Issuing tokens

use RoundlyConsulting\RefreshTokens\Facades\RefreshTokens;
use RoundlyConsulting\RefreshTokens\DataTransferObjects\IssueContext;

$new = RefreshTokens::issue($user, new IssueContext(
    ipAddress: $request->ip(),
    userAgent: $request->userAgent(),
    accessReference: $access->jti, // opaque link to the host's access token
));

$plainText = $new->plainText;      // return to the client ONCE
$row = $new->token;                // the stored RefreshToken row (hash only)

$new = RefreshTokens::for($user)
    ->fromRequest($request)        // fills ip + user agent
    ->linkedTo($access->jti)
    ->issue();

$sid = (string) Str::uuid();       // e.g. already minted into the access token as `sid`

$new = RefreshTokens::for($client)
    ->fromRequest($request)
    ->startingFamily($sid)         // root the family under YOUR uuid (IssueContext::$newFamilyId)
    ->ttl(3600)                    // sliding lifetime for this session
    ->absoluteTtl(86_400)          // hard cap for this session; 0 = uncapped
    ->meta(['guard' => 'clients', 'amr' => ['pwd', 'otp'], 'auth_time' => time()])
    ->issue();

$new = RefreshTokens::issue($owner, new IssueContext(
    ipAddress: $request->ip(),
    userAgent: $request->userAgent(),
    accessReference: $accessTokenId,   // opaque handle to the paired access token
    familyId: null,                    // inherit an existing family (rotation replacement)
    newFamilyId: null,                 // OR root a new family under a caller-chosen UUID
    ttl: null,                         // sliding lifetime override (>= 1 s)
    absoluteTtl: null,                 // absolute cap override, root only (>= 0; 0 = uncapped)
    meta: ['guard' => 'users', 'amr' => ['pwd'], 'auth_time' => time()],
));