najm-auth 3.4.0 → 4.0.1

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/AuthPlugin.ts
-import { Err as Err15, plugin } from "najm-core";
+import { Err as Err16, plugin } from "najm-core";
 import { cache } from "najm-cache";
 
 // src/auth.tokens.ts
@@ -354,6 +354,7 @@ function parseSessionCookiePayload(payload, maxAgeSeconds = DEFAULT_SESSION_MAX_
     if (!isRecord(data) || !isValidUser(data.user)) return null;
     if (!isStringArray(data.roles) || !isStringArray(data.permissions)) return null;
     if (!Number.isInteger(data.sessionVersion) || data.sessionVersion < 0) return null;
+    if (typeof data.tokenFamily !== "string" || !data.tokenFamily) return null;
     if (!Number.isFinite(data.iat) || !Number.isInteger(data.iat) || data.iat <= 0) return null;
     const issuedAt = data.iat;
     if (issuedAt > now + MAX_CLOCK_SKEW_MS) return null;
@@ -363,6 +364,7 @@ function parseSessionCookiePayload(payload, maxAgeSeconds = DEFAULT_SESSION_MAX_
       roles: [...data.roles],
       permissions: [...data.permissions],
       sessionVersion: data.sessionVersion,
+      tokenFamily: data.tokenFamily,
       iat: issuedAt
     };
   } catch {
@@ -439,8 +441,10 @@ var CookieManager = class CookieManager2 {
   // =========================================================================
   /**
    * Write a signed session cookie containing user data, roles, and permissions.
-   * The cookie is HMAC-signed with the configured session secret so it is tamper-proof
-   * but readable without a database query. Short TTL (5 min) ensures freshness.
+   * The cookie is HMAC-signed with the configured session secret, so its claims
+   * can be parsed without a database query. Authorization still verifies the
+   * session version and positive family liveness; a valid signature alone is
+   * never a revocation check. Short TTL (5 min) bounds claim staleness.
    */
   setSessionCookie(data) {
     const payload = { ...data, iat: Date.now() };
@@ -486,7 +490,7 @@ import { Get, Post, ResMsg } from "najm-core";
 import { Body, User as User2, Headers, Ctx } from "najm-core";
 
 // src/auth/AuthService.ts
-import { Injectable as Injectable11, Inject as Inject11 } from "najm-core";
+import { Injectable as Injectable12, Inject as Inject12 } from "najm-core";
 import { Err as Err12, Log } from "najm-core";
 import { Transaction as Transaction4 } from "najm-database";
 import { I18n as I18n8, I18nService as I18nService2 } from "najm-i18n";
@@ -494,7 +498,7 @@ import { EmailService, passwordResetTemplate, accountInviteTemplate } from "najm
 import { nanoid as nanoid5 } from "nanoid";
 
 // src/users/UserService.ts
-import { Injectable as Injectable5, Inject as Inject5 } from "najm-core";
+import { Injectable as Injectable6, Inject as Inject7 } from "najm-core";
 import { Transaction } from "najm-database";
 import { I18nService } from "najm-i18n";
 import { I18n as I18n4 } from "najm-i18n";
@@ -674,6 +678,15 @@ var UserRepository = class UserRepository2 {
     const [newUser] = await this.db.insert(this.users).values(data).returning();
     return newUser;
   }
+  /**
+   * Ids of everyone holding a role. Used to end sessions when the role's
+   * permission set changes: tokens carry permissions as claims, so the holders
+   * keep exercising the old set until their sessions do.
+   */
+  async getIdsByRole(roleId) {
+    const rows = await this.db.select({ id: this.users.id }).from(this.users).where(eq2(this.users.roleId, roleId));
+    return rows.map((row) => row.id);
+  }
   async update(id, data) {
     const [updatedUser] = await this.db.update(this.users).set(data).where(eq2(this.users.id, id)).returning();
     return updatedUser;
@@ -1334,6 +1347,16 @@ __name(isEmailIdentifier, "isEmailIdentifier");
 
 // src/users/UserService.ts
 import { Err as Err5 } from "najm-core";
+
+// src/tokens/SessionInvalidationService.ts
+import { Inject as Inject6, Injectable as Injectable5 } from "najm-core";
+import { CacheService } from "najm-cache";
+import timestring2 from "timestring";
+
+// src/tokens/TokenRepository.ts
+import { and, eq as eq4, isNull, lt } from "drizzle-orm";
+import { Repository as Repository3, Inject as Inject5 } from "najm-core";
+import { DB as DB3 } from "najm-database";
 var __decorate8 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1343,19 +1366,383 @@ var __decorate8 = function(decorators, target, key, desc) {
 var __metadata8 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var TokenRepository = class TokenRepository2 {
+  static {
+    __name(this, "TokenRepository");
+  }
+  db;
+  schema;
+  get tokens() {
+    return this.schema.tokens;
+  }
+  get users() {
+    return this.schema.users;
+  }
+  /** Shared query helper, scoped to the current database/transaction identity. */
+  queryHelper;
+  get q() {
+    const db = this.db;
+    if (this.queryHelper?.db !== db) {
+      this.queryHelper = { db, queries: new AuthQueries(db, this.schema) };
+    }
+    return this.queryHelper.queries;
+  }
+  /**
+   * Upsert the refresh-token row for a session, keyed on `tokenFamily` (the
+   * per-login session identifier, unique). A brand-new login inserts a fresh
+   * family row; a refresh rotation updates only that family's row, leaving the
+   * user's other sessions untouched.
+   */
+  async storeRefreshToken(tokenData) {
+    return await this.db.insert(this.tokens).values(tokenData).onConflictDoUpdate({
+      target: this.tokens.tokenFamily,
+      set: {
+        token: tokenData.token,
+        expiresAt: tokenData.expiresAt,
+        previousHash: tokenData.previousHash ?? null,
+        previousValidUntil: tokenData.previousValidUntil ?? null,
+        previousUsedAt: tokenData.previousUsedAt ?? null
+      },
+      // A revoked family is a durable tombstone. It must never be revived by
+      // an issuance racing with logout, or after the cache markers are lost.
+      setWhere: and(eq4(this.tokens.status, "active"), eq4(this.tokens.userId, tokenData.userId))
+    }).returning();
+  }
+  /**
+   * Rotate an existing refresh-token family with compare-and-swap semantics.
+   * This can never update a family durably revoked by a concurrent logout.
+   */
+  async rotateRefreshToken(tokenData, expectedCurrentHash) {
+    return await this.db.update(this.tokens).set({
+      token: tokenData.token,
+      expiresAt: tokenData.expiresAt,
+      previousHash: tokenData.previousHash,
+      previousValidUntil: tokenData.previousValidUntil,
+      previousUsedAt: tokenData.previousUsedAt ?? null
+    }).where(and(eq4(this.tokens.tokenFamily, tokenData.tokenFamily), eq4(this.tokens.userId, tokenData.userId), eq4(this.tokens.token, expectedCurrentHash), eq4(this.tokens.status, "active"))).returning();
+  }
+  /**
+   * Claim the previous-token grace slot for a single family. Conditional on
+   * BOTH the stored previousHash still matching the presented token AND
+   * previousUsedAt being NULL. Gating on the hash (not just the flag) closes
+   * the rotation race: the winner's rotation rewrites previousHash via
+   * storeRefreshToken (and resets previousUsedAt to NULL), so a loser whose
+   * UPDATE lands after that rotation no longer matches and gets zero rows —
+   * exactly one caller ever claims the slot.
+   */
+  async markPreviousUsed(tokenFamily, previousHash) {
+    return await this.db.update(this.tokens).set({ previousUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.previousHash, previousHash), isNull(this.tokens.previousUsedAt), eq4(this.tokens.status, "active"))).returning();
+  }
+  /** Look up a single session's token row by its family identifier. */
+  async getByFamily(tokenFamily) {
+    const [token] = await this.db.select().from(this.tokens).where(and(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.status, "active")));
+    return token ?? null;
+  }
+  /**
+   * Durably revoke one family without depending on physical deletion.
+   *
+   * The row remains as a tombstone until its original refresh expiry. This is
+   * what prevents a later cache loss from turning a failed/omitted cleanup
+   * delete into a valid database-backed recovery session.
+   */
+  async revokeFamily(tokenFamily) {
+    return this.db.update(this.tokens).set({
+      status: "revoked",
+      previousHash: null,
+      previousValidUntil: null,
+      previousUsedAt: null
+    }).where(and(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.status, "active"))).returning();
+  }
+  /** Durably revoke every active family for a user. */
+  async revokeAllForUser(userId) {
+    return this.db.update(this.tokens).set({
+      status: "revoked",
+      previousHash: null,
+      previousValidUntil: null,
+      previousUsedAt: null
+    }).where(and(eq4(this.tokens.userId, userId), eq4(this.tokens.status, "active"))).returning();
+  }
+  /**
+   * Opportunistic cleanup: with one row per family (no unique userId), expired
+   * and abandoned sessions accumulate. Delete every expired row.
+   */
+  async deleteExpired() {
+    return this.db.delete(this.tokens).where(lt(this.tokens.expiresAt, (/* @__PURE__ */ new Date()).toISOString())).returning();
+  }
+  async isUserExists(userId) {
+    const [user] = await this.db.select({ id: this.users.id }).from(this.users).where(eq4(this.users.id, userId)).limit(1);
+    return !!user;
+  }
+  async getRoleNameById(userId) {
+    return this.q.getRoleName(userId);
+  }
+  async getUserPermissions(userId) {
+    return this.q.getUserPermissions(userId);
+  }
+  async getRoleAndPermissions(userId) {
+    return this.q.getRoleAndPermissions(userId);
+  }
+  async getUser(userId) {
+    return await this.q.getUserWithPermissions(eq4(this.users.id, userId)) ?? null;
+  }
+};
+__decorate8([
+  DB3(),
+  __metadata8("design:type", Object)
+], TokenRepository.prototype, "db", void 0);
+__decorate8([
+  Inject5(AUTH_SCHEMA),
+  __metadata8("design:type", Object)
+], TokenRepository.prototype, "schema", void 0);
+TokenRepository = __decorate8([
+  Repository3()
+], TokenRepository);
+
+// src/tokens/SessionInvalidationService.ts
+var __decorate9 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata9 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var SessionInvalidationService_1;
+var _a5;
+var _b3;
+var SessionInvalidationService = class SessionInvalidationService2 {
+  static {
+    __name(this, "SessionInvalidationService");
+  }
+  static {
+    SessionInvalidationService_1 = this;
+  }
+  cache;
+  tokens;
+  config;
+  constructor(cache2, tokens) {
+    this.cache = cache2;
+    this.tokens = tokens;
+  }
+  /**
+   * Fields whose change ends existing sessions. Everything absent from this set
+   * — display name, avatar, language — is a profile edit and must leave the
+   * user signed in, on every device.
+   */
+  static SECURITY_FIELDS = Object.freeze([
+    "password",
+    "status",
+    "role",
+    "roleId",
+    "email",
+    "emailVerified",
+    "phone"
+  ]);
+  /** Whether an update payload touches anything that must end sessions. */
+  static affectsSecurityState(data) {
+    if (!data)
+      return false;
+    return SessionInvalidationService_1.SECURITY_FIELDS.some((field) => data[field] !== void 0);
+  }
+  get accessTokenTtlMs() {
+    return timestring2(this.config.jwt.accessExpiresIn, "ms");
+  }
+  get refreshTokenTtlMs() {
+    return timestring2(this.config.jwt.refreshExpiresIn, "ms");
+  }
+  sessionVersionKey(userId) {
+    return `auth:session-version:${userId}`;
+  }
+  revokedFamilyKey(tokenFamily) {
+    return `auth:revoked-family:${tokenFamily}`;
+  }
+  /**
+   * Positive liveness marker for one session family.
+   *
+   * The signed session snapshot is authorized against this rather than against
+   * the absence of a revocation marker, so losing the cache cannot make a
+   * logged-out family look valid again: with no marker the fast path simply
+   * declines and the request falls through to the database-backed resolver.
+   */
+  familyKey(tokenFamily) {
+    return `auth:family:${tokenFamily}`;
+  }
+  userCacheKey(userId) {
+    return `auth:user:${userId}`;
+  }
+  parseSessionVersion(raw) {
+    if (!raw)
+      return 0;
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+  }
+  async getSessionVersion(userId) {
+    return this.parseSessionVersion(await this.cache.get(this.sessionVersionKey(userId)));
+  }
+  /**
+   * Extend the version key's lifetime without rewriting its value.
+   *
+   * Token issuance used to `set()` the version it had just read, which meant an
+   * invalidation landing between that read and that write was silently undone —
+   * the revoked version came back and the old tokens verified again. Only the
+   * expiry is touched here, so a concurrent bump always survives.
+   */
+  async touchSessionVersion(userId) {
+    await this.cache.expire(this.sessionVersionKey(userId), this.accessTokenTtlMs);
+  }
+  /**
+   * Invalidate every access token already issued for a user, and drop the
+   * cached user record so the next read sees the new state rather than a stale
+   * snapshot that is merely truthy.
+   *
+   * The bump is an atomic increment, so concurrent invalidations cannot read
+   * the same version and write the same successor back.
+   */
+  async invalidateAccessTokens(userId) {
+    const key = this.sessionVersionKey(userId);
+    const { count } = await this.cache.incr(key, this.accessTokenTtlMs);
+    await this.cache.expire(key, this.accessTokenTtlMs);
+    await this.dropUserCache(userId);
+    return count;
+  }
+  async dropUserCache(userId) {
+    await this.cache.del(this.userCacheKey(userId));
+  }
+  /**
+   * End every session a user holds: access tokens by version, refresh sessions
+   * by row, and each family's liveness marker.
+   *
+   * Callers run this AFTER their database mutation has committed. Running it
+   * before would leave a window in which a concurrent login re-established a
+   * session against the state the mutation was about to remove; running it
+   * after a rollback merely signs the user out again, which is safe.
+   */
+  async invalidateUser(userId) {
+    await this.invalidateAccessTokens(userId);
+    const revoked = await this.tokens.revokeAllForUser(userId);
+    await Promise.all(familiesOf(revoked).map((family) => this.markFamilyRevoked(family)));
+  }
+  /**
+   * Record that a family is live, and whose it is. Called wherever the family's
+   * refresh row is written.
+   *
+   * The marker stores the owning user rather than a bare flag so a reader can
+   * confirm, in the same single lookup, that the family it was handed actually
+   * belongs to the identity claiming it.
+   *
+   * Revocation always wins. A refresh that rotated its row, was descheduled,
+   * and resumed after a logout would otherwise re-mark its family live and
+   * hand the browser back the session it had just ended — the database row is
+   * gone by then, but nothing on the fast path reads the database. So this
+   * writes, then re-reads the revocation marker and withdraws the write if one
+   * appeared. Combined with `markFamilyRevoked` setting the revocation marker
+   * *before* clearing liveness, every interleaving of the two converges on
+   * revoked: whichever of the pair observes the other, the liveness key ends
+   * up deleted.
+   *
+   * @returns whether the family is live after this call.
+   */
+  async markFamilyIssued(tokenFamily, userId) {
+    await this.cache.set(this.familyKey(tokenFamily), userId, this.refreshTokenTtlMs);
+    if (await this.isFamilyRevoked(tokenFamily)) {
+      await this.cache.del(this.familyKey(tokenFamily));
+      return false;
+    }
+    return true;
+  }
+  /**
+   * What one lookup can say about a family, in a single batched cache read.
+   *
+   * The three answers are deliberately distinct. `revoked` is authoritative and
+   * must deny. `unknown` means the cache cannot vouch for the family — it was
+   * evicted, or the cache was lost — and must send the caller to an
+   * authoritative, database-backed check rather than being read either way.
+   * Only `live` is a positive assertion, and only for the named user.
+   */
+  async familyStatus(tokenFamily, userId) {
+    if (!tokenFamily)
+      return "unknown";
+    const [owner, revoked] = await this.readMany([
+      this.familyKey(tokenFamily),
+      this.revokedFamilyKey(tokenFamily)
+    ]);
+    if (revoked != null)
+      return "revoked";
+    if (owner == null)
+      return "unknown";
+    if (userId !== void 0 && owner !== userId)
+      return "revoked";
+    return "live";
+  }
+  /**
+   * Whether a family is positively known to be live, and — when a user is
+   * given — to belong to that user.
+   *
+   * `false` means "not proven live" — revoked, mismatched, or simply not in
+   * cache. Callers must treat it as a reason to fall back to an authoritative
+   * check, never as proof of validity in the other direction.
+   */
+  async isFamilyLive(tokenFamily, userId) {
+    return await this.familyStatus(tokenFamily, userId) === "live";
+  }
+  async readMany(keys) {
+    const cache2 = this.cache;
+    if (cache2.getMany)
+      return cache2.getMany(keys);
+    return Promise.all(keys.map((key) => cache2.get(key)));
+  }
+  /**
+   * Keep revocation through both credential lifetimes. If deleting the refresh
+   * row fails, its still-valid cookie must remain denied after access expires.
+   */
+  async markFamilyRevoked(tokenFamily) {
+    await this.cache.set(this.revokedFamilyKey(tokenFamily), "1", Math.max(this.accessTokenTtlMs, this.refreshTokenTtlMs));
+    await this.cache.del(this.familyKey(tokenFamily));
+  }
+  async isFamilyRevoked(tokenFamily) {
+    return await this.cache.get(this.revokedFamilyKey(tokenFamily)) !== null;
+  }
+};
+__decorate9([
+  Inject6(AUTH_CONFIG),
+  __metadata9("design:type", Object)
+], SessionInvalidationService.prototype, "config", void 0);
+SessionInvalidationService = SessionInvalidationService_1 = __decorate9([
+  Injectable5(),
+  __metadata9("design:paramtypes", [typeof (_a5 = typeof CacheService !== "undefined" && CacheService) === "function" ? _a5 : Object, typeof (_b3 = typeof TokenRepository !== "undefined" && TokenRepository) === "function" ? _b3 : Object])
+], SessionInvalidationService);
+function familiesOf(rows) {
+  if (!Array.isArray(rows))
+    return [];
+  return rows.map((row) => row?.tokenFamily).filter((family) => typeof family === "string" && family.length > 0);
+}
+__name(familiesOf, "familiesOf");
+
+// src/users/UserService.ts
+var __decorate10 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata10 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 var __param2 = function(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 };
-var _a5;
-var _b3;
+var _a6;
+var _b4;
 var _c;
 var _d;
 var _e;
 var _f;
 var _g;
 var _h;
+var _j;
 var E164_PHONE = /^\+[1-9]\d{7,14}$/;
 var UserService = class UserService2 {
   static {
@@ -1368,8 +1755,9 @@ var UserService = class UserService2 {
   encryptionService;
   i18nService;
   authConfig;
+  sessionInvalidation;
   t;
-  constructor(roleValidator, roleService, userRepository, userValidator, encryptionService, i18nService, authConfig) {
+  constructor(roleValidator, roleService, userRepository, userValidator, encryptionService, i18nService, authConfig, sessionInvalidation) {
     this.roleValidator = roleValidator;
     this.roleService = roleService;
     this.userRepository = userRepository;
@@ -1377,6 +1765,19 @@ var UserService = class UserService2 {
     this.encryptionService = encryptionService;
     this.i18nService = i18nService;
     this.authConfig = authConfig;
+    this.sessionInvalidation = sessionInvalidation;
+  }
+  /**
+   * End the user's sessions after a security-relevant mutation has committed.
+   *
+   * Deactivating, deleting, or re-roling an account through the generic
+   * endpoints used to leave every already-issued token working until it
+   * expired. Invalidation belongs here, next to the write, so no caller can
+   * forget it — the application-level commands that already revoke keep doing
+   * so, and a second call is harmless.
+   */
+  async invalidateSessions(userId) {
+    await this.sessionInvalidation?.invalidateUser(userId);
   }
   sanitizeUser(user) {
     if (!user)
@@ -1494,15 +1895,23 @@ var UserService = class UserService2 {
     };
     const cleanedUpdateData = clean(updateData);
     const updatedUser = await this.userRepository.update(id, cleanedUpdateData);
-    return this.sanitizeUser(this.requireUser(updatedUser));
+    const result = this.sanitizeUser(this.requireUser(updatedUser));
+    if (SessionInvalidationService.affectsSecurityState(cleanedUpdateData)) {
+      await this.invalidateSessions(id);
+    }
+    return result;
   }
   async delete(id) {
     const user = await this.userRepository.delete(id);
-    return this.sanitizeUser(this.requireUser(user));
+    const result = this.sanitizeUser(this.requireUser(user));
+    await this.invalidateSessions(id);
+    return result;
   }
   async deleteAll() {
     const deletedUsers = await this.userRepository.deleteAll();
-    return this.sanitizeUsers(deletedUsers);
+    const result = this.sanitizeUsers(deletedUsers);
+    await Promise.all(result.map((user) => this.invalidateSessions(user.id)));
+    return result;
   }
   async getRoleName(id) {
     await this.userValidator.checkUserExists(id);
@@ -1524,11 +1933,15 @@ var UserService = class UserService2 {
   async assignRole(id, roleId, roleName) {
     const resolvedRoleId = await this.resolveUserRole(roleId, roleName);
     const updatedUser = await this.userRepository.update(id, { roleId: resolvedRoleId });
-    return this.sanitizeUser(this.requireUser(updatedUser));
+    const result = this.sanitizeUser(this.requireUser(updatedUser));
+    await this.invalidateSessions(id);
+    return result;
   }
   async removeRole(id) {
     const updatedUser = await this.userRepository.update(id, { roleId: null });
-    return this.sanitizeUser(this.requireUser(updatedUser));
+    const result = this.sanitizeUser(this.requireUser(updatedUser));
+    await this.invalidateSessions(id);
+    return result;
   }
   async seedAdminUser(config) {
     if (!config?.email || !config?.password) {
@@ -1563,170 +1976,42 @@ var UserService = class UserService2 {
     return this.i18nService.getCurrentLanguage();
   }
 };
-__decorate8([
+__decorate10([
   I18n4("users"),
-  __metadata8("design:type", Object)
+  __metadata10("design:type", Object)
 ], UserService.prototype, "t", void 0);
-__decorate8([
+__decorate10([
   Transaction(),
-  __metadata8("design:type", Function),
-  __metadata8("design:paramtypes", [typeof (_g = typeof Record !== "undefined" && Record) === "function" ? _g : Object, Object]),
-  __metadata8("design:returntype", typeof (_h = typeof Promise !== "undefined" && Promise) === "function" ? _h : Object)
+  __metadata10("design:type", Function),
+  __metadata10("design:paramtypes", [typeof (_h = typeof Record !== "undefined" && Record) === "function" ? _h : Object, Object]),
+  __metadata10("design:returntype", typeof (_j = typeof Promise !== "undefined" && Promise) === "function" ? _j : Object)
 ], UserService.prototype, "create", null);
-UserService = __decorate8([
-  Injectable5(),
-  __param2(6, Inject5(AUTH_CONFIG)),
-  __metadata8("design:paramtypes", [typeof (_a5 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _a5 : Object, typeof (_b3 = typeof RoleService !== "undefined" && RoleService) === "function" ? _b3 : Object, typeof (_c = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _c : Object, typeof (_d = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _d : Object, typeof (_e = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _e : Object, typeof (_f = typeof I18nService !== "undefined" && I18nService) === "function" ? _f : Object, Object])
+UserService = __decorate10([
+  Injectable6(),
+  __param2(6, Inject7(AUTH_CONFIG)),
+  __metadata10("design:paramtypes", [typeof (_a6 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _a6 : Object, typeof (_b4 = typeof RoleService !== "undefined" && RoleService) === "function" ? _b4 : Object, typeof (_c = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _c : Object, typeof (_d = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _d : Object, typeof (_e = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _e : Object, typeof (_f = typeof I18nService !== "undefined" && I18nService) === "function" ? _f : Object, Object, typeof (_g = typeof SessionInvalidationService !== "undefined" && SessionInvalidationService) === "function" ? _g : Object])
 ], UserService);
 
 // src/tokens/TokenService.ts
-import { Injectable as Injectable6, Inject as Inject8 } from "najm-core";
+import { Injectable as Injectable7, Inject as Inject9 } from "najm-core";
 import { I18n as I18n5 } from "najm-i18n";
-import { CacheService } from "najm-cache";
+import { CacheService as CacheService2 } from "najm-cache";
 import { createHash } from "crypto";
 import jwt from "jsonwebtoken";
 import { nanoid as nanoid4 } from "nanoid";
-
-// src/tokens/TokenRepository.ts
-import { and, eq as eq4, isNull, lt } from "drizzle-orm";
-import { Repository as Repository3, Inject as Inject6 } from "najm-core";
-import { DB as DB3 } from "najm-database";
-var __decorate9 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata9 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var TokenRepository = class TokenRepository2 {
-  static {
-    __name(this, "TokenRepository");
-  }
-  db;
-  schema;
-  get tokens() {
-    return this.schema.tokens;
-  }
-  get users() {
-    return this.schema.users;
-  }
-  /** Shared query helper, scoped to the current database/transaction identity. */
-  queryHelper;
-  get q() {
-    const db = this.db;
-    if (this.queryHelper?.db !== db) {
-      this.queryHelper = { db, queries: new AuthQueries(db, this.schema) };
-    }
-    return this.queryHelper.queries;
-  }
-  /**
-   * Upsert the refresh-token row for a session, keyed on `tokenFamily` (the
-   * per-login session identifier, unique). A brand-new login inserts a fresh
-   * family row; a refresh rotation updates only that family's row, leaving the
-   * user's other sessions untouched.
-   */
-  async storeRefreshToken(tokenData) {
-    return await this.db.insert(this.tokens).values(tokenData).onConflictDoUpdate({
-      target: this.tokens.tokenFamily,
-      set: {
-        token: tokenData.token,
-        expiresAt: tokenData.expiresAt,
-        previousHash: tokenData.previousHash ?? null,
-        previousValidUntil: tokenData.previousValidUntil ?? null,
-        previousUsedAt: tokenData.previousUsedAt ?? null
-      }
-    }).returning();
-  }
-  /**
-   * Rotate an existing refresh-token family with compare-and-swap semantics.
-   * This can never insert a family deleted by a concurrent logout.
-   */
-  async rotateRefreshToken(tokenData, expectedCurrentHash) {
-    return await this.db.update(this.tokens).set({
-      token: tokenData.token,
-      expiresAt: tokenData.expiresAt,
-      previousHash: tokenData.previousHash,
-      previousValidUntil: tokenData.previousValidUntil,
-      previousUsedAt: tokenData.previousUsedAt ?? null
-    }).where(and(eq4(this.tokens.tokenFamily, tokenData.tokenFamily), eq4(this.tokens.userId, tokenData.userId), eq4(this.tokens.token, expectedCurrentHash))).returning();
-  }
-  /**
-   * Claim the previous-token grace slot for a single family. Conditional on
-   * BOTH the stored previousHash still matching the presented token AND
-   * previousUsedAt being NULL. Gating on the hash (not just the flag) closes
-   * the rotation race: the winner's rotation rewrites previousHash via
-   * storeRefreshToken (and resets previousUsedAt to NULL), so a loser whose
-   * UPDATE lands after that rotation no longer matches and gets zero rows —
-   * exactly one caller ever claims the slot.
-   */
-  async markPreviousUsed(tokenFamily, previousHash) {
-    return await this.db.update(this.tokens).set({ previousUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.previousHash, previousHash), isNull(this.tokens.previousUsedAt))).returning();
-  }
-  /** Look up a single session's token row by its family identifier. */
-  async getByFamily(tokenFamily) {
-    const [token] = await this.db.select().from(this.tokens).where(eq4(this.tokens.tokenFamily, tokenFamily));
-    return token ?? null;
-  }
-  /** Revoke a single session (one family). */
-  async revokeFamily(tokenFamily) {
-    return this.db.delete(this.tokens).where(eq4(this.tokens.tokenFamily, tokenFamily)).returning();
-  }
-  /** Revoke every session for a user (password change/reset, logout-all). */
-  async revokeAllForUser(userId) {
-    return this.db.delete(this.tokens).where(eq4(this.tokens.userId, userId)).returning();
-  }
-  /**
-   * Opportunistic cleanup: with one row per family (no unique userId), expired
-   * and abandoned sessions accumulate. Delete every expired row.
-   */
-  async deleteExpired() {
-    return this.db.delete(this.tokens).where(lt(this.tokens.expiresAt, (/* @__PURE__ */ new Date()).toISOString())).returning();
-  }
-  async isUserExists(userId) {
-    const [user] = await this.db.select({ id: this.users.id }).from(this.users).where(eq4(this.users.id, userId)).limit(1);
-    return !!user;
-  }
-  async getRoleNameById(userId) {
-    return this.q.getRoleName(userId);
-  }
-  async getUserPermissions(userId) {
-    return this.q.getUserPermissions(userId);
-  }
-  async getRoleAndPermissions(userId) {
-    return this.q.getRoleAndPermissions(userId);
-  }
-  async getUser(userId) {
-    return await this.q.getUserWithPermissions(eq4(this.users.id, userId)) ?? null;
-  }
-};
-__decorate9([
-  DB3(),
-  __metadata9("design:type", Object)
-], TokenRepository.prototype, "db", void 0);
-__decorate9([
-  Inject6(AUTH_SCHEMA),
-  __metadata9("design:type", Object)
-], TokenRepository.prototype, "schema", void 0);
-TokenRepository = __decorate9([
-  Repository3()
-], TokenRepository);
-
-// src/tokens/TokenService.ts
-import timestring2 from "timestring";
+import timestring3 from "timestring";
 
 // src/credentialSetup/CredentialSetupRequirementRepository.ts
 import { and as and2, eq as eq5 } from "drizzle-orm";
-import { Err as Err6, Inject as Inject7, Repository as Repository4 } from "najm-core";
+import { Err as Err6, Inject as Inject8, Repository as Repository4 } from "najm-core";
 import { DB as DB4 } from "najm-database";
-var __decorate10 = function(decorators, target, key, desc) {
+var __decorate11 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata10 = function(k, v) {
+var __metadata11 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var CredentialSetupRequirementRepository = class CredentialSetupRequirementRepository2 {
@@ -1774,15 +2059,15 @@ var CredentialSetupRequirementRepository = class CredentialSetupRequirementRepos
     return requirement;
   }
 };
-__decorate10([
+__decorate11([
   DB4(),
-  __metadata10("design:type", Object)
+  __metadata11("design:type", Object)
 ], CredentialSetupRequirementRepository.prototype, "db", void 0);
-__decorate10([
-  Inject7(AUTH_SCHEMA),
-  __metadata10("design:type", Object)
+__decorate11([
+  Inject8(AUTH_SCHEMA),
+  __metadata11("design:type", Object)
 ], CredentialSetupRequirementRepository.prototype, "schema", void 0);
-CredentialSetupRequirementRepository = __decorate10([
+CredentialSetupRequirementRepository = __decorate11([
   Repository4()
 ], CredentialSetupRequirementRepository);
 
@@ -1791,20 +2076,21 @@ var PASSWORD_SETUP_PURPOSE = "password";
 
 // src/tokens/TokenService.ts
 import { Err as Err7 } from "najm-core";
-var __decorate11 = function(decorators, target, key, desc) {
+var __decorate12 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata11 = function(k, v) {
+var __metadata12 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var TokenService_1;
-var _a6;
-var _b4;
+var _a7;
+var _b5;
 var _c2;
 var _d2;
+var _e2;
 var TokenService = class TokenService2 {
   static {
     __name(this, "TokenService");
@@ -1816,13 +2102,23 @@ var TokenService = class TokenService2 {
   cookieManager;
   cache;
   credentialSetupRequirements;
+  sessions;
   config;
   t;
-  constructor(tokenRepository, cookieManager, cache2, credentialSetupRequirements) {
+  constructor(tokenRepository, cookieManager, cache2, credentialSetupRequirements, sessions) {
     this.tokenRepository = tokenRepository;
     this.cookieManager = cookieManager;
     this.cache = cache2;
     this.credentialSetupRequirements = credentialSetupRequirements;
+    this.sessions = sessions;
+  }
+  /** The shared invalidation contract — see SessionInvalidationService. */
+  get invalidation() {
+    if (!this.sessions) {
+      this.sessions = new SessionInvalidationService(this.cache, this.tokenRepository);
+      this.sessions.config = this.config;
+    }
+    return this.sessions;
   }
   /**
    * Get blacklist key prefix
@@ -1833,17 +2129,11 @@ var TokenService = class TokenService2 {
   get resetTokenPrefix() {
     return "auth:reset:";
   }
-  get sessionVersionPrefix() {
-    return "auth:session-version:";
-  }
   sessionVersionKey(userId) {
-    return `${this.sessionVersionPrefix}${userId}`;
-  }
-  accessTokenTtlMs() {
-    return timestring2(this.config.jwt.accessExpiresIn, "ms");
+    return this.invalidation.sessionVersionKey(userId);
   }
   expiresAt(expiresIn) {
-    return Math.floor((Date.now() + timestring2(expiresIn, "ms")) / 1e3);
+    return Math.floor((Date.now() + timestring3(expiresIn, "ms")) / 1e3);
   }
   async getCacheValues(keys) {
     const cache2 = this.cache;
@@ -1852,10 +2142,7 @@ var TokenService = class TokenService2 {
     return Promise.all(keys.map((key) => cache2.get(key)));
   }
   parseSessionVersion(raw) {
-    if (!raw)
-      return 0;
-    const parsed = Number(raw);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+    return this.invalidation.parseSessionVersion(raw);
   }
   // ============ TOKEN VALIDATION ============
   extractAccessToken(authorization) {
@@ -1877,18 +2164,23 @@ var TokenService = class TokenService2 {
     }
     const sessionKey = this.sessionVersionKey(payload.userId);
     const blacklistKey = payload.jti ? `${this.blacklistPrefix}${payload.jti}` : null;
-    const familyKey = payload.tokenFamily ? this.revokedFamilyKey(payload.tokenFamily) : null;
+    const revokedKey = payload.tokenFamily ? this.revokedFamilyKey(payload.tokenFamily) : null;
+    const liveKey = payload.tokenFamily ? this.invalidation.familyKey(payload.tokenFamily) : null;
     const keys = [
       ...blacklistKey ? [blacklistKey] : [],
       sessionKey,
-      ...familyKey ? [familyKey] : []
+      ...revokedKey ? [revokedKey] : [],
+      ...liveKey ? [liveKey] : []
     ];
     const values = await this.getCacheValues(keys);
     const valueByKey = new Map(keys.map((key, i) => [key, values[i]]));
     if (blacklistKey && valueByKey.get(blacklistKey) != null) {
       Err7(this.t("errors.tokenRevoked"), 401);
     }
-    if (familyKey && valueByKey.get(familyKey) != null) {
+    if (revokedKey && valueByKey.get(revokedKey) != null) {
+      Err7(this.t("errors.tokenRevoked"), 401);
+    }
+    if (!liveKey || valueByKey.get(liveKey) !== payload.userId) {
       Err7(this.t("errors.tokenRevoked"), 401);
     }
     const activeSessionVersion = this.parseSessionVersion(valueByKey.get(sessionKey) ?? null);
@@ -1922,6 +2214,11 @@ var TokenService = class TokenService2 {
     this.clearRefreshSessionCookies();
     Err7(this.t(messageKey), 401);
   }
+  async assertRefreshFamilyAllowed(tokenFamily, userId) {
+    if (await this.invalidation.familyStatus(tokenFamily, userId) === "revoked") {
+      this.rejectRefreshSession();
+    }
+  }
   readRefreshSessionCookie() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
@@ -1948,6 +2245,7 @@ var TokenService = class TokenService2 {
   async resolveRefreshSessionFromCookie() {
     const { refreshToken, userId, tokenFamily } = this.readRefreshSessionCookie();
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
+    await this.assertRefreshFamilyAllowed(tokenFamily, userId);
     if (!stored || stored.userId !== userId) {
       this.rejectRefreshSession();
     }
@@ -1979,7 +2277,8 @@ var TokenService = class TokenService2 {
       user,
       roles: user.role ? [user.role] : [],
       permissions: Array.isArray(user.permissions) ? user.permissions : [],
-      sessionVersion
+      sessionVersion,
+      tokenFamily
     };
   }
   // ============ USER RETRIEVAL (MAIN METHOD) ============
@@ -1988,7 +2287,26 @@ var TokenService = class TokenService2 {
       return null;
     const token = this.extractAccessToken(auth2);
     const { userId } = await this.verifyAccessToken(token);
-    return this.getUserById(userId);
+    return this.requireActiveUser(await this.getUserById(userId));
+  }
+  /**
+   * A user record is only an authorization if the account is still usable.
+   *
+   * A valid signature and an unrevoked version say the *token* is intact; they
+   * say nothing about whether the account behind it was since deactivated or
+   * deleted. Session invalidation is what normally ends such a token, but this
+   * check is what makes a truthy cached record insufficient on its own — so a
+   * missed invalidation, or a record filled into cache moments before the
+   * change, still cannot authorize a request.
+   */
+  requireActiveUser(user) {
+    if (!user) {
+      Err7(this.t("errors.tokenVerificationFailed"), 401);
+    }
+    if (user.status !== void 0 && user.status !== "active") {
+      Err7(this.t("errors.accountInactive"), 403);
+    }
+    return user;
   }
   async getUserById(userId) {
     const cacheKey = `auth:user:${userId}`;
@@ -2018,7 +2336,7 @@ var TokenService = class TokenService2 {
     const sessionVersion = await this.getUserSessionVersion(data.userId);
     const expiresAt = this.expiresAt(this.config.jwt.accessExpiresIn);
     if (sessionVersion > 0) {
-      await this.cache.set(this.sessionVersionKey(data.userId), String(sessionVersion), this.accessTokenTtlMs());
+      await this.invalidation.touchSessionVersion(data.userId);
     }
     const token = jwt.sign({ ...data, jti, sessionVersion, exp: expiresAt }, this.config.jwt.accessSecret);
     return { token, expiresAt, sessionVersion };
@@ -2031,9 +2349,24 @@ var TokenService = class TokenService2 {
   async getSessionVersion(userId) {
     return this.getUserSessionVersion(userId);
   }
+  /**
+   * Whether one session family is positively known to be live.
+   *
+   * `false` means "not proven live" — logged out, or simply not in cache — and
+   * is a reason to fall back to an authoritative check, never on its own a
+   * reason to treat a session as valid.
+   */
+  async isSessionFamilyLive(tokenFamily, userId) {
+    return await this.invalidation.familyStatus(tokenFamily, userId) === "live";
+  }
   /**
    * Generate access token with unique jti for blacklist support.
    * Includes roles/permissions for client-side RBAC/PBAC.
+   *
+   * The token only verifies while its `tokenFamily` is a live session — see
+   * verifyAccessToken. A token minted without one, or for a family that has
+   * been revoked, is refused by design rather than trusted on its signature.
+   * Use generateTokens() to establish a family.
    */
   async generateAccessToken(data) {
     return (await this.signAccessToken(data)).token;
@@ -2118,12 +2451,13 @@ var TokenService = class TokenService2 {
    * This prevents token theft in case of database breach
    */
   async storeRefreshToken(userId, refreshToken, tokenFamily) {
-    const expireInSecond = timestring2(this.config.jwt.refreshExpiresIn, "s");
+    await this.assertRefreshFamilyAllowed(tokenFamily, userId);
+    const expireInSecond = timestring3(this.config.jwt.refreshExpiresIn, "s");
     const hashedToken = this.hashToken(refreshToken);
     const existing = await this.tokenRepository.getByFamily(tokenFamily);
     const previousHash = existing?.token ?? null;
     const previousValidUntil = previousHash ? new Date(Date.now() + TokenService_1.PREVIOUS_GRACE_SECONDS * 1e3).toISOString() : null;
-    await this.tokenRepository.storeRefreshToken({
+    const stored = await this.tokenRepository.storeRefreshToken({
       userId,
       token: hashedToken,
       tokenFamily,
@@ -2132,6 +2466,12 @@ var TokenService = class TokenService2 {
       previousValidUntil,
       previousUsedAt: null
     });
+    if (!stored?.length) {
+      this.rejectRefreshSession();
+    }
+    if (!await this.invalidation.markFamilyIssued(tokenFamily, userId)) {
+      this.rejectRefreshSession();
+    }
   }
   /**
    * Rotate only the family row observed by refreshTokens(). This conditional
@@ -2139,7 +2479,7 @@ var TokenService = class TokenService2 {
    */
   async rotateTokens(userId, tokenFamily, expectedCurrentHash) {
     const generated = await this.createTokenPair(userId, tokenFamily);
-    const expireInSecond = timestring2(this.config.jwt.refreshExpiresIn, "s");
+    const expireInSecond = timestring3(this.config.jwt.refreshExpiresIn, "s");
     const rotated = await this.tokenRepository.rotateRefreshToken({
       userId,
       token: this.hashToken(generated.refreshToken),
@@ -2152,6 +2492,9 @@ var TokenService = class TokenService2 {
     if (!rotated?.length) {
       Err7(this.t("errors.refreshTokenInvalid"), 401);
     }
+    if (!await this.invalidation.markFamilyIssued(tokenFamily, userId)) {
+      this.rejectRefreshSession();
+    }
     return generated;
   }
   /**
@@ -2161,6 +2504,7 @@ var TokenService = class TokenService2 {
   async refreshTokens() {
     const { refreshToken, userId, tokenFamily } = this.readRefreshSessionCookie();
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
+    await this.assertRefreshFamilyAllowed(tokenFamily, userId);
     if (!stored || stored.userId !== userId) {
       this.rejectRefreshSession();
     }
@@ -2196,16 +2540,21 @@ var TokenService = class TokenService2 {
   }
   /** Revoke every refresh session for a user (password change/reset, logout-all). */
   async revokeAllForUser(userId) {
-    return this.tokenRepository.revokeAllForUser(userId);
+    const revoked = await this.tokenRepository.revokeAllForUser(userId);
+    if (Array.isArray(revoked)) {
+      await Promise.all(revoked.map((row) => row?.tokenFamily).filter((family) => typeof family === "string" && !!family).map((family) => this.invalidation.markFamilyRevoked(family)));
+    }
+    return revoked;
   }
   /** Revoke a single refresh session (one family). */
   async revokeFamily(tokenFamily) {
-    await this.markFamilyRevoked(tokenFamily);
+    await this.invalidation.markFamilyRevoked(tokenFamily);
     return this.tokenRepository.revokeFamily(tokenFamily);
   }
   /**
    * Opportunistic cleanup of expired/abandoned sessions. With one row per
-   * family (no unique userId), abandoned logins would otherwise accumulate.
+   * family (no unique userId), expired live rows and revocation tombstones
+   * would otherwise accumulate.
    * Best-effort — never let cleanup failure break the calling flow.
    */
   async deleteExpiredSessions() {
@@ -2215,10 +2564,7 @@ var TokenService = class TokenService2 {
     }
   }
   async invalidateUserAccessTokens(userId) {
-    const nextVersion = await this.getUserSessionVersion(userId) + 1;
-    await this.cache.set(this.sessionVersionKey(userId), String(nextVersion), this.accessTokenTtlMs());
-    await this.cache.del(`auth:user:${userId}`);
-    return nextVersion;
+    return this.invalidation.invalidateAccessTokens(userId);
   }
   async getUserFromCookie() {
     const userId = await this.resolveUserFromCookie();
@@ -2226,27 +2572,16 @@ var TokenService = class TokenService2 {
     if (!user) {
       Err7(this.t("errors.refreshTokenInvalid"), 401);
     }
-    return user;
-  }
-  get revokedFamilyPrefix() {
-    return "auth:revoked-family:";
+    return this.requireActiveUser(user);
   }
   revokedFamilyKey(tokenFamily) {
-    return `${this.revokedFamilyPrefix}${tokenFamily}`;
-  }
-  /**
-   * Mark a family as revoked in cache for the access-token TTL, so every
-   * access token minted for that family (not just the presented one) is
-   * rejected by verifyAccessToken until it would have expired anyway.
-   */
-  async markFamilyRevoked(tokenFamily) {
-    await this.cache.set(this.revokedFamilyKey(tokenFamily), "1", this.accessTokenTtlMs());
+    return this.invalidation.revokedFamilyKey(tokenFamily);
   }
   /**
    * Revoke only the suspect family — NOT the whole user. Bumping the global
    * per-user session version here would kill every device's access tokens on a
-   * single family's reuse detection. Instead drop the family's refresh row and
-   * mark the family revoked so its access tokens stop verifying.
+   * single family's reuse detection. Instead durably mark the family revoked
+   * so database recovery and its access tokens both stop verifying.
    */
   async revokeSuspectRefreshFamily(userId, tokenFamily) {
     if (tokenFamily) {
@@ -2258,7 +2593,7 @@ var TokenService = class TokenService2 {
   }
   /**
    * Logout the CURRENT session only — blacklist the presented access token,
-   * mark its family revoked, and delete that family's refresh row. Other
+   * mark its family revoked in cache and durably in the token row. Other
    * devices/sessions for the same user keep working. Use a password change or
    * reset (revoke-all) to terminate every session.
    *
@@ -2339,7 +2674,7 @@ var TokenService = class TokenService2 {
     const token = jwt.sign(data, this.config.jwt.refreshSecret, {
       expiresIn
     });
-    await this.cache.set(`${this.resetTokenPrefix}${userId}`, jti, timestring2(expiresIn, "ms"));
+    await this.cache.set(`${this.resetTokenPrefix}${userId}`, jti, timestring3(expiresIn, "ms"));
     return { token, userId };
   }
   /**
@@ -2358,10 +2693,22 @@ var TokenService = class TokenService2 {
     return this.generateSetPasswordToken(userId, "invite", "3d");
   }
   /**
-   * Verify password reset token
-   * Returns userId if valid, throws error if expired/invalid
+   * Verify and CONSUME a password reset or invite token.
+   *
+   * Consumption is a single atomic compare-and-delete, so exactly one of any
+   * number of concurrent callers holding the same link is told to proceed. The
+   * earlier `get()` then `del()` pair left a window in which two callers both
+   * read the same jti, both passed, and both went on to set a password.
+   *
+   * The comparison also means a stale token cannot delete the jti of a newer
+   * one that superseded it — the newer link keeps working.
+   *
+   * Callers must finish validating the replacement password BEFORE calling
+   * this: consumption is deliberately irreversible, so a token burned by a
+   * request that then failed validation would cost the user their link for
+   * nothing.
    */
-  async verifyResetToken(token) {
+  async consumeSetPasswordToken(token) {
     let decoded;
     try {
       decoded = jwt.verify(token, this.config.jwt.refreshSecret);
@@ -2371,40 +2718,53 @@ var TokenService = class TokenService2 {
     if (decoded.type !== "reset" && decoded.type !== "invite" || !decoded.jti) {
       Err7(this.t("errors.invalidResetToken"));
     }
+    const consume = this.cache.compareAndDelete;
+    if (typeof consume !== "function") {
+      Err7.invalidOperation("Password reset requires a cache with atomic compare-and-delete");
+    }
     const key = `${this.resetTokenPrefix}${decoded.userId}`;
-    const storedJti = await this.cache.get(key);
-    if (!storedJti || storedJti !== decoded.jti) {
+    if (!await consume.call(this.cache, key, decoded.jti)) {
       Err7(this.t("errors.invalidResetToken"));
     }
-    await this.cache.del(key);
-    return decoded.userId;
+    return {
+      userId: decoded.userId,
+      type: decoded.type
+    };
+  }
+  /**
+   * Backward-compatible user-id-only reset/invite token consumption.
+   * Prefer `consumeSetPasswordToken()` when the caller must distinguish an
+   * account invitation from an ordinary password reset.
+   */
+  async verifyResetToken(token) {
+    return (await this.consumeSetPasswordToken(token)).userId;
   }
   async getUserSessionVersion(userId) {
-    return this.parseSessionVersion(await this.cache.get(this.sessionVersionKey(userId)));
+    return this.invalidation.getSessionVersion(userId);
   }
 };
-__decorate11([
-  Inject8(AUTH_CONFIG),
-  __metadata11("design:type", Object)
+__decorate12([
+  Inject9(AUTH_CONFIG),
+  __metadata12("design:type", Object)
 ], TokenService.prototype, "config", void 0);
-__decorate11([
+__decorate12([
   I18n5("auth"),
-  __metadata11("design:type", Object)
+  __metadata12("design:type", Object)
 ], TokenService.prototype, "t", void 0);
-TokenService = TokenService_1 = __decorate11([
-  Injectable6(),
-  __metadata11("design:paramtypes", [typeof (_a6 = typeof TokenRepository !== "undefined" && TokenRepository) === "function" ? _a6 : Object, typeof (_b4 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _b4 : Object, typeof (_c2 = typeof CacheService !== "undefined" && CacheService) === "function" ? _c2 : Object, typeof (_d2 = typeof CredentialSetupRequirementRepository !== "undefined" && CredentialSetupRequirementRepository) === "function" ? _d2 : Object])
+TokenService = TokenService_1 = __decorate12([
+  Injectable7(),
+  __metadata12("design:paramtypes", [typeof (_a7 = typeof TokenRepository !== "undefined" && TokenRepository) === "function" ? _a7 : Object, typeof (_b5 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _b5 : Object, typeof (_c2 = typeof CacheService2 !== "undefined" && CacheService2) === "function" ? _c2 : Object, typeof (_d2 = typeof CredentialSetupRequirementRepository !== "undefined" && CredentialSetupRequirementRepository) === "function" ? _d2 : Object, typeof (_e2 = typeof SessionInvalidationService !== "undefined" && SessionInvalidationService) === "function" ? _e2 : Object])
 ], TokenService);
 
 // src/auth/AuthService.ts
-import timestring3 from "timestring";
+import timestring4 from "timestring";
 
 // src/auth/AuthSessionService.ts
-import { Injectable as Injectable8 } from "najm-core";
+import { Injectable as Injectable9 } from "najm-core";
 import { Err as Err9 } from "najm-core";
 
 // src/credentialSetup/CredentialSetupRequirementService.ts
-import { Injectable as Injectable7 } from "najm-core";
+import { Injectable as Injectable8 } from "najm-core";
 import { Transaction as Transaction2 } from "najm-database";
 
 // src/identity/temporaryCredential.ts
@@ -2476,17 +2836,17 @@ function normalizeSetupPurpose(purpose) {
 __name(normalizeSetupPurpose, "normalizeSetupPurpose");
 
 // src/credentialSetup/CredentialSetupRequirementService.ts
-var __decorate12 = function(decorators, target, key, desc) {
+var __decorate13 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata12 = function(k, v) {
+var __metadata13 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a7;
-var _b5;
+var _a8;
+var _b6;
 var _c3;
 var CredentialSetupRequirementService = class CredentialSetupRequirementService2 {
   static {
@@ -2526,15 +2886,15 @@ var CredentialSetupRequirementService = class CredentialSetupRequirementService2
     return this.repository.complete(userId, normalizeSetupPurpose(purpose));
   }
 };
-__decorate12([
+__decorate13([
   Transaction2({ retries: 2 }),
-  __metadata12("design:type", Function),
-  __metadata12("design:paramtypes", [String, String, Object]),
-  __metadata12("design:returntype", typeof (_c3 = typeof Promise !== "undefined" && Promise) === "function" ? _c3 : Object)
+  __metadata13("design:type", Function),
+  __metadata13("design:paramtypes", [String, String, Object]),
+  __metadata13("design:returntype", typeof (_c3 = typeof Promise !== "undefined" && Promise) === "function" ? _c3 : Object)
 ], CredentialSetupRequirementService.prototype, "markRequired", null);
-CredentialSetupRequirementService = __decorate12([
-  Injectable7(),
-  __metadata12("design:paramtypes", [typeof (_a7 = typeof CredentialSetupRequirementRepository !== "undefined" && CredentialSetupRequirementRepository) === "function" ? _a7 : Object, typeof (_b5 = typeof TokenService !== "undefined" && TokenService) === "function" ? _b5 : Object])
+CredentialSetupRequirementService = __decorate13([
+  Injectable8(),
+  __metadata13("design:paramtypes", [typeof (_a8 = typeof CredentialSetupRequirementRepository !== "undefined" && CredentialSetupRequirementRepository) === "function" ? _a8 : Object, typeof (_b6 = typeof TokenService !== "undefined" && TokenService) === "function" ? _b6 : Object])
 ], CredentialSetupRequirementService);
 
 // src/credentialSetup/errors.ts
@@ -2560,17 +2920,17 @@ var credentialSetupError = /* @__PURE__ */ __name((code, message, status = 400)
 }, "credentialSetupError");
 
 // src/auth/AuthSessionService.ts
-var __decorate13 = function(decorators, target, key, desc) {
+var __decorate14 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata13 = function(k, v) {
+var __metadata14 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a8;
-var _b6;
+var _a9;
+var _b7;
 var _c4;
 var _d3;
 var AuthSessionService = class AuthSessionService2 {
@@ -2598,7 +2958,7 @@ var AuthSessionService = class AuthSessionService2 {
     const generated = await this.tokenService.generateTokens(user.id);
     this.cookieManager.setRefreshToken(generated.refreshToken);
     await this.userService.updateLastLogin(user.id);
-    const { roles, permissions, sessionVersion } = generated;
+    const { roles, permissions, sessionVersion, tokenFamily } = generated;
     this.cookieManager.setSessionCookie({
       user: {
         id: user.id,
@@ -2609,39 +2969,40 @@ var AuthSessionService = class AuthSessionService2 {
       },
       roles,
       permissions,
-      sessionVersion
+      sessionVersion,
+      tokenFamily
     });
     const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, sessionVersion: _sessionVersion, ...tokens } = generated;
     return { ...tokens, user };
   }
 };
-AuthSessionService = __decorate13([
-  Injectable8(),
-  __metadata13("design:paramtypes", [typeof (_a8 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a8 : Object, typeof (_b6 = typeof UserService !== "undefined" && UserService) === "function" ? _b6 : Object, typeof (_c4 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c4 : Object, typeof (_d3 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _d3 : Object])
+AuthSessionService = __decorate14([
+  Injectable9(),
+  __metadata14("design:paramtypes", [typeof (_a9 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a9 : Object, typeof (_b7 = typeof UserService !== "undefined" && UserService) === "function" ? _b7 : Object, typeof (_c4 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c4 : Object, typeof (_d3 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _d3 : Object])
 ], AuthSessionService);
 
 // src/credentialSetup/PasswordSetupService.ts
-import { Inject as Inject10, Injectable as Injectable10 } from "najm-core";
+import { Inject as Inject11, Injectable as Injectable11 } from "najm-core";
 import { I18n as I18n7 } from "najm-i18n";
 
 // src/credentialSetup/CredentialSetupService.ts
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
 import { CookieService as CookieService2 } from "najm-cookies";
-import { Err as Err11, Injectable as Injectable9 } from "najm-core";
+import { Err as Err11, Injectable as Injectable10 } from "najm-core";
 import { Transaction as Transaction3 } from "najm-database";
 import { I18n as I18n6 } from "najm-i18n";
 
 // src/credentialSetup/CredentialSetupRepository.ts
 import { and as and3, eq as eq6, gt, isNull as isNull2, lt as lt2 } from "drizzle-orm";
-import { Err as Err10, Inject as Inject9, Repository as Repository5 } from "najm-core";
+import { Err as Err10, Inject as Inject10, Repository as Repository5 } from "najm-core";
 import { DB as DB5 } from "najm-database";
-var __decorate14 = function(decorators, target, key, desc) {
+var __decorate15 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata14 = function(k, v) {
+var __metadata15 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var CredentialSetupRepository = class CredentialSetupRepository2 {
@@ -2693,33 +3054,33 @@ var CredentialSetupRepository = class CredentialSetupRepository2 {
     return this.db.delete(this.sessions).where(lt2(this.sessions.expiresAt, (/* @__PURE__ */ new Date()).toISOString())).returning({ userId: this.sessions.userId });
   }
 };
-__decorate14([
+__decorate15([
   DB5(),
-  __metadata14("design:type", Object)
+  __metadata15("design:type", Object)
 ], CredentialSetupRepository.prototype, "db", void 0);
-__decorate14([
-  Inject9(AUTH_SCHEMA),
-  __metadata14("design:type", Object)
+__decorate15([
+  Inject10(AUTH_SCHEMA),
+  __metadata15("design:type", Object)
 ], CredentialSetupRepository.prototype, "schema", void 0);
-CredentialSetupRepository = __decorate14([
+CredentialSetupRepository = __decorate15([
   Repository5()
 ], CredentialSetupRepository);
 
 // src/credentialSetup/CredentialSetupService.ts
-var __decorate15 = function(decorators, target, key, desc) {
+var __decorate16 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata15 = function(k, v) {
+var __metadata16 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a9;
-var _b7;
+var _a10;
+var _b8;
 var _c5;
 var _d4;
-var _e2;
+var _e3;
 var _f2;
 var _g2;
 var DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME = "najm.credential-setup";
@@ -2855,48 +3216,48 @@ var CredentialSetupService = class CredentialSetupService2 {
     });
   }
 };
-__decorate15([
+__decorate16([
   I18n6("auth"),
-  __metadata15("design:type", Object)
+  __metadata16("design:type", Object)
 ], CredentialSetupService.prototype, "t", void 0);
-__decorate15([
+__decorate16([
   Transaction3({ retries: 2 }),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [String, Object]),
-  __metadata15("design:returntype", typeof (_e2 = typeof Promise !== "undefined" && Promise) === "function" ? _e2 : Object)
+  __metadata16("design:type", Function),
+  __metadata16("design:paramtypes", [String, Object]),
+  __metadata16("design:returntype", typeof (_e3 = typeof Promise !== "undefined" && Promise) === "function" ? _e3 : Object)
 ], CredentialSetupService.prototype, "begin", null);
-__decorate15([
+__decorate16([
   Transaction3({ retries: 2 }),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object, Function]),
-  __metadata15("design:returntype", typeof (_f2 = typeof Promise !== "undefined" && Promise) === "function" ? _f2 : Object)
+  __metadata16("design:type", Function),
+  __metadata16("design:paramtypes", [Object, Function]),
+  __metadata16("design:returntype", typeof (_f2 = typeof Promise !== "undefined" && Promise) === "function" ? _f2 : Object)
 ], CredentialSetupService.prototype, "consume", null);
-__decorate15([
+__decorate16([
   Transaction3({ retries: 2 }),
-  __metadata15("design:type", Function),
-  __metadata15("design:paramtypes", [Object]),
-  __metadata15("design:returntype", typeof (_g2 = typeof Promise !== "undefined" && Promise) === "function" ? _g2 : Object)
+  __metadata16("design:type", Function),
+  __metadata16("design:paramtypes", [Object]),
+  __metadata16("design:returntype", typeof (_g2 = typeof Promise !== "undefined" && Promise) === "function" ? _g2 : Object)
 ], CredentialSetupService.prototype, "cancel", null);
-CredentialSetupService = __decorate15([
-  Injectable9(),
-  __metadata15("design:paramtypes", [typeof (_a9 = typeof CredentialSetupRepository !== "undefined" && CredentialSetupRepository) === "function" ? _a9 : Object, typeof (_b7 = typeof TokenService !== "undefined" && TokenService) === "function" ? _b7 : Object, typeof (_c5 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c5 : Object, typeof (_d4 = typeof CookieService2 !== "undefined" && CookieService2) === "function" ? _d4 : Object])
+CredentialSetupService = __decorate16([
+  Injectable10(),
+  __metadata16("design:paramtypes", [typeof (_a10 = typeof CredentialSetupRepository !== "undefined" && CredentialSetupRepository) === "function" ? _a10 : Object, typeof (_b8 = typeof TokenService !== "undefined" && TokenService) === "function" ? _b8 : Object, typeof (_c5 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c5 : Object, typeof (_d4 = typeof CookieService2 !== "undefined" && CookieService2) === "function" ? _d4 : Object])
 ], CredentialSetupService);
 
 // src/credentialSetup/PasswordSetupService.ts
-var __decorate16 = function(decorators, target, key, desc) {
+var __decorate17 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata16 = function(k, v) {
+var __metadata17 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a10;
-var _b8;
+var _a11;
+var _b9;
 var _c6;
 var _d5;
-var _e3;
+var _e4;
 var _f3;
 var PasswordSetupService = class PasswordSetupService2 {
   static {
@@ -3013,38 +3374,38 @@ var PasswordSetupService = class PasswordSetupService2 {
     return this.validator.comparePassword(normalized, storedHash);
   }
 };
-__decorate16([
-  Inject10(AUTH_CONFIG),
-  __metadata16("design:type", Object)
+__decorate17([
+  Inject11(AUTH_CONFIG),
+  __metadata17("design:type", Object)
 ], PasswordSetupService.prototype, "config", void 0);
-__decorate16([
+__decorate17([
   I18n7("auth"),
-  __metadata16("design:type", Object)
+  __metadata17("design:type", Object)
 ], PasswordSetupService.prototype, "t", void 0);
-PasswordSetupService = __decorate16([
-  Injectable10(),
-  __metadata16("design:paramtypes", [typeof (_a10 = typeof CredentialSetupService !== "undefined" && CredentialSetupService) === "function" ? _a10 : Object, typeof (_b8 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _b8 : Object, typeof (_c6 = typeof UserService !== "undefined" && UserService) === "function" ? _c6 : Object, typeof (_d5 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _d5 : Object, typeof (_e3 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _e3 : Object, typeof (_f3 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _f3 : Object])
+PasswordSetupService = __decorate17([
+  Injectable11(),
+  __metadata17("design:paramtypes", [typeof (_a11 = typeof CredentialSetupService !== "undefined" && CredentialSetupService) === "function" ? _a11 : Object, typeof (_b9 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _b9 : Object, typeof (_c6 = typeof UserService !== "undefined" && UserService) === "function" ? _c6 : Object, typeof (_d5 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _d5 : Object, typeof (_e4 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _e4 : Object, typeof (_f3 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _f3 : Object])
 ], PasswordSetupService);
 
 // src/auth/AuthService.ts
-var __decorate17 = function(decorators, target, key, desc) {
+var __decorate18 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata17 = function(k, v) {
+var __metadata18 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a11;
-var _b9;
+var _a12;
+var _b10;
 var _c7;
 var _d6;
-var _e4;
+var _e5;
 var _f4;
 var _g3;
 var _h2;
-var _j;
+var _j2;
 var _k;
 var _l;
 var AuthService = class AuthService2 {
@@ -3083,7 +3444,7 @@ var AuthService = class AuthService2 {
     return new Date(lockoutUntil).getTime() > Date.now();
   }
   nextLockoutUntil() {
-    const durationMs = timestring3(this.config.lockout.duration, "ms");
+    const durationMs = timestring4(this.config.lockout.duration, "ms");
     return new Date(Date.now() + durationMs).toISOString();
   }
   getDummyHash() {
@@ -3333,7 +3694,8 @@ var AuthService = class AuthService2 {
         user: { id: user.id, email: user.email, name: user.name, role: user.role, status: user.status ?? void 0 },
         roles: generated.roles,
         permissions: generated.permissions,
-        sessionVersion: generated.sessionVersion
+        sessionVersion: generated.sessionVersion,
+        tokenFamily: generated.tokenFamily
       });
     }
     const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, sessionVersion: _sv, ...tokens } = generated;
@@ -3356,7 +3718,8 @@ var AuthService = class AuthService2 {
       },
       roles: recovered.roles,
       permissions: recovered.permissions,
-      sessionVersion: recovered.sessionVersion
+      sessionVersion: recovered.sessionVersion,
+      tokenFamily: recovered.tokenFamily
     });
     return { recovered: true };
   }
@@ -3408,7 +3771,12 @@ var AuthService = class AuthService2 {
         const lang = this.i18nService.getCurrentLanguage();
         result = { ...user, language: lang };
         const token = this.tokenService.decodeAccessToken(authorization.replace(/^Bearer\s+/i, ""));
-        cachePayload = { roles: token?.roles ?? [], permissions: token?.permissions ?? [], sessionVersion: token?.sessionVersion ?? 0 };
+        cachePayload = token?.tokenFamily ? {
+          roles: token.roles ?? [],
+          permissions: token.permissions ?? [],
+          sessionVersion: token.sessionVersion ?? 0,
+          tokenFamily: token.tokenFamily
+        } : null;
       } else {
         result = await this.getUserFromCookie();
       }
@@ -3420,7 +3788,8 @@ var AuthService = class AuthService2 {
         user: { id: result.id, email: result.email, name: result.name, role: result.role, status: result.status ?? void 0 },
         roles: cachePayload.roles,
         permissions: cachePayload.permissions,
-        sessionVersion: cachePayload.sessionVersion
+        sessionVersion: cachePayload.sessionVersion,
+        tokenFamily: cachePayload.tokenFamily
       });
     }
     return result;
@@ -3459,49 +3828,57 @@ var AuthService = class AuthService2 {
     return { message: this.t("success.passwordChanged") };
   }
   async resetPassword(token, newPassword) {
-    const userId = await this.tokenService.verifyResetToken(token);
     this.userValidator.validatePasswordStrength(newPassword);
-    await this.userService.update(userId, { password: newPassword });
-    await this.tokenService.invalidateUserAccessTokens(userId);
-    await this.tokenService.revokeAllForUser(userId);
+    const consumed = await this.tokenService.consumeSetPasswordToken(token);
+    const user = await this.userService.getById(consumed.userId);
+    const acceptsInvitation = consumed.type === "invite";
+    await this.userService.update(consumed.userId, {
+      password: newPassword,
+      ...acceptsInvitation ? {
+        emailVerified: true,
+        ...user.status === "pending" ? { status: "active" } : {}
+      } : {}
+    });
+    await this.tokenService.invalidateUserAccessTokens(consumed.userId);
+    await this.tokenService.revokeAllForUser(consumed.userId);
     this.cookieManager.clearRefreshToken();
     this.cookieManager.clearSessionCookie();
     return { message: this.t("success.passwordReset") };
   }
 };
-__decorate17([
-  Inject11(AUTH_CONFIG),
-  __metadata17("design:type", Object)
+__decorate18([
+  Inject12(AUTH_CONFIG),
+  __metadata18("design:type", Object)
 ], AuthService.prototype, "config", void 0);
-__decorate17([
+__decorate18([
   I18n8("auth"),
-  __metadata17("design:type", Object)
+  __metadata18("design:type", Object)
 ], AuthService.prototype, "t", void 0);
-__decorate17([
+__decorate18([
   Log(),
-  __metadata17("design:type", Object)
+  __metadata18("design:type", Object)
 ], AuthService.prototype, "logger", void 0);
-__decorate17([
+__decorate18([
   Transaction4(),
-  __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", [Object]),
-  __metadata17("design:returntype", typeof (_l = typeof Promise !== "undefined" && Promise) === "function" ? _l : Object)
+  __metadata18("design:type", Function),
+  __metadata18("design:paramtypes", [Object]),
+  __metadata18("design:returntype", typeof (_l = typeof Promise !== "undefined" && Promise) === "function" ? _l : Object)
 ], AuthService.prototype, "provisionWithCredentialSetup", null);
-AuthService = __decorate17([
-  Injectable11(),
-  __metadata17("design:paramtypes", [typeof (_a11 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a11 : Object, typeof (_b9 = typeof UserService !== "undefined" && UserService) === "function" ? _b9 : Object, typeof (_c7 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c7 : Object, typeof (_d6 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _d6 : Object, typeof (_e4 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _e4 : Object, typeof (_f4 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _f4 : Object, typeof (_g3 = typeof EmailService !== "undefined" && EmailService) === "function" ? _g3 : Object, typeof (_h2 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _h2 : Object, typeof (_j = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _j : Object, typeof (_k = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _k : Object])
+AuthService = __decorate18([
+  Injectable12(),
+  __metadata18("design:paramtypes", [typeof (_a12 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a12 : Object, typeof (_b10 = typeof UserService !== "undefined" && UserService) === "function" ? _b10 : Object, typeof (_c7 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c7 : Object, typeof (_d6 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _d6 : Object, typeof (_e5 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _e5 : Object, typeof (_f4 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _f4 : Object, typeof (_g3 = typeof EmailService !== "undefined" && EmailService) === "function" ? _g3 : Object, typeof (_h2 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _h2 : Object, typeof (_j2 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _j2 : Object, typeof (_k = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _k : Object])
 ], AuthService);
 
 // src/auth/AuthGuard.ts
 import { Service as Service2, User } from "najm-core";
 import { createGuard } from "najm-guard";
-var __decorate18 = function(decorators, target, key, desc) {
+var __decorate19 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata18 = function(k, v) {
+var __metadata19 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param3 = function(paramIndex, decorator) {
@@ -3513,17 +3890,27 @@ var AuthGuard = class AuthGuard2 {
   static {
     __name(this, "AuthGuard");
   }
+  /**
+   * A resolved principal is not automatically an authorized one.
+   *
+   * The resolvers ahead of this guard already reject deactivated accounts, so
+   * this is the backstop for anything that publishes a principal by another
+   * route: a truthy user record must still be an active one to pass. Records
+   * whose projection omits `status` are unchanged.
+   */
   canActivate(user) {
-    return !!user;
+    if (!user)
+      return false;
+    return user.status === void 0 || user.status === "active";
   }
 };
-__decorate18([
+__decorate19([
   __param3(0, User()),
-  __metadata18("design:type", Function),
-  __metadata18("design:paramtypes", [Object]),
-  __metadata18("design:returntype", Boolean)
+  __metadata19("design:type", Function),
+  __metadata19("design:paramtypes", [Object]),
+  __metadata19("design:returntype", Boolean)
 ], AuthGuard.prototype, "canActivate", null);
-AuthGuard = __decorate18([
+AuthGuard = __decorate19([
   Service2()
 ], AuthGuard);
 var isAuth = createGuard(AuthGuard);
@@ -3532,13 +3919,13 @@ var isAuth = createGuard(AuthGuard);
 import { Service as Service3 } from "najm-core";
 import { GuardParams, Role as RequestRole } from "najm-core";
 import { composeGuards, createGuard as createGuard2 } from "najm-guard";
-var __decorate19 = function(decorators, target, key, desc) {
+var __decorate20 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata19 = function(k, v) {
+var __metadata20 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param4 = function(paramIndex, decorator) {
@@ -3561,14 +3948,14 @@ var RoleGuard = class RoleGuard2 {
     return false;
   }
 };
-__decorate19([
+__decorate20([
   __param4(0, GuardParams()),
   __param4(1, RequestRole()),
-  __metadata19("design:type", Function),
-  __metadata19("design:paramtypes", [Object, String]),
-  __metadata19("design:returntype", void 0)
+  __metadata20("design:type", Function),
+  __metadata20("design:paramtypes", [Object, String]),
+  __metadata20("design:returntype", void 0)
 ], RoleGuard.prototype, "canActivate", null);
-RoleGuard = __decorate19([
+RoleGuard = __decorate20([
   Service3()
 ], RoleGuard);
 var Role = createGuard2(RoleGuard);
@@ -3739,13 +4126,13 @@ var userListQuery = z.object({
 });
 
 // src/auth/AuthController.ts
-var __decorate20 = function(decorators, target, key, desc) {
+var __decorate21 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata20 = function(k, v) {
+var __metadata21 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param5 = function(paramIndex, decorator) {
@@ -3753,18 +4140,28 @@ var __param5 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a12;
+var _a13;
 var hashKeyPart = /* @__PURE__ */ __name((value) => createHash3("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
 var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx, { clientIp }) => {
   const cookie = ctx.req.raw.headers.get("cookie") ?? "";
   const fingerprint = cookie ? hashKeyPart(cookie) : "none";
   return `${clientIp}:${fingerprint}`;
 }, "cookieFingerprint");
-var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx, keyContext) => {
+var readDeclaredIdentity = /* @__PURE__ */ __name((body, fields) => {
+  if (typeof body !== "object" || body === null || Array.isArray(body))
+    return void 0;
+  for (const field of fields) {
+    const value = body[field];
+    if (typeof value === "string" && value.trim())
+      return value;
+  }
+  return void 0;
+}, "readDeclaredIdentity");
+var identityRateLimitKey = /* @__PURE__ */ __name((fields) => async (ctx, keyContext) => {
   const ip = keyContext?.clientIp ?? UNRESOLVED_CLIENT_ADDRESS;
   try {
     const body = await ctx.req.json();
-    const identity = body?.identifier ?? body?.email;
+    const identity = readDeclaredIdentity(body, fields);
     const normalizedIdentity = getRequestIdentityResolver(ctx)(identity);
     if (normalizedIdentity) {
       return `${ip}:${hashKeyPart(normalizedIdentity)}`;
@@ -3772,7 +4169,9 @@ var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx, keyContext) =>
   } catch {
   }
   return ip;
-}, "authIdentityRateLimitKey");
+}, "identityRateLimitKey");
+var authIdentityRateLimitKey = identityRateLimitKey(["identifier", "email"]);
+var authEmailRateLimitKey = identityRateLimitKey(["email"]);
 var loginRateLimit = resolveAuthLoginRateLimitConfig();
 var AuthController = class AuthController2 {
   static {
@@ -3815,7 +4214,7 @@ var AuthController = class AuthController2 {
     return this.authService.resetPassword(body.token, body.newPassword);
   }
 };
-__decorate20([
+__decorate21([
   Post("/login"),
   RateLimit({
     limit: loginRateLimit.limit,
@@ -3827,105 +4226,105 @@ __decorate20([
   Validate(loginDto),
   ResMsg("auth.success.login"),
   __param5(0, Body()),
-  __metadata20("design:type", Function),
-  __metadata20("design:paramtypes", [Object]),
-  __metadata20("design:returntype", Promise)
+  __metadata21("design:type", Function),
+  __metadata21("design:paramtypes", [Object]),
+  __metadata21("design:returntype", Promise)
 ], AuthController.prototype, "loginUser", null);
-__decorate20([
+__decorate21([
   Post("/invite"),
   isAdmin(),
   RateLimit({ limit: 20, window: "15m", key: "user" }),
   Validate(inviteUserDto),
   ResMsg("auth.success.accountInviteSent"),
   __param5(0, Body()),
-  __metadata20("design:type", Function),
-  __metadata20("design:paramtypes", [Object]),
-  __metadata20("design:returntype", Promise)
+  __metadata21("design:type", Function),
+  __metadata21("design:paramtypes", [Object]),
+  __metadata21("design:returntype", Promise)
 ], AuthController.prototype, "inviteUser", null);
-__decorate20([
+__decorate21([
   Post("/refresh"),
   RateLimit({ limit: 15, window: "15m", key: cookieFingerprint() }),
   ResMsg("auth.success.tokenRefreshed"),
-  __metadata20("design:type", Function),
-  __metadata20("design:paramtypes", []),
-  __metadata20("design:returntype", Promise)
+  __metadata21("design:type", Function),
+  __metadata21("design:paramtypes", []),
+  __metadata21("design:returntype", Promise)
 ], AuthController.prototype, "refreshTokens", null);
-__decorate20([
+__decorate21([
   Post("/session/recover"),
   RateLimit({ limit: 120, window: "1m", key: cookieFingerprint() }),
   ResMsg("auth.success.sessionRecovered"),
   __param5(0, Headers("x-najm-session-recovery")),
   __param5(1, Ctx()),
-  __metadata20("design:type", Function),
-  __metadata20("design:paramtypes", [String, Object]),
-  __metadata20("design:returntype", Promise)
+  __metadata21("design:type", Function),
+  __metadata21("design:paramtypes", [String, Object]),
+  __metadata21("design:returntype", Promise)
 ], AuthController.prototype, "recoverSession", null);
-__decorate20([
+__decorate21([
   Post("/logout"),
   __param5(0, User2("id")),
   __param5(1, Headers("authorization")),
-  __metadata20("design:type", Function),
-  __metadata20("design:paramtypes", [String, String]),
-  __metadata20("design:returntype", Promise)
+  __metadata21("design:type", Function),
+  __metadata21("design:paramtypes", [String, String]),
+  __metadata21("design:returntype", Promise)
 ], AuthController.prototype, "logoutUser", null);
-__decorate20([
+__decorate21([
   Post("/change-password"),
   isAuth(),
   Validate(changePasswordDto),
   ResMsg("auth.success.passwordChanged"),
   __param5(0, User2("id")),
   __param5(1, Body()),
-  __metadata20("design:type", Function),
-  __metadata20("design:paramtypes", [String, Object]),
-  __metadata20("design:returntype", Promise)
+  __metadata21("design:type", Function),
+  __metadata21("design:paramtypes", [String, Object]),
+  __metadata21("design:returntype", Promise)
 ], AuthController.prototype, "changePassword", null);
-__decorate20([
+__decorate21([
   Get("/me"),
   RateLimit({ limit: 30, window: "1m", key: cookieFingerprint() }),
   ResMsg("auth.users.success.retrieved"),
   __param5(0, Headers("authorization")),
-  __metadata20("design:type", Function),
-  __metadata20("design:paramtypes", [String]),
-  __metadata20("design:returntype", Promise)
+  __metadata21("design:type", Function),
+  __metadata21("design:paramtypes", [String]),
+  __metadata21("design:returntype", Promise)
 ], AuthController.prototype, "userProfile", null);
-__decorate20([
+__decorate21([
   Post("/forgot-password"),
-  RateLimit({ limit: 3, window: "15m", key: authIdentityRateLimitKey, message: "Too many password reset requests. Please try again later." }),
+  RateLimit({ limit: 3, window: "15m", key: authEmailRateLimitKey, message: "Too many password reset requests. Please try again later." }),
   Validate(resetPasswordDto),
   ResMsg("auth.success.passwordResetSent"),
   __param5(0, Body()),
-  __metadata20("design:type", Function),
-  __metadata20("design:paramtypes", [Object]),
-  __metadata20("design:returntype", Promise)
+  __metadata21("design:type", Function),
+  __metadata21("design:paramtypes", [Object]),
+  __metadata21("design:returntype", Promise)
 ], AuthController.prototype, "forgotPassword", null);
-__decorate20([
+__decorate21([
   Post("/reset-password"),
   RateLimit({ limit: 5, window: "15m", key: "ip", message: "Too many password reset attempts. Please try again later." }),
   Validate(confirmResetPasswordDto),
   ResMsg("auth.success.passwordReset"),
   __param5(0, Body()),
-  __metadata20("design:type", Function),
-  __metadata20("design:paramtypes", [Object]),
-  __metadata20("design:returntype", Promise)
+  __metadata21("design:type", Function),
+  __metadata21("design:paramtypes", [Object]),
+  __metadata21("design:returntype", Promise)
 ], AuthController.prototype, "resetPassword", null);
-AuthController = __decorate20([
+AuthController = __decorate21([
   Controller("/auth"),
-  __metadata20("design:paramtypes", [typeof (_a12 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a12 : Object])
+  __metadata21("design:paramtypes", [typeof (_a13 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a13 : Object])
 ], AuthController);
 
 // src/auth/AuthResolver.ts
-import { APP, Container, DI, Inject as Inject12, LOGGER, Meta, Service as Service4 } from "najm-core";
+import { APP, Container, DI, Inject as Inject13, LOGGER, Meta, Service as Service4 } from "najm-core";
 import { USER, ROLE, PERMISSIONS } from "najm-guard";
-var __decorate21 = function(decorators, target, key, desc) {
+var __decorate22 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata21 = function(k, v) {
+var __metadata22 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a13;
+var _a14;
 var AuthResolver = class AuthResolver2 {
   static {
     __name(this, "AuthResolver");
@@ -3976,6 +4375,12 @@ var AuthResolver = class AuthResolver2 {
       const currentVersion = await tokenService.getSessionVersion(session.user.id);
       if ((session.sessionVersion ?? 0) !== currentVersion)
         return false;
+      if (!await tokenService.isSessionFamilyLive(session.tokenFamily, session.user.id)) {
+        return false;
+      }
+      const status = session.user.status;
+      if (status !== void 0 && status !== "active")
+        return false;
       return {
         user: { ...session.user, permissions: session.permissions },
         role: session.user.role ?? session.roles[0],
@@ -4041,32 +4446,32 @@ var AuthResolver = class AuthResolver2 {
     await authService.warmupPasswordHash();
   }
 };
-__decorate21([
+__decorate22([
   DI(),
-  __metadata21("design:type", typeof (_a13 = typeof Container !== "undefined" && Container) === "function" ? _a13 : Object)
+  __metadata22("design:type", typeof (_a14 = typeof Container !== "undefined" && Container) === "function" ? _a14 : Object)
 ], AuthResolver.prototype, "container", void 0);
-__decorate21([
-  Inject12(APP),
-  __metadata21("design:type", Object)
+__decorate22([
+  Inject13(APP),
+  __metadata22("design:type", Object)
 ], AuthResolver.prototype, "app", void 0);
-__decorate21([
-  Inject12(LOGGER),
-  __metadata21("design:type", Object)
+__decorate22([
+  Inject13(LOGGER),
+  __metadata22("design:type", Object)
 ], AuthResolver.prototype, "log", void 0);
-AuthResolver = __decorate21([
+AuthResolver = __decorate22([
   Service4(),
   Meta({ layer: "plugin", order: 30 })
 ], AuthResolver);
 
 // src/auth/AuthIdentityContextService.ts
-import { DI as DI2, Inject as Inject13, INJECTION_TYPES, Meta as Meta2, Service as Service5 } from "najm-core";
-var __decorate22 = function(decorators, target, key, desc) {
+import { DI as DI2, Inject as Inject14, INJECTION_TYPES, Meta as Meta2, Service as Service5 } from "najm-core";
+var __decorate23 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata22 = function(k, v) {
+var __metadata23 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param6 = function(paramIndex, decorator) {
@@ -4096,28 +4501,28 @@ var AuthIdentityContextService = class AuthIdentityContextService2 {
     });
   }
 };
-__decorate22([
+__decorate23([
   DI2(),
-  __metadata22("design:type", Object)
+  __metadata23("design:type", Object)
 ], AuthIdentityContextService.prototype, "container", void 0);
-AuthIdentityContextService = __decorate22([
+AuthIdentityContextService = __decorate23([
   Service5(),
   Meta2({ layer: "plugin", order: 14 }),
-  __param6(0, Inject13(AUTH_CONFIG)),
-  __metadata22("design:paramtypes", [Object])
+  __param6(0, Inject14(AUTH_CONFIG)),
+  __metadata23("design:paramtypes", [Object])
 ], AuthIdentityContextService);
 
 // src/auth/RegistrationController.ts
 import { Body as Body2, Controller as Controller2, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
 import { RateLimit as RateLimit2 } from "najm-rate";
 import { Validate as Validate2 } from "najm-validation";
-var __decorate23 = function(decorators, target, key, desc) {
+var __decorate24 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata23 = function(k, v) {
+var __metadata24 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param7 = function(paramIndex, decorator) {
@@ -4125,7 +4530,7 @@ var __param7 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a14;
+var _a15;
 var RegistrationController = class RegistrationController2 {
   static {
     __name(this, "RegistrationController");
@@ -4138,19 +4543,19 @@ var RegistrationController = class RegistrationController2 {
     return this.authService.registerUser(body);
   }
 };
-__decorate23([
+__decorate24([
   Post2("/register"),
-  RateLimit2({ limit: 5, window: "15m", key: authIdentityRateLimitKey }),
+  RateLimit2({ limit: 5, window: "15m", key: authEmailRateLimitKey }),
   Validate2(registerDto),
   ResMsg2("auth.success.register"),
   __param7(0, Body2()),
-  __metadata23("design:type", Function),
-  __metadata23("design:paramtypes", [Object]),
-  __metadata23("design:returntype", Promise)
+  __metadata24("design:type", Function),
+  __metadata24("design:paramtypes", [Object]),
+  __metadata24("design:returntype", Promise)
 ], RegistrationController.prototype, "registerUser", null);
-RegistrationController = __decorate23([
+RegistrationController = __decorate24([
   Controller2("/auth"),
-  __metadata23("design:paramtypes", [typeof (_a14 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a14 : Object])
+  __metadata24("design:paramtypes", [typeof (_a15 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a15 : Object])
 ], RegistrationController);
 
 // src/auth/runAsUser.ts
@@ -4301,13 +4706,13 @@ var assignRoleDto = z2.object({
 });
 
 // src/roles/RoleController.ts
-var __decorate24 = function(decorators, target, key, desc) {
+var __decorate25 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata24 = function(k, v) {
+var __metadata25 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param8 = function(paramIndex, decorator) {
@@ -4315,7 +4720,7 @@ var __param8 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a15;
+var _a16;
 var RoleController = class RoleController2 {
   static {
     __name(this, "RoleController");
@@ -4340,35 +4745,35 @@ var RoleController = class RoleController2 {
     return this.roleService.delete(params.id);
   }
 };
-__decorate24([
+__decorate25([
   Get2(),
   isAdmin(),
   ResMsg3("roles.success.retrieved"),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", []),
-  __metadata24("design:returntype", Promise)
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", []),
+  __metadata25("design:returntype", Promise)
 ], RoleController.prototype, "getRoles", null);
-__decorate24([
+__decorate25([
   Get2("/:id"),
   isAdmin(),
   Validate3({ params: roleIdParam }),
   ResMsg3("roles.success.retrieved"),
   __param8(0, Params()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], RoleController.prototype, "getRole", null);
-__decorate24([
+__decorate25([
   Post3(),
   isAdmin(),
   Validate3(createRoleDto),
   ResMsg3("roles.success.created"),
   __param8(0, Body3()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], RoleController.prototype, "createRole", null);
-__decorate24([
+__decorate25([
   Put("/:id"),
   isAdmin(),
   Validate3({
@@ -4378,34 +4783,34 @@ __decorate24([
   ResMsg3("roles.success.updated"),
   __param8(0, Params()),
   __param8(1, Body3()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object, Object]),
-  __metadata24("design:returntype", Promise)
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object, Object]),
+  __metadata25("design:returntype", Promise)
 ], RoleController.prototype, "updateRole", null);
-__decorate24([
+__decorate25([
   Delete("/:id"),
   isAdmin(),
   Validate3({ params: roleIdParam }),
   ResMsg3("roles.success.deleted"),
   __param8(0, Params()),
-  __metadata24("design:type", Function),
-  __metadata24("design:paramtypes", [Object]),
-  __metadata24("design:returntype", Promise)
+  __metadata25("design:type", Function),
+  __metadata25("design:paramtypes", [Object]),
+  __metadata25("design:returntype", Promise)
 ], RoleController.prototype, "deleteRole", null);
-RoleController = __decorate24([
+RoleController = __decorate25([
   Controller3("/roles"),
-  __metadata24("design:paramtypes", [typeof (_a15 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a15 : Object])
+  __metadata25("design:paramtypes", [typeof (_a16 = typeof RoleService !== "undefined" && RoleService) === "function" ? _a16 : Object])
 ], RoleController);
 
 // src/users/UserController.ts
 import { Validate as Validate4 } from "najm-validation";
-var __decorate25 = function(decorators, target, key, desc) {
+var __decorate26 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata25 = function(k, v) {
+var __metadata26 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param9 = function(paramIndex, decorator) {
@@ -4413,7 +4818,7 @@ var __param9 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a16;
+var _a17;
 var UserController = class UserController2 {
   static {
     __name(this, "UserController");
@@ -4460,75 +4865,75 @@ var UserController = class UserController2 {
     return this.userService.removeRole(params.userId);
   }
 };
-__decorate25([
+__decorate26([
   Get3(),
   isAdmin(),
   Validate4({ query: userListQuery }),
   ResMsg4("users.success.retrieved"),
   __param9(0, Query()),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", [Object]),
-  __metadata25("design:returntype", Promise)
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", [Object]),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "getUsers", null);
-__decorate25([
+__decorate26([
   Get3("/lang"),
   isAuth(),
   ResMsg4("users.success.retrieved"),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", []),
-  __metadata25("design:returntype", Promise)
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", []),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "getLang", null);
-__decorate25([
+__decorate26([
   Post4("/lang/:language"),
   isAuth(),
   Validate4({ params: languageParam }),
   ResMsg4("users.success.updated"),
   __param9(0, Params2()),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", [Object]),
-  __metadata25("design:returntype", Promise)
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", [Object]),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "updateLang", null);
-__decorate25([
+__decorate26([
   Get3("/:id"),
   isAdmin(),
   Validate4({ params: userIdParam }),
   ResMsg4("users.success.retrieved"),
   __param9(0, Params2()),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", [Object]),
-  __metadata25("design:returntype", Promise)
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", [Object]),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "getUser", null);
-__decorate25([
+__decorate26([
   Get3("/email/:email"),
   isAdmin(),
   Validate4({ params: emailParam }),
   ResMsg4("users.success.retrieved"),
   __param9(0, Params2()),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", [Object]),
-  __metadata25("design:returntype", Promise)
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", [Object]),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "getByEmail", null);
-__decorate25([
+__decorate26([
   Get3("/role/:userId"),
   isAdmin(),
   Validate4({ params: userIdInParam }),
   ResMsg4("users.success.retrieved"),
   __param9(0, Params2()),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", [Object]),
-  __metadata25("design:returntype", Promise)
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", [Object]),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "getRole", null);
-__decorate25([
+__decorate26([
   Post4(),
   isAdmin(),
   Validate4(createUserDto),
-  ResMsg4("users.success.created"),
-  __param9(0, Body4()),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", [Object]),
-  __metadata25("design:returntype", Promise)
+  ResMsg4("users.success.created"),
+  __param9(0, Body4()),
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", [Object]),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "create", null);
-__decorate25([
+__decorate26([
   Put2("/:id"),
   isAdmin(),
   Validate4({
@@ -4538,51 +4943,51 @@ __decorate25([
   ResMsg4("users.success.updated"),
   __param9(0, Params2()),
   __param9(1, Body4()),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", [Object, Object]),
-  __metadata25("design:returntype", Promise)
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", [Object, Object]),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "update", null);
-__decorate25([
+__decorate26([
   Delete2("/:id"),
   isAdmin(),
   Validate4({ params: userIdParam }),
   ResMsg4("users.success.deleted"),
   __param9(0, Params2()),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", [Object]),
-  __metadata25("design:returntype", Promise)
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", [Object]),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "delete", null);
-__decorate25([
+__decorate26([
   Delete2(),
   isAdmin(),
   ResMsg4("users.success.allDeleted"),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", []),
-  __metadata25("design:returntype", Promise)
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", []),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "deleteAll", null);
-__decorate25([
+__decorate26([
   Post4("/assign/:userId/:roleId"),
   isAdmin(),
   Validate4({ params: assignRoleParams }),
   ResMsg4("users.success.updated"),
   __param9(0, Params2()),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", [Object]),
-  __metadata25("design:returntype", Promise)
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", [Object]),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "assignRole", null);
-__decorate25([
+__decorate26([
   Delete2("/remove/:userId"),
   isAdmin(),
   Validate4({ params: userIdInParam }),
   ResMsg4("users.success.updated"),
   __param9(0, Params2()),
-  __metadata25("design:type", Function),
-  __metadata25("design:paramtypes", [Object]),
-  __metadata25("design:returntype", Promise)
+  __metadata26("design:type", Function),
+  __metadata26("design:paramtypes", [Object]),
+  __metadata26("design:returntype", Promise)
 ], UserController.prototype, "removeRole", null);
-UserController = __decorate25([
+UserController = __decorate26([
   Controller4("/users"),
-  __metadata25("design:paramtypes", [typeof (_a16 = typeof UserService !== "undefined" && UserService) === "function" ? _a16 : Object])
+  __metadata26("design:paramtypes", [typeof (_a17 = typeof UserService !== "undefined" && UserService) === "function" ? _a17 : Object])
 ], UserController);
 
 // src/permissions/index.ts
@@ -4603,15 +5008,15 @@ __export(permissions_exports, {
 
 // src/permissions/PermissionRepository.ts
 import { eq as eq7, and as and4 } from "drizzle-orm";
-import { Repository as Repository6, Inject as Inject14 } from "najm-core";
+import { Repository as Repository6, Inject as Inject15 } from "najm-core";
 import { DB as DB6 } from "najm-database";
-var __decorate26 = function(decorators, target, key, desc) {
+var __decorate27 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata26 = function(k, v) {
+var __metadata27 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var PermissionRepository = class PermissionRepository2 {
@@ -4689,29 +5094,29 @@ var PermissionRepository = class PermissionRepository2 {
     return deletedPermissions;
   }
 };
-__decorate26([
+__decorate27([
   DB6(),
-  __metadata26("design:type", Object)
+  __metadata27("design:type", Object)
 ], PermissionRepository.prototype, "db", void 0);
-__decorate26([
-  Inject14(AUTH_SCHEMA),
-  __metadata26("design:type", Object)
+__decorate27([
+  Inject15(AUTH_SCHEMA),
+  __metadata27("design:type", Object)
 ], PermissionRepository.prototype, "schema", void 0);
-PermissionRepository = __decorate26([
+PermissionRepository = __decorate27([
   Repository6()
 ], PermissionRepository);
 
 // src/permissions/PermissionGuards.ts
-import { Injectable as Injectable12 } from "najm-core";
+import { Injectable as Injectable13 } from "najm-core";
 import { GuardParams as GuardParams2, User as User3 } from "najm-core";
 import { createGuard as createGuard4, composeGuards as composeGuards3 } from "najm-guard";
-var __decorate27 = function(decorators, target, key, desc) {
+var __decorate28 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata27 = function(k, v) {
+var __metadata28 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param10 = function(paramIndex, decorator) {
@@ -4747,15 +5152,15 @@ var PermissionGuard = class PermissionGuard2 {
     return false;
   }
 };
-__decorate27([
+__decorate28([
   __param10(0, GuardParams2()),
   __param10(1, User3("permissions")),
-  __metadata27("design:type", Function),
-  __metadata27("design:paramtypes", [String, Array]),
-  __metadata27("design:returntype", Object)
+  __metadata28("design:type", Function),
+  __metadata28("design:paramtypes", [String, Array]),
+  __metadata28("design:returntype", Object)
 ], PermissionGuard.prototype, "canActivate", null);
-PermissionGuard = __decorate27([
-  Injectable12()
+PermissionGuard = __decorate28([
+  Injectable13()
 ], PermissionGuard);
 var Permission = createGuard4(PermissionGuard);
 var Can = /* @__PURE__ */ __name((permission) => composeGuards3(isAuth(), Permission(permission))(), "Can");
@@ -4766,23 +5171,23 @@ import { Get as Get4, Post as Post5, Put as Put3, Delete as Delete3, ResMsg as R
 import { Params as Params3, Body as Body5 } from "najm-core";
 
 // src/permissions/PermissionService.ts
-import { Injectable as Injectable14 } from "najm-core";
+import { Injectable as Injectable15 } from "najm-core";
 
 // src/permissions/PermissionValidator.ts
-import { Injectable as Injectable13 } from "najm-core";
+import { Injectable as Injectable14 } from "najm-core";
 import { I18n as I18n9 } from "najm-i18n";
 import { Err as Err14 } from "najm-core";
-var __decorate28 = function(decorators, target, key, desc) {
+var __decorate29 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata28 = function(k, v) {
+var __metadata29 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a17;
-var _b10;
+var _a18;
+var _b11;
 var PermissionValidator = class PermissionValidator2 {
   static {
     __name(this, "PermissionValidator");
@@ -4849,28 +5254,30 @@ var PermissionValidator = class PermissionValidator2 {
     }
   }
 };
-__decorate28([
+__decorate29([
   I18n9("permissions"),
-  __metadata28("design:type", Object)
+  __metadata29("design:type", Object)
 ], PermissionValidator.prototype, "t", void 0);
-PermissionValidator = __decorate28([
-  Injectable13(),
-  __metadata28("design:paramtypes", [typeof (_a17 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a17 : Object, typeof (_b10 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b10 : Object])
+PermissionValidator = __decorate29([
+  Injectable14(),
+  __metadata29("design:paramtypes", [typeof (_a18 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a18 : Object, typeof (_b11 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b11 : Object])
 ], PermissionValidator);
 
 // src/permissions/PermissionService.ts
-var __decorate29 = function(decorators, target, key, desc) {
+var __decorate30 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata29 = function(k, v) {
+var __metadata30 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a18;
-var _b11;
+var _a19;
+var _b12;
 var _c8;
+var _d7;
+var _e6;
 var PermissionService = class PermissionService2 {
   static {
     __name(this, "PermissionService");
@@ -4878,10 +5285,30 @@ var PermissionService = class PermissionService2 {
   permissionRepository;
   permissionValidator;
   roleService;
-  constructor(permissionRepository, permissionValidator, roleService) {
+  userRepository;
+  sessionInvalidation;
+  constructor(permissionRepository, permissionValidator, roleService, userRepository, sessionInvalidation) {
     this.permissionRepository = permissionRepository;
     this.permissionValidator = permissionValidator;
     this.roleService = roleService;
+    this.userRepository = userRepository;
+    this.sessionInvalidation = sessionInvalidation;
+  }
+  /**
+   * End the sessions of everyone holding a role whose permission set changed.
+   *
+   * Access tokens and signed session snapshots both carry permissions as
+   * claims, so a permission removed from a role stays exercisable until the
+   * sessions that captured it end. This is an infrequent administrative
+   * action, and the work is proportional to the role's membership.
+   */
+  async invalidateRoleHolders(roleId) {
+    if (!this.userRepository || !this.sessionInvalidation)
+      return;
+    const userIds = await this.userRepository.getIdsByRole(roleId);
+    for (const userId of userIds) {
+      await this.sessionInvalidation.invalidateAccessTokens(userId);
+    }
   }
   async getAll() {
     return await this.permissionRepository.getAll();
@@ -4918,10 +5345,14 @@ var PermissionService = class PermissionService2 {
   }
   async assignPermissionToRole(roleId, permissionId) {
     await this.permissionValidator.checkRoleHasPermission(roleId, permissionId);
-    return await this.permissionRepository.assignPermissionToRole(roleId, permissionId);
+    const assigned = await this.permissionRepository.assignPermissionToRole(roleId, permissionId);
+    await this.invalidateRoleHolders(roleId);
+    return assigned;
   }
   async removePermissionFromRole(roleId, permissionId) {
-    return await this.permissionRepository.removePermissionFromRole(roleId, permissionId);
+    const removed = await this.permissionRepository.removePermissionFromRole(roleId, permissionId);
+    await this.invalidateRoleHolders(roleId);
+    return removed;
   }
   async seedDefaultPermissions(defaultPermissions) {
     const created = [];
@@ -4975,9 +5406,9 @@ var PermissionService = class PermissionService2 {
     return await this.permissionRepository.deleteAll();
   }
 };
-PermissionService = __decorate29([
-  Injectable14(),
-  __metadata29("design:paramtypes", [typeof (_a18 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a18 : Object, typeof (_b11 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b11 : Object, typeof (_c8 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c8 : Object])
+PermissionService = __decorate30([
+  Injectable15(),
+  __metadata30("design:paramtypes", [typeof (_a19 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a19 : Object, typeof (_b12 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b12 : Object, typeof (_c8 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c8 : Object, typeof (_d7 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _d7 : Object, typeof (_e6 = typeof SessionInvalidationService !== "undefined" && SessionInvalidationService) === "function" ? _e6 : Object])
 ], PermissionService);
 
 // src/permissions/PermissionController.ts
@@ -5010,13 +5441,13 @@ var checkPermissionDto = z3.object({
 });
 
 // src/permissions/PermissionController.ts
-var __decorate30 = function(decorators, target, key, desc) {
+var __decorate31 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata30 = function(k, v) {
+var __metadata31 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param11 = function(paramIndex, decorator) {
@@ -5024,7 +5455,7 @@ var __param11 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a19;
+var _a20;
 var PermissionController = class PermissionController2 {
   static {
     __name(this, "PermissionController");
@@ -5070,32 +5501,32 @@ var PermissionController = class PermissionController2 {
     return this.permissionService.deleteAll();
   }
 };
-__decorate30([
+__decorate31([
   Get4(),
   ResMsg5("permissions.success.retrieved"),
-  __metadata30("design:type", Function),
-  __metadata30("design:paramtypes", []),
-  __metadata30("design:returntype", Promise)
+  __metadata31("design:type", Function),
+  __metadata31("design:paramtypes", []),
+  __metadata31("design:returntype", Promise)
 ], PermissionController.prototype, "getPermissions", null);
-__decorate30([
+__decorate31([
   Get4("/:id"),
   Validate5({ params: permissionIdParam }),
   ResMsg5("permissions.success.retrieved"),
   __param11(0, Params3()),
-  __metadata30("design:type", Function),
-  __metadata30("design:paramtypes", [Object]),
-  __metadata30("design:returntype", Promise)
+  __metadata31("design:type", Function),
+  __metadata31("design:paramtypes", [Object]),
+  __metadata31("design:returntype", Promise)
 ], PermissionController.prototype, "getPermission", null);
-__decorate30([
+__decorate31([
   Post5(),
   Validate5(createPermissionDto),
   ResMsg5({ message: "Permission created successfully", status: 201 }),
   __param11(0, Body5()),
-  __metadata30("design:type", Function),
-  __metadata30("design:paramtypes", [Object]),
-  __metadata30("design:returntype", Promise)
+  __metadata31("design:type", Function),
+  __metadata31("design:paramtypes", [Object]),
+  __metadata31("design:returntype", Promise)
 ], PermissionController.prototype, "create", null);
-__decorate30([
+__decorate31([
   Put3("/:id"),
   Validate5({
     params: permissionIdParam,
@@ -5104,72 +5535,73 @@ __decorate30([
   ResMsg5("permissions.success.updated"),
   __param11(0, Params3()),
   __param11(1, Body5()),
-  __metadata30("design:type", Function),
-  __metadata30("design:paramtypes", [Object, Object]),
-  __metadata30("design:returntype", Promise)
+  __metadata31("design:type", Function),
+  __metadata31("design:paramtypes", [Object, Object]),
+  __metadata31("design:returntype", Promise)
 ], PermissionController.prototype, "update", null);
-__decorate30([
+__decorate31([
   Delete3("/:id"),
   Validate5({ params: permissionIdParam }),
   ResMsg5("permissions.success.deleted"),
   __param11(0, Params3()),
-  __metadata30("design:type", Function),
-  __metadata30("design:paramtypes", [Object]),
-  __metadata30("design:returntype", Promise)
+  __metadata31("design:type", Function),
+  __metadata31("design:paramtypes", [Object]),
+  __metadata31("design:returntype", Promise)
 ], PermissionController.prototype, "delete", null);
-__decorate30([
+__decorate31([
   Get4("/role/:id"),
   Validate5({ params: roleIdParam }),
   ResMsg5("permissions.success.retrieved"),
   __param11(0, Params3()),
-  __metadata30("design:type", Function),
-  __metadata30("design:paramtypes", [Object]),
-  __metadata30("design:returntype", Promise)
+  __metadata31("design:type", Function),
+  __metadata31("design:paramtypes", [Object]),
+  __metadata31("design:returntype", Promise)
 ], PermissionController.prototype, "getByRole", null);
-__decorate30([
+__decorate31([
   Get4("/roles/:id"),
   Validate5({ params: permissionIdParam }),
   ResMsg5("permissions.success.retrieved"),
   __param11(0, Params3()),
-  __metadata30("design:type", Function),
-  __metadata30("design:paramtypes", [Object]),
-  __metadata30("design:returntype", Promise)
+  __metadata31("design:type", Function),
+  __metadata31("design:paramtypes", [Object]),
+  __metadata31("design:returntype", Promise)
 ], PermissionController.prototype, "getRolesByPermission", null);
-__decorate30([
+__decorate31([
   Post5("/assign/:roleId/:permissionId"),
   Validate5({ params: assignPermissionDto }),
   ResMsg5("permissions.success.assigned"),
   __param11(0, Params3()),
-  __metadata30("design:type", Function),
-  __metadata30("design:paramtypes", [Object]),
-  __metadata30("design:returntype", Promise)
+  __metadata31("design:type", Function),
+  __metadata31("design:paramtypes", [Object]),
+  __metadata31("design:returntype", Promise)
 ], PermissionController.prototype, "assignToRole", null);
-__decorate30([
+__decorate31([
   Delete3("/remove/:roleId/:permissionId"),
   Validate5({ params: assignPermissionDto }),
   ResMsg5("permissions.success.removed"),
   __param11(0, Params3()),
-  __metadata30("design:type", Function),
-  __metadata30("design:paramtypes", [Object]),
-  __metadata30("design:returntype", Promise)
+  __metadata31("design:type", Function),
+  __metadata31("design:paramtypes", [Object]),
+  __metadata31("design:returntype", Promise)
 ], PermissionController.prototype, "removeFromRole", null);
-__decorate30([
+__decorate31([
   Delete3(),
   isAdmin(),
   ResMsg5("permissions.success.allDeleted"),
-  __metadata30("design:type", Function),
-  __metadata30("design:paramtypes", []),
-  __metadata30("design:returntype", Promise)
+  __metadata31("design:type", Function),
+  __metadata31("design:paramtypes", []),
+  __metadata31("design:returntype", Promise)
 ], PermissionController.prototype, "deleteAll", null);
-PermissionController = __decorate30([
+PermissionController = __decorate31([
   Controller5("/permissions"),
   isAdmin(),
-  __metadata30("design:paramtypes", [typeof (_a19 = typeof PermissionService !== "undefined" && PermissionService) === "function" ? _a19 : Object])
+  __metadata31("design:paramtypes", [typeof (_a20 = typeof PermissionService !== "undefined" && PermissionService) === "function" ? _a20 : Object])
 ], PermissionController);
 
 // src/tokens/index.ts
 var tokens_exports = {};
 __export(tokens_exports, {
+  SessionInvalidationService: () => SessionInvalidationService,
   TokenRepository: () => TokenRepository,
   TokenService: () => TokenService,
   createTokenDto: () => createTokenDto,
@@ -5371,15 +5803,15 @@ function own(table, opts) {
 __name(own, "own");
 
 // src/ownership/configureOwnership.ts
-import { Injectable as Injectable15, Inject as Inject15, User as User4, Body as Body6, Params as Params4 } from "najm-core";
+import { Injectable as Injectable16, Inject as Inject16, User as User4, Body as Body6, Params as Params4 } from "najm-core";
 import { createGuard as createGuard5, composeGuards as composeGuards4 } from "najm-guard";
-var __decorate31 = function(decorators, target, key, desc) {
+var __decorate32 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata31 = function(k, v) {
+var __metadata32 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param12 = function(paramIndex, decorator) {
@@ -5399,7 +5831,7 @@ function toSingular(plural) {
 }
 __name(toSingular, "toSingular");
 function createResourceGuards(ownershipClass, resourceType, resource, options) {
-  var _a28, _b15;
+  var _a29, _b16;
   const writeGuard = options?.adminGuard ?? isAdmin;
   let AccessGuard = class AccessGuard {
     static {
@@ -5411,19 +5843,19 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
       return allowed ? { owner: user } : false;
     }
   };
-  __decorate31([
-    Inject15(ownershipClass),
-    __metadata31("design:type", Object)
+  __decorate32([
+    Inject16(ownershipClass),
+    __metadata32("design:type", Object)
   ], AccessGuard.prototype, "ownership", void 0);
-  __decorate31([
+  __decorate32([
     __param12(0, User4()),
     __param12(1, Params4("id")),
-    __metadata31("design:type", Function),
-    __metadata31("design:paramtypes", [Object, String]),
-    __metadata31("design:returntype", typeof (_a28 = typeof Promise !== "undefined" && Promise) === "function" ? _a28 : Object)
+    __metadata32("design:type", Function),
+    __metadata32("design:paramtypes", [Object, String]),
+    __metadata32("design:returntype", typeof (_a29 = typeof Promise !== "undefined" && Promise) === "function" ? _a29 : Object)
   ], AccessGuard.prototype, "canActivate", null);
-  AccessGuard = __decorate31([
-    Injectable15()
+  AccessGuard = __decorate32([
+    Injectable16()
   ], AccessGuard);
   let ListGuard = class ListGuard {
     static {
@@ -5435,18 +5867,18 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
       return { filter: ids };
     }
   };
-  __decorate31([
-    Inject15(ownershipClass),
-    __metadata31("design:type", Object)
+  __decorate32([
+    Inject16(ownershipClass),
+    __metadata32("design:type", Object)
   ], ListGuard.prototype, "ownership", void 0);
-  __decorate31([
+  __decorate32([
     __param12(0, User4()),
-    __metadata31("design:type", Function),
-    __metadata31("design:paramtypes", [Object]),
-    __metadata31("design:returntype", typeof (_b15 = typeof Promise !== "undefined" && Promise) === "function" ? _b15 : Object)
+    __metadata32("design:type", Function),
+    __metadata32("design:paramtypes", [Object]),
+    __metadata32("design:returntype", typeof (_b16 = typeof Promise !== "undefined" && Promise) === "function" ? _b16 : Object)
   ], ListGuard.prototype, "canActivate", null);
-  ListGuard = __decorate31([
-    Injectable15()
+  ListGuard = __decorate32([
+    Injectable16()
   ], ListGuard);
   const access = createGuard5(AccessGuard);
   const list = createGuard5(ListGuard);
@@ -5577,11 +6009,11 @@ function configureOwnership(config) {
       }
     }
   };
-  GeneratedOwnershipService = __decorate31([
-    Injectable15()
+  GeneratedOwnershipService = __decorate32([
+    Injectable16()
   ], GeneratedOwnershipService);
   function bodyGuard(resourceType, bodyField, optional = false) {
-    var _a28;
+    var _a29;
     let BodyAccessGuard = class BodyAccessGuard {
       static {
         __name(this, "BodyAccessGuard");
@@ -5594,19 +6026,19 @@ function configureOwnership(config) {
         return this.ownership.canAccess(user, resourceType, id);
       }
     };
-    __decorate31([
-      Inject15(GeneratedOwnershipService),
-      __metadata31("design:type", GeneratedOwnershipService)
+    __decorate32([
+      Inject16(GeneratedOwnershipService),
+      __metadata32("design:type", GeneratedOwnershipService)
     ], BodyAccessGuard.prototype, "ownership", void 0);
-    __decorate31([
+    __decorate32([
       __param12(0, User4()),
       __param12(1, Body6()),
-      __metadata31("design:type", Function),
-      __metadata31("design:paramtypes", [Object, Object]),
-      __metadata31("design:returntype", typeof (_a28 = typeof Promise !== "undefined" && Promise) === "function" ? _a28 : Object)
+      __metadata32("design:type", Function),
+      __metadata32("design:paramtypes", [Object, Object]),
+      __metadata32("design:returntype", typeof (_a29 = typeof Promise !== "undefined" && Promise) === "function" ? _a29 : Object)
     ], BodyAccessGuard.prototype, "canActivate", null);
-    BodyAccessGuard = __decorate31([
-      Injectable15()
+    BodyAccessGuard = __decorate32([
+      Injectable16()
     ], BodyAccessGuard);
     return createGuard5(BodyAccessGuard);
   }
@@ -5721,18 +6153,18 @@ __name(Policy, "Policy");
 // src/ownership/OwnedDecorator.ts
 import "reflect-metadata";
 import { sql as sql5, and as and5 } from "drizzle-orm";
-import { Injectable as Injectable16, Inject as Inject16, DI as DI3, Container as Container2, REQUEST_ID } from "najm-core";
+import { Injectable as Injectable17, Inject as Inject17, DI as DI3, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
-var __decorate32 = function(decorators, target, key, desc) {
+var __decorate33 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata32 = function(k, v) {
+var __metadata33 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a20;
+var _a21;
 var OWNED_META = Symbol.for("najm:owned");
 var ScopeContext = class ScopeContext2 {
   static {
@@ -5764,18 +6196,18 @@ var ScopeContext = class ScopeContext2 {
     }
   }
 };
-__decorate32([
+__decorate33([
   DI3(),
-  __metadata32("design:type", typeof (_a20 = typeof Container2 !== "undefined" && Container2) === "function" ? _a20 : Object)
+  __metadata33("design:type", typeof (_a21 = typeof Container2 !== "undefined" && Container2) === "function" ? _a21 : Object)
 ], ScopeContext.prototype, "container", void 0);
-ScopeContext = __decorate32([
-  Injectable16()
+ScopeContext = __decorate33([
+  Injectable17()
 ], ScopeContext);
 function Owned(token) {
   return function(target) {
     Reflect.defineMetadata(OWNED_META, token, target);
     const proto = target.prototype;
-    Inject16(ScopeContext)(proto, "_scopeCtx");
+    Inject17(ScopeContext)(proto, "_scopeCtx");
     function getUser(self) {
       return self._scopeCtx?.getUser() ?? null;
     }
@@ -5985,7 +6417,7 @@ __name(getAuthLocale, "getAuthLocale");
 var AUTH_SUPPORTED_LANGUAGES = Object.keys(AUTH_LOCALES);
 
 // src/oauth/google/GoogleOAuthProvider.ts
-import { Inject as Inject18, Injectable as Injectable18 } from "najm-core";
+import { Inject as Inject19, Injectable as Injectable19 } from "najm-core";
 
 // src/oauth/types.ts
 var OAuthFlowError = class extends Error {
@@ -6003,15 +6435,15 @@ var OAuthFlowError = class extends Error {
 };
 
 // src/oauth/google/GoogleTokenVerifier.ts
-import { Inject as Inject17, Injectable as Injectable17 } from "najm-core";
+import { Inject as Inject18, Injectable as Injectable18 } from "najm-core";
 import { createRemoteJWKSet, jwtVerify } from "jose";
-var __decorate33 = function(decorators, target, key, desc) {
+var __decorate34 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata33 = function(k, v) {
+var __metadata34 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var GOOGLE_JWKS = createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs"));
@@ -6063,25 +6495,25 @@ var GoogleTokenVerifier = class GoogleTokenVerifier2 {
     return google;
   }
 };
-__decorate33([
-  Inject17(AUTH_CONFIG),
-  __metadata33("design:type", Object)
+__decorate34([
+  Inject18(AUTH_CONFIG),
+  __metadata34("design:type", Object)
 ], GoogleTokenVerifier.prototype, "config", void 0);
-GoogleTokenVerifier = __decorate33([
-  Injectable17()
+GoogleTokenVerifier = __decorate34([
+  Injectable18()
 ], GoogleTokenVerifier);
 
 // src/oauth/google/GoogleOAuthProvider.ts
-var __decorate34 = function(decorators, target, key, desc) {
+var __decorate35 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata34 = function(k, v) {
+var __metadata35 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a21;
+var _a22;
 var AUTHORIZATION_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
 var TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
 var GoogleOAuthProvider = class GoogleOAuthProvider2 {
@@ -6149,24 +6581,24 @@ var GoogleOAuthProvider = class GoogleOAuthProvider2 {
     return google;
   }
 };
-__decorate34([
-  Inject18(AUTH_CONFIG),
-  __metadata34("design:type", Object)
+__decorate35([
+  Inject19(AUTH_CONFIG),
+  __metadata35("design:type", Object)
 ], GoogleOAuthProvider.prototype, "config", void 0);
-GoogleOAuthProvider = __decorate34([
-  Injectable18(),
-  __metadata34("design:paramtypes", [typeof (_a21 = typeof GoogleTokenVerifier !== "undefined" && GoogleTokenVerifier) === "function" ? _a21 : Object])
+GoogleOAuthProvider = __decorate35([
+  Injectable19(),
+  __metadata35("design:paramtypes", [typeof (_a22 = typeof GoogleTokenVerifier !== "undefined" && GoogleTokenVerifier) === "function" ? _a22 : Object])
 ], GoogleOAuthProvider);
 
 // src/oauth/github/GitHubOAuthProvider.ts
-import { Inject as Inject19, Injectable as Injectable19 } from "najm-core";
-var __decorate35 = function(decorators, target, key, desc) {
+import { Inject as Inject20, Injectable as Injectable20 } from "najm-core";
+var __decorate36 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata35 = function(k, v) {
+var __metadata36 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var AUTHORIZATION_ENDPOINT2 = "https://github.com/login/oauth/authorize";
@@ -6282,12 +6714,12 @@ var GitHubOAuthProvider = class GitHubOAuthProvider2 {
     return github;
   }
 };
-__decorate35([
-  Inject19(AUTH_CONFIG),
-  __metadata35("design:type", Object)
+__decorate36([
+  Inject20(AUTH_CONFIG),
+  __metadata36("design:type", Object)
 ], GitHubOAuthProvider.prototype, "config", void 0);
-GitHubOAuthProvider = __decorate35([
-  Injectable19()
+GitHubOAuthProvider = __decorate36([
+  Injectable20()
 ], GitHubOAuthProvider);
 
 // src/oauth/GitHubOAuthController.ts
@@ -6296,24 +6728,24 @@ import { Controller as Controller6, Ctx as Ctx2, Get as Get5, Post as Post6, Que
 import { RateLimit as RateLimit3 } from "najm-rate";
 
 // src/oauth/OAuthService.ts
-import { Inject as Inject22, Injectable as Injectable22, Log as Log2 } from "najm-core";
+import { Err as Err15, Inject as Inject23, Injectable as Injectable23, Log as Log2 } from "najm-core";
 
 // src/oauth/OAuthAccountService.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { Inject as Inject21, Injectable as Injectable20 } from "najm-core";
+import { Inject as Inject22, Injectable as Injectable21 } from "najm-core";
 import { Transaction as Transaction5 } from "najm-database";
 
 // src/oauth/OAuthAccountRepository.ts
 import { and as and6, eq as eq9 } from "drizzle-orm";
-import { Inject as Inject20, Repository as Repository7 } from "najm-core";
+import { Inject as Inject21, Repository as Repository7 } from "najm-core";
 import { DB as DB7 } from "najm-database";
-var __decorate36 = function(decorators, target, key, desc) {
+var __decorate37 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata36 = function(k, v) {
+var __metadata37 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var OAuthAccountRepository = class OAuthAccountRepository2 {
@@ -6341,32 +6773,32 @@ var OAuthAccountRepository = class OAuthAccountRepository2 {
     return account;
   }
 };
-__decorate36([
+__decorate37([
   DB7(),
-  __metadata36("design:type", Object)
+  __metadata37("design:type", Object)
 ], OAuthAccountRepository.prototype, "db", void 0);
-__decorate36([
-  Inject20(AUTH_SCHEMA),
-  __metadata36("design:type", Object)
+__decorate37([
+  Inject21(AUTH_SCHEMA),
+  __metadata37("design:type", Object)
 ], OAuthAccountRepository.prototype, "schema", void 0);
-OAuthAccountRepository = __decorate36([
+OAuthAccountRepository = __decorate37([
   Repository7()
 ], OAuthAccountRepository);
 
 // src/oauth/OAuthAccountService.ts
-var __decorate37 = function(decorators, target, key, desc) {
+var __decorate38 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata37 = function(k, v) {
+var __metadata38 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a22;
-var _b12;
+var _a23;
+var _b13;
 var _c9;
-var _d7;
+var _d8;
 var OAuthAccountService = class OAuthAccountService2 {
   static {
     __name(this, "OAuthAccountService");
@@ -6442,42 +6874,42 @@ var OAuthAccountService = class OAuthAccountService2 {
     return providerConfig;
   }
 };
-__decorate37([
-  Inject21(AUTH_CONFIG),
-  __metadata37("design:type", Object)
+__decorate38([
+  Inject22(AUTH_CONFIG),
+  __metadata38("design:type", Object)
 ], OAuthAccountService.prototype, "config", void 0);
-__decorate37([
+__decorate38([
   Transaction5(),
-  __metadata37("design:type", Function),
-  __metadata37("design:paramtypes", [Object]),
-  __metadata37("design:returntype", typeof (_c9 = typeof Promise !== "undefined" && Promise) === "function" ? _c9 : Object)
+  __metadata38("design:type", Function),
+  __metadata38("design:paramtypes", [Object]),
+  __metadata38("design:returntype", typeof (_c9 = typeof Promise !== "undefined" && Promise) === "function" ? _c9 : Object)
 ], OAuthAccountService.prototype, "resolveForLogin", null);
-__decorate37([
+__decorate38([
   Transaction5(),
-  __metadata37("design:type", Function),
-  __metadata37("design:paramtypes", [String, Object]),
-  __metadata37("design:returntype", typeof (_d7 = typeof Promise !== "undefined" && Promise) === "function" ? _d7 : Object)
+  __metadata38("design:type", Function),
+  __metadata38("design:paramtypes", [String, Object]),
+  __metadata38("design:returntype", typeof (_d8 = typeof Promise !== "undefined" && Promise) === "function" ? _d8 : Object)
 ], OAuthAccountService.prototype, "linkUser", null);
-OAuthAccountService = __decorate37([
-  Injectable20(),
-  __metadata37("design:paramtypes", [typeof (_a22 = typeof OAuthAccountRepository !== "undefined" && OAuthAccountRepository) === "function" ? _a22 : Object, typeof (_b12 = typeof UserService !== "undefined" && UserService) === "function" ? _b12 : Object])
+OAuthAccountService = __decorate38([
+  Injectable21(),
+  __metadata38("design:paramtypes", [typeof (_a23 = typeof OAuthAccountRepository !== "undefined" && OAuthAccountRepository) === "function" ? _a23 : Object, typeof (_b13 = typeof UserService !== "undefined" && UserService) === "function" ? _b13 : Object])
 ], OAuthAccountService);
 
 // src/oauth/OAuthStateService.ts
 import { createHash as createHash4, randomBytes as randomBytes4, timingSafeEqual } from "crypto";
-import { Injectable as Injectable21 } from "najm-core";
+import { Injectable as Injectable22 } from "najm-core";
 import { CookieService as CookieService3 } from "najm-cookies";
-var __decorate38 = function(decorators, target, key, desc) {
+var __decorate39 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata38 = function(k, v) {
+var __metadata39 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a23;
-var _b13;
+var _a24;
+var _b14;
 var ATTEMPT_TTL_MS = 10 * 60 * 1e3;
 var COOKIE_PREFIX = "najm.oauth.";
 var OAuthStateService = class OAuthStateService2 {
@@ -6566,26 +6998,26 @@ var OAuthStateService = class OAuthStateService2 {
     return /^[A-Za-z0-9_-]{40,128}$/.test(state);
   }
 };
-OAuthStateService = __decorate38([
-  Injectable21(),
-  __metadata38("design:paramtypes", [typeof (_a23 = typeof CookieService3 !== "undefined" && CookieService3) === "function" ? _a23 : Object, typeof (_b13 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b13 : Object])
+OAuthStateService = __decorate39([
+  Injectable22(),
+  __metadata39("design:paramtypes", [typeof (_a24 = typeof CookieService3 !== "undefined" && CookieService3) === "function" ? _a24 : Object, typeof (_b14 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b14 : Object])
 ], OAuthStateService);
 
 // src/oauth/OAuthService.ts
-var __decorate39 = function(decorators, target, key, desc) {
+var __decorate40 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata39 = function(k, v) {
+var __metadata40 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a24;
-var _b14;
+var _a25;
+var _b15;
 var _c10;
-var _d8;
-var _e5;
+var _d9;
+var _e7;
 var _f5;
 var _g4;
 var _h3;
@@ -6631,16 +7063,47 @@ var OAuthService = class OAuthService2 {
   finishGitHubCallback(params) {
     return this.finishCallback("github", params);
   }
+  /**
+   * Turn an expected OAuth start failure into the HTTP response it describes.
+   *
+   * `OAuthFlowError` carries the status it means — 404 for a provider that is
+   * not configured, 400 for a return path the caller chose badly — but it is a
+   * plain Error, so the framework's handler could only classify it as an
+   * unhandled 500. A disabled provider and a bad query string are ordinary
+   * client-visible outcomes, and reporting them as server faults hides real
+   * ones. Only the stable `oauth_*` code crosses the boundary; provider
+   * secrets, state, and codes never appear in it.
+   *
+   * The callback path deliberately does not go through here: it answers with a
+   * redirect carrying the same code, and that contract is unchanged.
+   */
+  failStart(error) {
+    if (error instanceof OAuthFlowError) {
+      Err15(error.oauthCode, error.status);
+    }
+    throw error;
+  }
   startLogin(provider, returnTo) {
-    this.providerConfig(provider);
-    const { attempt, codeChallenge } = this.state.create({
-      provider,
-      intent: "login",
-      returnTo
-    });
-    return this.provider(provider).authorizationUrl(attempt, codeChallenge);
+    try {
+      this.providerConfig(provider);
+      const { attempt, codeChallenge } = this.state.create({
+        provider,
+        intent: "login",
+        returnTo
+      });
+      return this.provider(provider).authorizationUrl(attempt, codeChallenge);
+    } catch (error) {
+      this.failStart(error);
+    }
   }
   async startLink(provider, userId, returnTo) {
+    try {
+      return await this.buildLinkStart(provider, userId, returnTo);
+    } catch (error) {
+      this.failStart(error);
+    }
+  }
+  async buildLinkStart(provider, userId, returnTo) {
     this.providerConfig(provider);
     const user = await this.users.getById(userId);
     if (user.status !== "active")
@@ -6722,27 +7185,27 @@ var OAuthService = class OAuthService2 {
     return providerConfig;
   }
 };
-__decorate39([
-  Inject22(AUTH_CONFIG),
-  __metadata39("design:type", Object)
+__decorate40([
+  Inject23(AUTH_CONFIG),
+  __metadata40("design:type", Object)
 ], OAuthService.prototype, "config", void 0);
-__decorate39([
+__decorate40([
   Log2(),
-  __metadata39("design:type", Object)
+  __metadata40("design:type", Object)
 ], OAuthService.prototype, "logger", void 0);
-OAuthService = __decorate39([
-  Injectable22(),
-  __metadata39("design:paramtypes", [typeof (_a24 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a24 : Object, typeof (_b14 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b14 : Object, typeof (_c10 = typeof GitHubOAuthProvider !== "undefined" && GitHubOAuthProvider) === "function" ? _c10 : Object, typeof (_d8 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _d8 : Object, typeof (_e5 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _e5 : Object, typeof (_f5 = typeof TokenService !== "undefined" && TokenService) === "function" ? _f5 : Object, typeof (_g4 = typeof UserService !== "undefined" && UserService) === "function" ? _g4 : Object, typeof (_h3 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _h3 : Object])
+OAuthService = __decorate40([
+  Injectable23(),
+  __metadata40("design:paramtypes", [typeof (_a25 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a25 : Object, typeof (_b15 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b15 : Object, typeof (_c10 = typeof GitHubOAuthProvider !== "undefined" && GitHubOAuthProvider) === "function" ? _c10 : Object, typeof (_d9 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _d9 : Object, typeof (_e7 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _e7 : Object, typeof (_f5 = typeof TokenService !== "undefined" && TokenService) === "function" ? _f5 : Object, typeof (_g4 = typeof UserService !== "undefined" && UserService) === "function" ? _g4 : Object, typeof (_h3 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _h3 : Object])
 ], OAuthService);
 
 // src/oauth/GitHubOAuthController.ts
-var __decorate40 = function(decorators, target, key, desc) {
+var __decorate41 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata40 = function(k, v) {
+var __metadata41 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param13 = function(paramIndex, decorator) {
@@ -6750,7 +7213,7 @@ var __param13 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a25;
+var _a26;
 var callbackKey = /* @__PURE__ */ __name((ctx, { clientIp }) => {
   const state = ctx.req.query("state") ?? "none";
   const fingerprint = createHash5("sha256").update(state).digest("base64url").slice(0, 24);
@@ -6775,52 +7238,52 @@ var GitHubOAuthController = class GitHubOAuthController2 {
     return this.oauth.startGitHubLink(userId, returnTo);
   }
 };
-__decorate40([
+__decorate41([
   Get5("/start"),
   RateLimit3({ limit: 20, window: "15m", key: "ip" }),
   __param13(0, Ctx2()),
   __param13(1, Query2("returnTo")),
-  __metadata40("design:type", Function),
-  __metadata40("design:paramtypes", [Object, String]),
-  __metadata40("design:returntype", void 0)
+  __metadata41("design:type", Function),
+  __metadata41("design:paramtypes", [Object, String]),
+  __metadata41("design:returntype", void 0)
 ], GitHubOAuthController.prototype, "start", null);
-__decorate40([
+__decorate41([
   Get5("/callback"),
   RateLimit3({ limit: 20, window: "15m", key: callbackKey }),
   __param13(0, Ctx2()),
   __param13(1, Query2("code")),
   __param13(2, Query2("state")),
   __param13(3, Query2("error")),
-  __metadata40("design:type", Function),
-  __metadata40("design:paramtypes", [Object, String, String, String]),
-  __metadata40("design:returntype", Promise)
+  __metadata41("design:type", Function),
+  __metadata41("design:paramtypes", [Object, String, String, String]),
+  __metadata41("design:returntype", Promise)
 ], GitHubOAuthController.prototype, "callback", null);
-__decorate40([
+__decorate41([
   Post6("/link"),
   isAuth(),
   RateLimit3({ limit: 10, window: "15m", key: "user" }),
   __param13(0, User5("id")),
   __param13(1, Query2("returnTo")),
-  __metadata40("design:type", Function),
-  __metadata40("design:paramtypes", [String, String]),
-  __metadata40("design:returntype", void 0)
+  __metadata41("design:type", Function),
+  __metadata41("design:paramtypes", [String, String]),
+  __metadata41("design:returntype", void 0)
 ], GitHubOAuthController.prototype, "link", null);
-GitHubOAuthController = __decorate40([
+GitHubOAuthController = __decorate41([
   Controller6("/auth/oauth/github"),
-  __metadata40("design:paramtypes", [typeof (_a25 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a25 : Object])
+  __metadata41("design:paramtypes", [typeof (_a26 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a26 : Object])
 ], GitHubOAuthController);
 
 // src/oauth/OAuthController.ts
 import { createHash as createHash6 } from "crypto";
 import { Controller as Controller7, Ctx as Ctx3, Get as Get6, Post as Post7, Query as Query3, User as User6 } from "najm-core";
 import { RateLimit as RateLimit4 } from "najm-rate";
-var __decorate41 = function(decorators, target, key, desc) {
+var __decorate42 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata41 = function(k, v) {
+var __metadata42 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param14 = function(paramIndex, decorator) {
@@ -6828,7 +7291,7 @@ var __param14 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a26;
+var _a27;
 var callbackKey2 = /* @__PURE__ */ __name((ctx, { clientIp }) => {
   const ip = clientIp;
   const state = ctx.req.query("state") ?? "none";
@@ -6854,39 +7317,39 @@ var OAuthController = class OAuthController2 {
     return this.oauth.startGoogleLink(userId, returnTo);
   }
 };
-__decorate41([
+__decorate42([
   Get6("/start"),
   RateLimit4({ limit: 20, window: "15m", key: "ip" }),
   __param14(0, Ctx3()),
   __param14(1, Query3("returnTo")),
-  __metadata41("design:type", Function),
-  __metadata41("design:paramtypes", [Object, String]),
-  __metadata41("design:returntype", void 0)
+  __metadata42("design:type", Function),
+  __metadata42("design:paramtypes", [Object, String]),
+  __metadata42("design:returntype", void 0)
 ], OAuthController.prototype, "start", null);
-__decorate41([
+__decorate42([
   Get6("/callback"),
   RateLimit4({ limit: 20, window: "15m", key: callbackKey2 }),
   __param14(0, Ctx3()),
   __param14(1, Query3("code")),
   __param14(2, Query3("state")),
   __param14(3, Query3("error")),
-  __metadata41("design:type", Function),
-  __metadata41("design:paramtypes", [Object, String, String, String]),
-  __metadata41("design:returntype", Promise)
+  __metadata42("design:type", Function),
+  __metadata42("design:paramtypes", [Object, String, String, String]),
+  __metadata42("design:returntype", Promise)
 ], OAuthController.prototype, "callback", null);
-__decorate41([
+__decorate42([
   Post7("/link"),
   isAuth(),
   RateLimit4({ limit: 10, window: "15m", key: "user" }),
   __param14(0, User6("id")),
   __param14(1, Query3("returnTo")),
-  __metadata41("design:type", Function),
-  __metadata41("design:paramtypes", [String, String]),
-  __metadata41("design:returntype", void 0)
+  __metadata42("design:type", Function),
+  __metadata42("design:paramtypes", [String, String]),
+  __metadata42("design:returntype", void 0)
 ], OAuthController.prototype, "link", null);
-OAuthController = __decorate41([
+OAuthController = __decorate42([
   Controller7("/auth/oauth/google"),
-  __metadata41("design:paramtypes", [typeof (_a26 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a26 : Object])
+  __metadata42("design:paramtypes", [typeof (_a27 = typeof OAuthService !== "undefined" && OAuthService) === "function" ? _a27 : Object])
 ], OAuthController);
 
 // src/oauth/index.ts
@@ -6915,13 +7378,13 @@ var credentialSetupChangeDto = z5.object({
 });
 
 // src/credentialSetup/CredentialSetupController.ts
-var __decorate42 = function(decorators, target, key, desc) {
+var __decorate43 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata42 = function(k, v) {
+var __metadata43 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param15 = function(paramIndex, decorator) {
@@ -6929,7 +7392,7 @@ var __param15 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a27;
+var _a28;
 var CredentialSetupController = class CredentialSetupController2 {
   static {
     __name(this, "CredentialSetupController");
@@ -6948,35 +7411,35 @@ var CredentialSetupController = class CredentialSetupController2 {
     return this.passwords.cancel();
   }
 };
-__decorate42([
+__decorate43([
   Get7("/setup"),
   RateLimit5({ limit: 30, window: "15m", key: "ip" }),
   ResMsg6("auth.success.credentialSetupPending"),
-  __metadata42("design:type", Function),
-  __metadata42("design:paramtypes", []),
-  __metadata42("design:returntype", void 0)
+  __metadata43("design:type", Function),
+  __metadata43("design:paramtypes", []),
+  __metadata43("design:returntype", void 0)
 ], CredentialSetupController.prototype, "status", null);
-__decorate42([
+__decorate43([
   Post8("/change"),
   RateLimit5({ limit: 5, window: "15m", key: "ip" }),
   Validate6(credentialSetupChangeDto),
   ResMsg6("auth.success.credentialSetupPasswordReplaced"),
   __param15(0, Body7()),
-  __metadata42("design:type", Function),
-  __metadata42("design:paramtypes", [Object]),
-  __metadata42("design:returntype", void 0)
+  __metadata43("design:type", Function),
+  __metadata43("design:paramtypes", [Object]),
+  __metadata43("design:returntype", void 0)
 ], CredentialSetupController.prototype, "change", null);
-__decorate42([
+__decorate43([
   Post8("/cancel"),
   RateLimit5({ limit: 10, window: "15m", key: "ip" }),
   ResMsg6("auth.success.credentialSetupCancelled"),
-  __metadata42("design:type", Function),
-  __metadata42("design:paramtypes", []),
-  __metadata42("design:returntype", void 0)
+  __metadata43("design:type", Function),
+  __metadata43("design:paramtypes", []),
+  __metadata43("design:returntype", void 0)
 ], CredentialSetupController.prototype, "cancel", null);
-CredentialSetupController = __decorate42([
+CredentialSetupController = __decorate43([
   Controller8("/auth/credential-setup"),
-  __metadata42("design:paramtypes", [typeof (_a27 = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _a27 : Object])
+  __metadata43("design:paramtypes", [typeof (_a28 = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _a28 : Object])
 ], CredentialSetupController);
 
 // src/credentialSetup/index.ts
@@ -7023,9 +7486,9 @@ var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
   const clientId = google.clientId ?? process.env.GOOGLE_CLIENT_ID ?? "";
   const clientSecret = google.clientSecret ?? process.env.GOOGLE_CLIENT_SECRET ?? "";
   if (!clientId)
-    throw Err15.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
+    throw Err16.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
   if (!clientSecret)
-    throw Err15.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
+    throw Err16.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
   const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
   const callbackUrl = google.callbackUrl ?? process.env.GOOGLE_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/google/callback`;
   return {
@@ -7047,9 +7510,9 @@ var resolveGitHubConfig = /* @__PURE__ */ __name((config) => {
   const clientId = github.clientId ?? process.env.GITHUB_CLIENT_ID ?? "";
   const clientSecret = github.clientSecret ?? process.env.GITHUB_CLIENT_SECRET ?? "";
   if (!clientId)
-    throw Err15.configRequired("auth.oauth.github", "GITHUB_CLIENT_ID");
+    throw Err16.configRequired("auth.oauth.github", "GITHUB_CLIENT_ID");
   if (!clientSecret)
-    throw Err15.configRequired("auth.oauth.github", "GITHUB_CLIENT_SECRET");
+    throw Err16.configRequired("auth.oauth.github", "GITHUB_CLIENT_SECRET");
   const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
   const callbackUrl = github.callbackUrl ?? process.env.GITHUB_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/github/callback`;
   return {
@@ -7117,10 +7580,10 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
     }
   };
   if (!finalConfig.jwt.accessSecret) {
-    throw Err15.configRequired("auth", "JWT_ACCESS_SECRET");
+    throw Err16.configRequired("auth", "JWT_ACCESS_SECRET");
   }
   if (!finalConfig.jwt.refreshSecret) {
-    throw Err15.configRequired("auth", "JWT_REFRESH_SECRET");
+    throw Err16.configRequired("auth", "JWT_REFRESH_SECRET");
   }
   return finalConfig;
 }, "resolveAuthConfig");
@@ -7338,6 +7801,7 @@ export {
   RoleService,
   RoleValidator,
   ScopeContext,
+  SessionInvalidationService,
   TOKEN_STATUS,
   TOKEN_TYPE,
   TokenRepository,
@@ -7351,6 +7815,7 @@ export {
   assignRoleDto,
   assignRoleParams,
   auth,
+  authEmailRateLimitKey,
   authIdentityRateLimitKey,
   authSchema,
   authSeed,