najm-auth 2.0.1 → 2.0.2

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/AuthPlugin.ts
-import { Err as Err9, plugin } from "najm-core";
+import { Err as Err10, plugin } from "najm-core";
 import { cache } from "najm-cache";
 
 // src/auth.tokens.ts
@@ -18,7 +18,7 @@ var AUTH_PERMISSIONS = /* @__PURE__ */ Symbol.for("najm:auth:permissions");
 var AUTH_ENCRYPTION_KEY = /* @__PURE__ */ Symbol.for("najm:auth:encryption-key");
 
 // src/schema/pg.ts
-import { pgTable, text, boolean, timestamp, pgEnum, primaryKey, integer, index } from "drizzle-orm/pg-core";
+import { pgTable, text, boolean, timestamp, pgEnum, primaryKey, integer, index, uniqueIndex } from "drizzle-orm/pg-core";
 import { sql } from "drizzle-orm";
 import { nanoid } from "nanoid";
 
@@ -58,6 +58,16 @@ var usersTable = pgTable("users", {
 }, (table) => ({
   roleIdx: index("users_role_id_idx").on(table.roleId)
 }));
+var oauthAccountsTable = pgTable("oauth_accounts", {
+  ...baseFields(10),
+  userId: text("user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+  provider: text("provider").notNull(),
+  providerAccountId: text("provider_account_id").notNull()
+}, (table) => ({
+  providerAccountUnique: uniqueIndex("oauth_accounts_provider_account_unique").on(table.provider, table.providerAccountId),
+  userProviderUnique: uniqueIndex("oauth_accounts_user_provider_unique").on(table.userId, table.provider),
+  userIdIdx: index("oauth_accounts_user_id_idx").on(table.userId)
+}));
 var permissionsTable = pgTable("permissions", {
   ...baseFields(5),
   name: text("name").notNull().unique(),
@@ -89,6 +99,7 @@ var rolePermissionsTable = pgTable("role_permissions", {
 }));
 var authSchema = {
   users: usersTable,
+  oauthAccounts: oauthAccountsTable,
   tokens: tokensTable,
   roles: rolesTable,
   permissions: permissionsTable,
@@ -96,7 +107,7 @@ var authSchema = {
 };
 
 // src/schema/sqlite.ts
-import { sqliteTable, text as text2, integer as integer2, uniqueIndex, index as index2 } from "drizzle-orm/sqlite-core";
+import { sqliteTable, text as text2, integer as integer2, uniqueIndex as uniqueIndex2, index as index2 } from "drizzle-orm/sqlite-core";
 import { sql as sql2 } from "drizzle-orm";
 import { nanoid as nanoid2 } from "nanoid";
 var baseFields2 = /* @__PURE__ */ __name((idLength = 5) => ({
@@ -126,6 +137,16 @@ var usersTable2 = sqliteTable("users", {
 }, (table) => ({
   roleIdx: index2("users_role_id_idx").on(table.roleId)
 }));
+var oauthAccountsTable2 = sqliteTable("oauth_accounts", {
+  ...baseFields2(10),
+  userId: text2("user_id").notNull().references(() => usersTable2.id, { onDelete: "cascade" }),
+  provider: text2("provider").notNull(),
+  providerAccountId: text2("provider_account_id").notNull()
+}, (table) => ({
+  providerAccountUnique: uniqueIndex2("oauth_accounts_provider_account_unique").on(table.provider, table.providerAccountId),
+  userProviderUnique: uniqueIndex2("oauth_accounts_user_provider_unique").on(table.userId, table.provider),
+  userIdIdx: index2("oauth_accounts_user_id_idx").on(table.userId)
+}));
 var permissionsTable2 = sqliteTable("permissions", {
   ...baseFields2(5),
   name: text2("name").notNull().unique(),
@@ -153,10 +174,11 @@ var rolePermissionsTable2 = sqliteTable("role_permissions", {
   roleId: text2("role_id").notNull().references(() => rolesTable2.id, { onDelete: "cascade" }),
   permissionId: text2("permission_id").notNull().references(() => permissionsTable2.id, { onDelete: "cascade" })
 }, (table) => ({
-  uniq: uniqueIndex("role_permission_unique").on(table.roleId, table.permissionId)
+  uniq: uniqueIndex2("role_permission_unique").on(table.roleId, table.permissionId)
 }));
 var authSchema2 = {
   users: usersTable2,
+  oauthAccounts: oauthAccountsTable2,
   tokens: tokensTable2,
   roles: rolesTable2,
   permissions: permissionsTable2,
@@ -381,8 +403,8 @@ import { Get, Post, ResMsg } from "najm-core";
 import { Body, User as User3, Headers } from "najm-core";
 
 // src/auth/AuthService.ts
-import { Injectable as Injectable7, Inject as Inject8 } from "najm-core";
-import { Err as Err7, Log } from "najm-core";
+import { Injectable as Injectable8, Inject as Inject8 } from "najm-core";
+import { Err as Err8, Log } from "najm-core";
 import { I18n as I18n6, I18nService as I18nService2 } from "najm-i18n";
 import { EmailService, passwordResetTemplate, accountInviteTemplate } from "najm-email";
 import { nanoid as nanoid5 } from "nanoid";
@@ -551,6 +573,15 @@ var UserRepository = class UserRepository2 {
     }).from(this.users).leftJoin(this.roles, eq2(this.users.roleId, this.roles.id)).where(eq2(this.users.email, email2));
     return existingUser;
   }
+  async getByEmailInsensitive(email2) {
+    const [existingUser] = await this.db.select({
+      ...this.q.userSelection(),
+      password: this.users.password,
+      failedLoginAttempts: this.users.failedLoginAttempts,
+      lockoutUntil: this.users.lockoutUntil
+    }).from(this.users).leftJoin(this.roles, eq2(this.users.roleId, this.roles.id)).where(sql3`lower(${this.users.email}) = ${email2.trim().toLowerCase()}`).limit(1);
+    return existingUser;
+  }
   async create(data) {
     const [newUser] = await this.db.insert(this.users).values(data).returning();
     return newUser;
@@ -1193,6 +1224,9 @@ var UserService = class UserService2 {
   async findByEmail(email2) {
     return await this.userRepository.getByEmail(email2);
   }
+  async findByEmailInsensitive(email2) {
+    return await this.userRepository.getByEmailInsensitive(email2);
+  }
   async getAuthRecordById(id) {
     return await this.userRepository.getRawById(id);
   }
@@ -1971,6 +2005,10 @@ TokenService = TokenService_1 = __decorate10([
 
 // src/auth/AuthService.ts
 import timestring3 from "timestring";
+
+// src/auth/AuthSessionService.ts
+import { Injectable as Injectable7 } from "najm-core";
+import { Err as Err7 } from "najm-core";
 var __decorate11 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1983,10 +2021,66 @@ var __metadata11 = function(k, v) {
 var _a7;
 var _b5;
 var _c3;
+var AuthSessionService = class AuthSessionService2 {
+  static {
+    __name(this, "AuthSessionService");
+  }
+  tokenService;
+  userService;
+  cookieManager;
+  constructor(tokenService, userService, cookieManager) {
+    this.tokenService = tokenService;
+    this.userService = userService;
+    this.cookieManager = cookieManager;
+  }
+  async establish(user) {
+    if (user.status !== "active") {
+      Err7("oauth_account_inactive", 403);
+    }
+    await this.tokenService.deleteExpiredSessions();
+    const generated = await this.tokenService.generateTokens(user.id);
+    this.cookieManager.setRefreshToken(generated.refreshToken);
+    await this.userService.updateLastLogin(user.id);
+    const { roles, permissions, sessionVersion } = generated;
+    this.cookieManager.setSessionCookie({
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        role: user.role ?? void 0,
+        status: user.status ?? void 0
+      },
+      roles,
+      permissions,
+      sessionVersion
+    });
+    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, sessionVersion: _sessionVersion, ...tokens } = generated;
+    return { ...tokens, user };
+  }
+};
+AuthSessionService = __decorate11([
+  Injectable7(),
+  __metadata11("design:paramtypes", [typeof (_a7 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a7 : Object, typeof (_b5 = typeof UserService !== "undefined" && UserService) === "function" ? _b5 : Object, typeof (_c3 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c3 : Object])
+], AuthSessionService);
+
+// src/auth/AuthService.ts
+var __decorate12 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata12 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a8;
+var _b6;
+var _c4;
 var _d2;
 var _e2;
 var _f2;
 var _g2;
+var _h2;
 var AuthService = class AuthService2 {
   static {
     __name(this, "AuthService");
@@ -1998,11 +2092,12 @@ var AuthService = class AuthService2 {
   cookieManager;
   i18nService;
   emailService;
+  authSessionService;
   config;
   t;
   logger;
   dummyHash;
-  constructor(tokenService, userService, userValidator, encryptionService, cookieManager, i18nService, emailService) {
+  constructor(tokenService, userService, userValidator, encryptionService, cookieManager, i18nService, emailService, authSessionService) {
     this.tokenService = tokenService;
     this.userService = userService;
     this.userValidator = userValidator;
@@ -2010,6 +2105,7 @@ var AuthService = class AuthService2 {
     this.cookieManager = cookieManager;
     this.i18nService = i18nService;
     this.emailService = emailService;
+    this.authSessionService = authSessionService;
   }
   isLockoutActive(lockoutUntil) {
     if (!lockoutUntil)
@@ -2105,7 +2201,7 @@ var AuthService = class AuthService2 {
       user.lockoutUntil = null;
     }
     if (user && this.isLockoutActive(user.lockoutUntil)) {
-      Err7(this.t("errors.accountLocked"), 423);
+      Err8(this.t("errors.accountLocked"), 423);
     }
     const storedHash = user?.password ?? await this.getDummyHash();
     const isValid = await this.userValidator.comparePassword(password, storedHash);
@@ -2114,34 +2210,23 @@ var AuthService = class AuthService2 {
         const attempts = await this.userService.incrementFailedAttempts(user.id);
         if (attempts >= this.config.lockout.maxAttempts) {
           await this.userService.setLockout(user.id, this.nextLockoutUntil());
-          Err7(this.t("errors.accountLocked"), 423);
+          Err8(this.t("errors.accountLocked"), 423);
         }
       }
-      Err7(this.t("errors.invalidCredentials"));
+      Err8(this.t("errors.invalidCredentials"));
     }
     if (user.status !== "active") {
-      Err7(this.t("errors.accountInactive"));
+      Err8(this.t("errors.accountInactive"));
     }
     if (this.config.requireVerifiedEmail && !user.emailVerified) {
-      Err7(this.t("errors.emailNotVerified"), 403);
+      Err8(this.t("errors.emailNotVerified"), 403);
     }
     if ((user.failedLoginAttempts ?? 0) > 0 || user.lockoutUntil) {
       await this.userService.resetFailedAttempts(user.id);
     }
-    await this.tokenService.deleteExpiredSessions();
-    const generated = await this.tokenService.generateTokens(user.id);
-    this.cookieManager.setRefreshToken(generated.refreshToken);
-    await this.userService.updateLastLogin(user.id);
     const { password: _, failedLoginAttempts: __, lockoutUntil: ___, ...sanitized } = user;
-    const { roles, permissions, sessionVersion } = generated;
-    this.cookieManager.setSessionCookie({
-      user: { id: sanitized.id, email: sanitized.email, name: sanitized.name, role: sanitized.role, status: sanitized.status ?? void 0 },
-      roles,
-      permissions,
-      sessionVersion
-    });
-    const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, sessionVersion: _sv, ...tokens } = generated;
-    return { ...tokens, user: sanitized };
+    this.authSessionService ??= new AuthSessionService(this.tokenService, this.userService, this.cookieManager);
+    return this.authSessionService.establish(sanitized);
   }
   async refreshTokens() {
     const generated = await this.tokenService.refreshTokens();
@@ -2237,11 +2322,11 @@ var AuthService = class AuthService2 {
   async changePassword(userId, currentPassword, newPassword) {
     const user = await this.userService.getAuthRecordById(userId);
     if (!user?.password) {
-      Err7(this.t("errors.invalidCredentials"));
+      Err8(this.t("errors.invalidCredentials"));
     }
     const isValid = await this.userValidator.comparePassword(currentPassword, user.password);
     if (!isValid) {
-      Err7(this.t("errors.invalidCredentials"));
+      Err8(this.t("errors.invalidCredentials"));
     }
     this.userValidator.validatePasswordStrength(newPassword);
     await this.userService.update(userId, { password: newPassword });
@@ -2262,33 +2347,33 @@ var AuthService = class AuthService2 {
     return { message: this.t("success.passwordReset") };
   }
 };
-__decorate11([
+__decorate12([
   Inject8(AUTH_CONFIG),
-  __metadata11("design:type", Object)
+  __metadata12("design:type", Object)
 ], AuthService.prototype, "config", void 0);
-__decorate11([
+__decorate12([
   I18n6("auth"),
-  __metadata11("design:type", Object)
+  __metadata12("design:type", Object)
 ], AuthService.prototype, "t", void 0);
-__decorate11([
+__decorate12([
   Log(),
-  __metadata11("design:type", Object)
+  __metadata12("design:type", Object)
 ], AuthService.prototype, "logger", void 0);
-AuthService = __decorate11([
-  Injectable7(),
-  __metadata11("design:paramtypes", [typeof (_a7 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a7 : Object, typeof (_b5 = typeof UserService !== "undefined" && UserService) === "function" ? _b5 : Object, typeof (_c3 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c3 : Object, typeof (_d2 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _d2 : Object, typeof (_e2 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _e2 : Object, typeof (_f2 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _f2 : Object, typeof (_g2 = typeof EmailService !== "undefined" && EmailService) === "function" ? _g2 : Object])
+AuthService = __decorate12([
+  Injectable8(),
+  __metadata12("design:paramtypes", [typeof (_a8 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a8 : Object, typeof (_b6 = typeof UserService !== "undefined" && UserService) === "function" ? _b6 : Object, typeof (_c4 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c4 : Object, typeof (_d2 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _d2 : Object, typeof (_e2 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _e2 : Object, typeof (_f2 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _f2 : Object, typeof (_g2 = typeof EmailService !== "undefined" && EmailService) === "function" ? _g2 : Object, typeof (_h2 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _h2 : Object])
 ], AuthService);
 
 // src/auth/AuthGuard.ts
 import { Service as Service2, User } from "najm-core";
 import { createGuard } from "najm-guard";
-var __decorate12 = function(decorators, target, key, desc) {
+var __decorate13 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata12 = function(k, v) {
+var __metadata13 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param3 = function(paramIndex, decorator) {
@@ -2304,13 +2389,13 @@ var AuthGuard = class AuthGuard2 {
     return !!user;
   }
 };
-__decorate12([
+__decorate13([
   __param3(0, User()),
-  __metadata12("design:type", Function),
-  __metadata12("design:paramtypes", [Object]),
-  __metadata12("design:returntype", Boolean)
+  __metadata13("design:type", Function),
+  __metadata13("design:paramtypes", [Object]),
+  __metadata13("design:returntype", Boolean)
 ], AuthGuard.prototype, "canActivate", null);
-AuthGuard = __decorate12([
+AuthGuard = __decorate13([
   Service2()
 ], AuthGuard);
 var isAuth = createGuard(AuthGuard);
@@ -2319,13 +2404,13 @@ var isAuth = createGuard(AuthGuard);
 import { Service as Service3 } from "najm-core";
 import { GuardParams, User as User2 } from "najm-core";
 import { composeGuards, createGuard as createGuard2 } from "najm-guard";
-var __decorate13 = function(decorators, target, key, desc) {
+var __decorate14 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata13 = function(k, v) {
+var __metadata14 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param4 = function(paramIndex, decorator) {
@@ -2348,14 +2433,14 @@ var RoleGuard = class RoleGuard2 {
     return false;
   }
 };
-__decorate13([
+__decorate14([
   __param4(0, GuardParams()),
   __param4(1, User2("role")),
-  __metadata13("design:type", Function),
-  __metadata13("design:paramtypes", [Object, String]),
-  __metadata13("design:returntype", void 0)
+  __metadata14("design:type", Function),
+  __metadata14("design:paramtypes", [Object, String]),
+  __metadata14("design:returntype", void 0)
 ], RoleGuard.prototype, "canActivate", null);
-RoleGuard = __decorate13([
+RoleGuard = __decorate14([
   Service3()
 ], RoleGuard);
 var Role = createGuard2(RoleGuard);
@@ -2431,13 +2516,13 @@ var userListQuery = z.object({
 });
 
 // src/auth/AuthController.ts
-var __decorate14 = function(decorators, target, key, desc) {
+var __decorate15 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata14 = function(k, v) {
+var __metadata15 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param5 = function(paramIndex, decorator) {
@@ -2445,7 +2530,7 @@ var __param5 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a8;
+var _a9;
 var hashKeyPart = /* @__PURE__ */ __name((value) => createHash2("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
 var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
   const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
@@ -2502,113 +2587,113 @@ var AuthController = class AuthController2 {
     return this.authService.resetPassword(body.token, body.newPassword);
   }
 };
-__decorate14([
+__decorate15([
   Post("/register"),
   RateLimit({ limit: 5, window: "15m", key: ipAndEmail }),
   Validate(registerDto),
   ResMsg("auth.success.register"),
   __param5(0, Body()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object]),
-  __metadata14("design:returntype", Promise)
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "registerUser", null);
-__decorate14([
+__decorate15([
   Post("/login"),
   RateLimit({ limit: 5, window: "15m", key: ipAndEmail, message: "Too many login attempts. Please try again later." }),
   Validate(loginDto),
   ResMsg("auth.success.login"),
   __param5(0, Body()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object]),
-  __metadata14("design:returntype", Promise)
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "loginUser", null);
-__decorate14([
+__decorate15([
   Post("/invite"),
   isAdmin(),
   RateLimit({ limit: 20, window: "15m", key: "user" }),
   Validate(inviteUserDto),
   ResMsg("auth.success.accountInviteSent"),
   __param5(0, Body()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object]),
-  __metadata14("design:returntype", Promise)
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "inviteUser", null);
-__decorate14([
+__decorate15([
   Post("/refresh"),
   RateLimit({ limit: 15, window: "15m", key: cookieFingerprint() }),
   ResMsg("auth.success.tokenRefreshed"),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", []),
-  __metadata14("design:returntype", Promise)
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", []),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "refreshTokens", null);
-__decorate14([
+__decorate15([
   Post("/logout"),
   isAuth(),
   RateLimit({ limit: 10, window: "15m", key: "user" }),
   __param5(0, User3("id")),
   __param5(1, Headers("authorization")),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [String, String]),
-  __metadata14("design:returntype", Promise)
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String, String]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "logoutUser", null);
-__decorate14([
+__decorate15([
   Post("/change-password"),
   isAuth(),
   Validate(changePasswordDto),
   ResMsg("auth.success.passwordChanged"),
   __param5(0, User3("id")),
   __param5(1, Body()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [String, Object]),
-  __metadata14("design:returntype", Promise)
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String, Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "changePassword", null);
-__decorate14([
+__decorate15([
   Get("/me"),
   RateLimit({ limit: 30, window: "1m", key: cookieFingerprint() }),
   ResMsg("auth.users.success.retrieved"),
   __param5(0, Headers("authorization")),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [String]),
-  __metadata14("design:returntype", Promise)
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "userProfile", null);
-__decorate14([
+__decorate15([
   Post("/forgot-password"),
   RateLimit({ limit: 3, window: "15m", key: ipAndEmail, message: "Too many password reset requests. Please try again later." }),
   Validate(resetPasswordDto),
   ResMsg("auth.success.passwordResetSent"),
   __param5(0, Body()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object]),
-  __metadata14("design:returntype", Promise)
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "forgotPassword", null);
-__decorate14([
+__decorate15([
   Post("/reset-password"),
   RateLimit({ limit: 5, window: "15m", key: "ip", message: "Too many password reset attempts. Please try again later." }),
   Validate(confirmResetPasswordDto),
   ResMsg("auth.success.passwordReset"),
   __param5(0, Body()),
-  __metadata14("design:type", Function),
-  __metadata14("design:paramtypes", [Object]),
-  __metadata14("design:returntype", Promise)
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [Object]),
+  __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "resetPassword", null);
-AuthController = __decorate14([
+AuthController = __decorate15([
   Controller("/auth"),
-  __metadata14("design:paramtypes", [typeof (_a8 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a8 : Object])
+  __metadata15("design:paramtypes", [typeof (_a9 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a9 : Object])
 ], AuthController);
 
 // src/auth/AuthResolver.ts
 import { APP, Container, DI, Inject as Inject9, LOGGER, Meta, Service as Service4 } from "najm-core";
 import { USER, ROLE, PERMISSIONS } from "najm-guard";
-var __decorate15 = function(decorators, target, key, desc) {
+var __decorate16 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata15 = function(k, v) {
+var __metadata16 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a9;
+var _a10;
 var AuthResolver = class AuthResolver2 {
   static {
     __name(this, "AuthResolver");
@@ -2724,19 +2809,19 @@ var AuthResolver = class AuthResolver2 {
     await authService.warmupPasswordHash();
   }
 };
-__decorate15([
+__decorate16([
   DI(),
-  __metadata15("design:type", typeof (_a9 = typeof Container !== "undefined" && Container) === "function" ? _a9 : Object)
+  __metadata16("design:type", typeof (_a10 = typeof Container !== "undefined" && Container) === "function" ? _a10 : Object)
 ], AuthResolver.prototype, "container", void 0);
-__decorate15([
+__decorate16([
   Inject9(APP),
-  __metadata15("design:type", Object)
+  __metadata16("design:type", Object)
 ], AuthResolver.prototype, "app", void 0);
-__decorate15([
+__decorate16([
   Inject9(LOGGER),
-  __metadata15("design:type", Object)
+  __metadata16("design:type", Object)
 ], AuthResolver.prototype, "log", void 0);
-AuthResolver = __decorate15([
+AuthResolver = __decorate16([
   Service4(),
   Meta({ layer: "plugin", order: 30 })
 ], AuthResolver);
@@ -2767,6 +2852,7 @@ __name(runAsUser, "runAsUser");
 // src/auth/index.ts
 var AUTH_MODULE = [
   AuthService,
+  AuthSessionService,
   CookieManager,
   EncryptionService,
   AuthGuard,
@@ -2882,13 +2968,13 @@ var assignRoleDto = z2.object({
 });
 
 // src/roles/RoleController.ts
-var __decorate16 = function(decorators, target, key, desc) {
+var __decorate17 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata16 = function(k, v) {
+var __metadata17 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param6 = function(paramIndex, decorator) {
@@ -2896,7 +2982,7 @@ var __param6 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a10;
+var _a11;
 var RoleController = class RoleController2 {
   static {
     __name(this, "RoleController");
@@ -2921,35 +3007,35 @@ var RoleController = class RoleController2 {
     return this.roleService.delete(params.id);
   }
 };
-__decorate16([
+__decorate17([
   Get2(),
   isAdmin(),
   ResMsg2("roles.success.retrieved"),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", []),
-  __metadata16("design:returntype", Promise)
+  __metadata17("design:type", Function),
+  __metadata17("design:paramtypes", []),
+  __metadata17("design:returntype", Promise)
 ], RoleController.prototype, "getRoles", null);
-__decorate16([
+__decorate17([
   Get2("/:id"),
   isAdmin(),
   Validate2({ params: roleIdParam }),
   ResMsg2("roles.success.retrieved"),
   __param6(0, Params()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object]),
-  __metadata16("design:returntype", Promise)
+  __metadata17("design:type", Function),
+  __metadata17("design:paramtypes", [Object]),
+  __metadata17("design:returntype", Promise)
 ], RoleController.prototype, "getRole", null);
-__decorate16([
+__decorate17([
   Post2(),
   isAdmin(),
   Validate2(createRoleDto),
   ResMsg2("roles.success.created"),
   __param6(0, Body2()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object]),
-  __metadata16("design:returntype", Promise)
+  __metadata17("design:type", Function),
+  __metadata17("design:paramtypes", [Object]),
+  __metadata17("design:returntype", Promise)
 ], RoleController.prototype, "createRole", null);
-__decorate16([
+__decorate17([
   Put("/:id"),
   isAdmin(),
   Validate2({
@@ -2959,34 +3045,34 @@ __decorate16([
   ResMsg2("roles.success.updated"),
   __param6(0, Params()),
   __param6(1, Body2()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object, Object]),
-  __metadata16("design:returntype", Promise)
+  __metadata17("design:type", Function),
+  __metadata17("design:paramtypes", [Object, Object]),
+  __metadata17("design:returntype", Promise)
 ], RoleController.prototype, "updateRole", null);
-__decorate16([
+__decorate17([
   Delete("/:id"),
   isAdmin(),
   Validate2({ params: roleIdParam }),
   ResMsg2("roles.success.deleted"),
   __param6(0, Params()),
-  __metadata16("design:type", Function),
-  __metadata16("design:paramtypes", [Object]),
-  __metadata16("design:returntype", Promise)
+  __metadata17("design:type", Function),
+  __metadata17("design:paramtypes", [Object]),
+  __metadata17("design:returntype", Promise)
 ], RoleController.prototype, "deleteRole", null);
-RoleController = __decorate16([
+RoleController = __decorate17([
   Controller2("/roles"),
-  __metadata16("design:paramtypes", [typeof (_a10 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a10 : Object])
+  __metadata17("design:paramtypes", [typeof (_a11 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a11 : Object])
 ], RoleController);
 
 // src/users/UserController.ts
 import { Validate as Validate3 } from "najm-validation";
-var __decorate17 = function(decorators, target, key, desc) {
+var __decorate18 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata17 = function(k, v) {
+var __metadata18 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param7 = function(paramIndex, decorator) {
@@ -2994,7 +3080,7 @@ var __param7 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a11;
+var _a12;
 var UserController = class UserController2 {
   static {
     __name(this, "UserController");
@@ -3041,75 +3127,75 @@ var UserController = class UserController2 {
     return this.userService.removeRole(params.userId);
   }
 };
-__decorate17([
+__decorate18([
   Get3(),
   isAdmin(),
   Validate3({ query: userListQuery }),
   ResMsg3("users.success.retrieved"),
   __param7(0, Query()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "getUsers", null);
-__decorate17([
+__decorate18([
   Get3("/lang"),
   isAuth(),
   ResMsg3("users.success.retrieved"),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", []),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", []),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "getLang", null);
-__decorate17([
+__decorate18([
   Post3("/lang/:language"),
   isAuth(),
   Validate3({ params: languageParam }),
   ResMsg3("users.success.updated"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "updateLang", null);
-__decorate17([
+__decorate18([
   Get3("/:id"),
   isAdmin(),
   Validate3({ params: userIdParam }),
   ResMsg3("users.success.retrieved"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "getUser", null);
-__decorate17([
+__decorate18([
   Get3("/email/:email"),
   isAdmin(),
   Validate3({ params: emailParam }),
   ResMsg3("users.success.retrieved"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "getByEmail", null);
-__decorate17([
+__decorate18([
   Get3("/role/:userId"),
   isAdmin(),
   Validate3({ params: userIdInParam }),
   ResMsg3("users.success.retrieved"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "getRole", null);
-__decorate17([
+__decorate18([
   Post3(),
   isAdmin(),
   Validate3(createUserDto),
   ResMsg3("users.success.created"),
   __param7(0, Body3()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "create", null);
-__decorate17([
+__decorate18([
   Put2("/:id"),
   isAdmin(),
   Validate3({
@@ -3119,51 +3205,51 @@ __decorate17([
   ResMsg3("users.success.updated"),
   __param7(0, Params2()),
   __param7(1, Body3()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object, Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object, Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "update", null);
-__decorate17([
+__decorate18([
   Delete2("/:id"),
   isAdmin(),
   Validate3({ params: userIdParam }),
   ResMsg3("users.success.deleted"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "delete", null);
-__decorate17([
+__decorate18([
   Delete2(),
   isAdmin(),
   ResMsg3("users.success.allDeleted"),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", []),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", []),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "deleteAll", null);
-__decorate17([
+__decorate18([
   Post3("/assign/:userId/:roleId"),
   isAdmin(),
   Validate3({ params: assignRoleParams }),
   ResMsg3("users.success.updated"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "assignRole", null);
-__decorate17([
+__decorate18([
   Delete2("/remove/:userId"),
   isAdmin(),
   Validate3({ params: userIdInParam }),
   ResMsg3("users.success.updated"),
   __param7(0, Params2()),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", Promise)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", Promise)
 ], UserController.prototype, "removeRole", null);
-UserController = __decorate17([
+UserController = __decorate18([
   Controller3("/users"),
-  __metadata17("design:paramtypes", [typeof (_a11 = typeof UserService !== "undefined" && UserService) === "function" ? _a11 : Object])
+  __metadata18("design:paramtypes", [typeof (_a12 = typeof UserService !== "undefined" && UserService) === "function" ? _a12 : Object])
 ], UserController);
 
 // src/permissions/index.ts
@@ -3186,13 +3272,13 @@ __export(permissions_exports, {
 import { eq as eq5, and as and2 } from "drizzle-orm";
 import { Repository as Repository4, Inject as Inject10 } from "najm-core";
 import { DB as DB4 } from "najm-database";
-var __decorate18 = function(decorators, target, key, desc) {
+var __decorate19 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata18 = function(k, v) {
+var __metadata19 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var PermissionRepository = class PermissionRepository2 {
@@ -3270,29 +3356,29 @@ var PermissionRepository = class PermissionRepository2 {
     return deletedPermissions;
   }
 };
-__decorate18([
+__decorate19([
   DB4(),
-  __metadata18("design:type", Object)
+  __metadata19("design:type", Object)
 ], PermissionRepository.prototype, "db", void 0);
-__decorate18([
+__decorate19([
   Inject10(AUTH_SCHEMA),
-  __metadata18("design:type", Object)
+  __metadata19("design:type", Object)
 ], PermissionRepository.prototype, "schema", void 0);
-PermissionRepository = __decorate18([
+PermissionRepository = __decorate19([
   Repository4()
 ], PermissionRepository);
 
 // src/permissions/PermissionGuards.ts
-import { Injectable as Injectable8 } from "najm-core";
+import { Injectable as Injectable9 } from "najm-core";
 import { GuardParams as GuardParams2, User as User4 } from "najm-core";
 import { createGuard as createGuard4, composeGuards as composeGuards3 } from "najm-guard";
-var __decorate19 = function(decorators, target, key, desc) {
+var __decorate20 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata19 = function(k, v) {
+var __metadata20 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param8 = function(paramIndex, decorator) {
@@ -3328,15 +3414,15 @@ var PermissionGuard = class PermissionGuard2 {
     return false;
   }
 };
-__decorate19([
+__decorate20([
   __param8(0, GuardParams2()),
   __param8(1, User4("permissions")),
-  __metadata19("design:type", Function),
-  __metadata19("design:paramtypes", [String, Array]),
-  __metadata19("design:returntype", Object)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [String, Array]),
+  __metadata20("design:returntype", Object)
 ], PermissionGuard.prototype, "canActivate", null);
-PermissionGuard = __decorate19([
-  Injectable8()
+PermissionGuard = __decorate20([
+  Injectable9()
 ], PermissionGuard);
 var Permission = createGuard4(PermissionGuard);
 var Can = /* @__PURE__ */ __name((permission) => composeGuards3(isAuth(), Permission(permission))(), "Can");
@@ -3347,23 +3433,23 @@ import { Get as Get4, Post as Post4, Put as Put3, Delete as Delete3, ResMsg as R
 import { Params as Params3, Body as Body4 } from "najm-core";
 
 // src/permissions/PermissionService.ts
-import { Injectable as Injectable10 } from "najm-core";
+import { Injectable as Injectable11 } from "najm-core";
 
 // src/permissions/PermissionValidator.ts
-import { Injectable as Injectable9 } from "najm-core";
+import { Injectable as Injectable10 } from "najm-core";
 import { I18n as I18n7 } from "najm-i18n";
-import { Err as Err8 } from "najm-core";
-var __decorate20 = function(decorators, target, key, desc) {
+import { Err as Err9 } from "najm-core";
+var __decorate21 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata20 = function(k, v) {
+var __metadata21 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a12;
-var _b6;
+var _a13;
+var _b7;
 var PermissionValidator = class PermissionValidator2 {
   static {
     __name(this, "PermissionValidator");
@@ -3381,7 +3467,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExists(id) {
     const permission = await this.permissionRepository.getById(id);
     if (!permission) {
-      Err8(this.t("errors.notFound"), 404);
+      Err9(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3391,7 +3477,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExistsByName(name) {
     const permission = await this.permissionRepository.getByName(name);
     if (!permission) {
-      Err8(this.t("errors.notFound"), 404);
+      Err9(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3403,7 +3489,7 @@ var PermissionValidator = class PermissionValidator2 {
       return;
     const existingPermission = await this.permissionRepository.getByName(name);
     if (existingPermission && existingPermission.id !== excludeId) {
-      Err8(this.t("errors.nameExists"), 409);
+      Err9(this.t("errors.nameExists"), 409);
     }
   }
   /**
@@ -3426,32 +3512,32 @@ var PermissionValidator = class PermissionValidator2 {
     await this.checkPermissionExists(permissionId);
     const hasPermission = await this.permissionRepository.checkRoleHasPermission(roleId, permissionId);
     if (hasPermission) {
-      Err8(this.t("errors.roleAlreadyHasPermission"), 409);
+      Err9(this.t("errors.roleAlreadyHasPermission"), 409);
     }
   }
 };
-__decorate20([
+__decorate21([
   I18n7("permissions"),
-  __metadata20("design:type", Object)
+  __metadata21("design:type", Object)
 ], PermissionValidator.prototype, "t", void 0);
-PermissionValidator = __decorate20([
-  Injectable9(),
-  __metadata20("design:paramtypes", [typeof (_a12 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a12 : Object, typeof (_b6 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b6 : Object])
+PermissionValidator = __decorate21([
+  Injectable10(),
+  __metadata21("design:paramtypes", [typeof (_a13 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a13 : Object, typeof (_b7 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b7 : Object])
 ], PermissionValidator);
 
 // src/permissions/PermissionService.ts
-var __decorate21 = function(decorators, target, key, desc) {
+var __decorate22 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata21 = function(k, v) {
+var __metadata22 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a13;
-var _b7;
-var _c4;
+var _a14;
+var _b8;
+var _c5;
 var PermissionService = class PermissionService2 {
   static {
     __name(this, "PermissionService");
@@ -3556,9 +3642,9 @@ var PermissionService = class PermissionService2 {
     return await this.permissionRepository.deleteAll();
   }
 };
-PermissionService = __decorate21([
-  Injectable10(),
-  __metadata21("design:paramtypes", [typeof (_a13 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a13 : Object, typeof (_b7 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b7 : Object, typeof (_c4 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c4 : Object])
+PermissionService = __decorate22([
+  Injectable11(),
+  __metadata22("design:paramtypes", [typeof (_a14 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a14 : Object, typeof (_b8 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b8 : Object, typeof (_c5 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c5 : Object])
 ], PermissionService);
 
 // src/permissions/PermissionController.ts
@@ -3591,13 +3677,13 @@ var checkPermissionDto = z3.object({
 });
 
 // src/permissions/PermissionController.ts
-var __decorate22 = function(decorators, target, key, desc) {
+var __decorate23 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata22 = function(k, v) {
+var __metadata23 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param9 = function(paramIndex, decorator) {
@@ -3605,7 +3691,7 @@ var __param9 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a14;
+var _a15;
 var PermissionController = class PermissionController2 {
   static {
     __name(this, "PermissionController");
@@ -3651,32 +3737,32 @@ var PermissionController = class PermissionController2 {
     return this.permissionService.deleteAll();
   }
 };
-__decorate22([
+__decorate23([
   Get4(),
   ResMsg4("permissions.success.retrieved"),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", []),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", []),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "getPermissions", null);
-__decorate22([
+__decorate23([
   Get4("/:id"),
   Validate4({ params: permissionIdParam }),
   ResMsg4("permissions.success.retrieved"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "getPermission", null);
-__decorate22([
+__decorate23([
   Post4(),
   Validate4(createPermissionDto),
   ResMsg4({ message: "Permission created successfully", status: 201 }),
   __param9(0, Body4()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "create", null);
-__decorate22([
+__decorate23([
   Put3("/:id"),
   Validate4({
     params: permissionIdParam,
@@ -3685,67 +3771,67 @@ __decorate22([
   ResMsg4("permissions.success.updated"),
   __param9(0, Params3()),
   __param9(1, Body4()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object, Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object, Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "update", null);
-__decorate22([
+__decorate23([
   Delete3("/:id"),
   Validate4({ params: permissionIdParam }),
   ResMsg4("permissions.success.deleted"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "delete", null);
-__decorate22([
+__decorate23([
   Get4("/role/:id"),
   Validate4({ params: roleIdParam }),
   ResMsg4("permissions.success.retrieved"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "getByRole", null);
-__decorate22([
+__decorate23([
   Get4("/roles/:id"),
   Validate4({ params: permissionIdParam }),
   ResMsg4("permissions.success.retrieved"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "getRolesByPermission", null);
-__decorate22([
+__decorate23([
   Post4("/assign/:roleId/:permissionId"),
   Validate4({ params: assignPermissionDto }),
   ResMsg4("permissions.success.assigned"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "assignToRole", null);
-__decorate22([
+__decorate23([
   Delete3("/remove/:roleId/:permissionId"),
   Validate4({ params: assignPermissionDto }),
   ResMsg4("permissions.success.removed"),
   __param9(0, Params3()),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", [Object]),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", [Object]),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "removeFromRole", null);
-__decorate22([
+__decorate23([
   Delete3(),
   isAdmin(),
   ResMsg4("permissions.success.allDeleted"),
-  __metadata22("design:type", Function),
-  __metadata22("design:paramtypes", []),
-  __metadata22("design:returntype", Promise)
+  __metadata23("design:type", Function),
+  __metadata23("design:paramtypes", []),
+  __metadata23("design:returntype", Promise)
 ], PermissionController.prototype, "deleteAll", null);
-PermissionController = __decorate22([
+PermissionController = __decorate23([
   Controller4("/permissions"),
   isAdmin(),
-  __metadata22("design:paramtypes", [typeof (_a14 = typeof PermissionService !== "undefined" && PermissionService) === "function" ? _a14 : Object])
+  __metadata23("design:paramtypes", [typeof (_a15 = typeof PermissionService !== "undefined" && PermissionService) === "function" ? _a15 : Object])
 ], PermissionController);
 
 // src/tokens/index.ts
@@ -3952,15 +4038,15 @@ function own(table, opts) {
 __name(own, "own");
 
 // src/ownership/configureOwnership.ts
-import { Injectable as Injectable11, Inject as Inject11, User as User5, Body as Body5, Params as Params4 } from "najm-core";
+import { Injectable as Injectable12, Inject as Inject11, User as User5, Body as Body5, Params as Params4 } from "najm-core";
 import { createGuard as createGuard5, composeGuards as composeGuards4 } from "najm-guard";
-var __decorate23 = function(decorators, target, key, desc) {
+var __decorate24 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata23 = function(k, v) {
+var __metadata24 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param10 = function(paramIndex, decorator) {
@@ -3980,7 +4066,7 @@ function toSingular(plural) {
 }
 __name(toSingular, "toSingular");
 function createResourceGuards(ownershipClass, resourceType, resource, options) {
-  var _a16, _b8;
+  var _a22, _b12;
   const writeGuard = options?.adminGuard ?? isAdmin;
   let AccessGuard = class AccessGuard {
     static {
@@ -3992,19 +4078,19 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
       return allowed ? { owner: user } : false;
     }
   };
-  __decorate23([
+  __decorate24([
     Inject11(ownershipClass),
-    __metadata23("design:type", Object)
+    __metadata24("design:type", Object)
   ], AccessGuard.prototype, "ownership", void 0);
-  __decorate23([
+  __decorate24([
     __param10(0, User5()),
     __param10(1, Params4("id")),
-    __metadata23("design:type", Function),
-    __metadata23("design:paramtypes", [Object, String]),
-    __metadata23("design:returntype", typeof (_a16 = typeof Promise !== "undefined" && Promise) === "function" ? _a16 : Object)
+    __metadata24("design:type", Function),
+    __metadata24("design:paramtypes", [Object, String]),
+    __metadata24("design:returntype", typeof (_a22 = typeof Promise !== "undefined" && Promise) === "function" ? _a22 : Object)
   ], AccessGuard.prototype, "canActivate", null);
-  AccessGuard = __decorate23([
-    Injectable11()
+  AccessGuard = __decorate24([
+    Injectable12()
   ], AccessGuard);
   let ListGuard = class ListGuard {
     static {
@@ -4016,18 +4102,18 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
       return { filter: ids };
     }
   };
-  __decorate23([
+  __decorate24([
     Inject11(ownershipClass),
-    __metadata23("design:type", Object)
+    __metadata24("design:type", Object)
   ], ListGuard.prototype, "ownership", void 0);
-  __decorate23([
+  __decorate24([
     __param10(0, User5()),
-    __metadata23("design:type", Function),
-    __metadata23("design:paramtypes", [Object]),
-    __metadata23("design:returntype", typeof (_b8 = typeof Promise !== "undefined" && Promise) === "function" ? _b8 : Object)
+    __metadata24("design:type", Function),
+    __metadata24("design:paramtypes", [Object]),
+    __metadata24("design:returntype", typeof (_b12 = typeof Promise !== "undefined" && Promise) === "function" ? _b12 : Object)
   ], ListGuard.prototype, "canActivate", null);
-  ListGuard = __decorate23([
-    Injectable11()
+  ListGuard = __decorate24([
+    Injectable12()
   ], ListGuard);
   const access = createGuard5(AccessGuard);
   const list = createGuard5(ListGuard);
@@ -4158,11 +4244,11 @@ function configureOwnership(config) {
       }
     }
   };
-  GeneratedOwnershipService = __decorate23([
-    Injectable11()
+  GeneratedOwnershipService = __decorate24([
+    Injectable12()
   ], GeneratedOwnershipService);
   function bodyGuard(resourceType, bodyField, optional = false) {
-    var _a16;
+    var _a22;
     let BodyAccessGuard = class BodyAccessGuard {
       static {
         __name(this, "BodyAccessGuard");
@@ -4175,19 +4261,19 @@ function configureOwnership(config) {
         return this.ownership.canAccess(user, resourceType, id);
       }
     };
-    __decorate23([
+    __decorate24([
       Inject11(GeneratedOwnershipService),
-      __metadata23("design:type", GeneratedOwnershipService)
+      __metadata24("design:type", GeneratedOwnershipService)
     ], BodyAccessGuard.prototype, "ownership", void 0);
-    __decorate23([
+    __decorate24([
       __param10(0, User5()),
       __param10(1, Body5()),
-      __metadata23("design:type", Function),
-      __metadata23("design:paramtypes", [Object, Object]),
-      __metadata23("design:returntype", typeof (_a16 = typeof Promise !== "undefined" && Promise) === "function" ? _a16 : Object)
+      __metadata24("design:type", Function),
+      __metadata24("design:paramtypes", [Object, Object]),
+      __metadata24("design:returntype", typeof (_a22 = typeof Promise !== "undefined" && Promise) === "function" ? _a22 : Object)
     ], BodyAccessGuard.prototype, "canActivate", null);
-    BodyAccessGuard = __decorate23([
-      Injectable11()
+    BodyAccessGuard = __decorate24([
+      Injectable12()
     ], BodyAccessGuard);
     return createGuard5(BodyAccessGuard);
   }
@@ -4302,18 +4388,18 @@ __name(Policy, "Policy");
 // src/ownership/OwnedDecorator.ts
 import "reflect-metadata";
 import { sql as sql5, and as and3 } from "drizzle-orm";
-import { Injectable as Injectable12, Inject as Inject12, DI as DI2, Container as Container2, REQUEST_ID } from "najm-core";
+import { Injectable as Injectable13, Inject as Inject12, DI as DI2, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
-var __decorate24 = function(decorators, target, key, desc) {
+var __decorate25 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata24 = function(k, v) {
+var __metadata25 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a15;
+var _a16;
 var OWNED_META = /* @__PURE__ */ Symbol.for("najm:owned");
 var ScopeContext = class ScopeContext2 {
   static {
@@ -4345,12 +4431,12 @@ var ScopeContext = class ScopeContext2 {
     }
   }
 };
-__decorate24([
+__decorate25([
   DI2(),
-  __metadata24("design:type", typeof (_a15 = typeof Container2 !== "undefined" && Container2) === "function" ? _a15 : Object)
+  __metadata25("design:type", typeof (_a16 = typeof Container2 !== "undefined" && Container2) === "function" ? _a16 : Object)
 ], ScopeContext.prototype, "container", void 0);
-ScopeContext = __decorate24([
-  Injectable12()
+ScopeContext = __decorate25([
+  Injectable13()
 ], ScopeContext);
 function Owned(token) {
   return function(target) {
@@ -4454,7 +4540,17 @@ var en_default = {
       sessionExpired: "Session has expired",
       accountLocked: "Account is temporarily locked. Please try again later.",
       accountInactive: "Account is inactive. Please contact support.",
-      emailNotVerified: "Please verify your email address before signing in."
+      emailNotVerified: "Please verify your email address before signing in.",
+      oauthProviderDisabled: "Google sign-in is not configured.",
+      oauthStateInvalid: "The Google sign-in attempt is invalid or expired.",
+      oauthAccessDenied: "Google sign-in was cancelled.",
+      oauthProviderError: "Google sign-in could not be completed.",
+      oauthVerifiedEmailRequired: "Google must provide a verified email address.",
+      oauthAccountLinkRequired: "Sign in with your password and link Google from your account.",
+      oauthProviderAccountLinked: "This Google account is already linked.",
+      oauthSignupDisabled: "Registration with Google is disabled.",
+      oauthHostedDomainDenied: "This Google Workspace domain is not allowed.",
+      oauthLinkSessionExpired: "Your session changed before Google could be linked. Please try again."
     },
     success: {
       login: "Login successful",
@@ -4464,7 +4560,9 @@ var en_default = {
       passwordResetSent: "If that email exists, a reset link has been sent",
       passwordReset: "Password has been reset successfully",
       accountInviteSent: "Invitation sent successfully",
-      tokenRefreshed: "Token refreshed successfully"
+      tokenRefreshed: "Token refreshed successfully",
+      oauthLogin: "Google sign-in successful",
+      oauthLinked: "Google account linked successfully"
     },
     emails: {
       passwordReset: {
@@ -4540,6 +4638,674 @@ function getAuthLocale(lang) {
 __name(getAuthLocale, "getAuthLocale");
 var AUTH_SUPPORTED_LANGUAGES = Object.keys(AUTH_LOCALES);
 
+// src/oauth/google/GoogleOAuthProvider.ts
+import { Inject as Inject14, Injectable as Injectable15 } from "najm-core";
+
+// src/oauth/types.ts
+var OAuthFlowError = class extends Error {
+  static {
+    __name(this, "OAuthFlowError");
+  }
+  oauthCode;
+  status;
+  constructor(oauthCode, status = 400) {
+    super(oauthCode);
+    this.oauthCode = oauthCode;
+    this.status = status;
+    this.name = "OAuthFlowError";
+  }
+};
+
+// src/oauth/google/GoogleTokenVerifier.ts
+import { Inject as Inject13, Injectable as Injectable14 } from "najm-core";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+var __decorate26 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata26 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var GOOGLE_JWKS = createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
+var GoogleTokenVerifier = class GoogleTokenVerifier2 {
+  static {
+    __name(this, "GoogleTokenVerifier");
+  }
+  config;
+  jwks = GOOGLE_JWKS;
+  async verify(idToken, nonce) {
+    const google = this.googleConfig();
+    try {
+      const { payload } = await jwtVerify(idToken, this.jwks, {
+        issuer: ["https://accounts.google.com", "accounts.google.com"],
+        audience: google.clientId,
+        algorithms: ["RS256"]
+      });
+      if (payload.nonce !== nonce)
+        throw new OAuthFlowError("oauth_token_invalid");
+      if (typeof payload.sub !== "string" || !payload.sub) {
+        throw new OAuthFlowError("oauth_token_invalid");
+      }
+      if (typeof payload.email !== "string" || !payload.email || payload.email_verified !== true) {
+        throw new OAuthFlowError("oauth_verified_email_required");
+      }
+      const hostedDomain = typeof payload.hd === "string" ? payload.hd.toLowerCase() : void 0;
+      if (google.allowedHostedDomains.length > 0 && (!hostedDomain || !google.allowedHostedDomains.includes(hostedDomain))) {
+        throw new OAuthFlowError("oauth_hosted_domain_denied", 403);
+      }
+      return {
+        provider: "google",
+        providerAccountId: payload.sub,
+        email: payload.email.trim().toLowerCase(),
+        emailVerified: true,
+        name: typeof payload.name === "string" ? payload.name : void 0,
+        picture: typeof payload.picture === "string" ? payload.picture : void 0,
+        hostedDomain
+      };
+    } catch (error) {
+      if (error instanceof OAuthFlowError)
+        throw error;
+      throw new OAuthFlowError("oauth_token_invalid");
+    }
+  }
+  googleConfig() {
+    const google = this.config.oauth?.google;
+    if (!google)
+      throw new OAuthFlowError("oauth_provider_disabled", 404);
+    return google;
+  }
+};
+__decorate26([
+  Inject13(AUTH_CONFIG),
+  __metadata26("design:type", Object)
+], GoogleTokenVerifier.prototype, "config", void 0);
+GoogleTokenVerifier = __decorate26([
+  Injectable14()
+], GoogleTokenVerifier);
+
+// src/oauth/google/GoogleOAuthProvider.ts
+var __decorate27 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata27 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a17;
+var AUTHORIZATION_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+var TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+var GoogleOAuthProvider = class GoogleOAuthProvider2 {
+  static {
+    __name(this, "GoogleOAuthProvider");
+  }
+  verifier;
+  config;
+  constructor(verifier) {
+    this.verifier = verifier;
+  }
+  authorizationUrl(attempt, codeChallenge) {
+    const google = this.googleConfig();
+    const url = new URL(AUTHORIZATION_ENDPOINT);
+    url.search = new URLSearchParams({
+      client_id: google.clientId,
+      redirect_uri: google.callbackUrl,
+      response_type: "code",
+      scope: "openid email profile",
+      state: attempt.state,
+      nonce: attempt.nonce,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256"
+    }).toString();
+    return url.toString();
+  }
+  async exchange(code, attempt) {
+    const google = this.googleConfig();
+    let response;
+    try {
+      response = await fetch(TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: google.clientId,
+          client_secret: google.clientSecret,
+          redirect_uri: google.callbackUrl,
+          grant_type: "authorization_code",
+          code_verifier: attempt.codeVerifier
+        }),
+        signal: AbortSignal.timeout(15e3)
+      });
+    } catch {
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    }
+    if (!response.ok)
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    }
+    const idToken = body.id_token;
+    if (typeof idToken !== "string" || !idToken) {
+      throw new OAuthFlowError("oauth_provider_error", 502);
+    }
+    return this.verifier.verify(idToken, attempt.nonce);
+  }
+  googleConfig() {
+    const google = this.config.oauth?.google;
+    if (!google)
+      throw new OAuthFlowError("oauth_provider_disabled", 404);
+    return google;
+  }
+};
+__decorate27([
+  Inject14(AUTH_CONFIG),
+  __metadata27("design:type", Object)
+], GoogleOAuthProvider.prototype, "config", void 0);
+GoogleOAuthProvider = __decorate27([
+  Injectable15(),
+  __metadata27("design:paramtypes", [typeof (_a17 = typeof GoogleTokenVerifier !== "undefined" && GoogleTokenVerifier) === "function" ? _a17 : Object])
+], GoogleOAuthProvider);
+
+// src/oauth/OAuthAccountRepository.ts
+import { and as and4, eq as eq7 } from "drizzle-orm";
+import { Inject as Inject15, Repository as Repository5 } from "najm-core";
+import { DB as DB5 } from "najm-database";
+var __decorate28 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata28 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var OAuthAccountRepository = class OAuthAccountRepository2 {
+  static {
+    __name(this, "OAuthAccountRepository");
+  }
+  db;
+  schema;
+  get accounts() {
+    if (!this.schema.oauthAccounts) {
+      throw new OAuthFlowError("oauth_schema_missing", 500);
+    }
+    return this.schema.oauthAccounts;
+  }
+  async getByProviderAccount(provider, providerAccountId) {
+    const [account] = await this.db.select().from(this.accounts).where(and4(eq7(this.accounts.provider, provider), eq7(this.accounts.providerAccountId, providerAccountId))).limit(1);
+    return account;
+  }
+  async getByUserProvider(userId, provider) {
+    const [account] = await this.db.select().from(this.accounts).where(and4(eq7(this.accounts.userId, userId), eq7(this.accounts.provider, provider))).limit(1);
+    return account;
+  }
+  async create(data) {
+    const [account] = await this.db.insert(this.accounts).values(data).onConflictDoNothing().returning();
+    return account;
+  }
+};
+__decorate28([
+  DB5(),
+  __metadata28("design:type", Object)
+], OAuthAccountRepository.prototype, "db", void 0);
+__decorate28([
+  Inject15(AUTH_SCHEMA),
+  __metadata28("design:type", Object)
+], OAuthAccountRepository.prototype, "schema", void 0);
+OAuthAccountRepository = __decorate28([
+  Repository5()
+], OAuthAccountRepository);
+
+// src/oauth/OAuthAccountService.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { Inject as Inject16, Injectable as Injectable16 } from "najm-core";
+import { Transaction as Transaction2 } from "najm-database";
+var __decorate29 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata29 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a18;
+var _b9;
+var _c6;
+var _d3;
+var OAuthAccountService = class OAuthAccountService2 {
+  static {
+    __name(this, "OAuthAccountService");
+  }
+  accounts;
+  users;
+  config;
+  constructor(accounts, users) {
+    this.accounts = accounts;
+    this.users = users;
+  }
+  async resolveForLogin(identity) {
+    const linked = await this.accounts.getByProviderAccount("google", identity.providerAccountId);
+    if (linked)
+      return this.users.getById(linked.userId);
+    const existingUser = await this.users.findByEmailInsensitive(identity.email);
+    if (existingUser) {
+      if (!this.googleConfig().autoLinkVerifiedEmail) {
+        throw new OAuthFlowError("oauth_account_link_required", 409);
+      }
+      await this.createLink(existingUser.id, identity);
+      return this.users.getById(existingUser.id);
+    }
+    if (!this.googleConfig().allowSignup) {
+      throw new OAuthFlowError("oauth_signup_disabled", 403);
+    }
+    const password = `${randomBytes2(32).toString("base64url")}Aa1`;
+    const user = await this.users.create({
+      name: identity.name,
+      email: identity.email,
+      password,
+      image: identity.picture,
+      emailVerified: true
+    });
+    await this.createLink(user.id, identity);
+    return this.users.getById(user.id);
+  }
+  async linkUser(userId, identity) {
+    const user = await this.users.getById(userId);
+    if (user.status !== "active")
+      throw new OAuthFlowError("oauth_account_inactive", 403);
+    const providerAccount = await this.accounts.getByProviderAccount("google", identity.providerAccountId);
+    if (providerAccount && providerAccount.userId !== userId) {
+      throw new OAuthFlowError("oauth_provider_account_linked", 409);
+    }
+    if (providerAccount)
+      return user;
+    const userProvider = await this.accounts.getByUserProvider(userId, "google");
+    if (userProvider && userProvider.providerAccountId !== identity.providerAccountId) {
+      throw new OAuthFlowError("oauth_user_provider_linked", 409);
+    }
+    if (!userProvider)
+      await this.createLink(userId, identity);
+    return user;
+  }
+  async createLink(userId, identity) {
+    const created = await this.accounts.create({
+      userId,
+      provider: "google",
+      providerAccountId: identity.providerAccountId
+    });
+    if (created)
+      return;
+    const linked = await this.accounts.getByProviderAccount("google", identity.providerAccountId);
+    if (!linked || linked.userId !== userId) {
+      throw new OAuthFlowError("oauth_provider_account_linked", 409);
+    }
+  }
+  googleConfig() {
+    const google = this.config.oauth?.google;
+    if (!google)
+      throw new OAuthFlowError("oauth_provider_disabled", 404);
+    return google;
+  }
+};
+__decorate29([
+  Inject16(AUTH_CONFIG),
+  __metadata29("design:type", Object)
+], OAuthAccountService.prototype, "config", void 0);
+__decorate29([
+  Transaction2(),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [Object]),
+  __metadata29("design:returntype", typeof (_c6 = typeof Promise !== "undefined" && Promise) === "function" ? _c6 : Object)
+], OAuthAccountService.prototype, "resolveForLogin", null);
+__decorate29([
+  Transaction2(),
+  __metadata29("design:type", Function),
+  __metadata29("design:paramtypes", [String, Object]),
+  __metadata29("design:returntype", typeof (_d3 = typeof Promise !== "undefined" && Promise) === "function" ? _d3 : Object)
+], OAuthAccountService.prototype, "linkUser", null);
+OAuthAccountService = __decorate29([
+  Injectable16(),
+  __metadata29("design:paramtypes", [typeof (_a18 = typeof OAuthAccountRepository !== "undefined" && OAuthAccountRepository) === "function" ? _a18 : Object, typeof (_b9 = typeof UserService !== "undefined" && UserService) === "function" ? _b9 : Object])
+], OAuthAccountService);
+
+// src/oauth/OAuthController.ts
+import { createHash as createHash4 } from "crypto";
+import { Controller as Controller5, Ctx, Get as Get5, Post as Post5, Query as Query2, User as User6 } from "najm-core";
+import { RateLimit as RateLimit2 } from "najm-rate";
+
+// src/oauth/OAuthService.ts
+import { Inject as Inject17, Injectable as Injectable18, Log as Log2 } from "najm-core";
+
+// src/oauth/OAuthStateService.ts
+import { createHash as createHash3, randomBytes as randomBytes3, timingSafeEqual } from "crypto";
+import { Injectable as Injectable17 } from "najm-core";
+import { CookieService as CookieService2 } from "najm-cookies";
+var __decorate30 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata30 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a19;
+var _b10;
+var ATTEMPT_TTL_MS = 10 * 60 * 1e3;
+var COOKIE_PREFIX = "najm.oauth.google.";
+var OAuthStateService = class OAuthStateService2 {
+  static {
+    __name(this, "OAuthStateService");
+  }
+  cookies;
+  encryption;
+  constructor(cookies2, encryption) {
+    this.cookies = cookies2;
+    this.encryption = encryption;
+  }
+  create(input) {
+    const state = randomBytes3(32).toString("base64url");
+    const codeVerifier = randomBytes3(48).toString("base64url");
+    const attempt = {
+      provider: "google",
+      intent: input.intent,
+      state,
+      nonce: randomBytes3(32).toString("base64url"),
+      codeVerifier,
+      returnTo: this.validateReturnTo(input.returnTo),
+      userId: input.userId,
+      sessionVersion: input.sessionVersion,
+      createdAt: Date.now()
+    };
+    this.cookies.set(this.cookieName(state), this.encryption.encrypt(JSON.stringify(attempt)), {
+      httpOnly: true,
+      sameSite: "Lax",
+      path: "/",
+      maxAge: Math.floor(ATTEMPT_TTL_MS / 1e3)
+    });
+    return {
+      attempt,
+      codeChallenge: createHash3("sha256").update(codeVerifier).digest("base64url")
+    };
+  }
+  consume(state) {
+    if (!this.isSafeState(state))
+      throw new OAuthFlowError("oauth_state_invalid");
+    const name = this.cookieName(state);
+    const encrypted = this.cookies.get(name);
+    this.cookies.delete(name, { path: "/" });
+    if (!encrypted)
+      throw new OAuthFlowError("oauth_state_invalid");
+    try {
+      const attempt = JSON.parse(this.encryption.decrypt(encrypted));
+      const expected = Buffer.from(attempt.state);
+      const actual = Buffer.from(state);
+      if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+        throw new OAuthFlowError("oauth_state_invalid");
+      }
+      if (attempt.provider !== "google" || Date.now() - attempt.createdAt > ATTEMPT_TTL_MS) {
+        throw new OAuthFlowError("oauth_state_invalid");
+      }
+      attempt.returnTo = this.validateReturnTo(attempt.returnTo);
+      return attempt;
+    } catch (error) {
+      if (error instanceof OAuthFlowError)
+        throw error;
+      throw new OAuthFlowError("oauth_state_invalid");
+    }
+  }
+  validateReturnTo(value) {
+    const candidate = value?.trim() || "/";
+    if (!candidate.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\")) {
+      throw new OAuthFlowError("oauth_redirect_invalid");
+    }
+    try {
+      const base = new URL("https://najm.invalid");
+      const parsed = new URL(candidate, base);
+      if (parsed.origin !== base.origin || parsed.username || parsed.password) {
+        throw new OAuthFlowError("oauth_redirect_invalid");
+      }
+      return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+    } catch (error) {
+      if (error instanceof OAuthFlowError)
+        throw error;
+      throw new OAuthFlowError("oauth_redirect_invalid");
+    }
+  }
+  cookieName(state) {
+    return `${COOKIE_PREFIX}${state}`;
+  }
+  isSafeState(state) {
+    return /^[A-Za-z0-9_-]{40,128}$/.test(state);
+  }
+};
+OAuthStateService = __decorate30([
+  Injectable17(),
+  __metadata30("design:paramtypes", [typeof (_a19 = typeof CookieService2 !== "undefined" && CookieService2) === "function" ? _a19 : Object, typeof (_b10 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b10 : Object])
+], OAuthStateService);
+
+// src/oauth/OAuthService.ts
+var __decorate31 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata31 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a20;
+var _b11;
+var _c7;
+var _d4;
+var _e3;
+var _f3;
+var OAuthService = class OAuthService2 {
+  static {
+    __name(this, "OAuthService");
+  }
+  state;
+  google;
+  accounts;
+  sessions;
+  tokens;
+  users;
+  config;
+  logger;
+  constructor(state, google, accounts, sessions, tokens, users) {
+    this.state = state;
+    this.google = google;
+    this.accounts = accounts;
+    this.sessions = sessions;
+    this.tokens = tokens;
+    this.users = users;
+  }
+  startGoogleLogin(returnTo) {
+    this.googleConfig();
+    const { attempt, codeChallenge } = this.state.create({ intent: "login", returnTo });
+    return this.google.authorizationUrl(attempt, codeChallenge);
+  }
+  async startGoogleLink(userId, returnTo) {
+    this.googleConfig();
+    const user = await this.users.getById(userId);
+    if (user.status !== "active")
+      throw new OAuthFlowError("oauth_account_inactive", 403);
+    const sessionVersion = await this.tokens.getSessionVersion(userId);
+    const { attempt, codeChallenge } = this.state.create({
+      intent: "link",
+      returnTo,
+      userId,
+      sessionVersion
+    });
+    return { authorizationUrl: this.google.authorizationUrl(attempt, codeChallenge) };
+  }
+  async finishGoogleCallback(params) {
+    try {
+      this.googleConfig();
+      if (!params.state)
+        throw new OAuthFlowError("oauth_state_invalid");
+      const attempt = this.state.consume(params.state);
+      if (params.error) {
+        throw new OAuthFlowError(params.error === "access_denied" ? "oauth_access_denied" : "oauth_provider_error");
+      }
+      if (!params.code)
+        throw new OAuthFlowError("oauth_provider_error");
+      const identity = await this.google.exchange(params.code, attempt);
+      if (attempt.intent === "link") {
+        if (!attempt.userId || attempt.sessionVersion === void 0) {
+          throw new OAuthFlowError("oauth_state_invalid");
+        }
+        const currentVersion = await this.tokens.getSessionVersion(attempt.userId);
+        if (currentVersion !== attempt.sessionVersion) {
+          throw new OAuthFlowError("oauth_link_session_expired", 401);
+        }
+        await this.accounts.linkUser(attempt.userId, identity);
+      } else {
+        const user = await this.accounts.resolveForLogin(identity);
+        await this.sessions.establish(user);
+      }
+      return this.frontendSuccessUrl(attempt.returnTo, attempt.intent);
+    } catch (error) {
+      const code = this.publicErrorCode(error);
+      this.logger.warn("Google OAuth callback failed", { provider: "google", code });
+      return this.frontendErrorUrl(code);
+    }
+  }
+  frontendSuccessUrl(returnTo, mode) {
+    const google = this.googleConfig();
+    const url = new URL(google.frontendCallbackPath, this.config.frontendUrl);
+    url.searchParams.set("provider", "google");
+    url.searchParams.set("mode", mode);
+    url.searchParams.set("returnTo", this.state.validateReturnTo(returnTo));
+    return url.toString();
+  }
+  frontendErrorUrl(code) {
+    const path2 = this.config.oauth?.google?.errorRedirectPath ?? "/login";
+    const url = new URL(path2, this.config.frontendUrl);
+    url.searchParams.set("oauthError", code);
+    return url.toString();
+  }
+  publicErrorCode(error) {
+    if (error instanceof OAuthFlowError)
+      return error.oauthCode;
+    if (error instanceof Error && /^oauth_[a-z0-9_]+$/.test(error.message))
+      return error.message;
+    return "oauth_provider_error";
+  }
+  googleConfig() {
+    const google = this.config.oauth?.google;
+    if (!google)
+      throw new OAuthFlowError("oauth_provider_disabled", 404);
+    return google;
+  }
+};
+__decorate31([
+  Inject17(AUTH_CONFIG),
+  __metadata31("design:type", Object)
+], OAuthService.prototype, "config", void 0);
+__decorate31([
+  Log2(),
+  __metadata31("design:type", Object)
+], OAuthService.prototype, "logger", void 0);
+OAuthService = __decorate31([
+  Injectable18(),
+  __metadata31("design:paramtypes", [typeof (_a20 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a20 : Object, typeof (_b11 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b11 : Object, typeof (_c7 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _c7 : Object, typeof (_d4 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _d4 : Object, typeof (_e3 = typeof TokenService !== "undefined" && TokenService) === "function" ? _e3 : Object, typeof (_f3 = typeof UserService !== "undefined" && UserService) === "function" ? _f3 : Object])
+], OAuthService);
+
+// src/oauth/OAuthController.ts
+var __decorate32 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata32 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param11 = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var _a21;
+var callbackKey = /* @__PURE__ */ __name((ctx) => {
+  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+  const state = ctx.req.query("state") ?? "none";
+  const fingerprint = createHash4("sha256").update(state).digest("base64url").slice(0, 24);
+  return `${ip}:${fingerprint}`;
+}, "callbackKey");
+var OAuthController = class OAuthController2 {
+  static {
+    __name(this, "OAuthController");
+  }
+  oauth;
+  constructor(oauth) {
+    this.oauth = oauth;
+  }
+  start(ctx, returnTo) {
+    return ctx.redirect(this.oauth.startGoogleLogin(returnTo), 302);
+  }
+  async callback(ctx, code, state, error) {
+    const redirect = await this.oauth.finishGoogleCallback({ code, state, error });
+    return ctx.redirect(redirect, 302);
+  }
+  link(userId, returnTo) {
+    return this.oauth.startGoogleLink(userId, returnTo);
+  }
+};
+__decorate32([
+  Get5("/start"),
+  RateLimit2({ limit: 20, window: "15m", key: "ip" }),
+  __param11(0, Ctx()),
+  __param11(1, Query2("returnTo")),
+  __metadata32("design:type", Function),
+  __metadata32("design:paramtypes", [Object, String]),
+  __metadata32("design:returntype", void 0)
+], OAuthController.prototype, "start", null);
+__decorate32([
+  Get5("/callback"),
+  RateLimit2({ limit: 20, window: "15m", key: callbackKey }),
+  __param11(0, Ctx()),
+  __param11(1, Query2("code")),
+  __param11(2, Query2("state")),
+  __param11(3, Query2("error")),
+  __metadata32("design:type", Function),
+  __metadata32("design:paramtypes", [Object, String, String, String]),
+  __metadata32("design:returntype", Promise)
+], OAuthController.prototype, "callback", null);
+__decorate32([
+  Post5("/link"),
+  isAuth(),
+  RateLimit2({ limit: 10, window: "15m", key: "user" }),
+  __param11(0, User6("id")),
+  __param11(1, Query2("returnTo")),
+  __metadata32("design:type", Function),
+  __metadata32("design:paramtypes", [String, String]),
+  __metadata32("design:returntype", void 0)
+], OAuthController.prototype, "link", null);
+OAuthController = __decorate32([
+  Controller5("/auth/oauth/google"),
+  __metadata32("design:paramtypes", [typeof (_a21 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a21 : Object])
+], OAuthController);
+
+// src/oauth/index.ts
+var OAUTH_MODULE = [
+  OAuthAccountRepository,
+  OAuthAccountService,
+  OAuthStateService,
+  GoogleTokenVerifier,
+  GoogleOAuthProvider,
+  OAuthService,
+  OAuthController
+];
+
 // src/AuthPlugin.ts
 var DEFAULT_JWT = {
   accessSecret: process.env.JWT_ACCESS_SECRET || "",
@@ -4547,7 +5313,47 @@ var DEFAULT_JWT = {
   refreshSecret: process.env.JWT_REFRESH_SECRET || "",
   refreshExpiresIn: process.env.REFRESH_EXPIRES_IN || "7d"
 };
-var mergeConfig = /* @__PURE__ */ __name((config) => {
+var validateFrontendPath = /* @__PURE__ */ __name((value, name) => {
+  if (!value.startsWith("/") || value.startsWith("//") || value.includes("\\")) {
+    throw new Error(`${name} must be a same-origin path starting with a single '/'`);
+  }
+  return value;
+}, "validateFrontendPath");
+var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
+  const configuredGoogle = config?.oauth?.google;
+  if (!configuredGoogle)
+    return void 0;
+  const google = configuredGoogle === true ? {} : configuredGoogle;
+  const clientId = google.clientId ?? process.env.GOOGLE_CLIENT_ID ?? "";
+  const clientSecret = google.clientSecret ?? process.env.GOOGLE_CLIENT_SECRET ?? "";
+  if (!clientId)
+    throw Err10.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
+  if (!clientSecret)
+    throw Err10.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
+  const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
+  const callbackUrl = google.callbackUrl ?? process.env.GOOGLE_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/google/callback`;
+  let callback;
+  try {
+    callback = new URL(callbackUrl);
+  } catch {
+    throw new Error("auth.oauth.google.callbackUrl must be an absolute URL");
+  }
+  const local = callback.hostname === "localhost" || callback.hostname === "127.0.0.1" || callback.hostname === "[::1]" || callback.hostname === "::1";
+  if (callback.protocol !== "https:" && !(local && callback.protocol === "http:")) {
+    throw new Error("auth.oauth.google.callbackUrl must use HTTPS (HTTP is allowed only for localhost)");
+  }
+  return {
+    clientId,
+    clientSecret,
+    callbackUrl: callback.toString(),
+    frontendCallbackPath: validateFrontendPath(google.frontendCallbackPath ?? "/auth/oauth/callback", "auth.oauth.google.frontendCallbackPath"),
+    errorRedirectPath: validateFrontendPath(google.errorRedirectPath ?? "/login", "auth.oauth.google.errorRedirectPath"),
+    allowSignup: google.allowSignup ?? true,
+    autoLinkVerifiedEmail: google.autoLinkVerifiedEmail ?? false,
+    allowedHostedDomains: [...new Set((google.allowedHostedDomains ?? []).map((domain) => domain.trim().toLowerCase()).filter(Boolean))]
+  };
+}, "resolveGoogleConfig");
+var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
   const bcryptRounds = config?.bcryptRounds ?? 10;
   if (!Number.isInteger(bcryptRounds) || bcryptRounds < 4 || bcryptRounds > 31) {
     throw new Error("auth.bcryptRounds must be an integer between 4 and 31");
@@ -4575,19 +5381,26 @@ var mergeConfig = /* @__PURE__ */ __name((config) => {
       maxAge: config?.session?.maxAge ?? 300,
       secret: config?.session?.secret
       // fallback to jwt.accessSecret at use site
+    },
+    oauth: {
+      google: resolveGoogleConfig(config)
     }
   };
   if (!finalConfig.jwt.accessSecret) {
-    throw Err9.configRequired("auth", "JWT_ACCESS_SECRET");
+    throw Err10.configRequired("auth", "JWT_ACCESS_SECRET");
   }
   if (!finalConfig.jwt.refreshSecret) {
-    throw Err9.configRequired("auth", "JWT_REFRESH_SECRET");
+    throw Err10.configRequired("auth", "JWT_REFRESH_SECRET");
   }
   return finalConfig;
-}, "mergeConfig");
-var selectSchema = /* @__PURE__ */ __name((config) => {
-  if (config?.schema)
+}, "resolveAuthConfig");
+var selectAuthSchema = /* @__PURE__ */ __name((config) => {
+  if (config?.schema) {
+    if (config.oauth?.google && !config.schema.oauthAccounts) {
+      throw new Error("auth.schema.oauthAccounts is required when Google OAuth is enabled");
+    }
     return config.schema;
+  }
   const dialect = config?.dialect ?? "pg";
   switch (dialect) {
     case "sqlite":
@@ -4596,8 +5409,8 @@ var selectSchema = /* @__PURE__ */ __name((config) => {
     default:
       return authSchema;
   }
-}, "selectSchema");
-var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email()).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, ScopeContext).config(AUTH_CONFIG, mergeConfig(config)).set(AUTH_SCHEMA, selectSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
+}, "selectAuthSchema");
+var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email(config?.email)).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_MODULE, OAUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, ScopeContext).config(AUTH_CONFIG, resolveAuthConfig(config)).set(AUTH_SCHEMA, selectAuthSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
 
 // src/seed.ts
 var toSeedId = /* @__PURE__ */ __name((prefix, value) => {
@@ -4743,6 +5556,7 @@ export {
   AuthQueries,
   AuthResolver,
   AuthService,
+  AuthSessionService,
   Can,
   CanCreate,
   CanDelete,
@@ -4811,6 +5625,7 @@ export {
   join2 as join,
   languageParam,
   loginDto,
+  oauthAccountsTable,
   own,
   parseSchema,
   permissionIdParam,