@astram/guard 0.10.1 → 0.11.0

package/dist/auth/auth.controller.d.ts

@@ -53,6 +53,7 @@
  * composed engines via DI tokens; it never news-up an engine or an adapter.
  */
 import type { Authenticator, PasswordHasher, SessionAuthority } from '@astram/core';
+import type { EmailChangeTokenStore } from './ports/email-change-token-store.js';
 import type { SessionRestrictionStore } from '../session/session-restriction-store.js';
 import type { SessionRecordStore } from '@astram/core';
 import type { Clock, SessionLifetimeConfig } from '@astram/core';
@@ -113,7 +114,8 @@ export declare class AuthController {
     private readonly rootIds?;
     private readonly sessionRecords?;
     private readonly sessionRestrictions?;
-    constructor(authenticator: Authenticator, sessionAuthority: SessionAuthority, pendingMfa: PendingMfaStore, tokenBinder?: SessionTokenBinder | undefined, profileResolver?: ProfileResolver | undefined, credentialResolver?: (CredentialResolver | null) | undefined, resetTokenStore?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, credentialWriter?: (CredentialWriter | null) | undefined, sessionSweeper?: (SessionSweeper | null) | undefined, passwordHasher?: PasswordHasher | undefined, resetLinkBaseUrl?: string | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined, loginIpLimiter?: (AttemptLimiter | null) | undefined, trustProxyCheck?: (TrustProxyBootCheck | null) | undefined, recoveryLimiter?: (AttemptLimiter | null) | undefined, forgotLimiter?: (AttemptLimiter | null) | undefined, forgotHintLimiter?: (AttemptLimiter | null) | undefined, resetLimiter?: (AttemptLimiter | null) | undefined, auditSink?: (AuditSink | null) | undefined, sessionFactsProjector?: (SessionFactsProjector | null) | undefined, scopeSubtreeResolver?: (ScopeSubtreeResolver | null) | undefined, membershipChecker?: (MembershipChecker | null) | undefined, permissionFacts?: (MariaDbPermissionFactsAdapter | null) | undefined, mfaLimiter?: (AttemptLimiter | null) | undefined, mfaStepUp?: (MfaStepUp | null) | undefined, clock?: (Clock | null) | undefined, lifetimes?: (SessionLifetimeConfig | null) | undefined, rootIds?: (readonly string[] | null) | undefined, sessionRecords?: (Pick<SessionRecordStore, "findSessionById"> | null) | undefined, sessionRestrictions?: (SessionRestrictionStore | null) | undefined);
+    private readonly emailChangeTokens?;
+    constructor(authenticator: Authenticator, sessionAuthority: SessionAuthority, pendingMfa: PendingMfaStore, tokenBinder?: SessionTokenBinder | undefined, profileResolver?: ProfileResolver | undefined, credentialResolver?: (CredentialResolver | null) | undefined, resetTokenStore?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, credentialWriter?: (CredentialWriter | null) | undefined, sessionSweeper?: (SessionSweeper | null) | undefined, passwordHasher?: PasswordHasher | undefined, resetLinkBaseUrl?: string | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined, loginIpLimiter?: (AttemptLimiter | null) | undefined, trustProxyCheck?: (TrustProxyBootCheck | null) | undefined, recoveryLimiter?: (AttemptLimiter | null) | undefined, forgotLimiter?: (AttemptLimiter | null) | undefined, forgotHintLimiter?: (AttemptLimiter | null) | undefined, resetLimiter?: (AttemptLimiter | null) | undefined, auditSink?: (AuditSink | null) | undefined, sessionFactsProjector?: (SessionFactsProjector | null) | undefined, scopeSubtreeResolver?: (ScopeSubtreeResolver | null) | undefined, membershipChecker?: (MembershipChecker | null) | undefined, permissionFacts?: (MariaDbPermissionFactsAdapter | null) | undefined, mfaLimiter?: (AttemptLimiter | null) | undefined, mfaStepUp?: (MfaStepUp | null) | undefined, clock?: (Clock | null) | undefined, lifetimes?: (SessionLifetimeConfig | null) | undefined, rootIds?: (readonly string[] | null) | undefined, sessionRecords?: (Pick<SessionRecordStore, "findSessionById"> | null) | undefined, sessionRestrictions?: (SessionRestrictionStore | null) | undefined, emailChangeTokens?: (EmailChangeTokenStore | null) | undefined);
     /**
      * The access-token binding TTL for an establishment (security hardening #8):
      * `clamp(session.expiresAtMs − now, 1, accessTtlMs)` — on login AND refresh. Never derived

package/dist/auth/auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAeH,OAAO,KAAK,EACV,aAAa,EAIb,cAAc,EAGd,gBAAgB,EAEjB,MAAM,cAAc,CAAC;AA+BtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAOjE,OAAO,EAA2C,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,iCAAiC,CAAC;AAOtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,cAAc,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,KAAK,EAEV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EAEf,MAAM,UAAU,CAAC;AA8GlB;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAO7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAIlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAY/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAM9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAQjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAS3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAWvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAStC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAYnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAMjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAK3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAGvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAM3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAMzB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBA3LpB,aAAa,EAAE,aAAa,EAE5B,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,eAAe,EAO3B,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAOhC,eAAe,CAAC,EAAE,eAAe,YAAA,EAOjC,kBAAkB,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAI9C,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAIxC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,gBAAgB,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAI1C,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAItC,cAAc,CAAC,EAAE,cAAc,YAAA,EAK/B,gBAAgB,CAAC,EAAE,MAAM,YAAA,EAOzB,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAYxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMpC,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMtC,eAAe,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5C,eAAe,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAQvC,aAAa,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKrC,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAS5B,qBAAqB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAWpD,oBAAoB,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA,EASlD,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAY5C,eAAe,CAAC,GAAE,6BAA6B,GAAG,IAAI,aAAA,EAMtD,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAK5B,KAAK,CAAC,GAAE,KAAK,GAAG,IAAI,aAAA,EAGpB,SAAS,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAMxC,OAAO,CAAC,GAAE,SAAS,MAAM,EAAE,GAAG,IAAI,aAAA,EAMlC,cAAc,CAAC,GAAE,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,GAAG,IAAI,aAAA,EAMnE,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA;IAGvE;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;OAKG;YACW,WAAW;IAiEzB;;;;;;;;;;OAUG;YACW,eAAe;IAgB7B;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAIjC;;;;;;;;OAQG;IACH;;;;;;;;OAQG;YACW,iBAAiB;YAcjB,sBAAsB;IAcpC;;;;;;;;;;OAUG;YACW,gBAAgB;IAY9B;;;;;;;;OAQG;YACW,uBAAuB;IAarC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;;;;;;;OAUG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK;YAIC,aAAa;IAM3B;;;;OAIG;IAIG,KAAK,CACD,IAAI,EAAE,YAAY,EAIpB,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC;IA0JzB;;;;;;;;;;;;;;;;;;OAkBG;IAIG,EAAE,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmCvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAIG,WAAW,CACP,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EACb,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAqFjF;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,cAAc,CACV,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAKjC,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAgEhB;;;;;;;;;;OAUG;YACW,oBAAoB;IAqClC;;;;;;;;;OASG;YACW,gBAAgB;IAwC9B;;;;;;;;;;;;OAYG;IAIG,aAAa,CACT,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAEhD,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAsFhB;;;;;;;;;;;;;;;;OAgBG;IAIG,GAAG,CAAS,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0B5D;;;;;;;;;;;;;;OAcG;YACW,eAAe;IA8C7B;;;;;;;;;;;;;;;OAeG;YACW,uBAAuB;IAuGrC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAoC1B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;OAUG;IAIG,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAkEpE;;;;OAIG;YACW,cAAc;IAe5B;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,cAAc;IAgE5B;;;;OAIG;IAIG,MAAM,CAAS,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAexD;;;;;OAKG;YACW,iBAAiB;CAOhC"}
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAeH,OAAO,KAAK,EACV,aAAa,EAIb,cAAc,EAGd,gBAAgB,EAEjB,MAAM,cAAc,CAAC;AA+BtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAEjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAQjE,OAAO,EAA2C,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,iCAAiC,CAAC;AAOtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,cAAc,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,KAAK,EAEV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EAEf,MAAM,UAAU,CAAC;AA8GlB;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAO7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAIlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAY/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAM9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAQjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAS3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAWvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAStC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAYnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAMjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAK3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAGvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAM3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAMzB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAIrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBA/LlB,aAAa,EAAE,aAAa,EAE5B,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,eAAe,EAO3B,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAOhC,eAAe,CAAC,EAAE,eAAe,YAAA,EAOjC,kBAAkB,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAI9C,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAIxC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,gBAAgB,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAI1C,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAItC,cAAc,CAAC,EAAE,cAAc,YAAA,EAK/B,gBAAgB,CAAC,EAAE,MAAM,YAAA,EAOzB,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAYxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMpC,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMtC,eAAe,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5C,eAAe,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAQvC,aAAa,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKrC,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAS5B,qBAAqB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAWpD,oBAAoB,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA,EASlD,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAY5C,eAAe,CAAC,GAAE,6BAA6B,GAAG,IAAI,aAAA,EAMtD,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAK5B,KAAK,CAAC,GAAE,KAAK,GAAG,IAAI,aAAA,EAGpB,SAAS,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAMxC,OAAO,CAAC,GAAE,SAAS,MAAM,EAAE,GAAG,IAAI,aAAA,EAMlC,cAAc,CAAC,GAAE,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,GAAG,IAAI,aAAA,EAMnE,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA,EAIpD,iBAAiB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA;IAGnE;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;OAKG;YACW,WAAW;IAiEzB;;;;;;;;;;OAUG;YACW,eAAe;IAgB7B;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAIjC;;;;;;;;OAQG;IACH;;;;;;;;OAQG;YACW,iBAAiB;YAcjB,sBAAsB;IAcpC;;;;;;;;;;OAUG;YACW,gBAAgB;IAY9B;;;;;;;;OAQG;YACW,uBAAuB;IAarC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;;;;;;;OAUG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK;YAIC,aAAa;IAM3B;;;;OAIG;IAIG,KAAK,CACD,IAAI,EAAE,YAAY,EAIpB,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC;IA0JzB;;;;;;;;;;;;;;;;;;OAkBG;IAIG,EAAE,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmCvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAIG,WAAW,CACP,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EACb,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAyFjF;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,cAAc,CACV,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAKjC,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAgEhB;;;;;;;;;;OAUG;YACW,oBAAoB;IAqClC;;;;;;;;;OASG;YACW,gBAAgB;IAwC9B;;;;;;;;;;;;OAYG;IAIG,aAAa,CACT,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAEhD,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IA0FhB;;;;;;;;;;;;;;;;OAgBG;IAIG,GAAG,CAAS,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0B5D;;;;;;;;;;;;;;OAcG;YACW,eAAe;IA8C7B;;;;;;;;;;;;;;;OAeG;YACW,uBAAuB;IAuGrC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAoC1B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;OAUG;IAIG,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAkEpE;;;;OAIG;YACW,cAAc;IAe5B;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,cAAc;IAgE5B;;;;OAIG;IAIG,MAAM,CAAS,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAexD;;;;;OAKG;YACW,iBAAiB;CAOhC"}

package/dist/auth/auth.controller.js

@@ -73,6 +73,7 @@ const common_2 = require("@nestjs/common");
 const classification_decorator_js_1 = require("../enforcement/classification.decorator.js");
 const tokens_js_1 = require("./tokens.js");
 const mariadb_session_record_store_js_1 = require("../session/mariadb-session-record-store.js");
+const engine_1 = require("@astram/engine");
 const crypto_adapters_js_1 = require("../session/crypto-adapters.js");
 const session_lifetimes_js_1 = require("../session/session-lifetimes.js");
 const mfa_step_up_js_1 = require("./mfa-step-up.js");
@@ -215,7 +216,8 @@ let AuthController = class AuthController {
     rootIds;
     sessionRecords;
     sessionRestrictions;
-    constructor(authenticator, sessionAuthority, pendingMfa, tokenBinder, profileResolver, credentialResolver, resetTokenStore, emailSender, credentialWriter, sessionSweeper, passwordHasher, resetLinkBaseUrl, recoveryCodes, loginLimiter, loginIpLimiter, trustProxyCheck, recoveryLimiter, forgotLimiter, forgotHintLimiter, resetLimiter, auditSink, sessionFactsProjector, scopeSubtreeResolver, membershipChecker, permissionFacts, mfaLimiter, mfaStepUp, clock, lifetimes, rootIds, sessionRecords, sessionRestrictions) {
+    emailChangeTokens;
+    constructor(authenticator, sessionAuthority, pendingMfa, tokenBinder, profileResolver, credentialResolver, resetTokenStore, emailSender, credentialWriter, sessionSweeper, passwordHasher, resetLinkBaseUrl, recoveryCodes, loginLimiter, loginIpLimiter, trustProxyCheck, recoveryLimiter, forgotLimiter, forgotHintLimiter, resetLimiter, auditSink, sessionFactsProjector, scopeSubtreeResolver, membershipChecker, permissionFacts, mfaLimiter, mfaStepUp, clock, lifetimes, rootIds, sessionRecords, sessionRestrictions, emailChangeTokens) {
         this.authenticator = authenticator;
         this.sessionAuthority = sessionAuthority;
         this.pendingMfa = pendingMfa;
@@ -248,6 +250,7 @@ let AuthController = class AuthController {
         this.rootIds = rootIds;
         this.sessionRecords = sessionRecords;
         this.sessionRestrictions = sessionRestrictions;
+        this.emailChangeTokens = emailChangeTokens;
     }
     /**
      * The access-token binding TTL for an establishment (security hardening #8):
@@ -768,8 +771,12 @@ let AuthController = class AuthController {
         if (claims === null) {
             throw new common_1.HttpException({ error: 'unauthorized' }, common_1.HttpStatus.UNAUTHORIZED);
         }
-        const targetNodeId = typeof body?.targetNodeId === 'string' ? body.targetNodeId : '';
-        if (targetNodeId === '') {
+        // Phase 11 #1 / KI #79: only a canonical uuid is checked and BOUND. The membership check is SQL
+        // (`utf8mb4_unicode_ci` ignores case, trailing spaces and width), so any other spelling would
+        // pass the gate and be bound as the session's tenant in the caller's spelling — its
+        // `shield:permver:<tenant>` key then misses every bump published to the stored id.
+        const targetNodeId = (0, engine_1.canonicalUuid)(body?.targetNodeId);
+        if (targetNodeId === null) {
             throw new common_1.HttpException({ error: 'invalid_target' }, common_1.HttpStatus.BAD_REQUEST);
         }
         // 2) ROOT does not switch (already unbounded; a switch could only NARROW its reach).
@@ -1088,6 +1095,10 @@ let AuthController = class AuthController {
         }
         // Burn any other outstanding reset tokens for the principal (single active reset).
         await store.invalidateAllForPrincipal(principalId);
+        // Phase 12 (A8): a pending self-service email change dies with the old password too.
+        await this.emailChangeTokens?.invalidateAllForPrincipal(principalId).catch((err) => {
+            sweepError ??= err;
+        });
         if (sweepError !== undefined)
             throw sweepError;
     }
@@ -1758,7 +1769,9 @@ exports.AuthController = AuthController = __decorate([
     __param(30, (0, common_1.Inject)(mariadb_session_record_store_js_1.SHIELD_SESSION_RECORD_STORE)),
     __param(31, (0, common_2.Optional)()),
     __param(31, (0, common_1.Inject)(tokens_js_1.SHIELD_SESSION_RESTRICTIONS)),
-    __metadata("design:paramtypes", [Object, Object, pending_mfa_store_js_1.PendingMfaStore, Function, Object, Object, Object, Object, Object, Object, Object, String, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object])
+    __param(32, (0, common_2.Optional)()),
+    __param(32, (0, common_1.Inject)(tokens_js_1.SHIELD_EMAIL_CHANGE_TOKEN_STORE)),
+    __metadata("design:paramtypes", [Object, Object, pending_mfa_store_js_1.PendingMfaStore, Function, Object, Object, Object, Object, Object, Object, Object, String, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object])
 ], AuthController);
 /**
  * Narrow an `authenticated` result to its guaranteed principal. The core engine

package/dist/auth/auth.module.d.ts

@@ -218,6 +218,12 @@ export interface AuthModuleOptions {
      * target node before re-binding the session. Only meaningful under `auth: true`.
      */
     readonly membershipChecker?: MembershipChecker;
+    /**
+     * The base URL of the app's confirm-email page (Phase 12, KI #14). The mailed link is
+     * `${emailChangeLinkBaseUrl}#t=<token>` (the token in the fragment, never the query). Default
+     * `http://localhost:5173/confirm-email`.
+     */
+    readonly emailChangeLinkBaseUrl?: string;
 }
 /**
  * The no-override default sender decision (pure apart from the warning). Exported for

package/dist/auth/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAanF,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EAEf,MAAM,cAAc,CAAC;AAwFtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAavD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAqfD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CAChD;AAiFD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAcrF;AAqFD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CA8J/D"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAanF,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EAEf,MAAM,cAAc,CAAC;AAiGtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAavD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAqfD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AA2HD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAcrF;AAqFD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CAsK/D"}

package/dist/auth/auth.module.js

@@ -118,6 +118,9 @@ const mariadb_profile_resolver_js_1 = require("../authentication/mariadb-profile
 const mariadb_credential_writer_js_1 = require("../authentication/mariadb-credential-writer.js");
 const mariadb_profile_writer_js_1 = require("../authentication/mariadb-profile-writer.js");
 const mariadb_reset_token_store_js_1 = require("../authentication/mariadb-reset-token-store.js");
+const mariadb_email_change_token_store_js_1 = require("../authentication/mariadb-email-change-token-store.js");
+const mariadb_email_address_changer_js_1 = require("../authentication/mariadb-email-address-changer.js");
+const email_change_messages_js_1 = require("./email-change-messages.js");
 const mariadb_recovery_code_store_js_1 = require("../authentication/mariadb-recovery-code-store.js");
 const mariadb_mfa_device_store_js_1 = require("../authentication/mariadb-mfa-device-store.js");
 const mariadb_session_sweeper_js_1 = require("../authentication/mariadb-session-sweeper.js");
@@ -130,6 +133,7 @@ const index_js_1 = require("../session/index.js");
 const persistence_module_js_1 = require("./persistence.module.js");
 const auth_controller_js_1 = require("./auth.controller.js");
 const account_controller_js_1 = require("./account.controller.js");
+const confirm_email_controller_js_1 = require("./confirm-email.controller.js");
 const pending_mfa_store_js_1 = require("./pending-mfa-store.js");
 const mfa_step_up_js_1 = require("./mfa-step-up.js");
 const tokens_js_1 = require("./tokens.js");
@@ -647,6 +651,46 @@ function makeResetTokenStoreProvider(override) {
             inject: [tokens_js_1.SHIELD_DB_POOL],
         };
 }
+/**
+ * The self-service email-change token store (Phase 12, KI #14) — always the framework default
+ * over `shield_identity.email_change_token` (identity migration 020); no consumer override seam.
+ */
+const emailChangeTokenStoreProvider = {
+    provide: tokens_js_1.SHIELD_EMAIL_CHANGE_TOKEN_STORE,
+    useFactory: (pool) => new mariadb_email_change_token_store_js_1.MariaDbEmailChangeTokenStore(pool),
+    inject: [tokens_js_1.SHIELD_DB_POOL],
+};
+/** The ONE email read/write path for an email change (Phase 12): the framework default. */
+const emailAddressChangerProvider = {
+    provide: tokens_js_1.SHIELD_EMAIL_ADDRESS_CHANGER,
+    useFactory: (pool) => new mariadb_email_address_changer_js_1.MariaDbEmailAddressChanger(pool),
+    inject: [tokens_js_1.SHIELD_DB_POOL],
+};
+/**
+ * The per-account email-change REQUEST limiter (Phase 12) — `email-change:pid:<id>`, 3 per 60-min
+ * window, so the route cannot spam an inbox. `consume` fails closed (503).
+ */
+const emailChangeLimiterProvider = {
+    provide: tokens_js_1.SHIELD_EMAIL_CHANGE_LIMITER,
+    useFactory: (redis) => new attempt_limiter_js_1.AttemptLimiter(redis, { maxAttempts: 3, windowMs: 60 * 60 * 1000 }),
+    inject: [tokens_js_1.SHIELD_REDIS],
+};
+/**
+ * The `POST /auth/confirm-email` per-IP limiter (Phase 12, A6) — `confirm-email:ip:<ip>`, 10 per
+ * 15-min window (like reset-password); enforced only with an explicit `trust proxy`.
+ */
+const confirmEmailLimiterProvider = {
+    provide: tokens_js_1.SHIELD_CONFIRM_EMAIL_LIMITER,
+    useFactory: (redis) => new attempt_limiter_js_1.AttemptLimiter(redis, { maxAttempts: 10, windowMs: 15 * 60 * 1000 }),
+    inject: [tokens_js_1.SHIELD_REDIS],
+};
+/** The confirm-link base (`ShieldModule.forRoot({ emailChangeLinkBaseUrl })`, dev default). */
+function makeEmailChangeLinkBaseUrlProvider(base) {
+    return {
+        provide: tokens_js_1.SHIELD_EMAIL_CHANGE_LINK_BASE_URL,
+        useValue: base ?? email_change_messages_js_1.DEFAULT_EMAIL_CHANGE_LINK_BASE_URL,
+    };
+}
 /**
  * Bind the {@link EmailSender} (security hardening #6):
  *  - a supplied sender → used verbatim (any environment);
@@ -800,7 +844,8 @@ let AuthModule = AuthModule_1 = class AuthModule {
             // injects the two composed engines (below) + PendingMfaStore.
             // AuthFactsController serves the framework-default `/identity/auth-facts` +
             // `/identity/permissions-version` (over the SHIELD_PERMISSION_FACTS adapter below).
-            controllers: [auth_controller_js_1.AuthController, account_controller_js_1.AccountController, auth_facts_controller_js_1.AuthFactsController],
+            // ConfirmEmailController (Phase 12): `POST /auth/confirm-email`, beside AuthController.
+            controllers: [auth_controller_js_1.AuthController, confirm_email_controller_js_1.ConfirmEmailController, account_controller_js_1.AccountController, auth_facts_controller_js_1.AuthFactsController],
             providers: [
                 passwordHasherProvider,
                 makeCredentialResolverProvider(options.credentialResolver),
@@ -809,6 +854,11 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 // The account/credential-surface seams (null when absent → route 501).
                 makeCredentialWriterProvider(options.credentialWriter),
                 makeResetTokenStoreProvider(options.resetTokenStore),
+                emailChangeTokenStoreProvider,
+                emailAddressChangerProvider,
+                emailChangeLimiterProvider,
+                confirmEmailLimiterProvider,
+                makeEmailChangeLinkBaseUrlProvider(options.emailChangeLinkBaseUrl),
                 makeEmailSenderProvider(options.emailSender),
                 makeRecoveryCodeStoreProvider(options.recoveryCodeStore),
                 makeProfileWriterProvider(options.profileWriter),
@@ -912,6 +962,8 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 // and the account/auth controllers see them app-wide through @Global Shield.
                 tokens_js_1.SHIELD_CREDENTIAL_WRITER,
                 tokens_js_1.SHIELD_RESET_TOKEN_STORE,
+                // Phase 12: identity's admin email change invalidates pending self-service tokens.
+                tokens_js_1.SHIELD_EMAIL_CHANGE_TOKEN_STORE,
                 tokens_js_1.SHIELD_EMAIL_SENDER,
                 tokens_js_1.SHIELD_RECOVERY_CODE_STORE,
                 tokens_js_1.SHIELD_PROFILE_WRITER,

package/dist/auth/confirm-email.controller.d.ts

@@ -0,0 +1,33 @@
+import type { AttemptLimiter } from './rate-limit/attempt-limiter.js';
+import { TrustProxyBootCheck } from './rate-limit/trust-proxy-check.js';
+import type { AuditSink } from './ports/audit-sink.js';
+import type { EmailSender } from './ports/email-sender.js';
+import type { EmailChangeTokenStore } from './ports/email-change-token-store.js';
+import type { EmailAddressChanger } from './ports/email-address-changer.js';
+import type { ResetTokenStore } from './ports/reset-token-store.js';
+import type { SessionSweeper } from './ports/session-sweeper.js';
+export declare class ConfirmEmailController {
+    private readonly tokens?;
+    private readonly addresses?;
+    private readonly sweeper?;
+    private readonly resetTokens?;
+    private readonly emailSender?;
+    private readonly auditSink?;
+    private readonly limiter?;
+    private readonly trustProxyCheck?;
+    constructor(tokens?: (EmailChangeTokenStore | null) | undefined, addresses?: (EmailAddressChanger | null) | undefined, sweeper?: (SessionSweeper | null) | undefined, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, auditSink?: (AuditSink | null) | undefined, limiter?: (AttemptLimiter | null) | undefined, trustProxyCheck?: (Pick<TrustProxyBootCheck, "perIpLimitingEnabled"> | null) | undefined);
+    confirmEmail(body: {
+        token?: unknown;
+    }, ip: string): Promise<{
+        ok: true;
+    }>;
+    /**
+     * Best-effort auth audit (A9): masked address, a reason code; never a token. Attributed to the
+     * token's user and the tenant of the session that requested the change (KI #14 re-review P1-2:
+     * the confirm request may carry no session, and `audit_log.al_tenant_id` is NOT NULL). Only a
+     * consumed token has a binding, so an unknown / expired / used token is never audited: there is
+     * no user or tenant to attribute it to (the per-IP limiter bounds that path).
+     */
+    private audit;
+}
+//# sourceMappingURL=confirm-email.controller.d.ts.map

package/dist/auth/confirm-email.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-email.controller.d.ts","sourceRoot":"","sources":["../../src/auth/confirm-email.controller.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAEV,qBAAqB,EACtB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,kCAAkC,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAcjE,qBACa,sBAAsB;IAI/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAGxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAGzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAGzB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBArBhB,MAAM,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAGrC,SAAS,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAGtC,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAG/B,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAGpC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAGhC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAG5B,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAG/B,eAAe,CAAC,GAAE,IAAI,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,GAAG,IAAI,aAAA;IAMvF,YAAY,CACR,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAE3B,EAAE,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IA6ExB;;;;;;OAMG;IACH,OAAO,CAAC,KAAK;CAkBd"}

package/dist/auth/confirm-email.controller.js

@@ -0,0 +1,205 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfirmEmailController = void 0;
+/**
+ * `POST /auth/confirm-email` — the CONFIRM half of the verified self-service email change (security
+ * hardening Phase 12, KI #14). `@Public()`: the link may be opened on a device with no session; the
+ * single-use token IS the credential. The request half is `PATCH /account/profile`.
+ *
+ * Flow:
+ *   1. per-IP budget `confirm-email:ip:<ip>` (A6; enforced only with an explicit `trust proxy`);
+ *   2. consume the token atomically (sha256; single use) — unknown / expired / used → 400;
+ *   3. ONE transaction (`EmailAddressChanger.change`): lock the user + credential rows, refuse a
+ *      stale binding or a non-active user (400, A3) and a collision (409), write `u_email`, move the
+ *      login hint that equalled the old email, burn the user's pending email-change tokens;
+ *   4. after commit: revoke every session of the user EXCEPT the requesting one (A7, durable revoke
+ *      + Redis unbind through the session sweeper), burn outstanding reset tokens, notify the OLD
+ *      address (A10, no link), audit (A9).
+ *
+ * Outcomes: 200 `{ ok: true }`; 400 `invalid_token`; 409 `email_unavailable`; 429
+ * `too_many_requests`; 503 `authentication_unavailable` (limiter / store outage, or a follow-up
+ * after the committed change failed); 501 `not_available` when a seam is unplugged.
+ *
+ * The token is never logged, echoed, or placed in an audit row; the body is never logged.
+ */
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const classification_decorator_js_1 = require("../enforcement/classification.decorator.js");
+const tokens_js_1 = require("./tokens.js");
+const trust_proxy_check_js_1 = require("./rate-limit/trust-proxy-check.js");
+const email_address_js_1 = require("./email-address.js");
+const email_change_messages_js_1 = require("./email-change-messages.js");
+function fail(status, error) {
+    throw new common_1.HttpException({ error }, status);
+}
+function invalidToken() {
+    fail(common_1.HttpStatus.BAD_REQUEST, 'invalid_token');
+}
+function unavailable() {
+    fail(common_1.HttpStatus.SERVICE_UNAVAILABLE, 'authentication_unavailable');
+}
+let ConfirmEmailController = class ConfirmEmailController {
+    tokens;
+    addresses;
+    sweeper;
+    resetTokens;
+    emailSender;
+    auditSink;
+    limiter;
+    trustProxyCheck;
+    constructor(tokens, addresses, sweeper, resetTokens, emailSender, auditSink, limiter, trustProxyCheck) {
+        this.tokens = tokens;
+        this.addresses = addresses;
+        this.sweeper = sweeper;
+        this.resetTokens = resetTokens;
+        this.emailSender = emailSender;
+        this.auditSink = auditSink;
+        this.limiter = limiter;
+        this.trustProxyCheck = trustProxyCheck;
+    }
+    async confirmEmail(body, ip) {
+        const tokens = this.tokens;
+        const addresses = this.addresses;
+        if (tokens == null || addresses == null)
+            fail(common_1.HttpStatus.NOT_IMPLEMENTED, 'not_available');
+        // A6: count every attempt first (fail closed); a blank ip is its own bucket, never a shared one.
+        const limiter = this.trustProxyCheck?.perIpLimitingEnabled === true ? this.limiter : null;
+        const ipKey = `confirm-email:ip:${ip || 'unknown-ip'}`;
+        if (limiter != null) {
+            let allowed;
+            try {
+                ({ allowed } = await limiter.consume(ipKey));
+            }
+            catch {
+                unavailable();
+            }
+            if (!allowed)
+                fail(common_1.HttpStatus.TOO_MANY_REQUESTS, 'too_many_requests');
+        }
+        const token = typeof body?.token === 'string' ? body.token : '';
+        if (token === '')
+            invalidToken();
+        let binding;
+        try {
+            binding = await tokens.consume((0, node_crypto_1.createHash)('sha256').update(token).digest('hex'));
+        }
+        catch {
+            unavailable();
+        }
+        if (binding === null)
+            invalidToken();
+        // A valid single-use token proved the caller: give the attempt back.
+        await limiter?.refund(ipKey).catch(() => undefined);
+        let outcome;
+        try {
+            outcome = await addresses.change({
+                principalId: binding.principalId,
+                newEmail: binding.newEmail,
+                expectedOldEmail: binding.oldEmail,
+                requireActive: true,
+            });
+        }
+        catch {
+            unavailable();
+        }
+        const maskedNew = (0, email_address_js_1.maskEmail)(binding.newEmail);
+        if (outcome.status !== 'changed') {
+            const reason = outcome.status === 'unavailable' ? 'email_unavailable' : outcome.status;
+            this.audit(binding, 'account.email_change_refused', { reason, newEmail: maskedNew });
+            if (outcome.status === 'unavailable')
+                fail(common_1.HttpStatus.CONFLICT, 'email_unavailable');
+            invalidToken();
+        }
+        // After commit. Each follow-up is attempted; a failure is surfaced (503) only after the rest
+        // ran, so the notice and the audit always go out for a committed change.
+        let followUpFailed = false;
+        if (this.sweeper != null) {
+            await this.sweeper
+                .revokeOthersForPrincipal(binding.principalId, binding.sessionId)
+                .catch(() => {
+                followUpFailed = true;
+            });
+        }
+        if (this.resetTokens != null) {
+            await this.resetTokens.invalidateAllForPrincipal(binding.principalId).catch(() => {
+                followUpFailed = true;
+            });
+        }
+        if (outcome.oldEmail !== null && outcome.oldEmail !== '' && this.emailSender != null) {
+            await this.emailSender
+                .send((0, email_change_messages_js_1.emailChangedNoticeMessage)(outcome.oldEmail, maskedNew, Date.now()))
+                .catch(() => undefined); // best-effort: the change is committed
+        }
+        this.audit(binding, 'account.email_changed', {
+            newEmail: maskedNew,
+            loginHintMoved: outcome.hintMoved,
+        });
+        if (followUpFailed)
+            unavailable();
+        return { ok: true };
+    }
+    /**
+     * Best-effort auth audit (A9): masked address, a reason code; never a token. Attributed to the
+     * token's user and the tenant of the session that requested the change (KI #14 re-review P1-2:
+     * the confirm request may carry no session, and `audit_log.al_tenant_id` is NOT NULL). Only a
+     * consumed token has a binding, so an unknown / expired / used token is never audited: there is
+     * no user or tenant to attribute it to (the per-IP limiter bounds that path).
+     */
+    audit(binding, action, attributes) {
+        void this.auditSink
+            ?.record({
+            type: 'authentication',
+            occurredAtMs: Date.now(),
+            actorId: binding.principalId,
+            tenantId: binding.tenantId,
+            action,
+            attributes,
+        })
+            .catch(() => {
+            /* best-effort: an audit failure never changes the response */
+        });
+    }
+};
+exports.ConfirmEmailController = ConfirmEmailController;
+__decorate([
+    (0, classification_decorator_js_1.Public)(),
+    (0, common_1.Post)('confirm-email'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Ip)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], ConfirmEmailController.prototype, "confirmEmail", null);
+exports.ConfirmEmailController = ConfirmEmailController = __decorate([
+    (0, common_1.Controller)('auth'),
+    __param(0, (0, common_1.Optional)()),
+    __param(0, (0, common_1.Inject)(tokens_js_1.SHIELD_EMAIL_CHANGE_TOKEN_STORE)),
+    __param(1, (0, common_1.Optional)()),
+    __param(1, (0, common_1.Inject)(tokens_js_1.SHIELD_EMAIL_ADDRESS_CHANGER)),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(tokens_js_1.SHIELD_SESSION_SWEEPER)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(tokens_js_1.SHIELD_RESET_TOKEN_STORE)),
+    __param(4, (0, common_1.Optional)()),
+    __param(4, (0, common_1.Inject)(tokens_js_1.SHIELD_EMAIL_SENDER)),
+    __param(5, (0, common_1.Optional)()),
+    __param(5, (0, common_1.Inject)(tokens_js_1.SHIELD_AUDIT_SINK)),
+    __param(6, (0, common_1.Optional)()),
+    __param(6, (0, common_1.Inject)(tokens_js_1.SHIELD_CONFIRM_EMAIL_LIMITER)),
+    __param(7, (0, common_1.Optional)()),
+    __param(7, (0, common_1.Inject)(trust_proxy_check_js_1.TrustProxyBootCheck)),
+    __metadata("design:paramtypes", [Object, Object, Object, Object, Object, Object, Object, Object])
+], ConfirmEmailController);

package/dist/auth/email-address.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Email-address helpers shared by the self-service email change (guard `PATCH /account/profile`,
+ * `POST /auth/confirm-email`) and the administrator path (`@astram/identity` `UserService`), so
+ * the two never drift (security hardening Phase 12, KI #14). Exported from the guard main entry;
+ * identity imports them (identity may import guard, never the reverse — ADR-0003/ADR-0026).
+ *
+ * Pure functions, no I/O.
+ */
+/**
+ * The canonical stored form of an email address (A5): trim → NFKC → trim → lower-case. Applied
+ * ONCE at the edge; that one value is what the token row, the collision check and the final write
+ * use. The second trim removes spaces NFKC itself produces (a no-break space folds to a space).
+ *
+ * Not the limiter-key canonicalisation (`canonicalHint`, which keys Redis budgets): that one stays
+ * unchanged so existing limiter keys do not move.
+ */
+export declare function canonicalEmail(raw: string): string;
+/**
+ * A deliberately minimal email shape check (non-empty, a single `@`, a `.` in the domain, no
+ * whitespace). A full RFC-5322 validator adds no security value here, only false rejections; the
+ * authoritative check is the confirm link reaching the inbox.
+ */
+export declare function isEmailShaped(value: string): boolean;
+/**
+ * The masked form used in audit rows and the old-address notice (A9, A10): the first character of
+ * the local part, `***`, then the domain (`alice@example.com` → `a***@example.com`). A value with no
+ * usable `@` is never echoed (`***`).
+ */
+export declare function maskEmail(value: string): string;
+//# sourceMappingURL=email-address.d.ts.map

package/dist/auth/email-address.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-address.d.ts","sourceRoot":"","sources":["../../src/auth/email-address.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMpD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/C"}

package/dist/auth/email-address.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * Email-address helpers shared by the self-service email change (guard `PATCH /account/profile`,
+ * `POST /auth/confirm-email`) and the administrator path (`@astram/identity` `UserService`), so
+ * the two never drift (security hardening Phase 12, KI #14). Exported from the guard main entry;
+ * identity imports them (identity may import guard, never the reverse — ADR-0003/ADR-0026).
+ *
+ * Pure functions, no I/O.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalEmail = canonicalEmail;
+exports.isEmailShaped = isEmailShaped;
+exports.maskEmail = maskEmail;
+/**
+ * The canonical stored form of an email address (A5): trim → NFKC → trim → lower-case. Applied
+ * ONCE at the edge; that one value is what the token row, the collision check and the final write
+ * use. The second trim removes spaces NFKC itself produces (a no-break space folds to a space).
+ *
+ * Not the limiter-key canonicalisation (`canonicalHint`, which keys Redis budgets): that one stays
+ * unchanged so existing limiter keys do not move.
+ */
+function canonicalEmail(raw) {
+    return raw.trim().normalize('NFKC').trim().toLowerCase();
+}
+/**
+ * A deliberately minimal email shape check (non-empty, a single `@`, a `.` in the domain, no
+ * whitespace). A full RFC-5322 validator adds no security value here, only false rejections; the
+ * authoritative check is the confirm link reaching the inbox.
+ */
+function isEmailShaped(value) {
+    if (/\s/.test(value))
+        return false;
+    const at = value.indexOf('@');
+    if (at <= 0 || at !== value.lastIndexOf('@') || at === value.length - 1)
+        return false;
+    const domain = value.slice(at + 1);
+    return domain.includes('.') && !domain.startsWith('.') && !domain.endsWith('.');
+}
+/**
+ * The masked form used in audit rows and the old-address notice (A9, A10): the first character of
+ * the local part, `***`, then the domain (`alice@example.com` → `a***@example.com`). A value with no
+ * usable `@` is never echoed (`***`).
+ */
+function maskEmail(value) {
+    const at = value.lastIndexOf('@');
+    if (at <= 0 || at === value.length - 1)
+        return '***';
+    return `${value.slice(0, 1)}***@${value.slice(at + 1)}`;
+}

package/dist/auth/email-change-messages.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The two emails of the verified self-service email change (security hardening Phase 12, KI #14).
+ * The framework composes them; the {@link EmailSender} only delivers. Both carry HTML and text.
+ *
+ *  - {@link confirmEmailChangeMessage}: to the NEW address, with the confirm link. The raw token is
+ *    in the link's FRAGMENT (`#t=`, A4) — it is never placed in a query string, logged, or returned.
+ *  - {@link emailChangedNoticeMessage}: to the OLD address after a confirmed change (A10). No link;
+ *    the time, the masked new address, and what to do if it wasn't the owner.
+ */
+import type { EmailMessage } from './ports/email-sender.js';
+/** Email-change token time-to-live: 30 minutes (same as a password reset). */
+export declare const EMAIL_CHANGE_TTL_MS: number;
+/** The default confirm-page base (a dev Vite origin), like the reset-link default. */
+export declare const DEFAULT_EMAIL_CHANGE_LINK_BASE_URL = "http://localhost:5173/confirm-email";
+/** The A10 sentence, verbatim. */
+export declare const NOT_YOU_SENTENCE = "If this wasn't you, reset your password from the login page and contact your administrator.";
+/** The confirm link: the token rides in the fragment, never the query (A4). */
+export declare function emailChangeLink(base: string, rawToken: string): string;
+export declare function confirmEmailChangeMessage(to: string, link: string): EmailMessage;
+export declare function emailChangedNoticeMessage(to: string, maskedNewEmail: string, atMs: number): EmailMessage;
+//# sourceMappingURL=email-change-messages.d.ts.map

package/dist/auth/email-change-messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-change-messages.d.ts","sourceRoot":"","sources":["../../src/auth/email-change-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAElD,sFAAsF;AACtF,eAAO,MAAM,kCAAkC,wCAAwC,CAAC;AAExF,kCAAkC;AAClC,eAAO,MAAM,gBAAgB,gGACkE,CAAC;AAUhG,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAehF;AAED,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,GACX,YAAY,CAYd"}