najm-auth 1.1.44 → 2.0.2

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/AuthPlugin.ts
-import { Err as Err8, plugin } from "najm-core";
+import { Err as Err10, plugin } from "najm-core";
 import { cache } from "najm-cache";
 
 // src/auth.tokens.ts
@@ -18,7 +18,7 @@ var AUTH_PERMISSIONS = /* @__PURE__ */ Symbol.for("najm:auth:permissions");
 var AUTH_ENCRYPTION_KEY = /* @__PURE__ */ Symbol.for("najm:auth:encryption-key");
 
 // src/schema/pg.ts
-import { pgTable, text, boolean, timestamp, pgEnum, primaryKey, integer, index } from "drizzle-orm/pg-core";
+import { pgTable, text, boolean, timestamp, pgEnum, primaryKey, integer, index, uniqueIndex } from "drizzle-orm/pg-core";
 import { sql } from "drizzle-orm";
 import { nanoid } from "nanoid";
 
@@ -58,6 +58,16 @@ var usersTable = pgTable("users", {
 }, (table) => ({
   roleIdx: index("users_role_id_idx").on(table.roleId)
 }));
+var oauthAccountsTable = pgTable("oauth_accounts", {
+  ...baseFields(10),
+  userId: text("user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+  provider: text("provider").notNull(),
+  providerAccountId: text("provider_account_id").notNull()
+}, (table) => ({
+  providerAccountUnique: uniqueIndex("oauth_accounts_provider_account_unique").on(table.provider, table.providerAccountId),
+  userProviderUnique: uniqueIndex("oauth_accounts_user_provider_unique").on(table.userId, table.provider),
+  userIdIdx: index("oauth_accounts_user_id_idx").on(table.userId)
+}));
 var permissionsTable = pgTable("permissions", {
   ...baseFields(5),
   name: text("name").notNull().unique(),
@@ -89,6 +99,7 @@ var rolePermissionsTable = pgTable("role_permissions", {
 }));
 var authSchema = {
   users: usersTable,
+  oauthAccounts: oauthAccountsTable,
   tokens: tokensTable,
   roles: rolesTable,
   permissions: permissionsTable,
@@ -96,7 +107,7 @@ var authSchema = {
 };
 
 // src/schema/sqlite.ts
-import { sqliteTable, text as text2, integer as integer2, uniqueIndex, index as index2 } from "drizzle-orm/sqlite-core";
+import { sqliteTable, text as text2, integer as integer2, uniqueIndex as uniqueIndex2, index as index2 } from "drizzle-orm/sqlite-core";
 import { sql as sql2 } from "drizzle-orm";
 import { nanoid as nanoid2 } from "nanoid";
 var baseFields2 = /* @__PURE__ */ __name((idLength = 5) => ({
@@ -126,6 +137,16 @@ var usersTable2 = sqliteTable("users", {
 }, (table) => ({
   roleIdx: index2("users_role_id_idx").on(table.roleId)
 }));
+var oauthAccountsTable2 = sqliteTable("oauth_accounts", {
+  ...baseFields2(10),
+  userId: text2("user_id").notNull().references(() => usersTable2.id, { onDelete: "cascade" }),
+  provider: text2("provider").notNull(),
+  providerAccountId: text2("provider_account_id").notNull()
+}, (table) => ({
+  providerAccountUnique: uniqueIndex2("oauth_accounts_provider_account_unique").on(table.provider, table.providerAccountId),
+  userProviderUnique: uniqueIndex2("oauth_accounts_user_provider_unique").on(table.userId, table.provider),
+  userIdIdx: index2("oauth_accounts_user_id_idx").on(table.userId)
+}));
 var permissionsTable2 = sqliteTable("permissions", {
   ...baseFields2(5),
   name: text2("name").notNull().unique(),
@@ -153,10 +174,11 @@ var rolePermissionsTable2 = sqliteTable("role_permissions", {
   roleId: text2("role_id").notNull().references(() => rolesTable2.id, { onDelete: "cascade" }),
   permissionId: text2("permission_id").notNull().references(() => permissionsTable2.id, { onDelete: "cascade" })
 }, (table) => ({
-  uniq: uniqueIndex("role_permission_unique").on(table.roleId, table.permissionId)
+  uniq: uniqueIndex2("role_permission_unique").on(table.roleId, table.permissionId)
 }));
 var authSchema2 = {
   users: usersTable2,
+  oauthAccounts: oauthAccountsTable2,
   tokens: tokensTable2,
   roles: rolesTable2,
   permissions: permissionsTable2,
@@ -290,6 +312,9 @@ var CookieManager = class CookieManager2 {
   get cookieName() {
     return this.config.refreshCookieName || "refreshToken";
   }
+  get refreshCookiePath() {
+    return this.config.refreshCookiePath || "/";
+  }
   get sessionCookieName() {
     return this.config.session.name;
   }
@@ -304,10 +329,10 @@ var CookieManager = class CookieManager2 {
   // =========================================================================
   setRefreshToken(refreshToken) {
     const maxAge = timestring(this.config.jwt.refreshExpiresIn, "s");
-    this.cookieService.set(this.cookieName, refreshToken, { maxAge });
+    this.cookieService.set(this.cookieName, refreshToken, { maxAge, path: this.refreshCookiePath });
   }
   clearRefreshToken() {
-    this.cookieService.delete(this.cookieName);
+    this.cookieService.delete(this.cookieName, { path: this.refreshCookiePath });
   }
   getRefreshToken() {
     return this.cookieService.get(this.cookieName);
@@ -373,14 +398,14 @@ CookieManager = __decorate2([
 ], CookieManager);
 
 // src/auth/AuthController.ts
-import { Controller as Controller2 } from "najm-core";
-import { Get as Get2, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
-import { Body as Body2, User as User3, Headers } from "najm-core";
+import { Controller } from "najm-core";
+import { Get, Post, ResMsg } from "najm-core";
+import { Body, User as User3, Headers } from "najm-core";
 
 // src/auth/AuthService.ts
-import { Injectable as Injectable7, Inject as Inject8 } from "najm-core";
-import { Err as Err6, Log } from "najm-core";
-import { I18n as I18n5, I18nService as I18nService2 } from "najm-i18n";
+import { Injectable as Injectable8, Inject as Inject8 } from "najm-core";
+import { Err as Err8, Log } from "najm-core";
+import { I18n as I18n6, I18nService as I18nService2 } from "najm-i18n";
 import { EmailService, passwordResetTemplate, accountInviteTemplate } from "najm-email";
 import { nanoid as nanoid5 } from "nanoid";
 
@@ -388,7 +413,7 @@ import { nanoid as nanoid5 } from "nanoid";
 import { Injectable as Injectable5, Inject as Inject5 } from "najm-core";
 import { Transaction } from "najm-database";
 import { I18nService } from "najm-i18n";
-import { I18n as I18n3 } from "najm-i18n";
+import { I18n as I18n4 } from "najm-i18n";
 
 // src/users/UserRepository.ts
 import { eq as eq2, ne, sql as sql3 } from "drizzle-orm";
@@ -548,6 +573,15 @@ var UserRepository = class UserRepository2 {
     }).from(this.users).leftJoin(this.roles, eq2(this.users.roleId, this.roles.id)).where(eq2(this.users.email, email2));
     return existingUser;
   }
+  async getByEmailInsensitive(email2) {
+    const [existingUser] = await this.db.select({
+      ...this.q.userSelection(),
+      password: this.users.password,
+      failedLoginAttempts: this.users.failedLoginAttempts,
+      lockoutUntil: this.users.lockoutUntil
+    }).from(this.users).leftJoin(this.roles, eq2(this.users.roleId, this.roles.id)).where(sql3`lower(${this.users.email}) = ${email2.trim().toLowerCase()}`).limit(1);
+    return existingUser;
+  }
   async create(data) {
     const [newUser] = await this.db.insert(this.users).values(data).returning();
     return newUser;
@@ -758,7 +792,8 @@ UserValidator = __decorate4([
 ], UserValidator);
 
 // src/roles/RoleService.ts
-import { Injectable as Injectable4 } from "najm-core";
+import { Injectable as Injectable4, Err as Err3 } from "najm-core";
+import { I18n as I18n3 } from "najm-i18n";
 
 // src/roles/RoleRepository.ts
 import { eq as eq3 } from "drizzle-orm";
@@ -782,6 +817,14 @@ var RoleRepository = class RoleRepository2 {
   get roles() {
     return this.schema.roles;
   }
+  get users() {
+    return this.schema.users;
+  }
+  /** True if any user currently references this role (blocks deletion). */
+  async hasUsers(roleId) {
+    const rows = await this.db.select({ id: this.users.id }).from(this.users).where(eq3(this.users.roleId, roleId)).limit(1);
+    return rows.length > 0;
+  }
   async getAll() {
     return await this.db.select().from(this.roles);
   }
@@ -917,6 +960,7 @@ var RoleService = class RoleService2 {
   }
   roleRepository;
   roleValidator;
+  t;
   constructor(roleRepository, roleValidator) {
     this.roleRepository = roleRepository;
     this.roleValidator = roleValidator;
@@ -936,12 +980,21 @@ var RoleService = class RoleService2 {
     return await this.roleRepository.create(data);
   }
   async update(id, data) {
-    await this.roleValidator.checkRoleExists(id);
+    const role = await this.roleValidator.checkRoleExists(id);
+    if (role.name === ROLES.ADMIN && data.name && data.name !== ROLES.ADMIN) {
+      Err3(this.t("errors.cannotRenameSystem"), 403);
+    }
     await this.roleValidator.checkNameUnique(data.name, id);
     return await this.roleRepository.update(id, data);
   }
   async delete(id) {
-    await this.roleValidator.checkRoleExists(id);
+    const role = await this.roleValidator.checkRoleExists(id);
+    if (role.name === ROLES.ADMIN) {
+      Err3(this.t("errors.cannotDeleteSystem"), 403);
+    }
+    if (await this.roleRepository.hasUsers(id)) {
+      Err3(this.t("errors.roleInUse"), 409);
+    }
     return await this.roleRepository.delete(id);
   }
   async seedDefaultRoles(defaultRoles) {
@@ -960,6 +1013,10 @@ var RoleService = class RoleService2 {
     return role?.id;
   }
 };
+__decorate7([
+  I18n3("roles"),
+  __metadata7("design:type", Object)
+], RoleService.prototype, "t", void 0);
 RoleService = __decorate7([
   Injectable4(),
   __metadata7("design:paramtypes", [typeof (_a4 = typeof RoleRepository !== "undefined" && RoleRepository) === "function" ? _a4 : Object, typeof (_b2 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b2 : Object])
@@ -972,7 +1029,7 @@ import { nanoid as nanoid3 } from "nanoid";
 import * as fs from "fs/promises";
 import * as path from "path";
 import _isEmpty from "lodash.isempty";
-import { Err as Err3 } from "najm-core";
+import { Err as Err4 } from "najm-core";
 var avatarsPath = path.join(process.cwd(), "avatars");
 var parseSchema = /* @__PURE__ */ __name(async (schema, data) => {
   try {
@@ -980,7 +1037,7 @@ var parseSchema = /* @__PURE__ */ __name(async (schema, data) => {
   } catch (error) {
     const errors = error.issues || error.errors || [];
     const errorMessage = errors.map((err) => `${err.path.join(".")}: ${err.message}`).join("; ");
-    Err3(errorMessage);
+    Err4(errorMessage);
   }
 }, "parseSchema");
 var clean = /* @__PURE__ */ __name((obj) => {
@@ -1066,7 +1123,7 @@ var isPath = /* @__PURE__ */ __name((img) => typeof img === "string" && img.trim
 var isFile = /* @__PURE__ */ __name((img) => !!img && typeof img !== "string" && img instanceof File, "isFile");
 
 // src/users/UserService.ts
-import { Err as Err4 } from "najm-core";
+import { Err as Err5 } from "najm-core";
 var __decorate8 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1121,7 +1178,7 @@ var UserService = class UserService2 {
   }
   requireUser(user) {
     if (!user) {
-      Err4(this.t("errors.notFound"), 404);
+      Err5(this.t("errors.notFound"), 404);
     }
     return user;
   }
@@ -1135,12 +1192,12 @@ var UserService = class UserService2 {
       if (roleByName) {
         return roleByName.id;
       }
-      Err4(`Role '${roleName}' not found`);
+      Err5(`Role '${roleName}' not found`);
     }
     if (this.authConfig.defaultRole) {
       const defaultRole = await this.roleService.getByName(this.authConfig.defaultRole);
       if (!defaultRole) {
-        Err4(`Default role '${this.authConfig.defaultRole}' not found. Create it first or set defaultRole to null in auth config.`);
+        Err5(`Default role '${this.authConfig.defaultRole}' not found. Create it first or set defaultRole to null in auth config.`);
       }
       return defaultRole.id;
     }
@@ -1167,13 +1224,16 @@ var UserService = class UserService2 {
   async findByEmail(email2) {
     return await this.userRepository.getByEmail(email2);
   }
+  async findByEmailInsensitive(email2) {
+    return await this.userRepository.getByEmailInsensitive(email2);
+  }
   async getAuthRecordById(id) {
     return await this.userRepository.getRawById(id);
   }
   async create(data) {
     const { id, email: email2, name, image, emailVerified, password, roleId, role } = data;
     if (!password || typeof password !== "string" || password.trim().length === 0) {
-      Err4("Password is required");
+      Err5("Password is required");
     }
     this.userValidator.validatePasswordStrength(password);
     let userId = id || nanoid3(10);
@@ -1247,10 +1307,10 @@ var UserService = class UserService2 {
   }
   async seedAdminUser(config) {
     if (!config?.email || !config?.password) {
-      Err4("Admin email and password must be provided via config parameter");
+      Err5("Admin email and password must be provided via config parameter");
     }
     if (config.password.length < 12) {
-      Err4("Admin password must be at least 12 characters");
+      Err5("Admin password must be at least 12 characters");
     }
     const adminRole = await this.roleValidator.checkAdminRoleExists();
     const existingUser = await this.userRepository.getByEmail(config.email);
@@ -1279,7 +1339,7 @@ var UserService = class UserService2 {
   }
 };
 __decorate8([
-  I18n3("users"),
+  I18n4("users"),
   __metadata8("design:type", Object)
 ], UserService.prototype, "t", void 0);
 __decorate8([
@@ -1296,7 +1356,7 @@ UserService = __decorate8([
 
 // src/tokens/TokenService.ts
 import { Injectable as Injectable6, Inject as Inject7 } from "najm-core";
-import { I18n as I18n4 } from "najm-i18n";
+import { I18n as I18n5 } from "najm-i18n";
 import { CacheService } from "najm-cache";
 import { createHash } from "crypto";
 import jwt from "jsonwebtoken";
@@ -1413,7 +1473,7 @@ TokenRepository = __decorate9([
 
 // src/tokens/TokenService.ts
 import timestring2 from "timestring";
-import { Err as Err5 } from "najm-core";
+import { Err as Err6 } from "najm-core";
 var __decorate10 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1482,7 +1542,7 @@ var TokenService = class TokenService2 {
     if (authorization?.startsWith("Bearer ")) {
       return authorization.split(" ")[1];
     }
-    Err5(this.t("errors.tokenMissing"));
+    Err6(this.t("errors.tokenMissing"));
   }
   /**
    * Verify access token and check blacklist
@@ -1493,7 +1553,7 @@ var TokenService = class TokenService2 {
     try {
       payload = jwt.verify(token, this.config.jwt.accessSecret);
     } catch {
-      Err5(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"));
     }
     const sessionKey = this.sessionVersionKey(payload.userId);
     const blacklistKey = payload.jti ? `${this.blacklistPrefix}${payload.jti}` : null;
@@ -1506,15 +1566,15 @@ var TokenService = class TokenService2 {
     const values = await this.getCacheValues(keys);
     const valueByKey = new Map(keys.map((key, i) => [key, values[i]]));
     if (blacklistKey && valueByKey.get(blacklistKey) != null) {
-      Err5(this.t("errors.tokenRevoked"));
+      Err6(this.t("errors.tokenRevoked"));
     }
     if (familyKey && valueByKey.get(familyKey) != null) {
-      Err5(this.t("errors.tokenRevoked"));
+      Err6(this.t("errors.tokenRevoked"));
     }
     const activeSessionVersion = this.parseSessionVersion(valueByKey.get(sessionKey) ?? null);
     const tokenSessionVersion = payload.sessionVersion ?? 0;
     if (tokenSessionVersion !== activeSessionVersion) {
-      Err5(this.t("errors.tokenRevoked"));
+      Err6(this.t("errors.tokenRevoked"));
     }
     return payload;
   }
@@ -1523,13 +1583,13 @@ var TokenService = class TokenService2 {
     try {
       decoded = jwt.verify(token, this.config.jwt.refreshSecret);
     } catch {
-      Err5(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"));
     }
     if (decoded.type && decoded.type !== "refresh") {
-      Err5(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"));
     }
     if (!decoded.tokenFamily) {
-      Err5(this.t("errors.tokenVerificationFailed"));
+      Err6(this.t("errors.tokenVerificationFailed"));
     }
     return { userId: decoded.userId, tokenFamily: decoded.tokenFamily };
   }
@@ -1548,12 +1608,12 @@ var TokenService = class TokenService2 {
   async resolveUserFromCookie() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
-      Err5(this.t("errors.refreshTokenMissing"));
+      Err6(this.t("errors.refreshTokenMissing"));
     }
     const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err5(this.t("errors.refreshTokenInvalid"));
+      Err6(this.t("errors.refreshTokenInvalid"));
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
@@ -1563,7 +1623,7 @@ var TokenService = class TokenService2 {
     if (canRecover) {
       return userId;
     }
-    Err5(this.t("errors.refreshTokenInvalid"));
+    Err6(this.t("errors.refreshTokenInvalid"));
   }
   // ============ USER RETRIEVAL (MAIN METHOD) ============
   async getUser(auth2) {
@@ -1604,7 +1664,15 @@ var TokenService = class TokenService2 {
       await this.cache.set(this.sessionVersionKey(data.userId), String(sessionVersion), this.accessTokenTtlMs());
     }
     const token = jwt.sign({ ...data, jti, sessionVersion, exp: expiresAt }, this.config.jwt.accessSecret);
-    return { token, expiresAt };
+    return { token, expiresAt, sessionVersion };
+  }
+  /**
+   * Current per-user session version (0 when never invalidated). The signed
+   * session cookie stamps this so a fast-path reader can reject a cookie whose
+   * session was invalidated after it was written.
+   */
+  async getSessionVersion(userId) {
+    return this.getUserSessionVersion(userId);
   }
   /**
    * Generate access token with unique jti for blacklist support.
@@ -1643,6 +1711,7 @@ var TokenService = class TokenService2 {
       tokenFamily: family,
       roles: accessTokenData.roles,
       permissions: accessTokenData.permissions,
+      sessionVersion: access.sessionVersion,
       accessToken: access.token,
       refreshToken: refresh.token,
       accessTokenExpiresAt: access.expiresAt,
@@ -1710,12 +1779,12 @@ var TokenService = class TokenService2 {
   async refreshTokens() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
-      Err5(this.t("errors.refreshTokenMissing"));
+      Err6(this.t("errors.refreshTokenMissing"));
     }
     const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err5(this.t("errors.refreshTokenInvalid"));
+      Err6(this.t("errors.refreshTokenInvalid"));
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
@@ -1725,12 +1794,12 @@ var TokenService = class TokenService2 {
     if (canRecover) {
       const claimed = await this.tokenRepository.markPreviousUsed(tokenFamily, presentedHash);
       if (!claimed?.length) {
-        Err5(this.t("errors.refreshTokenInvalid"));
+        Err6(this.t("errors.refreshTokenInvalid"));
       }
       return this.generateTokens(userId, tokenFamily);
     }
     await this.revokeSuspectRefreshFamily(userId, tokenFamily);
-    Err5(this.t("errors.refreshTokenInvalid"));
+    Err6(this.t("errors.refreshTokenInvalid"));
   }
   /** Revoke every refresh session for a user (password change/reset, logout-all). */
   async revokeAllForUser(userId) {
@@ -1762,7 +1831,7 @@ var TokenService = class TokenService2 {
     const userId = await this.resolveUserFromCookie();
     const user = await this.getUserById(userId);
     if (!user) {
-      Err5(this.t("errors.refreshTokenInvalid"));
+      Err6(this.t("errors.refreshTokenInvalid"));
     }
     return user;
   }
@@ -1904,15 +1973,15 @@ var TokenService = class TokenService2 {
     try {
       decoded = jwt.verify(token, this.config.jwt.refreshSecret);
     } catch {
-      Err5(this.t("errors.resetTokenExpired"));
+      Err6(this.t("errors.resetTokenExpired"));
     }
     if (decoded.type !== "reset" && decoded.type !== "invite" || !decoded.jti) {
-      Err5(this.t("errors.invalidResetToken"));
+      Err6(this.t("errors.invalidResetToken"));
     }
     const key = `${this.resetTokenPrefix}${decoded.userId}`;
     const storedJti = await this.cache.get(key);
     if (!storedJti || storedJti !== decoded.jti) {
-      Err5(this.t("errors.invalidResetToken"));
+      Err6(this.t("errors.invalidResetToken"));
     }
     await this.cache.del(key);
     return decoded.userId;
@@ -1926,7 +1995,7 @@ __decorate10([
   __metadata10("design:type", Object)
 ], TokenService.prototype, "config", void 0);
 __decorate10([
-  I18n4("auth"),
+  I18n5("auth"),
   __metadata10("design:type", Object)
 ], TokenService.prototype, "t", void 0);
 TokenService = TokenService_1 = __decorate10([
@@ -1936,6 +2005,10 @@ TokenService = TokenService_1 = __decorate10([
 
 // src/auth/AuthService.ts
 import timestring3 from "timestring";
+
+// src/auth/AuthSessionService.ts
+import { Injectable as Injectable7 } from "najm-core";
+import { Err as Err7 } from "najm-core";
 var __decorate11 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1948,10 +2021,66 @@ var __metadata11 = function(k, v) {
 var _a7;
 var _b5;
 var _c3;
+var AuthSessionService = class AuthSessionService2 {
+  static {
+    __name(this, "AuthSessionService");
+  }
+  tokenService;
+  userService;
+  cookieManager;
+  constructor(tokenService, userService, cookieManager) {
+    this.tokenService = tokenService;
+    this.userService = userService;
+    this.cookieManager = cookieManager;
+  }
+  async establish(user) {
+    if (user.status !== "active") {
+      Err7("oauth_account_inactive", 403);
+    }
+    await this.tokenService.deleteExpiredSessions();
+    const generated = await this.tokenService.generateTokens(user.id);
+    this.cookieManager.setRefreshToken(generated.refreshToken);
+    await this.userService.updateLastLogin(user.id);
+    const { roles, permissions, sessionVersion } = generated;
+    this.cookieManager.setSessionCookie({
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        role: user.role ?? void 0,
+        status: user.status ?? void 0
+      },
+      roles,
+      permissions,
+      sessionVersion
+    });
+    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, sessionVersion: _sessionVersion, ...tokens } = generated;
+    return { ...tokens, user };
+  }
+};
+AuthSessionService = __decorate11([
+  Injectable7(),
+  __metadata11("design:paramtypes", [typeof (_a7 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a7 : Object, typeof (_b5 = typeof UserService !== "undefined" && UserService) === "function" ? _b5 : Object, typeof (_c3 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c3 : Object])
+], AuthSessionService);
+
+// src/auth/AuthService.ts
+var __decorate12 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata12 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a8;
+var _b6;
+var _c4;
 var _d2;
 var _e2;
 var _f2;
 var _g2;
+var _h2;
 var AuthService = class AuthService2 {
   static {
     __name(this, "AuthService");
@@ -1963,11 +2092,12 @@ var AuthService = class AuthService2 {
   cookieManager;
   i18nService;
   emailService;
+  authSessionService;
   config;
   t;
   logger;
   dummyHash;
-  constructor(tokenService, userService, userValidator, encryptionService, cookieManager, i18nService, emailService) {
+  constructor(tokenService, userService, userValidator, encryptionService, cookieManager, i18nService, emailService, authSessionService) {
     this.tokenService = tokenService;
     this.userService = userService;
     this.userValidator = userValidator;
@@ -1975,6 +2105,7 @@ var AuthService = class AuthService2 {
     this.cookieManager = cookieManager;
     this.i18nService = i18nService;
     this.emailService = emailService;
+    this.authSessionService = authSessionService;
   }
   isLockoutActive(lockoutUntil) {
     if (!lockoutUntil)
@@ -1993,7 +2124,13 @@ var AuthService = class AuthService2 {
     await this.getDummyHash();
   }
   async registerUser(body) {
-    return await this.userService.create(body);
+    return await this.userService.create({
+      name: body.name,
+      email: body.email,
+      password: body.password,
+      image: body.image,
+      emailVerified: false
+    });
   }
   /**
    * Admin-initiated account creation. The user is created with a random,
@@ -2019,15 +2156,17 @@ var AuthService = class AuthService2 {
     });
     const { token } = await this.tokenService.generateInviteToken(user.id);
     const inviteLink = `${this.config.frontendUrl}/reset-password?token=${token}`;
+    let emailSent = false;
     try {
       await this.emailService.sendHtml(body.email, this.t("emails.accountInvite.subject"), accountInviteTemplate({
         inviteLink,
         userName: user.name || body.email
       }));
+      emailSent = true;
     } catch (error) {
       this.logger.warn("Account invite email failed", { email: body.email, error });
     }
-    return user;
+    return { ...user, emailSent };
   }
   /**
    * Create a login for a person record. The branch is intentional and is the
@@ -2062,7 +2201,7 @@ var AuthService = class AuthService2 {
       user.lockoutUntil = null;
     }
     if (user && this.isLockoutActive(user.lockoutUntil)) {
-      Err6(this.t("errors.accountLocked"), 423);
+      Err8(this.t("errors.accountLocked"), 423);
     }
     const storedHash = user?.password ?? await this.getDummyHash();
     const isValid = await this.userValidator.comparePassword(password, storedHash);
@@ -2071,30 +2210,23 @@ var AuthService = class AuthService2 {
         const attempts = await this.userService.incrementFailedAttempts(user.id);
         if (attempts >= this.config.lockout.maxAttempts) {
           await this.userService.setLockout(user.id, this.nextLockoutUntil());
-          Err6(this.t("errors.accountLocked"), 423);
+          Err8(this.t("errors.accountLocked"), 423);
         }
       }
-      Err6(this.t("errors.invalidCredentials"));
+      Err8(this.t("errors.invalidCredentials"));
     }
     if (user.status !== "active") {
-      Err6(this.t("errors.accountInactive"));
+      Err8(this.t("errors.accountInactive"));
+    }
+    if (this.config.requireVerifiedEmail && !user.emailVerified) {
+      Err8(this.t("errors.emailNotVerified"), 403);
     }
     if ((user.failedLoginAttempts ?? 0) > 0 || user.lockoutUntil) {
       await this.userService.resetFailedAttempts(user.id);
     }
-    await this.tokenService.deleteExpiredSessions();
-    const generated = await this.tokenService.generateTokens(user.id);
-    this.cookieManager.setRefreshToken(generated.refreshToken);
-    await this.userService.updateLastLogin(user.id);
     const { password: _, failedLoginAttempts: __, lockoutUntil: ___, ...sanitized } = user;
-    const { roles, permissions } = generated;
-    this.cookieManager.setSessionCookie({
-      user: { id: sanitized.id, email: sanitized.email, name: sanitized.name, role: sanitized.role, status: sanitized.status ?? void 0 },
-      roles,
-      permissions
-    });
-    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, ...tokens } = generated;
-    return { ...tokens, user: sanitized };
+    this.authSessionService ??= new AuthSessionService(this.tokenService, this.userService, this.cookieManager);
+    return this.authSessionService.establish(sanitized);
   }
   async refreshTokens() {
     const generated = await this.tokenService.refreshTokens();
@@ -2104,10 +2236,11 @@ var AuthService = class AuthService2 {
       this.cookieManager.setSessionCookie({
         user: { id: user.id, email: user.email, name: user.name, role: user.role, status: user.status ?? void 0 },
         roles: generated.roles,
-        permissions: generated.permissions
+        permissions: generated.permissions,
+        sessionVersion: generated.sessionVersion
       });
     }
-    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, ...tokens } = generated;
+    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, sessionVersion: _sv, ...tokens } = generated;
     return tokens;
   }
   async logoutUser(userId, authorization) {
@@ -2153,7 +2286,7 @@ var AuthService = class AuthService2 {
         const lang = this.i18nService.getCurrentLanguage();
         result = { ...user, language: lang };
         const token = this.tokenService.decodeAccessToken(authorization.replace(/^Bearer\s+/i, ""));
-        cachePayload = { roles: token?.roles ?? [], permissions: token?.permissions ?? [] };
+        cachePayload = { roles: token?.roles ?? [], permissions: token?.permissions ?? [], sessionVersion: token?.sessionVersion ?? 0 };
       } else {
         result = await this.getUserFromCookie();
       }
@@ -2164,7 +2297,8 @@ var AuthService = class AuthService2 {
       this.cookieManager.setSessionCookie({
         user: { id: result.id, email: result.email, name: result.name, role: result.role, status: result.status ?? void 0 },
         roles: cachePayload.roles,
-        permissions: cachePayload.permissions
+        permissions: cachePayload.permissions,
+        sessionVersion: cachePayload.sessionVersion
       });
     }
     return result;
@@ -2188,11 +2322,11 @@ var AuthService = class AuthService2 {
   async changePassword(userId, currentPassword, newPassword) {
     const user = await this.userService.getAuthRecordById(userId);
     if (!user?.password) {
-      Err6(this.t("errors.invalidCredentials"));
+      Err8(this.t("errors.invalidCredentials"));
     }
     const isValid = await this.userValidator.comparePassword(currentPassword, user.password);
     if (!isValid) {
-      Err6(this.t("errors.invalidCredentials"));
+      Err8(this.t("errors.invalidCredentials"));
     }
     this.userValidator.validatePasswordStrength(newPassword);
     await this.userService.update(userId, { password: newPassword });
@@ -2213,33 +2347,33 @@ var AuthService = class AuthService2 {
     return { message: this.t("success.passwordReset") };
   }
 };
-__decorate11([
+__decorate12([
   Inject8(AUTH_CONFIG),
-  __metadata11("design:type", Object)
+  __metadata12("design:type", Object)
 ], AuthService.prototype, "config", void 0);
-__decorate11([
-  I18n5("auth"),
-  __metadata11("design:type", Object)
+__decorate12([
+  I18n6("auth"),
+  __metadata12("design:type", Object)
 ], AuthService.prototype, "t", void 0);
-__decorate11([
+__decorate12([
   Log(),
-  __metadata11("design:type", Object)
+  __metadata12("design:type", Object)
 ], AuthService.prototype, "logger", void 0);
-AuthService = __decorate11([
-  Injectable7(),
-  __metadata11("design:paramtypes", [typeof (_a7 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a7 : Object, typeof (_b5 = typeof UserService !== "undefined" && UserService) === "function" ? _b5 : Object, typeof (_c3 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c3 : Object, typeof (_d2 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _d2 : Object, typeof (_e2 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _e2 : Object, typeof (_f2 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _f2 : Object, typeof (_g2 = typeof EmailService !== "undefined" && EmailService) === "function" ? _g2 : Object])
+AuthService = __decorate12([
+  Injectable8(),
+  __metadata12("design:paramtypes", [typeof (_a8 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a8 : Object, typeof (_b6 = typeof UserService !== "undefined" && UserService) === "function" ? _b6 : Object, typeof (_c4 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c4 : Object, typeof (_d2 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _d2 : Object, typeof (_e2 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _e2 : Object, typeof (_f2 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _f2 : Object, typeof (_g2 = typeof EmailService !== "undefined" && EmailService) === "function" ? _g2 : Object, typeof (_h2 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _h2 : Object])
 ], AuthService);
 
 // src/auth/AuthGuard.ts
 import { Service as Service2, User } from "najm-core";
 import { createGuard } from "najm-guard";
-var __decorate12 = function(decorators, target, key, desc) {
+var __decorate13 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata12 = function(k, v) {
+var __metadata13 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param3 = function(paramIndex, decorator) {
@@ -2255,51 +2389,28 @@ var AuthGuard = class AuthGuard2 {
     return !!user;
   }
 };
-__decorate12([
+__decorate13([
   __param3(0, User()),
-  __metadata12("design:type", Function),
-  __metadata12("design:paramtypes", [Object]),
-  __metadata12("design:returntype", Boolean)
+  __metadata13("design:type", Function),
+  __metadata13("design:paramtypes", [Object]),
+  __metadata13("design:returntype", Boolean)
 ], AuthGuard.prototype, "canActivate", null);
-AuthGuard = __decorate12([
+AuthGuard = __decorate13([
   Service2()
 ], AuthGuard);
 var isAuth = createGuard(AuthGuard);
 
-// src/roles/index.ts
-var roles_exports = {};
-__export(roles_exports, {
-  ROLES: () => ROLES,
-  ROLE_GROUPS: () => ROLE_GROUPS,
-  Role: () => Role,
-  RoleController: () => RoleController,
-  RoleGuard: () => RoleGuard,
-  RoleRepository: () => RoleRepository,
-  RoleService: () => RoleService,
-  RoleValidator: () => RoleValidator,
-  assignRoleDto: () => assignRoleDto,
-  createRoleDto: () => createRoleDto,
-  defineRoles: () => defineRoles,
-  isAdmin: () => isAdmin,
-  isAdministrator: () => isAdministrator,
-  roleIdParam: () => roleIdParam,
-  updateRoleDto: () => updateRoleDto
-});
-
-// src/roles/defineRoles.ts
-import { composeGuards as composeGuards2, createGuard as createGuard3 } from "najm-guard";
-
 // src/roles/RoleGuards.ts
 import { Service as Service3 } from "najm-core";
 import { GuardParams, User as User2 } from "najm-core";
 import { composeGuards, createGuard as createGuard2 } from "najm-guard";
-var __decorate13 = function(decorators, target, key, desc) {
+var __decorate14 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata13 = function(k, v) {
+var __metadata14 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param4 = function(paramIndex, decorator) {
@@ -2322,86 +2433,96 @@ var RoleGuard = class RoleGuard2 {
     return false;
   }
 };
-__decorate13([
+__decorate14([
   __param4(0, GuardParams()),
   __param4(1, User2("role")),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [Object, String]),
-  __metadata13("design:returntype", void 0)
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object, String]),
+  __metadata14("design:returntype", void 0)
 ], RoleGuard.prototype, "canActivate", null);
-RoleGuard = __decorate13([
+RoleGuard = __decorate14([
   Service3()
 ], RoleGuard);
 var Role = createGuard2(RoleGuard);
 var isAdmin = composeGuards(isAuth(), Role(ROLES.ADMIN));
 var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
 
-// src/roles/defineRoles.ts
-var Role2 = createGuard3(RoleGuard);
-function defineRoles(roles, options) {
-  const ROLES2 = roles;
-  const superRoleKeys = options?.superRoles ?? [];
-  function resolveRoleValues(keys) {
-    return Array.from(new Set([...keys, ...superRoleKeys].map((key) => roles[key])));
-  }
-  __name(resolveRoleValues, "resolveRoleValues");
-  const guards2 = {};
-  for (const [key, value] of Object.entries(roles)) {
-    const name = `is${key.charAt(0).toUpperCase()}${key.slice(1).toLowerCase()}`;
-    const allowedValues = resolveRoleValues([key]);
-    guards2[name] = composeGuards2(isAuth(), Role2(allowedValues.length === 1 ? value : allowedValues));
-  }
-  function createGroupGuard(keys) {
-    const values = resolveRoleValues(keys);
-    return composeGuards2(isAuth(), Role2(values));
-  }
-  __name(createGroupGuard, "createGroupGuard");
-  function hasRole(userRole, ...keys) {
-    if (!userRole)
-      return false;
-    const normalized = userRole.toLowerCase();
-    return resolveRoleValues(keys).some((role) => role === normalized);
-  }
-  __name(hasRole, "hasRole");
-  function isInGroup(userRole, keys) {
-    return hasRole(userRole, ...keys);
-  }
-  __name(isInGroup, "isInGroup");
-  return { ROLES: ROLES2, createGroupGuard, hasRole, isInGroup, ...guards2 };
-}
-__name(defineRoles, "defineRoles");
-
-// src/roles/RoleController.ts
-import { Controller } from "najm-core";
-import { Get, Post, Put, Delete, ResMsg } from "najm-core";
-import { Params, Body } from "najm-core";
+// src/auth/AuthController.ts
 import { Validate } from "najm-validation";
+import { RateLimit } from "najm-rate";
+import { createHash as createHash2 } from "crypto";
 
-// src/roles/RoleDto.ts
+// src/users/UserDto.ts
 import { z } from "zod";
-var nameField = z.string().min(2, "Name must be at least 2 characters").max(50, "Name too long");
-var descriptionField = z.string().max(255, "Description too long").optional();
-var createRoleDto = z.object({
-  name: nameField,
-  description: descriptionField
+var emailField = z.string().email("Invalid email format");
+var passwordField = z.string().min(8, "Password must be at least 8 characters").refine((v) => new TextEncoder().encode(v).length <= 72, "Password must be at most 72 bytes").regex(/[A-Z]/, "Password must contain at least one uppercase letter").regex(/[a-z]/, "Password must contain at least one lowercase letter").regex(/\d/, "Password must contain at least one number");
+var optionalDateField = z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be in YYYY-MM-DD format").nullable().optional();
+var createUserDto = z.object({
+  name: z.string().max(100).optional(),
+  email: emailField,
+  password: passwordField,
+  roleId: z.string().min(1).optional(),
+  image: z.string().nullish(),
+  emailVerified: z.boolean().default(false),
+  status: z.enum(["active", "inactive", "pending"]).optional()
 });
-var updateRoleDto = createRoleDto.partial();
-var roleIdParam = z.object({
-  id: z.string().length(5, "Role ID must be 5 characters")
+var updateUserDto = createUserDto.partial();
+var registerDto = z.object({
+  name: z.string().max(100).optional(),
+  email: emailField,
+  password: passwordField,
+  image: z.string().nullish()
+});
+var inviteUserDto = z.object({
+  name: z.string().max(100).optional(),
+  email: emailField,
+  roleId: z.string().min(1).optional(),
+  image: z.string().nullish()
+});
+var userIdParam = z.object({
+  id: z.string().min(1, "User ID is required")
+});
+var loginDto = z.object({
+  email: emailField,
+  password: passwordField
+});
+var changePasswordDto = z.object({
+  currentPassword: passwordField,
+  newPassword: passwordField
+});
+var resetPasswordDto = z.object({
+  email: emailField
+});
+var confirmResetPasswordDto = z.object({
+  token: z.string().min(10, "Invalid reset token"),
+  newPassword: passwordField
+});
+var languageParam = z.object({
+  language: z.string().min(2)
+});
+var emailParam = z.object({
+  email: emailField
+});
+var userIdInParam = z.object({
+  userId: z.string().min(1, "User ID is required")
 });
-var assignRoleDto = z.object({
-  userId: z.string().length(8, "User ID must be 8 characters"),
-  roleId: z.string().length(5, "Role ID must be 5 characters")
+var assignRoleParams = z.object({
+  userId: z.string().min(1, "User ID is required"),
+  roleId: z.string().min(1)
+});
+var userListQuery = z.object({
+  limit: z.coerce.number().int().min(1).max(100).default(50),
+  offset: z.coerce.number().int().min(0).default(0)
 });
 
-// src/roles/RoleController.ts
-var __decorate14 = function(decorators, target, key, desc) {
+// src/auth/AuthController.ts
+var __decorate15 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata14 = function(k, v) {
+var __metadata15 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param5 = function(paramIndex, decorator) {
@@ -2409,202 +2530,43 @@ var __param5 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a8;
-var RoleController = class RoleController2 {
-  static {
-    __name(this, "RoleController");
+var _a9;
+var hashKeyPart = /* @__PURE__ */ __name((value) => createHash2("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
+var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
+  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+  const cookie = ctx.req.raw.headers.get("cookie") ?? "";
+  const fingerprint = cookie ? hashKeyPart(cookie) : "none";
+  return `${ip}:${fingerprint}`;
+}, "cookieFingerprint");
+var ipAndEmail = /* @__PURE__ */ __name(async (ctx) => {
+  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+  try {
+    const body = await ctx.req.json();
+    if (body?.email && typeof body.email === "string") {
+      const normalizedEmail = body.email.trim().toLowerCase();
+      if (normalizedEmail)
+        return `${ip}:${hashKeyPart(normalizedEmail)}`;
+    }
+  } catch {
   }
-  roleService;
-  constructor(roleService) {
-    this.roleService = roleService;
+  return ip;
+}, "ipAndEmail");
+var AuthController = class AuthController2 {
+  static {
+    __name(this, "AuthController");
   }
-  async getRoles() {
-    return this.roleService.getAll();
+  authService;
+  constructor(authService) {
+    this.authService = authService;
   }
-  async getRole(params) {
-    return this.roleService.getById(params.id);
+  async registerUser(body) {
+    return this.authService.registerUser(body);
   }
-  async createRole(body) {
-    return this.roleService.create(body);
+  async loginUser(body) {
+    return this.authService.loginUser(body);
   }
-  async updateRole(params, body) {
-    return this.roleService.update(params.id, body);
-  }
-  async deleteRole(params) {
-    return this.roleService.delete(params.id);
-  }
-};
-__decorate14([
-  Get(),
-  isAdmin(),
-  ResMsg("roles.success.retrieved"),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", []),
-  __metadata14("design:returntype", Promise)
-], RoleController.prototype, "getRoles", null);
-__decorate14([
-  Get("/:id"),
-  isAdmin(),
-  Validate({ params: roleIdParam }),
-  ResMsg("roles.success.retrieved"),
-  __param5(0, Params()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object]),
-  __metadata14("design:returntype", Promise)
-], RoleController.prototype, "getRole", null);
-__decorate14([
-  Post(),
-  isAdmin(),
-  Validate(createRoleDto),
-  ResMsg("roles.success.created"),
-  __param5(0, Body()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object]),
-  __metadata14("design:returntype", Promise)
-], RoleController.prototype, "createRole", null);
-__decorate14([
-  Put("/:id"),
-  isAdmin(),
-  Validate({
-    params: roleIdParam,
-    body: updateRoleDto
-  }),
-  ResMsg("roles.success.updated"),
-  __param5(0, Params()),
-  __param5(1, Body()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object, Object]),
-  __metadata14("design:returntype", Promise)
-], RoleController.prototype, "updateRole", null);
-__decorate14([
-  Delete("/:id"),
-  isAdmin(),
-  Validate({ params: roleIdParam }),
-  ResMsg("roles.success.deleted"),
-  __param5(0, Params()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object]),
-  __metadata14("design:returntype", Promise)
-], RoleController.prototype, "deleteRole", null);
-RoleController = __decorate14([
-  Controller("/roles"),
-  __metadata14("design:paramtypes", [typeof (_a8 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a8 : Object])
-], RoleController);
-
-// src/auth/AuthController.ts
-import { Validate as Validate2 } from "najm-validation";
-import { RateLimit } from "najm-rate";
-import { createHash as createHash2 } from "crypto";
-
-// src/users/UserDto.ts
-import { z as z2 } from "zod";
-var emailField = z2.string().email("Invalid email format");
-var passwordField = z2.string().min(8, "Password must be at least 8 characters");
-var optionalDateField = z2.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be in YYYY-MM-DD format").nullable().optional();
-var createUserDto = z2.object({
-  name: z2.string().max(100).optional(),
-  email: emailField,
-  password: passwordField,
-  roleId: z2.string().min(1).optional(),
-  image: z2.string().nullish(),
-  emailVerified: z2.boolean().default(false),
-  status: z2.enum(["active", "inactive", "pending"]).optional()
-});
-var updateUserDto = createUserDto.partial();
-var inviteUserDto = z2.object({
-  name: z2.string().max(100).optional(),
-  email: emailField,
-  roleId: z2.string().min(1).optional(),
-  image: z2.string().nullish()
-});
-var userIdParam = z2.object({
-  id: z2.string().min(1, "User ID is required")
-});
-var loginDto = z2.object({
-  email: emailField,
-  password: passwordField
-});
-var changePasswordDto = z2.object({
-  currentPassword: passwordField,
-  newPassword: passwordField
-});
-var resetPasswordDto = z2.object({
-  email: emailField
-});
-var confirmResetPasswordDto = z2.object({
-  token: z2.string().min(10, "Invalid reset token"),
-  newPassword: passwordField
-});
-var languageParam = z2.object({
-  language: z2.string().min(2)
-});
-var emailParam = z2.object({
-  email: emailField
-});
-var userIdInParam = z2.object({
-  userId: z2.string().min(1, "User ID is required")
-});
-var assignRoleParams = z2.object({
-  userId: z2.string().min(1, "User ID is required"),
-  roleId: z2.string().min(1)
-});
-var userListQuery = z2.object({
-  limit: z2.coerce.number().int().min(1).max(100).default(50),
-  offset: z2.coerce.number().int().min(0).default(0)
-});
-
-// src/auth/AuthController.ts
-var __decorate15 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata15 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param6 = function(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-};
-var _a9;
-var hashKeyPart = /* @__PURE__ */ __name((value) => createHash2("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
-var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
-  const cookie = ctx.req.raw.headers.get("cookie") ?? "";
-  const fingerprint = cookie ? hashKeyPart(cookie) : "none";
-  return `${ip}:${fingerprint}`;
-}, "cookieFingerprint");
-var ipAndEmail = /* @__PURE__ */ __name(async (ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
-  try {
-    const body = await ctx.req.json();
-    if (body?.email && typeof body.email === "string") {
-      const normalizedEmail = body.email.trim().toLowerCase();
-      if (normalizedEmail)
-        return `${ip}:${hashKeyPart(normalizedEmail)}`;
-    }
-  } catch {
-  }
-  return ip;
-}, "ipAndEmail");
-var AuthController = class AuthController2 {
-  static {
-    __name(this, "AuthController");
-  }
-  authService;
-  constructor(authService) {
-    this.authService = authService;
-  }
-  async registerUser(body) {
-    return this.authService.registerUser(body);
-  }
-  async loginUser(body) {
-    return this.authService.loginUser(body);
-  }
-  async inviteUser(body) {
-    return this.authService.inviteUser(body);
+  async inviteUser(body) {
+    return this.authService.inviteUser(body);
   }
   async refreshTokens() {
     return this.authService.refreshTokens();
@@ -2626,96 +2588,96 @@ var AuthController = class AuthController2 {
   }
 };
 __decorate15([
-  Post2("/register"),
+  Post("/register"),
   RateLimit({ limit: 5, window: "15m", key: ipAndEmail }),
-  Validate2(createUserDto),
-  ResMsg2("auth.success.register"),
-  __param6(0, Body2()),
+  Validate(registerDto),
+  ResMsg("auth.success.register"),
+  __param5(0, Body()),
   __metadata15("design:type", Function),
   __metadata15("design:paramtypes", [Object]),
   __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "registerUser", null);
 __decorate15([
-  Post2("/login"),
+  Post("/login"),
   RateLimit({ limit: 5, window: "15m", key: ipAndEmail, message: "Too many login attempts. Please try again later." }),
-  Validate2(loginDto),
-  ResMsg2("auth.success.login"),
-  __param6(0, Body2()),
+  Validate(loginDto),
+  ResMsg("auth.success.login"),
+  __param5(0, Body()),
   __metadata15("design:type", Function),
   __metadata15("design:paramtypes", [Object]),
   __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "loginUser", null);
 __decorate15([
-  Post2("/invite"),
+  Post("/invite"),
   isAdmin(),
   RateLimit({ limit: 20, window: "15m", key: "user" }),
-  Validate2(inviteUserDto),
-  ResMsg2("auth.success.accountInviteSent"),
-  __param6(0, Body2()),
+  Validate(inviteUserDto),
+  ResMsg("auth.success.accountInviteSent"),
+  __param5(0, Body()),
   __metadata15("design:type", Function),
   __metadata15("design:paramtypes", [Object]),
   __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "inviteUser", null);
 __decorate15([
-  Post2("/refresh"),
+  Post("/refresh"),
   RateLimit({ limit: 15, window: "15m", key: cookieFingerprint() }),
-  ResMsg2("auth.success.tokenRefreshed"),
+  ResMsg("auth.success.tokenRefreshed"),
   __metadata15("design:type", Function),
   __metadata15("design:paramtypes", []),
   __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "refreshTokens", null);
 __decorate15([
-  Post2("/logout"),
+  Post("/logout"),
   isAuth(),
   RateLimit({ limit: 10, window: "15m", key: "user" }),
-  __param6(0, User3("id")),
-  __param6(1, Headers("authorization")),
+  __param5(0, User3("id")),
+  __param5(1, Headers("authorization")),
   __metadata15("design:type", Function),
   __metadata15("design:paramtypes", [String, String]),
   __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "logoutUser", null);
 __decorate15([
-  Post2("/change-password"),
+  Post("/change-password"),
   isAuth(),
-  Validate2(changePasswordDto),
-  ResMsg2("auth.success.passwordChanged"),
-  __param6(0, User3("id")),
-  __param6(1, Body2()),
+  Validate(changePasswordDto),
+  ResMsg("auth.success.passwordChanged"),
+  __param5(0, User3("id")),
+  __param5(1, Body()),
   __metadata15("design:type", Function),
   __metadata15("design:paramtypes", [String, Object]),
   __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "changePassword", null);
 __decorate15([
-  Get2("/me"),
+  Get("/me"),
   RateLimit({ limit: 30, window: "1m", key: cookieFingerprint() }),
-  ResMsg2("auth.users.success.retrieved"),
-  __param6(0, Headers("authorization")),
+  ResMsg("auth.users.success.retrieved"),
+  __param5(0, Headers("authorization")),
   __metadata15("design:type", Function),
   __metadata15("design:paramtypes", [String]),
   __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "userProfile", null);
 __decorate15([
-  Post2("/forgot-password"),
+  Post("/forgot-password"),
   RateLimit({ limit: 3, window: "15m", key: ipAndEmail, message: "Too many password reset requests. Please try again later." }),
-  Validate2(resetPasswordDto),
-  ResMsg2("auth.success.passwordResetSent"),
-  __param6(0, Body2()),
+  Validate(resetPasswordDto),
+  ResMsg("auth.success.passwordResetSent"),
+  __param5(0, Body()),
   __metadata15("design:type", Function),
   __metadata15("design:paramtypes", [Object]),
   __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "forgotPassword", null);
 __decorate15([
-  Post2("/reset-password"),
+  Post("/reset-password"),
   RateLimit({ limit: 5, window: "15m", key: "ip", message: "Too many password reset attempts. Please try again later." }),
-  Validate2(confirmResetPasswordDto),
-  ResMsg2("auth.success.passwordReset"),
-  __param6(0, Body2()),
+  Validate(confirmResetPasswordDto),
+  ResMsg("auth.success.passwordReset"),
+  __param5(0, Body()),
   __metadata15("design:type", Function),
   __metadata15("design:paramtypes", [Object]),
   __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "resetPassword", null);
 AuthController = __decorate15([
-  Controller2("/auth"),
+  Controller("/auth"),
   __metadata15("design:paramtypes", [typeof (_a9 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a9 : Object])
 ], AuthController);
 
@@ -2778,6 +2740,10 @@ var AuthResolver = class AuthResolver2 {
       const session = cookieManager.getSessionCookie();
       if (!session)
         return false;
+      const tokenService = await this.container.resolve(TokenService);
+      const currentVersion = await tokenService.getSessionVersion(session.user.id);
+      if ((session.sessionVersion ?? 0) !== currentVersion)
+        return false;
       return {
         user: { ...session.user, permissions: session.permissions },
         role: session.user.role ?? session.roles[0],
@@ -2886,6 +2852,7 @@ __name(runAsUser, "runAsUser");
 // src/auth/index.ts
 var AUTH_MODULE = [
   AuthService,
+  AuthSessionService,
   CookieManager,
   EncryptionService,
   AuthGuard,
@@ -2908,6 +2875,7 @@ __export(users_exports, {
   inviteUserDto: () => inviteUserDto,
   languageParam: () => languageParam,
   loginDto: () => loginDto,
+  registerDto: () => registerDto,
   resetPasswordDto: () => resetPasswordDto,
   updateUserDto: () => updateUserDto,
   userIdInParam: () => userIdInParam,
@@ -2919,7 +2887,87 @@ __export(users_exports, {
 import { Controller as Controller3 } from "najm-core";
 import { Get as Get3, Post as Post3, Put as Put2, Delete as Delete2, ResMsg as ResMsg3 } from "najm-core";
 import { Params as Params2, Body as Body3, Query } from "najm-core";
-import { Validate as Validate3 } from "najm-validation";
+
+// src/roles/index.ts
+var roles_exports = {};
+__export(roles_exports, {
+  ROLES: () => ROLES,
+  ROLE_GROUPS: () => ROLE_GROUPS,
+  Role: () => Role,
+  RoleController: () => RoleController,
+  RoleGuard: () => RoleGuard,
+  RoleRepository: () => RoleRepository,
+  RoleService: () => RoleService,
+  RoleValidator: () => RoleValidator,
+  assignRoleDto: () => assignRoleDto,
+  createRoleDto: () => createRoleDto,
+  defineRoles: () => defineRoles,
+  isAdmin: () => isAdmin,
+  isAdministrator: () => isAdministrator,
+  roleIdParam: () => roleIdParam,
+  updateRoleDto: () => updateRoleDto
+});
+
+// src/roles/defineRoles.ts
+import { composeGuards as composeGuards2, createGuard as createGuard3 } from "najm-guard";
+var Role2 = createGuard3(RoleGuard);
+function defineRoles(roles, options) {
+  const ROLES2 = roles;
+  const superRoleKeys = options?.superRoles ?? [];
+  function resolveRoleValues(keys) {
+    return Array.from(new Set([...keys, ...superRoleKeys].map((key) => roles[key])));
+  }
+  __name(resolveRoleValues, "resolveRoleValues");
+  const guards2 = {};
+  for (const [key, value] of Object.entries(roles)) {
+    const name = `is${key.charAt(0).toUpperCase()}${key.slice(1).toLowerCase()}`;
+    const allowedValues = resolveRoleValues([key]);
+    guards2[name] = composeGuards2(isAuth(), Role2(allowedValues.length === 1 ? value : allowedValues));
+  }
+  function createGroupGuard(keys) {
+    const values = resolveRoleValues(keys);
+    return composeGuards2(isAuth(), Role2(values));
+  }
+  __name(createGroupGuard, "createGroupGuard");
+  function hasRole(userRole, ...keys) {
+    if (!userRole)
+      return false;
+    const normalized = userRole.toLowerCase();
+    return resolveRoleValues(keys).some((role) => role === normalized);
+  }
+  __name(hasRole, "hasRole");
+  function isInGroup(userRole, keys) {
+    return hasRole(userRole, ...keys);
+  }
+  __name(isInGroup, "isInGroup");
+  return { ROLES: ROLES2, createGroupGuard, hasRole, isInGroup, ...guards2 };
+}
+__name(defineRoles, "defineRoles");
+
+// src/roles/RoleController.ts
+import { Controller as Controller2 } from "najm-core";
+import { Get as Get2, Post as Post2, Put, Delete, ResMsg as ResMsg2 } from "najm-core";
+import { Params, Body as Body2 } from "najm-core";
+import { Validate as Validate2 } from "najm-validation";
+
+// src/roles/RoleDto.ts
+import { z as z2 } from "zod";
+var nameField = z2.string().min(2, "Name must be at least 2 characters").max(50, "Name too long");
+var descriptionField = z2.string().max(255, "Description too long").optional();
+var createRoleDto = z2.object({
+  name: nameField,
+  description: descriptionField
+});
+var updateRoleDto = createRoleDto.partial();
+var roleIdParam = z2.object({
+  id: z2.string().length(5, "Role ID must be 5 characters")
+});
+var assignRoleDto = z2.object({
+  userId: z2.string().length(8, "User ID must be 8 characters"),
+  roleId: z2.string().length(5, "Role ID must be 5 characters")
+});
+
+// src/roles/RoleController.ts
 var __decorate17 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -2929,12 +2977,110 @@ var __decorate17 = function(decorators, target, key, desc) {
 var __metadata17 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param7 = function(paramIndex, decorator) {
+var __param6 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
 var _a11;
+var RoleController = class RoleController2 {
+  static {
+    __name(this, "RoleController");
+  }
+  roleService;
+  constructor(roleService) {
+    this.roleService = roleService;
+  }
+  async getRoles() {
+    return this.roleService.getAll();
+  }
+  async getRole(params) {
+    return this.roleService.getById(params.id);
+  }
+  async createRole(body) {
+    return this.roleService.create(body);
+  }
+  async updateRole(params, body) {
+    return this.roleService.update(params.id, body);
+  }
+  async deleteRole(params) {
+    return this.roleService.delete(params.id);
+  }
+};
+__decorate17([
+  Get2(),
+  isAdmin(),
+  ResMsg2("roles.success.retrieved"),
+  __metadata17("design:type", Function),
+  __metadata17("design:paramtypes", []),
+  __metadata17("design:returntype", Promise)
+], RoleController.prototype, "getRoles", null);
+__decorate17([
+  Get2("/:id"),
+  isAdmin(),
+  Validate2({ params: roleIdParam }),
+  ResMsg2("roles.success.retrieved"),
+  __param6(0, Params()),
+  __metadata17("design:type", Function),
+  __metadata17("design:paramtypes", [Object]),
+  __metadata17("design:returntype", Promise)
+], RoleController.prototype, "getRole", null);
+__decorate17([
+  Post2(),
+  isAdmin(),
+  Validate2(createRoleDto),
+  ResMsg2("roles.success.created"),
+  __param6(0, Body2()),
+  __metadata17("design:type", Function),
+  __metadata17("design:paramtypes", [Object]),
+  __metadata17("design:returntype", Promise)
+], RoleController.prototype, "createRole", null);
+__decorate17([
+  Put("/:id"),
+  isAdmin(),
+  Validate2({
+    params: roleIdParam,
+    body: updateRoleDto
+  }),
+  ResMsg2("roles.success.updated"),
+  __param6(0, Params()),
+  __param6(1, Body2()),
+  __metadata17("design:type", Function),
+  __metadata17("design:paramtypes", [Object, Object]),
+  __metadata17("design:returntype", Promise)
+], RoleController.prototype, "updateRole", null);
+__decorate17([
+  Delete("/:id"),
+  isAdmin(),
+  Validate2({ params: roleIdParam }),
+  ResMsg2("roles.success.deleted"),
+  __param6(0, Params()),
+  __metadata17("design:type", Function),
+  __metadata17("design:paramtypes", [Object]),
+  __metadata17("design:returntype", Promise)
+], RoleController.prototype, "deleteRole", null);
+RoleController = __decorate17([
+  Controller2("/roles"),
+  __metadata17("design:paramtypes", [typeof (_a11 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a11 : Object])
+], RoleController);
+
+// src/users/UserController.ts
+import { Validate as Validate3 } from "najm-validation";
+var __decorate18 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata18 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param7 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var _a12;
 var UserController = class UserController2 {
   static {
     __name(this, "UserController");
@@ -2981,75 +3127,75 @@ var UserController = class UserController2 {
     return this.userService.removeRole(params.userId);
   }
 };
-__decorate17([
+__decorate18([
   Get3(),
   isAdmin(),
   Validate3({ query: userListQuery }),
   ResMsg3("users.success.retrieved"),
   __param7(0, Query()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "getUsers", null);
-__decorate17([
+__decorate18([
   Get3("/lang"),
   isAuth(),
   ResMsg3("users.success.retrieved"),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", []),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", []),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "getLang", null);
-__decorate17([
+__decorate18([
   Post3("/lang/:language"),
   isAuth(),
   Validate3({ params: languageParam }),
   ResMsg3("users.success.updated"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "updateLang", null);
-__decorate17([
+__decorate18([
   Get3("/:id"),
   isAdmin(),
   Validate3({ params: userIdParam }),
   ResMsg3("users.success.retrieved"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "getUser", null);
-__decorate17([
+__decorate18([
   Get3("/email/:email"),
   isAdmin(),
   Validate3({ params: emailParam }),
   ResMsg3("users.success.retrieved"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "getByEmail", null);
-__decorate17([
+__decorate18([
   Get3("/role/:userId"),
   isAdmin(),
   Validate3({ params: userIdInParam }),
   ResMsg3("users.success.retrieved"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "getRole", null);
-__decorate17([
+__decorate18([
   Post3(),
   isAdmin(),
   Validate3(createUserDto),
   ResMsg3("users.success.created"),
   __param7(0, Body3()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "create", null);
-__decorate17([
+__decorate18([
   Put2("/:id"),
   isAdmin(),
   Validate3({
@@ -3059,51 +3205,51 @@ __decorate17([
   ResMsg3("users.success.updated"),
   __param7(0, Params2()),
   __param7(1, Body3()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object, Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object, Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "update", null);
-__decorate17([
+__decorate18([
   Delete2("/:id"),
   isAdmin(),
   Validate3({ params: userIdParam }),
   ResMsg3("users.success.deleted"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "delete", null);
-__decorate17([
+__decorate18([
   Delete2(),
   isAdmin(),
   ResMsg3("users.success.allDeleted"),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", []),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", []),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "deleteAll", null);
-__decorate17([
+__decorate18([
   Post3("/assign/:userId/:roleId"),
   isAdmin(),
   Validate3({ params: assignRoleParams }),
   ResMsg3("users.success.updated"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "assignRole", null);
-__decorate17([
+__decorate18([
   Delete2("/remove/:userId"),
   isAdmin(),
   Validate3({ params: userIdInParam }),
   ResMsg3("users.success.updated"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "removeRole", null);
-UserController = __decorate17([
+UserController = __decorate18([
   Controller3("/users"),
-  __metadata17("design:paramtypes", [typeof (_a11 = typeof UserService !== "undefined" && UserService) === "function" ? _a11 : Object])
+  __metadata18("design:paramtypes", [typeof (_a12 = typeof UserService !== "undefined" && UserService) === "function" ? _a12 : Object])
 ], UserController);
 
 // src/permissions/index.ts
@@ -3126,13 +3272,13 @@ __export(permissions_exports, {
 import { eq as eq5, and as and2 } from "drizzle-orm";
 import { Repository as Repository4, Inject as Inject10 } from "najm-core";
 import { DB as DB4 } from "najm-database";
-var __decorate18 = function(decorators, target, key, desc) {
+var __decorate19 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata18 = function(k, v) {
+var __metadata19 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var PermissionRepository = class PermissionRepository2 {
@@ -3210,29 +3356,29 @@ var PermissionRepository = class PermissionRepository2 {
     return deletedPermissions;
   }
 };
-__decorate18([
+__decorate19([
   DB4(),
-  __metadata18("design:type", Object)
+  __metadata19("design:type", Object)
 ], PermissionRepository.prototype, "db", void 0);
-__decorate18([
+__decorate19([
   Inject10(AUTH_SCHEMA),
-  __metadata18("design:type", Object)
+  __metadata19("design:type", Object)
 ], PermissionRepository.prototype, "schema", void 0);
-PermissionRepository = __decorate18([
+PermissionRepository = __decorate19([
   Repository4()
 ], PermissionRepository);
 
 // src/permissions/PermissionGuards.ts
-import { Injectable as Injectable8 } from "najm-core";
+import { Injectable as Injectable9 } from "najm-core";
 import { GuardParams as GuardParams2, User as User4 } from "najm-core";
 import { createGuard as createGuard4, composeGuards as composeGuards3 } from "najm-guard";
-var __decorate19 = function(decorators, target, key, desc) {
+var __decorate20 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata19 = function(k, v) {
+var __metadata20 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param8 = function(paramIndex, decorator) {
@@ -3268,15 +3414,15 @@ var PermissionGuard = class PermissionGuard2 {
     return false;
   }
 };
-__decorate19([
+__decorate20([
   __param8(0, GuardParams2()),
   __param8(1, User4("permissions")),
-  __metadata19("design:type", Function),
-  __metadata19("design:paramtypes", [String, Array]),
-  __metadata19("design:returntype", Object)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [String, Array]),
+  __metadata20("design:returntype", Object)
 ], PermissionGuard.prototype, "canActivate", null);
-PermissionGuard = __decorate19([
-  Injectable8()
+PermissionGuard = __decorate20([
+  Injectable9()
 ], PermissionGuard);
 var Permission = createGuard4(PermissionGuard);
 var Can = /* @__PURE__ */ __name((permission) => composeGuards3(isAuth(), Permission(permission))(), "Can");
@@ -3287,23 +3433,23 @@ import { Get as Get4, Post as Post4, Put as Put3, Delete as Delete3, ResMsg as R
 import { Params as Params3, Body as Body4 } from "najm-core";
 
 // src/permissions/PermissionService.ts
-import { Injectable as Injectable10 } from "najm-core";
+import { Injectable as Injectable11 } from "najm-core";
 
 // src/permissions/PermissionValidator.ts
-import { Injectable as Injectable9 } from "najm-core";
-import { I18n as I18n6 } from "najm-i18n";
-import { Err as Err7 } from "najm-core";
-var __decorate20 = function(decorators, target, key, desc) {
+import { Injectable as Injectable10 } from "najm-core";
+import { I18n as I18n7 } from "najm-i18n";
+import { Err as Err9 } from "najm-core";
+var __decorate21 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata20 = function(k, v) {
+var __metadata21 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a12;
-var _b6;
+var _a13;
+var _b7;
 var PermissionValidator = class PermissionValidator2 {
   static {
     __name(this, "PermissionValidator");
@@ -3321,7 +3467,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExists(id) {
     const permission = await this.permissionRepository.getById(id);
     if (!permission) {
-      Err7(this.t("errors.notFound"), 404);
+      Err9(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3331,7 +3477,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExistsByName(name) {
     const permission = await this.permissionRepository.getByName(name);
     if (!permission) {
-      Err7(this.t("errors.notFound"), 404);
+      Err9(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3343,7 +3489,7 @@ var PermissionValidator = class PermissionValidator2 {
       return;
     const existingPermission = await this.permissionRepository.getByName(name);
     if (existingPermission && existingPermission.id !== excludeId) {
-      Err7(this.t("errors.nameExists"), 409);
+      Err9(this.t("errors.nameExists"), 409);
     }
   }
   /**
@@ -3366,32 +3512,32 @@ var PermissionValidator = class PermissionValidator2 {
     await this.checkPermissionExists(permissionId);
     const hasPermission = await this.permissionRepository.checkRoleHasPermission(roleId, permissionId);
     if (hasPermission) {
-      Err7(this.t("errors.roleAlreadyHasPermission"), 409);
+      Err9(this.t("errors.roleAlreadyHasPermission"), 409);
     }
   }
 };
-__decorate20([
-  I18n6("permissions"),
-  __metadata20("design:type", Object)
+__decorate21([
+  I18n7("permissions"),
+  __metadata21("design:type", Object)
 ], PermissionValidator.prototype, "t", void 0);
-PermissionValidator = __decorate20([
-  Injectable9(),
-  __metadata20("design:paramtypes", [typeof (_a12 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a12 : Object, typeof (_b6 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b6 : Object])
+PermissionValidator = __decorate21([
+  Injectable10(),
+  __metadata21("design:paramtypes", [typeof (_a13 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a13 : Object, typeof (_b7 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b7 : Object])
 ], PermissionValidator);
 
 // src/permissions/PermissionService.ts
-var __decorate21 = function(decorators, target, key, desc) {
+var __decorate22 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata21 = function(k, v) {
+var __metadata22 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a13;
-var _b7;
-var _c4;
+var _a14;
+var _b8;
+var _c5;
 var PermissionService = class PermissionService2 {
   static {
     __name(this, "PermissionService");
@@ -3496,9 +3642,9 @@ var PermissionService = class PermissionService2 {
     return await this.permissionRepository.deleteAll();
   }
 };
-PermissionService = __decorate21([
-  Injectable10(),
-  __metadata21("design:paramtypes", [typeof (_a13 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a13 : Object, typeof (_b7 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b7 : Object, typeof (_c4 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c4 : Object])
+PermissionService = __decorate22([
+  Injectable11(),
+  __metadata22("design:paramtypes", [typeof (_a14 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a14 : Object, typeof (_b8 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b8 : Object, typeof (_c5 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c5 : Object])
 ], PermissionService);
 
 // src/permissions/PermissionController.ts
@@ -3531,13 +3677,13 @@ var checkPermissionDto = z3.object({
 });
 
 // src/permissions/PermissionController.ts
-var __decorate22 = function(decorators, target, key, desc) {
+var __decorate23 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata22 = function(k, v) {
+var __metadata23 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param9 = function(paramIndex, decorator) {
@@ -3545,7 +3691,7 @@ var __param9 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a14;
+var _a15;
 var PermissionController = class PermissionController2 {
   static {
     __name(this, "PermissionController");
@@ -3591,32 +3737,32 @@ var PermissionController = class PermissionController2 {
     return this.permissionService.deleteAll();
   }
 };
-__decorate22([
+__decorate23([
   Get4(),
   ResMsg4("permissions.success.retrieved"),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", []),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", []),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "getPermissions", null);
-__decorate22([
+__decorate23([
   Get4("/:id"),
   Validate4({ params: permissionIdParam }),
   ResMsg4("permissions.success.retrieved"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "getPermission", null);
-__decorate22([
+__decorate23([
   Post4(),
   Validate4(createPermissionDto),
   ResMsg4({ message: "Permission created successfully", status: 201 }),
   __param9(0, Body4()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "create", null);
-__decorate22([
+__decorate23([
   Put3("/:id"),
   Validate4({
     params: permissionIdParam,
@@ -3625,67 +3771,67 @@ __decorate22([
   ResMsg4("permissions.success.updated"),
   __param9(0, Params3()),
   __param9(1, Body4()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object, Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object, Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "update", null);
-__decorate22([
+__decorate23([
   Delete3("/:id"),
   Validate4({ params: permissionIdParam }),
   ResMsg4("permissions.success.deleted"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "delete", null);
-__decorate22([
+__decorate23([
   Get4("/role/:id"),
   Validate4({ params: roleIdParam }),
   ResMsg4("permissions.success.retrieved"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "getByRole", null);
-__decorate22([
+__decorate23([
   Get4("/roles/:id"),
   Validate4({ params: permissionIdParam }),
   ResMsg4("permissions.success.retrieved"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "getRolesByPermission", null);
-__decorate22([
+__decorate23([
   Post4("/assign/:roleId/:permissionId"),
   Validate4({ params: assignPermissionDto }),
   ResMsg4("permissions.success.assigned"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "assignToRole", null);
-__decorate22([
+__decorate23([
   Delete3("/remove/:roleId/:permissionId"),
   Validate4({ params: assignPermissionDto }),
   ResMsg4("permissions.success.removed"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "removeFromRole", null);
-__decorate22([
+__decorate23([
   Delete3(),
   isAdmin(),
   ResMsg4("permissions.success.allDeleted"),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", []),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", []),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "deleteAll", null);
-PermissionController = __decorate22([
+PermissionController = __decorate23([
   Controller4("/permissions"),
   isAdmin(),
-  __metadata22("design:paramtypes", [typeof (_a14 = typeof PermissionService !== "undefined" && PermissionService) === "function" ? _a14 : Object])
+  __metadata23("design:paramtypes", [typeof (_a15 = typeof PermissionService !== "undefined" && PermissionService) === "function" ? _a15 : Object])
 ], PermissionController);
 
 // src/tokens/index.ts
@@ -3892,15 +4038,15 @@ function own(table, opts) {
 __name(own, "own");
 
 // src/ownership/configureOwnership.ts
-import { Injectable as Injectable11, Inject as Inject11, User as User5, Body as Body5, Params as Params4 } from "najm-core";
+import { Injectable as Injectable12, Inject as Inject11, User as User5, Body as Body5, Params as Params4 } from "najm-core";
 import { createGuard as createGuard5, composeGuards as composeGuards4 } from "najm-guard";
-var __decorate23 = function(decorators, target, key, desc) {
+var __decorate24 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata23 = function(k, v) {
+var __metadata24 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param10 = function(paramIndex, decorator) {
@@ -3920,7 +4066,7 @@ function toSingular(plural) {
 }
 __name(toSingular, "toSingular");
 function createResourceGuards(ownershipClass, resourceType, resource, options) {
-  var _a16, _b8;
+  var _a22, _b12;
   const writeGuard = options?.adminGuard ?? isAdmin;
   let AccessGuard = class AccessGuard {
     static {
@@ -3932,19 +4078,19 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
       return allowed ? { owner: user } : false;
     }
   };
-  __decorate23([
+  __decorate24([
     Inject11(ownershipClass),
-    __metadata23("design:type", Object)
+    __metadata24("design:type", Object)
   ], AccessGuard.prototype, "ownership", void 0);
-  __decorate23([
+  __decorate24([
     __param10(0, User5()),
     __param10(1, Params4("id")),
-    __metadata23("design:type", Function),
-    __metadata23("design:paramtypes", [Object, String]),
-    __metadata23("design:returntype", typeof (_a16 = typeof Promise !== "undefined" && Promise) === "function" ? _a16 : Object)
+    __metadata24("design:type", Function),
+    __metadata24("design:paramtypes", [Object, String]),
+    __metadata24("design:returntype", typeof (_a22 = typeof Promise !== "undefined" && Promise) === "function" ? _a22 : Object)
   ], AccessGuard.prototype, "canActivate", null);
-  AccessGuard = __decorate23([
-    Injectable11()
+  AccessGuard = __decorate24([
+    Injectable12()
   ], AccessGuard);
   let ListGuard = class ListGuard {
     static {
@@ -3956,18 +4102,18 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
       return { filter: ids };
     }
   };
-  __decorate23([
+  __decorate24([
     Inject11(ownershipClass),
-    __metadata23("design:type", Object)
+    __metadata24("design:type", Object)
   ], ListGuard.prototype, "ownership", void 0);
-  __decorate23([
+  __decorate24([
     __param10(0, User5()),
-    __metadata23("design:type", Function),
-    __metadata23("design:paramtypes", [Object]),
-    __metadata23("design:returntype", typeof (_b8 = typeof Promise !== "undefined" && Promise) === "function" ? _b8 : Object)
+    __metadata24("design:type", Function),
+    __metadata24("design:paramtypes", [Object]),
+    __metadata24("design:returntype", typeof (_b12 = typeof Promise !== "undefined" && Promise) === "function" ? _b12 : Object)
   ], ListGuard.prototype, "canActivate", null);
-  ListGuard = __decorate23([
-    Injectable11()
+  ListGuard = __decorate24([
+    Injectable12()
   ], ListGuard);
   const access = createGuard5(AccessGuard);
   const list = createGuard5(ListGuard);
@@ -4098,11 +4244,11 @@ function configureOwnership(config) {
       }
     }
   };
-  GeneratedOwnershipService = __decorate23([
-    Injectable11()
+  GeneratedOwnershipService = __decorate24([
+    Injectable12()
   ], GeneratedOwnershipService);
   function bodyGuard(resourceType, bodyField, optional = false) {
-    var _a16;
+    var _a22;
     let BodyAccessGuard = class BodyAccessGuard {
       static {
         __name(this, "BodyAccessGuard");
@@ -4115,19 +4261,19 @@ function configureOwnership(config) {
         return this.ownership.canAccess(user, resourceType, id);
       }
     };
-    __decorate23([
+    __decorate24([
       Inject11(GeneratedOwnershipService),
-      __metadata23("design:type", GeneratedOwnershipService)
+      __metadata24("design:type", GeneratedOwnershipService)
     ], BodyAccessGuard.prototype, "ownership", void 0);
-    __decorate23([
+    __decorate24([
       __param10(0, User5()),
       __param10(1, Body5()),
-      __metadata23("design:type", Function),
-      __metadata23("design:paramtypes", [Object, Object]),
-      __metadata23("design:returntype", typeof (_a16 = typeof Promise !== "undefined" && Promise) === "function" ? _a16 : Object)
+      __metadata24("design:type", Function),
+      __metadata24("design:paramtypes", [Object, Object]),
+      __metadata24("design:returntype", typeof (_a22 = typeof Promise !== "undefined" && Promise) === "function" ? _a22 : Object)
     ], BodyAccessGuard.prototype, "canActivate", null);
-    BodyAccessGuard = __decorate23([
-      Injectable11()
+    BodyAccessGuard = __decorate24([
+      Injectable12()
     ], BodyAccessGuard);
     return createGuard5(BodyAccessGuard);
   }
@@ -4242,18 +4388,18 @@ __name(Policy, "Policy");
 // src/ownership/OwnedDecorator.ts
 import "reflect-metadata";
 import { sql as sql5, and as and3 } from "drizzle-orm";
-import { Injectable as Injectable12, Inject as Inject12, DI as DI2, Container as Container2, REQUEST_ID } from "najm-core";
+import { Injectable as Injectable13, Inject as Inject12, DI as DI2, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
-var __decorate24 = function(decorators, target, key, desc) {
+var __decorate25 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata24 = function(k, v) {
+var __metadata25 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a15;
+var _a16;
 var OWNED_META = /* @__PURE__ */ Symbol.for("najm:owned");
 var ScopeContext = class ScopeContext2 {
   static {
@@ -4285,12 +4431,12 @@ var ScopeContext = class ScopeContext2 {
     }
   }
 };
-__decorate24([
+__decorate25([
   DI2(),
-  __metadata24("design:type", typeof (_a15 = typeof Container2 !== "undefined" && Container2) === "function" ? _a15 : Object)
+  __metadata25("design:type", typeof (_a16 = typeof Container2 !== "undefined" && Container2) === "function" ? _a16 : Object)
 ], ScopeContext.prototype, "container", void 0);
-ScopeContext = __decorate24([
-  Injectable12()
+ScopeContext = __decorate25([
+  Injectable13()
 ], ScopeContext);
 function Owned(token) {
   return function(target) {
@@ -4393,7 +4539,18 @@ var en_default = {
       unauthorized: "Unauthorized access",
       sessionExpired: "Session has expired",
       accountLocked: "Account is temporarily locked. Please try again later.",
-      accountInactive: "Account is inactive. Please contact support."
+      accountInactive: "Account is inactive. Please contact support.",
+      emailNotVerified: "Please verify your email address before signing in.",
+      oauthProviderDisabled: "Google sign-in is not configured.",
+      oauthStateInvalid: "The Google sign-in attempt is invalid or expired.",
+      oauthAccessDenied: "Google sign-in was cancelled.",
+      oauthProviderError: "Google sign-in could not be completed.",
+      oauthVerifiedEmailRequired: "Google must provide a verified email address.",
+      oauthAccountLinkRequired: "Sign in with your password and link Google from your account.",
+      oauthProviderAccountLinked: "This Google account is already linked.",
+      oauthSignupDisabled: "Registration with Google is disabled.",
+      oauthHostedDomainDenied: "This Google Workspace domain is not allowed.",
+      oauthLinkSessionExpired: "Your session changed before Google could be linked. Please try again."
     },
     success: {
       login: "Login successful",
@@ -4403,7 +4560,9 @@ var en_default = {
       passwordResetSent: "If that email exists, a reset link has been sent",
       passwordReset: "Password has been reset successfully",
       accountInviteSent: "Invitation sent successfully",
-      tokenRefreshed: "Token refreshed successfully"
+      tokenRefreshed: "Token refreshed successfully",
+      oauthLogin: "Google sign-in successful",
+      oauthLinked: "Google account linked successfully"
     },
     emails: {
       passwordReset: {
@@ -4436,7 +4595,9 @@ var en_default = {
       notFound: "Role not found",
       exists: "Role already exists",
       nameRequired: "Role name is required",
-      cannotDeleteSystem: "Cannot delete system role"
+      cannotDeleteSystem: "Cannot delete system role",
+      cannotRenameSystem: "Cannot rename the system admin role",
+      roleInUse: "Cannot delete a role that is assigned to users"
     },
     success: {
       created: "Role created successfully",
@@ -4477,6 +4638,674 @@ function getAuthLocale(lang) {
 __name(getAuthLocale, "getAuthLocale");
 var AUTH_SUPPORTED_LANGUAGES = Object.keys(AUTH_LOCALES);
 
+// src/oauth/google/GoogleOAuthProvider.ts
+import { Inject as Inject14, Injectable as Injectable15 } from "najm-core";
+
+// src/oauth/types.ts
+var OAuthFlowError = class extends Error {
+  static {
+    __name(this, "OAuthFlowError");
+  }
+  oauthCode;
+  status;
+  constructor(oauthCode, status = 400) {
+    super(oauthCode);
+    this.oauthCode = oauthCode;
+    this.status = status;
+    this.name = "OAuthFlowError";
+  }
+};
+
+// src/oauth/google/GoogleTokenVerifier.ts
+import { Inject as Inject13, Injectable as Injectable14 } from "najm-core";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+var __decorate26 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata26 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var GOOGLE_JWKS = createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
+var GoogleTokenVerifier = class GoogleTokenVerifier2 {
+  static {
+    __name(this, "GoogleTokenVerifier");
+  }
+  config;
+  jwks = GOOGLE_JWKS;
+  async verify(idToken, nonce) {
+    const google = this.googleConfig();
+    try {
+      const { payload } = await jwtVerify(idToken, this.jwks, {
+        issuer: ["https://accounts.google.com", "accounts.google.com"],
+        audience: google.clientId,
+        algorithms: ["RS256"]
+      });
+      if (payload.nonce !== nonce)
+        throw new OAuthFlowError("oauth_token_invalid");
+      if (typeof payload.sub !== "string" || !payload.sub) {
+        throw new OAuthFlowError("oauth_token_invalid");
+      }
+      if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
+        throw new OAuthFlowError("oauth_verified_email_required");
+      }
+      const hostedDomain = typeof payload.hd === "string" ? payload.hd.toLowerCase() : void 0;
+      if (google.allowedHostedDomains.length > 0 && (!hostedDomain || !google.allowedHostedDomains.includes(hostedDomain))) {
+        throw new OAuthFlowError("oauth_hosted_domain_denied", 403);
+      }
+      return {
+        provider: "google",
+        providerAccountId: payload.sub,
+        email: payload.email.trim().toLowerCase(),
+        emailVerified: true,
+        name: typeof payload.name === "string" ? payload.name : void 0,
+        picture: typeof payload.picture === "string" ? payload.picture : void 0,
+        hostedDomain
+      };
+    } catch (error) {
+      if (error instanceof OAuthFlowError)
+        throw error;
+      throw new OAuthFlowError("oauth_token_invalid");
+    }
+  }
+  googleConfig() {
+    const google = this.config.oauth?.google;
+    if (!google)
+      throw new OAuthFlowError("oauth_provider_disabled", 404);
+    return google;
+  }
+};
+__decorate26([
+  Inject13(AUTH_CONFIG),
+  __metadata26("design:type", Object)
+], GoogleTokenVerifier.prototype, "config", void 0);
+GoogleTokenVerifier = __decorate26([
+  Injectable14()
+], GoogleTokenVerifier);
+
+// src/oauth/google/GoogleOAuthProvider.ts
+var __decorate27 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata27 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a17;
+var AUTHORIZATION_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+var TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+var GoogleOAuthProvider = class GoogleOAuthProvider2 {
+  static {
+    __name(this, "GoogleOAuthProvider");
+  }
+  verifier;
+  config;
+  constructor(verifier) {
+    this.verifier = verifier;
+  }
+  authorizationUrl(attempt, codeChallenge) {
+    const google = this.googleConfig();
+    const url = new URL(AUTHORIZATION_ENDPOINT);
+    url.search = new URLSearchParams({
+      client_id: google.clientId,
+      redirect_uri: google.callbackUrl,
+      response_type: "code",
+      scope: "openid email profile",
+      state: attempt.state,
+      nonce: attempt.nonce,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256"
+    }).toString();
+    return url.toString();
+  }
+  async exchange(code, attempt) {
+    const google = this.googleConfig();
+    let response;
+    try {
+      response = await fetch(TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: google.clientId,
+          client_secret: google.clientSecret,
+          redirect_uri: google.callbackUrl,
+          grant_type: "authorization_code",
+          code_verifier: attempt.codeVerifier
+        }),
+        signal: AbortSignal.timeout(15e3)
+      });
+    } catch {
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    }
+    if (!response.ok)
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    }
+    const idToken = body.id_token;
+    if (typeof idToken !== "string" || !idToken) {
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    }
+    return this.verifier.verify(idToken, attempt.nonce);
+  }
+  googleConfig() {
+    const google = this.config.oauth?.google;
+    if (!google)
+      throw new OAuthFlowError("oauth_provider_disabled", 404);
+    return google;
+  }
+};
+__decorate27([
+  Inject14(AUTH_CONFIG),
+  __metadata27("design:type", Object)
+], GoogleOAuthProvider.prototype, "config", void 0);
+GoogleOAuthProvider = __decorate27([
+  Injectable15(),
+  __metadata27("design:paramtypes", [typeof (_a17 = typeof GoogleTokenVerifier !== "undefined" && GoogleTokenVerifier) === "function" ? _a17 : Object])
+], GoogleOAuthProvider);
+
+// src/oauth/OAuthAccountRepository.ts
+import { and as and4, eq as eq7 } from "drizzle-orm";
+import { Inject as Inject15, Repository as Repository5 } from "najm-core";
+import { DB as DB5 } from "najm-database";
+var __decorate28 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata28 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var OAuthAccountRepository = class OAuthAccountRepository2 {
+  static {
+    __name(this, "OAuthAccountRepository");
+  }
+  db;
+  schema;
+  get accounts() {
+    if (!this.schema.oauthAccounts) {
+      throw new OAuthFlowError("oauth_schema_missing", 500);
+    }
+    return this.schema.oauthAccounts;
+  }
+  async getByProviderAccount(provider, providerAccountId) {
+    const [account] = await this.db.select().from(this.accounts).where(and4(eq7(this.accounts.provider, provider), eq7(this.accounts.providerAccountId, providerAccountId))).limit(1);
+    return account;
+  }
+  async getByUserProvider(userId, provider) {
+    const [account] = await this.db.select().from(this.accounts).where(and4(eq7(this.accounts.userId, userId), eq7(this.accounts.provider, provider))).limit(1);
+    return account;
+  }
+  async create(data) {
+    const [account] = await this.db.insert(this.accounts).values(data).onConflictDoNothing().returning();
+    return account;
+  }
+};
+__decorate28([
+  DB5(),
+  __metadata28("design:type", Object)
+], OAuthAccountRepository.prototype, "db", void 0);
+__decorate28([
+  Inject15(AUTH_SCHEMA),
+  __metadata28("design:type", Object)
+], OAuthAccountRepository.prototype, "schema", void 0);
+OAuthAccountRepository = __decorate28([
+  Repository5()
+], OAuthAccountRepository);
+
+// src/oauth/OAuthAccountService.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { Inject as Inject16, Injectable as Injectable16 } from "najm-core";
+import { Transaction as Transaction2 } from "najm-database";
+var __decorate29 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata29 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a18;
+var _b9;
+var _c6;
+var _d3;
+var OAuthAccountService = class OAuthAccountService2 {
+  static {
+    __name(this, "OAuthAccountService");
+  }
+  accounts;
+  users;
+  config;
+  constructor(accounts, users) {
+    this.accounts = accounts;
+    this.users = users;
+  }
+  async resolveForLogin(identity) {
+    const linked = await this.accounts.getByProviderAccount("google", identity.providerAccountId);
+    if (linked)
+      return this.users.getById(linked.userId);
+    const existingUser = await this.users.findByEmailInsensitive(identity.email);
+    if (existingUser) {
+      if (!this.googleConfig().autoLinkVerifiedEmail) {
+        throw new OAuthFlowError("oauth_account_link_required", 409);
+      }
+      await this.createLink(existingUser.id, identity);
+      return this.users.getById(existingUser.id);
+    }
+    if (!this.googleConfig().allowSignup) {
+      throw new OAuthFlowError("oauth_signup_disabled", 403);
+    }
+    const password = `${randomBytes2(32).toString("base64url")}Aa1`;
+    const user = await this.users.create({
+      name: identity.name,
+      email: identity.email,
+      password,
+      image: identity.picture,
+      emailVerified: true
+    });
+    await this.createLink(user.id, identity);
+    return this.users.getById(user.id);
+  }
+  async linkUser(userId, identity) {
+    const user = await this.users.getById(userId);
+    if (user.status !== "active")
+      throw new OAuthFlowError("oauth_account_inactive", 403);
+    const providerAccount = await this.accounts.getByProviderAccount("google", identity.providerAccountId);
+    if (providerAccount && providerAccount.userId !== userId) {
+      throw new OAuthFlowError("oauth_provider_account_linked", 409);
+    }
+    if (providerAccount)
+      return user;
+    const userProvider = await this.accounts.getByUserProvider(userId, "google");
+    if (userProvider && userProvider.providerAccountId !== identity.providerAccountId) {
+      throw new OAuthFlowError("oauth_user_provider_linked", 409);
+    }
+    if (!userProvider)
+      await this.createLink(userId, identity);
+    return user;
+  }
+  async createLink(userId, identity) {
+    const created = await this.accounts.create({
+      userId,
+      provider: "google",
+      providerAccountId: identity.providerAccountId
+    });
+    if (created)
+      return;
+    const linked = await this.accounts.getByProviderAccount("google", identity.providerAccountId);
+    if (!linked || linked.userId !== userId) {
+      throw new OAuthFlowError("oauth_provider_account_linked", 409);
+    }
+  }
+  googleConfig() {
+    const google = this.config.oauth?.google;
+    if (!google)
+      throw new OAuthFlowError("oauth_provider_disabled", 404);
+    return google;
+  }
+};
+__decorate29([
+  Inject16(AUTH_CONFIG),
+  __metadata29("design:type", Object)
+], OAuthAccountService.prototype, "config", void 0);
+__decorate29([
+  Transaction2(),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [Object]),
+  __metadata29("design:returntype", typeof (_c6 = typeof Promise !== "undefined" && Promise) === "function" ? _c6 : Object)
+], OAuthAccountService.prototype, "resolveForLogin", null);
+__decorate29([
+  Transaction2(),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [String, Object]),
+  __metadata29("design:returntype", typeof (_d3 = typeof Promise !== "undefined" && Promise) === "function" ? _d3 : Object)
+], OAuthAccountService.prototype, "linkUser", null);
+OAuthAccountService = __decorate29([
+  Injectable16(),
+  __metadata29("design:paramtypes", [typeof (_a18 = typeof OAuthAccountRepository !== "undefined" && OAuthAccountRepository) === "function" ? _a18 : Object, typeof (_b9 = typeof UserService !== "undefined" && UserService) === "function" ? _b9 : Object])
+], OAuthAccountService);
+
+// src/oauth/OAuthController.ts
+import { createHash as createHash4 } from "crypto";
+import { Controller as Controller5, Ctx, Get as Get5, Post as Post5, Query as Query2, User as User6 } from "najm-core";
+import { RateLimit as RateLimit2 } from "najm-rate";
+
+// src/oauth/OAuthService.ts
+import { Inject as Inject17, Injectable as Injectable18, Log as Log2 } from "najm-core";
+
+// src/oauth/OAuthStateService.ts
+import { createHash as createHash3, randomBytes as randomBytes3, timingSafeEqual } from "crypto";
+import { Injectable as Injectable17 } from "najm-core";
+import { CookieService as CookieService2 } from "najm-cookies";
+var __decorate30 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata30 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a19;
+var _b10;
+var ATTEMPT_TTL_MS = 10 * 60 * 1e3;
+var COOKIE_PREFIX = "najm.oauth.google.";
+var OAuthStateService = class OAuthStateService2 {
+  static {
+    __name(this, "OAuthStateService");
+  }
+  cookies;
+  encryption;
+  constructor(cookies2, encryption) {
+    this.cookies = cookies2;
+    this.encryption = encryption;
+  }
+  create(input) {
+    const state = randomBytes3(32).toString("base64url");
+    const codeVerifier = randomBytes3(48).toString("base64url");
+    const attempt = {
+      provider: "google",
+      intent: input.intent,
+      state,
+      nonce: randomBytes3(32).toString("base64url"),
+      codeVerifier,
+      returnTo: this.validateReturnTo(input.returnTo),
+      userId: input.userId,
+      sessionVersion: input.sessionVersion,
+      createdAt: Date.now()
+    };
+    this.cookies.set(this.cookieName(state), this.encryption.encrypt(JSON.stringify(attempt)), {
+      httpOnly: true,
+      sameSite: "Lax",
+      path: "/",
+      maxAge: Math.floor(ATTEMPT_TTL_MS / 1e3)
+    });
+    return {
+      attempt,
+      codeChallenge: createHash3("sha256").update(codeVerifier).digest("base64url")
+    };
+  }
+  consume(state) {
+    if (!this.isSafeState(state))
+      throw new OAuthFlowError("oauth_state_invalid");
+    const name = this.cookieName(state);
+    const encrypted = this.cookies.get(name);
+    this.cookies.delete(name, { path: "/" });
+    if (!encrypted)
+      throw new OAuthFlowError("oauth_state_invalid");
+    try {
+      const attempt = JSON.parse(this.encryption.decrypt(encrypted));
+      const expected = Buffer.from(attempt.state);
+      const actual = Buffer.from(state);
+      if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+        throw new OAuthFlowError("oauth_state_invalid");
+      }
+      if (attempt.provider !== "google" || Date.now() - attempt.createdAt > ATTEMPT_TTL_MS) {
+        throw new OAuthFlowError("oauth_state_invalid");
+      }
+      attempt.returnTo = this.validateReturnTo(attempt.returnTo);
+      return attempt;
+    } catch (error) {
+      if (error instanceof OAuthFlowError)
+        throw error;
+      throw new OAuthFlowError("oauth_state_invalid");
+    }
+  }
+  validateReturnTo(value) {
+    const candidate = value?.trim() || "/";
+    if (!candidate.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\")) {
+      throw new OAuthFlowError("oauth_redirect_invalid");
+    }
+    try {
+      const base = new URL("https://najm.invalid");
+      const parsed = new URL(candidate, base);
+      if (parsed.origin !== base.origin || parsed.username || parsed.password) {
+        throw new OAuthFlowError("oauth_redirect_invalid");
+      }
+      return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+    } catch (error) {
+      if (error instanceof OAuthFlowError)
+        throw error;
+      throw new OAuthFlowError("oauth_redirect_invalid");
+    }
+  }
+  cookieName(state) {
+    return `${COOKIE_PREFIX}${state}`;
+  }
+  isSafeState(state) {
+    return /^[A-Za-z0-9_-]{40,128}$/.test(state);
+  }
+};
+OAuthStateService = __decorate30([
+  Injectable17(),
+  __metadata30("design:paramtypes", [typeof (_a19 = typeof CookieService2 !== "undefined" && CookieService2) === "function" ? _a19 : Object, typeof (_b10 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b10 : Object])
+], OAuthStateService);
+
+// src/oauth/OAuthService.ts
+var __decorate31 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata31 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a20;
+var _b11;
+var _c7;
+var _d4;
+var _e3;
+var _f3;
+var OAuthService = class OAuthService2 {
+  static {
+    __name(this, "OAuthService");
+  }
+  state;
+  google;
+  accounts;
+  sessions;
+  tokens;
+  users;
+  config;
+  logger;
+  constructor(state, google, accounts, sessions, tokens, users) {
+    this.state = state;
+    this.google = google;
+    this.accounts = accounts;
+    this.sessions = sessions;
+    this.tokens = tokens;
+    this.users = users;
+  }
+  startGoogleLogin(returnTo) {
+    this.googleConfig();
+    const { attempt, codeChallenge } = this.state.create({ intent: "login", returnTo });
+    return this.google.authorizationUrl(attempt, codeChallenge);
+  }
+  async startGoogleLink(userId, returnTo) {
+    this.googleConfig();
+    const user = await this.users.getById(userId);
+    if (user.status !== "active")
+      throw new OAuthFlowError("oauth_account_inactive", 403);
+    const sessionVersion = await this.tokens.getSessionVersion(userId);
+    const { attempt, codeChallenge } = this.state.create({
+      intent: "link",
+      returnTo,
+      userId,
+      sessionVersion
+    });
+    return { authorizationUrl: this.google.authorizationUrl(attempt, codeChallenge) };
+  }
+  async finishGoogleCallback(params) {
+    try {
+      this.googleConfig();
+      if (!params.state)
+        throw new OAuthFlowError("oauth_state_invalid");
+      const attempt = this.state.consume(params.state);
+      if (params.error) {
+        throw new OAuthFlowError(params.error === "access_denied" ? "oauth_access_denied" : "oauth_provider_error");
+      }
+      if (!params.code)
+        throw new OAuthFlowError("oauth_provider_error");
+      const identity = await this.google.exchange(params.code, attempt);
+      if (attempt.intent === "link") {
+        if (!attempt.userId || attempt.sessionVersion === void 0) {
+          throw new OAuthFlowError("oauth_state_invalid");
+        }
+        const currentVersion = await this.tokens.getSessionVersion(attempt.userId);
+        if (currentVersion !== attempt.sessionVersion) {
+          throw new OAuthFlowError("oauth_link_session_expired", 401);
+        }
+        await this.accounts.linkUser(attempt.userId, identity);
+      } else {
+        const user = await this.accounts.resolveForLogin(identity);
+        await this.sessions.establish(user);
+      }
+      return this.frontendSuccessUrl(attempt.returnTo, attempt.intent);
+    } catch (error) {
+      const code = this.publicErrorCode(error);
+      this.logger.warn("Google OAuth callback failed", { provider: "google", code });
+      return this.frontendErrorUrl(code);
+    }
+  }
+  frontendSuccessUrl(returnTo, mode) {
+    const google = this.googleConfig();
+    const url = new URL(google.frontendCallbackPath, this.config.frontendUrl);
+    url.searchParams.set("provider", "google");
+    url.searchParams.set("mode", mode);
+    url.searchParams.set("returnTo", this.state.validateReturnTo(returnTo));
+    return url.toString();
+  }
+  frontendErrorUrl(code) {
+    const path2 = this.config.oauth?.google?.errorRedirectPath ?? "/login";
+    const url = new URL(path2, this.config.frontendUrl);
+    url.searchParams.set("oauthError", code);
+    return url.toString();
+  }
+  publicErrorCode(error) {
+    if (error instanceof OAuthFlowError)
+      return error.oauthCode;
+    if (error instanceof Error && /^oauth_[a-z0-9_]+$/.test(error.message))
+      return error.message;
+    return "oauth_provider_error";
+  }
+  googleConfig() {
+    const google = this.config.oauth?.google;
+    if (!google)
+      throw new OAuthFlowError("oauth_provider_disabled", 404);
+    return google;
+  }
+};
+__decorate31([
+  Inject17(AUTH_CONFIG),
+  __metadata31("design:type", Object)
+], OAuthService.prototype, "config", void 0);
+__decorate31([
+  Log2(),
+  __metadata31("design:type", Object)
+], OAuthService.prototype, "logger", void 0);
+OAuthService = __decorate31([
+  Injectable18(),
+  __metadata31("design:paramtypes", [typeof (_a20 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a20 : Object, typeof (_b11 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b11 : Object, typeof (_c7 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _c7 : Object, typeof (_d4 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _d4 : Object, typeof (_e3 = typeof TokenService !== "undefined" && TokenService) === "function" ? _e3 : Object, typeof (_f3 = typeof UserService !== "undefined" && UserService) === "function" ? _f3 : Object])
+], OAuthService);
+
+// src/oauth/OAuthController.ts
+var __decorate32 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata32 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param11 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var _a21;
+var callbackKey = /* @__PURE__ */ __name((ctx) => {
+  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+  const state = ctx.req.query("state") ?? "none";
+  const fingerprint = createHash4("sha256").update(state).digest("base64url").slice(0, 24);
+  return `${ip}:${fingerprint}`;
+}, "callbackKey");
+var OAuthController = class OAuthController2 {
+  static {
+    __name(this, "OAuthController");
+  }
+  oauth;
+  constructor(oauth) {
+    this.oauth = oauth;
+  }
+  start(ctx, returnTo) {
+    return ctx.redirect(this.oauth.startGoogleLogin(returnTo), 302);
+  }
+  async callback(ctx, code, state, error) {
+    const redirect = await this.oauth.finishGoogleCallback({ code, state, error });
+    return ctx.redirect(redirect, 302);
+  }
+  link(userId, returnTo) {
+    return this.oauth.startGoogleLink(userId, returnTo);
+  }
+};
+__decorate32([
+  Get5("/start"),
+  RateLimit2({ limit: 20, window: "15m", key: "ip" }),
+  __param11(0, Ctx()),
+  __param11(1, Query2("returnTo")),
+  __metadata32("design:type", Function),
+  __metadata32("design:paramtypes", [Object, String]),
+  __metadata32("design:returntype", void 0)
+], OAuthController.prototype, "start", null);
+__decorate32([
+  Get5("/callback"),
+  RateLimit2({ limit: 20, window: "15m", key: callbackKey }),
+  __param11(0, Ctx()),
+  __param11(1, Query2("code")),
+  __param11(2, Query2("state")),
+  __param11(3, Query2("error")),
+  __metadata32("design:type", Function),
+  __metadata32("design:paramtypes", [Object, String, String, String]),
+  __metadata32("design:returntype", Promise)
+], OAuthController.prototype, "callback", null);
+__decorate32([
+  Post5("/link"),
+  isAuth(),
+  RateLimit2({ limit: 10, window: "15m", key: "user" }),
+  __param11(0, User6("id")),
+  __param11(1, Query2("returnTo")),
+  __metadata32("design:type", Function),
+  __metadata32("design:paramtypes", [String, String]),
+  __metadata32("design:returntype", void 0)
+], OAuthController.prototype, "link", null);
+OAuthController = __decorate32([
+  Controller5("/auth/oauth/google"),
+  __metadata32("design:paramtypes", [typeof (_a21 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a21 : Object])
+], OAuthController);
+
+// src/oauth/index.ts
+var OAUTH_MODULE = [
+  OAuthAccountRepository,
+  OAuthAccountService,
+  OAuthStateService,
+  GoogleTokenVerifier,
+  GoogleOAuthProvider,
+  OAuthService,
+  OAuthController
+];
+
 // src/AuthPlugin.ts
 var DEFAULT_JWT = {
   accessSecret: process.env.JWT_ACCESS_SECRET || "",
@@ -4484,7 +5313,47 @@ var DEFAULT_JWT = {
   refreshSecret: process.env.JWT_REFRESH_SECRET || "",
   refreshExpiresIn: process.env.REFRESH_EXPIRES_IN || "7d"
 };
-var mergeConfig = /* @__PURE__ */ __name((config) => {
+var validateFrontendPath = /* @__PURE__ */ __name((value, name) => {
+  if (!value.startsWith("/") || value.startsWith("//") || value.includes("\\")) {
+    throw new Error(`${name} must be a same-origin path starting with a single '/'`);
+  }
+  return value;
+}, "validateFrontendPath");
+var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
+  const configuredGoogle = config?.oauth?.google;
+  if (!configuredGoogle)
+    return void 0;
+  const google = configuredGoogle === true ? {} : configuredGoogle;
+  const clientId = google.clientId ?? process.env.GOOGLE_CLIENT_ID ?? "";
+  const clientSecret = google.clientSecret ?? process.env.GOOGLE_CLIENT_SECRET ?? "";
+  if (!clientId)
+    throw Err10.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
+  if (!clientSecret)
+    throw Err10.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
+  const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
+  const callbackUrl = google.callbackUrl ?? process.env.GOOGLE_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/google/callback`;
+  let callback;
+  try {
+    callback = new URL(callbackUrl);
+  } catch {
+    throw new Error("auth.oauth.google.callbackUrl must be an absolute URL");
+  }
+  const local = callback.hostname === "localhost" || callback.hostname === "127.0.0.1" || callback.hostname === "[::1]" || callback.hostname === "::1";
+  if (callback.protocol !== "https:" && !(local && callback.protocol === "http:")) {
+    throw new Error("auth.oauth.google.callbackUrl must use HTTPS (HTTP is allowed only for localhost)");
+  }
+  return {
+    clientId,
+    clientSecret,
+    callbackUrl: callback.toString(),
+    frontendCallbackPath: validateFrontendPath(google.frontendCallbackPath ?? "/auth/oauth/callback", "auth.oauth.google.frontendCallbackPath"),
+    errorRedirectPath: validateFrontendPath(google.errorRedirectPath ?? "/login", "auth.oauth.google.errorRedirectPath"),
+    allowSignup: google.allowSignup ?? true,
+    autoLinkVerifiedEmail: google.autoLinkVerifiedEmail ?? false,
+    allowedHostedDomains: [...new Set((google.allowedHostedDomains ?? []).map((domain) => domain.trim().toLowerCase()).filter(Boolean))]
+  };
+}, "resolveGoogleConfig");
+var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
   const bcryptRounds = config?.bcryptRounds ?? 10;
   if (!Number.isInteger(bcryptRounds) || bcryptRounds < 4 || bcryptRounds > 31) {
     throw new Error("auth.bcryptRounds must be an integer between 4 and 31");
@@ -4500,6 +5369,8 @@ var mergeConfig = /* @__PURE__ */ __name((config) => {
     defaultRole: config?.defaultRole ?? null,
     frontendUrl: config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000",
     registrationMode: config?.registrationMode ?? "active",
+    requireVerifiedEmail: config?.requireVerifiedEmail ?? false,
+    refreshCookiePath: config?.refreshCookiePath ?? "/",
     lockout: {
       maxAttempts: config?.lockout?.maxAttempts ?? 5,
       duration: config?.lockout?.duration ?? "15m"
@@ -4510,19 +5381,26 @@ var mergeConfig = /* @__PURE__ */ __name((config) => {
       maxAge: config?.session?.maxAge ?? 300,
       secret: config?.session?.secret
       // fallback to jwt.accessSecret at use site
+    },
+    oauth: {
+      google: resolveGoogleConfig(config)
     }
   };
   if (!finalConfig.jwt.accessSecret) {
-    throw Err8.configRequired("auth", "JWT_ACCESS_SECRET");
+    throw Err10.configRequired("auth", "JWT_ACCESS_SECRET");
   }
   if (!finalConfig.jwt.refreshSecret) {
-    throw Err8.configRequired("auth", "JWT_REFRESH_SECRET");
+    throw Err10.configRequired("auth", "JWT_REFRESH_SECRET");
   }
   return finalConfig;
-}, "mergeConfig");
-var selectSchema = /* @__PURE__ */ __name((config) => {
-  if (config?.schema)
+}, "resolveAuthConfig");
+var selectAuthSchema = /* @__PURE__ */ __name((config) => {
+  if (config?.schema) {
+    if (config.oauth?.google && !config.schema.oauthAccounts) {
+      throw new Error("auth.schema.oauthAccounts is required when Google OAuth is enabled");
+    }
     return config.schema;
+  }
   const dialect = config?.dialect ?? "pg";
   switch (dialect) {
     case "sqlite":
@@ -4531,8 +5409,8 @@ var selectSchema = /* @__PURE__ */ __name((config) => {
     default:
       return authSchema;
   }
-}, "selectSchema");
-var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email()).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, ScopeContext).config(AUTH_CONFIG, mergeConfig(config)).set(AUTH_SCHEMA, selectSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
+}, "selectAuthSchema");
+var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email(config?.email)).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_MODULE, OAUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, ScopeContext).config(AUTH_CONFIG, resolveAuthConfig(config)).set(AUTH_SCHEMA, selectAuthSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
 
 // src/seed.ts
 var toSeedId = /* @__PURE__ */ __name((prefix, value) => {
@@ -4678,6 +5556,7 @@ export {
   AuthQueries,
   AuthResolver,
   AuthService,
+  AuthSessionService,
   Can,
   CanCreate,
   CanDelete,
@@ -4746,12 +5625,14 @@ export {
   join2 as join,
   languageParam,
   loginDto,
+  oauthAccountsTable,
   own,
   parseSchema,
   permissionIdParam,
   permissionsTable,
   pickProps,
   refreshTokenDto,
+  registerDto,
   resetPasswordDto,
   revokeTokenDto,
   roleIdParam,