@astram/guard 0.19.0 → 0.20.0

package/dist/auth/account.controller.d.ts

@@ -44,6 +44,7 @@
  */
 import type { FactorVerifier, PasswordHasher } from '@astram/core';
 import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import type { MfaRequirementService } from '../session/mfa-requirement-service.js';
 import type { AuditSink } from './ports/audit-sink.js';
 import type { EmailSender } from './ports/email-sender.js';
 import type { MessageDispatcher } from '../messaging/message-dispatcher.js';
@@ -87,7 +88,8 @@ export declare class AccountController {
     private readonly emailChangeLimiter?;
     private readonly auditSink?;
     private readonly messageDispatcher?;
-    constructor(binder?: SessionTokenBinder | undefined, hasher?: PasswordHasher | undefined, writer?: (CredentialWriter | null) | undefined, sweeper?: (SessionSweeper | null) | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, totpVerifier?: (FactorVerifier | null) | undefined, profileResolver?: (ProfileResolver | null) | undefined, profileWriter?: (ProfileWriter | null) | undefined, mfaDevices?: (MfaDeviceStore | null) | undefined, sessionRestrictions?: (SessionRestrictionStore | null) | undefined, loginTotpVerifier?: (FactorVerifier | null) | undefined, mfaLimiter?: (AttemptLimiter | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined, emailChangeTokens?: (EmailChangeTokenStore | null) | undefined, emailAddresses?: (EmailAddressChanger | null) | undefined, emailSender?: (EmailSender | null) | undefined, emailChangeLinkBaseUrl?: string | null | undefined, emailChangeLimiter?: (AttemptLimiter | null) | undefined, auditSink?: (AuditSink | null) | undefined, messageDispatcher?: (MessageDispatcher | null) | undefined);
+    private readonly mfaRequirement?;
+    constructor(binder?: SessionTokenBinder | undefined, hasher?: PasswordHasher | undefined, writer?: (CredentialWriter | null) | undefined, sweeper?: (SessionSweeper | null) | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, totpVerifier?: (FactorVerifier | null) | undefined, profileResolver?: (ProfileResolver | null) | undefined, profileWriter?: (ProfileWriter | null) | undefined, mfaDevices?: (MfaDeviceStore | null) | undefined, sessionRestrictions?: (SessionRestrictionStore | null) | undefined, loginTotpVerifier?: (FactorVerifier | null) | undefined, mfaLimiter?: (AttemptLimiter | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined, emailChangeTokens?: (EmailChangeTokenStore | null) | undefined, emailAddresses?: (EmailAddressChanger | null) | undefined, emailSender?: (EmailSender | null) | undefined, emailChangeLinkBaseUrl?: string | null | undefined, emailChangeLimiter?: (AttemptLimiter | null) | undefined, auditSink?: (AuditSink | null) | undefined, messageDispatcher?: (MessageDispatcher | null) | undefined, mfaRequirement?: (MfaRequirementService | null) | undefined);
     /**
      * Resolve a human-readable otpauth account LABEL for the caller (email, else display
      * name) via the profile resolver. Best-effort: no resolver / null profile / a thrown

package/dist/auth/account.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.controller.d.ts","sourceRoot":"","sources":["../../src/auth/account.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAmBH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAa,MAAM,cAAc,CAAC;AAK9E,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,yCAAyC,CAAC;AAsBjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAQ5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAiJjE,8EAA8E;AAC9E,UAAU,cAAc;IACtB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAED,qBACa,iBAAiB;IAO1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAMxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAKzB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAQ/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAKjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAOrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAM9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAInC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAIxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAK3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBAjGlB,MAAM,CAAC,EAAE,kBAAkB,YAAA,EAI3B,MAAM,CAAC,EAAE,cAAc,YAAA,EAIvB,MAAM,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAMhC,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAK/B,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAQxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAKxC,aAAa,CAAC,GAAE,aAAa,GAAG,IAAI,aAAA,EAKpC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA,EAOpD,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMpC,iBAAiB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAIhD,cAAc,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI3C,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,YAAA,EAItC,kBAAkB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAI1C,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAK5B,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAG/D;;;;;;OAMG;YACW,mBAAmB;IAwBjC;;;;OAIG;YACW,aAAa;IAS3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;;;;;;;;;;;;;;;OAoBG;IAIG,cAAc,CACQ,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,IAAI,CAAC;IAsEhB;;;;;OAKG;YACW,UAAU;IAMxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5D,GAAG,EAAE,cAAc,GAC9C,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IA2CnD;;;OAGG;YACW,kBAAkB;IAsJhC;;;;;OAKG;YACW,oBAAoB;IAWlC;;;;;;;;OAQG;YACW,sBAAsB;IAmBpC;;;;;;;;;OASG;YACW,eAAe;IAuB7B;;;;;;;;OAQG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,GAC1D,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAUzD;;;;;;;;;;;;;;;;OAgBG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BpE;;;;;;;;;;;;;;;;;;OAkBG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA8ExC;;;;;;;OAOG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC;IAoBjC;;;;;;;;;OASG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IAgChB;;;;;;;;OAQG;IAIG,uBAAuB,CACD,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CA+BxC"}
+{"version":3,"file":"account.controller.d.ts","sourceRoot":"","sources":["../../src/auth/account.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAmBH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAa,MAAM,cAAc,CAAC;AAK9E,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,yCAAyC,CAAC;AAuBjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAEnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAQ5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAsJjE,8EAA8E;AAC9E,UAAU,cAAc;IACtB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAED,qBACa,iBAAiB;IAO1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAMxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAKzB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAQ/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAKjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAOrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAM9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAInC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAIxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAK3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAtGf,MAAM,CAAC,EAAE,kBAAkB,YAAA,EAI3B,MAAM,CAAC,EAAE,cAAc,YAAA,EAIvB,MAAM,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAMhC,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAK/B,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAQxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAKxC,aAAa,CAAC,GAAE,aAAa,GAAG,IAAI,aAAA,EAKpC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA,EAOpD,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMpC,iBAAiB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAIhD,cAAc,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI3C,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,YAAA,EAItC,kBAAkB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAI1C,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAK5B,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAK5C,cAAc,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA;IAGhE;;;;;;OAMG;YACW,mBAAmB;IAwBjC;;;;OAIG;YACW,aAAa;IAc3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,eAAe;IASvB;;;;;;;;;;;;;;;;;;;;OAoBG;IAIG,cAAc,CACQ,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,IAAI,CAAC;IAsEhB;;;;;OAKG;YACW,UAAU;IAMxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5D,GAAG,EAAE,cAAc,GAC9C,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IA2CnD;;;OAGG;YACW,kBAAkB;IAsJhC;;;;;OAKG;YACW,oBAAoB;IAWlC;;;;;;;;OAQG;YACW,sBAAsB;IAmBpC;;;;;;;;;OASG;YACW,eAAe;IAuB7B;;;;;;;;OAQG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,GAC1D,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAUzD;;;;;;;;;;;;;;;;OAgBG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BpE;;;;;;;;;;;;;;;;;;OAkBG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAqGxC;;;;;;;OAOG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC;IAoBjC;;;;;;;;;OASG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IAqEhB;;;;;;;;OAQG;IAIG,uBAAuB,CACD,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CA+BxC"}

package/dist/auth/account.controller.js

@@ -64,6 +64,8 @@ const classification_decorator_js_1 = require("../enforcement/classification.dec
 const request_principal_js_1 = require("../request-auth/request-principal.js");
 const tokens_js_1 = require("../request-auth/tokens.js");
 const tokens_js_2 = require("./tokens.js");
+const session_restriction_js_1 = require("../session/session-restriction.js");
+const auth_audit_js_1 = require("./auth-audit.js");
 const deliver_email_js_1 = require("../messaging/deliver-email.js");
 const email_address_js_1 = require("./email-address.js");
 const email_change_messages_js_1 = require("./email-change-messages.js");
@@ -169,6 +171,10 @@ function unprocessable(error) {
  * `code`. Missing → this 400 (the client then asks for the code); a wrong code is the generic
  * {@link badRequest}.
  */
+/** R2.7: the 409 for removing the last device while a mandatory-2FA policy applies. */
+function mfaRequiredByPolicy() {
+    throw new common_1.HttpException({ error: 'mfa_required_by_policy' }, common_1.HttpStatus.CONFLICT);
+}
 function nameTaken() {
     throw new common_1.HttpException({ error: 'name_taken' }, common_1.HttpStatus.CONFLICT);
 }
@@ -214,7 +220,8 @@ let AccountController = class AccountController {
     emailChangeLimiter;
     auditSink;
     messageDispatcher;
-    constructor(binder, hasher, writer, sweeper, recoveryCodes, totpVerifier, profileResolver, profileWriter, mfaDevices, sessionRestrictions, loginTotpVerifier, mfaLimiter, loginLimiter, emailChangeTokens, emailAddresses, emailSender, emailChangeLinkBaseUrl, emailChangeLimiter, auditSink, messageDispatcher) {
+    mfaRequirement;
+    constructor(binder, hasher, writer, sweeper, recoveryCodes, totpVerifier, profileResolver, profileWriter, mfaDevices, sessionRestrictions, loginTotpVerifier, mfaLimiter, loginLimiter, emailChangeTokens, emailAddresses, emailSender, emailChangeLinkBaseUrl, emailChangeLimiter, auditSink, messageDispatcher, mfaRequirement) {
         this.binder = binder;
         this.hasher = hasher;
         this.writer = writer;
@@ -235,6 +242,7 @@ let AccountController = class AccountController {
         this.emailChangeLimiter = emailChangeLimiter;
         this.auditSink = auditSink;
         this.messageDispatcher = messageDispatcher;
+        this.mfaRequirement = mfaRequirement;
     }
     /**
      * Resolve a human-readable otpauth account LABEL for the caller (email, else display
@@ -281,6 +289,11 @@ let AccountController = class AccountController {
         const claims = await this.binder.resolve(token);
         if (claims === null)
             unauthorized();
+        // Auth capabilities R2.5: re-evaluate the mandatory-2FA requirement when the permission version
+        // moved (no DB query otherwise; a failure is the 503 `authentication_unavailable`).
+        if (this.mfaRequirement !== undefined && this.mfaRequirement !== null) {
+            return this.mfaRequirement.refresh(token, claims);
+        }
         return claims;
     }
     /**
@@ -307,8 +320,11 @@ let AccountController = class AccountController {
      * A normal (`mustReenroll:false`) session is unaffected — this is a no-op for it.
      */
     enforceReenroll(claims, allowedDuringReenroll) {
-        if (claims.mustReenroll === true && !allowedDuringReenroll) {
-            throw new common_1.HttpException({ error: 'reenrollment_required' }, common_1.HttpStatus.FORBIDDEN);
+        // D-2: the same per-handler policy serves the mandatory-2FA restriction (`mfa_enrollment`,
+        // including a passed grace deadline), each reason with its own 403 code.
+        const reason = (0, session_restriction_js_1.restrictionOf)(claims, Date.now());
+        if (reason !== null && !allowedDuringReenroll) {
+            throw new common_1.HttpException({ error: (0, session_restriction_js_1.restrictionErrorCode)(reason) }, common_1.HttpStatus.FORBIDDEN);
         }
     }
     /**
@@ -812,6 +828,24 @@ let AccountController = class AccountController {
         if (claims.mustReenroll === true && this.sessionRestrictions) {
             await this.sessionRestrictions.clearMustReenroll(claims.sessionId).catch(() => undefined);
         }
+        // MANDATORY 2FA (R2.3, AC-7): a confirmed factor lifts the `mfa_enrollment` restriction and any
+        // grace deadline on THIS session at once (Redis claims + durable column; the very next request
+        // succeeds) and deletes the grace clock (R2.4). Best-effort like the re-enrol clear: a failure
+        // leaves the session restricted (the safe direction).
+        if (this.mfaRequirement !== undefined && this.mfaRequirement !== null) {
+            await this.mfaRequirement.onFactorConfirmed(claims);
+        }
+        else if ((claims.restriction === 'mfa_enrollment' || claims.mfaEnrollmentDeadlineMs !== undefined) &&
+            this.binder !== undefined &&
+            this.binder !== null) {
+            // The feature was switched off since the session was restricted: still lift it.
+            await this.binder.clearRestriction(claims.sessionId);
+            if (claims.restriction === 'mfa_enrollment') {
+                await this.sessionRestrictions?.clearMfaRestriction?.(claims.sessionId).catch(() => { });
+            }
+        }
+        // R12.2: the session's own actor and tenant; no device id, name, secret or code.
+        (0, auth_audit_js_1.emitAuthAudit)(this.auditSink, (0, auth_audit_js_1.authEvent)(auth_audit_js_1.AUTH_MFA_ENROLLED, claims.id, claims.tenantId, { firstDevice: wasFirst }));
         if (wasFirst) {
             const recoveryCodes = await this.replaceRecoveryCodes(claims.id, recoveryStore, hasher);
             return { recoveryCodes };
@@ -869,20 +903,57 @@ let AccountController = class AccountController {
         // Phase 11 #1: the canonical device id or 400 (after the session, before any proof is spent).
         const deviceId = (0, engine_1.canonicalUuid)(id) ?? badRequest();
         const code = typeof body?.code === 'string' ? body.code : '';
+        // R2.7 (AC-11): the LAST confirmed device cannot be removed while a mandatory-2FA policy
+        // applies to the caller. The requirement is evaluated first (DB reads are fine here; a failure
+        // is 503), then a cheap pre-check refuses before any proof is spent (no code is burnt), and the
+        // delete itself re-checks under a per-principal row lock (`removeKeepingOne`), so two
+        // concurrent removals can never leave zero devices.
+        const mfa = this.mfaRequirement;
+        let policyApplies = false;
+        if (mfa !== undefined && mfa !== null) {
+            try {
+                policyApplies = await mfa.requiresFactor(claims);
+            }
+            catch {
+                retryableUnavailable();
+            }
+            if (policyApplies) {
+                const confirmed = (await store.listAll(claims.id)).filter((d) => d.confirmed);
+                if (confirmed.length === 1 && confirmed[0].id === deviceId)
+                    mfaRequiredByPolicy();
+            }
+        }
         // Proof BEFORE the delete: a TOTP from any confirmed device (incl. the one being
         // removed — legit for the last-device disable) OR a valid recovery code. Rate-limited
         // and replay-guarded like `/auth/mfa` (Phase 8 #1).
         await this.requireMfaProof(store, claims.id, code);
-        const removed = await store.remove(claims.id, deviceId);
+        let removed;
+        if (policyApplies && typeof store.removeKeepingOne === 'function') {
+            const outcome = await store.removeKeepingOne(claims.id, deviceId);
+            if (outcome === 'last_device')
+                mfaRequiredByPolicy();
+            removed = outcome === 'removed';
+        }
+        else {
+            removed = await store.remove(claims.id, deviceId);
+        }
         if (!removed) {
             throw new common_1.HttpException({ error: 'not_found' }, common_1.HttpStatus.NOT_FOUND);
         }
         // Removing the last confirmed device disables MFA → wipe the account recovery codes.
-        if ((await store.countConfirmed(claims.id)) === 0) {
+        const mfaOff = (await store.countConfirmed(claims.id)) === 0;
+        // R2.7 defence in depth: a store without the atomic removal (or any other path) still left no
+        // factor while a policy applies → restrict THIS session now, not at the next sign-in.
+        if (mfaOff && policyApplies && mfa !== undefined && mfa !== null) {
+            await mfa.restrictNow(claims);
+        }
+        if (mfaOff) {
             if (this.recoveryCodes !== undefined && this.recoveryCodes !== null) {
                 await this.recoveryCodes.replaceAll(claims.id, []);
             }
         }
+        // R12.2: the session's own actor and tenant; no device id, secret or code.
+        (0, auth_audit_js_1.emitAuthAudit)(this.auditSink, (0, auth_audit_js_1.authEvent)(auth_audit_js_1.AUTH_MFA_REMOVED, claims.id, claims.tenantId, { mfaOff }));
     }
     /**
      * `POST /account/mfa/recovery-codes/regenerate` — mint a fresh recovery-code batch
@@ -1045,5 +1116,7 @@ exports.AccountController = AccountController = __decorate([
     __param(18, (0, common_1.Inject)(tokens_js_2.SHIELD_AUDIT_SINK)),
     __param(19, (0, common_1.Optional)()),
     __param(19, (0, common_1.Inject)(tokens_js_2.SHIELD_MESSAGE_DISPATCHER)),
-    __metadata("design:paramtypes", [Function, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object])
+    __param(20, (0, common_1.Optional)()),
+    __param(20, (0, common_1.Inject)(tokens_js_2.SHIELD_MFA_REQUIREMENT)),
+    __metadata("design:paramtypes", [Function, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object])
 ], AccountController);

package/dist/auth/admin-signin-controls.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Auth capabilities R11 (task 18, B-5): the guard pieces behind `@astram/identity`'s admin sign-in
+ * controls (`POST /identity/users/:uuid/{reset-mfa,unlock,end-sessions}`). Guard never imports
+ * identity (ADR-0003): identity injects these through the tokens re-exported from
+ * `@astram/guard/internal` ({@link SHIELD_ADMIN_STEP_UP}, {@link SHIELD_ACCOUNT_UNLOCKER}).
+ *
+ * ── STEP-UP (R11.2) ─────────────────────────────────────────────────────────
+ *   The admin's OWN current TOTP, checked the way the code-gated `/account` routes check it
+ *   (`AccountController.requireMfaProof`): the attempt is counted on the admin's `mfa:pid:<id>`
+ *   budget BEFORE verifying (atomic increment-first), the code is verified against every confirmed
+ *   device through the replay-guarded login verifier (an accepted code is spent on every path), a
+ *   success resets the budget. TOTP only: recovery codes are not accepted here (R11.2). The login
+ *   step-up (`mfa-step-up.ts`) needs a pending password challenge, so it is not reused directly.
+ *   No confirmed device ⇒ `no_factor` before anything is counted.
+ *
+ * ── UNLOCK (R11.1) ──────────────────────────────────────────────────────────
+ *   Clears `login:pid:<id>`, `mfa:pid:<id>`, `recovery:<id>` (each on its own limiter) and the
+ *   account CAPTCHA counter of every CAPTCHA endpoint (`shield:captcha:<ep>:pid:<id>`). The
+ *   typed-text CAPTCHA keys hash the text a user typed and cannot be derived from the account; they
+ *   expire with their window. Any Redis error rejects ({@link AdminControlUnavailableError}).
+ */
+import type { FactorVerifier } from '@astram/core';
+import type { MfaDeviceStore } from './ports/mfa-device-store.js';
+import type { AttemptLimiter } from './rate-limit/attempt-limiter.js';
+/** A store the admin control needs could not answer; nothing is claimed (caller → 503). */
+export declare class AdminControlUnavailableError extends Error {
+    constructor();
+}
+/**
+ * The step-up verdict:
+ *  - `verified`: the code is right (budget reset);
+ *  - `no_factor`: the admin has no confirmed device (caller → 409 `mfa_required`), nothing counted;
+ *  - `missing`: blank code, nothing counted;
+ *  - `rejected`: wrong code (stays counted);
+ *  - `locked`: the admin's `mfa:pid` budget is spent;
+ *  - `unavailable`: a store could not answer (fail closed).
+ */
+export type AdminStepUpOutcome = 'verified' | 'no_factor' | 'missing' | 'rejected' | 'locked' | 'unavailable';
+/** The seam identity injects under {@link SHIELD_ADMIN_STEP_UP}. */
+export interface AdminStepUp {
+    verify(principalId: string, code: string): Promise<AdminStepUpOutcome>;
+}
+export interface TotpAdminStepUpDeps {
+    readonly devices: Pick<MfaDeviceStore, 'listConfirmedSecrets'> | null;
+    /** The replay-guarded login TOTP verifier (`SHIELD_LOGIN_TOTP_VERIFIER`). */
+    readonly verifier: FactorVerifier | null;
+    /** The MFA step limiter (`SHIELD_MFA_LIMITER`, `mfa:pid:<id>`). */
+    readonly limiter: Pick<AttemptLimiter, 'consume' | 'refund' | 'reset'> | null;
+}
+export declare class TotpAdminStepUp implements AdminStepUp {
+    private readonly deps;
+    constructor(deps: TotpAdminStepUpDeps);
+    verify(principalId: string, code: string): Promise<AdminStepUpOutcome>;
+}
+/** The keys one unlock clears (limiter keys without the `shield:attempts:` namespace). */
+export declare function accountUnlockKeys(principalId: string): {
+    login: string;
+    mfa: string;
+    recovery: string;
+    captcha: string[];
+};
+/** The seam identity injects under {@link SHIELD_ACCOUNT_UNLOCKER}. */
+export interface AccountUnlocker {
+    /** Clear every sign-in counter of the principal; rejects {@link AdminControlUnavailableError}. */
+    unlock(principalId: string): Promise<void>;
+}
+export interface RedisAccountUnlockerDeps {
+    readonly login: Pick<AttemptLimiter, 'clear'>;
+    readonly mfa: Pick<AttemptLimiter, 'clear'>;
+    readonly recovery: Pick<AttemptLimiter, 'clear'>;
+    readonly captcha: {
+        clearStrict(keys: readonly string[]): Promise<void>;
+    };
+}
+export declare class RedisAccountUnlocker implements AccountUnlocker {
+    private readonly deps;
+    constructor(deps: RedisAccountUnlockerDeps);
+    unlock(principalId: string): Promise<void>;
+}
+//# sourceMappingURL=admin-signin-controls.d.ts.map

package/dist/auth/admin-signin-controls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-signin-controls.d.ts","sourceRoot":"","sources":["../../src/auth/admin-signin-controls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,2FAA2F;AAC3F,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAC5B,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE/E,oEAAoE;AACpE,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,GAAG,IAAI,CAAC;IACtE,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC;CAC/E;AAED,qBAAa,eAAgB,YAAW,WAAW;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,mBAAmB;IAEhD,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAmC7E;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAOA;AAED,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,kGAAkG;IAClG,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE;QAAE,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;CAC3E;AAED,qBAAa,oBAAqB,YAAW,eAAe;IAC9C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,wBAAwB;IAErD,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAcjD"}

package/dist/auth/admin-signin-controls.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisAccountUnlocker = exports.TotpAdminStepUp = exports.AdminControlUnavailableError = void 0;
+exports.accountUnlockKeys = accountUnlockKeys;
+const captcha_config_js_1 = require("../config/captcha-config.js");
+/** A store the admin control needs could not answer; nothing is claimed (caller → 503). */
+class AdminControlUnavailableError extends Error {
+    constructor() {
+        super('admin sign-in control unavailable');
+        this.name = 'AdminControlUnavailableError';
+    }
+}
+exports.AdminControlUnavailableError = AdminControlUnavailableError;
+class TotpAdminStepUp {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async verify(principalId, code) {
+        const { devices, verifier, limiter } = this.deps;
+        if (!devices || !verifier || !limiter || !principalId)
+            return 'unavailable';
+        let secrets;
+        try {
+            secrets = await devices.listConfirmedSecrets(principalId);
+        }
+        catch {
+            return 'unavailable';
+        }
+        if (!Array.isArray(secrets) || secrets.length === 0)
+            return 'no_factor';
+        const presented = typeof code === 'string' ? code.trim() : '';
+        if (presented === '')
+            return 'missing';
+        const key = `mfa:pid:${principalId}`;
+        let allowed;
+        try {
+            ({ allowed } = await limiter.consume(key));
+        }
+        catch {
+            return 'unavailable';
+        }
+        if (!allowed)
+            return 'locked';
+        let satisfied;
+        try {
+            satisfied = (await verifier.verify({ factor: 'totp', payload: { code: presented } }, secrets.join('\n')))?.satisfied;
+        }
+        catch {
+            // No verdict (replay guard / Redis down): give the attempt back, fail closed.
+            await limiter.refund(key);
+            return 'unavailable';
+        }
+        if (satisfied !== true)
+            return 'rejected';
+        await limiter.reset(key);
+        return 'verified';
+    }
+}
+exports.TotpAdminStepUp = TotpAdminStepUp;
+/** The keys one unlock clears (limiter keys without the `shield:attempts:` namespace). */
+function accountUnlockKeys(principalId) {
+    return {
+        login: `login:pid:${principalId}`,
+        mfa: `mfa:pid:${principalId}`,
+        recovery: `recovery:${principalId}`,
+        captcha: captcha_config_js_1.CAPTCHA_ENDPOINTS.map((ep) => `${ep}:pid:${principalId}`),
+    };
+}
+class RedisAccountUnlocker {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async unlock(principalId) {
+        if (typeof principalId !== 'string' || principalId === '') {
+            throw new AdminControlUnavailableError();
+        }
+        const keys = accountUnlockKeys(principalId);
+        try {
+            await this.deps.login.clear(keys.login);
+            await this.deps.mfa.clear(keys.mfa);
+            await this.deps.recovery.clear(keys.recovery);
+            await this.deps.captcha.clearStrict(keys.captcha);
+        }
+        catch {
+            throw new AdminControlUnavailableError();
+        }
+    }
+}
+exports.RedisAccountUnlocker = RedisAccountUnlocker;

package/dist/auth/auth-audit.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Auth audit events and counters (R12.2–R12.4, AC-18).
+ *
+ * Events (through the auth {@link AuditSink}, fire-and-forget, errors swallowed):
+ *  - `auth.login.succeeded` / `auth.login.failed` (`authentication`), attribute `method`:
+ *    `password`, or the MFA step's `totp` / `recovery_code`.
+ *  - `auth.logout` (`session_lifecycle`), attribute `proven`.
+ *  - `auth.mfa.enrolled` / `auth.mfa.removed` (`authentication`).
+ *
+ * Actor and tenant always come from the RESOLVED principal or session, never from the request.
+ * No event carries the typed hint, a password, a code or a token.
+ *
+ * Bounding (R12.3): a failure row is written only for a resolved account, and only by the attempt
+ * that OPENS the account's limiter window ({@link opensFailureWindow}: the increment-first count is
+ * 1). The limiter's counter is atomic (Lua `INCR`), so of N parallel failures exactly one sees 1,
+ * and the window is fixed (not extended by later attempts), so an account yields at most one
+ * failure row per lockout window, plus the existing lockout row on the edge. No extra Redis key and
+ * no extra round trip; with no limiter there is no window and no failure row. Unknown names write
+ * no row at all; they only count.
+ *
+ * Counters (R12.4): one structured log line per occurrence with fixed keys and no personal data,
+ * the style of `recordUnprovenLogout` (`logout-proof.ts`):
+ *  - `{ counter: 'auth.login.failed', method, account: 'known' | 'unknown' }`
+ *  - `{ counter: 'auth.lockout', method, account: 'known' | 'unknown' | 'ip' }`
+ */
+import { Logger } from '@nestjs/common';
+import type { AuditSink, AuthAuditEvent } from './ports/audit-sink.js';
+/** The sign-in factor an event or counter refers to. */
+export type AuthMethod = 'password' | 'totp' | 'recovery_code';
+/** Whether the failing name resolved to an account (`ip` = the per-IP lockout, no account). */
+export type AccountLabel = 'known' | 'unknown' | 'ip';
+export declare const AUTH_LOGIN_SUCCEEDED = "auth.login.succeeded";
+export declare const AUTH_LOGIN_FAILED = "auth.login.failed";
+export declare const AUTH_LOGOUT = "auth.logout";
+export declare const AUTH_MFA_ENROLLED = "auth.mfa.enrolled";
+export declare const AUTH_MFA_REMOVED = "auth.mfa.removed";
+/** Counter keys (R12.4). */
+export declare const LOGIN_FAILED_COUNTER = "auth.login.failed";
+export declare const LOCKOUT_COUNTER = "auth.lockout";
+/** Record one event, fire-and-forget. A missing sink is a no-op; a sink error never propagates. */
+export declare function emitAuthAudit(sink: AuditSink | null | undefined, event: AuthAuditEvent): void;
+/** An `authentication` event about `actorId` in `tenantId`. */
+export declare function authEvent(action: string, actorId: string, tenantId: string, attributes: Record<string, unknown>, nowMs?: number): AuthAuditEvent;
+/** The `auth.logout` event (`session_lifecycle`) for a revoked session. */
+export declare function logoutEvent(actorId: string, tenantId: string, proven: boolean, nowMs?: number): AuthAuditEvent;
+/**
+ * True when this failed attempt opened the account's limiter window (its increment-first count
+ * is 1), so it may write the window's one `auth.login.failed` row. `null` (no limiter) → false.
+ */
+export declare function opensFailureWindow(verdict: {
+    count: number;
+} | null | undefined): boolean;
+/** Count one failed sign-in (R12.4). */
+export declare function countLoginFailure(method: AuthMethod, account: 'known' | 'unknown', logger?: Pick<Logger, 'log'>): void;
+/** Count one lockout (the edge where a limiter trips; R12.4). */
+export declare function countLockout(method: AuthMethod, account: AccountLabel, logger?: Pick<Logger, 'log'>): void;
+/** The tenant id in resolved credential claims, or `null`. */
+export declare function tenantOfClaims(claims: unknown): string | null;
+//# sourceMappingURL=auth-audit.d.ts.map

package/dist/auth/auth-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-audit.d.ts","sourceRoot":"","sources":["../../src/auth/auth-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvE,wDAAwD;AACxD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,eAAe,CAAC;AAE/D,+FAA+F;AAC/F,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;AAEtD,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,4BAA4B;AAC5B,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AACxD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAI9C,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAS7F;AAED,+DAA+D;AAC/D,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,KAAK,GAAE,MAAmB,GACzB,cAAc,CAEhB;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,EACf,KAAK,GAAE,MAAmB,GACzB,cAAc,CAShB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEzF;AAED,wCAAwC;AACxC,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,MAAM,GAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAiB,GAC1C,IAAI,CAEN;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,YAAY,EACrB,MAAM,GAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAiB,GAC1C,IAAI,CAEN;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAG7D"}

package/dist/auth/auth-audit.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Auth audit events and counters (R12.2–R12.4, AC-18).
+ *
+ * Events (through the auth {@link AuditSink}, fire-and-forget, errors swallowed):
+ *  - `auth.login.succeeded` / `auth.login.failed` (`authentication`), attribute `method`:
+ *    `password`, or the MFA step's `totp` / `recovery_code`.
+ *  - `auth.logout` (`session_lifecycle`), attribute `proven`.
+ *  - `auth.mfa.enrolled` / `auth.mfa.removed` (`authentication`).
+ *
+ * Actor and tenant always come from the RESOLVED principal or session, never from the request.
+ * No event carries the typed hint, a password, a code or a token.
+ *
+ * Bounding (R12.3): a failure row is written only for a resolved account, and only by the attempt
+ * that OPENS the account's limiter window ({@link opensFailureWindow}: the increment-first count is
+ * 1). The limiter's counter is atomic (Lua `INCR`), so of N parallel failures exactly one sees 1,
+ * and the window is fixed (not extended by later attempts), so an account yields at most one
+ * failure row per lockout window, plus the existing lockout row on the edge. No extra Redis key and
+ * no extra round trip; with no limiter there is no window and no failure row. Unknown names write
+ * no row at all; they only count.
+ *
+ * Counters (R12.4): one structured log line per occurrence with fixed keys and no personal data,
+ * the style of `recordUnprovenLogout` (`logout-proof.ts`):
+ *  - `{ counter: 'auth.login.failed', method, account: 'known' | 'unknown' }`
+ *  - `{ counter: 'auth.lockout', method, account: 'known' | 'unknown' | 'ip' }`
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCKOUT_COUNTER = exports.LOGIN_FAILED_COUNTER = exports.AUTH_MFA_REMOVED = exports.AUTH_MFA_ENROLLED = exports.AUTH_LOGOUT = exports.AUTH_LOGIN_FAILED = exports.AUTH_LOGIN_SUCCEEDED = void 0;
+exports.emitAuthAudit = emitAuthAudit;
+exports.authEvent = authEvent;
+exports.logoutEvent = logoutEvent;
+exports.opensFailureWindow = opensFailureWindow;
+exports.countLoginFailure = countLoginFailure;
+exports.countLockout = countLockout;
+exports.tenantOfClaims = tenantOfClaims;
+const common_1 = require("@nestjs/common");
+exports.AUTH_LOGIN_SUCCEEDED = 'auth.login.succeeded';
+exports.AUTH_LOGIN_FAILED = 'auth.login.failed';
+exports.AUTH_LOGOUT = 'auth.logout';
+exports.AUTH_MFA_ENROLLED = 'auth.mfa.enrolled';
+exports.AUTH_MFA_REMOVED = 'auth.mfa.removed';
+/** Counter keys (R12.4). */
+exports.LOGIN_FAILED_COUNTER = 'auth.login.failed';
+exports.LOCKOUT_COUNTER = 'auth.lockout';
+const counterLogger = new common_1.Logger('ShieldAuth');
+/** Record one event, fire-and-forget. A missing sink is a no-op; a sink error never propagates. */
+function emitAuthAudit(sink, event) {
+    if (sink === undefined || sink === null)
+        return;
+    try {
+        void sink.record(event).catch(() => {
+            /* best-effort: an audit failure never changes the response */
+        });
+    }
+    catch {
+        /* a synchronous throw from a consumer sink is swallowed too */
+    }
+}
+/** An `authentication` event about `actorId` in `tenantId`. */
+function authEvent(action, actorId, tenantId, attributes, nowMs = Date.now()) {
+    return { type: 'authentication', occurredAtMs: nowMs, actorId, tenantId, action, attributes };
+}
+/** The `auth.logout` event (`session_lifecycle`) for a revoked session. */
+function logoutEvent(actorId, tenantId, proven, nowMs = Date.now()) {
+    return {
+        type: 'session_lifecycle',
+        occurredAtMs: nowMs,
+        actorId,
+        tenantId,
+        action: exports.AUTH_LOGOUT,
+        attributes: { proven },
+    };
+}
+/**
+ * True when this failed attempt opened the account's limiter window (its increment-first count
+ * is 1), so it may write the window's one `auth.login.failed` row. `null` (no limiter) → false.
+ */
+function opensFailureWindow(verdict) {
+    return verdict !== null && verdict !== undefined && verdict.count === 1;
+}
+/** Count one failed sign-in (R12.4). */
+function countLoginFailure(method, account, logger = counterLogger) {
+    logger.log({ counter: exports.LOGIN_FAILED_COUNTER, method, account });
+}
+/** Count one lockout (the edge where a limiter trips; R12.4). */
+function countLockout(method, account, logger = counterLogger) {
+    logger.log({ counter: exports.LOCKOUT_COUNTER, method, account });
+}
+/** The tenant id in resolved credential claims, or `null`. */
+function tenantOfClaims(claims) {
+    const t = claims?.tenantId;
+    return typeof t === 'string' && t !== '' ? t : null;
+}