@astram/guard 0.8.0 → 0.10.0

package/dist/auth/account.controller.d.ts

@@ -38,13 +38,14 @@
  *   `DELETE /account/mfa/devices/:id` (code-gated), `POST
  *   /account/mfa/recovery-codes/regenerate` (code-gated).
  *
- * ── NO ORACLE ── a wrong current password is an indistinguishable generic 401
- *   (same body as no-token). We never reveal whether the principal exists, nor which
- *   check failed. Passwords/hashes are NEVER logged.
+ * ── NO ORACLE ── no-token / bad token is one generic 401. A wrong current password is a
+ *   400 (Phase 9 #3; never 401, which clients read as "token expired" and replay), the
+ *   same for a missing stored hash. Passwords/hashes are NEVER logged.
  */
 import type { FactorVerifier, PasswordHasher } from '@astram/core';
 import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
 import type { SessionRestrictionStore } from '../session/session-restriction-store.js';
+import type { AttemptLimiter } from './rate-limit/attempt-limiter.js';
 import type { CredentialWriter } from './ports/credential-writer.js';
 import type { MfaDevice, MfaDeviceStore } from './ports/mfa-device-store.js';
 import type { CurrentUserProfile, ProfileResolver } from './profile-resolver.js';
@@ -62,7 +63,10 @@ export declare class AccountController {
     private readonly profileWriter?;
     private readonly mfaDevices?;
     private readonly sessionRestrictions?;
-    constructor(binder?: SessionTokenBinder | undefined, hasher?: PasswordHasher | undefined, writer?: (CredentialWriter | null) | undefined, sweeper?: (SessionSweeper | null) | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, totpVerifier?: (FactorVerifier | null) | undefined, profileResolver?: (ProfileResolver | null) | undefined, profileWriter?: (ProfileWriter | null) | undefined, mfaDevices?: (MfaDeviceStore | null) | undefined, sessionRestrictions?: (SessionRestrictionStore | null) | undefined);
+    private readonly loginTotpVerifier?;
+    private readonly mfaLimiter?;
+    private readonly loginLimiter?;
+    constructor(binder?: SessionTokenBinder | undefined, hasher?: PasswordHasher | undefined, writer?: (CredentialWriter | null) | undefined, sweeper?: (SessionSweeper | null) | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, totpVerifier?: (FactorVerifier | null) | undefined, profileResolver?: (ProfileResolver | null) | undefined, profileWriter?: (ProfileWriter | null) | undefined, mfaDevices?: (MfaDeviceStore | null) | undefined, sessionRestrictions?: (SessionRestrictionStore | null) | undefined, loginTotpVerifier?: (FactorVerifier | null) | undefined, mfaLimiter?: (AttemptLimiter | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined);
     /**
      * Resolve a human-readable otpauth account LABEL for the caller (email, else display
      * name) via the profile resolver. Best-effort: no resolver / null profile / a thrown
@@ -111,8 +115,16 @@ export declare class AccountController {
      *   • no/invalid token                       → 401 (generic)
      *   • newPassword shorter than the minimum   → 422 `{ error: 'weak_password' }`
      *   • writer/hasher seam absent              → 501 `{ error: 'not_available' }`
-     *   • wrong current password                 → 401 (generic, no write)
-     *   • success                                → 204 (no body)
+     *   • wrong current password                 → 400 `{ error: 'invalid_current_password' }`
+     *                                              (no write; counted; also for no stored hash)
+     *   • account login budget exhausted         → 429 `{ error: 'too_many_requests' }`
+     *                                              (not verified, no write)
+     *   • attempt limiter (Redis) unreachable    → 503 `{ error: 'authentication_unavailable' }`
+     *                                              (fail closed, not verified, no write)
+     *
+     * 401 is reserved for a missing/invalid session (Phase 9 #3): the client's refresh
+     * wrapper refreshes and replays on a bearer 401, so a credential mismatch must not use it.
+     *   • success                                → 204 (no body; counter reset)
      */
     changePassword(authorization: string | undefined, body: {
         currentPassword?: string;
@@ -156,10 +168,25 @@ export declare class AccountController {
     private replaceRecoveryCodes;
     /**
      * Verify a presented `code` against ANY of the caller's CONFIRMED device secrets
-     * (TOTP), returning true on the first match. Used by remove/regenerate where the
-     * proof may come from any live device (not a specific one). NEVER logs the code.
+     * (TOTP) through the replay-guarded login verifier: the secrets are bundled
+     * newline-joined (the `OrTotpVerifier` contract) and an accepted code is claimed in
+     * Redis, so it cannot be reused on this or any other MFA path inside the window. A
+     * Redis error on the claim → 503 (fail closed; never an unguarded accept, never a
+     * fall-through to the recovery-code check). Guarded verifier not wired → `false`.
+     * NEVER logs the code.
      */
     private verifyAgainstAnyDevice;
+    /**
+     * The shared second-factor proof for the code-gated account routes (Phase 8 #1),
+     * mirroring `/auth/mfa`: the attempt is counted against `mfa:pid:<principalId>` BEFORE
+     * any TOTP or recovery-code verification (Phase 9 #10: atomic increment-first, so
+     * parallel guesses cannot all pass; a locked caller never triggers the Argon2 recovery
+     * scan) → a TOTP from any confirmed device, else a recovery code (consumed) → a failed
+     * proof keeps its count (400), a good one resets the counter. Locked → 429. A Redis
+     * error on the gate fails closed (503), as does the TOTP replay claim; an attempt that
+     * ended in such an error (no verdict) is given back.
+     */
+    private requireMfaProof;
     /**
      * `GET /account/mfa/devices` — list the caller's CONFIRMED authenticator devices.
      * `mfaEnabled` reflects whether any confirmed device exists. Pending (unconfirmed)
@@ -225,7 +252,7 @@ export declare class AccountController {
      * and additionally wipes the account's recovery codes.
      *
      * Outcomes: 401; store absent → 501; wrong code → 400 (no remove); not found/owned →
-     * 404; success → 204.
+     * 404; MFA budget exhausted → 429; limiter/replay guard unreachable → 503; success → 204.
      */
     removeDevice(authorization: string | undefined, id: string, body: {
         code?: string;
@@ -236,6 +263,7 @@ export declare class AccountController {
      * — a TOTP from any confirmed device OR an existing recovery code.
      *
      * Outcomes: 401; store/recovery/hasher absent → 501; MFA off → 400; wrong code → 400;
+     * MFA budget exhausted → 429; limiter/replay guard unreachable → 503;
      * success → 200 `{ recoveryCodes }`.
      */
     regenerateRecoveryCodes(authorization: string | undefined, body: {

package/dist/auth/account.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.controller.d.ts","sourceRoot":"","sources":["../../src/auth/account.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAa,MAAM,cAAc,CAAC;AAI9E,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,yCAAyC,CAAC;AAYjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA4DjE,qBACa,iBAAiB;IAO1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAMxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAKzB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAM/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAKjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBA/CpB,MAAM,CAAC,EAAE,kBAAkB,YAAA,EAI3B,MAAM,CAAC,EAAE,cAAc,YAAA,EAIvB,MAAM,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAMhC,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAK/B,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAMxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAKxC,aAAa,CAAC,GAAE,aAAa,GAAG,IAAI,aAAA,EAKpC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA;IAGvE;;;;;;OAMG;YACW,mBAAmB;IAwBjC;;;;OAIG;YACW,aAAa;IAS3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;;;;;;;OAYG;IAIG,cAAc,CACQ,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,IAAI,CAAC;IAsChB;;;;;OAKG;YACW,UAAU;IAMxB;;;;;;;;;;;;;;;;;OAiBG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,kBAAkB,CAAC;IA6C9B;;;;;OAKG;YACW,oBAAoB;IAWlC;;;;OAIG;YACW,sBAAsB;IAYpC;;;;;;;;OAQG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,GAC1D,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAUzD;;;;;;;OAOG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAmBpE;;;;;;;;;OASG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA8DxC;;;;;;;OAOG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC;IAiBjC;;;;;;;;;OASG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IAmChB;;;;;;;OAOG;IAIG,uBAAuB,CACD,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAgCxC"}
+{"version":3,"file":"account.controller.d.ts","sourceRoot":"","sources":["../../src/auth/account.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAa,MAAM,cAAc,CAAC;AAI9E,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,yCAAyC,CAAC;AAejD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAwGjE,qBACa,iBAAiB;IAO1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAMxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAKzB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAQ/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAKjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAOrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAlEb,MAAM,CAAC,EAAE,kBAAkB,YAAA,EAI3B,MAAM,CAAC,EAAE,cAAc,YAAA,EAIvB,MAAM,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAMhC,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAK/B,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAQxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAKxC,aAAa,CAAC,GAAE,aAAa,GAAG,IAAI,aAAA,EAKpC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA,EAOpD,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA;IAGvD;;;;;;OAMG;YACW,mBAAmB;IAwBjC;;;;OAIG;YACW,aAAa;IAS3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;;;;;;;;;;;;;;;OAoBG;IAIG,cAAc,CACQ,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,IAAI,CAAC;IA6DhB;;;;;OAKG;YACW,UAAU;IAMxB;;;;;;;;;;;;;;;;;OAiBG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,kBAAkB,CAAC;IA6C9B;;;;;OAKG;YACW,oBAAoB;IAWlC;;;;;;;;OAQG;YACW,sBAAsB;IAmBpC;;;;;;;;;OASG;YACW,eAAe;IAuB7B;;;;;;;;OAQG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,GAC1D,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAUzD;;;;;;;OAOG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAmBpE;;;;;;;;;OASG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA8DxC;;;;;;;OAOG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC;IAiBjC;;;;;;;;;OASG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IA8BhB;;;;;;;;OAQG;IAIG,uBAAuB,CACD,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CA+BxC"}

package/dist/auth/account.controller.js

@@ -39,9 +39,9 @@
  *   `DELETE /account/mfa/devices/:id` (code-gated), `POST
  *   /account/mfa/recovery-codes/regenerate` (code-gated).
  *
- * ── NO ORACLE ── a wrong current password is an indistinguishable generic 401
- *   (same body as no-token). We never reveal whether the principal exists, nor which
- *   check failed. Passwords/hashes are NEVER logged.
+ * ── NO ORACLE ── no-token / bad token is one generic 401. A wrong current password is a
+ *   400 (Phase 9 #3; never 401, which clients read as "token expired" and replay), the
+ *   same for a missing stored hash. Passwords/hashes are NEVER logged.
  */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -62,6 +62,7 @@ const classification_decorator_js_1 = require("../enforcement/classification.dec
 const request_principal_js_1 = require("../request-auth/request-principal.js");
 const tokens_js_1 = require("../request-auth/tokens.js");
 const tokens_js_2 = require("./tokens.js");
+const canonical_hint_js_1 = require("./rate-limit/canonical-hint.js");
 const totp_enrollment_js_1 = require("./totp-enrollment.js");
 /** Max length of a device name (matches the `md_name VARCHAR(120)` column). */
 const MAX_DEVICE_NAME_LEN = 120;
@@ -82,14 +83,22 @@ const TOTP_ISSUER = 'Astram';
  */
 const FALLBACK_OTPAUTH_LABEL = 'account';
 /**
- * The SINGLE generic 401 for EVERY unauthenticated/bad-credential path here (no
- * token, no binder, resolve→null, wrong current password). Deliberately
- * non-distinguishing — never leaks whether the principal exists or which check
- * failed.
+ * The SINGLE generic 401 for EVERY unauthenticated path here (no token, no binder,
+ * resolve→null). Deliberately non-distinguishing — never leaks whether the principal
+ * exists. Never used for a credential mismatch by an authenticated caller (Phase 9 #3):
+ * clients treat a bearer 401 as an expired token and refresh + replay.
  */
 function unauthorized() {
     throw new common_1.HttpException({ error: 'unauthorized' }, common_1.HttpStatus.UNAUTHORIZED);
 }
+/**
+ * The 400 for a wrong (or unset) current password on change-password (Phase 9 #3). The
+ * caller is authenticated and acting on their own account, so naming the field is safe;
+ * a missing stored hash gives the same answer (no "has no password" oracle).
+ */
+function invalidCurrentPassword() {
+    throw new common_1.HttpException({ error: 'invalid_current_password' }, common_1.HttpStatus.BAD_REQUEST);
+}
 /** The honest 501 when a required seam is unplugged (fail-closed, no mutation). */
 function notAvailable() {
     throw new common_1.HttpException({ error: 'not_available' }, common_1.HttpStatus.NOT_IMPLEMENTED);
@@ -103,6 +112,38 @@ function notAvailable() {
 function badRequest() {
     throw new common_1.HttpException({ error: 'invalid_request' }, common_1.HttpStatus.BAD_REQUEST);
 }
+/**
+ * The 429 for a caller whose proof budget is exhausted (Phase 8 #1). These routes are
+ * self-scoped and already authenticated, so the throttle signal reveals nothing about
+ * another account; a 401 here would read as "session expired" to the client's refresh logic.
+ */
+function tooManyRequests() {
+    throw new common_1.HttpException({ error: 'too_many_requests' }, common_1.HttpStatus.TOO_MANY_REQUESTS);
+}
+/**
+ * The retryable 503 when the replay guard or the attempt limiter (Redis) cannot answer:
+ * fail closed, no mutation.
+ */
+function retryableUnavailable() {
+    throw new common_1.HttpException({ error: 'authentication_unavailable' }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+}
+/**
+ * Phase 9 #10 — count this attempt BEFORE verifying anything (atomic increment-first).
+ * Over budget → 429; limiter unreachable → 503 (fail closed). No limiter wired → no-op.
+ */
+async function consumeAttempt(limiter, key) {
+    if (limiter == null)
+        return;
+    let allowed;
+    try {
+        ({ allowed } = await limiter.consume(key));
+    }
+    catch {
+        retryableUnavailable();
+    }
+    if (!allowed)
+        tooManyRequests();
+}
 /**
  * The 422 for a semantically invalid profile edit — an empty change (`no_changes`)
  * or a malformed email (`invalid_email`). Distinct from {@link badRequest}: this is
@@ -123,7 +164,10 @@ let AccountController = class AccountController {
     profileWriter;
     mfaDevices;
     sessionRestrictions;
-    constructor(binder, hasher, writer, sweeper, recoveryCodes, totpVerifier, profileResolver, profileWriter, mfaDevices, sessionRestrictions) {
+    loginTotpVerifier;
+    mfaLimiter;
+    loginLimiter;
+    constructor(binder, hasher, writer, sweeper, recoveryCodes, totpVerifier, profileResolver, profileWriter, mfaDevices, sessionRestrictions, loginTotpVerifier, mfaLimiter, loginLimiter) {
         this.binder = binder;
         this.hasher = hasher;
         this.writer = writer;
@@ -134,6 +178,9 @@ let AccountController = class AccountController {
         this.profileWriter = profileWriter;
         this.mfaDevices = mfaDevices;
         this.sessionRestrictions = sessionRestrictions;
+        this.loginTotpVerifier = loginTotpVerifier;
+        this.mfaLimiter = mfaLimiter;
+        this.loginLimiter = loginLimiter;
     }
     /**
      * Resolve a human-readable otpauth account LABEL for the caller (email, else display
@@ -220,8 +267,16 @@ let AccountController = class AccountController {
      *   • no/invalid token                       → 401 (generic)
      *   • newPassword shorter than the minimum   → 422 `{ error: 'weak_password' }`
      *   • writer/hasher seam absent              → 501 `{ error: 'not_available' }`
-     *   • wrong current password                 → 401 (generic, no write)
-     *   • success                                → 204 (no body)
+     *   • wrong current password                 → 400 `{ error: 'invalid_current_password' }`
+     *                                              (no write; counted; also for no stored hash)
+     *   • account login budget exhausted         → 429 `{ error: 'too_many_requests' }`
+     *                                              (not verified, no write)
+     *   • attempt limiter (Redis) unreachable    → 503 `{ error: 'authentication_unavailable' }`
+     *                                              (fail closed, not verified, no write)
+     *
+     * 401 is reserved for a missing/invalid session (Phase 9 #3): the client's refresh
+     * wrapper refreshes and replays on a bearer 401, so a credential mismatch must not use it.
+     *   • success                                → 204 (no body; counter reset)
      */
     async changePassword(authorization, body) {
         const claims = await this.requireClaims(authorization);
@@ -240,14 +295,38 @@ let AccountController = class AccountController {
         }
         const writer = this.writer;
         const hasher = this.hasher;
+        // Phase 8 #8: the current-password check spends the SAME per-account budget as
+        // password login (`login:pid:<principalId>`, shared counter): checked BEFORE the
+        // verify (a locked account never reaches the hasher), a wrong current password records
+        // a failure, and a success resets it — exactly as a completed login does. Locked → 429
+        // (Phase 9 #3), like the MFA account routes: the caller is authenticated, so the
+        // throttle reveals nothing about another account, and a 401 would make the client
+        // refresh and replay the request.
+        //
+        // Phase 9 #10: the attempt is counted FIRST (atomic), so parallel guesses cannot all
+        // slip past a read-only check; a wrong password simply keeps its count. A Redis error
+        // fails closed (503).
+        const loginKey = (0, canonical_hint_js_1.loginHintKey)('', claims.id);
+        await consumeAttempt(this.loginLimiter, loginKey);
         // Verify the current password: read the stored hash BY PRINCIPAL ID via the writer
         // seam's `getPasswordHash` (change-password holds the principal id from the token,
         // whereas CredentialResolver keys by identityHint). A missing hash or a mismatch is
-        // the SAME generic 401 (no oracle), and no write happens.
-        const stored = await writer.getPasswordHash(claims.id);
-        if (stored === null || !(await hasher.verify(stored, currentPassword))) {
-            unauthorized();
+        // the SAME 400 (no oracle), and no write happens. NOT 401 (Phase 9 #3): the session is
+        // valid, and the client's refresh wrapper treats a bearer 401 as an expired token —
+        // refresh + replay, which counted every typo twice against the shared login budget.
+        let matches;
+        try {
+            const stored = await writer.getPasswordHash(claims.id);
+            matches = stored !== null && (await hasher.verify(stored, currentPassword));
+        }
+        catch (err) {
+            // No verdict (store/hasher fault): give the attempt back, then surface the error.
+            await this.loginLimiter?.refund(loginKey);
+            throw err;
         }
+        if (!matches)
+            invalidCurrentPassword(); // the consumed attempt stays counted
+        await this.loginLimiter?.reset(loginKey);
         const newHash = await hasher.hash(newPassword);
         await writer.setPassword(claims.id, newHash);
         // Revoke the caller's OTHER sessions (keep the current one live). Best-effort:
@@ -339,16 +418,56 @@ let AccountController = class AccountController {
     }
     /**
      * Verify a presented `code` against ANY of the caller's CONFIRMED device secrets
-     * (TOTP), returning true on the first match. Used by remove/regenerate where the
-     * proof may come from any live device (not a specific one). NEVER logs the code.
+     * (TOTP) through the replay-guarded login verifier: the secrets are bundled
+     * newline-joined (the `OrTotpVerifier` contract) and an accepted code is claimed in
+     * Redis, so it cannot be reused on this or any other MFA path inside the window. A
+     * Redis error on the claim → 503 (fail closed; never an unguarded accept, never a
+     * fall-through to the recovery-code check). Guarded verifier not wired → `false`.
+     * NEVER logs the code.
      */
     async verifyAgainstAnyDevice(store, principalId, code) {
+        if (this.loginTotpVerifier === undefined || this.loginTotpVerifier === null)
+            return false;
         const secrets = await store.listConfirmedSecrets(principalId);
-        for (const secret of secrets) {
-            if (await this.verifyTotp(secret, code))
-                return true;
+        if (secrets.length === 0)
+            return false;
+        try {
+            const verdict = await this.loginTotpVerifier.verify({ factor: 'totp', payload: { code } }, secrets.join('\n'));
+            return verdict.satisfied;
+        }
+        catch {
+            retryableUnavailable();
         }
-        return false;
+    }
+    /**
+     * The shared second-factor proof for the code-gated account routes (Phase 8 #1),
+     * mirroring `/auth/mfa`: the attempt is counted against `mfa:pid:<principalId>` BEFORE
+     * any TOTP or recovery-code verification (Phase 9 #10: atomic increment-first, so
+     * parallel guesses cannot all pass; a locked caller never triggers the Argon2 recovery
+     * scan) → a TOTP from any confirmed device, else a recovery code (consumed) → a failed
+     * proof keeps its count (400), a good one resets the counter. Locked → 429. A Redis
+     * error on the gate fails closed (503), as does the TOTP replay claim; an attempt that
+     * ended in such an error (no verdict) is given back.
+     */
+    async requireMfaProof(store, principalId, code) {
+        const mfaKey = `mfa:pid:${principalId}`;
+        await consumeAttempt(this.mfaLimiter, mfaKey);
+        let proven;
+        try {
+            const byTotp = await this.verifyAgainstAnyDevice(store, principalId, code);
+            proven =
+                byTotp ||
+                    (this.recoveryCodes !== undefined &&
+                        this.recoveryCodes !== null &&
+                        (await this.recoveryCodes.consume(principalId, code)));
+        }
+        catch (err) {
+            await this.mfaLimiter?.refund(mfaKey);
+            throw err;
+        }
+        if (!proven)
+            badRequest(); // the consumed attempt stays counted
+        await this.mfaLimiter?.reset(mfaKey);
     }
     /**
      * `GET /account/mfa/devices` — list the caller's CONFIRMED authenticator devices.
@@ -490,7 +609,7 @@ let AccountController = class AccountController {
      * and additionally wipes the account's recovery codes.
      *
      * Outcomes: 401; store absent → 501; wrong code → 400 (no remove); not found/owned →
-     * 404; success → 204.
+     * 404; MFA budget exhausted → 429; limiter/replay guard unreachable → 503; success → 204.
      */
     async removeDevice(authorization, id, body) {
         const claims = await this.requireClaims(authorization);
@@ -504,14 +623,9 @@ let AccountController = class AccountController {
         const store = this.mfaDevices;
         const code = typeof body?.code === 'string' ? body.code : '';
         // Proof BEFORE the delete: a TOTP from any confirmed device (incl. the one being
-        // removed — legit for the last-device disable) OR a valid recovery code.
-        const byTotp = await this.verifyAgainstAnyDevice(store, claims.id, code);
-        const byRecovery = !byTotp &&
-            this.recoveryCodes !== undefined &&
-            this.recoveryCodes !== null &&
-            (await this.recoveryCodes.consume(claims.id, code));
-        if (!byTotp && !byRecovery)
-            badRequest();
+        // removed — legit for the last-device disable) OR a valid recovery code. Rate-limited
+        // and replay-guarded like `/auth/mfa` (Phase 8 #1).
+        await this.requireMfaProof(store, claims.id, code);
         const removed = await store.remove(claims.id, id);
         if (!removed) {
             throw new common_1.HttpException({ error: 'not_found' }, common_1.HttpStatus.NOT_FOUND);
@@ -529,6 +643,7 @@ let AccountController = class AccountController {
      * — a TOTP from any confirmed device OR an existing recovery code.
      *
      * Outcomes: 401; store/recovery/hasher absent → 501; MFA off → 400; wrong code → 400;
+     * MFA budget exhausted → 429; limiter/replay guard unreachable → 503;
      * success → 200 `{ recoveryCodes }`.
      */
     async regenerateRecoveryCodes(authorization, body) {
@@ -551,11 +666,9 @@ let AccountController = class AccountController {
         // MFA must be on — else there's nothing to protect / no code source → generic 400.
         if ((await store.countConfirmed(claims.id)) === 0)
             badRequest();
-        // Proof: a TOTP from any confirmed device OR an existing recovery code.
-        const byTotp = await this.verifyAgainstAnyDevice(store, claims.id, code);
-        const byRecovery = !byTotp && (await recoveryStore.consume(claims.id, code));
-        if (!byTotp && !byRecovery)
-            badRequest();
+        // Proof: a TOTP from any confirmed device OR an existing recovery code (rate-limited
+        // and replay-guarded like `/auth/mfa`, Phase 8 #1).
+        await this.requireMfaProof(store, claims.id, code);
         const recoveryCodes = await this.replaceRecoveryCodes(claims.id, recoveryStore, hasher);
         return { recoveryCodes };
     }
@@ -664,7 +777,13 @@ exports.AccountController = AccountController = __decorate([
     __param(8, (0, common_1.Inject)(tokens_js_2.SHIELD_MFA_DEVICE_STORE)),
     __param(9, (0, common_1.Optional)()),
     __param(9, (0, common_1.Inject)(tokens_js_2.SHIELD_SESSION_RESTRICTIONS)),
-    __metadata("design:paramtypes", [Function, Object, Object, Object, Object, Object, Object, Object, Object, Object])
+    __param(10, (0, common_1.Optional)()),
+    __param(10, (0, common_1.Inject)(tokens_js_2.SHIELD_LOGIN_TOTP_VERIFIER)),
+    __param(11, (0, common_1.Optional)()),
+    __param(11, (0, common_1.Inject)(tokens_js_2.SHIELD_MFA_LIMITER)),
+    __param(12, (0, common_1.Optional)()),
+    __param(12, (0, common_1.Inject)(tokens_js_2.SHIELD_LOGIN_LIMITER)),
+    __metadata("design:paramtypes", [Function, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object])
 ], AccountController);
 /**
  * A deliberately-minimal email shape check (non-empty, a single `@`, a `.` in the

package/dist/auth/auth.controller.d.ts

@@ -379,11 +379,12 @@ export declare class AuthController {
      * {@link MfaStepUp} (same `OrTotpVerifier` + replay guard as the authenticator, principal
      * minted by the identity broker).
      *
-     *  - `mfa:pid:<principalId>` is checked BEFORE verifying: locked → generic 401 and the
-     *    step-up is never consulted.
-     *  - a rejected code records a failure; the edge where the count first reaches the
-     *    threshold audits `auth.mfa.locked` ONCE (no notify — pre-auth, see recovery lockout).
-     *  - a transient outage → 503, never counted.
+     *  - the attempt is counted against `mfa:pid:<principalId>` BEFORE verifying (Phase 9
+     *    #10, atomic increment-first): over budget → generic 401 and the step-up is never
+     *    consulted; limiter unreachable → 503 (fail closed).
+     *  - a rejected code stays counted; the attempt whose count equals the threshold audits
+     *    `auth.mfa.locked` ONCE (no notify — pre-auth, see recovery lockout).
+     *  - a transient outage → 503, the attempt is given back (never counted).
      *  - success → establish + bind, then reset the TOTP counter AND the login counter (the
      *    login counter is reset only here, once authentication fully succeeded).
      */

package/dist/auth/auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAeH,OAAO,KAAK,EACV,aAAa,EAIb,cAAc,EAGd,gBAAgB,EAEjB,MAAM,cAAc,CAAC;AA+BtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAOjE,OAAO,EAA2C,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAOtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,cAAc,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,KAAK,EAEV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EAEf,MAAM,UAAU,CAAC;AA6FlB;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAO7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAIlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAU/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAM9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAQjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAS3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAWvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAStC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAYnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAKjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAK3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAGvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAM3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAMzB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAxLpB,aAAa,EAAE,aAAa,EAE5B,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,eAAe,EAO3B,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAOhC,eAAe,CAAC,EAAE,eAAe,YAAA,EAOjC,kBAAkB,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAI9C,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAIxC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,gBAAgB,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAI1C,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAItC,cAAc,CAAC,EAAE,cAAc,YAAA,EAK/B,gBAAgB,CAAC,EAAE,MAAM,YAAA,EAOzB,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAUxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMpC,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMtC,eAAe,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5C,eAAe,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAQvC,aAAa,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKrC,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAS5B,qBAAqB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAWpD,oBAAoB,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA,EASlD,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAY5C,eAAe,CAAC,GAAE,6BAA6B,GAAG,IAAI,aAAA,EAKtD,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAK5B,KAAK,CAAC,GAAE,KAAK,GAAG,IAAI,aAAA,EAGpB,SAAS,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAMxC,OAAO,CAAC,GAAE,SAAS,MAAM,EAAE,GAAG,IAAI,aAAA,EAMlC,cAAc,CAAC,GAAE,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,GAAG,IAAI,aAAA,EAMnE,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA;IAGvE;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;OAKG;YACW,WAAW;IAiEzB;;;;;;;;;;OAUG;YACW,eAAe;IAgB7B;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAIjC;;;;;;;;OAQG;IACH;;;;;;;;OAQG;YACW,iBAAiB;YAcjB,sBAAsB;IAcpC;;;;;;;;;;OAUG;YACW,gBAAgB;IAY9B;;;;;;;;OAQG;YACW,uBAAuB;IAarC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;;;;;;;OAUG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK;YAIC,aAAa;IAM3B;;;;OAIG;IAIG,KAAK,CACD,IAAI,EAAE,YAAY,EAIpB,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC;IA0HzB;;;;;;;;;;;;;;;;;;OAkBG;IAIG,EAAE,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmCvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAIG,WAAW,CACP,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EACb,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAqFjF;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,cAAc,CACV,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAKjC,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAgEhB;;;;;;;;;;OAUG;YACW,oBAAoB;IAqClC;;;;;;;;;OASG;YACW,gBAAgB;IAwC9B;;;;;;;;;;;;OAYG;IAIG,aAAa,CACT,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAEhD,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAsFhB;;;;;;;;;;;;;;;;OAgBG;IAIG,GAAG,CAAS,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0B5D;;;;;;;;;;;;;OAaG;YACW,eAAe;IA2C7B;;;;;;;;;;;;;;;OAeG;YACW,uBAAuB;IA0GrC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAoC1B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;OAUG;IAIG,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAkEpE;;;;OAIG;YACW,cAAc;IAe5B;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,cAAc;IAgE5B;;;;OAIG;IAIG,MAAM,CAAS,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAexD;;;;;OAKG;YACW,iBAAiB;CAOhC"}
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAeH,OAAO,KAAK,EACV,aAAa,EAIb,cAAc,EAGd,gBAAgB,EAEjB,MAAM,cAAc,CAAC;AA+BtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAOjE,OAAO,EAA2C,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,iCAAiC,CAAC;AAOtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAsB,MAAM,cAAc,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,KAAK,EAEV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EAEf,MAAM,UAAU,CAAC;AA8GlB;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAO7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAIlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAY/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAM9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAQjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAS3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAWvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAStC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAYnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAMjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAK5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAK3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAGvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAM3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAMzB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAMhC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBA3LpB,aAAa,EAAE,aAAa,EAE5B,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,eAAe,EAO3B,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAOhC,eAAe,CAAC,EAAE,eAAe,YAAA,EAOjC,kBAAkB,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAI9C,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAIxC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,gBAAgB,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAI1C,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAItC,cAAc,CAAC,EAAE,cAAc,YAAA,EAK/B,gBAAgB,CAAC,EAAE,MAAM,YAAA,EAOzB,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAYxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMpC,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAMtC,eAAe,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5C,eAAe,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAQvC,aAAa,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKrC,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAS5B,qBAAqB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAWpD,oBAAoB,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA,EASlD,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAY5C,eAAe,CAAC,GAAE,6BAA6B,GAAG,IAAI,aAAA,EAMtD,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKlC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAK5B,KAAK,CAAC,GAAE,KAAK,GAAG,IAAI,aAAA,EAGpB,SAAS,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAMxC,OAAO,CAAC,GAAE,SAAS,MAAM,EAAE,GAAG,IAAI,aAAA,EAMlC,cAAc,CAAC,GAAE,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,GAAG,IAAI,aAAA,EAMnE,mBAAmB,CAAC,GAAE,uBAAuB,GAAG,IAAI,aAAA;IAGvE;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;OAKG;YACW,WAAW;IAiEzB;;;;;;;;;;OAUG;YACW,eAAe;IAgB7B;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAIjC;;;;;;;;OAQG;IACH;;;;;;;;OAQG;YACW,iBAAiB;YAcjB,sBAAsB;IAcpC;;;;;;;;;;OAUG;YACW,gBAAgB;IAY9B;;;;;;;;OAQG;YACW,uBAAuB;IAarC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;;;;;;;OAUG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK;YAIC,aAAa;IAM3B;;;;OAIG;IAIG,KAAK,CACD,IAAI,EAAE,YAAY,EAIpB,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC;IA0JzB;;;;;;;;;;;;;;;;;;OAkBG;IAIG,EAAE,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmCvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAIG,WAAW,CACP,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EACb,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAqFjF;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,cAAc,CACV,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAKjC,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAgEhB;;;;;;;;;;OAUG;YACW,oBAAoB;IAqClC;;;;;;;;;OASG;YACW,gBAAgB;IAwC9B;;;;;;;;;;;;OAYG;IAIG,aAAa,CACT,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAEhD,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAsFhB;;;;;;;;;;;;;;;;OAgBG;IAIG,GAAG,CAAS,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0B5D;;;;;;;;;;;;;;OAcG;YACW,eAAe;IA8C7B;;;;;;;;;;;;;;;OAeG;YACW,uBAAuB;IAuGrC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAoC1B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;OAUG;IAIG,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAkEpE;;;;OAIG;YACW,cAAc;IAe5B;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,cAAc;IAgE5B;;;;OAIG;IAIG,MAAM,CAAS,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAexD;;;;;OAKG;YACW,iBAAiB;CAOhC"}