najm-auth 2.0.4 → 2.0.6

package/README.md

@@ -167,6 +167,7 @@ All routes are prefixed with `/auth` and auto-registered by the plugin.
 | `POST` | `/auth/register` | Register new user | None |
 | `POST` | `/auth/login` | Login with email/password | None |
 | `POST` | `/auth/refresh` | Refresh access token (cookie) | None (uses refresh cookie) |
+| `POST` | `/auth/session/recover` | Reissue signed session without token rotation | Refresh cookie + recovery header |
 | `POST` | `/auth/logout` | Logout and revoke tokens | ✅ Required |
 | `GET` | `/auth/me` | Get current user profile | ✅ Required |
 | `POST` | `/auth/forgot-password` | Request password reset | None |
@@ -600,6 +601,7 @@ limits are active when `auth()` is registered.
 | `POST /auth/register` | 5 | 15 minutes | IP |
 | `POST /auth/login` | 5 | 15 minutes | IP |
 | `POST /auth/refresh` | 15 | 15 minutes | Cookie fingerprint |
+| `POST /auth/session/recover` | 120 | 1 minute | Cookie fingerprint |
 | `POST /auth/logout` | 10 | 15 minutes | User ID |
 | `GET /auth/me` | 30 | 1 minute | User ID |
 | `POST /auth/forgot-password` | 3 | 15 minutes | IP |
@@ -675,8 +677,15 @@ throw new HttpError(403, 'Insufficient permissions for this action');
 - Login uses a dummy password hash for missing users to reduce timing leaks.
 - Forgot-password responses avoid email enumeration.
 - Auth routes register `najm-rate` and ship route-level brute-force limits.
-- Session cookies are signed, short-lived, and checked against session version
-  invalidation.
+- Session cookies are signed and short-lived; server auth resolution checks
+  their session version.
+- Expired signed sessions recover through authoritative, non-rotating refresh
+  validation; middleware verifies the reissued HMAC before using its claims.
+- Server-side recovery sends only the configured refresh cookie and accepts
+  relative or exact same-origin endpoints. URL credentials and any
+  scheme/hostname/port change are rejected before the network request.
+- `verifyAlways` forces that authoritative check on every protected request;
+  the default bounds cached role/status staleness to `session.maxAge`.
 
 ### Password Reset Tokens
 

package/dist/{NajmAuthClient-B9dGk9MH.d.ts → NajmAuthClient-0yzFb9CR.d.ts}

@@ -247,4 +247,4 @@ declare class NajmAuthClient {
  */
 declare function createAuthClient(config: AuthClientConfig): NajmAuthClient;
 
-export { AuthError as A, type DecodedToken as D, FetchClient as F, type HydrateSession as H, NajmAuthClient as N, type OAuthProvider as O, type RetryConfig as R, type SyncPayload as S, type TabSyncMessage as T, type AuthClientConfig as a, type AuthEventMap as b, createAuthClient as c, type AuthState as d, type AuthUser as e, type AuthEvent as f, type AuthEventHandler as g, type ServerResponse as h, type TokenPair as i, type RequestOptions as j, type OAuthLoginOptions as k };
+export { type AuthClientConfig as A, type DecodedToken as D, FetchClient as F, type HydrateSession as H, NajmAuthClient as N, type OAuthLoginOptions as O, type RequestOptions as R, type SyncPayload as S, type TabSyncMessage as T, AuthError as a, type AuthEvent as b, type AuthEventHandler as c, type AuthEventMap as d, type AuthState as e, type AuthUser as f, type OAuthProvider as g, type RetryConfig as h, type ServerResponse as i, type TokenPair as j, createAuthClient as k };

package/dist/client/edge.d.ts

@@ -11,6 +11,10 @@ interface AuthMiddlewareConfig {
     roleRoutes?: Record<string, string[]>;
     /** Refresh token cookie name (default: 'refreshToken') */
     cookieName?: string;
+    /** API base URL used by session recovery (default: '/api'). */
+    apiBaseURL?: string;
+    /** Auth endpoint prefix used by session recovery (default: '/auth'). */
+    authPrefix?: string;
     /** Signed session cookie name (default: 'najm.session') */
     sessionCookieName?: string;
     /** @deprecated Session cookies are verified locally at the Edge. */
@@ -20,10 +24,16 @@ interface AuthMiddlewareConfig {
     /** Must match the auth plugin's session.maxAge. Default: 300 seconds. */
     sessionMaxAge?: number;
     /**
-     * Retained for compatibility. Every protected route now verifies the signed
-     * session cookie locally, so enabling this never calls `/auth/me`.
+     * Force authoritative refresh-session validation on every protected request.
+     * This reissues the signed session cookie without rotating refresh tokens.
      */
     verifyAlways?: boolean;
+    /**
+     * Session-recovery endpoint. Relative values resolve against the request
+     * origin. Defaults to `${apiBaseURL}${authPrefix}/session/recover`.
+     * Set to false to disable automatic recovery.
+     */
+    recoveryURL?: string | false;
 }
 /**
  * Create a Next.js middleware function that protects routes based on auth state.

package/dist/client/edge.js

@@ -131,6 +131,106 @@ function isStringArray(value) {
 }
 __name(isStringArray, "isStringArray");
 
+// src/client/sessionRecovery.ts
+async function requestSessionRecovery(options) {
+  if (!isCookieName(options.refreshCookieName) || !isCookieName(options.sessionCookieName)) {
+    return { status: "unavailable" };
+  }
+  if (!isCookieValue(options.refreshCookieValue)) {
+    return { status: "invalid" };
+  }
+  const endpoint = sameOriginRecoveryEndpoint(
+    options.endpoint,
+    options.requestOrigin
+  );
+  if (!endpoint) {
+    return { status: "unavailable" };
+  }
+  let response;
+  try {
+    response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        Cookie: `${options.refreshCookieName}=${options.refreshCookieValue}`,
+        "X-Najm-Session-Recovery": "1"
+      },
+      cache: "no-store",
+      redirect: "manual"
+    });
+  } catch {
+    return { status: "unavailable" };
+  }
+  if (!response.ok) {
+    const status = response.status;
+    return {
+      status: status === 400 || status === 401 || status === 403 ? "invalid" : "unavailable",
+      httpStatus: status
+    };
+  }
+  const setCookie = response.headers.get("set-cookie");
+  if (!setCookie) return { status: "unavailable", httpStatus: response.status };
+  const sessionCookieValue = readSetCookieValue(setCookie, options.sessionCookieName);
+  if (!sessionCookieValue) {
+    return { status: "unavailable", httpStatus: response.status };
+  }
+  const claims = await verifySessionCookie(sessionCookieValue, {
+    secret: options.sessionSecret,
+    maxAgeSeconds: options.sessionMaxAge
+  });
+  if (!claims) return { status: "unavailable", httpStatus: response.status };
+  return {
+    status: "recovered",
+    claims,
+    setCookie,
+    sessionCookieValue
+  };
+}
+__name(requestSessionRecovery, "requestSessionRecovery");
+function authEndpoint(baseURL, authPrefix, suffix, requestURL) {
+  const normalizedBase = baseURL.replace(/\/+$/, "");
+  const normalizedPrefix = `/${authPrefix.replace(/^\/+|\/+$/g, "")}`;
+  const normalizedSuffix = `/${suffix.replace(/^\/+/, "")}`;
+  const value = `${normalizedBase}${normalizedPrefix}${normalizedSuffix}`;
+  return requestURL ? new URL(value, requestURL).toString() : value;
+}
+__name(authEndpoint, "authEndpoint");
+function replaceCookieValue(cookieHeader, name, value) {
+  const parts = cookieHeader.split(";").map((part) => part.trim()).filter(Boolean).filter((part) => part.slice(0, part.indexOf("=")).trim() !== name);
+  parts.push(`${name}=${value}`);
+  return parts.join("; ");
+}
+__name(replaceCookieValue, "replaceCookieValue");
+function readSetCookieValue(setCookie, name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = setCookie.match(new RegExp(`(?:^|,\\s*)${escaped}=([^;]*)`));
+  return match?.[1] || void 0;
+}
+__name(readSetCookieValue, "readSetCookieValue");
+function isCookieName(value) {
+  return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(value);
+}
+__name(isCookieName, "isCookieName");
+function isCookieValue(value) {
+  return value.length > 0 && /^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]+$/.test(value);
+}
+__name(isCookieValue, "isCookieValue");
+function sameOriginRecoveryEndpoint(endpoint, requestOrigin) {
+  try {
+    const trusted = new URL(requestOrigin);
+    if (trusted.protocol !== "https:" && trusted.protocol !== "http:" || trusted.username || trusted.password) {
+      return void 0;
+    }
+    const resolved = new URL(endpoint, trusted.origin);
+    if (resolved.username || resolved.password) return void 0;
+    if (resolved.origin !== trusted.origin) return void 0;
+    return resolved.toString();
+  } catch {
+    return void 0;
+  }
+}
+__name(sameOriginRecoveryEndpoint, "sameOriginRecoveryEndpoint");
+
 // src/client/server/withAuthMiddleware.ts
 function withAuthMiddleware(config) {
   const {
@@ -139,26 +239,31 @@ function withAuthMiddleware(config) {
     loginRoute = "/login",
     roleRoutes = {},
     cookieName = "refreshToken",
+    apiBaseURL = "/api",
+    authPrefix = "/auth",
     sessionCookieName = "najm.session",
     sessionSecret,
     sessionMaxAge,
-    verifyAlways = false
+    verifyAlways = false,
+    recoveryURL
   } = config;
-  void verifyAlways;
   return /* @__PURE__ */ __name(async function middleware(request) {
     const { NextResponse } = await import("next/server");
-    const redirectToLogin = /* @__PURE__ */ __name((pathname2, clearCookies) => {
+    const redirectToLogin = /* @__PURE__ */ __name((returnPath2, clearCookies) => {
       const loginUrl = new URL(loginRoute, request.url);
-      loginUrl.searchParams.set("from", pathname2);
+      loginUrl.searchParams.set("from", returnPath2);
       const res = NextResponse.redirect(loginUrl);
-      if (clearCookies) {
+      if (clearCookies.includes("refresh")) {
         res.cookies.delete(cookieName);
+      }
+      if (clearCookies.includes("session")) {
         res.cookies.delete(sessionCookieName);
       }
       return res;
     }, "redirectToLogin");
     const url = new URL(request.url);
     const pathname = url.pathname;
+    const returnPath = `${url.pathname}${url.search}`;
     if (matchesAny(pathname, publicRoutes)) {
       return NextResponse.next();
     }
@@ -167,19 +272,54 @@ function withAuthMiddleware(config) {
     const cookie = request.headers.get("cookie") ?? "";
     const sessionCookie = readCookieValue(cookie, sessionCookieName);
     const secret = resolveSessionSecret(sessionSecret);
-    if (!sessionCookie || !secret) {
-      return redirectToLogin(pathname, true);
+    if (!secret) {
+      return redirectToLogin(returnPath, ["session"]);
     }
-    const session = await verifySessionCookie(sessionCookie, {
+    let session = sessionCookie ? await verifySessionCookie(sessionCookie, {
       secret,
       maxAgeSeconds: sessionMaxAge
-    });
-    if (!session) {
-      return redirectToLogin(pathname, true);
+    }) : null;
+    let recovery = null;
+    if (!session || verifyAlways) {
+      const refreshCookie = readCookieValue(cookie, cookieName);
+      if (!refreshCookie || recoveryURL === false) {
+        return redirectToLogin(returnPath, ["refresh", "session"]);
+      }
+      const endpoint = recoveryURL ? new URL(recoveryURL, request.url).toString() : authEndpoint(apiBaseURL, authPrefix, "/session/recover", request.url);
+      recovery = await requestSessionRecovery({
+        endpoint,
+        requestOrigin: url.origin,
+        refreshCookieName: cookieName,
+        refreshCookieValue: refreshCookie,
+        sessionCookieName,
+        sessionSecret: secret,
+        sessionMaxAge
+      });
+      if (recovery.status !== "recovered") {
+        return redirectToLogin(
+          returnPath,
+          recovery.status === "invalid" ? ["refresh", "session"] : ["session"]
+        );
+      }
+      session = recovery.claims;
     }
     const requiredRoles = findMatchingRoles(pathname, roleRoutes);
     if (requiredRoles && !session.roles.some((role) => requiredRoles.includes(role))) {
-      return new NextResponse(null, { status: 403 });
+      const forbidden = new NextResponse(null, { status: 403 });
+      if (recovery?.status === "recovered") {
+        forbidden.headers.append("Set-Cookie", recovery.setCookie);
+      }
+      return forbidden;
+    }
+    if (recovery?.status === "recovered") {
+      const requestHeaders = new Headers(request.headers);
+      requestHeaders.set(
+        "cookie",
+        replaceCookieValue(cookie, sessionCookieName, recovery.sessionCookieValue)
+      );
+      const response = NextResponse.next({ request: { headers: requestHeaders } });
+      response.headers.append("Set-Cookie", recovery.setCookie);
+      return response;
     }
     return NextResponse.next();
   }, "middleware");

package/dist/client/index.d.ts

@@ -1,5 +1,5 @@
-import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../NajmAuthClient-B9dGk9MH.js';
-export { a as AuthClientConfig, A as AuthError, f as AuthEvent, g as AuthEventHandler, b as AuthEventMap, d as AuthState, e as AuthUser, F as FetchClient, H as HydrateSession, N as NajmAuthClient, k as OAuthLoginOptions, O as OAuthProvider, j as RequestOptions, R as RetryConfig, h as ServerResponse, i as TokenPair, c as createAuthClient } from '../NajmAuthClient-B9dGk9MH.js';
+import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../NajmAuthClient-0yzFb9CR.js';
+export { A as AuthClientConfig, a as AuthError, b as AuthEvent, c as AuthEventHandler, d as AuthEventMap, e as AuthState, f as AuthUser, F as FetchClient, H as HydrateSession, N as NajmAuthClient, O as OAuthLoginOptions, g as OAuthProvider, R as RequestOptions, h as RetryConfig, i as ServerResponse, j as TokenPair, k as createAuthClient } from '../NajmAuthClient-0yzFb9CR.js';
 
 /**
  * Decode a JWT token payload without verification.

package/dist/client/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as react from 'react';
 import { ReactNode, CSSProperties, ReactElement } from 'react';
-import { N as NajmAuthClient, H as HydrateSession, d as AuthState, e as AuthUser, A as AuthError, k as OAuthLoginOptions, f as AuthEvent, b as AuthEventMap } from '../../NajmAuthClient-B9dGk9MH.js';
+import { N as NajmAuthClient, H as HydrateSession, e as AuthState, f as AuthUser, a as AuthError, O as OAuthLoginOptions, b as AuthEvent, d as AuthEventMap } from '../../NajmAuthClient-0yzFb9CR.js';
 
 interface AuthProviderProps {
     client: NajmAuthClient;

package/dist/client/react/index.js

@@ -7,7 +7,7 @@ import { useEffect, useRef } from "react";
 
 // src/client/react/context.ts
 import { createContext, useContext } from "react";
-var KEY = /* @__PURE__ */ Symbol.for("najm:auth:client:context");
+var KEY = Symbol.for("najm:auth:client:context");
 var contextStore = globalThis;
 function getAuthClientContext() {
   const existing = contextStore[KEY];

package/dist/client/server/index.d.ts

@@ -1,4 +1,4 @@
-import { e as AuthUser, F as FetchClient, R as RetryConfig, N as NajmAuthClient } from '../../NajmAuthClient-B9dGk9MH.js';
+import { f as AuthUser, F as FetchClient, N as NajmAuthClient, h as RetryConfig } from '../../NajmAuthClient-0yzFb9CR.js';
 export { withAuthMiddleware } from '../edge.js';
 import 'next/server';
 
@@ -72,27 +72,17 @@ interface ServerSession {
 interface GetSessionConfig {
     /**
      * Base URL for auth endpoints.
-     * Defaults to `${NEXT_PUBLIC_API_URL || http://localhost:${PORT||3000}}/api`.
+     * Defaults to `NEXT_PUBLIC_API_URL` or the same-origin `/api` path.
      */
     baseURL?: string;
-    /**
-     * Auth route prefix appended to baseURL (default: '/auth').
-     */
+    /** Auth route prefix appended to baseURL (default: '/auth'). */
     authPrefix?: string;
-    /**
-     * Refresh token cookie name to check before making the network call.
-     * If absent we skip and return null immediately.
-     * Default: 'refreshToken'
-     */
+    /** Refresh token cookie name (default: 'refreshToken'). */
     cookieName?: string;
-    /**
-     * Session cookie name (default: 'najm.session').
-     * When present and valid, skips the /auth/me fetch entirely.
-     */
+    /** Signed session cookie name (default: 'najm.session'). */
     sessionCookieName?: string;
     /**
      * Secret used to verify the session cookie HMAC signature.
-     * Must match the `jwt.accessSecret` used by the auth plugin.
      * Falls back to NAJM_SESSION_SECRET or JWT_ACCESS_SECRET env vars.
      */
     sessionSecret?: string;
@@ -101,6 +91,11 @@ interface GetSessionConfig {
      * Must match the auth plugin's `session.maxAge`. Default: 300.
      */
     sessionMaxAge?: number;
+    /**
+     * Session-recovery endpoint. Defaults to
+     * `${baseURL}${authPrefix}/session/recover`. Set to false to disable fallback.
+     */
+    recoveryURL?: string | false;
     /**
      * Error handling mode:
      * - 'nullable' (default): returns null on any failure
@@ -122,29 +117,10 @@ declare class AuthTransportError extends Error {
     constructor(message: string, status?: number);
 }
 /**
- * Resolve the current session inside a Next.js Server Component, Route Handler,
- * or Server Action.
- *
- * **Fast path**: If a signed `najm.session` cookie exists and is valid,
- * returns the session instantly with zero network calls.
- *
- * **Fallback**: Checks the refresh token cookie and calls `/auth/me`.
- *
- * @example
- * ```tsx
- * import { getSession } from 'najm-auth/client/server';
- *
- * export default async function RootLayout({ children }) {
- *   const session = await getSession();
- *   return (
- *     <html><body>
- *       <AuthProvider client={authClient} initialSession={session}>
- *         {children}
- *       </AuthProvider>
- *     </body></html>
- *   );
- * }
- * ```
+ * Resolve a session in a Next.js Server Component, Route Handler, or Server
+ * Action. Recovery returns claims for the current render but cannot persist
+ * response cookies during Server Component rendering; middleware performs that
+ * persistence for protected navigation.
  */
 declare function getSession(config?: GetSessionConfig): Promise<ServerSession | null>;
 
@@ -200,11 +176,16 @@ interface DefineAuthConfig {
     sessionSecret?: string;
     /** Must match the auth plugin's session.maxAge. Default: 300 seconds. */
     sessionMaxAge?: number;
+    /**
+     * Session-recovery endpoint. Defaults to
+     * `${apiBaseURL}${authPrefix}/session/recover`; false disables recovery.
+     */
+    recoveryURL?: string | false;
     /** Next.js middleware matcher (default: exclude _next, favicon, api) */
     matcher?: string[];
     /**
-     * Retained for compatibility. Every protected route verifies the signed
-     * session cookie locally without an `/auth/me` request.
+     * Force authoritative refresh-session validation on every protected request.
+     * Recovery reissues the signed cookie without rotating refresh tokens.
      */
     verifyAlways?: boolean;
 }
@@ -218,7 +199,7 @@ interface AuthKit {
     readonly client: NajmAuthClient;
     /** Shortcut for `client.api` — the underlying FetchClient with auth attached. */
     readonly api: FetchClient;
-    /** Resolve session — reads signed cookie first (instant), falls back to /auth/me */
+    /** Resolve session — signed-cookie first, then non-rotating recovery. */
     getSession: (opts?: Pick<GetSessionConfig, 'mode'>) => Promise<ServerSession | null>;
     /** Require session — throws if unauthenticated */
     requireSession: () => Promise<ServerSession>;

package/dist/client/server/index.js

@@ -144,6 +144,111 @@ var init_sessionCookie = __esm({
   }
 });
 
+// src/client/sessionRecovery.ts
+async function requestSessionRecovery(options) {
+  if (!isCookieName(options.refreshCookieName) || !isCookieName(options.sessionCookieName)) {
+    return { status: "unavailable" };
+  }
+  if (!isCookieValue(options.refreshCookieValue)) {
+    return { status: "invalid" };
+  }
+  const endpoint = sameOriginRecoveryEndpoint(
+    options.endpoint,
+    options.requestOrigin
+  );
+  if (!endpoint) {
+    return { status: "unavailable" };
+  }
+  let response;
+  try {
+    response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        Cookie: `${options.refreshCookieName}=${options.refreshCookieValue}`,
+        "X-Najm-Session-Recovery": "1"
+      },
+      cache: "no-store",
+      redirect: "manual"
+    });
+  } catch {
+    return { status: "unavailable" };
+  }
+  if (!response.ok) {
+    const status = response.status;
+    return {
+      status: status === 400 || status === 401 || status === 403 ? "invalid" : "unavailable",
+      httpStatus: status
+    };
+  }
+  const setCookie = response.headers.get("set-cookie");
+  if (!setCookie) return { status: "unavailable", httpStatus: response.status };
+  const sessionCookieValue = readSetCookieValue(setCookie, options.sessionCookieName);
+  if (!sessionCookieValue) {
+    return { status: "unavailable", httpStatus: response.status };
+  }
+  const claims = await verifySessionCookie(sessionCookieValue, {
+    secret: options.sessionSecret,
+    maxAgeSeconds: options.sessionMaxAge
+  });
+  if (!claims) return { status: "unavailable", httpStatus: response.status };
+  return {
+    status: "recovered",
+    claims,
+    setCookie,
+    sessionCookieValue
+  };
+}
+function authEndpoint(baseURL, authPrefix, suffix, requestURL) {
+  const normalizedBase = baseURL.replace(/\/+$/, "");
+  const normalizedPrefix = `/${authPrefix.replace(/^\/+|\/+$/g, "")}`;
+  const normalizedSuffix = `/${suffix.replace(/^\/+/, "")}`;
+  const value = `${normalizedBase}${normalizedPrefix}${normalizedSuffix}`;
+  return requestURL ? new URL(value, requestURL).toString() : value;
+}
+function replaceCookieValue(cookieHeader, name, value) {
+  const parts = cookieHeader.split(";").map((part) => part.trim()).filter(Boolean).filter((part) => part.slice(0, part.indexOf("=")).trim() !== name);
+  parts.push(`${name}=${value}`);
+  return parts.join("; ");
+}
+function readSetCookieValue(setCookie, name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = setCookie.match(new RegExp(`(?:^|,\\s*)${escaped}=([^;]*)`));
+  return match?.[1] || void 0;
+}
+function isCookieName(value) {
+  return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(value);
+}
+function isCookieValue(value) {
+  return value.length > 0 && /^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]+$/.test(value);
+}
+function sameOriginRecoveryEndpoint(endpoint, requestOrigin) {
+  try {
+    const trusted = new URL(requestOrigin);
+    if (trusted.protocol !== "https:" && trusted.protocol !== "http:" || trusted.username || trusted.password) {
+      return void 0;
+    }
+    const resolved = new URL(endpoint, trusted.origin);
+    if (resolved.username || resolved.password) return void 0;
+    if (resolved.origin !== trusted.origin) return void 0;
+    return resolved.toString();
+  } catch {
+    return void 0;
+  }
+}
+var init_sessionRecovery = __esm({
+  "src/client/sessionRecovery.ts"() {
+    init_sessionCookie();
+    __name(requestSessionRecovery, "requestSessionRecovery");
+    __name(authEndpoint, "authEndpoint");
+    __name(replaceCookieValue, "replaceCookieValue");
+    __name(readSetCookieValue, "readSetCookieValue");
+    __name(isCookieName, "isCookieName");
+    __name(isCookieValue, "isCookieValue");
+    __name(sameOriginRecoveryEndpoint, "sameOriginRecoveryEndpoint");
+  }
+});
+
 // src/client/server/getSession.ts
 var getSession_exports = {};
 __export(getSession_exports, {
@@ -155,17 +260,25 @@ __export(getSession_exports, {
 function defaultBaseURL() {
   const explicit = typeof process !== "undefined" ? process.env.NAJM_AUTH_BASE_URL : void 0;
   if (explicit) return explicit;
-  const origin = typeof process !== "undefined" ? process.env.NEXT_PUBLIC_API_URL ?? `http://localhost:${process.env.PORT ?? 3e3}` : "http://localhost:3000";
-  return `${origin.replace(/\/$/, "")}/api`;
+  const publicUrl = typeof process !== "undefined" ? process.env.NEXT_PUBLIC_API_URL : void 0;
+  return publicUrl || "/api";
 }
-function buildSession(body) {
-  if (!body?.data) return null;
-  const { roles, permissions, ...user } = body.data;
-  return {
-    user,
-    roles: roles ?? (user.role ? [user.role] : void 0),
-    permissions: permissions ?? user.permissions
-  };
+function firstForwardedValue(value) {
+  const first = value?.split(",")[0]?.trim();
+  return first || void 0;
+}
+function requestOriginFromHeaders(headers) {
+  const host = firstForwardedValue(headers.get("x-forwarded-host")) ?? firstForwardedValue(headers.get("host"));
+  if (!host) return void 0;
+  const protocol = firstForwardedValue(headers.get("x-forwarded-proto")) ?? "https";
+  if (protocol !== "https" && protocol !== "http") return void 0;
+  try {
+    const url = new URL(`${protocol}://${host}`);
+    if (url.username || url.password) return void 0;
+    return url.origin;
+  } catch {
+    return void 0;
+  }
 }
 async function getSession(config = {}) {
   const cookieName = config.cookieName ?? "refreshToken";
@@ -173,73 +286,80 @@ async function getSession(config = {}) {
   const baseURL = config.baseURL ?? defaultBaseURL();
   const prefix = config.authPrefix ?? "/auth";
   const strict = config.mode === "strict";
-  let cookieHeader = "";
   let sessionCookieValue;
-  let hasRefreshCookie = false;
+  let refreshCookieValue;
+  let requestOrigin;
   try {
     const mod = await import("next/headers");
     const cookieStore = await mod.cookies();
-    const sessionCookie = cookieStore.get(sessionCookieName);
-    if (sessionCookie) sessionCookieValue = sessionCookie.value;
-    if (typeof cookieStore.get === "function") {
-      hasRefreshCookie = !!cookieStore.get(cookieName);
+    sessionCookieValue = cookieStore.get(sessionCookieName)?.value;
+    refreshCookieValue = cookieStore.get(cookieName)?.value;
+    if (typeof mod.headers === "function") {
+      requestOrigin = requestOriginFromHeaders(await mod.headers());
     }
-    cookieHeader = cookieStore.getAll().map((c) => `${c.name}=${c.value}`).join("; ");
-  } catch (err) {
+  } catch {
     if (strict) throw new AuthConfigError("Failed to read cookies from Next.js headers()");
     return null;
   }
-  if (sessionCookieValue) {
-    const secret = resolveSessionSecret(config.sessionSecret);
-    if (!secret) {
-      if (strict) throw new AuthConfigError("Session cookie secret is not configured");
-      return null;
-    }
+  const secret = resolveSessionSecret(config.sessionSecret);
+  if (sessionCookieValue && secret) {
     const claims = await verifySessionCookie(sessionCookieValue, {
       secret,
       maxAgeSeconds: config.sessionMaxAge
     });
-    if (!claims) {
-      if (strict) throw new NoSessionError("Invalid or expired session cookie");
-      return null;
+    if (claims) {
+      return {
+        user: claims.user,
+        roles: claims.roles,
+        permissions: claims.permissions
+      };
     }
-    return {
-      user: claims.user,
-      roles: claims.roles,
-      permissions: claims.permissions
-    };
   }
-  if (!hasRefreshCookie) {
-    if (strict) throw new NoSessionError("No refresh token cookie");
+  if (!secret) {
+    if (strict) throw new AuthConfigError("Session cookie secret is not configured");
     return null;
   }
-  if (!cookieHeader) {
-    if (strict) throw new NoSessionError("Empty cookie header");
+  if (!refreshCookieValue || config.recoveryURL === false) {
+    if (strict) throw new NoSessionError("No recoverable refresh session");
     return null;
   }
-  try {
-    const res = await fetch(`${baseURL}${prefix}/me`, {
-      headers: { Cookie: cookieHeader, Accept: "application/json" },
-      cache: "no-store"
-    });
-    if (!res.ok) {
-      if (strict) throw new AuthTransportError(`/auth/me returned ${res.status}`, res.status);
-      return null;
-    }
-    const body = await res.json();
-    const session = buildSession(body);
-    if (!session && strict) throw new NoSessionError("No user data in /auth/me response");
-    return session;
-  } catch (err) {
-    if (err instanceof NoSessionError || err instanceof AuthTransportError) throw err;
-    if (strict) throw new AuthTransportError(`Failed to fetch /auth/me: ${err.message}`);
+  if (!requestOrigin) {
+    if (strict) throw new AuthConfigError("Incoming request origin is unavailable");
     return null;
   }
+  const endpoint = config.recoveryURL ? new URL(config.recoveryURL, requestOrigin).toString() : authEndpoint(baseURL, prefix, "/session/recover", requestOrigin);
+  const recovery = await requestSessionRecovery({
+    endpoint,
+    requestOrigin,
+    refreshCookieName: cookieName,
+    refreshCookieValue,
+    sessionCookieName,
+    sessionSecret: secret,
+    sessionMaxAge: config.sessionMaxAge
+  });
+  if (recovery.status === "recovered") {
+    return {
+      user: recovery.claims.user,
+      roles: recovery.claims.roles,
+      permissions: recovery.claims.permissions
+    };
+  }
+  if (strict) {
+    if (recovery.status === "invalid") {
+      throw new NoSessionError("Refresh session is invalid or revoked");
+    }
+    throw new AuthTransportError(
+      "Session recovery endpoint was unavailable or returned an invalid session",
+      recovery.httpStatus
+    );
+  }
+  return null;
 }
 var NoSessionError, AuthConfigError, AuthTransportError;
 var init_getSession = __esm({
   "src/client/server/getSession.ts"() {
     init_sessionCookie();
+    init_sessionRecovery();
     NoSessionError = class extends Error {
       static {
         __name(this, "NoSessionError");
@@ -272,7 +392,8 @@ var init_getSession = __esm({
       code = "AUTH_TRANSPORT_ERROR";
     };
     __name(defaultBaseURL, "defaultBaseURL");
-    __name(buildSession, "buildSession");
+    __name(firstForwardedValue, "firstForwardedValue");
+    __name(requestOriginFromHeaders, "requestOriginFromHeaders");
     __name(getSession, "getSession");
   }
 });
@@ -468,6 +589,7 @@ __name(createServerClient, "createServerClient");
 
 // src/client/server/withAuthMiddleware.ts
 init_sessionCookie();
+init_sessionRecovery();
 function withAuthMiddleware(config) {
   const {
     protectedRoutes = [],
@@ -475,26 +597,31 @@ function withAuthMiddleware(config) {
     loginRoute = "/login",
     roleRoutes = {},
     cookieName = "refreshToken",
+    apiBaseURL = "/api",
+    authPrefix = "/auth",
     sessionCookieName = "najm.session",
     sessionSecret,
     sessionMaxAge,
-    verifyAlways = false
+    verifyAlways = false,
+    recoveryURL
   } = config;
-  void verifyAlways;
   return /* @__PURE__ */ __name(async function middleware(request) {
     const { NextResponse } = await import("next/server");
-    const redirectToLogin = /* @__PURE__ */ __name((pathname2, clearCookies) => {
+    const redirectToLogin = /* @__PURE__ */ __name((returnPath2, clearCookies) => {
       const loginUrl = new URL(loginRoute, request.url);
-      loginUrl.searchParams.set("from", pathname2);
+      loginUrl.searchParams.set("from", returnPath2);
       const res = NextResponse.redirect(loginUrl);
-      if (clearCookies) {
+      if (clearCookies.includes("refresh")) {
         res.cookies.delete(cookieName);
+      }
+      if (clearCookies.includes("session")) {
         res.cookies.delete(sessionCookieName);
       }
       return res;
     }, "redirectToLogin");
     const url = new URL(request.url);
     const pathname = url.pathname;
+    const returnPath = `${url.pathname}${url.search}`;
     if (matchesAny(pathname, publicRoutes)) {
       return NextResponse.next();
     }
@@ -503,19 +630,54 @@ function withAuthMiddleware(config) {
     const cookie = request.headers.get("cookie") ?? "";
     const sessionCookie = readCookieValue(cookie, sessionCookieName);
     const secret = resolveSessionSecret(sessionSecret);
-    if (!sessionCookie || !secret) {
-      return redirectToLogin(pathname, true);
+    if (!secret) {
+      return redirectToLogin(returnPath, ["session"]);
     }
-    const session = await verifySessionCookie(sessionCookie, {
+    let session = sessionCookie ? await verifySessionCookie(sessionCookie, {
       secret,
       maxAgeSeconds: sessionMaxAge
-    });
-    if (!session) {
-      return redirectToLogin(pathname, true);
+    }) : null;
+    let recovery = null;
+    if (!session || verifyAlways) {
+      const refreshCookie = readCookieValue(cookie, cookieName);
+      if (!refreshCookie || recoveryURL === false) {
+        return redirectToLogin(returnPath, ["refresh", "session"]);
+      }
+      const endpoint = recoveryURL ? new URL(recoveryURL, request.url).toString() : authEndpoint(apiBaseURL, authPrefix, "/session/recover", request.url);
+      recovery = await requestSessionRecovery({
+        endpoint,
+        requestOrigin: url.origin,
+        refreshCookieName: cookieName,
+        refreshCookieValue: refreshCookie,
+        sessionCookieName,
+        sessionSecret: secret,
+        sessionMaxAge
+      });
+      if (recovery.status !== "recovered") {
+        return redirectToLogin(
+          returnPath,
+          recovery.status === "invalid" ? ["refresh", "session"] : ["session"]
+        );
+      }
+      session = recovery.claims;
     }
     const requiredRoles = findMatchingRoles(pathname, roleRoutes);
     if (requiredRoles && !session.roles.some((role) => requiredRoles.includes(role))) {
-      return new NextResponse(null, { status: 403 });
+      const forbidden = new NextResponse(null, { status: 403 });
+      if (recovery?.status === "recovered") {
+        forbidden.headers.append("Set-Cookie", recovery.setCookie);
+      }
+      return forbidden;
+    }
+    if (recovery?.status === "recovered") {
+      const requestHeaders = new Headers(request.headers);
+      requestHeaders.set(
+        "cookie",
+        replaceCookieValue(cookie, sessionCookieName, recovery.sessionCookieValue)
+      );
+      const response = NextResponse.next({ request: { headers: requestHeaders } });
+      response.headers.append("Set-Cookie", recovery.setCookie);
+      return response;
     }
     return NextResponse.next();
   }, "middleware");
@@ -1049,6 +1211,7 @@ function defineAuth(authConfig = {}) {
     sessionCookieName = "najm.session",
     sessionSecret,
     sessionMaxAge,
+    recoveryURL,
     matcher = ["/((?!_next/static|_next/image|favicon.ico|api).*)"],
     verifyAlways = false,
     refreshThreshold,
@@ -1058,13 +1221,13 @@ function defineAuth(authConfig = {}) {
     retry
   } = authConfig;
   const sessionConfig = {
-    baseURL: void 0,
-    // resolved at call time from env/defaults
+    baseURL: apiBaseURL,
     authPrefix,
     cookieName,
     sessionCookieName,
     sessionSecret,
-    sessionMaxAge
+    sessionMaxAge,
+    recoveryURL
   };
   let _client = null;
   const getClient = /* @__PURE__ */ __name(() => {
@@ -1112,9 +1275,12 @@ function defineAuth(authConfig = {}) {
     loginRoute,
     roleRoutes,
     cookieName,
+    apiBaseURL,
+    authPrefix,
     sessionCookieName,
     sessionSecret,
     sessionMaxAge,
+    recoveryURL,
     verifyAlways
   });
   const protect = /* @__PURE__ */ __name((Page, options) => {

package/dist/index.d.ts

@@ -9,6 +9,7 @@ import { User, NewUser, RoleEntity, NewRoleEntity, Permission, NewPermission, Ro
 export { NewOAuthAccount, NewRolePermission, NewToken, OAuthAccount, Token, authSchema, baseFields, oauthAccountsTable, permissionsTable, rolePermissionsTable, rolesTable, tokenStatusEnum, tokenTypeEnum, tokensTable, userStatusEnum, usersTable } from './schema/pg.js';
 import { CacheService } from 'najm-cache';
 import { z } from 'zod';
+import { Context } from 'hono';
 import { GuardResult } from 'najm-guard';
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
@@ -279,6 +280,7 @@ var auth = {
 		passwordReset: "Password has been reset successfully",
 		accountInviteSent: "Invitation sent successfully",
 		tokenRefreshed: "Token refreshed successfully",
+		sessionRecovered: "Session recovered successfully",
 		oauthLogin: "Google sign-in successful",
 		oauthLinked: "Google account linked successfully"
 	},
@@ -396,6 +398,7 @@ declare const AUTH_LOCALES: {
                 passwordReset: string;
                 accountInviteSent: string;
                 tokenRefreshed: string;
+                sessionRecovered: string;
                 oauthLogin: string;
                 oauthLinked: string;
             };
@@ -932,7 +935,21 @@ declare class TokenService {
      * the active session. Reuse detection and revocation belong to the
      * rotation path only.
      */
+    private resolveRefreshSessionFromCookie;
     resolveUserFromCookie(): Promise<string>;
+    /**
+     * Resolve authoritative claims for signed-session recovery.
+     *
+     * This deliberately bypasses the 30-second user cache so status, role, and
+     * permission changes are reflected when the short session snapshot expires.
+     * It validates but never rotates or consumes the refresh token.
+     */
+    recoverSessionFromCookie(): Promise<{
+        user: any;
+        roles: any[];
+        permissions: any;
+        sessionVersion: number;
+    }>;
     getUser(auth: string): Promise<any>;
     getUserById(userId: string): Promise<any>;
     private hashToken;
@@ -1009,6 +1026,7 @@ declare class TokenService {
         accessTokenExpiresAt: number;
         refreshTokenExpiresAt: number;
     }>;
+    private requireActiveRefreshUser;
     /** Revoke every refresh session for a user (password change/reset, logout-all). */
     revokeAllForUser(userId: string): Promise<any>;
     /** Revoke a single refresh session (one family). */
@@ -1242,6 +1260,14 @@ declare class AuthService {
         user: SanitizedUser;
     }>;
     refreshTokens(): Promise<TokenPair>;
+    /**
+     * Reissue the short-lived signed session snapshot from a fully validated
+     * refresh session. This path never creates or returns access/refresh tokens
+     * and never rotates the refresh family.
+     */
+    recoverSession(): Promise<{
+        recovered: true;
+    }>;
     logoutUser(userId: string, authorization?: string): Promise<{
         data: any;
         message: string;
@@ -1310,6 +1336,9 @@ declare class AuthController {
         emailSent: boolean;
     }>;
     refreshTokens(): Promise<TokenPair>;
+    recoverSession(recoveryRequest: string | undefined, ctx: Context): Promise<{
+        recovered: true;
+    }>;
     logoutUser(userId: string, authorization?: string): Promise<{
         data: any;
         message: string;

package/dist/index.js

@@ -6,16 +6,16 @@ var __export = (target, all) => {
 };
 
 // src/AuthPlugin.ts
-import { Err as Err10, plugin } from "najm-core";
+import { Err as Err11, plugin } from "najm-core";
 import { cache } from "najm-cache";
 
 // src/auth.tokens.ts
-var AUTH_CONFIG = /* @__PURE__ */ Symbol.for("najm:auth:config");
-var AUTH_SCHEMA = /* @__PURE__ */ Symbol.for("najm:auth:schema");
-var AUTH_USER = /* @__PURE__ */ Symbol.for("najm:auth:user");
-var AUTH_ROLE = /* @__PURE__ */ Symbol.for("najm:auth:role");
-var AUTH_PERMISSIONS = /* @__PURE__ */ Symbol.for("najm:auth:permissions");
-var AUTH_ENCRYPTION_KEY = /* @__PURE__ */ Symbol.for("najm:auth:encryption-key");
+var AUTH_CONFIG = Symbol.for("najm:auth:config");
+var AUTH_SCHEMA = Symbol.for("najm:auth:schema");
+var AUTH_USER = Symbol.for("najm:auth:user");
+var AUTH_ROLE = Symbol.for("najm:auth:role");
+var AUTH_PERMISSIONS = Symbol.for("najm:auth:permissions");
+var AUTH_ENCRYPTION_KEY = Symbol.for("najm:auth:encryption-key");
 
 // src/schema/pg.ts
 import { pgTable, text, boolean, timestamp, pgEnum, primaryKey, integer, index, uniqueIndex } from "drizzle-orm/pg-core";
@@ -431,9 +431,9 @@ CookieManager = __decorate2([
 ], CookieManager);
 
 // src/auth/AuthController.ts
-import { Controller } from "najm-core";
+import { Controller, Err as Err9 } from "najm-core";
 import { Get, Post, ResMsg } from "najm-core";
-import { Body, User as User2, Headers } from "najm-core";
+import { Body, User as User2, Headers, Ctx } from "najm-core";
 
 // src/auth/AuthService.ts
 import { Injectable as Injectable8, Inject as Inject8 } from "najm-core";
@@ -1638,7 +1638,7 @@ var TokenService = class TokenService2 {
    * the active session. Reuse detection and revocation belong to the
    * rotation path only.
    */
-  async resolveUserFromCookie() {
+  async resolveRefreshSessionFromCookie() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
       Err6(this.t("errors.refreshTokenMissing"));
@@ -1650,14 +1650,35 @@ var TokenService = class TokenService2 {
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
-      return userId;
+      return { userId, tokenFamily };
     }
     const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
     if (canRecover) {
-      return userId;
+      return { userId, tokenFamily };
     }
     Err6(this.t("errors.refreshTokenInvalid"));
   }
+  async resolveUserFromCookie() {
+    return (await this.resolveRefreshSessionFromCookie()).userId;
+  }
+  /**
+   * Resolve authoritative claims for signed-session recovery.
+   *
+   * This deliberately bypasses the 30-second user cache so status, role, and
+   * permission changes are reflected when the short session snapshot expires.
+   * It validates but never rotates or consumes the refresh token.
+   */
+  async recoverSessionFromCookie() {
+    const { userId, tokenFamily } = await this.resolveRefreshSessionFromCookie();
+    const user = await this.requireActiveRefreshUser(userId, tokenFamily);
+    const sessionVersion = await this.getUserSessionVersion(userId);
+    return {
+      user,
+      roles: user.role ? [user.role] : [],
+      permissions: Array.isArray(user.permissions) ? user.permissions : [],
+      sessionVersion
+    };
+  }
   // ============ USER RETRIEVAL (MAIN METHOD) ============
   async getUser(auth2) {
     if (!auth2)
@@ -1820,6 +1841,7 @@ var TokenService = class TokenService2 {
       Err6(this.t("errors.refreshTokenInvalid"));
     }
     const presentedHash = this.hashToken(refreshToken);
+    await this.requireActiveRefreshUser(userId, tokenFamily);
     if (presentedHash === stored.token) {
       return this.generateTokens(userId, tokenFamily);
     }
@@ -1834,6 +1856,14 @@ var TokenService = class TokenService2 {
     await this.revokeSuspectRefreshFamily(userId, tokenFamily);
     Err6(this.t("errors.refreshTokenInvalid"));
   }
+  async requireActiveRefreshUser(userId, tokenFamily) {
+    const user = await this.tokenRepository.getUser(userId);
+    if (!user || user.status !== "active") {
+      await this.revokeFamily(tokenFamily);
+      Err6(this.t("errors.refreshTokenInvalid"));
+    }
+    return user;
+  }
   /** Revoke every refresh session for a user (password change/reset, logout-all). */
   async revokeAllForUser(userId) {
     return this.tokenRepository.revokeAllForUser(userId);
@@ -2276,6 +2306,27 @@ var AuthService = class AuthService2 {
     const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, sessionVersion: _sv, ...tokens } = generated;
     return tokens;
   }
+  /**
+   * Reissue the short-lived signed session snapshot from a fully validated
+   * refresh session. This path never creates or returns access/refresh tokens
+   * and never rotates the refresh family.
+   */
+  async recoverSession() {
+    const recovered = await this.tokenService.recoverSessionFromCookie();
+    this.cookieManager.setSessionCookie({
+      user: {
+        id: recovered.user.id,
+        email: recovered.user.email,
+        name: recovered.user.name,
+        role: recovered.user.role ?? void 0,
+        status: recovered.user.status ?? void 0
+      },
+      roles: recovered.roles,
+      permissions: recovered.permissions,
+      sessionVersion: recovered.sessionVersion
+    });
+    return { recovered: true };
+  }
   async logoutUser(userId, authorization) {
     await this.tokenService.logout(userId, authorization);
     this.cookieManager.clearRefreshToken();
@@ -2604,6 +2655,14 @@ var AuthController = class AuthController2 {
   async refreshTokens() {
     return this.authService.refreshTokens();
   }
+  async recoverSession(recoveryRequest, ctx) {
+    if (recoveryRequest !== "1") {
+      Err9("Invalid session recovery request", 400);
+    }
+    ctx.header("Cache-Control", "private, no-store");
+    ctx.header("Vary", "Cookie");
+    return this.authService.recoverSession();
+  }
   async logoutUser(userId, authorization) {
     return this.authService.logoutUser(userId, authorization);
   }
@@ -2659,6 +2718,16 @@ __decorate15([
   __metadata15("design:paramtypes", []),
   __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "refreshTokens", null);
+__decorate15([
+  Post("/session/recover"),
+  RateLimit({ limit: 120, window: "1m", key: cookieFingerprint() }),
+  ResMsg("auth.success.sessionRecovered"),
+  __param5(0, Headers("x-najm-session-recovery")),
+  __param5(1, Ctx()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String, Object]),
+  __metadata15("design:returntype", Promise)
+], AuthController.prototype, "recoverSession", null);
 __decorate15([
   Post("/logout"),
   isAuth(),
@@ -3471,7 +3540,7 @@ import { Injectable as Injectable11 } from "najm-core";
 // src/permissions/PermissionValidator.ts
 import { Injectable as Injectable10 } from "najm-core";
 import { I18n as I18n7 } from "najm-i18n";
-import { Err as Err9 } from "najm-core";
+import { Err as Err10 } from "najm-core";
 var __decorate21 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -3500,7 +3569,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExists(id) {
     const permission = await this.permissionRepository.getById(id);
     if (!permission) {
-      Err9(this.t("errors.notFound"), 404);
+      Err10(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3510,7 +3579,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExistsByName(name) {
     const permission = await this.permissionRepository.getByName(name);
     if (!permission) {
-      Err9(this.t("errors.notFound"), 404);
+      Err10(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3522,7 +3591,7 @@ var PermissionValidator = class PermissionValidator2 {
       return;
     const existingPermission = await this.permissionRepository.getByName(name);
     if (existingPermission && existingPermission.id !== excludeId) {
-      Err9(this.t("errors.nameExists"), 409);
+      Err10(this.t("errors.nameExists"), 409);
     }
   }
   /**
@@ -3545,7 +3614,7 @@ var PermissionValidator = class PermissionValidator2 {
     await this.checkPermissionExists(permissionId);
     const hasPermission = await this.permissionRepository.checkRoleHasPermission(roleId, permissionId);
     if (hasPermission) {
-      Err9(this.t("errors.roleAlreadyHasPermission"), 409);
+      Err10(this.t("errors.roleAlreadyHasPermission"), 409);
     }
   }
 };
@@ -3911,9 +3980,9 @@ var revokeTokenDto = z4.object({
 // src/ownership/scopedOwnership.ts
 import { aliasedTable, eq as eq6, getTableColumns, sql as sql4 } from "drizzle-orm";
 var DEFAULT_ADMIN_ROLES = ["admin"];
-var DRIZZLE_NAME = /* @__PURE__ */ Symbol.for("drizzle:Name");
-var DRIZZLE_BASE_NAME = /* @__PURE__ */ Symbol.for("drizzle:BaseName");
-var DRIZZLE_IS_ALIAS = /* @__PURE__ */ Symbol.for("drizzle:IsAlias");
+var DRIZZLE_NAME = Symbol.for("drizzle:Name");
+var DRIZZLE_BASE_NAME = Symbol.for("drizzle:BaseName");
+var DRIZZLE_IS_ALIAS = Symbol.for("drizzle:IsAlias");
 function join2(left, right) {
   const table = right.table;
   if (!table)
@@ -4361,9 +4430,9 @@ __name(configureOwnership, "configureOwnership");
 // src/ownership/ScopeGuard.ts
 import "reflect-metadata";
 import { composeGuards as composeGuards5 } from "najm-guard";
-var ACTION_KEY = /* @__PURE__ */ Symbol.for("najm:guard:action");
-var TOKEN_KEY = /* @__PURE__ */ Symbol.for("najm:guard:token");
-var POLICY_KEY = /* @__PURE__ */ Symbol.for("najm:policy:token");
+var ACTION_KEY = Symbol.for("najm:guard:action");
+var TOKEN_KEY = Symbol.for("najm:guard:token");
+var POLICY_KEY = Symbol.for("najm:policy:token");
 var PERM = {
   list: /* @__PURE__ */ __name((n) => `read:${n}`, "list"),
   read: /* @__PURE__ */ __name((n) => `read:${n}`, "read"),
@@ -4433,7 +4502,7 @@ var __metadata25 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var _a16;
-var OWNED_META = /* @__PURE__ */ Symbol.for("najm:owned");
+var OWNED_META = Symbol.for("najm:owned");
 var ScopeContext = class ScopeContext2 {
   static {
     __name(this, "ScopeContext");
@@ -4594,6 +4663,7 @@ var en_default = {
       passwordReset: "Password has been reset successfully",
       accountInviteSent: "Invitation sent successfully",
       tokenRefreshed: "Token refreshed successfully",
+      sessionRecovered: "Session recovered successfully",
       oauthLogin: "Google sign-in successful",
       oauthLinked: "Google account linked successfully"
     },
@@ -5010,7 +5080,7 @@ OAuthAccountService = __decorate29([
 
 // src/oauth/OAuthController.ts
 import { createHash as createHash4 } from "crypto";
-import { Controller as Controller5, Ctx, Get as Get5, Post as Post5, Query as Query2, User as User5 } from "najm-core";
+import { Controller as Controller5, Ctx as Ctx2, Get as Get5, Post as Post5, Query as Query2, User as User5 } from "najm-core";
 import { RateLimit as RateLimit2 } from "najm-rate";
 
 // src/oauth/OAuthService.ts
@@ -5296,7 +5366,7 @@ var OAuthController = class OAuthController2 {
 __decorate32([
   Get5("/start"),
   RateLimit2({ limit: 20, window: "15m", key: "ip" }),
-  __param11(0, Ctx()),
+  __param11(0, Ctx2()),
   __param11(1, Query2("returnTo")),
   __metadata32("design:type", Function),
   __metadata32("design:paramtypes", [Object, String]),
@@ -5305,7 +5375,7 @@ __decorate32([
 __decorate32([
   Get5("/callback"),
   RateLimit2({ limit: 20, window: "15m", key: callbackKey }),
-  __param11(0, Ctx()),
+  __param11(0, Ctx2()),
   __param11(1, Query2("code")),
   __param11(2, Query2("state")),
   __param11(3, Query2("error")),
@@ -5360,9 +5430,9 @@ var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
   const clientId = google.clientId ?? process.env.GOOGLE_CLIENT_ID ?? "";
   const clientSecret = google.clientSecret ?? process.env.GOOGLE_CLIENT_SECRET ?? "";
   if (!clientId)
-    throw Err10.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
+    throw Err11.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
   if (!clientSecret)
-    throw Err10.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
+    throw Err11.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
   const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
   const callbackUrl = google.callbackUrl ?? process.env.GOOGLE_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/google/callback`;
   let callback;
@@ -5421,10 +5491,10 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
     }
   };
   if (!finalConfig.jwt.accessSecret) {
-    throw Err10.configRequired("auth", "JWT_ACCESS_SECRET");
+    throw Err11.configRequired("auth", "JWT_ACCESS_SECRET");
   }
   if (!finalConfig.jwt.refreshSecret) {
-    throw Err10.configRequired("auth", "JWT_REFRESH_SECRET");
+    throw Err11.configRequired("auth", "JWT_REFRESH_SECRET");
   }
   return finalConfig;
 }, "resolveAuthConfig");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "2.0.4",
+  "version": "2.0.6",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -67,9 +67,9 @@
     "@testing-library/react": "^16.3.2",
     "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^25.0.2",
-    "drizzle-kit": "^0.31.8",
-    "drizzle-orm": "^0.45.1",
-    "happy-dom": "^17.6.3",
+    "drizzle-kit": "^0.31.10",
+    "drizzle-orm": "^0.45.2",
+    "happy-dom": "^20.11.1",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"
   },
@@ -93,8 +93,8 @@
     "zod": "^4.2.1"
   },
   "peerDependencies": {
-    "drizzle-orm": "^0.45.1",
-    "hono": "^4.0.0",
+    "drizzle-orm": "^0.45.2",
+    "hono": "^4.12.18",
     "react": ">=18",
     "next": ">=14"
   },