fix(auth0-server-js): address review comments - bump auth-js dep, empty token guard, docs

- Bump @auth0/auth0-auth-js dependency from ^1.11.0 to ^1.12.0
- Add explicit empty-string token guard in revokeRefreshToken (throws MissingRequiredArgumentError)
- Add offline_access scope to example-express-web authorizationParams
- Expand JSDoc and EXAMPLES.md to document resolver-mode behavior for explicit tokens
- Assert revoke-before-delete ordering in logout test using ops array

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jd3vi1

examples/example-express-web/src/auth0.ts

@@ -32,6 +32,7 @@ export function auth0(options: Auth0ExpressOptions) {
     clientSecret: options.clientSecret,
     authorizationParams: {
       redirect_uri: redirectUri.toString(),
+      scope: 'openid profile email offline_access',
     },
     transactionStore: new CookieTransactionStore(
       {

packages/auth0-server-js/EXAMPLES.md

@@ -1504,6 +1504,8 @@ A specific token can be passed via `options.token`, bypassing the session lookup
 await serverClient.revokeRefreshToken({ token: '<refresh_token>' });
 ```
 
+In resolver mode, the domain-match guard still applies even when a token is supplied explicitly. If the session domain does not match the domain resolved for the current request (or if the session has no stored domain), the call returns without revoking. Pass an empty string to `options.token` to get a `MissingRequiredArgumentError` rather than a silent no-op.
+
 ### Revoking on logout
 
 `logout()` automatically revokes the session's refresh token before clearing the local session.

packages/auth0-server-js/package.json

@@ -25,7 +25,7 @@
     }
   },
   "dependencies": {
-    "@auth0/auth0-auth-js": "^1.11.0",
+    "@auth0/auth0-auth-js": "^1.12.0",
     "jose": "^6.0.8"
   },
   "devDependencies": {

packages/auth0-server-js/src/server-client.spec.ts

@@ -7051,16 +7051,19 @@ describe('logout revocation', () => {
   };
 
   test('should revoke refresh token before clearing session on logout', async () => {
-    let revocationCalled = false;
+    const ops: string[] = [];
     setupRevocation(() => {
-      revocationCalled = true;
+      ops.push('revoke');
       return new HttpResponse(null, { status: 200 });
     });
 
     const mockStateStore = {
       get: vi.fn(),
       set: vi.fn(),
-      delete: vi.fn(),
+      delete: vi.fn().mockImplementation(() => {
+        ops.push('delete');
+        return Promise.resolve();
+      }),
       deleteByLogoutToken: vi.fn(),
     };
 
@@ -7085,8 +7088,7 @@ describe('logout revocation', () => {
 
     await serverClient.logout({ returnTo: '/after-logout' });
 
-    expect(revocationCalled).toBe(true);
-    expect(mockStateStore.delete).toHaveBeenCalled();
+    expect(ops).toEqual(['revoke', 'delete']);
   });
 
   test('should continue with logout even if revocation fails', async () => {

packages/auth0-server-js/src/server-client.ts

@@ -1081,16 +1081,26 @@ export class ServerClient<TStoreOptions = unknown> {
   /**
    * Revokes the refresh token stored in the current session, or an explicitly supplied token.
    *
+   * In resolver mode, revocation only occurs when the session domain matches the domain resolved
+   * for the current request. If the domains differ (or the session has no stored domain), the call
+   * returns without revoking to avoid sending a token to the wrong tenant. This guard applies even
+   * when a token is passed explicitly via `options.token`.
+   *
    * @param options Optionally supply a token to revoke instead of reading from the session.
    * @param storeOptions Optional options passed to the StateStore.
    *
+   * @throws {MissingRequiredArgumentError} If `options.token` is an empty string.
    * @throws {MissingSessionError} If no refresh token is found in the session and none was provided.
    * @throws {TokenRevocationError} If the revocation request fails.
    */
   public async revokeRefreshToken(
     options: RevokeRefreshTokenOptions = {},
     storeOptions?: TStoreOptions
   ): Promise<void> {
+    if (options.token !== undefined && options.token.length === 0) {
+      throw new MissingRequiredArgumentError('options.token must not be an empty string.');
+    }
+
     let refreshToken = options.token;
 
     // Skip the store read when a token is supplied and we are in static mode: