@astram/guard 0.1.1 → 0.3.0

package/dist/auth/account.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.controller.js","sourceRoot":"","sources":["../../src/auth/account.controller.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;;;;;;;;;;;;;;;AAEH,2CAcwB;AAExB,4FAAoE;AACpE,+EAA0E;AAC1E,yDAAwE;AAKxE,2CASqB;AAOrB,6DAAkG;AAElG,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,WAAW,GAAG,QAAQ,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEzC;;;;;GAKG;AACH,SAAS,YAAY;IACnB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;AAC9E,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY;IACnB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,mBAAU,CAAC,eAAe,CAAC,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU;IACjB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,EAAE,mBAAU,CAAC,oBAAoB,CAAC,CAAC;AACtE,CAAC;AAGM,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAOT;IAIA;IAIA;IAMA;IAKA;IAMA;IAOA;IAKA;IAKA;IAhDnB,YAMmB,MAA2B,EAI3B,MAAuB,EAIvB,MAAgC,EAMhC,OAA+B,EAK/B,aAAwC,EAMxC,YAAoC,EAOpC,eAAwC,EAKxC,aAAoC,EAKpC,UAAkC;QA1ClC,WAAM,GAAN,MAAM,CAAqB;QAI3B,WAAM,GAAN,MAAM,CAAiB;QAIvB,WAAM,GAAN,MAAM,CAA0B;QAMhC,YAAO,GAAP,OAAO,CAAwB;QAK/B,kBAAa,GAAb,aAAa,CAA2B;QAMxC,iBAAY,GAAZ,YAAY,CAAwB;QAOpC,oBAAe,GAAf,eAAe,CAAyB;QAKxC,kBAAa,GAAb,aAAa,CAAuB;QAKpC,eAAU,GAAV,UAAU,CAAwB;IAClD,CAAC;IAEJ;;;;;;OAMG;IACK,KAAK,CAAC,mBAAmB,CAAC,MAA4B;QAC5D,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACxE,OAAO,sBAAsB,CAAC;QAChC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;gBACjD,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC5B,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,KAAK;aACD,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,IAAI,CAAC;YAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACxF,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;YAChF,8CAA8C;YAC9C,OAAO,sBAAsB,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,aAAa,CAAC,aAAsB;QAChD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,YAAY,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,IAAA,yCAAkB,EAAC,aAAa,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,IAAI;YAAE,YAAY,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,IAAI;YAAE,YAAY,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACK,eAAe,CAAC,MAA4B,EAAE,qBAA8B;QAClF,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3D,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAIG,AAAN,KAAK,CAAC,cAAc,CACQ,aAAiC,EACnD,IAAwD;QAEhE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACvD,oFAAoF;QACpF,8BAA8B;QAC9B,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,eAAe,GAAG,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAElF,IAAI,WAAW,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,mBAAU,CAAC,oBAAoB,CAAC,CAAC;QACvF,CAAC;QACD,+EAA+E;QAC/E,+CAA+C;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnF,YAAY,EAAE,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3B,mFAAmF;QACnF,mFAAmF;QACnF,oFAAoF;QACpF,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YACvE,YAAY,EAAE,CAAC;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAE7C,+EAA+E;QAC/E,wDAAwD;QACxD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,IAAY;QACnD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EACrC,MAAM,CACP,CAAC;QACF,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IAIG,AAAN,KAAK,CAAC,aAAa,CACS,aAAiC,EACnD,IAAuC;QAE/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACvD,mFAAmF;QACnF,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEpC,4EAA4E;QAC5E,0CAA0C;QAC1C,MAAM,IAAI,GACR,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC3D,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAClB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,KAAK,GACT,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC7D,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YACnB,CAAC,CAAC,SAAS,CAAC;QAEhB,yEAAyE;QACzE,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9C,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC;QACD,iFAAiF;QACjF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,aAAa,CAAC,eAAe,CAAC,CAAC;QACjC,CAAC;QAED,4EAA4E;QAC5E,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACpE,YAAY,EAAE,CAAC;QACjB,CAAC;QAED,iFAAiF;QACjF,sEAAsE;QACtE,MAAM,OAAO,GAAsC,EAAE,CAAC;QACtD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,4CAA4C;IAC5C,8EAA8E;IAE9E;;;;;OAKG;IACK,KAAK,CAAC,oBAAoB,CAChC,WAAmB,EACnB,KAAwB,EACxB,MAAsB;QAEtB,MAAM,QAAQ,GAAG,IAAA,0CAAqB,GAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,sBAAsB,CAClC,KAAqB,EACrB,WAAmB,EACnB,IAAY;QAEZ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IAIG,AAAN,KAAK,CAAC,WAAW,CACW,aAAiC;QAE3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACvD,iFAAiF;QACjF,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,YAAY,EAAE,CAAC;QAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IAIG,AAAN,KAAK,CAAC,WAAW,CACW,aAAiC,EACnD,IAAuB;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACvD,mFAAmF;QACnF,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,YAAY,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;QAE9B,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,GAAG,CAAC;YAChB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC;YACvC,CAAC,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAErE,MAAM,MAAM,GAAG,IAAA,uCAAkB,GAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,IAAA,oCAAe,EAAC,MAAM,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;QAChG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAC1C,CAAC;IAED;;;;;;;;;OASG;IAIG,AAAN,KAAK,CAAC,aAAa,CACS,aAAiC,EACnD,IAA0C;QAElD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACvD,oFAAoF;QACpF,mFAAmF;QACnF,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IACE,IAAI,CAAC,UAAU,KAAK,SAAS;YAC7B,IAAI,CAAC,UAAU,KAAK,IAAI;YACxB,IAAI,CAAC,aAAa,KAAK,SAAS;YAChC,IAAI,CAAC,aAAa,KAAK,IAAI;YAC3B,IAAI,CAAC,MAAM,KAAK,SAAS,EACzB,CAAC;YACD,YAAY,EAAE,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;QAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3B,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7D,oFAAoF;QACpF,6EAA6E;QAC7E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QACxE,CAAC;QACD,kFAAkF;QAClF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAAE,UAAU,EAAE,CAAC;QAEzD,qFAAqF;QACrF,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC3D,8EAA8E;QAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QACxE,CAAC;QAED,8EAA8E;QAC9E,8EAA8E;QAC9E,oFAAoF;QACpF,8EAA8E;QAC9E,oFAAoF;QACpF,iFAAiF;QACjF,+EAA+E;QAC/E,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACtF,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;YACxF,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QACD,uDAAuD;QACvD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;OAOG;IAIG,AAAN,KAAK,CAAC,YAAY,CACU,aAAiC,EAC9C,EAAU,EACf,IAAuB;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACvD,6EAA6E;QAC7E,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,YAAY,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;QAE9B,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,aAAa,CAAC,cAAc,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACrF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IAIG,AAAN,KAAK,CAAC,YAAY,CACU,aAAiC,EAC9C,EAAU,EACf,IAAuB;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACvD,kFAAkF;QAClF,iFAAiF;QACjF,+EAA+E;QAC/E,kBAAkB;QAClB,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,YAAY,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;QAE9B,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7D,iFAAiF;QACjF,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,UAAU,GACd,CAAC,MAAM;YACP,IAAI,CAAC,aAAa,KAAK,SAAS;YAChC,IAAI,CAAC,aAAa,KAAK,IAAI;YAC3B,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;YAAE,UAAU,EAAE,CAAC;QAEzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QACxE,CAAC;QAED,qFAAqF;QACrF,IAAI,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBACpE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IAIG,AAAN,KAAK,CAAC,uBAAuB,CACD,aAAiC,EACnD,IAAuB;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACvD,mFAAmF;QACnF,4EAA4E;QAC5E,sDAAsD;QACtD,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IACE,IAAI,CAAC,UAAU,KAAK,SAAS;YAC7B,IAAI,CAAC,UAAU,KAAK,IAAI;YACxB,IAAI,CAAC,aAAa,KAAK,SAAS;YAChC,IAAI,CAAC,aAAa,KAAK,IAAI;YAC3B,IAAI,CAAC,MAAM,KAAK,SAAS,EACzB,CAAC;YACD,YAAY,EAAE,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;QAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3B,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7D,mFAAmF;QACnF,IAAI,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;YAAE,UAAU,EAAE,CAAC;QAEhE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;YAAE,UAAU,EAAE,CAAC;QAEzC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QACxF,OAAO,EAAE,aAAa,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AAhjBY,8CAAiB;AA2ItB;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAE7B,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;IACxB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;uDAqCR;AAsCK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,cAAK,EAAC,SAAS,CAAC;IAChB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IAErB,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;IACxB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;sDAqCR;AAyDK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,YAAG,EAAC,aAAa,CAAC;IAClB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IAErB,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;;;;oDAS1B;AAaK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IAErB,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;IACxB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;oDAkBR;AAeK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,qBAAqB,CAAC;IAC3B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IAErB,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;IACxB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;sDAwDR;AAaK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,cAAK,EAAC,wBAAwB,CAAC;IAC/B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IAErB,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;IACxB,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,IAAA,aAAI,GAAE,CAAA;;;;qDAgBR;AAeK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,eAAM,EAAC,iBAAiB,CAAC;IACzB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAE7B,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;IACxB,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,IAAA,aAAI,GAAE,CAAA;;;;qDAkCR;AAaK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,+BAA+B,CAAC;IACrC,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IAErB,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;IACxB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;gEAgCR;4BA/iBU,iBAAiB;IAD7B,IAAA,mBAAU,EAAC,SAAS,CAAC;IAMjB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,uCAA2B,CAAC,CAAA;IAGnC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,kCAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,oCAAwB,CAAC,CAAA;IAKhC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,kCAAsB,CAAC,CAAA;IAI9B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAKlC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAM5B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;IAI/B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,iCAAqB,CAAC,CAAA;IAI7B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;;GAhDvB,iBAAiB,CAgjB7B;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAClF,CAAC"}

package/dist/auth/auth.controller.d.ts

@@ -0,0 +1,316 @@
+/**
+ * Phase 0b Auth-surface — the framework-owned **`/auth/*` HTTP controllers**
+ * (spec §2). A consumer app gets login + MFA + refresh + logout FOR FREE by
+ * importing `ShieldModule.forRoot()` (which imports `AuthModule`); it writes no
+ * auth code. All four routes are `@Public()` (ADR-0002): they run BEFORE the
+ * caller has a session, so the global deny-by-default guard must NOT gate them.
+ *
+ * This controller is a THIN transport shim over the two composed core engines
+ * (`SHIELD_AUTHENTICATOR` / `SHIELD_SESSION_AUTHORITY`, from Team B). It holds NO
+ * business logic beyond mapping engine outcomes → HTTP status + the frozen DTO
+ * shapes (`./dto.ts`). Every security invariant is enforced here per the DTO
+ * header + the spec:
+ *
+ * ── OUTCOME → HTTP STATUS MAP (the security contract) ────────────────────────
+ *   login authenticated        → 200  SessionSuccess { session(no-secret), tokens }
+ *   login mfa_required          → 200  MfaChallengeResponse { mfaRequired, challengeToken }
+ *   login invalid_credentials   → 401  GENERIC   ← unknown-user AND wrong-password IDENTICAL
+ *   login auth_unavailable      → 503  RETRYABLE ← transient blip is NOT a credential deny
+ *   mfa   success               → 200  SessionSuccess
+ *   mfa   wrong/expired/forged   → 401  GENERIC   ← indistinguishable from a bad code
+ *   mfa   auth_unavailable      → 503  RETRYABLE
+ *   refresh ok                  → 200  SessionSuccess (new tokens, rotated session)
+ *   refresh reuse/invalid       → 401  GENERIC   session_rejected (lineage-kill is the engine's)
+ *   logout                      → 204  (idempotent; unknown/already-revoked → still 204)
+ *
+ * ── ANTI-ENUMERATION ── login + mfa failures are a SINGLE generic 401 with an
+ *   identical body (`{ error: 'invalid_credentials' }`) whether the user is
+ *   unknown, the password is wrong, or the factor is wrong/expired. The core
+ *   authenticator's decoy-verify already equalizes timing; this layer never adds a
+ *   distinguishing field/status.
+ *
+ * ── NO SECRET LEAK ── no password, hash, TOTP secret, raw token (beyond the two a
+ *   success legitimately mints), or challenge internal ever appears in a body or a
+ *   log. Request bodies are NEVER logged. The `SessionView` mapped from the core
+ *   `Session` carries no secret by construction.
+ *
+ * ── TRANSIENT ≠ DENY (ADR-0016) ── a transient `authentication_unavailable` from
+ *   the authenticator becomes a RETRYABLE 503, never a 401 — a dependency blip must
+ *   not look like (or trigger the client to treat it as) a credential failure.
+ *   ⚠ ENGINE-SEAM LIMIT on /auth/refresh: the core `SessionAuthority.rotate`
+ *   collapses BOTH a terminal deny AND a transient store outage into one
+ *   `SessionRejectedError` (its top-level fail-closed catch — see
+ *   session-authority.ts). From THIS seam the two are indistinguishable, so refresh
+ *   maps the generic reject to 401. Surfacing a retryable-503 on a refresh-time
+ *   store outage would require the engine to expose a transient signal it does not
+ *   today — flagged to the architect as a possible core-API gap (NOT worked around
+ *   here; we do not invent a core API).
+ *
+ * ADR-0023: composition is the framework's job — this controller only CONSUMES the
+ * composed engines via DI tokens; it never news-up an engine or an adapter.
+ */
+import type { Authenticator, PasswordHasher, SessionAuthority } from '@astram/core';
+import type { SessionFactsProjector } from './ports/session-facts-projector.js';
+import type { AttemptLimiter } from './rate-limit/attempt-limiter.js';
+import { PendingMfaStore } from './pending-mfa-store.js';
+import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import type { CurrentUserProfile, ProfileResolver } from './profile-resolver.js';
+import type { CredentialResolver } from '@astram/core';
+import type { ResetTokenStore } from './ports/reset-token-store.js';
+import type { EmailSender } from './ports/email-sender.js';
+import type { CredentialWriter } from './ports/credential-writer.js';
+import type { SessionSweeper } from './ports/session-sweeper.js';
+import type { RecoveryCodeStore } from './ports/recovery-code-store.js';
+import type { AuditSink } from './ports/audit-sink.js';
+import type { LoginRequest, LoginResponse, LogoutRequest, MfaRequest, RefreshRequest, SessionSuccess } from './dto.js';
+/**
+ * The framework-owned auth endpoints. Registered into `AuthModule`'s `controllers`
+ * by the integration owner / Team B (this controller is EXPORTED for that purpose;
+ * it does NOT edit auth.module.ts itself). Depends on the two composed engines +
+ * the pending-MFA store (provided alongside it).
+ */
+export declare class AuthController {
+    private readonly authenticator;
+    private readonly sessionAuthority;
+    private readonly pendingMfa;
+    private readonly tokenBinder?;
+    private readonly profileResolver?;
+    private readonly credentialResolver?;
+    private readonly resetTokenStore?;
+    private readonly emailSender?;
+    private readonly credentialWriter?;
+    private readonly sessionSweeper?;
+    private readonly passwordHasher?;
+    private readonly resetLinkBaseUrl?;
+    private readonly recoveryCodes?;
+    private readonly loginLimiter?;
+    private readonly recoveryLimiter?;
+    private readonly forgotLimiter?;
+    private readonly forgotHintLimiter?;
+    private readonly resetLimiter?;
+    private readonly auditSink?;
+    private readonly sessionFactsProjector?;
+    constructor(authenticator: Authenticator, sessionAuthority: SessionAuthority, pendingMfa: PendingMfaStore, tokenBinder?: SessionTokenBinder | undefined, profileResolver?: ProfileResolver | undefined, credentialResolver?: (CredentialResolver | null) | undefined, resetTokenStore?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, credentialWriter?: (CredentialWriter | null) | undefined, sessionSweeper?: (SessionSweeper | null) | undefined, passwordHasher?: PasswordHasher | undefined, resetLinkBaseUrl?: string | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined, recoveryLimiter?: (AttemptLimiter | null) | undefined, forgotLimiter?: (AttemptLimiter | null) | undefined, forgotHintLimiter?: (AttemptLimiter | null) | undefined, resetLimiter?: (AttemptLimiter | null) | undefined, auditSink?: (AuditSink | null) | undefined, sessionFactsProjector?: (SessionFactsProjector | null) | undefined);
+    /**
+     * Bind the established session's access token to the principal's claims (the
+     * request-auth layer). The access-token TTL is `expiresAtMs - issuedAtMs` from the
+     * session. Best-effort: a binding failure must not fail the login (the caller still
+     * gets valid tokens); the guard fails closed if the binding is absent.
+     */
+    private bindSession;
+    /**
+     * Project the principal's coarse grants for the session binding (ADR-0011), via the
+     * OPTIONAL {@link SessionFactsProjector} seam. Returns the {@link CoarseGrants} to
+     * cache, or `undefined` when there is no projector, the projection yielded nothing,
+     * OR it threw — every "no facts" path collapses to `undefined` so the caller simply
+     * omits `cachedFacts` and the request DB-reloads (fail-closed; a projection failure
+     * NEVER fails the login/refresh and never fabricates a grant).
+     */
+    private projectFacts;
+    /**
+     * Project coarse grants for a principal id + tenant (ADR-0011), distinguishing THREE
+     * outcomes for the REFRESH path (which must know whether to carry the existing cache
+     * forward, replace it, or strip it):
+     *   - `undefined` → NO projector wired → carry the existing `cachedFacts` forward.
+     *   - `null`      → projector present but yielded nothing (or threw) → STRIP the cache
+     *                   (→ next request DB-reloads; fail-closed).
+     *   - `CoarseGrants` → the fresh grants to cache.
+     * A throw collapses to `null` (fail-closed strip), never a login/refresh failure and
+     * never a fabricated grant.
+     */
+    private projectFactsFor;
+    /**
+     * Build a Principal directly from resolved internal claims (recovery/alt-factor
+     * paths that don't run the full authenticate() loop). Equivalent to the identity
+     * broker's internal-source normalize for this case — the credential resolver
+     * already returns canonical Internal-source claims (`id`, `tenantId`, `roleIds`),
+     * the same shape the TOTP success path's `requirePrincipal` yields. Returns
+     * `null` when `id`/`tenantId` are missing/malformed (→ the caller fails closed to
+     * a generic 401). `isRoot` is FORCED false here — a recovery login is
+     * never a source of elevated status (root is a broker/server-side decision,
+     * never a claim), matching the internal adapter's root-safety.
+     */
+    private principalFromClaims;
+    /**
+     * `POST /auth/login` — verify a password credential and either establish a
+     * session, issue an MFA challenge, deny generically, or signal a transient
+     * outage. NEVER logs the request body.
+     */
+    login(body: LoginRequest): Promise<LoginResponse>;
+    /**
+     * `GET /auth/me` — the signed-in user's **display profile** (name, email, active
+     * company name, role names) for the UI header/card. Fills the flagged gap: login
+     * returns only IDs, so without this a UI would either leak a raw UUID or show only
+     * the login hint.
+     *
+     * AUTH: this route is `@Public()` to the CLASSIFICATION guard (it is not an
+     * object-type permission — "read my own profile" has no typeKey to `decide()` on),
+     * but it authenticates the caller ITSELF: it resolves the bearer access token to a
+     * live `Principal` via the request-auth layer (the SAME liveness-gated path the
+     * enforcement guard uses). No/invalid/expired/revoked token → 401. So it is public
+     * only in the "not object-gated" sense — it is NOT unauthenticated.
+     *
+     * PROFILE: the framework is org-schema-agnostic, so it delegates id→name
+     * resolution to the consumer's {@link ProfileResolver} (the `profileResolver`
+     * seam). The resolver returns display NAMES (never raw UUIDs). Absent seam → 501
+     * (honest "not available"); resolver returns `null` (deleted user) → 404; resolver
+     * throws (store outage) → generic 500 (fail-closed, never a partial profile).
+     */
+    me(authorization?: string): Promise<CurrentUserProfile>;
+    /**
+     * `POST /auth/forgot-password` — request a password-reset link. ALWAYS returns 204
+     * with an identical (empty) body whether or not the hint matches a principal
+     * (ANTI-ENUMERATION, spec §4.1): the response must reveal nothing about whether an
+     * account exists.
+     *
+     * ── TIMING ANTI-ENUMERATION ── a MATCHING hint does extra work (mint + hash token,
+     *   issue it to the store, resolve the email, send it) that an UNKNOWN hint skips —
+     *   a naive `await` of that work would make the matching branch measurably slower, a
+     *   timing oracle. So the found-path work is FIRE-AND-FORGET: `deliverResetLink` is
+     *   invoked WITHOUT `await`, and the handler returns 204 immediately, so BOTH
+     *   branches return in ~constant time. A `.catch` is attached to the detached
+     *   promise so a store/email rejection is swallowed (never an unhandled rejection,
+     *   never a distinguishing error).
+     *
+     * ── SEAMS ── needs the credentialResolver (hint→principalId), the resetTokenStore,
+     *   and the emailSender. Any absent → the whole found-path is skipped and we still
+     *   return 204 (a deployment without the reset seams simply never sends — never a
+     *   501 here, which would itself be an enumeration signal on hint validity).
+     */
+    forgotPassword(body: {
+        identityHint?: string;
+    }, ip: string): Promise<void>;
+    /**
+     * The detached found-path work for {@link forgotPassword}: mint a raw token, issue
+     * its SHA-256 hash to the store (30-min TTL), resolve the recipient email via the
+     * profile resolver, and send the framework-composed reset link. Runs OUTSIDE the
+     * request/response timing (fire-and-forget) so it cannot form a timing oracle. Never
+     * logs the token or the email.
+     */
+    private deliverResetLink;
+    /**
+     * `POST /auth/reset-password` — complete a password reset with the emailed token.
+     *
+     * Outcomes:
+     *   • newPassword shorter than the minimum        → 422 `{ error: 'weak_password' }`
+     *   • resetTokenStore/credentialWriter/hasher absent → 501 `{ error: 'not_available' }`
+     *   • token unknown / expired / already-consumed  → 400 `{ error: 'invalid_token' }`
+     *   • success                                     → 204 (no body)
+     *
+     * On success: consume the token (single-use), hash + write the new password, then
+     * revoke ALL of the principal's sessions (reset kills every session, spec §5.1/§6)
+     * and invalidate any other outstanding reset tokens for the principal.
+     */
+    resetPassword(body: {
+        token?: string;
+        newPassword?: string;
+    }, ip: string): Promise<void>;
+    /**
+     * `POST /auth/mfa` — complete a pending MFA login. Consumes the single-use
+     * challenge handle (unknown/expired/forged → same generic 401 as a bad code),
+     * then BRANCHES on the presented factor:
+     *   • `'totp'` → RE-RUNS `authenticate(hint, [password, totp])` with the code
+     *     (the authenticator has no standalone factor-verify seam — the full attempt
+     *     IS the verify). Success → establish + tokens.
+     *   • `'recovery_code'` → the lost-device escape hatch: verify a one-time
+     *     recovery code (a separate branch, NOT the core factor loop — recovery codes
+     *     are N single-use Argon2 hashes, incompatible with the pure one-secret
+     *     `FactorVerifier`). See {@link completeViaRecoveryCode}.
+     *   • any other factor → generic 401 (no leak of "unsupported factor").
+     *
+     * Anti-enumeration: unknown/forged/expired challenge, unknown hint, wrong code,
+     * and wrong recovery code ALL return the identical generic 401.
+     */
+    mfa(body: MfaRequest): Promise<SessionSuccess>;
+    /**
+     * The `/auth/mfa` RECOVERY-CODE branch (spec §3). The lost-device user completes
+     * login with a pre-issued single-use recovery code instead of a TOTP.
+     *
+     * `pending` is the ALREADY-CONSUMED challenge (proof the password passed at
+     * `/auth/login` — §3: "the challenge IS proof of password"), so this branch does
+     * NOT re-verify the password, mirroring exactly how the TOTP branch trusts the
+     * challenge for the password and only checks the code.
+     *
+     * ── ANTI-ENUMERATION ── seam-absent, unknown hint, malformed claims, and a wrong
+     *   recovery code ALL raise the identical generic 401 — no path reveals whether
+     *   the user exists, has recovery codes, or which check failed.
+     *
+     * ── NO SAFEGUARDS YET ── rate-limit (Phase 3), `mustReenroll` (Phase 2), and
+     *   notify+audit (Phase 4) attach at the marked seams below.
+     */
+    private completeViaRecoveryCode;
+    /**
+     * Fire-and-forget security notice for a recovery-code login (spec §6.1). Resolves the
+     * recipient email via the already-injected {@link ProfileResolver} (the same seam
+     * forgot-password uses), then delivers a NEUTRAL "a recovery code was used to sign in"
+     * warning via {@link EmailSender}. Best-effort: NOT awaited by the caller, and it
+     * swallows every rejection so a missing email / resolver throw / send failure never
+     * fails the login. NO code / token / principal uuid is ever placed in the body — only
+     * the neutral notice the account owner needs to act on it.
+     */
+    private notifyRecoveryUsed;
+    /**
+     * Record an auth-SECURITY event (best-effort, fire-and-forget) and OPTIONALLY notify
+     * the account owner. The REUSABLE audit+notify primitive (feature #140) — it
+     * generalizes the two inlined blocks that {@link completeViaRecoveryCode} used to
+     * carry (the `auditSink.record(...)` call + the `notifyRecoveryUsed` email) so EVERY
+     * lockout/abuse path records a uniform, secret-free security event through ONE seam.
+     *
+     * ── NEVER THROWS INTO THE REQUEST PATH ── the (already-decided) HTTP response must
+     *   NOT change because an audit/notify failed or is slow: nothing here is awaited by
+     *   the caller, the audit `record` is fire-and-forget with a swallowed `.catch`, and
+     *   the notify runs inside {@link maybeNotifyOwner}'s own detached, swallowed IIFE.
+     *
+     * ── NO SECRET LEAK ── `attributes` carries only non-secret structured detail (a
+     *   reason code, never a password / recovery code / TOTP secret / token / hash). The
+     *   `identityHint` (the email/username the user typed) is acceptable in an AUDIT row
+     *   — it IS the actor identity the event is about — but it is written ONLY to the
+     *   audit attributes, NEVER used as a notify recipient (see the notify rule below).
+     *
+     * ── NOTIFY ONLY WITH A RESOLVED PRINCIPAL ── the owner email is resolved from
+     *   `actorId` + `tenantId` via the profile resolver. When there is NO resolved
+     *   principal (a pre-auth login lockout keys on the typed hint only — the resolver
+     *   has not run), we CANNOT know the real account owner, so we DO NOT notify: mailing
+     *   a bare hint could email a non-owner (the hint may be someone else's address / a
+     *   typo) and would confirm the account exists. In that case the AUDIT still fires;
+     *   only the notify is skipped.
+     */
+    private recordSecurityEvent;
+    /**
+     * Fire-and-forget "a security-sensitive event happened on your account" notice to the
+     * resolved owner (the generalized {@link notifyRecoveryUsed} path). Resolves the
+     * recipient email from `principalId` + `tenantId` via the injected profile resolver,
+     * then delivers a NEUTRAL security warning via the email sender. Best-effort: NOT
+     * awaited, and every rejection (missing email / resolver throw / send failure) is
+     * swallowed so it never changes the response. NO code / token / uuid ever enters the
+     * body — only the neutral notice the owner needs to act on it.
+     *
+     * Today the only notify caller is the recovery-code login (which routes through
+     * {@link recordSecurityEvent} with `notify:true`), so this delegates to the existing
+     * {@link notifyRecoveryUsed} message — the exact neutral, no-secret email the recovery
+     * behavior + its tests already assert (the refactor keeps that email byte-for-byte).
+     */
+    private maybeNotifyOwner;
+    /**
+     * `POST /auth/refresh` — rotate the refresh token. Reuse/invalid/expired →
+     * generic 401 (`session_rejected`; the engine already killed the lineage,
+     * ADR-0015). ⚠ See the class header: the engine's rotate collapses a transient
+     * store outage into the SAME reject, so refresh cannot emit the ADR-0016 503 from
+     * this seam today (flagged core-API gap).
+     */
+    refresh(body: RefreshRequest): Promise<SessionSuccess>;
+    /**
+     * `POST /auth/logout` — revoke the session. Idempotent + leak-free: revoking an
+     * unknown or already-revoked session still returns 204 (the engine's `revoke`
+     * swallows and returns void either way), so existence is never revealed.
+     */
+    logout(body: LogoutRequest): Promise<void>;
+    /**
+     * Establish a session for an authenticated principal, mapping the engine's
+     * generic `SessionRejectedError` (a malformed principal or a store outage at
+     * establish time) to a generic 401. We never surface a session-establish failure
+     * as a distinct, enumerable outcome.
+     */
+    private establishOrReject;
+}
+//# sourceMappingURL=auth.controller.d.ts.map

package/dist/auth/auth.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAeH,OAAO,KAAK,EACV,aAAa,EAIb,cAAc,EAGd,gBAAgB,EAEjB,MAAM,cAAc,CAAC;AAsBtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAGlF,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EAEf,MAAM,UAAU,CAAC;AA6FlB;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAO7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAIlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAS/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAI9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAQjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAS3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBAvGtB,aAAa,EAAE,aAAa,EAE5B,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,eAAe,EAO3B,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAOhC,eAAe,CAAC,EAAE,eAAe,YAAA,EAOjC,kBAAkB,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAI9C,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAIxC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,gBAAgB,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAI1C,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAItC,cAAc,CAAC,EAAE,cAAc,YAAA,EAK/B,gBAAgB,CAAC,EAAE,MAAM,YAAA,EAOzB,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EASxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAIpC,eAAe,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAQvC,aAAa,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKrC,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAS5B,qBAAqB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA;IAGvE;;;;;OAKG;YACW,WAAW;IAsCzB;;;;;;;OAOG;YACW,YAAY;IAQ1B;;;;;;;;;;OAUG;YACW,eAAe;IAc7B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;;;OAIG;IAIG,KAAK,CAAS,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAyE/D;;;;;;;;;;;;;;;;;;OAkBG;IAIG,EAAE,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4CvF;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,cAAc,CACV,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAIjC,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IA+FhB;;;;;;OAMG;YACW,gBAAgB;IAyC9B;;;;;;;;;;;;OAYG;IAIG,aAAa,CACT,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAEhD,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;;;;;;;;;;;;OAeG;IAIG,GAAG,CAAS,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAyC5D;;;;;;;;;;;;;;;OAeG;YACW,uBAAuB;IAoFrC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAiC1B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;OAMG;IAIG,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAmCpE;;;;OAIG;IAIG,MAAM,CAAS,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAexD;;;;;OAKG;YACW,iBAAiB;CAOhC"}