najm-auth 4.2.4 → 5.0.0

package/dist/index.js

@@ -498,7 +498,7 @@ import { Get, Post, ResMsg } from "najm-core";
 import { Body, User as User2, Headers, Ctx } from "najm-core";
 
 // src/auth/AuthService.ts
-import { Injectable as Injectable12, Inject as Inject12 } from "najm-core";
+import { Injectable as Injectable12, Inject as Inject13 } from "najm-core";
 import { Err as Err12, Log } from "najm-core";
 import { Transaction as Transaction4 } from "najm-database";
 import { I18n as I18n8, I18nService as I18nService2 } from "najm-i18n";
@@ -512,7 +512,7 @@ import { I18nService } from "najm-i18n";
 import { I18n as I18n4 } from "najm-i18n";
 
 // src/users/UserRepository.ts
-import { eq as eq2, ne, sql as sql3 } from "drizzle-orm";
+import { and, eq as eq2, isNull, ne, sql as sql3 } from "drizzle-orm";
 import { Repository, Inject as Inject3 } from "najm-core";
 import { DB } from "najm-database";
 
@@ -699,6 +699,11 @@ var UserRepository = class UserRepository2 {
     const [updatedUser] = await this.db.update(this.users).set(data).where(eq2(this.users.id, id)).returning();
     return updatedUser;
   }
+  /** The credential that authorized a delayed write must still own the account. */
+  async updateWithCredential(id, data, expected) {
+    const [updated] = await this.db.update(this.users).set(data).where(and(eq2(this.users.id, id), eq2(this.users.password, expected.password), eq2(this.users.email, expected.email), expected.status == null ? isNull(this.users.status) : eq2(this.users.status, expected.status), expected.emailVerified == null ? isNull(this.users.emailVerified) : eq2(this.users.emailVerified, expected.emailVerified))).returning();
+    return updated;
+  }
   async updateLastLogin(id) {
     const [updatedUser] = await this.db.update(this.users).set({ lastLogin: (/* @__PURE__ */ new Date()).toISOString() }).where(eq2(this.users.id, id)).returning();
     return updatedUser;
@@ -758,6 +763,24 @@ UserRepository = __decorate3([
 import { Injectable as Injectable2 } from "najm-core";
 import { Err } from "najm-core";
 import { I18n } from "najm-i18n";
+
+// src/shared/uniqueViolation.ts
+function isUniqueViolation(error) {
+  const visited = /* @__PURE__ */ new Set();
+  while (error && typeof error === "object" && !visited.has(error)) {
+    visited.add(error);
+    const candidate = error;
+    if (candidate.code === "23505" || candidate.code === "SQLITE_CONSTRAINT_UNIQUE" || candidate.code === "SQLITE_CONSTRAINT_PRIMARYKEY")
+      return true;
+    if (typeof candidate.message === "string" && /unique constraint failed/i.test(candidate.message))
+      return true;
+    error = candidate.cause;
+  }
+  return false;
+}
+__name(isUniqueViolation, "isUniqueViolation");
+
+// src/users/UserValidator.ts
 var __decorate4 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -786,7 +809,7 @@ var UserValidator = class UserValidator2 {
   async checkEmailUnique(email2, excludeId) {
     if (!email2)
       return;
-    const existingUser = await this.userRepository.getByEmail(email2);
+    const existingUser = await this.userRepository.getByEmailInsensitive(email2);
     if (existingUser && existingUser.id !== excludeId) {
       Err(this.t("errors.emailExists"), 409);
     }
@@ -802,6 +825,20 @@ var UserValidator = class UserValidator2 {
       Err(this.t("errors.phoneExists"), 409);
     }
   }
+  /** The database remains authoritative when two validation reads both pass. */
+  async writeUnique(write) {
+    try {
+      return await write();
+    } catch (error) {
+      if (isUniqueViolation(error))
+        Err("User identity already exists", 409);
+      throw error;
+    }
+  }
+  checkCredentialUnchanged(updated) {
+    if (!updated)
+      Err("Account credentials changed. Please sign in again or request a new link.", 409);
+  }
   /**
    * Check if user exists by ID
    */
@@ -919,7 +956,7 @@ UserValidator = __decorate4([
 ], UserValidator);
 
 // src/roles/RoleService.ts
-import { Injectable as Injectable4, Err as Err3 } from "najm-core";
+import { Injectable as Injectable5, Err as Err3 } from "najm-core";
 import { I18n as I18n3 } from "najm-i18n";
 
 // src/roles/RoleRepository.ts
@@ -1069,7 +1106,16 @@ RoleValidator = __decorate6([
   __metadata6("design:paramtypes", [typeof (_a3 = typeof RoleRepository !== "undefined" && RoleRepository) === "function" ? _a3 : Object])
 ], RoleValidator);
 
-// src/roles/RoleService.ts
+// src/tokens/SessionInvalidationService.ts
+import { Inject as Inject6, Injectable as Injectable4 } from "najm-core";
+import { CacheService } from "najm-cache";
+import { TransactionService } from "najm-database";
+import timestring2 from "timestring";
+
+// src/tokens/TokenRepository.ts
+import { and as and2, eq as eq4, isNull as isNull2, lt } from "drizzle-orm";
+import { Repository as Repository3, Inject as Inject5 } from "najm-core";
+import { DB as DB3 } from "najm-database";
 var __decorate7 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1079,487 +1125,177 @@ var __decorate7 = function(decorators, target, key, desc) {
 var __metadata7 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a4;
-var _b2;
-var RoleService = class RoleService2 {
+var TokenRepository = class TokenRepository2 {
   static {
-    __name(this, "RoleService");
+    __name(this, "TokenRepository");
   }
-  roleRepository;
-  roleValidator;
-  t;
-  constructor(roleRepository, roleValidator) {
-    this.roleRepository = roleRepository;
-    this.roleValidator = roleValidator;
+  db;
+  schema;
+  get tokens() {
+    return this.schema.tokens;
   }
-  async getAll() {
-    return await this.roleRepository.getAll();
+  get users() {
+    return this.schema.users;
   }
-  async getById(id) {
-    await this.roleValidator.checkRoleExists(id);
-    return await this.roleRepository.getById(id);
+  async getCredentialState(userId) {
+    const [user] = await this.db.select({
+      id: this.users.id,
+      password: this.users.password,
+      email: this.users.email,
+      status: this.users.status,
+      emailVerified: this.users.emailVerified
+    }).from(this.users).where(eq4(this.users.id, userId)).limit(1);
+    return user;
   }
-  async getByName(name) {
-    return await this.roleRepository.getByName(name);
+  /** Shared query helper, scoped to the current database/transaction identity. */
+  queryHelper;
+  get q() {
+    const db = this.db;
+    if (this.queryHelper?.db !== db) {
+      this.queryHelper = { db, queries: new AuthQueries(db, this.schema) };
+    }
+    return this.queryHelper.queries;
   }
-  async create(data) {
-    await this.roleValidator.checkNameUnique(data.name);
-    return await this.onDuplicateName(() => this.roleRepository.create(data));
+  /**
+   * Upsert the refresh-token row for a session, keyed on `tokenFamily` (the
+   * per-login session identifier, unique). A brand-new login inserts a fresh
+   * family row; a refresh rotation updates only that family's row, leaving the
+   * user's other sessions untouched.
+   */
+  async storeRefreshToken(tokenData) {
+    return await this.db.insert(this.tokens).values(tokenData).onConflictDoUpdate({
+      target: this.tokens.tokenFamily,
+      set: {
+        token: tokenData.token,
+        expiresAt: tokenData.expiresAt,
+        previousHash: tokenData.previousHash ?? null,
+        previousValidUntil: tokenData.previousValidUntil ?? null,
+        previousUsedAt: tokenData.previousUsedAt ?? null
+      },
+      // A revoked family is a durable tombstone. It must never be revived by
+      // an issuance racing with logout, or after the cache markers are lost.
+      setWhere: and2(eq4(this.tokens.status, "active"), eq4(this.tokens.userId, tokenData.userId))
+    }).returning();
   }
-  async update(id, data) {
-    const role = await this.roleValidator.checkRoleExists(id);
-    if (role.name === ROLES.ADMIN && data.name && data.name !== ROLES.ADMIN) {
-      Err3(this.t("errors.cannotRenameSystem"), 403);
-    }
-    await this.roleValidator.checkNameUnique(data.name, id);
-    return await this.onDuplicateName(() => this.roleRepository.update(id, data));
+  /**
+   * Rotate an existing refresh-token family with compare-and-swap semantics.
+   * This can never update a family durably revoked by a concurrent logout.
+   */
+  async rotateRefreshToken(tokenData, expectedCurrentHash) {
+    return await this.db.update(this.tokens).set({
+      token: tokenData.token,
+      expiresAt: tokenData.expiresAt,
+      previousHash: tokenData.previousHash,
+      previousValidUntil: tokenData.previousValidUntil,
+      previousUsedAt: tokenData.previousUsedAt ?? null
+    }).where(and2(eq4(this.tokens.tokenFamily, tokenData.tokenFamily), eq4(this.tokens.userId, tokenData.userId), eq4(this.tokens.token, expectedCurrentHash), eq4(this.tokens.status, "active"))).returning();
   }
-  async delete(id) {
-    const role = await this.roleValidator.checkRoleExists(id);
-    if (role.name === ROLES.ADMIN) {
-      Err3(this.t("errors.cannotDeleteSystem"), 403);
-    }
-    if (await this.roleRepository.hasUsers(id)) {
-      Err3(this.t("errors.roleInUse"), 409);
-    }
-    return await this.roleRepository.delete(id);
+  /**
+   * Claim the previous-token grace slot for a single family. Conditional on
+   * BOTH the stored previousHash still matching the presented token AND
+   * previousUsedAt being NULL. Gating on the hash (not just the flag) closes
+   * the rotation race: the winner's rotation rewrites previousHash via
+   * storeRefreshToken (and resets previousUsedAt to NULL), so a loser whose
+   * UPDATE lands after that rotation no longer matches and gets zero rows —
+   * exactly one caller ever claims the slot.
+   */
+  async markPreviousUsed(tokenFamily, previousHash) {
+    return await this.db.update(this.tokens).set({ previousUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and2(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.previousHash, previousHash), isNull2(this.tokens.previousUsedAt), eq4(this.tokens.status, "active"))).returning();
   }
-  async seedDefaultRoles(defaultRoles) {
-    const rolesToCreate = [];
-    for (const role of defaultRoles) {
-      const exists = await this.roleValidator.isRoleNameExists(role.name);
-      if (!exists) {
-        rolesToCreate.push(role);
-      }
-    }
-    const createdRoles = await Promise.all(rolesToCreate.map((role) => this.roleRepository.create(role)));
-    return createdRoles;
+  /** Look up a single session's token row by its family identifier. */
+  async getByFamily(tokenFamily) {
+    const [token] = await this.db.select().from(this.tokens).where(and2(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.status, "active")));
+    return token ?? null;
   }
-  async getRoleIdByName(name) {
-    const role = await this.getByName(name);
-    return role?.id;
+  /**
+   * Durably revoke one family without depending on physical deletion.
+   *
+   * The row remains as a tombstone until its original refresh expiry. This is
+   * what prevents a later cache loss from turning a failed/omitted cleanup
+   * delete into a valid database-backed recovery session.
+   */
+  async revokeFamily(tokenFamily) {
+    return this.db.update(this.tokens).set({
+      status: "revoked",
+      previousHash: null,
+      previousValidUntil: null,
+      previousUsedAt: null
+    }).where(and2(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.status, "active"))).returning();
+  }
+  /** Durably revoke every active family for a user. */
+  async revokeAllForUser(userId) {
+    return this.db.update(this.tokens).set({
+      status: "revoked",
+      previousHash: null,
+      previousValidUntil: null,
+      previousUsedAt: null
+    }).where(and2(eq4(this.tokens.userId, userId), eq4(this.tokens.status, "active"))).returning();
   }
   /**
-   * checkNameUnique() reads before it writes, so two concurrent requests can
-   * both pass it and race to insert the same name. The database rejects the
-   * loser; answer it with the same 409 the validator would have given rather
-   * than leaking a raw driver error as a 500.
+   * Opportunistic cleanup: with one row per family (no unique userId), expired
+   * and abandoned sessions accumulate. Delete every expired row.
    */
-  async onDuplicateName(write) {
-    try {
-      return await write();
-    } catch (error) {
-      if (isDuplicateRoleName(error)) {
-        Err3(this.t("errors.exists"), 409);
-      }
-      throw error;
-    }
+  async deleteExpired() {
+    return this.db.delete(this.tokens).where(lt(this.tokens.expiresAt, (/* @__PURE__ */ new Date()).toISOString())).returning();
+  }
+  async isUserExists(userId) {
+    const [user] = await this.db.select({ id: this.users.id }).from(this.users).where(eq4(this.users.id, userId)).limit(1);
+    return !!user;
+  }
+  async getRoleNameById(userId) {
+    return this.q.getRoleName(userId);
+  }
+  async getUserPermissions(userId) {
+    return this.q.getUserPermissions(userId);
+  }
+  async getRoleAndPermissions(userId) {
+    return this.q.getRoleAndPermissions(userId);
+  }
+  async getUser(userId) {
+    return await this.q.getUserWithPermissions(eq4(this.users.id, userId)) ?? null;
   }
 };
 __decorate7([
-  I18n3("roles"),
+  DB3(),
   __metadata7("design:type", Object)
-], RoleService.prototype, "t", void 0);
-RoleService = __decorate7([
-  Injectable4(),
-  __metadata7("design:paramtypes", [typeof (_a4 = typeof RoleRepository !== "undefined" && RoleRepository) === "function" ? _a4 : Object, typeof (_b2 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b2 : Object])
-], RoleService);
-function isDuplicateRoleName(error) {
-  if (!error || typeof error !== "object")
-    return false;
-  const candidate = error;
-  if (candidate.code === "23505")
-    return true;
-  if (candidate.code === "SQLITE_CONSTRAINT_UNIQUE")
-    return true;
-  const message = typeof candidate.message === "string" ? candidate.message : "";
-  return /unique constraint failed/i.test(message) || /duplicate key value violates unique constraint/i.test(message);
-}
-__name(isDuplicateRoleName, "isDuplicateRoleName");
-
-// src/users/UserService.ts
-import { nanoid as nanoid3 } from "nanoid";
+], TokenRepository.prototype, "db", void 0);
+__decorate7([
+  Inject5(AUTH_SCHEMA),
+  __metadata7("design:type", Object)
+], TokenRepository.prototype, "schema", void 0);
+TokenRepository = __decorate7([
+  Repository3()
+], TokenRepository);
 
-// src/shared/index.ts
-import * as fs from "fs/promises";
-import * as path from "path";
-import _isEmpty from "lodash.isempty";
-import { Err as Err4 } from "najm-core";
-var avatarsPath = path.join(process.cwd(), "avatars");
-var parseSchema = /* @__PURE__ */ __name(async (schema, data) => {
-  try {
-    return await schema.parseAsync(data);
-  } catch (error) {
-    const errors = error.issues || error.errors || [];
-    const errorMessage = errors.map((err) => `${err.path.join(".")}: ${err.message}`).join("; ");
-    Err4(errorMessage);
+// src/tokens/SessionInvalidationService.ts
+var __decorate8 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata8 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var SessionInvalidationService_1;
+var _a4;
+var _b2;
+var _c;
+var SessionInvalidationService = class SessionInvalidationService2 {
+  static {
+    __name(this, "SessionInvalidationService");
   }
-}, "parseSchema");
-var clean = /* @__PURE__ */ __name((obj) => {
-  const cleaned = {};
-  for (const [key, value] of Object.entries(obj)) {
-    if (value !== void 0 && value !== "") {
-      cleaned[key] = value;
-    }
-  }
-  return cleaned;
-}, "clean");
-var getAvatarFile = /* @__PURE__ */ __name(async (fileName) => {
-  try {
-    const filePath = path.join(avatarsPath, fileName);
-    const buffer = await fs.readFile(filePath);
-    const file = new File([buffer], fileName, {
-      type: "image/png"
-    });
-    return file;
-  } catch (error) {
-    return null;
-  }
-}, "getAvatarFile");
-var formatDate = /* @__PURE__ */ __name((dateValue) => {
-  if (!dateValue)
-    return null;
-  let date;
-  if (dateValue instanceof Date) {
-    date = dateValue;
-  } else if (typeof dateValue === "string") {
-    date = new Date(dateValue);
-  } else {
-    return null;
-  }
-  if (isNaN(date.getTime()))
-    return null;
-  return date.toISOString().split("T")[0];
-}, "formatDate");
-function calculateAge(dateOfBirth) {
-  if (!dateOfBirth)
-    return null;
-  const formattedDate = formatDate(dateOfBirth);
-  if (!formattedDate)
-    return null;
-  const birth = new Date(formattedDate);
-  const today = /* @__PURE__ */ new Date();
-  let age = today.getFullYear() - birth.getFullYear();
-  const monthDiff = today.getMonth() - birth.getMonth();
-  if (monthDiff < 0 || monthDiff === 0 && today.getDate() < birth.getDate()) {
-    age--;
-  }
-  return age;
-}
-__name(calculateAge, "calculateAge");
-function calculateYearsOfExperience(hireDate) {
-  if (!hireDate)
-    return null;
-  const formattedDate = formatDate(hireDate);
-  if (!formattedDate)
-    return null;
-  const hire = new Date(formattedDate);
-  const today = /* @__PURE__ */ new Date();
-  let years = today.getFullYear() - hire.getFullYear();
-  const monthDiff = today.getMonth() - hire.getMonth();
-  if (monthDiff < 0 || monthDiff === 0 && today.getDate() < hire.getDate()) {
-    years--;
-  }
-  return years;
-}
-__name(calculateYearsOfExperience, "calculateYearsOfExperience");
-function pickProps(source, keys) {
-  const result = {};
-  for (const key of keys) {
-    if (source[key] !== void 0) {
-      result[key] = source[key];
-    }
-  }
-  return result;
-}
-__name(pickProps, "pickProps");
-var isEmpty = _isEmpty;
-var isPath = /* @__PURE__ */ __name((img) => typeof img === "string" && img.trim().length > 0 && (img.startsWith("/") || img.startsWith("http") || img.startsWith("storage/")), "isPath");
-var isFile = /* @__PURE__ */ __name((img) => !!img && typeof img !== "string" && img instanceof File, "isFile");
-
-// src/identity/presets.ts
-var compactPhone = /* @__PURE__ */ __name((value) => value.trim().replace(/[\s().-]+/g, ""), "compactPhone");
-var MOROCCO_LOCAL = /^0\d{9}$/;
-var MOROCCO_NATIONAL = /^212\d{9}$/;
-var MOROCCO_E164 = /^\+212\d{9}$/;
-var normalizeMoroccanPhone = /* @__PURE__ */ __name((value) => {
-  const compact = compactPhone(value);
-  if (MOROCCO_LOCAL.test(compact))
-    return `+212${compact.slice(1)}`;
-  if (MOROCCO_NATIONAL.test(compact))
-    return `+${compact}`;
-  if (MOROCCO_E164.test(compact))
-    return compact;
-  return null;
-}, "normalizeMoroccanPhone");
-var moroccoIdentityPreset = {
-  name: "ma",
-  normalize: normalizeMoroccanPhone
-};
-var TUNISIA_LOCAL = /^\d{8}$/;
-var TUNISIA_NATIONAL = /^216\d{8}$/;
-var TUNISIA_E164 = /^\+216\d{8}$/;
-var normalizeTunisianPhone = /* @__PURE__ */ __name((value) => {
-  const compact = compactPhone(value);
-  if (TUNISIA_LOCAL.test(compact))
-    return `+216${compact}`;
-  if (TUNISIA_NATIONAL.test(compact))
-    return `+${compact}`;
-  if (TUNISIA_E164.test(compact))
-    return compact;
-  return null;
-}, "normalizeTunisianPhone");
-var tunisiaIdentityPreset = {
-  name: "tn",
-  normalize: normalizeTunisianPhone
-};
-var IDENTITY_PRESETS = {
-  ma: moroccoIdentityPreset,
-  tn: tunisiaIdentityPreset
-};
-var DEFAULT_IDENTITY_PRESET = "ma";
-
-// src/identity/resolver.ts
-var MAX_IDENTIFIER_LENGTH = 254;
-var E164 = /^\+[1-9]\d{7,14}$/;
-var normalizeE164 = /* @__PURE__ */ __name((value) => {
-  const compact = compactPhone(value);
-  const international = compact.startsWith("00") ? `+${compact.slice(2)}` : compact;
-  return E164.test(international) ? international : null;
-}, "normalizeE164");
-var selectPreset = /* @__PURE__ */ __name((preset) => {
-  if (preset === null)
-    return null;
-  if (preset === void 0)
-    return IDENTITY_PRESETS[DEFAULT_IDENTITY_PRESET];
-  if (typeof preset === "string") {
-    const selected = IDENTITY_PRESETS[preset];
-    if (!selected)
-      throw new Error(`auth.identity.preset '${preset}' is not a built-in identity preset`);
-    return selected;
-  }
-  if (typeof preset.normalize !== "function") {
-    throw new Error("auth.identity.preset must expose a normalize(value) function");
-  }
-  return preset;
-}, "selectPreset");
-function createIdentityResolver(config) {
-  const preset = selectPreset(config?.preset);
-  const extend = config?.extend ?? [];
-  if (extend.some((normalizer) => typeof normalizer !== "function")) {
-    throw new Error("auth.identity.extend must contain only normalizer functions");
-  }
-  const pipeline = [
-    ...extend,
-    ...preset ? [preset.normalize] : [],
-    normalizeE164
-  ];
-  return (value) => {
-    if (typeof value !== "string")
-      return null;
-    const trimmed = value.trim();
-    if (!trimmed || trimmed.length > MAX_IDENTIFIER_LENGTH)
-      return null;
-    if (trimmed.includes("@"))
-      return trimmed.toLowerCase();
-    for (const normalize of pipeline) {
-      const normalized = normalize(trimmed);
-      if (normalized)
-        return normalized;
-    }
-    return null;
-  };
-}
-__name(createIdentityResolver, "createIdentityResolver");
-var defaultResolver = createIdentityResolver();
-function normalizeAuthIdentifier(value) {
-  return defaultResolver(value);
-}
-__name(normalizeAuthIdentifier, "normalizeAuthIdentifier");
-function isEmailIdentifier(value) {
-  return value.includes("@");
-}
-__name(isEmailIdentifier, "isEmailIdentifier");
-
-// src/users/UserService.ts
-import { Err as Err5 } from "najm-core";
-
-// src/tokens/SessionInvalidationService.ts
-import { Inject as Inject6, Injectable as Injectable5 } from "najm-core";
-import { CacheService } from "najm-cache";
-import timestring2 from "timestring";
-
-// src/tokens/TokenRepository.ts
-import { and, eq as eq4, isNull, lt } from "drizzle-orm";
-import { Repository as Repository3, Inject as Inject5 } from "najm-core";
-import { DB as DB3 } from "najm-database";
-var __decorate8 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata8 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var TokenRepository = class TokenRepository2 {
-  static {
-    __name(this, "TokenRepository");
-  }
-  db;
-  schema;
-  get tokens() {
-    return this.schema.tokens;
-  }
-  get users() {
-    return this.schema.users;
-  }
-  /** Shared query helper, scoped to the current database/transaction identity. */
-  queryHelper;
-  get q() {
-    const db = this.db;
-    if (this.queryHelper?.db !== db) {
-      this.queryHelper = { db, queries: new AuthQueries(db, this.schema) };
-    }
-    return this.queryHelper.queries;
-  }
-  /**
-   * Upsert the refresh-token row for a session, keyed on `tokenFamily` (the
-   * per-login session identifier, unique). A brand-new login inserts a fresh
-   * family row; a refresh rotation updates only that family's row, leaving the
-   * user's other sessions untouched.
-   */
-  async storeRefreshToken(tokenData) {
-    return await this.db.insert(this.tokens).values(tokenData).onConflictDoUpdate({
-      target: this.tokens.tokenFamily,
-      set: {
-        token: tokenData.token,
-        expiresAt: tokenData.expiresAt,
-        previousHash: tokenData.previousHash ?? null,
-        previousValidUntil: tokenData.previousValidUntil ?? null,
-        previousUsedAt: tokenData.previousUsedAt ?? null
-      },
-      // A revoked family is a durable tombstone. It must never be revived by
-      // an issuance racing with logout, or after the cache markers are lost.
-      setWhere: and(eq4(this.tokens.status, "active"), eq4(this.tokens.userId, tokenData.userId))
-    }).returning();
-  }
-  /**
-   * Rotate an existing refresh-token family with compare-and-swap semantics.
-   * This can never update a family durably revoked by a concurrent logout.
-   */
-  async rotateRefreshToken(tokenData, expectedCurrentHash) {
-    return await this.db.update(this.tokens).set({
-      token: tokenData.token,
-      expiresAt: tokenData.expiresAt,
-      previousHash: tokenData.previousHash,
-      previousValidUntil: tokenData.previousValidUntil,
-      previousUsedAt: tokenData.previousUsedAt ?? null
-    }).where(and(eq4(this.tokens.tokenFamily, tokenData.tokenFamily), eq4(this.tokens.userId, tokenData.userId), eq4(this.tokens.token, expectedCurrentHash), eq4(this.tokens.status, "active"))).returning();
-  }
-  /**
-   * Claim the previous-token grace slot for a single family. Conditional on
-   * BOTH the stored previousHash still matching the presented token AND
-   * previousUsedAt being NULL. Gating on the hash (not just the flag) closes
-   * the rotation race: the winner's rotation rewrites previousHash via
-   * storeRefreshToken (and resets previousUsedAt to NULL), so a loser whose
-   * UPDATE lands after that rotation no longer matches and gets zero rows —
-   * exactly one caller ever claims the slot.
-   */
-  async markPreviousUsed(tokenFamily, previousHash) {
-    return await this.db.update(this.tokens).set({ previousUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.previousHash, previousHash), isNull(this.tokens.previousUsedAt), eq4(this.tokens.status, "active"))).returning();
-  }
-  /** Look up a single session's token row by its family identifier. */
-  async getByFamily(tokenFamily) {
-    const [token] = await this.db.select().from(this.tokens).where(and(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.status, "active")));
-    return token ?? null;
-  }
-  /**
-   * Durably revoke one family without depending on physical deletion.
-   *
-   * The row remains as a tombstone until its original refresh expiry. This is
-   * what prevents a later cache loss from turning a failed/omitted cleanup
-   * delete into a valid database-backed recovery session.
-   */
-  async revokeFamily(tokenFamily) {
-    return this.db.update(this.tokens).set({
-      status: "revoked",
-      previousHash: null,
-      previousValidUntil: null,
-      previousUsedAt: null
-    }).where(and(eq4(this.tokens.tokenFamily, tokenFamily), eq4(this.tokens.status, "active"))).returning();
-  }
-  /** Durably revoke every active family for a user. */
-  async revokeAllForUser(userId) {
-    return this.db.update(this.tokens).set({
-      status: "revoked",
-      previousHash: null,
-      previousValidUntil: null,
-      previousUsedAt: null
-    }).where(and(eq4(this.tokens.userId, userId), eq4(this.tokens.status, "active"))).returning();
-  }
-  /**
-   * Opportunistic cleanup: with one row per family (no unique userId), expired
-   * and abandoned sessions accumulate. Delete every expired row.
-   */
-  async deleteExpired() {
-    return this.db.delete(this.tokens).where(lt(this.tokens.expiresAt, (/* @__PURE__ */ new Date()).toISOString())).returning();
-  }
-  async isUserExists(userId) {
-    const [user] = await this.db.select({ id: this.users.id }).from(this.users).where(eq4(this.users.id, userId)).limit(1);
-    return !!user;
-  }
-  async getRoleNameById(userId) {
-    return this.q.getRoleName(userId);
-  }
-  async getUserPermissions(userId) {
-    return this.q.getUserPermissions(userId);
-  }
-  async getRoleAndPermissions(userId) {
-    return this.q.getRoleAndPermissions(userId);
-  }
-  async getUser(userId) {
-    return await this.q.getUserWithPermissions(eq4(this.users.id, userId)) ?? null;
-  }
-};
-__decorate8([
-  DB3(),
-  __metadata8("design:type", Object)
-], TokenRepository.prototype, "db", void 0);
-__decorate8([
-  Inject5(AUTH_SCHEMA),
-  __metadata8("design:type", Object)
-], TokenRepository.prototype, "schema", void 0);
-TokenRepository = __decorate8([
-  Repository3()
-], TokenRepository);
-
-// src/tokens/SessionInvalidationService.ts
-var __decorate9 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata9 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var SessionInvalidationService_1;
-var _a5;
-var _b3;
-var SessionInvalidationService = class SessionInvalidationService2 {
-  static {
-    __name(this, "SessionInvalidationService");
-  }
-  static {
-    SessionInvalidationService_1 = this;
+  static {
+    SessionInvalidationService_1 = this;
   }
   cache;
   tokens;
+  transactions;
   config;
-  constructor(cache2, tokens) {
+  constructor(cache2, tokens, transactions) {
     this.cache = cache2;
     this.tokens = tokens;
+    this.transactions = transactions;
   }
   /**
    * Fields whose change ends existing sessions. Everything absent from this set
@@ -1582,7 +1318,7 @@ var SessionInvalidationService = class SessionInvalidationService2 {
     return SessionInvalidationService_1.SECURITY_FIELDS.some((field) => data[field] !== void 0);
   }
   get accessTokenTtlMs() {
-    return timestring2(this.config.jwt.accessExpiresIn, "ms");
+    return Math.max(timestring2(this.config.jwt.accessExpiresIn, "ms"), (this.config.session?.maxAge ?? 300) * 1e3);
   }
   get refreshTokenTtlMs() {
     return timestring2(this.config.jwt.refreshExpiresIn, "ms");
@@ -1636,9 +1372,15 @@ var SessionInvalidationService = class SessionInvalidationService2 {
    * the same version and write the same successor back.
    */
   async invalidateAccessTokens(userId) {
+    const version = await this.invalidateAccessTokensNow(userId);
+    await this.afterTransaction(() => this.invalidateAccessTokens(userId));
+    return version;
+  }
+  async invalidateAccessTokensNow(userId) {
     const key = this.sessionVersionKey(userId);
     const { count } = await this.cache.incr(key, this.accessTokenTtlMs);
     await this.cache.expire(key, this.accessTokenTtlMs);
+    await this.cache.del(`${this.userCacheKey(userId)}:${count - 1}`);
     await this.dropUserCache(userId);
     return count;
   }
@@ -1649,15 +1391,30 @@ var SessionInvalidationService = class SessionInvalidationService2 {
    * End every session a user holds: access tokens by version, refresh sessions
    * by row, and each family's liveness marker.
    *
-   * Callers run this AFTER their database mutation has committed. Running it
-   * before would leave a window in which a concurrent login re-established a
-   * session against the state the mutation was about to remove; running it
-   * after a rollback merely signs the user out again, which is safe.
+   * Repeat invalidation when a caller-owned transaction completes. Readers can
+   * recover from the previous committed state before commit, or from transient
+   * state on a shared connection before rollback. Neither snapshot may survive.
    */
   async invalidateUser(userId) {
-    await this.invalidateAccessTokens(userId);
+    await this.invalidateAccessTokensNow(userId);
+    await this.revokeAllForUserNow(userId);
+    await this.afterTransaction(() => this.invalidateUser(userId));
+  }
+  async revokeAllForUser(userId) {
+    const revoked = await this.revokeAllForUserNow(userId);
+    await this.afterTransaction(() => this.revokeAllForUser(userId));
+    return revoked;
+  }
+  async afterTransaction(callback) {
+    if (!this.transactions?.isActive())
+      return;
+    await this.transactions.afterCommit(callback);
+    await this.transactions.afterRollback(callback);
+  }
+  async revokeAllForUserNow(userId) {
     const revoked = await this.tokens.revokeAllForUser(userId);
     await Promise.all(familiesOf(revoked).map((family) => this.markFamilyRevoked(family)));
+    return revoked;
   }
   /**
    * Record that a family is live, and whose it is. Called wherever the family's
@@ -1722,40 +1479,365 @@ var SessionInvalidationService = class SessionInvalidationService2 {
   async isFamilyLive(tokenFamily, userId) {
     return await this.familyStatus(tokenFamily, userId) === "live";
   }
-  async readMany(keys) {
-    const cache2 = this.cache;
-    if (cache2.getMany)
-      return cache2.getMany(keys);
-    return Promise.all(keys.map((key) => cache2.get(key)));
+  async readMany(keys) {
+    const cache2 = this.cache;
+    if (cache2.getMany)
+      return cache2.getMany(keys);
+    return Promise.all(keys.map((key) => cache2.get(key)));
+  }
+  /**
+   * Keep revocation through both credential lifetimes. If deleting the refresh
+   * row fails, its still-valid cookie must remain denied after access expires.
+   */
+  async markFamilyRevoked(tokenFamily) {
+    await this.cache.set(this.revokedFamilyKey(tokenFamily), "1", Math.max(this.accessTokenTtlMs, this.refreshTokenTtlMs));
+    await this.cache.del(this.familyKey(tokenFamily));
+  }
+  async isFamilyRevoked(tokenFamily) {
+    return await this.cache.get(this.revokedFamilyKey(tokenFamily)) !== null;
+  }
+};
+__decorate8([
+  Inject6(AUTH_CONFIG),
+  __metadata8("design:type", Object)
+], SessionInvalidationService.prototype, "config", void 0);
+SessionInvalidationService = SessionInvalidationService_1 = __decorate8([
+  Injectable4(),
+  __metadata8("design:paramtypes", [typeof (_a4 = typeof CacheService !== "undefined" && CacheService) === "function" ? _a4 : Object, typeof (_b2 = typeof TokenRepository !== "undefined" && TokenRepository) === "function" ? _b2 : Object, typeof (_c = typeof TransactionService !== "undefined" && TransactionService) === "function" ? _c : Object])
+], SessionInvalidationService);
+function familiesOf(rows) {
+  if (!Array.isArray(rows))
+    return [];
+  return rows.map((row) => row?.tokenFamily).filter((family) => typeof family === "string" && family.length > 0);
+}
+__name(familiesOf, "familiesOf");
+
+// src/roles/RoleService.ts
+var __decorate9 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata9 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a5;
+var _b3;
+var _c2;
+var _d;
+var RoleService = class RoleService2 {
+  static {
+    __name(this, "RoleService");
+  }
+  roleRepository;
+  roleValidator;
+  userRepository;
+  sessionInvalidation;
+  t;
+  constructor(roleRepository, roleValidator, userRepository, sessionInvalidation) {
+    this.roleRepository = roleRepository;
+    this.roleValidator = roleValidator;
+    this.userRepository = userRepository;
+    this.sessionInvalidation = sessionInvalidation;
+  }
+  async getAll() {
+    return await this.roleRepository.getAll();
+  }
+  async getById(id) {
+    await this.roleValidator.checkRoleExists(id);
+    return await this.roleRepository.getById(id);
+  }
+  async getByName(name) {
+    return await this.roleRepository.getByName(name);
+  }
+  async create(data) {
+    await this.roleValidator.checkNameUnique(data.name);
+    return await this.onDuplicateName(() => this.roleRepository.create(data));
+  }
+  async update(id, data) {
+    const role = await this.roleValidator.checkRoleExists(id);
+    if (role.name === ROLES.ADMIN && data.name && data.name !== ROLES.ADMIN) {
+      Err3(this.t("errors.cannotRenameSystem"), 403);
+    }
+    await this.roleValidator.checkNameUnique(data.name, id);
+    const updated = await this.onDuplicateName(() => this.roleRepository.update(id, data));
+    if (data.name !== void 0 && this.userRepository && this.sessionInvalidation) {
+      for (const userId of await this.userRepository.getIdsByRole(id)) {
+        await this.sessionInvalidation.invalidateAccessTokens(userId);
+      }
+    }
+    return updated;
+  }
+  async delete(id) {
+    const role = await this.roleValidator.checkRoleExists(id);
+    if (role.name === ROLES.ADMIN) {
+      Err3(this.t("errors.cannotDeleteSystem"), 403);
+    }
+    if (await this.roleRepository.hasUsers(id)) {
+      Err3(this.t("errors.roleInUse"), 409);
+    }
+    return await this.roleRepository.delete(id);
+  }
+  async seedDefaultRoles(defaultRoles) {
+    const rolesToCreate = [];
+    for (const role of defaultRoles) {
+      const exists = await this.roleValidator.isRoleNameExists(role.name);
+      if (!exists) {
+        rolesToCreate.push(role);
+      }
+    }
+    const createdRoles = await Promise.all(rolesToCreate.map((role) => this.roleRepository.create(role)));
+    return createdRoles;
+  }
+  async getRoleIdByName(name) {
+    const role = await this.getByName(name);
+    return role?.id;
+  }
+  /**
+   * checkNameUnique() reads before it writes, so two concurrent requests can
+   * both pass it and race to insert the same name. The database rejects the
+   * loser; answer it with the same 409 the validator would have given rather
+   * than leaking a raw driver error as a 500.
+   */
+  async onDuplicateName(write) {
+    try {
+      return await write();
+    } catch (error) {
+      if (isDuplicateRoleName(error)) {
+        Err3(this.t("errors.exists"), 409);
+      }
+      throw error;
+    }
+  }
+};
+__decorate9([
+  I18n3("roles"),
+  __metadata9("design:type", Object)
+], RoleService.prototype, "t", void 0);
+RoleService = __decorate9([
+  Injectable5(),
+  __metadata9("design:paramtypes", [typeof (_a5 = typeof RoleRepository !== "undefined" && RoleRepository) === "function" ? _a5 : Object, typeof (_b3 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b3 : Object, typeof (_c2 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _c2 : Object, typeof (_d = typeof SessionInvalidationService !== "undefined" && SessionInvalidationService) === "function" ? _d : Object])
+], RoleService);
+function isDuplicateRoleName(error) {
+  if (!error || typeof error !== "object")
+    return false;
+  const candidate = error;
+  if (candidate.code === "23505")
+    return true;
+  if (candidate.code === "SQLITE_CONSTRAINT_UNIQUE")
+    return true;
+  const message = typeof candidate.message === "string" ? candidate.message : "";
+  return /unique constraint failed/i.test(message) || /duplicate key value violates unique constraint/i.test(message);
+}
+__name(isDuplicateRoleName, "isDuplicateRoleName");
+
+// src/users/UserService.ts
+import { nanoid as nanoid3 } from "nanoid";
+
+// src/shared/index.ts
+import * as fs from "fs/promises";
+import * as path from "path";
+import _isEmpty from "lodash.isempty";
+import { Err as Err4 } from "najm-core";
+var avatarsPath = path.join(process.cwd(), "avatars");
+var parseSchema = /* @__PURE__ */ __name(async (schema, data) => {
+  try {
+    return await schema.parseAsync(data);
+  } catch (error) {
+    const errors = error.issues || error.errors || [];
+    const errorMessage = errors.map((err) => `${err.path.join(".")}: ${err.message}`).join("; ");
+    Err4(errorMessage);
+  }
+}, "parseSchema");
+var clean = /* @__PURE__ */ __name((obj) => {
+  const cleaned = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (value !== void 0 && value !== "") {
+      cleaned[key] = value;
+    }
+  }
+  return cleaned;
+}, "clean");
+var getAvatarFile = /* @__PURE__ */ __name(async (fileName) => {
+  try {
+    const filePath = path.join(avatarsPath, fileName);
+    const buffer = await fs.readFile(filePath);
+    const file = new File([buffer], fileName, {
+      type: "image/png"
+    });
+    return file;
+  } catch (error) {
+    return null;
+  }
+}, "getAvatarFile");
+var formatDate = /* @__PURE__ */ __name((dateValue) => {
+  if (!dateValue)
+    return null;
+  let date;
+  if (dateValue instanceof Date) {
+    date = dateValue;
+  } else if (typeof dateValue === "string") {
+    date = new Date(dateValue);
+  } else {
+    return null;
+  }
+  if (isNaN(date.getTime()))
+    return null;
+  return date.toISOString().split("T")[0];
+}, "formatDate");
+function calculateAge(dateOfBirth) {
+  if (!dateOfBirth)
+    return null;
+  const formattedDate = formatDate(dateOfBirth);
+  if (!formattedDate)
+    return null;
+  const birth = new Date(formattedDate);
+  const today = /* @__PURE__ */ new Date();
+  let age = today.getFullYear() - birth.getFullYear();
+  const monthDiff = today.getMonth() - birth.getMonth();
+  if (monthDiff < 0 || monthDiff === 0 && today.getDate() < birth.getDate()) {
+    age--;
+  }
+  return age;
+}
+__name(calculateAge, "calculateAge");
+function calculateYearsOfExperience(hireDate) {
+  if (!hireDate)
+    return null;
+  const formattedDate = formatDate(hireDate);
+  if (!formattedDate)
+    return null;
+  const hire = new Date(formattedDate);
+  const today = /* @__PURE__ */ new Date();
+  let years = today.getFullYear() - hire.getFullYear();
+  const monthDiff = today.getMonth() - hire.getMonth();
+  if (monthDiff < 0 || monthDiff === 0 && today.getDate() < hire.getDate()) {
+    years--;
+  }
+  return years;
+}
+__name(calculateYearsOfExperience, "calculateYearsOfExperience");
+function pickProps(source, keys) {
+  const result = {};
+  for (const key of keys) {
+    if (source[key] !== void 0) {
+      result[key] = source[key];
+    }
+  }
+  return result;
+}
+__name(pickProps, "pickProps");
+var isEmpty = _isEmpty;
+var isPath = /* @__PURE__ */ __name((img) => typeof img === "string" && img.trim().length > 0 && (img.startsWith("/") || img.startsWith("http") || img.startsWith("storage/")), "isPath");
+var isFile = /* @__PURE__ */ __name((img) => !!img && typeof img !== "string" && img instanceof File, "isFile");
+
+// src/identity/presets.ts
+var compactPhone = /* @__PURE__ */ __name((value) => value.trim().replace(/[\s().-]+/g, ""), "compactPhone");
+var MOROCCO_LOCAL = /^0\d{9}$/;
+var MOROCCO_NATIONAL = /^212\d{9}$/;
+var MOROCCO_E164 = /^\+212\d{9}$/;
+var normalizeMoroccanPhone = /* @__PURE__ */ __name((value) => {
+  const compact = compactPhone(value);
+  if (MOROCCO_LOCAL.test(compact))
+    return `+212${compact.slice(1)}`;
+  if (MOROCCO_NATIONAL.test(compact))
+    return `+${compact}`;
+  if (MOROCCO_E164.test(compact))
+    return compact;
+  return null;
+}, "normalizeMoroccanPhone");
+var moroccoIdentityPreset = {
+  name: "ma",
+  normalize: normalizeMoroccanPhone
+};
+var TUNISIA_LOCAL = /^\d{8}$/;
+var TUNISIA_NATIONAL = /^216\d{8}$/;
+var TUNISIA_E164 = /^\+216\d{8}$/;
+var normalizeTunisianPhone = /* @__PURE__ */ __name((value) => {
+  const compact = compactPhone(value);
+  if (TUNISIA_LOCAL.test(compact))
+    return `+216${compact}`;
+  if (TUNISIA_NATIONAL.test(compact))
+    return `+${compact}`;
+  if (TUNISIA_E164.test(compact))
+    return compact;
+  return null;
+}, "normalizeTunisianPhone");
+var tunisiaIdentityPreset = {
+  name: "tn",
+  normalize: normalizeTunisianPhone
+};
+var IDENTITY_PRESETS = {
+  ma: moroccoIdentityPreset,
+  tn: tunisiaIdentityPreset
+};
+var DEFAULT_IDENTITY_PRESET = "ma";
+
+// src/identity/resolver.ts
+var MAX_IDENTIFIER_LENGTH = 254;
+var E164 = /^\+[1-9]\d{7,14}$/;
+var normalizeE164 = /* @__PURE__ */ __name((value) => {
+  const compact = compactPhone(value);
+  const international = compact.startsWith("00") ? `+${compact.slice(2)}` : compact;
+  return E164.test(international) ? international : null;
+}, "normalizeE164");
+var selectPreset = /* @__PURE__ */ __name((preset) => {
+  if (preset === null)
+    return null;
+  if (preset === void 0)
+    return IDENTITY_PRESETS[DEFAULT_IDENTITY_PRESET];
+  if (typeof preset === "string") {
+    const selected = IDENTITY_PRESETS[preset];
+    if (!selected)
+      throw new Error(`auth.identity.preset '${preset}' is not a built-in identity preset`);
+    return selected;
   }
-  /**
-   * Keep revocation through both credential lifetimes. If deleting the refresh
-   * row fails, its still-valid cookie must remain denied after access expires.
-   */
-  async markFamilyRevoked(tokenFamily) {
-    await this.cache.set(this.revokedFamilyKey(tokenFamily), "1", Math.max(this.accessTokenTtlMs, this.refreshTokenTtlMs));
-    await this.cache.del(this.familyKey(tokenFamily));
+  if (typeof preset.normalize !== "function") {
+    throw new Error("auth.identity.preset must expose a normalize(value) function");
   }
-  async isFamilyRevoked(tokenFamily) {
-    return await this.cache.get(this.revokedFamilyKey(tokenFamily)) !== null;
+  return preset;
+}, "selectPreset");
+function createIdentityResolver(config) {
+  const preset = selectPreset(config?.preset);
+  const extend = config?.extend ?? [];
+  if (extend.some((normalizer) => typeof normalizer !== "function")) {
+    throw new Error("auth.identity.extend must contain only normalizer functions");
   }
-};
-__decorate9([
-  Inject6(AUTH_CONFIG),
-  __metadata9("design:type", Object)
-], SessionInvalidationService.prototype, "config", void 0);
-SessionInvalidationService = SessionInvalidationService_1 = __decorate9([
-  Injectable5(),
-  __metadata9("design:paramtypes", [typeof (_a5 = typeof CacheService !== "undefined" && CacheService) === "function" ? _a5 : Object, typeof (_b3 = typeof TokenRepository !== "undefined" && TokenRepository) === "function" ? _b3 : Object])
-], SessionInvalidationService);
-function familiesOf(rows) {
-  if (!Array.isArray(rows))
-    return [];
-  return rows.map((row) => row?.tokenFamily).filter((family) => typeof family === "string" && family.length > 0);
+  const pipeline = [
+    ...extend,
+    ...preset ? [preset.normalize] : [],
+    normalizeE164
+  ];
+  return (value) => {
+    if (typeof value !== "string")
+      return null;
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.length > MAX_IDENTIFIER_LENGTH)
+      return null;
+    if (trimmed.includes("@"))
+      return trimmed.toLowerCase();
+    for (const normalize of pipeline) {
+      const normalized = normalize(trimmed);
+      if (normalized)
+        return normalized;
+    }
+    return null;
+  };
 }
-__name(familiesOf, "familiesOf");
+__name(createIdentityResolver, "createIdentityResolver");
+var defaultResolver = createIdentityResolver();
+function normalizeAuthIdentifier(value) {
+  return defaultResolver(value);
+}
+__name(normalizeAuthIdentifier, "normalizeAuthIdentifier");
+function isEmailIdentifier(value) {
+  return value.includes("@");
+}
+__name(isEmailIdentifier, "isEmailIdentifier");
 
 // src/users/UserService.ts
+import { Err as Err5 } from "najm-core";
 var __decorate10 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1772,8 +1854,8 @@ var __param2 = function(paramIndex, decorator) {
 };
 var _a6;
 var _b4;
-var _c;
-var _d;
+var _c3;
+var _d2;
 var _e;
 var _f;
 var _g;
@@ -1905,7 +1987,7 @@ var UserService = class UserService2 {
     const userDetails = {
       id: userId,
       name: name || null,
-      email: email2,
+      email: email2.trim().toLowerCase(),
       image,
       password: hashedPassword,
       roleId: resolvedRoleId,
@@ -1913,7 +1995,7 @@ var UserService = class UserService2 {
       ...normalizedPhone ? { phone: normalizedPhone } : {},
       status: data.status ?? this.authConfig.registrationMode ?? "active"
     };
-    const newUser = await this.userRepository.create(userDetails);
+    const newUser = await this.userValidator.writeUnique(() => this.userRepository.create(userDetails));
     return this.sanitizeUser(newUser);
   }
   /**
@@ -1939,8 +2021,19 @@ var UserService = class UserService2 {
       image,
       ...hashedPassword && { password: hashedPassword }
     };
+    if (typeof data.email === "string")
+      updateData.email = data.email.trim().toLowerCase();
+    if (data.phone !== void 0 && data.phone !== null) {
+      const phone = this.authConfig.identity?.resolve(data.phone) ?? normalizeAuthIdentifier(data.phone);
+      if (!phone || !E164_PHONE.test(phone))
+        Err5("A valid phone number is required", 400);
+      await this.userValidator.checkPhoneUnique(phone, id);
+      updateData.phone = phone;
+    }
     const cleanedUpdateData = clean(updateData);
-    const updatedUser = await this.userRepository.update(id, cleanedUpdateData);
+    const updatedUser = await this.userValidator.writeUnique(() => options.expectedCredential ? this.userRepository.updateWithCredential(id, cleanedUpdateData, options.expectedCredential) : this.userRepository.update(id, cleanedUpdateData));
+    if (options.expectedCredential)
+      this.userValidator.checkCredentialUnchanged(updatedUser);
     const result = this.sanitizeUser(this.requireUser(updatedUser));
     if (SessionInvalidationService.affectsSecurityState(cleanedUpdateData)) {
       await this.invalidateSessions(id);
@@ -2033,20 +2126,20 @@ __decorate10([
 UserService = __decorate10([
   Injectable6(),
   __param2(6, Inject7(AUTH_CONFIG)),
-  __metadata10("design:paramtypes", [typeof (_a6 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _a6 : Object, typeof (_b4 = typeof RoleService !== "undefined" && RoleService) === "function" ? _b4 : Object, typeof (_c = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _c : Object, typeof (_d = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _d : Object, typeof (_e = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _e : Object, typeof (_f = typeof I18nService !== "undefined" && I18nService) === "function" ? _f : Object, Object, typeof (_g = typeof SessionInvalidationService !== "undefined" && SessionInvalidationService) === "function" ? _g : Object])
+  __metadata10("design:paramtypes", [typeof (_a6 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _a6 : Object, typeof (_b4 = typeof RoleService !== "undefined" && RoleService) === "function" ? _b4 : Object, typeof (_c3 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _c3 : Object, typeof (_d2 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _d2 : Object, typeof (_e = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _e : Object, typeof (_f = typeof I18nService !== "undefined" && I18nService) === "function" ? _f : Object, Object, typeof (_g = typeof SessionInvalidationService !== "undefined" && SessionInvalidationService) === "function" ? _g : Object])
 ], UserService);
 
 // src/tokens/TokenService.ts
 import { Injectable as Injectable7, Inject as Inject9 } from "najm-core";
 import { I18n as I18n5 } from "najm-i18n";
 import { CacheService as CacheService2 } from "najm-cache";
-import { createHash, createHmac } from "crypto";
+import { createHash, createHmac as createHmac2 } from "crypto";
 import jwt from "jsonwebtoken";
 import { nanoid as nanoid4 } from "nanoid";
 import timestring3 from "timestring";
 
 // src/credentialSetup/CredentialSetupRequirementRepository.ts
-import { and as and2, eq as eq5 } from "drizzle-orm";
+import { and as and3, eq as eq5 } from "drizzle-orm";
 import { Err as Err6, Inject as Inject8, Repository as Repository4 } from "najm-core";
 import { DB as DB4 } from "najm-database";
 var __decorate11 = function(decorators, target, key, desc) {
@@ -2090,16 +2183,16 @@ var CredentialSetupRequirementRepository = class CredentialSetupRequirementRepos
     return requirement;
   }
   async find(userId, purpose) {
-    const [requirement] = await this.db.select(this.columns).from(this.requirements).where(and2(eq5(this.requirements.userId, userId), eq5(this.requirements.purpose, purpose))).limit(1);
+    const [requirement] = await this.db.select(this.columns).from(this.requirements).where(and3(eq5(this.requirements.userId, userId), eq5(this.requirements.purpose, purpose))).limit(1);
     return requirement;
   }
   async listRequired(userId) {
-    return this.db.select(this.columns).from(this.requirements).where(and2(eq5(this.requirements.userId, userId), eq5(this.requirements.required, true)));
+    return this.db.select(this.columns).from(this.requirements).where(and3(eq5(this.requirements.userId, userId), eq5(this.requirements.required, true)));
   }
   /** Only a still-required row completes, so a replayed completion is a no-op. */
   async complete(userId, purpose) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const [requirement] = await this.db.update(this.requirements).set({ required: false, completedAt: now, updatedAt: now }).where(and2(eq5(this.requirements.userId, userId), eq5(this.requirements.purpose, purpose), eq5(this.requirements.required, true))).returning(this.columns);
+    const [requirement] = await this.db.update(this.requirements).set({ required: false, completedAt: now, updatedAt: now }).where(and3(eq5(this.requirements.userId, userId), eq5(this.requirements.purpose, purpose), eq5(this.requirements.required, true))).returning(this.columns);
     return requirement;
   }
 };
@@ -2138,6 +2231,15 @@ __name(storedTimeMs, "storedTimeMs");
 
 // src/tokens/TokenService.ts
 import { Err as Err7 } from "najm-core";
+
+// src/auth/credentialState.ts
+import { createHmac } from "crypto";
+function credentialFingerprint(secret, user) {
+  return createHmac("sha256", secret).update("najm:set-password:v1:").update(JSON.stringify([user.id, user.password, user.email, user.status, user.emailVerified])).digest("base64url");
+}
+__name(credentialFingerprint, "credentialFingerprint");
+
+// src/tokens/TokenService.ts
 var __decorate12 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -2150,8 +2252,8 @@ var __metadata12 = function(k, v) {
 var TokenService_1;
 var _a7;
 var _b5;
-var _c2;
-var _d2;
+var _c4;
+var _d3;
 var _e2;
 var TokenService = class TokenService2 {
   static {
@@ -2220,10 +2322,13 @@ var TokenService = class TokenService2 {
   async verifyAccessToken(token) {
     let payload;
     try {
-      payload = jwt.verify(token, this.config.jwt.accessSecret);
+      payload = jwt.verify(token, this.config.jwt.accessSecret, { algorithms: ["HS256"] });
     } catch {
       Err7(this.t("errors.tokenVerificationFailed"), 401);
     }
+    if (!payload || typeof payload !== "object" || "type" in payload && payload.type !== "access" || typeof payload.userId !== "string" || !payload.userId || typeof payload.tokenFamily !== "string" || !payload.tokenFamily || !Number.isFinite(payload.exp) || payload.sessionVersion !== void 0 && (!Number.isSafeInteger(payload.sessionVersion) || payload.sessionVersion < 0)) {
+      Err7(this.t("errors.tokenVerificationFailed"), 401);
+    }
     const sessionKey = this.sessionVersionKey(payload.userId);
     const blacklistKey = payload.jti ? `${this.blacklistPrefix}${payload.jti}` : null;
     const revokedKey = payload.tokenFamily ? this.revokedFamilyKey(payload.tokenFamily) : null;
@@ -2255,14 +2360,14 @@ var TokenService = class TokenService2 {
   verifyRefreshToken(token) {
     let decoded;
     try {
-      decoded = jwt.verify(token, this.config.jwt.refreshSecret);
+      decoded = jwt.verify(token, this.config.jwt.refreshSecret, { algorithms: ["HS256"] });
     } catch {
       Err7(this.t("errors.tokenVerificationFailed"), 401);
     }
-    if (decoded.type && decoded.type !== "refresh") {
+    if (!decoded || typeof decoded !== "object" || decoded.type !== "refresh" || typeof decoded.userId !== "string" || !decoded.userId || !Number.isFinite(decoded.exp)) {
       Err7(this.t("errors.tokenVerificationFailed"), 401);
     }
-    if (!decoded.tokenFamily) {
+    if (typeof decoded.tokenFamily !== "string" || !decoded.tokenFamily) {
       Err7(this.t("errors.tokenVerificationFailed"), 401);
     }
     return { userId: decoded.userId, tokenFamily: decoded.tokenFamily };
@@ -2329,8 +2434,9 @@ var TokenService = class TokenService2 {
    */
   async recoverSessionFromCookie() {
     const { userId, tokenFamily } = await this.resolveRefreshSessionFromCookie();
-    const user = await this.requireActiveRefreshUser(userId, tokenFamily);
     const sessionVersion = await this.getUserSessionVersion(userId);
+    const user = await this.requireActiveRefreshUser(userId, tokenFamily);
+    await this.assertSessionVersion(userId, sessionVersion);
     return {
       user,
       roles: user.role ? [user.role] : [],
@@ -2367,16 +2473,18 @@ var TokenService = class TokenService2 {
     return user;
   }
   async getUserById(userId) {
-    const cacheKey = `auth:user:${userId}`;
+    const version = await this.getUserSessionVersion(userId);
+    const cacheKey = `auth:user:${userId}:${version}`;
     if (typeof this.cache.getOrSet === "function") {
-      return this.cache.getOrSet(cacheKey, () => this.tokenRepository.getUser(userId), 3e4);
+      const user2 = await this.cache.getOrSet(cacheKey, () => this.tokenRepository.getUser(userId), 3e4);
+      await this.assertSessionVersion(userId, version);
+      return user2;
     }
     const cached = await this.cache.get(cacheKey);
-    if (cached)
-      return JSON.parse(cached);
-    const user = await this.tokenRepository.getUser(userId);
-    if (user)
+    const user = cached ? JSON.parse(cached) : await this.tokenRepository.getUser(userId);
+    if (!cached && user)
       await this.cache.set(cacheKey, JSON.stringify(user), 3e4);
+    await this.assertSessionVersion(userId, version);
     return user;
   }
   // ============ TOKEN GENERATION ============
@@ -2389,9 +2497,9 @@ var TokenService = class TokenService2 {
   decodeAccessToken(token) {
     return jwt.decode(token);
   }
-  async signAccessToken(data) {
+  async signAccessToken(data, capturedVersion) {
     const jti = nanoid4(16);
-    const sessionVersion = await this.getUserSessionVersion(data.userId);
+    const sessionVersion = capturedVersion ?? await this.getUserSessionVersion(data.userId);
     const expiresAt = this.expiresAt(this.config.jwt.accessExpiresIn);
     if (sessionVersion > 0) {
       await this.invalidation.touchSessionVersion(data.userId);
@@ -2446,7 +2554,7 @@ var TokenService = class TokenService2 {
    * rebuild the token its rotation issued and hand the browser that one.
    */
   successorRefreshToken(replaced, data, expiresAt) {
-    const jti = createHmac("sha256", this.config.jwt.refreshSecret).update(`successor:${replaced}`).digest("base64url").slice(0, 16);
+    const jti = createHmac2("sha256", this.config.jwt.refreshSecret).update(`successor:${replaced}`).digest("base64url").slice(0, 16);
     const iat = expiresAt - Math.floor(timestring3(this.config.jwt.refreshExpiresIn, "s"));
     const token = jwt.sign({ ...data, jti, type: "refresh", iat, exp: expiresAt }, this.config.jwt.refreshSecret);
     return { token, expiresAt };
@@ -2454,7 +2562,8 @@ var TokenService = class TokenService2 {
   generateRefreshToken(data) {
     return this.signRefreshToken({ userId: data.userId, tokenFamily: data.tokenFamily ?? nanoid4(16) }).token;
   }
-  async createTokenPair(userId, family, replaced) {
+  async createTokenPair(userId, family, replaced, capturedVersion) {
+    const sessionVersion = capturedVersion ?? await this.getUserSessionVersion(userId);
     const { roleName, permissions } = await this.tokenRepository.getRoleAndPermissions(userId);
     const accessTokenData = {
       userId,
@@ -2462,7 +2571,8 @@ var TokenService = class TokenService2 {
       permissions: permissions ?? [],
       tokenFamily: family
     };
-    const access = await this.signAccessToken(accessTokenData);
+    await this.assertSessionVersion(userId, sessionVersion);
+    const access = await this.signAccessToken(accessTokenData, sessionVersion);
     const refresh = replaced ? this.successorRefreshToken(replaced, { userId, tokenFamily: family }, this.expiresAt(this.config.jwt.refreshExpiresIn)) : this.signRefreshToken({ userId, tokenFamily: family });
     return {
       userId,
@@ -2476,12 +2586,20 @@ var TokenService = class TokenService2 {
       refreshTokenExpiresAt: refresh.expiresAt
     };
   }
-  async generateTokens(userId, tokenFamily) {
+  async generateTokens(userId, tokenFamily, capturedVersion) {
     const family = tokenFamily ?? nanoid4(16);
-    const generated = await this.createTokenPair(userId, family);
+    const generated = await this.createTokenPair(userId, family, void 0, capturedVersion);
     await this.storeRefreshToken(userId, generated.refreshToken, family);
+    await this.assertSessionVersion(userId, generated.sessionVersion, family);
     return generated;
   }
+  async assertSessionVersion(userId, expected, issuedFamily) {
+    if (await this.getUserSessionVersion(userId) !== expected) {
+      if (issuedFamily)
+        await this.revokeFamily(issuedFamily);
+      Err7(this.t("errors.tokenRevoked"), 401);
+    }
+  }
   // ============ TOKEN BLACKLIST (Cache) ============
   /**
    * Blacklist an access token by its jti
@@ -2565,6 +2683,7 @@ var TokenService = class TokenService2 {
     if (!await this.invalidation.markFamilyIssued(tokenFamily, userId)) {
       this.rejectRefreshSession();
     }
+    await this.assertSessionVersion(userId, generated.sessionVersion);
     return generated;
   }
   /**
@@ -2619,12 +2738,15 @@ var TokenService = class TokenService2 {
   async serveReplacedToken(userId, tokenFamily, replaced, stored) {
     const successor = this.successorRefreshToken(replaced, { userId, tokenFamily }, Math.floor(storedTimeMs(stored.expiresAt) / 1e3));
     const refresh = this.hashToken(successor.token) === stored.token ? successor : void 0;
+    const sessionVersion = await this.getUserSessionVersion(userId);
     const { roleName, permissions } = await this.tokenRepository.getRoleAndPermissions(userId);
     const roles = roleName ? [roleName] : [];
-    const access = await this.signAccessToken({ userId, roles, permissions: permissions ?? [], tokenFamily });
+    await this.assertSessionVersion(userId, sessionVersion);
+    const access = await this.signAccessToken({ userId, roles, permissions: permissions ?? [], tokenFamily }, sessionVersion);
     if (!await this.invalidation.markFamilyIssued(tokenFamily, userId)) {
       this.rejectRefreshSession();
     }
+    await this.assertSessionVersion(userId, sessionVersion);
     return {
       userId,
       tokenFamily,
@@ -2652,11 +2774,7 @@ var TokenService = class TokenService2 {
   }
   /** Revoke every refresh session for a user (password change/reset, logout-all). */
   async revokeAllForUser(userId) {
-    const revoked = await this.tokenRepository.revokeAllForUser(userId);
-    if (Array.isArray(revoked)) {
-      await Promise.all(revoked.map((row) => row?.tokenFamily).filter((family) => typeof family === "string" && !!family).map((family) => this.invalidation.markFamilyRevoked(family)));
-    }
-    return revoked;
+    return this.invalidation.revokeAllForUser(userId);
   }
   /** Revoke a single refresh session (one family). */
   async revokeFamily(tokenFamily) {
@@ -2771,34 +2889,45 @@ var TokenService = class TokenService2 {
    * account invites). Stores the jti in cache so the token can only be used
    * once, with a TTL matching the JWT expiry.
    */
-  async generateSetPasswordToken(userId, type, expiresIn) {
+  async generateSetPasswordToken(userId, type, expiresIn, expectedEmail) {
+    const user = await this.tokenRepository.getCredentialState(userId);
+    if (!user || expectedEmail !== void 0 && user.email.trim().toLowerCase() !== expectedEmail.trim().toLowerCase()) {
+      Err7(this.t("errors.invalidResetToken"), 401);
+    }
+    const credentialState = credentialFingerprint(this.config.jwt.refreshSecret, user);
     const jti = nanoid4(16);
     const data = {
       userId,
       type,
       jti,
-      timestamp: Date.now()
+      timestamp: Date.now(),
+      credentialState
     };
     const token = jwt.sign(data, this.config.jwt.refreshSecret, {
       expiresIn
     });
     await this.cache.set(`${this.resetTokenPrefix}${userId}`, jti, timestring3(expiresIn, "ms"));
+    const current = await this.tokenRepository.getCredentialState(userId);
+    if (!current || credentialFingerprint(this.config.jwt.refreshSecret, current) !== credentialState) {
+      await this.discardSetPasswordToken(userId, jti);
+      Err7(this.t("errors.invalidResetToken"), 401);
+    }
     return { token, userId, jti };
   }
   /**
    * Generate secure password reset token
    * Returns both the plain token (to send via email) and userId for identification
    */
-  async generateResetToken(userId) {
-    return this.generateSetPasswordToken(userId, "reset", "1h");
+  async generateResetToken(userId, expectedEmail) {
+    return this.generateSetPasswordToken(userId, "reset", "1h", expectedEmail);
   }
   /**
    * Generate secure account-invite token.
    * Longer expiry (3d) than reset because an invited user may not check
    * their email immediately. Consumed via the same reset-password endpoint.
    */
-  async generateInviteToken(userId) {
-    return this.generateSetPasswordToken(userId, "invite", "3d");
+  async generateInviteToken(userId, expectedEmail) {
+    return this.generateSetPasswordToken(userId, "invite", "3d", expectedEmail);
   }
   /**
    * Discard a set-password token this process just minted, identified by the
@@ -2836,11 +2965,11 @@ var TokenService = class TokenService2 {
   async consumeSetPasswordToken(token) {
     let decoded;
     try {
-      decoded = jwt.verify(token, this.config.jwt.refreshSecret);
+      decoded = jwt.verify(token, this.config.jwt.refreshSecret, { algorithms: ["HS256"] });
     } catch {
       Err7(this.t("errors.resetTokenExpired"));
     }
-    if (decoded.type !== "reset" && decoded.type !== "invite" || !decoded.jti) {
+    if (!decoded || typeof decoded !== "object" || decoded.type !== "reset" && decoded.type !== "invite" || typeof decoded.userId !== "string" || !decoded.userId || typeof decoded.jti !== "string" || !decoded.jti || typeof decoded.credentialState !== "string" || !decoded.credentialState || !Number.isFinite(decoded.exp)) {
       Err7(this.t("errors.invalidResetToken"));
     }
     const consume = this.cache.compareAndDelete;
@@ -2848,12 +2977,21 @@ var TokenService = class TokenService2 {
       Err7.invalidOperation("Password reset requires a cache with atomic compare-and-delete");
     }
     const key = `${this.resetTokenPrefix}${decoded.userId}`;
+    const matches = /* @__PURE__ */ __name(async () => {
+      const current = await this.tokenRepository.getCredentialState(decoded.userId);
+      return current && credentialFingerprint(this.config.jwt.refreshSecret, current) === decoded.credentialState;
+    }, "matches");
+    if (!await matches())
+      Err7(this.t("errors.invalidResetToken"));
     if (!await consume.call(this.cache, key, decoded.jti)) {
       Err7(this.t("errors.invalidResetToken"));
     }
+    if (!await matches())
+      Err7(this.t("errors.invalidResetToken"));
     return {
       userId: decoded.userId,
-      type: decoded.type
+      type: decoded.type,
+      credentialState: decoded.credentialState
     };
   }
   /**
@@ -2878,7 +3016,7 @@ __decorate12([
 ], TokenService.prototype, "t", void 0);
 TokenService = TokenService_1 = __decorate12([
   Injectable7(),
-  __metadata12("design:paramtypes", [typeof (_a7 = typeof TokenRepository !== "undefined" && TokenRepository) === "function" ? _a7 : Object, typeof (_b5 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _b5 : Object, typeof (_c2 = typeof CacheService2 !== "undefined" && CacheService2) === "function" ? _c2 : Object, typeof (_d2 = typeof CredentialSetupRequirementRepository !== "undefined" && CredentialSetupRequirementRepository) === "function" ? _d2 : Object, typeof (_e2 = typeof SessionInvalidationService !== "undefined" && SessionInvalidationService) === "function" ? _e2 : Object])
+  __metadata12("design:paramtypes", [typeof (_a7 = typeof TokenRepository !== "undefined" && TokenRepository) === "function" ? _a7 : Object, typeof (_b5 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _b5 : Object, typeof (_c4 = typeof CacheService2 !== "undefined" && CacheService2) === "function" ? _c4 : Object, typeof (_d3 = typeof CredentialSetupRequirementRepository !== "undefined" && CredentialSetupRequirementRepository) === "function" ? _d3 : Object, typeof (_e2 = typeof SessionInvalidationService !== "undefined" && SessionInvalidationService) === "function" ? _e2 : Object])
 ], TokenService);
 
 // src/auth/AuthService.ts
@@ -2972,7 +3110,7 @@ var __metadata13 = function(k, v) {
 };
 var _a8;
 var _b6;
-var _c3;
+var _c5;
 var CredentialSetupRequirementService = class CredentialSetupRequirementService2 {
   static {
     __name(this, "CredentialSetupRequirementService");
@@ -3015,7 +3153,7 @@ __decorate13([
   Transaction2({ retries: 2 }),
   __metadata13("design:type", Function),
   __metadata13("design:paramtypes", [String, String, Object]),
-  __metadata13("design:returntype", typeof (_c3 = typeof Promise !== "undefined" && Promise) === "function" ? _c3 : Object)
+  __metadata13("design:returntype", typeof (_c5 = typeof Promise !== "undefined" && Promise) === "function" ? _c5 : Object)
 ], CredentialSetupRequirementService.prototype, "markRequired", null);
 CredentialSetupRequirementService = __decorate13([
   Injectable8(),
@@ -3044,6 +3182,9 @@ var credentialSetupError = /* @__PURE__ */ __name((code, message, status = 400)
   throw new BaseError(code, message, status);
 }, "credentialSetupError");
 
+// src/auth/verifiedCredential.ts
+var verifiedCredentials = /* @__PURE__ */ new WeakMap();
+
 // src/auth/AuthSessionService.ts
 var __decorate14 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -3056,8 +3197,8 @@ var __metadata14 = function(k, v) {
 };
 var _a9;
 var _b7;
-var _c4;
-var _d3;
+var _c6;
+var _d4;
 var AuthSessionService = class AuthSessionService2 {
   static {
     __name(this, "AuthSessionService");
@@ -3073,17 +3214,28 @@ var AuthSessionService = class AuthSessionService2 {
     this.credentialSetupRequirements = credentialSetupRequirements;
   }
   async establish(user) {
-    if (user.status !== "active") {
+    const sessionVersion = await this.tokenService.getSessionVersion(user.id);
+    const current = await this.userService.getAuthRecordById(user.id);
+    if (!current || current.status !== "active" || user.status !== "active") {
       Err9("oauth_account_inactive", 403);
     }
+    const verifiedHash = verifiedCredentials.get(user);
+    if (verifiedHash !== void 0 && verifiedHash !== current.password || ["email", "phone", "emailVerified", "roleId"].some((field) => field in user && (user[field] ?? null) !== (current[field] ?? null))) {
+      Err9("errors.invalidCredentials", 401);
+    }
     if (await this.credentialSetupRequirements?.isRequired(user.id, PASSWORD_SETUP_PURPOSE)) {
       credentialSetupError(CREDENTIAL_SETUP_CODES.REQUIRED, "Credential setup is required before a session can be established", 403);
     }
     await this.tokenService.deleteExpiredSessions();
-    const generated = await this.tokenService.generateTokens(user.id);
-    this.cookieManager.setRefreshToken(generated.refreshToken);
+    const generated = await this.tokenService.generateTokens(user.id, void 0, sessionVersion);
     await this.userService.updateLastLogin(user.id);
-    const { roles, permissions, sessionVersion, tokenFamily } = generated;
+    if (await this.tokenService.getSessionVersion(user.id) !== generated.sessionVersion) {
+      await this.tokenService.revokeFamily(generated.tokenFamily);
+      Err9("errors.tokenRevoked", 401);
+    }
+    this.cookieManager.setRefreshToken(generated.refreshToken);
+    const { roles, permissions, tokenFamily } = generated;
+    user = { ...user, role: roles[0] ?? null };
     this.cookieManager.setSessionCookie({
       user: {
         id: user.id,
@@ -3103,22 +3255,22 @@ var AuthSessionService = class AuthSessionService2 {
 };
 AuthSessionService = __decorate14([
   Injectable9(),
-  __metadata14("design:paramtypes", [typeof (_a9 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a9 : Object, typeof (_b7 = typeof UserService !== "undefined" && UserService) === "function" ? _b7 : Object, typeof (_c4 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c4 : Object, typeof (_d3 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _d3 : Object])
+  __metadata14("design:paramtypes", [typeof (_a9 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a9 : Object, typeof (_b7 = typeof UserService !== "undefined" && UserService) === "function" ? _b7 : Object, typeof (_c6 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c6 : Object, typeof (_d4 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _d4 : Object])
 ], AuthSessionService);
 
 // src/credentialSetup/PasswordSetupService.ts
-import { Inject as Inject11, Injectable as Injectable11 } from "najm-core";
+import { Inject as Inject12, Injectable as Injectable11 } from "najm-core";
 import { I18n as I18n7 } from "najm-i18n";
 
 // src/credentialSetup/CredentialSetupService.ts
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
 import { CookieService as CookieService2 } from "najm-cookies";
-import { Err as Err11, Injectable as Injectable10 } from "najm-core";
+import { Err as Err11, Inject as Inject11, Injectable as Injectable10 } from "najm-core";
 import { Transaction as Transaction3 } from "najm-database";
 import { I18n as I18n6 } from "najm-i18n";
 
 // src/credentialSetup/CredentialSetupRepository.ts
-import { and as and3, eq as eq6, gt, isNull as isNull2, lt as lt2 } from "drizzle-orm";
+import { and as and4, eq as eq6, gt, isNull as isNull3, lt as lt2 } from "drizzle-orm";
 import { Err as Err10, Inject as Inject10, Repository as Repository5 } from "najm-core";
 import { DB as DB5 } from "najm-database";
 var __decorate15 = function(decorators, target, key, desc) {
@@ -3145,7 +3297,7 @@ var CredentialSetupRepository = class CredentialSetupRepository2 {
   }
   async replaceActive(data) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    await this.db.update(this.sessions).set({ revokedAt: now, updatedAt: now }).where(and3(eq6(this.sessions.userId, data.userId), eq6(this.sessions.purpose, data.purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt)));
+    await this.db.update(this.sessions).set({ revokedAt: now, updatedAt: now }).where(and4(eq6(this.sessions.userId, data.userId), eq6(this.sessions.purpose, data.purpose), isNull3(this.sessions.consumedAt), isNull3(this.sessions.revokedAt)));
     const [session] = await this.db.insert(this.sessions).values(data).returning({
       userId: this.sessions.userId,
       purpose: this.sessions.purpose,
@@ -3158,12 +3310,12 @@ var CredentialSetupRepository = class CredentialSetupRepository2 {
       userId: this.sessions.userId,
       purpose: this.sessions.purpose,
       expiresAt: this.sessions.expiresAt
-    }).from(this.sessions).where(and3(eq6(this.sessions.tokenHash, tokenHash), eq6(this.sessions.purpose, purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt), gt(this.sessions.expiresAt, (/* @__PURE__ */ new Date()).toISOString()))).limit(1);
+    }).from(this.sessions).where(and4(eq6(this.sessions.tokenHash, tokenHash), eq6(this.sessions.purpose, purpose), isNull3(this.sessions.consumedAt), isNull3(this.sessions.revokedAt), gt(this.sessions.expiresAt, (/* @__PURE__ */ new Date()).toISOString()))).limit(1);
     return session;
   }
   async consume(tokenHash, purpose) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const [session] = await this.db.update(this.sessions).set({ consumedAt: now, updatedAt: now }).where(and3(eq6(this.sessions.tokenHash, tokenHash), eq6(this.sessions.purpose, purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt), gt(this.sessions.expiresAt, now))).returning({
+    const [session] = await this.db.update(this.sessions).set({ consumedAt: now, updatedAt: now }).where(and4(eq6(this.sessions.tokenHash, tokenHash), eq6(this.sessions.purpose, purpose), isNull3(this.sessions.consumedAt), isNull3(this.sessions.revokedAt), gt(this.sessions.expiresAt, now))).returning({
       userId: this.sessions.userId,
       purpose: this.sessions.purpose,
       expiresAt: this.sessions.expiresAt
@@ -3172,7 +3324,7 @@ var CredentialSetupRepository = class CredentialSetupRepository2 {
   }
   async revoke(tokenHash, purpose) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const [session] = await this.db.update(this.sessions).set({ revokedAt: now, updatedAt: now }).where(and3(eq6(this.sessions.tokenHash, tokenHash), eq6(this.sessions.purpose, purpose), isNull2(this.sessions.consumedAt), isNull2(this.sessions.revokedAt))).returning({ userId: this.sessions.userId });
+    const [session] = await this.db.update(this.sessions).set({ revokedAt: now, updatedAt: now }).where(and4(eq6(this.sessions.tokenHash, tokenHash), eq6(this.sessions.purpose, purpose), isNull3(this.sessions.consumedAt), isNull3(this.sessions.revokedAt))).returning({ userId: this.sessions.userId });
     return session;
   }
   async deleteExpired() {
@@ -3203,11 +3355,12 @@ var __metadata16 = function(k, v) {
 };
 var _a10;
 var _b8;
-var _c5;
-var _d4;
+var _c7;
+var _d5;
 var _e3;
 var _f2;
 var _g2;
+var _h2;
 var DEFAULT_CREDENTIAL_SETUP_COOKIE_NAME = "najm.credential-setup";
 var DEFAULT_CREDENTIAL_SETUP_TTL_MS = 10 * 60 * 1e3;
 var MAX_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -3220,12 +3373,15 @@ var CredentialSetupService = class CredentialSetupService2 {
   tokens;
   authCookies;
   cookies;
+  users;
   t;
-  constructor(repository, tokens, authCookies, cookies2) {
+  config;
+  constructor(repository, tokens, authCookies, cookies2, users) {
     this.repository = repository;
     this.tokens = tokens;
     this.authCookies = authCookies;
     this.cookies = cookies2;
+    this.users = users;
   }
   /**
    * Revoke normal auth sessions and issue a single-purpose, short-lived,
@@ -3233,7 +3389,10 @@ var CredentialSetupService = class CredentialSetupService2 {
    */
   async begin(userId, options) {
     const resolved = this.resolveOptions(options);
-    const token = randomBytes2(32).toString("base64url");
+    const user = await this.users.getRawById(userId);
+    if (!user)
+      this.sessionInvalid();
+    const token = `${randomBytes2(32).toString("base64url")}.${credentialFingerprint(this.config.jwt.refreshSecret, user)}`;
     const expiresAt = new Date(Date.now() + resolved.ttlMs).toISOString();
     await this.repository.deleteExpired();
     await this.repository.replaceActive({
@@ -3244,6 +3403,7 @@ var CredentialSetupService = class CredentialSetupService2 {
     });
     await this.tokens.invalidateUserAccessTokens(userId);
     await this.tokens.revokeAllForUser(userId);
+    await this.requireCurrentCredential(userId, token, resolved);
     this.authCookies.clearRefreshToken();
     this.authCookies.clearSessionCookie();
     this.setCookie(token, resolved);
@@ -3260,6 +3420,7 @@ var CredentialSetupService = class CredentialSetupService2 {
       this.clearCookie(resolved);
       this.sessionInvalid();
     }
+    await this.requireCurrentCredential(session.userId, token, resolved);
     return session;
   }
   /**
@@ -3277,10 +3438,19 @@ var CredentialSetupService = class CredentialSetupService2 {
       this.clearCookie(resolved);
       this.sessionInvalid();
     }
+    await this.requireCurrentCredential(session.userId, token, resolved);
     const result = await complete(session);
     this.clearCookie(resolved);
     return result;
   }
+  async requireCurrentCredential(userId, token, options) {
+    const fingerprint = token.split(".")[1];
+    const user = await this.users.getRawById(userId);
+    if (!fingerprint || !user || credentialFingerprint(this.config.jwt.refreshSecret, user) !== fingerprint) {
+      this.clearCookie(options);
+      this.sessionInvalid();
+    }
+  }
   async cancel(options) {
     const resolved = this.resolveOptions(options);
     const token = this.cookies.get(resolved.cookieName);
@@ -3345,27 +3515,31 @@ __decorate16([
   I18n6("auth"),
   __metadata16("design:type", Object)
 ], CredentialSetupService.prototype, "t", void 0);
+__decorate16([
+  Inject11(AUTH_CONFIG),
+  __metadata16("design:type", Object)
+], CredentialSetupService.prototype, "config", void 0);
 __decorate16([
   Transaction3({ retries: 2 }),
   __metadata16("design:type", Function),
   __metadata16("design:paramtypes", [String, Object]),
-  __metadata16("design:returntype", typeof (_e3 = typeof Promise !== "undefined" && Promise) === "function" ? _e3 : Object)
+  __metadata16("design:returntype", typeof (_f2 = typeof Promise !== "undefined" && Promise) === "function" ? _f2 : Object)
 ], CredentialSetupService.prototype, "begin", null);
 __decorate16([
   Transaction3({ retries: 2 }),
   __metadata16("design:type", Function),
   __metadata16("design:paramtypes", [Object, Function]),
-  __metadata16("design:returntype", typeof (_f2 = typeof Promise !== "undefined" && Promise) === "function" ? _f2 : Object)
+  __metadata16("design:returntype", typeof (_g2 = typeof Promise !== "undefined" && Promise) === "function" ? _g2 : Object)
 ], CredentialSetupService.prototype, "consume", null);
 __decorate16([
   Transaction3({ retries: 2 }),
   __metadata16("design:type", Function),
   __metadata16("design:paramtypes", [Object]),
-  __metadata16("design:returntype", typeof (_g2 = typeof Promise !== "undefined" && Promise) === "function" ? _g2 : Object)
+  __metadata16("design:returntype", typeof (_h2 = typeof Promise !== "undefined" && Promise) === "function" ? _h2 : Object)
 ], CredentialSetupService.prototype, "cancel", null);
 CredentialSetupService = __decorate16([
   Injectable10(),
-  __metadata16("design:paramtypes", [typeof (_a10 = typeof CredentialSetupRepository !== "undefined" && CredentialSetupRepository) === "function" ? _a10 : Object, typeof (_b8 = typeof TokenService !== "undefined" && TokenService) === "function" ? _b8 : Object, typeof (_c5 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c5 : Object, typeof (_d4 = typeof CookieService2 !== "undefined" && CookieService2) === "function" ? _d4 : Object])
+  __metadata16("design:paramtypes", [typeof (_a10 = typeof CredentialSetupRepository !== "undefined" && CredentialSetupRepository) === "function" ? _a10 : Object, typeof (_b8 = typeof TokenService !== "undefined" && TokenService) === "function" ? _b8 : Object, typeof (_c7 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _c7 : Object, typeof (_d5 = typeof CookieService2 !== "undefined" && CookieService2) === "function" ? _d5 : Object, typeof (_e3 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _e3 : Object])
 ], CredentialSetupService);
 
 // src/credentialSetup/PasswordSetupService.ts
@@ -3380,8 +3554,8 @@ var __metadata17 = function(k, v) {
 };
 var _a11;
 var _b9;
-var _c6;
-var _d5;
+var _c8;
+var _d6;
 var _e4;
 var _f3;
 var PasswordSetupService = class PasswordSetupService2 {
@@ -3440,9 +3614,9 @@ var PasswordSetupService = class PasswordSetupService2 {
    */
   async change(newPassword) {
     const { userId } = await this.setup.require(this.options);
-    const password = await this.validateReplacement(userId, newPassword);
+    const { password, credential } = await this.validateReplacement(userId, newPassword);
     const hashed = await this.encryption.hashPassword(password);
-    await this.setup.consume(this.options, (session) => this.persist(session.userId, hashed));
+    await this.setup.consume(this.options, (session) => this.persist(session.userId, hashed, credential));
     return { changed: true, signInAgain: true };
   }
   async cancel() {
@@ -3465,15 +3639,18 @@ var PasswordSetupService = class PasswordSetupService2 {
     if (await this.isCurrentPassword(newPassword, kind.normalize(newPassword), user.password)) {
       credentialSetupError(CREDENTIAL_SETUP_CODES.SAME_PASSWORD, this.message("errors.credentialSetupSamePassword", "Choose a password different from your current one."), 400);
     }
-    return newPassword;
+    return { password: newPassword, credential: user };
   }
   /**
    * Runs inside the setup-session consumption transaction, so the password
    * update, the requirement completion, and the one-time session all commit or
    * roll back together.
    */
-  async persist(userId, password) {
-    await this.userRecords.update(userId, { password });
+  async persist(userId, password, credential) {
+    if (userId !== credential.id)
+      this.validator.checkCredentialUnchanged(void 0);
+    const updated = await this.userRecords.updateWithCredential(userId, { password }, credential);
+    this.validator.checkCredentialUnchanged(updated);
     const completed = await this.requirements.completeRequirement(userId, PASSWORD_SETUP_PURPOSE);
     if (!completed) {
       credentialSetupError(CREDENTIAL_SETUP_CODES.ALREADY_COMPLETED, this.message("errors.credentialSetupAlreadyCompleted", "The password was already replaced. Please sign in again."), 409);
@@ -3485,6 +3662,9 @@ var PasswordSetupService = class PasswordSetupService2 {
     if (!parsed.success) {
       credentialSetupError(CREDENTIAL_SETUP_CODES.PASSWORD_REJECTED, parsed.error.issues[0]?.message ?? this.message("errors.credentialSetupPasswordRejected", "Choose a different password."), 422);
     }
+    if (!parsed.data || new TextEncoder().encode(parsed.data).length > 72) {
+      credentialSetupError(CREDENTIAL_SETUP_CODES.PASSWORD_REJECTED, "Password must be between 1 and 72 bytes", 422);
+    }
     return parsed.data;
   }
   /**
@@ -3500,7 +3680,7 @@ var PasswordSetupService = class PasswordSetupService2 {
   }
 };
 __decorate17([
-  Inject11(AUTH_CONFIG),
+  Inject12(AUTH_CONFIG),
   __metadata17("design:type", Object)
 ], PasswordSetupService.prototype, "config", void 0);
 __decorate17([
@@ -3509,7 +3689,7 @@ __decorate17([
 ], PasswordSetupService.prototype, "t", void 0);
 PasswordSetupService = __decorate17([
   Injectable11(),
-  __metadata17("design:paramtypes", [typeof (_a11 = typeof CredentialSetupService !== "undefined" && CredentialSetupService) === "function" ? _a11 : Object, typeof (_b9 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _b9 : Object, typeof (_c6 = typeof UserService !== "undefined" && UserService) === "function" ? _c6 : Object, typeof (_d5 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _d5 : Object, typeof (_e4 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _e4 : Object, typeof (_f3 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _f3 : Object])
+  __metadata17("design:paramtypes", [typeof (_a11 = typeof CredentialSetupService !== "undefined" && CredentialSetupService) === "function" ? _a11 : Object, typeof (_b9 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _b9 : Object, typeof (_c8 = typeof UserService !== "undefined" && UserService) === "function" ? _c8 : Object, typeof (_d6 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _d6 : Object, typeof (_e4 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _e4 : Object, typeof (_f3 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _f3 : Object])
 ], PasswordSetupService);
 
 // src/auth/AuthService.ts
@@ -3524,12 +3704,12 @@ var __metadata18 = function(k, v) {
 };
 var _a12;
 var _b10;
-var _c7;
-var _d6;
+var _c9;
+var _d7;
 var _e5;
 var _f4;
 var _g3;
-var _h2;
+var _h3;
 var _j2;
 var _k;
 var _l;
@@ -3623,7 +3803,7 @@ var AuthService = class AuthService2 {
    * Nothing here logs the token, the link, the message body, or the recipient.
    */
   async deliverInvitation(userId, email2, userName, role) {
-    const { token, jti } = await this.tokenService.generateInviteToken(userId);
+    const { token, jti } = await this.tokenService.generateInviteToken(userId, email2);
     const inviteLink = `${this.config.frontendUrl}/reset-password?token=${token}`;
     const accountType = role?.trim().toLowerCase() || void 0;
     const accountLabel = accountType ? `${accountType} account` : "account";
@@ -3817,6 +3997,7 @@ var AuthService = class AuthService2 {
       await this.userService.resetFailedAttempts(user.id);
     }
     const { password: _, failedLoginAttempts: __, lockoutUntil: ___, ...sanitized } = user;
+    verifiedCredentials.set(sanitized, storedHash);
     return { user: sanitized, requirement };
   }
   /**
@@ -3956,12 +4137,12 @@ var AuthService = class AuthService2 {
     return result;
   }
   async forgotPassword(email2) {
-    const user = await this.userService.findByEmail(email2);
+    const user = await this.userService.findByEmailInsensitive(email2);
     if (user) {
-      const { token } = await this.tokenService.generateResetToken(user.id);
-      const resetLink = `${this.config.frontendUrl}/reset-password?token=${token}`;
       try {
-        await this.emailService.sendHtml(email2, this.t("emails.passwordReset.subject"), passwordResetTemplate({
+        const { token } = await this.tokenService.generateResetToken(user.id, user.email);
+        const resetLink = `${this.config.frontendUrl}/reset-password?token=${token}`;
+        await this.emailService.sendHtml(user.email, this.t("emails.passwordReset.subject"), passwordResetTemplate({
           resetLink,
           userName: user.name || email2
         }));
@@ -3981,7 +4162,7 @@ var AuthService = class AuthService2 {
       Err12(this.t("errors.invalidCredentials"), 401);
     }
     this.userValidator.validatePasswordStrength(newPassword);
-    await this.userService.update(userId, { password: newPassword });
+    await this.userService.update(userId, { password: newPassword }, { expectedCredential: user });
     await this.tokenService.invalidateUserAccessTokens(userId);
     await this.tokenService.revokeAllForUser(userId);
     this.cookieManager.clearRefreshToken();
@@ -3991,7 +4172,10 @@ var AuthService = class AuthService2 {
   async resetPassword(token, newPassword) {
     this.userValidator.validatePasswordStrength(newPassword);
     const consumed = await this.tokenService.consumeSetPasswordToken(token);
-    const user = await this.userService.getById(consumed.userId);
+    const user = await this.userService.getAuthRecordById(consumed.userId);
+    if (!user || credentialFingerprint(this.config.jwt.refreshSecret, user) !== consumed.credentialState) {
+      Err12(this.t("errors.invalidResetToken"), 401);
+    }
     const acceptsInvitation = consumed.type === "invite";
     await this.userService.update(consumed.userId, {
       password: newPassword,
@@ -3999,7 +4183,7 @@ var AuthService = class AuthService2 {
         emailVerified: true,
         ...user.status === "pending" ? { status: "active" } : {}
       } : {}
-    });
+    }, { expectedCredential: user });
     await this.tokenService.invalidateUserAccessTokens(consumed.userId);
     await this.tokenService.revokeAllForUser(consumed.userId);
     this.cookieManager.clearRefreshToken();
@@ -4075,7 +4259,7 @@ var AuthService = class AuthService2 {
     if (!email2) {
       Err12("This account has no email address to send a password reset to", 409);
     }
-    const { token, jti } = await this.tokenService.generateResetToken(user.id);
+    const { token, jti } = await this.tokenService.generateResetToken(user.id, user.email);
     const resetLink = `${this.config.frontendUrl}/reset-password?token=${token}`;
     let emailSent = false;
     try {
@@ -4137,7 +4321,7 @@ var AuthService = class AuthService2 {
   }
 };
 __decorate18([
-  Inject12(AUTH_CONFIG),
+  Inject13(AUTH_CONFIG),
   __metadata18("design:type", Object)
 ], AuthService.prototype, "config", void 0);
 __decorate18([
@@ -4162,7 +4346,7 @@ __decorate18([
 ], AuthService.prototype, "resetToTemporaryCredential", null);
 AuthService = __decorate18([
   Injectable12(),
-  __metadata18("design:paramtypes", [typeof (_a12 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a12 : Object, typeof (_b10 = typeof UserService !== "undefined" && UserService) === "function" ? _b10 : Object, typeof (_c7 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c7 : Object, typeof (_d6 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _d6 : Object, typeof (_e5 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _e5 : Object, typeof (_f4 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _f4 : Object, typeof (_g3 = typeof EmailService !== "undefined" && EmailService) === "function" ? _g3 : Object, typeof (_h2 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _h2 : Object, typeof (_j2 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _j2 : Object, typeof (_k = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _k : Object])
+  __metadata18("design:paramtypes", [typeof (_a12 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a12 : Object, typeof (_b10 = typeof UserService !== "undefined" && UserService) === "function" ? _b10 : Object, typeof (_c9 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c9 : Object, typeof (_d7 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _d7 : Object, typeof (_e5 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _e5 : Object, typeof (_f4 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _f4 : Object, typeof (_g3 = typeof EmailService !== "undefined" && EmailService) === "function" ? _g3 : Object, typeof (_h3 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _h3 : Object, typeof (_j2 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _j2 : Object, typeof (_k = typeof PasswordSetupService !== "undefined" && PasswordSetupService) === "function" ? _k : Object])
 ], AuthService);
 
 // src/auth/AuthGuard.ts
@@ -4394,7 +4578,7 @@ var loginDto = z.union([
   })
 ]);
 var changePasswordDto = z.object({
-  currentPassword: passwordField,
+  currentPassword: loginCredentialField,
   newPassword: passwordField
 });
 var resetPasswordDto = z.object({
@@ -4617,7 +4801,7 @@ AuthController = __decorate21([
 ], AuthController);
 
 // src/auth/AuthResolver.ts
-import { APP, Container, DI, Inject as Inject13, LOGGER, Meta, Service as Service4 } from "najm-core";
+import { APP, Container, DI, Inject as Inject14, LOGGER, Meta, Service as Service4 } from "najm-core";
 import { USER, ROLE, PERMISSIONS } from "najm-guard";
 var __decorate22 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -4755,11 +4939,11 @@ __decorate22([
   __metadata22("design:type", typeof (_a14 = typeof Container !== "undefined" && Container) === "function" ? _a14 : Object)
 ], AuthResolver.prototype, "container", void 0);
 __decorate22([
-  Inject13(APP),
+  Inject14(APP),
   __metadata22("design:type", Object)
 ], AuthResolver.prototype, "app", void 0);
 __decorate22([
-  Inject13(LOGGER),
+  Inject14(LOGGER),
   __metadata22("design:type", Object)
 ], AuthResolver.prototype, "log", void 0);
 AuthResolver = __decorate22([
@@ -4768,7 +4952,7 @@ AuthResolver = __decorate22([
 ], AuthResolver);
 
 // src/auth/AuthIdentityContextService.ts
-import { DI as DI2, Inject as Inject14, INJECTION_TYPES, Meta as Meta2, Service as Service5 } from "najm-core";
+import { DI as DI2, Inject as Inject15, INJECTION_TYPES, Meta as Meta2, Service as Service5 } from "najm-core";
 var __decorate23 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -4812,12 +4996,12 @@ __decorate23([
 AuthIdentityContextService = __decorate23([
   Service5(),
   Meta2({ layer: "plugin", order: 14 }),
-  __param6(0, Inject14(AUTH_CONFIG)),
+  __param6(0, Inject15(AUTH_CONFIG)),
   __metadata23("design:paramtypes", [Object])
 ], AuthIdentityContextService);
 
 // src/auth/RegistrationController.ts
-import { Body as Body2, Controller as Controller2, Err as Err14, Inject as Inject15, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
+import { Body as Body2, Controller as Controller2, Err as Err14, Inject as Inject16, Post as Post2, ResMsg as ResMsg2 } from "najm-core";
 import { RateLimit as RateLimit2 } from "najm-rate";
 import { Public as Public2 } from "najm-guard";
 import { Validate as Validate2 } from "najm-validation";
@@ -4852,7 +5036,7 @@ var RegistrationController = class RegistrationController2 {
   }
 };
 __decorate24([
-  Inject15(AUTH_CONFIG),
+  Inject16(AUTH_CONFIG),
   __metadata24("design:type", Object)
 ], RegistrationController.prototype, "config", void 0);
 __decorate24([
@@ -5320,8 +5504,8 @@ __export(permissions_exports, {
 });
 
 // src/permissions/PermissionRepository.ts
-import { eq as eq7, and as and4 } from "drizzle-orm";
-import { Repository as Repository6, Inject as Inject16 } from "najm-core";
+import { eq as eq7, and as and5, sql as sql4 } from "drizzle-orm";
+import { Repository as Repository6, Inject as Inject17 } from "najm-core";
 import { DB as DB6 } from "najm-database";
 var __decorate27 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -5389,16 +5573,58 @@ var PermissionRepository = class PermissionRepository2 {
       description: this.roles.description
     }).from(this.rolePermissions).leftJoin(this.roles, eq7(this.rolePermissions.roleId, this.roles.id)).where(eq7(this.rolePermissions.permissionId, permissionId));
   }
+  /**
+   * Capture grants and mutate their parent in one database transaction. A
+   * PostgreSQL parent-row lock conflicts with the FK check of a concurrent
+   * grant. SQLite executes the whole callback synchronously under its write
+   * lock; an async callback would commit before its awaited queries finish.
+   */
+  async mutateWithRoles(id, mutation) {
+    const grants = /* @__PURE__ */ __name((db) => {
+      const query = db.selectDistinct({ roleId: this.rolePermissions.roleId }).from(this.rolePermissions);
+      return id === void 0 ? query : query.where(eq7(this.rolePermissions.permissionId, id));
+    }, "grants");
+    const probe = this.db.select().from(this.permissions).limit(0);
+    const sqlite = typeof probe.for !== "function";
+    if (sqlite && this.db.resultKind === "sync") {
+      return this.db.transaction((tx) => {
+        const roleIds = grants(tx).all().map((row) => row.roleId);
+        const rows = mutation(tx).returning().all();
+        return { rows, roleIds };
+      });
+    }
+    return this.db.transaction(async (tx) => {
+      if (!sqlite && id === void 0) {
+        await tx.execute(sql4`LOCK TABLE ${this.permissions} IN EXCLUSIVE MODE`);
+      } else if (!sqlite) {
+        await tx.select({ id: this.permissions.id }).from(this.permissions).where(eq7(this.permissions.id, id)).for("update");
+      }
+      const roleIds = (await grants(tx)).map((row) => row.roleId);
+      const rows = await mutation(tx).returning();
+      return { rows, roleIds };
+    });
+  }
+  async updateWithRoles(id, data) {
+    const { rows, roleIds } = await this.mutateWithRoles(id, (db) => db.update(this.permissions).set(data).where(eq7(this.permissions.id, id)));
+    return { permission: rows[0], roleIds };
+  }
+  async deleteWithRoles(id) {
+    const { rows, roleIds } = await this.mutateWithRoles(id, (db) => db.delete(this.permissions).where(eq7(this.permissions.id, id)));
+    return { permission: rows[0], roleIds };
+  }
+  async deleteAllWithRoles() {
+    return this.mutateWithRoles(void 0, (db) => db.delete(this.permissions));
+  }
   async assignPermissionToRole(roleId, permissionId) {
     const [newRolePermission] = await this.db.insert(this.rolePermissions).values({ roleId, permissionId }).returning();
     return newRolePermission;
   }
   async removePermissionFromRole(roleId, permissionId) {
-    const [deletedRolePermission] = await this.db.delete(this.rolePermissions).where(and4(eq7(this.rolePermissions.roleId, roleId), eq7(this.rolePermissions.permissionId, permissionId))).returning();
+    const [deletedRolePermission] = await this.db.delete(this.rolePermissions).where(and5(eq7(this.rolePermissions.roleId, roleId), eq7(this.rolePermissions.permissionId, permissionId))).returning();
     return deletedRolePermission;
   }
   async checkRoleHasPermission(roleId, permissionId) {
-    const [rolePermission] = await this.db.select().from(this.rolePermissions).where(and4(eq7(this.rolePermissions.roleId, roleId), eq7(this.rolePermissions.permissionId, permissionId)));
+    const [rolePermission] = await this.db.select().from(this.rolePermissions).where(and5(eq7(this.rolePermissions.roleId, roleId), eq7(this.rolePermissions.permissionId, permissionId)));
     return !!rolePermission;
   }
   async deleteAll() {
@@ -5412,7 +5638,7 @@ __decorate27([
   __metadata27("design:type", Object)
 ], PermissionRepository.prototype, "db", void 0);
 __decorate27([
-  Inject16(AUTH_SCHEMA),
+  Inject17(AUTH_SCHEMA),
   __metadata27("design:type", Object)
 ], PermissionRepository.prototype, "schema", void 0);
 PermissionRepository = __decorate27([
@@ -5588,8 +5814,8 @@ var __metadata30 = function(k, v) {
 };
 var _a19;
 var _b12;
-var _c8;
-var _d7;
+var _c10;
+var _d8;
 var _e6;
 var PermissionService = class PermissionService2 {
   static {
@@ -5615,10 +5841,14 @@ var PermissionService = class PermissionService2 {
    * sessions that captured it end. This is an infrequent administrative
    * action, and the work is proportional to the role's membership.
    */
-  async invalidateRoleHolders(roleId) {
+  async invalidateRoleHolders(roleIds) {
     if (!this.userRepository || !this.sessionInvalidation)
       return;
-    const userIds = await this.userRepository.getIdsByRole(roleId);
+    const userIds = /* @__PURE__ */ new Set();
+    for (const roleId of new Set(typeof roleIds === "string" ? [roleIds] : roleIds)) {
+      for (const userId of await this.userRepository.getIdsByRole(roleId))
+        userIds.add(userId);
+    }
     for (const userId of userIds) {
       await this.sessionInvalidation.invalidateAccessTokens(userId);
     }
@@ -5643,11 +5873,18 @@ var PermissionService = class PermissionService2 {
   async update(id, data) {
     await this.permissionValidator.checkPermissionExists(id);
     await this.permissionValidator.checkPermissionNameUnique(data.name, id);
-    return await this.permissionRepository.update(id, data);
+    const changesClaims = ["name", "resource", "action"].some((field) => data[field] !== void 0);
+    if (!changesClaims)
+      return this.permissionRepository.update(id, data);
+    const { permission: updated, roleIds } = await this.permissionRepository.updateWithRoles(id, data);
+    await this.invalidateRoleHolders(roleIds);
+    return updated;
   }
   async delete(id) {
     await this.permissionValidator.checkPermissionExists(id);
-    return await this.permissionRepository.delete(id);
+    const { permission: deleted, roleIds } = await this.permissionRepository.deleteWithRoles(id);
+    await this.invalidateRoleHolders(roleIds);
+    return deleted;
   }
   async getPermissionsByRole(roleId) {
     return await this.permissionRepository.getPermissionsByRole(roleId);
@@ -5716,12 +5953,14 @@ var PermissionService = class PermissionService2 {
     return { assigned, skipped };
   }
   async deleteAll() {
-    return await this.permissionRepository.deleteAll();
+    const { rows: deleted, roleIds } = await this.permissionRepository.deleteAllWithRoles();
+    await this.invalidateRoleHolders(roleIds);
+    return deleted;
   }
 };
 PermissionService = __decorate30([
   Injectable15(),
-  __metadata30("design:paramtypes", [typeof (_a19 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a19 : Object, typeof (_b12 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b12 : Object, typeof (_c8 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c8 : Object, typeof (_d7 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _d7 : Object, typeof (_e6 = typeof SessionInvalidationService !== "undefined" && SessionInvalidationService) === "function" ? _e6 : Object])
+  __metadata30("design:paramtypes", [typeof (_a19 = typeof PermissionRepository !== "undefined" && PermissionRepository) === "function" ? _a19 : Object, typeof (_b12 = typeof PermissionValidator !== "undefined" && PermissionValidator) === "function" ? _b12 : Object, typeof (_c10 = typeof RoleService !== "undefined" && RoleService) === "function" ? _c10 : Object, typeof (_d8 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _d8 : Object, typeof (_e6 = typeof SessionInvalidationService !== "undefined" && SessionInvalidationService) === "function" ? _e6 : Object])
 ], PermissionService);
 
 // src/permissions/PermissionController.ts
@@ -5954,7 +6193,7 @@ var revokeTokenDto = z4.object({
 });
 
 // src/ownership/scopedOwnership.ts
-import { aliasedTable, eq as eq8, getTableColumns, sql as sql4 } from "drizzle-orm";
+import { aliasedTable, eq as eq8, getTableColumns, sql as sql5 } from "drizzle-orm";
 var DEFAULT_ADMIN_ROLES = ["admin"];
 var DRIZZLE_NAME = Symbol.for("drizzle:Name");
 var DRIZZLE_BASE_NAME = Symbol.for("drizzle:BaseName");
@@ -6091,7 +6330,7 @@ var OwnershipToken = class {
       return query;
     const rule = this._rules[role];
     if (!rule)
-      return query.where(sql4`1 = 0`);
+      return query.where(sql5`1 = 0`);
     const { query: q, condition } = rule(uid, query);
     return q.where(condition);
   }
@@ -6106,7 +6345,7 @@ var OwnershipToken = class {
       return { query, condition: null };
     const rule = this._rules[role];
     if (!rule)
-      return { query, condition: sql4`1 = 0` };
+      return { query, condition: sql5`1 = 0` };
     return rule(uid, query);
   }
 };
@@ -6116,7 +6355,7 @@ function own(table, opts) {
 __name(own, "own");
 
 // src/ownership/configureOwnership.ts
-import { Injectable as Injectable16, Inject as Inject17, User as User4, Body as Body6, Params as Params4 } from "najm-core";
+import { Injectable as Injectable16, Inject as Inject18, User as User4, Body as Body6, Params as Params4 } from "najm-core";
 import { createGuard as createGuard5, composeGuards as composeGuards4 } from "najm-guard";
 var __decorate32 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -6157,7 +6396,7 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
     }
   };
   __decorate32([
-    Inject17(ownershipClass),
+    Inject18(ownershipClass),
     __metadata32("design:type", Object)
   ], AccessGuard.prototype, "ownership", void 0);
   __decorate32([
@@ -6181,7 +6420,7 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
     }
   };
   __decorate32([
-    Inject17(ownershipClass),
+    Inject18(ownershipClass),
     __metadata32("design:type", Object)
   ], ListGuard.prototype, "ownership", void 0);
   __decorate32([
@@ -6340,7 +6579,7 @@ function configureOwnership(config) {
       }
     };
     __decorate32([
-      Inject17(GeneratedOwnershipService),
+      Inject18(GeneratedOwnershipService),
       __metadata32("design:type", GeneratedOwnershipService)
     ], BodyAccessGuard.prototype, "ownership", void 0);
     __decorate32([
@@ -6465,12 +6704,12 @@ __name(Policy, "Policy");
 
 // src/ownership/OwnedDecorator.ts
 import "reflect-metadata";
-import { sql as sql6, and as and5 } from "drizzle-orm";
-import { Injectable as Injectable17, Inject as Inject18, DI as DI3, Container as Container2, REQUEST_ID } from "najm-core";
+import { sql as sql7, and as and6 } from "drizzle-orm";
+import { Injectable as Injectable17, Inject as Inject19, DI as DI3, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
 
 // src/ownership/ownershipCondition.ts
-import { inArray, or, sql as sql5 } from "drizzle-orm";
+import { inArray, or, sql as sql6 } from "drizzle-orm";
 function validateOwnershipAlternatives(tokens) {
   if (!tokens.length)
     throw new Error("Ownership requires at least one token");
@@ -6489,7 +6728,7 @@ function ownershipCondition(db, tokens, context) {
     return void 0;
   const user = context.getUser();
   if (!user)
-    return sql5`1 = 0`;
+    return sql6`1 = 0`;
   const conditions = [];
   for (const token of tokens) {
     const { query, condition } = token.applyScopeSplit(user.id, user.role, db.select({ id: idColumn }).from(token.table));
@@ -6500,7 +6739,7 @@ function ownershipCondition(db, tokens, context) {
     conditions.push(inArray(idColumn, query.where(condition)));
   }
   if (!conditions.length)
-    return sql5`1 = 0`;
+    return sql6`1 = 0`;
   return conditions.length === 1 ? conditions[0] : or(...conditions);
 }
 __name(ownershipCondition, "ownershipCondition");
@@ -6531,7 +6770,7 @@ function ownedProperty(proto, key, tokens) {
     enumerable: false
   });
   if (!Reflect.hasOwnMetadata(OWNED_PROPERTIES, proto, "_scopeCtx")) {
-    Inject18(ScopeContext)(proto, "_scopeCtx");
+    Inject19(ScopeContext)(proto, "_scopeCtx");
     Reflect.defineMetadata(OWNED_PROPERTIES, true, proto, "_scopeCtx");
     Object.defineProperty(proto, "_scopeCtx", {
       get() {
@@ -6605,7 +6844,7 @@ function Owned(token, ...alternatives) {
       throw new Error("@Owned requires a repository class");
     Reflect.defineMetadata(OWNED_META, token, target);
     const proto = target.prototype;
-    Inject18(ScopeContext)(proto, "_scopeCtx");
+    Inject19(ScopeContext)(proto, "_scopeCtx");
     Object.defineProperty(proto, "ownershipCondition", {
       value() {
         return ownershipCondition(this.db, tokens, this._scopeCtx);
@@ -6627,7 +6866,7 @@ function Owned(token, ...alternatives) {
         return null;
       if (filtered.length === 1)
         return filtered[0];
-      return and5(...filtered);
+      return and6(...filtered);
     }
     __name(combineConditions, "combineConditions");
     function applyQueryOptions(query, opts = {}, whereCondition) {
@@ -6648,7 +6887,7 @@ function Owned(token, ...alternatives) {
             return query.where(this.ownershipCondition());
           const user = getUser(this);
           if (!user)
-            return query.where(sql6`1 = 0`);
+            return query.where(sql7`1 = 0`);
           return token.applyScope(user.id, user.role, query);
         };
       },
@@ -6827,7 +7066,7 @@ __name(getAuthLocale, "getAuthLocale");
 var AUTH_SUPPORTED_LANGUAGES = Object.keys(AUTH_LOCALES);
 
 // src/oauth/google/GoogleOAuthProvider.ts
-import { Inject as Inject20, Injectable as Injectable19 } from "najm-core";
+import { Inject as Inject21, Injectable as Injectable19 } from "najm-core";
 
 // src/oauth/types.ts
 var OAuthFlowError = class extends Error {
@@ -6845,7 +7084,7 @@ var OAuthFlowError = class extends Error {
 };
 
 // src/oauth/google/GoogleTokenVerifier.ts
-import { Inject as Inject19, Injectable as Injectable18 } from "najm-core";
+import { Inject as Inject20, Injectable as Injectable18 } from "najm-core";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 var __decorate34 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -6906,7 +7145,7 @@ var GoogleTokenVerifier = class GoogleTokenVerifier2 {
   }
 };
 __decorate34([
-  Inject19(AUTH_CONFIG),
+  Inject20(AUTH_CONFIG),
   __metadata34("design:type", Object)
 ], GoogleTokenVerifier.prototype, "config", void 0);
 GoogleTokenVerifier = __decorate34([
@@ -6992,7 +7231,7 @@ var GoogleOAuthProvider = class GoogleOAuthProvider2 {
   }
 };
 __decorate35([
-  Inject20(AUTH_CONFIG),
+  Inject21(AUTH_CONFIG),
   __metadata35("design:type", Object)
 ], GoogleOAuthProvider.prototype, "config", void 0);
 GoogleOAuthProvider = __decorate35([
@@ -7001,7 +7240,7 @@ GoogleOAuthProvider = __decorate35([
 ], GoogleOAuthProvider);
 
 // src/oauth/github/GitHubOAuthProvider.ts
-import { Inject as Inject21, Injectable as Injectable20 } from "najm-core";
+import { Inject as Inject22, Injectable as Injectable20 } from "najm-core";
 var __decorate36 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -7125,7 +7364,7 @@ var GitHubOAuthProvider = class GitHubOAuthProvider2 {
   }
 };
 __decorate36([
-  Inject21(AUTH_CONFIG),
+  Inject22(AUTH_CONFIG),
   __metadata36("design:type", Object)
 ], GitHubOAuthProvider.prototype, "config", void 0);
 GitHubOAuthProvider = __decorate36([
@@ -7139,16 +7378,16 @@ import { RateLimit as RateLimit3 } from "najm-rate";
 import { Public as Public3 } from "najm-guard";
 
 // src/oauth/OAuthService.ts
-import { Err as Err16, Inject as Inject24, Injectable as Injectable23, Log as Log2 } from "najm-core";
+import { Err as Err16, Inject as Inject25, Injectable as Injectable23, Log as Log2 } from "najm-core";
 
 // src/oauth/OAuthAccountService.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { Inject as Inject23, Injectable as Injectable21 } from "najm-core";
+import { Inject as Inject24, Injectable as Injectable21 } from "najm-core";
 import { Transaction as Transaction5 } from "najm-database";
 
 // src/oauth/OAuthAccountRepository.ts
-import { and as and6, eq as eq9 } from "drizzle-orm";
-import { Inject as Inject22, Repository as Repository7 } from "najm-core";
+import { and as and7, eq as eq9 } from "drizzle-orm";
+import { Inject as Inject23, Repository as Repository7 } from "najm-core";
 import { DB as DB7 } from "najm-database";
 var __decorate37 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -7172,11 +7411,11 @@ var OAuthAccountRepository = class OAuthAccountRepository2 {
     return this.schema.oauthAccounts;
   }
   async getByProviderAccount(provider, providerAccountId) {
-    const [account] = await this.db.select().from(this.accounts).where(and6(eq9(this.accounts.provider, provider), eq9(this.accounts.providerAccountId, providerAccountId))).limit(1);
+    const [account] = await this.db.select().from(this.accounts).where(and7(eq9(this.accounts.provider, provider), eq9(this.accounts.providerAccountId, providerAccountId))).limit(1);
     return account;
   }
   async getByUserProvider(userId, provider) {
-    const [account] = await this.db.select().from(this.accounts).where(and6(eq9(this.accounts.userId, userId), eq9(this.accounts.provider, provider))).limit(1);
+    const [account] = await this.db.select().from(this.accounts).where(and7(eq9(this.accounts.userId, userId), eq9(this.accounts.provider, provider))).limit(1);
     return account;
   }
   async create(data) {
@@ -7189,7 +7428,7 @@ __decorate37([
   __metadata37("design:type", Object)
 ], OAuthAccountRepository.prototype, "db", void 0);
 __decorate37([
-  Inject22(AUTH_SCHEMA),
+  Inject23(AUTH_SCHEMA),
   __metadata37("design:type", Object)
 ], OAuthAccountRepository.prototype, "schema", void 0);
 OAuthAccountRepository = __decorate37([
@@ -7208,8 +7447,8 @@ var __metadata38 = function(k, v) {
 };
 var _a23;
 var _b13;
-var _c9;
-var _d8;
+var _c11;
+var _d9;
 var OAuthAccountService = class OAuthAccountService2 {
   static {
     __name(this, "OAuthAccountService");
@@ -7286,20 +7525,20 @@ var OAuthAccountService = class OAuthAccountService2 {
   }
 };
 __decorate38([
-  Inject23(AUTH_CONFIG),
+  Inject24(AUTH_CONFIG),
   __metadata38("design:type", Object)
 ], OAuthAccountService.prototype, "config", void 0);
 __decorate38([
   Transaction5(),
   __metadata38("design:type", Function),
   __metadata38("design:paramtypes", [Object]),
-  __metadata38("design:returntype", typeof (_c9 = typeof Promise !== "undefined" && Promise) === "function" ? _c9 : Object)
+  __metadata38("design:returntype", typeof (_c11 = typeof Promise !== "undefined" && Promise) === "function" ? _c11 : Object)
 ], OAuthAccountService.prototype, "resolveForLogin", null);
 __decorate38([
   Transaction5(),
   __metadata38("design:type", Function),
   __metadata38("design:paramtypes", [String, Object]),
-  __metadata38("design:returntype", typeof (_d8 = typeof Promise !== "undefined" && Promise) === "function" ? _d8 : Object)
+  __metadata38("design:returntype", typeof (_d9 = typeof Promise !== "undefined" && Promise) === "function" ? _d9 : Object)
 ], OAuthAccountService.prototype, "linkUser", null);
 OAuthAccountService = __decorate38([
   Injectable21(),
@@ -7310,6 +7549,22 @@ OAuthAccountService = __decorate38([
 import { createHash as createHash4, randomBytes as randomBytes4, timingSafeEqual } from "crypto";
 import { Injectable as Injectable22 } from "najm-core";
 import { CookieService as CookieService3 } from "najm-cookies";
+
+// src/client/redirectPath.ts
+function normalizeLocalRedirectPath(value) {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || value.includes("\\") || /[\u0000-\u001f\u007f]/.test(value)) return null;
+  try {
+    const base = new URL("https://najm.invalid");
+    const parsed = new URL(value, base);
+    if (parsed.origin !== base.origin || parsed.pathname.startsWith("//")) return null;
+    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+  } catch {
+    return null;
+  }
+}
+__name(normalizeLocalRedirectPath, "normalizeLocalRedirectPath");
+
+// src/oauth/OAuthStateService.ts
 var __decorate39 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -7385,22 +7640,10 @@ var OAuthStateService = class OAuthStateService2 {
     }
   }
   validateReturnTo(value) {
-    const candidate = value?.trim() || "/";
-    if (!candidate.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\")) {
-      throw new OAuthFlowError("oauth_redirect_invalid");
-    }
-    try {
-      const base = new URL("https://najm.invalid");
-      const parsed = new URL(candidate, base);
-      if (parsed.origin !== base.origin || parsed.username || parsed.password) {
-        throw new OAuthFlowError("oauth_redirect_invalid");
-      }
-      return `${parsed.pathname}${parsed.search}${parsed.hash}`;
-    } catch (error) {
-      if (error instanceof OAuthFlowError)
-        throw error;
+    const path2 = normalizeLocalRedirectPath(value?.trim() || "/");
+    if (!path2)
       throw new OAuthFlowError("oauth_redirect_invalid");
-    }
+    return path2;
   }
   cookieName(provider, state) {
     return `${COOKIE_PREFIX}${provider}.${state}`;
@@ -7426,12 +7669,12 @@ var __metadata40 = function(k, v) {
 };
 var _a25;
 var _b15;
-var _c10;
-var _d9;
+var _c12;
+var _d10;
 var _e7;
 var _f5;
 var _g4;
-var _h3;
+var _h4;
 var OAuthService = class OAuthService2 {
   static {
     __name(this, "OAuthService");
@@ -7597,7 +7840,7 @@ var OAuthService = class OAuthService2 {
   }
 };
 __decorate40([
-  Inject24(AUTH_CONFIG),
+  Inject25(AUTH_CONFIG),
   __metadata40("design:type", Object)
 ], OAuthService.prototype, "config", void 0);
 __decorate40([
@@ -7606,7 +7849,7 @@ __decorate40([
 ], OAuthService.prototype, "logger", void 0);
 OAuthService = __decorate40([
   Injectable23(),
-  __metadata40("design:paramtypes", [typeof (_a25 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a25 : Object, typeof (_b15 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b15 : Object, typeof (_c10 = typeof GitHubOAuthProvider !== "undefined" && GitHubOAuthProvider) === "function" ? _c10 : Object, typeof (_d9 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _d9 : Object, typeof (_e7 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _e7 : Object, typeof (_f5 = typeof TokenService !== "undefined" && TokenService) === "function" ? _f5 : Object, typeof (_g4 = typeof UserService !== "undefined" && UserService) === "function" ? _g4 : Object, typeof (_h3 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _h3 : Object])
+  __metadata40("design:paramtypes", [typeof (_a25 = typeof OAuthStateService !== "undefined" && OAuthStateService) === "function" ? _a25 : Object, typeof (_b15 = typeof GoogleOAuthProvider !== "undefined" && GoogleOAuthProvider) === "function" ? _b15 : Object, typeof (_c12 = typeof GitHubOAuthProvider !== "undefined" && GitHubOAuthProvider) === "function" ? _c12 : Object, typeof (_d10 = typeof OAuthAccountService !== "undefined" && OAuthAccountService) === "function" ? _d10 : Object, typeof (_e7 = typeof AuthSessionService !== "undefined" && AuthSessionService) === "function" ? _e7 : Object, typeof (_f5 = typeof TokenService !== "undefined" && TokenService) === "function" ? _f5 : Object, typeof (_g4 = typeof UserService !== "undefined" && UserService) === "function" ? _g4 : Object, typeof (_h4 = typeof CredentialSetupRequirementService !== "undefined" && CredentialSetupRequirementService) === "function" ? _h4 : Object])
 ], OAuthService);
 
 // src/oauth/GitHubOAuthController.ts