase() === userRole.toLowerCase());
-    if (hasRole) {
-      return { role: userRole };
-    }
-    return false;
-  }
-};
-__decorate15([
-  __param5(0, GuardParams()),
-  __param5(1, User3("role")),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object, String]),
-  __metadata15("design:returntype", void 0)
-], RoleGuard.prototype, "canActivate", null);
-RoleGuard = __decorate15([
-  Service4()
-], RoleGuard);
-var Role = createGuard2(RoleGuard);
-var isAdmin = composeGuards(isAuth(), Role(ROLES.ADMIN));
-var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
-
-// src/roles/defineRoles.ts
-var Role2 = createGuard3(RoleGuard);
-function defineRoles(roles, options) {
-  const ROLES2 = roles;
-  const superRoleKeys = options?.superRoles ?? [];
-  function resolveRoleValues(keys) {
-    return Array.from(new Set([...keys, ...superRoleKeys].map((key) => roles[key])));
-  }
-  __name(resolveRoleValues, "resolveRoleValues");
-  const guards2 = {};
-  for (const [key, value] of Object.entries(roles)) {
-    const name = `is${key.charAt(0).toUpperCase()}${key.slice(1).toLowerCase()}`;
-    const allowedValues = resolveRoleValues([key]);
-    guards2[name] = composeGuards2(isAuth(), Role2(allowedValues.length === 1 ? value : allowedValues));
-  }
-  function createGroupGuard(keys) {
-    const values = resolveRoleValues(keys);
-    return composeGuards2(isAuth(), Role2(values));
-  }
-  __name(createGroupGuard, "createGroupGuard");
-  function hasRole(userRole, ...keys) {
-    if (!userRole)
-      return false;
-    const normalized = userRole.toLowerCase();
-    return resolveRoleValues(keys).some((role) => role === normalized);
-  }
-  __name(hasRole, "hasRole");
-  function isInGroup(userRole, keys) {
-    return hasRole(userRole, ...keys);
-  }
-  __name(isInGroup, "isInGroup");
-  return { ROLES: ROLES2, createGroupGuard, hasRole, isInGroup, ...guards2 };
-}
-__name(defineRoles, "defineRoles");
-
-// src/roles/RoleController.ts
-import { Controller as Controller2 } from "najm-core";
-import { Get as Get2, Post as Post2, Put, Delete, ResMsg as ResMsg2 } from "najm-core";
-import { Params, Body as Body2 } from "najm-core";
-import { Validate as Validate2 } from "najm-validation";
-
-// src/roles/RoleDto.ts
-import { z as z2 } from "zod";
-var nameField = z2.string().min(2, "Name must be at least 2 characters").max(50, "Name too long");
-var descriptionField = z2.string().max(255, "Description too long").optional();
-var createRoleDto = z2.object({
-  name: nameField,
-  description: descriptionField
-});
-var updateRoleDto = createRoleDto.partial();
-var roleIdParam = z2.object({
-  id: z2.string().length(5, "Role ID must be 5 characters")
-});
-var assignRoleDto = z2.object({
-  userId: z2.string().length(8, "User ID must be 8 characters"),
-  roleId: z2.string().length(5, "Role ID must be 5 characters")
-});
-
-// src/roles/RoleController.ts
-var __decorate16 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata16 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param6 = function(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-};
-var _a10;
-var RoleController = class RoleController2 {
-  static {
-    __name(this, "RoleController");
-  }
-  roleService;
-  constructor(roleService) {
-    this.roleService = roleService;
-  }
-  async getRoles() {
-    return this.roleService.getAll();
-  }
-  async getRole(params) {
-    return this.roleService.getById(params.id);
-  }
-  async createRole(body) {
-    return this.roleService.create(body);
-  }
-  async updateRole(params, body) {
-    return this.roleService.update(params.id, body);
-  }
-  async deleteRole(params) {
-    return this.roleService.delete(params.id);
-  }
-};
-__decorate16([
-  Get2(),
-  isAdmin(),
-  ResMsg2("roles.success.retrieved"),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", []),
-  __metadata16("design:returntype", Promise)
-], RoleController.prototype, "getRoles", null);
-__decorate16([
-  Get2("/:id"),
-  isAdmin(),
-  Validate2({ params: roleIdParam }),
-  ResMsg2("roles.success.retrieved"),
-  __param6(0, Params()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object]),
-  __metadata16("design:returntype", Promise)
-], RoleController.prototype, "getRole", null);
-__decorate16([
-  Post2(),
-  isAdmin(),
-  Validate2(createRoleDto),
-  ResMsg2("roles.success.created"),
-  __param6(0, Body2()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object]),
-  __metadata16("design:returntype", Promise)
-], RoleController.prototype, "createRole", null);
-__decorate16([
-  Put("/:id"),
-  isAdmin(),
-  Validate2({
-    params: roleIdParam,
-    body: updateRoleDto
-  }),
-  ResMsg2("roles.success.updated"),
-  __param6(0, Params()),
-  __param6(1, Body2()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object, Object]),
-  __metadata16("design:returntype", Promise)
-], RoleController.prototype, "updateRole", null);
-__decorate16([
-  Delete("/:id"),
-  isAdmin(),
-  Validate2({ params: roleIdParam }),
-  ResMsg2("roles.success.deleted"),
-  __param6(0, Params()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object]),
-  __metadata16("design:returntype", Promise)
-], RoleController.prototype, "deleteRole", null);
-RoleController = __decorate16([
-  Controller2("/roles"),
-  __metadata16("design:paramtypes", [typeof (_a10 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a10 : Object])
-], RoleController);
-
-// src/users/UserController.ts
 import { Validate as Validate3 } from "najm-validation";
 var __decorate17 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -3577,7 +3690,7 @@ var revokeTokenDto = z4.object({
 });
 
 // src/ownership/scopedOwnership.ts
-import { aliasedTable, eq as eq6, getTableColumns, sql as sql5 } from "drizzle-orm";
+import { aliasedTable, eq as eq6, getTableColumns, sql as sql4 } from "drizzle-orm";
 var DEFAULT_ADMIN_ROLES = ["admin"];
 var DRIZZLE_NAME = /* @__PURE__ */ Symbol.for("drizzle:Name");
 var DRIZZLE_BASE_NAME = /* @__PURE__ */ Symbol.for("drizzle:BaseName");
@@ -3714,7 +3827,7 @@ var OwnershipToken = class {
       return query;
     const rule = this._rules[role];
     if (!rule)
-      return query.where(sql5`1 = 0`);
+      return query.where(sql4`1 = 0`);
     const { query: q, condition } = rule(uid, query);
     return q.where(condition);
   }
@@ -3729,7 +3842,7 @@ var OwnershipToken = class {
       return { query, condition: null };
     const rule = this._rules[role];
     if (!rule)
-      return { query, condition: sql5`1 = 0` };
+      return { query, condition: sql4`1 = 0` };
     return rule(uid, query);
   }
 };
@@ -4088,7 +4201,7 @@ __name(Policy, "Policy");
 
 // src/ownership/OwnedDecorator.ts
 import "reflect-metadata";
-import { sql as sql6, and as and3 } from "drizzle-orm";
+import { sql as sql5, and as and3 } from "drizzle-orm";
 import { Injectable as Injectable12, Inject as Inject12, DI as DI2, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
 var __decorate24 = function(decorators, target, key, desc) {
@@ -4177,7 +4290,7 @@ function Owned(token) {
             return query;
           const user = getUser(this);
           if (!user)
-            return query.where(sql6`1 = 0`);
+            return query.where(sql5`1 = 0`);
           return token.applyScope(user.id, user.role, query);
         };
       },
@@ -4249,7 +4362,16 @@ var en_default = {
       passwordChanged: "Password changed successfully",
       passwordResetSent: "If that email exists, a reset link has been sent",
       passwordReset: "Password has been reset successfully",
+      accountInviteSent: "Invitation sent successfully",
       tokenRefreshed: "Token refreshed successfully"
+    },
+    emails: {
+      passwordReset: {
+        subject: "Reset your password"
+      },
+      accountInvite: {
+        subject: "You've been invited \u2014 set up your account"
+      }
     }
   },
   users: {
@@ -4365,14 +4487,12 @@ var selectSchema = /* @__PURE__ */ __name((config) => {
   switch (dialect) {
     case "sqlite":
       return authSchema2;
-    case "mysql":
-      return authSchema3;
     case "pg":
     default:
       return authSchema;
   }
 }, "selectSchema");
-var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email()).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(auth_exports, users_exports, roles_exports, permissions_exports, tokens_exports, ScopeContext).config(AUTH_CONFIG, mergeConfig(config)).set(AUTH_SCHEMA, selectSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
+var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email()).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, ScopeContext).config(AUTH_CONFIG, mergeConfig(config)).set(AUTH_SCHEMA, selectSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
 
 // src/seed.ts
 var toSeedId = /* @__PURE__ */ __name((prefix, value) => {
@@ -4576,6 +4696,7 @@ export {
   formatDate,
   getAuthLocale,
   getAvatarFile,
+  inviteUserDto,
   isAdmin,
   isAdministrator,
   isAuth,