@astram/identity 0.4.0 → 0.5.0

package/dist/features/service-account/service-account.service.js

@@ -193,7 +193,10 @@ class ServiceAccountService {
      * described generically: the role/company catalog reads are not caller-scoped, so resolving a
      * name for an arbitrary id would turn the 403 into a cross-tenant name/existence oracle.
      */
-    async assertWithinCeiling(ceiling, scopeSubtreeNodeIds, roleIds, onAgent = { nodes: [], roles: [] }) {
+    async assertWithinCeiling(ceiling, scopeSubtreeNodeIds, roleIds, onAgent = {
+        nodes: [],
+        roles: [],
+    }) {
         if (ceiling.isRoot)
             return;
         const badNodes = uniqueIds(scopeSubtreeNodeIds).filter((n) => !ceilingAllowsNode(ceiling, n));
@@ -213,13 +216,17 @@ class ServiceAccountService {
     async describeOffenders(bad, onAgent, lookup, noun, plural) {
         const known = new Set(onAgent);
         const nameable = bad.filter((id) => known.has(id));
-        const found = nameable.length > 0 ? new Map((await lookup(nameable)).map((x) => [x.id, x.name])) : new Map();
+        const found = nameable.length > 0
+            ? new Map((await lookup(nameable)).map((x) => [x.id, x.name]))
+            : new Map();
         const names = uniqueIds(nameable.map((id) => found.get(id) ?? '').filter((n) => n.length > 0));
         const rest = bad.length - names.length;
         if (names.length === 0)
             return rest === 1 ? `a ${noun}` : `${rest} ${plural}`;
         const named = `the ${names.length === 1 ? noun : plural} ${quoteNames(names)}`;
-        return rest === 0 ? named : `${named} and ${rest === 1 ? `1 other ${noun}` : `${rest} other ${plural}`}`;
+        return rest === 0
+            ? named
+            : `${named} and ${rest === 1 ? `1 other ${noun}` : `${rest} other ${plural}`}`;
     }
     /**
      * Resolve names for audit (ids already authorised for this caller: within ceiling, or on the
@@ -261,7 +268,9 @@ class ServiceAccountService {
             ]);
         return {
             // Defensive re-filter through the same predicates (a store that over-returns can't widen it).
-            roles: roles.filter((r) => ceilingAllowsRole(ceiling, r.id)).map((r) => ({ id: r.id, name: r.name })),
+            roles: roles
+                .filter((r) => ceilingAllowsRole(ceiling, r.id))
+                .map((r) => ({ id: r.id, name: r.name })),
             scopeNodes: treeOrder(nodes.filter((n) => ceilingAllowsNode(ceiling, n.id))),
         };
     }
@@ -374,8 +383,12 @@ class ServiceAccountService {
         const updatedAtMs = Math.max(this.now(), (existing.updatedAtMs ?? 0) + 1);
         const normalized = {
             ...(patch.label !== undefined ? { label: patch.label.trim() } : {}),
-            ...(requestedScope !== undefined ? { scopeSubtreeNodeIds: mergeIds(requestedScope, preservedScope) } : {}),
-            ...(requestedRoles !== undefined ? { roleIds: mergeIds(requestedRoles, preservedRoles) } : {}),
+            ...(requestedScope !== undefined
+                ? { scopeSubtreeNodeIds: mergeIds(requestedScope, preservedScope) }
+                : {}),
+            ...(requestedRoles !== undefined
+                ? { roleIds: mergeIds(requestedRoles, preservedRoles) }
+                : {}),
             ...(patch.status !== undefined ? { status: patch.status } : {}),
         };
         // The preserve-merge is a read-modify-write: guard it so a concurrent edit (e.g. root revoking an
@@ -393,7 +406,10 @@ class ServiceAccountService {
         // WHAT changed, by name: diff the stored sets (added ⊆ ceiling or root; removed were on the agent).
         const diff = (before, after) => after === undefined
             ? { added: [], removed: [] }
-            : { added: after.filter((x) => !before.includes(x)), removed: before.filter((x) => !after.includes(x)) };
+            : {
+                added: after.filter((x) => !before.includes(x)),
+                removed: before.filter((x) => !after.includes(x)),
+            };
         const roleDiff = diff(existing.roleIds, normalized.roleIds);
         const scopeDiff = diff(existing.scopeSubtreeNodeIds, normalized.scopeSubtreeNodeIds);
         const names = await this.auditNames([...roleDiff.added, ...roleDiff.removed], [...scopeDiff.added, ...scopeDiff.removed]);
@@ -414,13 +430,35 @@ class ServiceAccountService {
      * Issue a NEW key for an account (own-tenant). Mints `ask_<id>_<secret>`, hashes the secret, and
      * persists the hash as the next version — carrying the ACCOUNT's current scope/roles onto the key
      * (so the key's Principal reflects the account as it stands). Returns the raw key ONCE.
-     * `expiresAtMs` is optional (a non-expiring key is discouraged; the caller opts in to no expiry).
+     * ADR-0033 §4 (security hardening): the caller must give a FUTURE `expiresAtMs`, or opt in to a
+     * non-expiring key explicitly with `neverExpires: true` — otherwise 400, nothing minted.
      */
     async issueKey(admin, id, opts = {}) {
+        const expiresAtMs = this.resolveExpiry(opts);
         const account = await this.accounts.getById(id, scopeOf(admin));
         if (account === null)
             throw new ServiceAccountNotFoundError();
-        return this.mintFor(account, admin, 'service_account.key_issued', opts.expiresAtMs);
+        return this.mintFor(account, admin, 'service_account.key_issued', expiresAtMs);
+    }
+    /**
+     * The key's expiry from the request: a future epoch-ms, or `undefined` when the caller said
+     * `neverExpires: true`. Neither, both, or a past/invalid time → ServiceAccountInputError (400).
+     */
+    resolveExpiry(opts) {
+        const hasExpiry = opts.expiresAtMs !== undefined;
+        if (hasExpiry && opts.neverExpires === true) {
+            throw new ServiceAccountInputError('Give either an expiry or neverExpires: true, not both.');
+        }
+        if (opts.neverExpires === true)
+            return undefined;
+        if (!hasExpiry) {
+            throw new ServiceAccountInputError('Choose when the key expires (expiresAtMs), or set neverExpires: true for a key that never expires.');
+        }
+        const ms = opts.expiresAtMs;
+        if (typeof ms !== 'number' || !Number.isFinite(ms) || ms <= this.now()) {
+            throw new ServiceAccountInputError('expiresAtMs must be a time in the future (epoch-ms).');
+        }
+        return ms;
     }
     /**
      * Rotate an account's key: mint a new version (the old version stops being the current one —
@@ -428,10 +466,11 @@ class ServiceAccountService {
      * new raw key ONCE.
      */
     async rotateKey(admin, id, opts = {}) {
+        const expiresAtMs = this.resolveExpiry(opts);
         const account = await this.accounts.getById(id, scopeOf(admin));
         if (account === null)
             throw new ServiceAccountNotFoundError();
-        return this.mintFor(account, admin, 'service_account.key_rotated', opts.expiresAtMs);
+        return this.mintFor(account, admin, 'service_account.key_rotated', expiresAtMs);
     }
     /** Revoke ALL of an account's keys (own-tenant) — fail-closed on the next request. Idempotent. */
     async revokeKeys(admin, id) {
@@ -473,7 +512,13 @@ class ServiceAccountService {
     /** Best-effort audit — a sink throw must never fail a legitimate operation. */
     async safeAudit(action, admin, occurredAtMs, attributes) {
         try {
-            await this.audit.record({ action, actorId: admin.id, tenantId: admin.tenantId, occurredAtMs, attributes });
+            await this.audit.record({
+                action,
+                actorId: admin.id,
+                tenantId: admin.tenantId,
+                occurredAtMs,
+                attributes,
+            });
         }
         catch {
             // swallow — auditing is best-effort here (the durable sink already logs its own failures).

package/dist/features/share/share.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share.controller.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.controller.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAErE,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAqBD,qBACa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD;;;;OAIG;IAGG,IAAI,CACD,GAAG,EAAE,aAAa,EACP,OAAO,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM;;;IAYtC;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAW5D;;;OAGG;IAGG,OAAO,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;CAU/D"}
+{"version":3,"file":"share.controller.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.controller.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAErE,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAwBD,qBAEa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD;;;;OAIG;IAGG,IAAI,CACD,GAAG,EAAE,aAAa,EACP,OAAO,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM;;;IAYtC;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAW5D;;;OAGG;IAGG,OAAO,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;CAU/D"}

package/dist/features/share/share.controller.js

@@ -28,6 +28,7 @@ exports.ShareController = void 0;
  */
 const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 const share_service_js_1 = require("./share.service.js");
 /** Validate + narrow a share/unshare body to a {@link ShareRequest} (grantee + action only). */
 function toShareRequest(body) {
@@ -139,5 +140,6 @@ __decorate([
 ], ShareController.prototype, "unshare", null);
 exports.ShareController = ShareController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [share_service_js_1.ShareService])
 ], ShareController);

package/dist/features/share/share.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share.service.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,eAAe,CAAC;AAEvB,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrF;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH,CAAC;CACH;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,iBAAiB,GAAG,eAAe,EAC3C,MAAM,EAAE,kBAAkB;IAG7C;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/D,qFAAqF;IAC/E,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjE;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;CAoBjC"}
+{"version":3,"file":"share.service.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEzE,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrF;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH,CAAC;CACH;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,iBAAiB,GAAG,eAAe,EAC3C,MAAM,EAAE,kBAAkB;IAG7C;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/D,qFAAqF;IAC/E,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjE;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;CAoBjC"}

package/dist/features/shared/identity-error.interceptor.d.ts

@@ -0,0 +1,24 @@
+/**
+ * IdentityErrorInterceptor — maps engine, ceiling and identity domain errors to HTTP for every
+ * identity route, in ONE place (security hardening Phase 1, ADR-0034 follow-up).
+ *
+ * Before this, an engine `AuthorizationDeniedError` (for example the ADR-0034 create wall's
+ * `create_outside_write_scope`) escaped a controller as an unmapped error → HTTP 500. Each mapping
+ * below uses a fixed, id-free message (ADR-0012): the engine's own message carries reason codes and
+ * detail that are for logs, not clients.
+ *
+ * Applied with `@UseInterceptors(IdentityErrorInterceptor)` on each identity controller. An
+ * `HttpException` (a controller's own 400/403/404) passes through untouched; anything unmapped is
+ * rethrown as-is (Nest's default handling).
+ */
+import { type CallHandler, type ExecutionContext, type NestInterceptor } from '@nestjs/common';
+import { type Observable } from 'rxjs';
+/**
+ * Map one error to the HTTP exception identity answers with, or return it unchanged when it is
+ * not an identity-mapped type. Exported for unit tests and for callers that map by hand.
+ */
+export declare function toIdentityHttpError(err: unknown): unknown;
+export declare class IdentityErrorInterceptor implements NestInterceptor {
+    intercept(_context: ExecutionContext, next: CallHandler): Observable<unknown>;
+}
+//# sourceMappingURL=identity-error.interceptor.d.ts.map

package/dist/features/shared/identity-error.interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-error.interceptor.d.ts","sourceRoot":"","sources":["../../../src/features/shared/identity-error.interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAqB/D;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAwBzD;AAED,qBACa,wBAAyB,YAAW,eAAe;IAC9D,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;CAK9E"}

package/dist/features/shared/identity-error.interceptor.js

@@ -0,0 +1,82 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityErrorInterceptor = void 0;
+exports.toIdentityHttpError = toIdentityHttpError;
+/**
+ * IdentityErrorInterceptor — maps engine, ceiling and identity domain errors to HTTP for every
+ * identity route, in ONE place (security hardening Phase 1, ADR-0034 follow-up).
+ *
+ * Before this, an engine `AuthorizationDeniedError` (for example the ADR-0034 create wall's
+ * `create_outside_write_scope`) escaped a controller as an unmapped error → HTTP 500. Each mapping
+ * below uses a fixed, id-free message (ADR-0012): the engine's own message carries reason codes and
+ * detail that are for logs, not clients.
+ *
+ * Applied with `@UseInterceptors(IdentityErrorInterceptor)` on each identity controller. An
+ * `HttpException` (a controller's own 400/403/404) passes through untouched; anything unmapped is
+ * rethrown as-is (Nest's default handling).
+ */
+const common_1 = require("@nestjs/common");
+const rxjs_1 = require("rxjs");
+const engine_1 = require("@astram/engine");
+const core_1 = require("@astram/core");
+const guard_1 = require("@astram/guard");
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const scope_closure_service_js_1 = require("../scope/scope-closure.service.js");
+const identity_errors_js_1 = require("./identity-errors.js");
+/** The fixed client message for an engine deny, by reason code (never the engine's own text). */
+function deniedMessage(reason) {
+    if (reason === 'create_outside_write_scope') {
+        return 'You cannot create this record: it is outside the organisations you manage.';
+    }
+    return 'You do not have access to perform this action.';
+}
+/**
+ * Map one error to the HTTP exception identity answers with, or return it unchanged when it is
+ * not an identity-mapped type. Exported for unit tests and for callers that map by hand.
+ */
+function toIdentityHttpError(err) {
+    if (err instanceof common_1.HttpException)
+        return err;
+    if (err instanceof engine_1.AuthorizationDeniedError)
+        return new common_1.ForbiddenException(deniedMessage(err.reason));
+    if (err instanceof grant_ceiling_js_1.GrantCeilingError)
+        return new common_1.ForbiddenException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityForbiddenError)
+        return new common_1.ForbiddenException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityNotFoundError)
+        return new common_1.NotFoundException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityConflictError)
+        return new common_1.ConflictException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityBadRequestError)
+        return new common_1.BadRequestException(err.message);
+    if (err instanceof guard_1.ScopeCycleError) {
+        return new common_1.ConflictException('That move would put an organisation inside its own sub-tree.');
+    }
+    if (err instanceof scope_closure_service_js_1.NodeHasChildrenError) {
+        return new common_1.ConflictException('This organisation still has sub-organisations. Move or delete them first.');
+    }
+    if (err instanceof engine_1.ValidationError) {
+        return new common_1.BadRequestException(`Invalid value for '${err.field}'.`);
+    }
+    if (err instanceof core_1.AuthorizationUnavailableError || err instanceof engine_1.EngineUnavailableError) {
+        return new common_1.ServiceUnavailableException('Authorization is temporarily unavailable. Try again.');
+    }
+    return err;
+}
+let IdentityErrorInterceptor = class IdentityErrorInterceptor {
+    intercept(_context, next) {
+        return next
+            .handle()
+            .pipe((0, rxjs_1.catchError)((err) => (0, rxjs_1.throwError)(() => toIdentityHttpError(err))));
+    }
+};
+exports.IdentityErrorInterceptor = IdentityErrorInterceptor;
+exports.IdentityErrorInterceptor = IdentityErrorInterceptor = __decorate([
+    (0, common_1.Injectable)()
+], IdentityErrorInterceptor);

package/dist/features/shared/identity-errors.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Identity domain errors (security hardening Phase 1). Thrown by identity services, mapped to HTTP
+ * by {@link IdentityErrorInterceptor} in ONE place so every identity route answers the same way.
+ *
+ * Messages are user-facing: they name no raw ids (ADR-0012) and carry no store detail.
+ */
+/** The caller may not perform this action on this target (→ 403). */
+export declare class IdentityForbiddenError extends Error {
+    constructor(message: string);
+}
+/** The target does not exist or is outside the caller's reach (→ 404, no existence leak). */
+export declare class IdentityNotFoundError extends Error {
+    constructor(message: string);
+}
+/** The request conflicts with the current state (cycle, children present, … → 409). */
+export declare class IdentityConflictError extends Error {
+    constructor(message: string);
+}
+/** The request is malformed (→ 400). */
+export declare class IdentityBadRequestError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=identity-errors.d.ts.map

package/dist/features/shared/identity-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-errors.d.ts","sourceRoot":"","sources":["../../../src/features/shared/identity-errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,6FAA6F;AAC7F,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,uFAAuF;AACvF,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,wCAAwC;AACxC,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/features/shared/identity-errors.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * Identity domain errors (security hardening Phase 1). Thrown by identity services, mapped to HTTP
+ * by {@link IdentityErrorInterceptor} in ONE place so every identity route answers the same way.
+ *
+ * Messages are user-facing: they name no raw ids (ADR-0012) and carry no store detail.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityBadRequestError = exports.IdentityConflictError = exports.IdentityNotFoundError = exports.IdentityForbiddenError = void 0;
+/** The caller may not perform this action on this target (→ 403). */
+class IdentityForbiddenError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityForbiddenError';
+    }
+}
+exports.IdentityForbiddenError = IdentityForbiddenError;
+/** The target does not exist or is outside the caller's reach (→ 404, no existence leak). */
+class IdentityNotFoundError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityNotFoundError';
+    }
+}
+exports.IdentityNotFoundError = IdentityNotFoundError;
+/** The request conflicts with the current state (cycle, children present, … → 409). */
+class IdentityConflictError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityConflictError';
+    }
+}
+exports.IdentityConflictError = IdentityConflictError;
+/** The request is malformed (→ 400). */
+class IdentityBadRequestError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityBadRequestError';
+    }
+}
+exports.IdentityBadRequestError = IdentityBadRequestError;

package/dist/features/user/session-revocation-check.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Boot check (security hardening Phase 3 review P2). Disabling a user revokes its sessions through
+ * guard's `SHIELD_SESSION_SWEEPER` (provided by the auth surface). When the auth surface is on —
+ * guard's session token binder is visible — but no sweeper is, a disable still drops the user's
+ * roles (version bump + `[]` roles) but cannot end its sessions: say so at boot instead of failing
+ * silently. Auth off → no sessions exist → nothing to warn about.
+ *
+ * @returns `true` when the warning was emitted.
+ */
+export declare function warnIfSessionsUnrevocable(binder: unknown, sweeper: unknown, warn: (message: string) => void): boolean;
+//# sourceMappingURL=session-revocation-check.d.ts.map

package/dist/features/user/session-revocation-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-revocation-check.d.ts","sourceRoot":"","sources":["../../../src/features/user/session-revocation-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,OAAO,CAQT"}

package/dist/features/user/session-revocation-check.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.warnIfSessionsUnrevocable = warnIfSessionsUnrevocable;
+/**
+ * Boot check (security hardening Phase 3 review P2). Disabling a user revokes its sessions through
+ * guard's `SHIELD_SESSION_SWEEPER` (provided by the auth surface). When the auth surface is on —
+ * guard's session token binder is visible — but no sweeper is, a disable still drops the user's
+ * roles (version bump + `[]` roles) but cannot end its sessions: say so at boot instead of failing
+ * silently. Auth off → no sessions exist → nothing to warn about.
+ *
+ * @returns `true` when the warning was emitted.
+ */
+function warnIfSessionsUnrevocable(binder, sweeper, warn) {
+    if (binder === undefined || binder === null)
+        return false;
+    if (sweeper !== undefined && sweeper !== null)
+        return false;
+    warn('SHIELD_SESSION_SWEEPER is not available: disabling a user will not revoke its sessions ' +
+        '(its roles still drop on the next request). Provide a sessionSweeper to ShieldModule.forRoot.');
+    return true;
+}

package/dist/features/user/user.controller.d.ts

@@ -1,5 +1,6 @@
 import { UserService } from './user.service.js';
 import { type ListQueryDto } from '../shared/list-query.js';
+import type { AuthedRequest } from '../shared/http.js';
 export declare class UserController {
     private readonly users;
     constructor(users: UserService);
@@ -14,25 +15,29 @@ export declare class UserController {
         page: number;
         limit: number;
     }>;
-    /** Create a user — gated on `identity:user:create`. */
-    createUser(body: {
+    /**
+     * Create a user — gated on `identity:user:create`. Optional `companyUuid` creates the user's
+     * first (active) membership in the same transaction; it must be a company the caller manages.
+     */
+    createUser(req: AuthedRequest, body: {
         username?: string;
+        companyUuid?: string;
     }): Promise<{
         id: import("packages/engine/dist/types.js").RecordId;
     }>;
     /** Read one user — gated on `identity:user:read` (CONTROL-plane; root, the identity
      *  administrator, may read users). */
     getUser(uuid: string): Promise<import("packages/engine/dist/types.js").RecordView | null>;
-    /** Update a user — gated on `identity:user:update`. */
-    updateUser(uuid: string, body: {
+    /** Update a user — gated on `identity:user:update`. Only `username`, `email`, `status` apply. */
+    updateUser(req: AuthedRequest, uuid: string, body: {
         username?: string;
         email?: string;
         status?: string;
     }): Promise<{
         success: boolean;
     }>;
-    /** Delete a user — gated on `identity:user:delete`. */
-    deleteUser(uuid: string): Promise<{
+    /** Delete a user — gated on `identity:user:delete`; the caller must dominate the user. */
+    deleteUser(req: AuthedRequest, uuid: string): Promise<{
         success: boolean;
     }>;
 }

package/dist/features/user/user.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAK5E,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C,uDAAuD;IAGjD,UAAU,CAAS,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKpD;0CACsC;IAGtC,OAAO,CAAgB,IAAI,EAAE,MAAM;IAInC,uDAAuD;IAGjD,UAAU,CACC,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMtE,uDAAuD;IAGjD,UAAU,CAAgB,IAAI,EAAE,MAAM;;;CAI7C"}
+{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACjB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAW3D;0CACsC;IAGtC,OAAO,CAAgB,IAAI,EAAE,MAAM;IAInC,iGAAiG;IAG3F,UAAU,CACP,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUtE,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAIxE"}

package/dist/features/user/user.controller.js

@@ -17,9 +17,11 @@ const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const user_service_js_1 = require("./user.service.js");
 const list_query_js_1 = require("../shared/list-query.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 // User management is gated on `identity:user:<action>` grants. `user` is CONTROL-plane
 // for ALL actions — including read: the capped root is the identity administrator (the
-// identity-administrator model), so it may list/read users AND manage them.
+// identity-administrator model), so it may list/read users AND manage them. Changing a user's
+// email or status, or deleting them, also needs the caller to dominate that user (D2).
 let UserController = class UserController {
     users;
     constructor(users) {
@@ -35,9 +37,17 @@ let UserController = class UserController {
         const result = await this.users.listUsers(params);
         return { total: result.total, rows: result.rows, page, limit };
     }
-    /** Create a user — gated on `identity:user:create`. */
-    async createUser(body) {
-        const id = await this.users.createUser(body?.username ?? 'Untitled');
+    /**
+     * Create a user — gated on `identity:user:create`. Optional `companyUuid` creates the user's
+     * first (active) membership in the same transaction; it must be a company the caller manages.
+     */
+    async createUser(req, body) {
+        const id = await this.users.createUser(req.principal, {
+            username: body?.username ?? 'Untitled',
+            ...(typeof body?.companyUuid === 'string' && body.companyUuid.length > 0
+                ? { companyUuid: body.companyUuid }
+                : {}),
+        });
         return { id };
     }
     /** Read one user — gated on `identity:user:read` (CONTROL-plane; root, the identity
@@ -45,14 +55,18 @@ let UserController = class UserController {
     getUser(uuid) {
         return this.users.getUser(uuid);
     }
-    /** Update a user — gated on `identity:user:update`. */
-    async updateUser(uuid, body) {
-        await this.users.updateUser(uuid, body ?? {});
+    /** Update a user — gated on `identity:user:update`. Only `username`, `email`, `status` apply. */
+    async updateUser(req, uuid, body) {
+        await this.users.updateUser(req.principal, uuid, {
+            username: body?.username,
+            email: body?.email,
+            status: body?.status,
+        });
         return { success: true };
     }
-    /** Delete a user — gated on `identity:user:delete`. */
-    async deleteUser(uuid) {
-        await this.users.deleteUser(uuid);
+    /** Delete a user — gated on `identity:user:delete`; the caller must dominate the user. */
+    async deleteUser(req, uuid) {
+        await this.users.deleteUser(req.principal, uuid);
         return { success: true };
     }
 };
@@ -68,9 +82,10 @@ __decorate([
 __decorate([
     (0, common_1.Post)('users'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'create' }),
-    __param(0, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "createUser", null);
 __decorate([
@@ -84,21 +99,24 @@ __decorate([
 __decorate([
     (0, common_1.Put)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'update' }),
-    __param(0, (0, common_1.Param)('uuid')),
-    __param(1, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
+    __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "updateUser", null);
 __decorate([
     (0, common_1.Delete)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'delete' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "deleteUser", null);
 exports.UserController = UserController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [user_service_js_1.UserService])
 ], UserController);

package/dist/features/user/user.service.d.ts

@@ -1,26 +1,67 @@
 import { RecordsService, type RecordId } from '@astram/engine';
+import type { Principal } from '@astram/core';
+import { type EmailSender, type ResetTokenStore, type SessionSweeper } from '@astram/guard';
+import { type PostingVersionBump } from '../membership/posting-version-bump.js';
 import { type ListParams } from '../shared/list-query.js';
+import { GrantCeiling } from '../authz/grant-ceiling.js';
+/** The patch keys a generic user update accepts (security hardening #3). */
+export interface UserPatch {
+    username?: unknown;
+    email?: unknown;
+    status?: unknown;
+}
 /**
- * UserService — user (principal) CRUD on the paved road, via the framework's
- * RecordsService facade. The facade supplies the acting identity (the request
- * principal) — this service never threads a Principal. No raw SQL, no RECORD_ENGINE.
+ * UserService — user (principal) CRUD on the paved road, via the framework's RecordsService facade
+ * (the request principal acts). No raw SQL, no RECORD_ENGINE.
+ *
+ * Users are GLOBAL (one user can belong to many tenants) and the email is a credential attribute:
+ * forgot-password mails the reset link to it. So (security hardening #3, D2):
+ *   - the patch is whitelisted to `{username, email, status}`;
+ *   - changing `email` or `status`, and deleting a user, require the actor to DOMINATE the target
+ *     (`GrantCeiling.assertDominates`: every membership of the target inside the actor's subtree,
+ *     and every key the target could hold is held by the actor);
+ *   - an email change burns the target's outstanding password-reset tokens BEFORE the change and
+ *     notifies the OLD address after it (best-effort), when guard's reset-token store and email
+ *     sender are wired (`ShieldModule.forRoot({ auth: true })`).
  */
 export declare class UserService {
     private readonly records;
-    constructor(records: RecordsService);
-    /** Create a user. */
-    createUser(username: string): Promise<RecordId>;
+    private readonly ceiling;
+    private readonly resetTokens?;
+    private readonly emailSender?;
+    private readonly sessions?;
+    private readonly versionBump?;
+    private readonly logger;
+    constructor(records: RecordsService, ceiling: GrantCeiling, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, sessions?: (SessionSweeper | null) | undefined, versionBump?: (PostingVersionBump | null) | undefined);
+    /**
+     * Create a user. With `companyUuid`, the user is created AND attached (one active membership) in
+     * ONE transaction — the onboarding path for a non-root admin, whose membership create is checked
+     * by the engine's create wall (a company outside the caller's subtree ⇒ 403, nothing persists).
+     */
+    createUser(actor: Principal, input: {
+        username: string;
+        companyUuid?: string | undefined;
+    }): Promise<RecordId>;
     /** List users (tenant-scoped by the pipe), with paging/search/sort. */
     listUsers(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
     /** Read a single user. */
     getUser(uuid: string): Promise<import("@astram/engine").RecordView | null>;
-    /** Update a user. */
-    updateUser(uuid: string, patch: {
-        username?: string;
-        email?: string;
-        status?: string;
-    }): Promise<void>;
-    /** Delete a user. */
-    deleteUser(uuid: string): Promise<void>;
+    /** Update a user (whitelisted patch; email/status changes need dominance — see the class doc). */
+    updateUser(actor: Principal, uuid: string, patch: UserPatch): Promise<void>;
+    /**
+     * After a status change (security hardening Phase 3): bump every tenant the user is a member of
+     * (the next request reloads its grants: none while disabled, back when re-enabled), and, when the
+     * account is not `active`, durably revoke all its sessions (Redis unbound too).
+     *
+     * Both are ATTEMPTED INDEPENDENTLY (Phase 3 review P1): a failed bump never skips the revoke, or
+     * the reverse. If either failed, the first error is rethrown, so the admin sees it and can
+     * re-send the same status (which re-runs both). The status itself is already committed, so login
+     * and role reads refuse the account regardless.
+     */
+    private applyStatusChange;
+    /** Delete a user — only a user the actor dominates. */
+    deleteUser(actor: Principal, uuid: string): Promise<void>;
+    /** Tell the OLD address its account email changed (best-effort; never names the new one). */
+    private notifyEmailChanged;
 }
 //# sourceMappingURL=user.service.d.ts.map

package/dist/features/user/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAK1E;;;;GAIG;AACH,qBACa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD,qBAAqB;IACrB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI/C,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,qBAAqB;IACrB,UAAU,CACR,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5D,OAAO,CAAC,IAAI,CAAC;IAIhB,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGxC"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAMzD,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAnB/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC5D,OAAO,CAAC,QAAQ,CAAC;IAcpB,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BjF;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}