@astram/guard 0.7.0 → 0.9.0

package/dist/auth/account.controller.d.ts

@@ -44,6 +44,8 @@
  */
 import type { FactorVerifier, PasswordHasher } from '@astram/core';
 import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import type { SessionRestrictionStore } from '../session/session-restriction-store.js';
+import type { AttemptLimiter } from './rate-limit/attempt-limiter.js';
 import type { CredentialWriter } from './ports/credential-writer.js';
 import type { MfaDevice, MfaDeviceStore } from './ports/mfa-device-store.js';
 import type { CurrentUserProfile, ProfileResolver } from './profile-resolver.js';
@@ -60,7 +62,11 @@ export declare class AccountController {
     private readonly profileResolver?;
     private readonly profileWriter?;
     private readonly mfaDevices?;
-    constructor(binder?: SessionTokenBinder | undefined, hasher?: PasswordHasher | undefined, writer?: (CredentialWriter | null) | undefined, sweeper?: (SessionSweeper | null) | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, totpVerifier?: (FactorVerifier | null) | undefined, profileResolver?: (ProfileResolver | null) | undefined, profileWriter?: (ProfileWriter | null) | undefined, mfaDevices?: (MfaDeviceStore | null) | undefined);
+    private readonly sessionRestrictions?;
+    private readonly loginTotpVerifier?;
+    private readonly mfaLimiter?;
+    private readonly loginLimiter?;
+    constructor(binder?: SessionTokenBinder | undefined, hasher?: PasswordHasher | undefined, writer?: (CredentialWriter | null) | undefined, sweeper?: (SessionSweeper | null) | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, totpVerifier?: (FactorVerifier | null) | undefined, profileResolver?: (ProfileResolver | null) | undefined, profileWriter?: (ProfileWriter | null) | undefined, mfaDevices?: (MfaDeviceStore | null) | undefined, sessionRestrictions?: (SessionRestrictionStore | null) | undefined, loginTotpVerifier?: (FactorVerifier | null) | undefined, mfaLimiter?: (AttemptLimiter | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined);
     /**
      * Resolve a human-readable otpauth account LABEL for the caller (email, else display
      * name) via the profile resolver. Best-effort: no resolver / null profile / a thrown
@@ -109,8 +115,9 @@ export declare class AccountController {
      *   • no/invalid token                       → 401 (generic)
      *   • newPassword shorter than the minimum   → 422 `{ error: 'weak_password' }`
      *   • writer/hasher seam absent              → 501 `{ error: 'not_available' }`
-     *   • wrong current password                 → 401 (generic, no write)
-     *   • success                                → 204 (no body)
+     *   • wrong current password                 → 401 (generic, no write; counted)
+     *   • account login budget exhausted         → 401 (generic, not verified, no write)
+     *   • success                                → 204 (no body; counter reset)
      */
     changePassword(authorization: string | undefined, body: {
         currentPassword?: string;
@@ -154,10 +161,25 @@ export declare class AccountController {
     private replaceRecoveryCodes;
     /**
      * Verify a presented `code` against ANY of the caller's CONFIRMED device secrets
-     * (TOTP), returning true on the first match. Used by remove/regenerate where the
-     * proof may come from any live device (not a specific one). NEVER logs the code.
+     * (TOTP) through the replay-guarded login verifier: the secrets are bundled
+     * newline-joined (the `OrTotpVerifier` contract) and an accepted code is claimed in
+     * Redis, so it cannot be reused on this or any other MFA path inside the window. A
+     * Redis error on the claim → 503 (fail closed; never an unguarded accept, never a
+     * fall-through to the recovery-code check). Guarded verifier not wired → `false`.
+     * NEVER logs the code.
      */
     private verifyAgainstAnyDevice;
+    /**
+     * The shared second-factor proof for the code-gated account routes (Phase 8 #1),
+     * mirroring `/auth/mfa`: the `mfa:pid:<principalId>` budget is checked BEFORE any TOTP
+     * or recovery-code verification (so a locked caller never triggers the Argon2
+     * recovery scan) → a TOTP from any confirmed device, else a recovery code (consumed) →
+     * a failed proof records a failure (400), a good one resets the counter. Locked → 429.
+     * The limiter fails open on a Redis blip (its documented posture); the TOTP replay
+     * claim fails closed (503), and the session itself is Redis-bound, so a Redis outage
+     * cannot open this path.
+     */
+    private requireMfaProof;
     /**
      * `GET /account/mfa/devices` — list the caller's CONFIRMED authenticator devices.
      * `mfaEnabled` reflects whether any confirmed device exists. Pending (unconfirmed)

package/dist/auth/account.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.controller.d.ts","sourceRoot":"","sources":["../../src/auth/account.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAa,MAAM,cAAc,CAAC;AAI9E,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,yCAAyC,CAAC;AAWjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA4DjE,qBACa,iBAAiB;IAO1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAMxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAKzB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAM/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAKjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBA1CX,MAAM,CAAC,EAAE,kBAAkB,YAAA,EAI3B,MAAM,CAAC,EAAE,cAAc,YAAA,EAIvB,MAAM,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAMhC,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAK/B,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAMxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAKxC,aAAa,CAAC,GAAE,aAAa,GAAG,IAAI,aAAA,EAKpC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA;IAGrD;;;;;;OAMG;YACW,mBAAmB;IAwBjC;;;;OAIG;YACW,aAAa;IAS3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;;;;;;;OAYG;IAIG,cAAc,CACQ,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,IAAI,CAAC;IAsChB;;;;;OAKG;YACW,UAAU;IASxB;;;;;;;;;;;;;;;;;OAiBG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,kBAAkB,CAAC;IA+C9B;;;;;OAKG;YACW,oBAAoB;IAWlC;;;;OAIG;YACW,sBAAsB;IAYpC;;;;;;;;OAQG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,GAC1D,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAUzD;;;;;;;OAOG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAmBpE;;;;;;;;;OASG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAyDxC;;;;;;;OAOG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC;IAiBjC;;;;;;;;;OASG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IAmChB;;;;;;;OAOG;IAIG,uBAAuB,CACD,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAgCxC"}
+{"version":3,"file":"account.controller.d.ts","sourceRoot":"","sources":["../../src/auth/account.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAa,MAAM,cAAc,CAAC;AAI9E,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,yCAAyC,CAAC;AAejD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA0EjE,qBACa,iBAAiB;IAO1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAMxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAKzB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAQ/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAKjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAOrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAlEb,MAAM,CAAC,EAAE,kBAAkB,YAAA,EAI3B,MAAM,CAAC,EAAE,cAAc,YAAA,EAIvB,MAAM,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAMhC,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAK/B,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAQxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAKxC,aAAa,CAAC,GAAE,aAAa,GAAG,IAAI,aAAA,EAKpC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA,EAOpD,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA;IAGvD;;;;;;OAMG;YACW,mBAAmB;IAwBjC;;;;OAIG;YACW,aAAa;IAS3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;;;;;;;;OAaG;IAIG,cAAc,CACQ,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,IAAI,CAAC;IAkDhB;;;;;OAKG;YACW,UAAU;IAMxB;;;;;;;;;;;;;;;;;OAiBG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,kBAAkB,CAAC;IA6C9B;;;;;OAKG;YACW,oBAAoB;IAWlC;;;;;;;;OAQG;YACW,sBAAsB;IAmBpC;;;;;;;;;OASG;YACW,eAAe;IAsB7B;;;;;;;;OAQG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,GAC1D,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAUzD;;;;;;;OAOG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAmBpE;;;;;;;;;OASG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA8DxC;;;;;;;OAOG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC;IAiBjC;;;;;;;;;OASG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IA8BhB;;;;;;;OAOG;IAIG,uBAAuB,CACD,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CA+BxC"}

package/dist/auth/account.controller.js

@@ -62,6 +62,7 @@ const classification_decorator_js_1 = require("../enforcement/classification.dec
 const request_principal_js_1 = require("../request-auth/request-principal.js");
 const tokens_js_1 = require("../request-auth/tokens.js");
 const tokens_js_2 = require("./tokens.js");
+const canonical_hint_js_1 = require("./rate-limit/canonical-hint.js");
 const totp_enrollment_js_1 = require("./totp-enrollment.js");
 /** Max length of a device name (matches the `md_name VARCHAR(120)` column). */
 const MAX_DEVICE_NAME_LEN = 120;
@@ -103,6 +104,18 @@ function notAvailable() {
 function badRequest() {
     throw new common_1.HttpException({ error: 'invalid_request' }, common_1.HttpStatus.BAD_REQUEST);
 }
+/**
+ * The 429 for a caller whose proof budget is exhausted (Phase 8 #1). These routes are
+ * self-scoped and already authenticated, so the throttle signal reveals nothing about
+ * another account; a 401 here would read as "session expired" to the client's refresh logic.
+ */
+function tooManyRequests() {
+    throw new common_1.HttpException({ error: 'too_many_requests' }, common_1.HttpStatus.TOO_MANY_REQUESTS);
+}
+/** The retryable 503 when the replay guard (Redis) cannot answer: fail closed, no mutation. */
+function retryableUnavailable() {
+    throw new common_1.HttpException({ error: 'authentication_unavailable' }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+}
 /**
  * The 422 for a semantically invalid profile edit — an empty change (`no_changes`)
  * or a malformed email (`invalid_email`). Distinct from {@link badRequest}: this is
@@ -122,7 +135,11 @@ let AccountController = class AccountController {
     profileResolver;
     profileWriter;
     mfaDevices;
-    constructor(binder, hasher, writer, sweeper, recoveryCodes, totpVerifier, profileResolver, profileWriter, mfaDevices) {
+    sessionRestrictions;
+    loginTotpVerifier;
+    mfaLimiter;
+    loginLimiter;
+    constructor(binder, hasher, writer, sweeper, recoveryCodes, totpVerifier, profileResolver, profileWriter, mfaDevices, sessionRestrictions, loginTotpVerifier, mfaLimiter, loginLimiter) {
         this.binder = binder;
         this.hasher = hasher;
         this.writer = writer;
@@ -132,6 +149,10 @@ let AccountController = class AccountController {
         this.profileResolver = profileResolver;
         this.profileWriter = profileWriter;
         this.mfaDevices = mfaDevices;
+        this.sessionRestrictions = sessionRestrictions;
+        this.loginTotpVerifier = loginTotpVerifier;
+        this.mfaLimiter = mfaLimiter;
+        this.loginLimiter = loginLimiter;
     }
     /**
      * Resolve a human-readable otpauth account LABEL for the caller (email, else display
@@ -218,8 +239,9 @@ let AccountController = class AccountController {
      *   • no/invalid token                       → 401 (generic)
      *   • newPassword shorter than the minimum   → 422 `{ error: 'weak_password' }`
      *   • writer/hasher seam absent              → 501 `{ error: 'not_available' }`
-     *   • wrong current password                 → 401 (generic, no write)
-     *   • success                                → 204 (no body)
+     *   • wrong current password                 → 401 (generic, no write; counted)
+     *   • account login budget exhausted         → 401 (generic, not verified, no write)
+     *   • success                                → 204 (no body; counter reset)
      */
     async changePassword(authorization, body) {
         const claims = await this.requireClaims(authorization);
@@ -238,14 +260,25 @@ let AccountController = class AccountController {
         }
         const writer = this.writer;
         const hasher = this.hasher;
+        // Phase 8 #8: the current-password check spends the SAME per-account budget as
+        // password login (`login:pid:<principalId>`, shared counter): checked BEFORE the
+        // verify (a locked account never reaches the hasher), a wrong current password records
+        // a failure, and a success resets it — exactly as a completed login does. Locked → the
+        // same generic 401 as a wrong password (no oracle).
+        const loginKey = (0, canonical_hint_js_1.loginHintKey)('', claims.id);
+        if (this.loginLimiter != null && !(await this.loginLimiter.check(loginKey))) {
+            unauthorized();
+        }
         // Verify the current password: read the stored hash BY PRINCIPAL ID via the writer
         // seam's `getPasswordHash` (change-password holds the principal id from the token,
         // whereas CredentialResolver keys by identityHint). A missing hash or a mismatch is
         // the SAME generic 401 (no oracle), and no write happens.
         const stored = await writer.getPasswordHash(claims.id);
         if (stored === null || !(await hasher.verify(stored, currentPassword))) {
+            await this.loginLimiter?.recordFailure(loginKey);
             unauthorized();
         }
+        await this.loginLimiter?.reset(loginKey);
         const newHash = await hasher.hash(newPassword);
         await writer.setPassword(claims.id, newHash);
         // Revoke the caller's OTHER sessions (keep the current one live). Best-effort:
@@ -290,9 +323,7 @@ let AccountController = class AccountController {
         this.enforceReenroll(claims, false);
         // Normalize: treat only non-empty string fields as a real change (trim so a
         // whitespace-only value is not a change).
-        const name = typeof body?.name === 'string' && body.name.trim().length > 0
-            ? body.name.trim()
-            : undefined;
+        const name = typeof body?.name === 'string' && body.name.trim().length > 0 ? body.name.trim() : undefined;
         const email = typeof body?.email === 'string' && body.email.trim().length > 0
             ? body.email.trim()
             : undefined;
@@ -339,16 +370,52 @@ let AccountController = class AccountController {
     }
     /**
      * Verify a presented `code` against ANY of the caller's CONFIRMED device secrets
-     * (TOTP), returning true on the first match. Used by remove/regenerate where the
-     * proof may come from any live device (not a specific one). NEVER logs the code.
+     * (TOTP) through the replay-guarded login verifier: the secrets are bundled
+     * newline-joined (the `OrTotpVerifier` contract) and an accepted code is claimed in
+     * Redis, so it cannot be reused on this or any other MFA path inside the window. A
+     * Redis error on the claim → 503 (fail closed; never an unguarded accept, never a
+     * fall-through to the recovery-code check). Guarded verifier not wired → `false`.
+     * NEVER logs the code.
      */
     async verifyAgainstAnyDevice(store, principalId, code) {
+        if (this.loginTotpVerifier === undefined || this.loginTotpVerifier === null)
+            return false;
         const secrets = await store.listConfirmedSecrets(principalId);
-        for (const secret of secrets) {
-            if (await this.verifyTotp(secret, code))
-                return true;
+        if (secrets.length === 0)
+            return false;
+        try {
+            const verdict = await this.loginTotpVerifier.verify({ factor: 'totp', payload: { code } }, secrets.join('\n'));
+            return verdict.satisfied;
         }
-        return false;
+        catch {
+            retryableUnavailable();
+        }
+    }
+    /**
+     * The shared second-factor proof for the code-gated account routes (Phase 8 #1),
+     * mirroring `/auth/mfa`: the `mfa:pid:<principalId>` budget is checked BEFORE any TOTP
+     * or recovery-code verification (so a locked caller never triggers the Argon2
+     * recovery scan) → a TOTP from any confirmed device, else a recovery code (consumed) →
+     * a failed proof records a failure (400), a good one resets the counter. Locked → 429.
+     * The limiter fails open on a Redis blip (its documented posture); the TOTP replay
+     * claim fails closed (503), and the session itself is Redis-bound, so a Redis outage
+     * cannot open this path.
+     */
+    async requireMfaProof(store, principalId, code) {
+        const mfaKey = `mfa:pid:${principalId}`;
+        if (this.mfaLimiter != null && !(await this.mfaLimiter.check(mfaKey))) {
+            tooManyRequests();
+        }
+        const byTotp = await this.verifyAgainstAnyDevice(store, principalId, code);
+        const byRecovery = !byTotp &&
+            this.recoveryCodes !== undefined &&
+            this.recoveryCodes !== null &&
+            (await this.recoveryCodes.consume(principalId, code));
+        if (!byTotp && !byRecovery) {
+            await this.mfaLimiter?.recordFailure(mfaKey);
+            badRequest();
+        }
+        await this.mfaLimiter?.reset(mfaKey);
     }
     /**
      * `GET /account/mfa/devices` — list the caller's CONFIRMED authenticator devices.
@@ -446,6 +513,11 @@ let AccountController = class AccountController {
         if (claims.mustReenroll === true && this.binder !== undefined && this.binder !== null) {
             await this.binder.clearReenroll(claims.sessionId);
         }
+        // Durable side (Phase 3B review P1). Best-effort: a failed clear only means a binding rebuilt
+        // after a Redis loss is restricted again (the safe direction); the user re-confirms.
+        if (claims.mustReenroll === true && this.sessionRestrictions) {
+            await this.sessionRestrictions.clearMustReenroll(claims.sessionId).catch(() => undefined);
+        }
         if (wasFirst) {
             const recoveryCodes = await this.replaceRecoveryCodes(claims.id, recoveryStore, hasher);
             return { recoveryCodes };
@@ -499,14 +571,9 @@ let AccountController = class AccountController {
         const store = this.mfaDevices;
         const code = typeof body?.code === 'string' ? body.code : '';
         // Proof BEFORE the delete: a TOTP from any confirmed device (incl. the one being
-        // removed — legit for the last-device disable) OR a valid recovery code.
-        const byTotp = await this.verifyAgainstAnyDevice(store, claims.id, code);
-        const byRecovery = !byTotp &&
-            this.recoveryCodes !== undefined &&
-            this.recoveryCodes !== null &&
-            (await this.recoveryCodes.consume(claims.id, code));
-        if (!byTotp && !byRecovery)
-            badRequest();
+        // removed — legit for the last-device disable) OR a valid recovery code. Rate-limited
+        // and replay-guarded like `/auth/mfa` (Phase 8 #1).
+        await this.requireMfaProof(store, claims.id, code);
         const removed = await store.remove(claims.id, id);
         if (!removed) {
             throw new common_1.HttpException({ error: 'not_found' }, common_1.HttpStatus.NOT_FOUND);
@@ -546,11 +613,9 @@ let AccountController = class AccountController {
         // MFA must be on — else there's nothing to protect / no code source → generic 400.
         if ((await store.countConfirmed(claims.id)) === 0)
             badRequest();
-        // Proof: a TOTP from any confirmed device OR an existing recovery code.
-        const byTotp = await this.verifyAgainstAnyDevice(store, claims.id, code);
-        const byRecovery = !byTotp && (await recoveryStore.consume(claims.id, code));
-        if (!byTotp && !byRecovery)
-            badRequest();
+        // Proof: a TOTP from any confirmed device OR an existing recovery code (rate-limited
+        // and replay-guarded like `/auth/mfa`, Phase 8 #1).
+        await this.requireMfaProof(store, claims.id, code);
         const recoveryCodes = await this.replaceRecoveryCodes(claims.id, recoveryStore, hasher);
         return { recoveryCodes };
     }
@@ -657,7 +722,15 @@ exports.AccountController = AccountController = __decorate([
     __param(7, (0, common_1.Inject)(tokens_js_2.SHIELD_PROFILE_WRITER)),
     __param(8, (0, common_1.Optional)()),
     __param(8, (0, common_1.Inject)(tokens_js_2.SHIELD_MFA_DEVICE_STORE)),
-    __metadata("design:paramtypes", [Function, Object, Object, Object, Object, Object, Object, Object, Object])
+    __param(9, (0, common_1.Optional)()),
+    __param(9, (0, common_1.Inject)(tokens_js_2.SHIELD_SESSION_RESTRICTIONS)),
+    __param(10, (0, common_1.Optional)()),
+    __param(10, (0, common_1.Inject)(tokens_js_2.SHIELD_LOGIN_TOTP_VERIFIER)),
+    __param(11, (0, common_1.Optional)()),
+    __param(11, (0, common_1.Inject)(tokens_js_2.SHIELD_MFA_LIMITER)),
+    __param(12, (0, common_1.Optional)()),
+    __param(12, (0, common_1.Inject)(tokens_js_2.SHIELD_LOGIN_LIMITER)),
+    __metadata("design:paramtypes", [Function, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object])
 ], AccountController);
 /**
  * A deliberately-minimal email shape check (non-empty, a single `@`, a `.` in the

package/dist/auth/auth.controller.d.ts

@@ -14,10 +14,13 @@
  * ── OUTCOME → HTTP STATUS MAP (the security contract) ────────────────────────
  *   login authenticated        → 200  SessionSuccess { session(no-secret), tokens }
  *   login mfa_required          → 200  MfaChallengeResponse { mfaRequired, challengeToken }
+ *                                      (a Redis challenge: principal + hint + credential
+ *                                      fingerprint, never the password — M6)
  *   login invalid_credentials   → 401  GENERIC   ← unknown-user AND wrong-password IDENTICAL
  *   login auth_unavailable      → 503  RETRYABLE ← transient blip is NOT a credential deny
  *   mfa   success               → 200  SessionSuccess
  *   mfa   wrong/expired/forged   → 401  GENERIC   ← indistinguishable from a bad code
+ *   mfa   TOTP step locked (#9) → 401  GENERIC   (5 wrong codes / 15 min per account)
  *   mfa   auth_unavailable      → 503  RETRYABLE
  *   refresh ok                  → 200  SessionSuccess (new tokens, rotated session)
  *   refresh reuse/invalid       → 401  GENERIC   session_rejected (lineage-kill is the engine's)
@@ -50,12 +53,17 @@
  * composed engines via DI tokens; it never news-up an engine or an adapter.
  */
 import type { Authenticator, PasswordHasher, SessionAuthority } from '@astram/core';
+import type { SessionRestrictionStore } from '../session/session-restriction-store.js';
+import type { SessionRecordStore } from '@astram/core';
+import type { Clock, SessionLifetimeConfig } from '@astram/core';
+import { type MfaStepUp } from './mfa-step-up.js';
 import type { SessionFactsProjector } from './ports/session-facts-projector.js';
 import type { ScopeSubtreeResolver } from './ports/scope-subtree-resolver.js';
 import type { MembershipChecker } from './ports/membership-checker.js';
 import type { AttemptLimiter } from './rate-limit/attempt-limiter.js';
+import { TrustProxyBootCheck } from './rate-limit/trust-proxy-check.js';
 import { PendingMfaStore } from './pending-mfa-store.js';
-import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import { type SessionTokenBinder } from '../request-auth/session-token-binder.js';
 import type { CurrentUserProfile, ProfileResolver } from './profile-resolver.js';
 import type { CredentialResolver } from '@astram/core';
 import type { ResetTokenStore } from './ports/reset-token-store.js';
@@ -87,6 +95,8 @@ export declare class AuthController {
     private readonly resetLinkBaseUrl?;
     private readonly recoveryCodes?;
     private readonly loginLimiter?;
+    private readonly loginIpLimiter?;
+    private readonly trustProxyCheck?;
     private readonly recoveryLimiter?;
     private readonly forgotLimiter?;
     private readonly forgotHintLimiter?;
@@ -96,23 +106,28 @@ export declare class AuthController {
     private readonly scopeSubtreeResolver?;
     private readonly membershipChecker?;
     private readonly permissionFacts?;
-    constructor(authenticator: Authenticator, sessionAuthority: SessionAuthority, pendingMfa: PendingMfaStore, tokenBinder?: SessionTokenBinder | undefined, profileResolver?: ProfileResolver | undefined, credentialResolver?: (CredentialResolver | null) | undefined, resetTokenStore?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, credentialWriter?: (CredentialWriter | null) | undefined, sessionSweeper?: (SessionSweeper | null) | undefined, passwordHasher?: PasswordHasher | undefined, resetLinkBaseUrl?: string | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined, recoveryLimiter?: (AttemptLimiter | null) | undefined, forgotLimiter?: (AttemptLimiter | null) | undefined, forgotHintLimiter?: (AttemptLimiter | null) | undefined, resetLimiter?: (AttemptLimiter | null) | undefined, auditSink?: (AuditSink | null) | undefined, sessionFactsProjector?: (SessionFactsProjector | null) | undefined, scopeSubtreeResolver?: (ScopeSubtreeResolver | null) | undefined, membershipChecker?: (MembershipChecker | null) | undefined, permissionFacts?: (MariaDbPermissionFactsAdapter | null) | undefined);
+    private readonly mfaLimiter?;
+    private readonly mfaStepUp?;
+    private readonly clock?;
+    private readonly lifetimes?;
+    private readonly rootIds?;
+    private readonly sessionRecords?;
+    private readonly sessionRestrictions?;
+    constructor(authenticator: Authenticator, sessionAuthority: SessionAuthority, pendingMfa: PendingMfaStore, tokenBinder?: SessionTokenBinder | undefined, profileResolver?: ProfileResolver | undefined, credentialResolver?: (CredentialResolver | null) | undefined, resetTokenStore?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, credentialWriter?: (CredentialWriter | null) | undefined, sessionSweeper?: (SessionSweeper | null) | undefined, passwordHasher?: PasswordHasher | undefined, resetLinkBaseUrl?: string | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined, loginIpLimiter?: (AttemptLimiter | null) | undefined, trustProxyCheck?: (TrustProxyBootCheck | null) | undefined, recoveryLimiter?: (AttemptLimiter | null) | undefined, forgotLimiter?: (AttemptLimiter | null) | undefined, forgotHintLimiter?: (AttemptLimiter | null) | undefined, resetLimiter?: (AttemptLimiter | null) | undefined, auditSink?: (AuditSink | null) | undefined, sessionFactsProjector?: (SessionFactsProjector | null) | undefined, scopeSubtreeResolver?: (ScopeSubtreeResolver | null) | undefined, membershipChecker?: (MembershipChecker | null) | undefined, permissionFacts?: (MariaDbPermissionFactsAdapter | null) | undefined, mfaLimiter?: (AttemptLimiter | null) | undefined, mfaStepUp?: (MfaStepUp | null) | undefined, clock?: (Clock | null) | undefined, lifetimes?: (SessionLifetimeConfig | null) | undefined, rootIds?: (readonly string[] | null) | undefined, sessionRecords?: (Pick<SessionRecordStore, "findSessionById"> | null) | undefined, sessionRestrictions?: (SessionRestrictionStore | null) | undefined);
+    /**
+     * The access-token binding TTL for an establishment (security hardening #8):
+     * `clamp(session.expiresAtMs − now, 1, accessTtlMs)` — on login AND refresh. Never derived
+     * from `issuedAtMs` (the original login), which made refresh-minted tokens live for the
+     * session's age.
+     */
+    private accessTtlFor;
     /**
      * Bind the established session's access token to the principal's claims (the
-     * request-auth layer). The access-token TTL is `expiresAtMs - issuedAtMs` from the
-     * session. Best-effort: a binding failure must not fail the login (the caller still
+     * request-auth layer). The access-token TTL is {@link accessTtlFor} (≤ the access TTL).
+     * Best-effort: a binding failure must not fail the login (the caller still
      * gets valid tokens); the guard fails closed if the binding is absent.
      */
     private bindSession;
-    /**
-     * Project the principal's coarse grants for the session binding (ADR-0011), via the
-     * OPTIONAL {@link SessionFactsProjector} seam. Returns the {@link CoarseGrants} to
-     * cache, or `undefined` when there is no projector, the projection yielded nothing,
-     * OR it threw — every "no facts" path collapses to `undefined` so the caller simply
-     * omits `cachedFacts` and the request DB-reloads (fail-closed; a projection failure
-     * NEVER fails the login/refresh and never fabricates a grant).
-     */
-    private projectFacts;
     /**
      * Project coarse grants for a principal id + tenant (ADR-0011), distinguishing THREE
      * outcomes for the REFRESH path (which must know whether to carry the existing cache
@@ -148,6 +163,16 @@ export declare class AuthController {
      * bumped by moveNode/deleteNode) re-derives its CORRECT subtree here, closing the
      * stale-subtree-after-move window (bounded by the access-token lifetime — ADR-0011).
      */
+    /**
+     * The permission version of `tenantId`, read just BEFORE its subtree is resolved, to stamp the
+     * binding (`scopeSubtreeVersion`, security hardening Phase 1C): when gate 5 later reloads facts
+     * at a newer version, the enforcement guard re-derives the subtree. Read before the resolve so a
+     * racing bump leaves the stamp too old (one extra re-derive), never too new. Only when a
+     * subtree resolver is wired (no subtree → nothing to stamp, no extra read). Best-effort: no
+     * facts adapter, a non-integer, or a throw → `undefined` (unstamped → the guard re-derives once
+     * at the next reload). One indexed read at login/refresh/scope-switch, never per request.
+     */
+    private subtreeVersionFor;
     private resolveScopeSubtreeFor;
     /**
      * Compute the caller's OWN auth-facts projection to INLINE into a login/mfa success
@@ -183,12 +208,33 @@ export declare class AuthController {
      * never a claim), matching the internal adapter's root-safety.
      */
     private principalFromClaims;
+    /**
+     * The account (principal id) a typed hint resolves to, for keying the per-account
+     * limiters (review F1). Goes through the SAME injected {@link CredentialResolver} the
+     * composed authenticator uses — the default is the indexed
+     * `WHERE ic_identity_hint = ? LIMIT 1` on the `utf8mb4_unicode_ci` column — so the DB
+     * collation, not client-side normalisation, decides which spellings are one account.
+     * No new access path. The RAW hint is passed (never normalised).
+     *
+     * Returns `null` for an unknown hint, a blank hint, or when no resolver is wired (→ the
+     * canonical-hash fallback key). A store ERROR propagates (the caller fails closed).
+     */
+    /**
+     * The ONE gate for every per-IP limiter (login failures, forgot-password, reset-password):
+     * returns the limiter only when bootstrap confirmed an explicit Express `trust proxy`
+     * ({@link TrustProxyBootCheck.perIpLimitingEnabled}); otherwise `null` (limiter OFF).
+     * Without it every client behind a proxy shares one `req.ip`, so enforcing a per-IP
+     * limit would block everyone (an unauthenticated global DoS). Per-account limits are
+     * never routed through here.
+     */
+    private perIp;
+    private lookupAccount;
     /**
      * `POST /auth/login` — verify a password credential and either establish a
      * session, issue an MFA challenge, deny generically, or signal a transient
      * outage. NEVER logs the request body.
      */
-    login(body: LoginRequest): Promise<LoginResponse>;
+    login(body: LoginRequest, ip: string): Promise<LoginResponse>;
     /**
      * `GET /auth/me` — the signed-in user's **display profile** (name, email, active
      * company name, role names) for the UI header/card. Fills the flagged gap: login
@@ -269,12 +315,27 @@ export declare class AuthController {
     forgotPassword(body: {
         identityHint?: string;
     }, ip: string): Promise<void>;
+    /**
+     * The detached per-account half of {@link forgotPassword} (review F1):
+     *  1. resolve the RAW hint through the same {@link CredentialResolver} the authenticator
+     *     uses (the DB collation decides which spellings are one account);
+     *  2. meter the per-account budget — `forgot:pid:<principalId>`, or the canonical-hash
+     *     fallback key for an unknown hint — and audit `auth.forgot_password.hint_throttled`
+     *     ONCE on the edge (distinct from the IP site's `throttled`, so "one account bombed
+     *     across rotating IPs" is visible). No notify (it would itself be the email-bomb);
+     *  3. send only when both budgets allow, the account resolved, and the reset seams exist.
+     * A lookup error still meters (fallback key) and skips the send (still 204).
+     */
+    private meterAndDeliverReset;
     /**
      * The detached found-path work for {@link forgotPassword}: mint a raw token, issue
      * its SHA-256 hash to the store (30-min TTL), resolve the recipient email via the
      * profile resolver, and send the framework-composed reset link. Runs OUTSIDE the
-     * request/response timing (fire-and-forget) so it cannot form a timing oracle. Never
-     * logs the token or the email.
+     * request/response timing (fire-and-forget) so it cannot form a timing oracle. This
+     * method itself writes no log line — but the raw token and the email ARE handed to the
+     * bound {@link EmailSender}, and the dev-only `LogEmailSender` (the default ONLY when
+     * NODE_ENV is `development`/`test`) prints the whole message, link included, to stdout.
+     * Any other environment must supply a real sender or `emailSender: 'disabled'`.
      */
     private deliverResetLink;
     /**
@@ -298,9 +359,9 @@ export declare class AuthController {
      * `POST /auth/mfa` — complete a pending MFA login. Consumes the single-use
      * challenge handle (unknown/expired/forged → same generic 401 as a bad code),
      * then BRANCHES on the presented factor:
-     *   • `'totp'` → RE-RUNS `authenticate(hint, [password, totp])` with the code
-     *     (the authenticator has no standalone factor-verify seam — the full attempt
-     *     IS the verify). Success → establish + tokens.
+     *   • `'totp'` → the MFA STEP-UP (M6): verify ONLY the code against the principal the
+     *     password step recorded (no password is held or re-run). Rate-limited per account
+     *     (#9). See {@link completeViaTotp}.
      *   • `'recovery_code'` → the lost-device escape hatch: verify a one-time
      *     recovery code (a separate branch, NOT the core factor loop — recovery codes
      *     are N single-use Argon2 hashes, incompatible with the pure one-secret
@@ -308,9 +369,25 @@ export declare class AuthController {
      *   • any other factor → generic 401 (no leak of "unsupported factor").
      *
      * Anti-enumeration: unknown/forged/expired challenge, unknown hint, wrong code,
-     * and wrong recovery code ALL return the identical generic 401.
+     * a locked TOTP step, and a wrong recovery code ALL return the identical generic 401.
+     * A challenge-store outage is a retryable 503.
      */
     mfa(body: MfaRequest): Promise<SessionSuccess>;
+    /**
+     * The `/auth/mfa` TOTP branch (M6 + #9). The consumed challenge proves the password
+     * step passed for `pending.principalId`; this verifies ONLY the code, through the
+     * {@link MfaStepUp} (same `OrTotpVerifier` + replay guard as the authenticator, principal
+     * minted by the identity broker).
+     *
+     *  - `mfa:pid:<principalId>` is checked BEFORE verifying: locked → generic 401 and the
+     *    step-up is never consulted.
+     *  - a rejected code records a failure; the edge where the count first reaches the
+     *    threshold audits `auth.mfa.locked` ONCE (no notify — pre-auth, see recovery lockout).
+     *  - a transient outage → 503, never counted.
+     *  - success → establish + bind, then reset the TOTP counter AND the login counter (the
+     *    login counter is reset only here, once authentication fully succeeded).
+     */
+    private completeViaTotp;
     /**
      * The `/auth/mfa` RECOVERY-CODE branch (spec §3). The lost-device user completes
      * login with a pre-issued single-use recovery code instead of a TOTP.
@@ -383,11 +460,43 @@ export declare class AuthController {
     /**
      * `POST /auth/refresh` — rotate the refresh token. Reuse/invalid/expired →
      * generic 401 (`session_rejected`; the engine already killed the lineage,
-     * ADR-0015). ⚠ See the class header: the engine's rotate collapses a transient
+     * ADR-0015, and `HotRevokingSessionRecordStore` unbinds it in Redis so the live access
+     * token dies on its next request — M-A). The new access token is bound for ≤ the access
+     * TTL; the previous one keeps a 30 s grace (#8, D7). If the session's claims cannot be
+     * carried forward (`rebindOnRotate` → false) the refresh is a generic 401 — never an
+     * unbound token. ⚠ See the class header: the engine's rotate collapses a transient
      * store outage into the SAME reject, so refresh cannot emit the ADR-0016 503 from
      * this seam today (flagged core-API gap).
      */
     refresh(body: RefreshRequest): Promise<SessionSuccess>;
+    /**
+     * The refresh-time projection for one node: coarse grants + live roles (ADR-0035) and the
+     * subtree with its version stamp (Phase 1C: the version is read FIRST). Each part is best-effort
+     * exactly as at login (`undefined` = carry / omit, `null` facts = strip).
+     */
+    private projectForNode;
+    /**
+     * SILENT RECOVERY of a lost session binding (invariant #12, ADR-0013, ADR-0035, GAPS #5).
+     * `rotate()` has already proved the durable session is active and inside its idle and absolute
+     * windows, and returned its principal + tenant. The rebuilt claims NEVER carry more authority
+     * than the session had (Phase 3B review P1); they come from durable sources only:
+     *  - principal + tenant: the durable session record (the LOGIN node; a scope-switch is not
+     *    durable, so a rebuilt session returns to the node it was opened on);
+     *  - the RE-ENROLL restriction: `shield_identity.session.s_must_reenroll`, set at a
+     *    recovery-code login. A restricted session rebuilds `mustReenroll: true` and NEVER root
+     *    (exactly how the recovery login bound it);
+     *  - the account status: a disabled user gets no rebuild;
+     *  - roles: the live projection (ADR-0035) — `[]` when none is available (non-widening; the
+     *    first request's gate-5 reload fills them, because no facts are cached then);
+     *  - `isRoot` (unrestricted sessions only): the server-side root allowlist, never a claim;
+     *  - subtree: the resolver (absent → the self-node fallback, non-widening);
+     *  - kind `user` (sessions are human; service accounts authenticate with keys).
+     * No restriction store, or any error reading it → no rebuild (fail closed). The claims entry is
+     * written with `NX`, then the durable session is READ AGAIN: if a logout or revoke landed
+     * meanwhile, the rebuilt binding is dropped and the refresh fails. Returns `true` when the
+     * session is bound and still active. Any error → `false` (the caller answers 401).
+     */
+    private rebuildBinding;
     /**
      * `POST /auth/logout` — revoke the session. Idempotent + leak-free: revoking an
      * unknown or already-revoked session still returns 204 (the engine's `revoke`

package/dist/auth/auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAeH,OAAO,KAAK,EACV,aAAa,EAIb,cAAc,EAGd,gBAAgB,EAEjB,MAAM,cAAc,CAAC;AAyBtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAGlF,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,KAAK,EAEV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EAEf,MAAM,UAAU,CAAC;AA6FlB;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAO7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAIlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAS/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAI9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAQjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAS3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAWvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAStC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAYnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAvIhB,aAAa,EAAE,aAAa,EAE5B,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,eAAe,EAO3B,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAOhC,eAAe,CAAC,EAAE,eAAe,YAAA,EAOjC,kBAAkB,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAI9C,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAIxC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,gBAAgB,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAI1C,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAItC,cAAc,CAAC,EAAE,cAAc,YAAA,EAK/B,gBAAgB,CAAC,EAAE,MAAM,YAAA,EAOzB,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EASxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAIpC,eAAe,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAQvC,aAAa,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKrC,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAS5B,qBAAqB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAWpD,oBAAoB,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA,EASlD,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAY5C,eAAe,CAAC,GAAE,6BAA6B,GAAG,IAAI,aAAA;IAGzE;;;;;OAKG;YACW,WAAW;IAiDzB;;;;;;;OAOG;YACW,YAAY;IAQ1B;;;;;;;;;;OAUG;YACW,eAAe;IAc7B;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAMjC;;;;;;;;OAQG;YACW,sBAAsB;IAgBpC;;;;;;;;;;OAUG;YACW,gBAAgB;IAY9B;;;;;;;;OAQG;YACW,uBAAuB;IAarC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;OAIG;IAIG,KAAK,CAAS,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IA2E/D;;;;;;;;;;;;;;;;;;OAkBG;IAIG,EAAE,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4CvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAIG,WAAW,CACP,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EACb,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IA2EjF;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,cAAc,CACV,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAIjC,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IA+FhB;;;;;;OAMG;YACW,gBAAgB;IA4C9B;;;;;;;;;;;;OAYG;IAIG,aAAa,CACT,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAEhD,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;;;;;;;;;;;;OAeG;IAIG,GAAG,CAAS,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0C5D;;;;;;;;;;;;;;;OAeG;YACW,uBAAuB;IAwFrC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAoC1B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;OAMG;IAIG,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IA2CpE;;;;OAIG;IAIG,MAAM,CAAS,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAexD;;;;;OAKG;YACW,iBAAiB;CAOhC"}
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAeH,OAAO,KAAK,EACV,aAAa,EAIb,cAAc,EAGd,gBAAgB,EAEjB,MAAM,cAAc,CAAC;AA+BtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAOjE,OAAO,EAA2C,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAOtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,cAAc,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,KAAK,EAEV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EAEf,MAAM,UAAU,CAAC;AA6FlB;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAO7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAIlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAU/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAM9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAQjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAS3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAWvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAStC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAYnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAKjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAK3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAGvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAM3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAMzB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAxLpB,aAAa,EAAE,aAAa,EAE5B,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,eAAe,EAO3B,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAOhC,eAAe,CAAC,EAAE,eAAe,YAAA,EAOjC,kBAAkB,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAI9C,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAIxC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,gBAAgB,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAI1C,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAItC,cAAc,CAAC,EAAE,cAAc,YAAA,EAK/B,gBAAgB,CAAC,EAAE,MAAM,YAAA,EAOzB,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAUxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMpC,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMtC,eAAe,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5C,eAAe,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAQvC,aAAa,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKrC,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAS5B,qBAAqB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAWpD,oBAAoB,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA,EASlD,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAY5C,eAAe,CAAC,GAAE,6BAA6B,GAAG,IAAI,aAAA,EAKtD,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAK5B,KAAK,CAAC,GAAE,KAAK,GAAG,IAAI,aAAA,EAGpB,SAAS,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAMxC,OAAO,CAAC,GAAE,SAAS,MAAM,EAAE,GAAG,IAAI,aAAA,EAMlC,cAAc,CAAC,GAAE,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,GAAG,IAAI,aAAA,EAMnE,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA;IAGvE;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;OAKG;YACW,WAAW;IAiEzB;;;;;;;;;;OAUG;YACW,eAAe;IAgB7B;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAIjC;;;;;;;;OAQG;IACH;;;;;;;;OAQG;YACW,iBAAiB;YAcjB,sBAAsB;IAcpC;;;;;;;;;;OAUG;YACW,gBAAgB;IAY9B;;;;;;;;OAQG;YACW,uBAAuB;IAarC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;;;;;;;OAUG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK;YAIC,aAAa;IAM3B;;;;OAIG;IAIG,KAAK,CACD,IAAI,EAAE,YAAY,EAIpB,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC;IA0HzB;;;;;;;;;;;;;;;;;;OAkBG;IAIG,EAAE,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmCvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAIG,WAAW,CACP,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EACb,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAqFjF;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,cAAc,CACV,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAKjC,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAgEhB;;;;;;;;;;OAUG;YACW,oBAAoB;IAqClC;;;;;;;;;OASG;YACW,gBAAgB;IAwC9B;;;;;;;;;;;;OAYG;IAIG,aAAa,CACT,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAEhD,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAsFhB;;;;;;;;;;;;;;;;OAgBG;IAIG,GAAG,CAAS,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0B5D;;;;;;;;;;;;;OAaG;YACW,eAAe;IA2C7B;;;;;;;;;;;;;;;OAeG;YACW,uBAAuB;IA0GrC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAoC1B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;OAUG;IAIG,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAkEpE;;;;OAIG;YACW,cAAc;IAe5B;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,cAAc;IAgE5B;;;;OAIG;IAIG,MAAM,CAAS,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAexD;;;;;OAKG;YACW,iBAAiB;CAOhC"}