@astram/frontend-core 0.7.0 → 0.9.0

package/dist/auth/auditService.d.ts

@@ -29,9 +29,25 @@ export interface AuditQuery {
     page?: number;
     limit?: number;
 }
-/** A single resolved audit row. Concrete shape is server-defined. */
+/**
+ * Who wrote an audit row: a user, a service account (API key), a framework operation (org
+ * bootstrap, audit retention prune), or an id found nowhere (shown as "Deleted user").
+ */
+export type AuditActorKind = 'user' | 'service_account' | 'operation' | 'unknown';
+/**
+ * A single resolved audit row (`GET /identity/audit` `data[]`). Labels only, never raw ids. The
+ * named fields are optional so an older server (no `actorKind`) still type-checks; the index
+ * signature keeps any further server field readable.
+ */
 export interface AuditRecord {
     id?: string;
+    occurredAt?: number;
+    actorLabel?: string;
+    /** Absent on servers before KI #140: treat as `'user'`. */
+    actorKind?: AuditActorKind;
+    action?: string;
+    tenantLabel?: string;
+    detail?: Record<string, unknown>;
     [key: string]: unknown;
 }
 export type ListAuditResult = {

package/dist/auth/auditService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditService.d.ts","sourceRoot":"","sources":["../../src/auth/auditService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEpE,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,WAAW,YAAY;IAC3B,IAAI,CACF,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,EAClB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,eAAe,CAAA;KAAE,GAClC,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7B;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CA2EjE"}
+{"version":3,"file":"auditService.d.ts","sourceRoot":"","sources":["../../src/auth/auditService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEpE,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,iBAAiB,GAAG,WAAW,GAAG,SAAS,CAAC;AAElF;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,WAAW,YAAY;IAC3B,IAAI,CACF,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,EAClB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,eAAe,CAAA;KAAE,GAClC,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7B;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CA2EjE"}

package/dist/auth/auditService.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditService.js","sourceRoot":"","sources":["../../src/auth/auditService.ts"],"names":[],"mappings":"AAmDA,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD;;;;;;;;;;OAUG;IACH,SAAS,eAAe,CAAC,KAAkB;QACzC,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,SAAS,IAAI,CACX,CAAqB,EACrB,OAAe;QAEf,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QACzF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,OAAO;QACL;;;;;;WAMG;QACH,KAAK,CAAC,IAAI,CACR,WAAmB,EACnB,KAAkB,EAClB,IAAmC;YAEnC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE;gBACnE,WAAW,EAAE,WAAW;gBACxB,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAKzB,CAAC;gBACF,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;oBACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;oBACtB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC;oBACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,KAAK,IAAI,EAAE;iBACxC,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auditService.js","sourceRoot":"","sources":["../../src/auth/auditService.ts"],"names":[],"mappings":"AAoEA,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD;;;;;;;;;;OAUG;IACH,SAAS,eAAe,CAAC,KAAkB;QACzC,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,SAAS,IAAI,CACX,CAAqB,EACrB,OAAe;QAEf,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QACzF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,OAAO;QACL;;;;;;WAMG;QACH,KAAK,CAAC,IAAI,CACR,WAAmB,EACnB,KAAkB,EAClB,IAAmC;YAEnC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE;gBACnE,WAAW,EAAE,WAAW;gBACxB,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAKzB,CAAC;gBACF,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;oBACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;oBACtB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC;oBACnC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,KAAK,IAAI,EAAE;iBACxC,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/authService.d.ts

@@ -7,12 +7,13 @@
  * runs unchanged on web today and React Native next.
  *
  * Framework auth routes (server-side, framework-owned):
- *   POST /auth/login   { identityHint, password } → { session, tokens } | { mfaRequired, challengeToken }
+ *   GET  /auth/login-options                      → { signInWith, captcha } (public)
+ *   POST /auth/login   { identityHint, password, captchaToken? } → { session, tokens } | { mfaRequired, challengeToken }
  *   POST /auth/mfa     { challengeToken, factor, code } → { session, tokens }
  *   POST /auth/refresh { refreshToken }           → { session, tokens }
- *   POST /auth/logout  { sessionId }              → 204
- *   POST /auth/forgot-password { identityHint }   → 204 (always)
- *   POST /auth/reset-password  { token, newPassword } → 204 | 400 | 422 | 501
+ *   POST /auth/logout  { sessionId, refreshToken? } (+ bearer) → 204
+ *   POST /auth/forgot-password { identityHint, captchaToken? } → 204 (always)
+ *   POST /auth/reset-password  { token, newPassword, captchaToken? } → 204 | 400 | 422 | 501
  *   POST /auth/confirm-email   { token }          → 200 { ok } | 400 | 409 | 429 | 503
  *
  * Every method resolves to a plain result object (never throws), so views stay dumb.
@@ -21,7 +22,7 @@
  * every result branch are unchanged; only types were added.
  */
 import type { AbortSignalLike, HttpClient } from '../http/types.js';
-import type { Session, SessionTokens } from './session.js';
+import type { Session, SessionState, SessionTokens } from './session.js';
 /** Shape of a display profile returned by GET /auth/me. */
 export interface AuthProfile {
     id: string;
@@ -35,8 +36,42 @@ export interface AuthProfile {
         id: string;
         name: string;
     }>;
+    /**
+     * Auth capabilities R2.4: when a security policy requires 2FA and the user is still in the grace
+     * period, the deadline to enrol (ISO-8601 UTC string). Absent otherwise. Drives the grace banner.
+     */
+    mfaEnrollmentDeadline?: string;
     [key: string]: unknown;
 }
+/** How users may type their sign-in name (R1.8): email always; a login name when enabled. */
+export type SignInMethod = 'email' | 'username';
+/** The CAPTCHA providers the server can name (R7.1). */
+export type CaptchaProvider = 'turnstile' | 'recaptcha-v3' | 'recaptcha-v2';
+/** `adaptive`: a challenge only after repeated failures; `always`: every attempt (R7.3). */
+export type CaptchaMode = 'adaptive' | 'always';
+/** The public CAPTCHA settings from `GET /auth/login-options` (the site key, never the secret). */
+export interface CaptchaOptions {
+    provider: CaptchaProvider;
+    siteKey: string;
+    mode: CaptchaMode;
+}
+/** `GET /auth/login-options` (R7.3, R13.2): the login label and the CAPTCHA widget settings. */
+export type LoginOptionsResult = {
+    ok: true;
+    signInWith: SignInMethod[];
+    captcha: CaptchaOptions | null;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+/**
+ * Optional CAPTCHA token for login, forgot-password and reset-password (R7.2). Send it once the
+ * server answered `captchaRequired: true` (or always, in `always` mode).
+ */
+export interface CaptchaOpts {
+    captchaToken?: string;
+}
 /**
  * The caller's own coarse auth-facts projection, as inlined into a login/mfa success
  * body by the framework (same shape as `GET /identity/auth-facts`). ADDITIVE +
@@ -64,9 +99,12 @@ export type LoginResult = {
 } | {
     ok: 'mfa';
     challengeToken: string;
-} | {
+}
+/** `captchaRequired`: the server wants a CAPTCHA token on the next attempt (R7.3). */
+ | {
     ok: false;
     error: string;
+    captchaRequired?: true;
 };
 export type CompleteMfaResult = {
     ok: true;
@@ -106,12 +144,14 @@ export type MeResult = {
 export type RequestResetResult = {
     ok: true;
 };
+/** `captchaRequired`: retry with a CAPTCHA token (the message stays the generic one). */
 export type ResetPasswordResult = {
     ok: true;
 } | {
     ok: false;
     status: number;
     error: string;
+    captchaRequired?: true;
 };
 /** `status: 0` = the server could not be reached. */
 export type ConfirmEmailResult = {
@@ -122,16 +162,22 @@ export type ConfirmEmailResult = {
     error: string;
 };
 export interface AuthService {
-    login(identityHint: string, password: string): Promise<LoginResult>;
+    /** Public sign-in settings (R13.2): sign-in methods and CAPTCHA widget settings. */
+    loginOptions(): Promise<LoginOptionsResult>;
+    login(identityHint: string, password: string, opts?: CaptchaOpts): Promise<LoginResult>;
     completeMfa(challengeToken: string, code: string, factor?: string): Promise<CompleteMfaResult>;
     /** `opts.signal` (additive) is forwarded to the transport so a hung refresh can be aborted. */
     refresh(refreshToken: string, opts?: {
         signal?: AbortSignalLike;
     }): Promise<RefreshResult>;
-    logout(sessionId: string | undefined): Promise<LogoutResult>;
+    /**
+     * Pass the session state (`{ session, tokens }`) so the server gets proof of ownership
+     * (R15.1); a bare `sessionId` string is still accepted (no proof sent).
+     */
+    logout(target: string | SessionState | null | undefined): Promise<LogoutResult>;
     me(accessToken: string): Promise<MeResult>;
-    requestReset(identityHint: string): Promise<RequestResetResult>;
-    resetPassword(token: string, newPassword: string): Promise<ResetPasswordResult>;
+    requestReset(identityHint: string, opts?: CaptchaOpts): Promise<RequestResetResult>;
+    resetPassword(token: string, newPassword: string, opts?: CaptchaOpts): Promise<ResetPasswordResult>;
     confirmEmail(token: string): Promise<ConfirmEmailResult>;
 }
 export declare function createAuthService(http: HttpClient): AuthService;

package/dist/auth/authService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authService.d.ts","sourceRoot":"","sources":["../../src/auth/authService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE3D,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAYD,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAAE,GACtF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,MAAM,iBAAiB,GACzB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AAExC,MAAM,MAAM,QAAQ,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F,qDAAqD;AACrD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpE,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/F,+FAA+F;IAC/F,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,eAAe,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3F,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChF,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC1D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAoM/D"}
+{"version":3,"file":"authService.d.ts","sourceRoot":"","sources":["../../src/auth/authService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEzE,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6FAA6F;AAC7F,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,UAAU,CAAC;AAEhD,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;AAE5E,4FAA4F;AAC5F,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEhD,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,gGAAgG;AAChG,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,YAAY,EAAE,CAAC;IAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GACxE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA8BD;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAYD,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAAE,GACtF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE;AACvC,sFAAsF;GACpF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAEzD,MAAM,MAAM,iBAAiB,GACzB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AAExC,MAAM,MAAM,QAAQ,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AAE9C,yFAAyF;AACzF,MAAM,MAAM,mBAAmB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAEtF,qDAAqD;AACrD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,WAAW;IAC1B,oFAAoF;IACpF,YAAY,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5C,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACxF,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/F,+FAA+F;IAC/F,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,eAAe,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3F;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAChF,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpF,aAAa,CACX,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC1D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CA4Q/D"}

package/dist/auth/authService.js

@@ -1,13 +1,66 @@
+const SIGN_IN_METHODS = ['email', 'username'];
+const CAPTCHA_PROVIDERS = ['turnstile', 'recaptcha-v3', 'recaptcha-v2'];
+const CAPTCHA_MODES = ['adaptive', 'always'];
+/** True when the failure body says the next attempt needs a CAPTCHA token. */
+function captchaRequiredIn(data) {
+    return (data !== null &&
+        typeof data === 'object' &&
+        data.captcha === 'required');
+}
+/** Keep only a well-formed CAPTCHA block; anything else reads as "no CAPTCHA". */
+function captchaOptionsOf(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return null;
+    const { provider, siteKey, mode } = raw;
+    if (!CAPTCHA_PROVIDERS.includes(provider))
+        return null;
+    if (typeof siteKey !== 'string' || siteKey.length === 0)
+        return null;
+    if (!CAPTCHA_MODES.includes(mode))
+        return null;
+    return { provider: provider, siteKey, mode: mode };
+}
+/** `captchaToken` as a body fragment, only when set. */
+function captchaBody(opts) {
+    return opts?.captchaToken ? { captchaToken: opts.captchaToken } : {};
+}
 export function createAuthService(http) {
     return {
+        /**
+         * Read the public sign-in settings (framework `GET /auth/login-options`, no session, so the
+         * call is anonymous). Resolves to `{ ok: true, signInWith, captcha }`: `signInWith` lists the
+         * accepted name kinds (the login label is "Email" or "Email or username"); `captcha` is the
+         * provider, site key and mode, or `null` when CAPTCHA is off. Unknown methods are dropped
+         * (an empty list reads as `['email']`) and a malformed CAPTCHA block reads as `null`.
+         */
+        async loginOptions() {
+            const r = await http.get('/auth/login-options', { anonymous: true });
+            if (r.ok) {
+                const data = (r.data ?? {});
+                const methods = Array.isArray(data.signInWith)
+                    ? SIGN_IN_METHODS.filter((m) => data.signInWith.includes(m))
+                    : [];
+                return {
+                    ok: true,
+                    signInWith: methods.length > 0 ? methods : ['email'],
+                    captcha: captchaOptionsOf(data.captcha),
+                };
+            }
+            if (r.status === 0) {
+                return { ok: false, status: 0, error: 'Cannot reach the server. Is it running?' };
+            }
+            return { ok: false, status: r.status, error: 'Could not load sign-in options.' };
+        },
         /**
          * Log in. Resolves to:
          *   { ok: true, session, tokens }   — authenticated
          *   { ok: 'mfa', challengeToken }   — second factor required
          *   { ok: false, error }            — bad credentials / unavailable / unreachable
+         *     (+ `captchaRequired: true` when the 401 says the next attempt needs a CAPTCHA token)
+         * `opts.captchaToken` is sent only when set.
          */
-        async login(identityHint, password) {
-            const r = await http.post('/auth/login', { identityHint, password });
+        async login(identityHint, password, opts) {
+            const r = await http.post('/auth/login', { identityHint, password, ...captchaBody(opts) });
             const data = r.data;
             if (r.status === 0)
                 return { ok: false, error: 'Cannot reach the server. Is it running?' };
@@ -26,8 +79,13 @@ export function createAuthService(http) {
                     ...(data.authFacts ? { authFacts: data.authFacts } : {}),
                 };
             }
-            if (r.status === 401)
-                return { ok: false, error: 'Invalid username or password.' };
+            if (r.status === 401) {
+                return {
+                    ok: false,
+                    error: 'Invalid username or password.',
+                    ...(captchaRequiredIn(r.data) ? { captchaRequired: true } : {}),
+                };
+            }
             if (r.status === 503) {
                 return { ok: false, error: 'Authentication is temporarily unavailable. Please try again.' };
             }
@@ -83,10 +141,27 @@ export function createAuthService(http) {
             }
             return { ok: false, status: r.status, error: 'Session expired. Please sign in again.' };
         },
-        /** Log out (revoke the session). Always resolves — logout must never block a UI. */
-        async logout(sessionId) {
-            if (sessionId)
-                await http.post('/auth/logout', { sessionId });
+        /**
+         * Log out (revoke the session). Always resolves — logout must never block a UI.
+         *
+         * Pass the session state (`{ session, tokens }`) so the server can verify the caller owns
+         * the session (R15.1): the body carries `{ sessionId, refreshToken }` and the access token
+         * goes as `Authorization: Bearer`, each only when held. A bare `sessionId` string still
+         * works (sends `{ sessionId }` only), but a server with `logoutRequiresProof: true` then
+         * revokes nothing.
+         */
+        async logout(target) {
+            if (typeof target === 'string') {
+                if (target)
+                    await http.post('/auth/logout', { sessionId: target });
+                return { ok: true };
+            }
+            const sessionId = target?.session?.sessionId;
+            if (!sessionId)
+                return { ok: true };
+            const refreshToken = target?.tokens?.refreshToken;
+            const accessToken = target?.tokens?.accessToken;
+            await http.post('/auth/logout', refreshToken ? { sessionId, refreshToken } : { sessionId }, accessToken ? { bearerToken: accessToken } : undefined);
             return { ok: true };
         },
         /**
@@ -119,9 +194,10 @@ export function createAuthService(http) {
          * `{ ok: true }` — the UI shows the SAME neutral confirmation regardless. Never
          * reveals whether the account exists.
          * @param identityHint username or email
+         * @param opts.captchaToken sent only when set (the server checks it after answering 204)
          */
-        async requestReset(identityHint) {
-            await http.post('/auth/forgot-password', { identityHint });
+        async requestReset(identityHint, opts) {
+            await http.post('/auth/forgot-password', { identityHint, ...captchaBody(opts) });
             // Mirror the server's anti-enumeration: report nothing about existence.
             return { ok: true };
         },
@@ -132,14 +208,27 @@ export function createAuthService(http) {
          *   { ok: false, status, error }       — 400 (invalid/expired link),
          *                                         422 (requirements), 501 (not available)
          * Never throws — the UI renders the message.
+         * A 400 that carries `captcha: 'required'` adds `captchaRequired: true` (retry with a token);
+         * the message stays the generic one.
          * @param token the raw reset token from the emailed link
+         * @param opts.captchaToken sent only when set
          */
-        async resetPassword(token, newPassword) {
-            const r = await http.post('/auth/reset-password', { token, newPassword });
+        async resetPassword(token, newPassword, opts) {
+            const r = await http.post('/auth/reset-password', {
+                token,
+                newPassword,
+                ...captchaBody(opts),
+            });
             if (r.status === 204)
                 return { ok: true };
-            if (r.status === 400)
-                return { ok: false, status: 400, error: 'This reset link is invalid or has expired.' };
+            if (r.status === 400) {
+                return {
+                    ok: false,
+                    status: 400,
+                    error: 'This reset link is invalid or has expired.',
+                    ...(captchaRequiredIn(r.data) ? { captchaRequired: true } : {}),
+                };
+            }
             if (r.status === 422)
                 return { ok: false, status: 422, error: 'New password does not meet the requirements.' };
             if (r.status === 501)

package/dist/auth/authService.js.map

@@ -1 +1 @@
-{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../src/auth/authService.ts"],"names":[],"mappings":"AA4GA,MAAM,UAAU,iBAAiB,CAAC,IAAgB;IAChD,OAAO;QACL;;;;;WAKG;QACH,KAAK,CAAC,KAAK,CAAC,YAAoB,EAAE,QAAgB;YAChD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAgC,CAAC;YAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YAC3F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC;gBAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,cAAwB,EAAE,CAAC;YACtE,CAAC;YACD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC1C,uEAAuE;gBACvE,2EAA2E;gBAC3E,iFAAiF;gBACjF,wFAAwF;gBACxF,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YACnF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC;YAC9F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QACjE,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,WAAW,CACf,cAAsB,EACtB,IAAY,EACZ,MAAM,GAAG,MAAM;YAEf,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACzE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAgC,CAAC;YAChD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC1C,6EAA6E;gBAC7E,0EAA0E;gBAC1E,yEAAyE;gBACzE,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,eAAe,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI;oBAC9C,6EAA6E;oBAC7E,4EAA4E;oBAC5E,qEAAqE;oBACrE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YAC3F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC;YAC9F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC5D,CAAC;QAED,wDAAwD;QACxD,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,IAAmC;YAEnC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,eAAe,EACf,EAAE,YAAY,EAAE,EAChB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC;YACF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAgC,CAAC;YAChD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAClE,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YACpF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,8DAA8D;iBACtE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QAC1F,CAAC;QAED,oFAAoF;QACpF,KAAK,CAAC,MAAM,CAAC,SAA6B;YACxC,IAAI,SAAS;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,EAAE,CAAC,WAAmB;YAC1B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,CAAC,CAAC,IAA0B,CAAC;YAC1C,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACrF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;YACpF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC3E,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,YAAY,CAAC,YAAoB;YACrC,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3D,wEAAwE;YACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,WAAmB;YACpD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;YACzF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;YAC3F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;YAC/E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAC7E,CAAC;QAED;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,YAAY,CAAC,KAAa;YAC9B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YACpF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;YACnF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;YACpF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,6DAA6D;iBACrE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,mEAAmE;iBAC3E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;QAC7F,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../src/auth/authService.ts"],"names":[],"mappings":"AAsEA,MAAM,eAAe,GAA4B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACvE,MAAM,iBAAiB,GAA+B,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AACpG,MAAM,aAAa,GAA2B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAErE,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,IAAa;IACtC,OAAO,CACL,IAAI,KAAK,IAAI;QACb,OAAO,IAAI,KAAK,QAAQ;QACvB,IAA8B,CAAC,OAAO,KAAK,UAAU,CACvD,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAA8B,CAAC;IACnE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAA2B,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAmB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,QAAQ,EAAE,QAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,IAAmB,EAAE,CAAC;AACvF,CAAC;AAED,wDAAwD;AACxD,SAAS,WAAW,CAAC,IAAkB;IACrC,OAAO,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAwFD,MAAM,UAAU,iBAAiB,CAAC,IAAgB;IAChD,OAAO;QACL;;;;;;WAMG;QACH,KAAK,CAAC,YAAY;YAChB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAgD,CAAC;gBAC3E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;oBAC5C,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,IAAI,CAAC,UAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;oBAC3E,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,UAAU,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;oBACpD,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;iBACxC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YACpF,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QACnF,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,KAAK,CAAC,YAAoB,EAAE,QAAgB,EAAE,IAAkB;YACpE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3F,MAAM,IAAI,GAAG,CAAC,CAAC,IAAgC,CAAC;YAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YAC3F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC;gBAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,cAAwB,EAAE,CAAC;YACtE,CAAC;YACD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC1C,uEAAuE;gBACvE,2EAA2E;gBAC3E,iFAAiF;gBACjF,wFAAwF;gBACxF,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,+BAA+B;oBACtC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC;YAC9F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QACjE,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,WAAW,CACf,cAAsB,EACtB,IAAY,EACZ,MAAM,GAAG,MAAM;YAEf,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACzE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAgC,CAAC;YAChD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC1C,6EAA6E;gBAC7E,0EAA0E;gBAC1E,yEAAyE;gBACzE,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,eAAe,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI;oBAC9C,6EAA6E;oBAC7E,4EAA4E;oBAC5E,qEAAqE;oBACrE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YAC3F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC;YAC9F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC5D,CAAC;QAED,wDAAwD;QACxD,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,IAAmC;YAEnC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,eAAe,EACf,EAAE,YAAY,EAAE,EAChB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC;YACF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAgC,CAAC;YAChD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAClE,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YACpF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,8DAA8D;iBACtE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QAC1F,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,MAAM,CAAC,MAAgD;YAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,IAAI,MAAM;oBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBACnE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;YAC7C,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC;YAClD,MAAM,WAAW,GAAG,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC;YAChD,MAAM,IAAI,CAAC,IAAI,CACb,cAAc,EACd,YAAY,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAC1D,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CACvD,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,EAAE,CAAC,WAAmB;YAC1B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,CAAC,CAAC,IAA0B,CAAC;YAC1C,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACrF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;YACpF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC3E,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,YAAY,CAAC,YAAoB,EAAE,IAAkB;YACzD,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjF,wEAAwE;YACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAED;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,WAAmB,EACnB,IAAkB;YAElB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBAChD,KAAK;gBACL,WAAW;gBACX,GAAG,WAAW,CAAC,IAAI,CAAC;aACrB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,4CAA4C;oBACnD,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;YAC3F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;YAC/E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAC7E,CAAC;QAED;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,YAAY,CAAC,KAAa;YAC9B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YACpF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;YACnF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;YACpF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,6DAA6D;iBACrE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,mEAAmE;iBAC3E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;QAC7F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/identityService.d.ts

@@ -12,12 +12,15 @@
  *
  * The server routes these hit (all `@Classified`, root-gated in Phase 2):
  *   GET/POST/PUT/DELETE  /identity/companies[/:uuid]
+ *   PUT                  /identity/companies/:uuid/parent
  *   GET/POST/PUT/DELETE  /identity/roles[/:uuid]
  *   GET/POST/PUT/DELETE  /identity/users[/:uuid]
+ *   POST                 /identity/users/:uuid/{reset-mfa,unlock,end-sessions}  (R11, body { code })
  *   GET/POST             /identity/users/:userUuid/memberships
  *   PUT/DELETE           /identity/memberships/:membershipUuid
  *   PUT                  /identity/memberships/:membershipUuid/postings
- *   GET                  /identity/companies/:companyUuid/{departments,branches}  (Phase 5 seam)
+ *   GET/POST             /identity/companies/:companyUuid/{departments,branches}
+ *   PUT/DELETE           /identity/{departments,branches}/:uuid  (G-012)
  *
  * NO raw UUID is ever a display value — list rows carry `{ id, fields }` (the id is a
  * key/param), membership cards carry `*Name` fields resolved server-side.
@@ -52,6 +55,22 @@ export interface IdentityRecord {
     id?: string;
     [key: string]: unknown;
 }
+/**
+ * One grantable permission from `GET /identity/permission-catalog`. Render `label` (never `key`);
+ * `description` / `caution` are the declared help text (null when none). `firstSeenAt` (ISO) and
+ * `firstSeenVersion` record when the permission first appeared (null when unknown).
+ */
+export interface PermissionCatalogRow {
+    key: string;
+    label: string;
+    module: string;
+    typeKey: string;
+    action: string;
+    description: string | null;
+    caution: string | null;
+    firstSeenAt: string | null;
+    firstSeenVersion: string | null;
+}
 /** `{ key, module, label, description?, permissionKeys[] }` — identified by key, never a uuid. */
 export interface AccessBundle {
     key: string;
@@ -78,10 +97,27 @@ export interface Posting {
     effectiveFrom?: string;
     effectiveUntil?: string;
 }
-export type PagedListResult = {
+/**
+ * A department or branch row from a company-scoped catalog list (G-012): `uuid` is the option
+ * value, `name` the label (never render the uuid). `usedBy` is the number of assignments
+ * (postings) the caller can see that reference the row; it is absent when the caller cannot read
+ * postings. It is advisory: the server's delete still decides (409 when the row is in use).
+ */
+export interface OrgUnitRow extends IdentityRecord {
+    uuid?: string;
+    name?: string;
+    usedBy?: number;
+}
+/** Optional paging for a company-scoped catalog list; omit it to get every row (up to 1000). */
+export interface OrgUnitListOpts {
+    page?: number;
+    limit?: number;
+    search?: string;
+}
+export type PagedListResult<R extends IdentityRecord = IdentityRecord> = {
     ok: true;
     total: number;
-    rows: IdentityRecord[];
+    rows: R[];
     page: number;
     limit: number;
 } | {
@@ -89,9 +125,9 @@ export type PagedListResult = {
     status: number;
     error: string;
 };
-export type GetRecordResult = {
+export type GetRecordResult<R extends IdentityRecord = IdentityRecord> = {
     ok: true;
-    record: IdentityRecord | null;
+    record: R | null;
 } | {
     ok: false;
     status: number;
@@ -119,6 +155,55 @@ export type OkResult = {
  * as `signInStatus`; no credential data is ever exposed.
  */
 export type SignInStatus = 'pending' | 'active' | 'none';
+/**
+ * Whether a user must use 2FA and has it (auth capabilities R11.3): `enrolled` = has a confirmed
+ * device; `required` = a policy requires it and none is set up (signs in restricted); `grace` =
+ * required, still inside the grace period; `not_required` = no policy applies. Never device
+ * names, secrets or counts.
+ */
+export type UserMfaStatus = 'enrolled' | 'required' | 'grace' | 'not_required';
+/** A user row from `listUsers` / `getUser`: the record plus the server-computed statuses. */
+export interface UserRecord extends IdentityRecord {
+    signInStatus?: SignInStatus;
+    /** Absent when the server does not compute it (no MFA policy feature wired). */
+    mfaStatus?: UserMfaStatus;
+}
+/**
+ * Why an admin sign-in action (reset 2FA, unlock, end sessions; R11) failed. The UI branches on it:
+ * - `code_required` — no code was sent (400 `mfa_required`)
+ * - `invalid_code` — the admin's code was wrong or expired (400 `invalid_request`)
+ * - `admin_needs_mfa` — the admin has no 2FA set up and must enrol first (409 `mfa_required`)
+ * - `forbidden` — not allowed (yourself, no permission, another tenant, user not dominated; 403)
+ * - `not_authenticated` (401), `not_found` (404)
+ * - `rate_limited` — too many code attempts (429)
+ * - `unavailable` — nothing was changed, try again (503)
+ * - `partially_applied` — part of the action ran; retrying is safe (503 `partially_applied`)
+ * - `unreachable` — the server could not be reached (status 0)
+ * - `failed` — anything else
+ */
+export type SignInAdminFailureReason = 'code_required' | 'invalid_code' | 'admin_needs_mfa' | 'forbidden' | 'not_authenticated' | 'not_found' | 'rate_limited' | 'unavailable' | 'partially_applied' | 'unreachable' | 'failed';
+/** Result of `resetUserMfa` / `unlockUser` / `endUserSessions`; `error` is a fixed message. */
+export type SignInAdminResult = {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    reason: SignInAdminFailureReason;
+    error: string;
+};
+/**
+ * Build a `?page&limit&search&sortBy&sortOrder` query string from a DataTable
+ * options bag, omitting anything absent/empty so the server applies its defaults.
+ * Values are URL-encoded. Returns '' (no leading '?') when nothing is set.
+ *
+ * Built with plain `encodeURIComponent` (not `URLSearchParams`) — this package has
+ * no `lib.dom`/Node ambient types (it must run unchanged on web AND React Native,
+ * where `URLSearchParams` isn't guaranteed to exist), and every key here is set at
+ * most once, so a manual `key=value` join is byte-identical to the source's
+ * `URLSearchParams#toString()` output. Shared with the other identity services (not
+ * part of the package barrel).
+ */
+export declare function listQueryString(opts?: ListOpts): string;
 /**
  * `inviteUser` result. `emailed`: the server sent the set-password email. `link`: the one-time
  * link, present only when the app opted in to returning it (`returnLinkToAdmin`); show it once.
@@ -134,7 +219,7 @@ export type InviteUserResult = {
 };
 export type ListPermissionCatalogResult = {
     ok: true;
-    catalog: string[];
+    catalog: PermissionCatalogRow[];
     wildcards: string[];
 } | {
     ok: false;
@@ -184,9 +269,26 @@ export type AddMembershipResult = {
     status: number;
     error: string;
 };
+/**
+ * A company-scoped catalog list. `total`/`page`/`limit` are present when the server sends them
+ * (G-012 servers always do), so a caller can tell whether `rows` is everything.
+ */
 export type ListCatalogRowsResult = {
     ok: true;
-    rows: IdentityRecord[];
+    rows: OrgUnitRow[];
+    total?: number;
+    page?: number;
+    limit?: number;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+/** `createDepartment` / `createBranch` / `createCompanyRole` result: the new row's uuid (a key, never a label) and name. */
+export type CreateOrgUnitResult = {
+    ok: true;
+    uuid: string;
+    name: string;
 } | {
     ok: false;
     status: number;
@@ -198,11 +300,17 @@ export interface IdentityService {
     createCompany(accessToken: string, name: string): Promise<CreateRecordResult>;
     updateCompany(accessToken: string, uuid: string, patch?: Record<string, unknown>): Promise<OkResult>;
     deleteCompany(accessToken: string, uuid: string): Promise<OkResult>;
+    /** Re-parent a company (`null` = top level, root only); the server checks cycles and reach. */
+    moveCompany(accessToken: string, uuid: string, parentUuid: string | null): Promise<OkResult>;
     listRoles(accessToken: string, opts?: ListOpts): Promise<PagedListResult>;
     getRole(accessToken: string, uuid: string): Promise<GetRecordResult>;
     createRole(accessToken: string, name: string): Promise<CreateRecordResult>;
     updateRole(accessToken: string, uuid: string, patch?: Record<string, unknown>): Promise<OkResult>;
     deleteRole(accessToken: string, uuid: string): Promise<OkResult>;
+    /** One company's own roles (G-013), paged like `listRoles`; 404 when the company is out of reach. */
+    listCompanyRoles(accessToken: string, companyUuid: string, opts?: ListOpts): Promise<PagedListResult>;
+    /** Create a role owned by the company (G-013); a refusal keeps the server's message. */
+    createCompanyRole(accessToken: string, companyUuid: string, name: string): Promise<CreateOrgUnitResult>;
     listPermissionCatalog(accessToken: string): Promise<ListPermissionCatalogResult>;
     listGrantsSummary(accessToken: string, opts?: ListOpts): Promise<ListGrantsSummaryResult>;
     listRolePermissions(accessToken: string, uuid: string): Promise<ListRolePermissionsResult>;
@@ -211,8 +319,8 @@ export interface IdentityService {
     listAccessBundles(accessToken: string): Promise<ListAccessBundlesResult>;
     grantAccessBundle(accessToken: string, uuid: string, key: string): Promise<OkResult>;
     revokeAccessBundle(accessToken: string, uuid: string, key: string): Promise<OkResult>;
-    listUsers(accessToken: string, opts?: ListOpts): Promise<PagedListResult>;
-    getUser(accessToken: string, uuid: string): Promise<GetRecordResult>;
+    listUsers(accessToken: string, opts?: ListOpts): Promise<PagedListResult<UserRecord>>;
+    getUser(accessToken: string, uuid: string): Promise<GetRecordResult<UserRecord>>;
     createUser(accessToken: string, input?: {
         username?: string;
         email?: string;
@@ -220,13 +328,22 @@ export interface IdentityService {
     updateUser(accessToken: string, uuid: string, patch?: Record<string, unknown>): Promise<OkResult>;
     deleteUser(accessToken: string, uuid: string): Promise<OkResult>;
     inviteUser(accessToken: string, userUuid: string): Promise<InviteUserResult>;
+    resetUserMfa(accessToken: string, userUuid: string, code: string): Promise<SignInAdminResult>;
+    unlockUser(accessToken: string, userUuid: string, code: string): Promise<SignInAdminResult>;
+    endUserSessions(accessToken: string, userUuid: string, code: string): Promise<SignInAdminResult>;
     getUserMemberships(accessToken: string, userUuid: string): Promise<GetUserMembershipsResult>;
     addMembership(accessToken: string, userUuid: string, companyUuid: string): Promise<AddMembershipResult>;
     setMembershipActive(accessToken: string, membershipUuid: string, userUuid: string): Promise<OkResult>;
     removeMembership(accessToken: string, membershipUuid: string): Promise<OkResult>;
     replacePostings(accessToken: string, membershipUuid: string, postings: Posting[]): Promise<OkResult>;
-    listDepartments(accessToken: string, companyUuid: string): Promise<ListCatalogRowsResult>;
-    listBranches(accessToken: string, companyUuid: string): Promise<ListCatalogRowsResult>;
+    listDepartments(accessToken: string, companyUuid: string, opts?: OrgUnitListOpts): Promise<ListCatalogRowsResult>;
+    listBranches(accessToken: string, companyUuid: string, opts?: OrgUnitListOpts): Promise<ListCatalogRowsResult>;
+    createDepartment(accessToken: string, companyUuid: string, name: string): Promise<CreateOrgUnitResult>;
+    renameDepartment(accessToken: string, uuid: string, name: string): Promise<OkResult>;
+    deleteDepartment(accessToken: string, uuid: string): Promise<OkResult>;
+    createBranch(accessToken: string, companyUuid: string, name: string): Promise<CreateOrgUnitResult>;
+    renameBranch(accessToken: string, uuid: string, name: string): Promise<OkResult>;
+    deleteBranch(accessToken: string, uuid: string): Promise<OkResult>;
 }
 export declare function createIdentityService(http: HttpClient): IdentityService;
 //# sourceMappingURL=identityService.d.ts.map