@bevel-software/platform-core-backend 0.19.0 → 0.21.0

package/dist/modules/audit/event-classifier.js

@@ -0,0 +1,123 @@
+/**
+ * The platform tools whose `path` argument may point INTO a skill folder — a
+ * read of `Plugins/Sales/rfi/SKILL.md` or of a file bundled beside it is the
+ * agent reading that skill, and is logged as such rather than as a file read.
+ */
+const SKILL_FOLDER_READ_TOOLS = new Set(['read_file', 'grep', 'list_files']);
+/** The platform tool that loads a skill by name. */
+const GET_SKILL = 'get_skill';
+/** `<manual>.<tool>` → its two halves; a bare name has no manual. */
+export function splitUtcpName(utcpName) {
+    const dot = utcpName.indexOf('.');
+    return dot < 0
+        ? { manual: '', tool: utcpName }
+        : { manual: utcpName.slice(0, dot), tool: utcpName.slice(dot + 1) };
+}
+/**
+ * The `path` a platform tool was called with, wherever the caller put it.
+ * Bevel-hosted http tools take their arguments inside a `body` envelope
+ * (`{ body: { path } }`); a caller that flattened it (`{ path }`) is read too.
+ */
+function pathArgument(args) {
+    const body = args.body;
+    const inner = body && typeof body === 'object' ? body.path : undefined;
+    const candidate = typeof inner === 'string' ? inner : args.path;
+    return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
+}
+/** The `name` a `get_skill` call asked for, from the envelope or flattened. */
+function skillNameArgument(args) {
+    const body = args.body;
+    const inner = body && typeof body === 'object' ? body.name : undefined;
+    const candidate = typeof inner === 'string' ? inner : args.name;
+    return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
+}
+/**
+ * When a platform read names a path, the path — the signal that the caller
+ * should fetch the skill catalog before classifying (a folder match turns
+ * the read into a skill event). Null for every other call, so the catalog is
+ * never fetched for a `notion.search` or a `write_file`.
+ */
+export function skillReadPath(utcpName, args, kbManualName) {
+    const { manual, tool } = splitUtcpName(utcpName);
+    if (manual !== kbManualName)
+        return null;
+    if (tool === GET_SKILL)
+        return skillNameArgument(args) === null ? null : '';
+    if (!SKILL_FOLDER_READ_TOOLS.has(tool))
+        return null;
+    return pathArgument(args);
+}
+/**
+ * The path as segments, resolved: forward slashes, `.` dropped, `..` taken
+ * back a segment, no empty segments — so two spellings of one place compare
+ * equal, and a path that climbs OUT of a folder is never matched to it. A
+ * path that climbs above its own start has no place at all and resolves to
+ * the empty string, which matches nothing. (The file tools refuse `..`
+ * outright; the log must still not credit a refused read to a skill.)
+ */
+function normalizePath(p) {
+    const out = [];
+    for (const segment of p.replace(/\\/g, '/').split('/')) {
+        if (segment === '' || segment === '.')
+            continue;
+        if (segment === '..') {
+            if (out.length === 0)
+                return '';
+            out.pop();
+            continue;
+        }
+        out.push(segment);
+    }
+    return out.join('/');
+}
+/**
+ * The skill whose folder contains `path`, if any. Matched on a segment
+ * boundary anywhere in the path — a caller may spell the path from the
+ * repository root (`Plugins/Sales/rfi/SKILL.md`) or from one level above it
+ * (`knowledge-base/Plugins/Sales/rfi/SKILL.md`), and both are that skill.
+ * The longest folder wins, so a skill nested under another's folder is not
+ * mistaken for its parent.
+ */
+export function skillContaining(path, skills) {
+    const normalized = normalizePath(path);
+    if (!normalized)
+        return null;
+    const haystack = `/${normalized}/`;
+    let best = null;
+    for (const skill of skills) {
+        const folder = normalizePath(skill.path);
+        if (!folder)
+            continue;
+        if (haystack.includes(`/${folder}/`) && (!best || folder.length > normalizePath(best.path).length)) {
+            best = skill;
+        }
+    }
+    return best;
+}
+/**
+ * Classify one call. `skills` is the catalog when {@link skillReadPath} asked
+ * for it and the caller could fetch it; null otherwise (the read is then
+ * logged as the capability it is, which is the honest fallback).
+ */
+export function classifyToolCall(utcpName, args, ctx, skills) {
+    const { manual, tool } = splitUtcpName(utcpName);
+    // A meta-tool (`call_tool_chain`, `list_tools`, …) has no manual: the platform's own.
+    if (manual === '' || manual === ctx.kbManualName) {
+        if (tool === GET_SKILL) {
+            const name = skillNameArgument(args);
+            if (name) {
+                const folder = skills?.find((s) => s.name === name)?.path ?? null;
+                return { kind: 'skill', manual: folder, name };
+            }
+        }
+        else if (SKILL_FOLDER_READ_TOOLS.has(tool) && skills) {
+            const path = pathArgument(args);
+            const skill = path ? skillContaining(path, skills) : null;
+            if (skill)
+                return { kind: 'skill', manual: skill.path, name: skill.name };
+        }
+        return { kind: 'capability', manual: null, name: tool };
+    }
+    return { kind: 'tool', manual: ctx.catalogNames.get(manual) ?? manual, name: tool };
+}
+//# sourceMappingURL=event-classifier.js.map

package/dist/modules/audit/event-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-classifier.js","sourceRoot":"","sources":["../../../src/modules/audit/event-classifier.ts"],"names":[],"mappings":"AA6BA;;;;GAIG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAElG,oDAAoD;AACpD,MAAM,SAAS,GAAG,WAAW,CAAC;AAE9B,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,GAAG,CAAC;QACZ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAA6B;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAChE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAChE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,IAA6B,EAAE,YAAoB;IACjG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;YAAE,SAAS;QAChD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAChC,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAA8B;IAC1E,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,UAAU,GAAG,CAAC;IACnC,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnG,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,IAA6B,EAC7B,GAAsB,EACtB,MAAqC;IAErC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjD,sFAAsF;IACtF,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;gBAClE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;aAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;YACvD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,IAAI,KAAK;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACtF,CAAC"}

package/dist/modules/audit/index.d.ts

@@ -0,0 +1,7 @@
+export * from './audit.contract.js';
+export { AgentAuditService, MAX_EVENT_PAGE, retentionDaysFrom } from './agent-audit.service.js';
+export { createAgentRestAuditMiddleware } from './agent-rest-audit.middleware.js';
+export { createAuditRoutes } from './audit.routes.js';
+export { RequestAudit } from './request-audit.js';
+export { classifyToolCall, skillContaining, skillReadPath, splitUtcpName, type ClassifiedCall, type ClassifierContext, type SkillFolder, } from './event-classifier.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC"}

package/dist/modules/audit/index.js

@@ -0,0 +1,7 @@
+export * from './audit.contract.js';
+export { AgentAuditService, MAX_EVENT_PAGE, retentionDaysFrom } from './agent-audit.service.js';
+export { createAgentRestAuditMiddleware } from './agent-rest-audit.middleware.js';
+export { createAuditRoutes } from './audit.routes.js';
+export { RequestAudit } from './request-audit.js';
+export { classifyToolCall, skillContaining, skillReadPath, splitUtcpName, } from './event-classifier.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,aAAa,GAId,MAAM,uBAAuB,CAAC"}

package/dist/modules/audit/request-audit.d.ts

@@ -0,0 +1,57 @@
+import type { CodeModeUtcpClient } from '@utcp/code-mode';
+import type { AgentEventOutcome, AuditPrincipalRef, IAgentEventRecorder } from './audit.contract.js';
+import { type ClassifiedCall, type SkillFolder } from './event-classifier.js';
+/**
+ * The Audit log's view of ONE MCP request: who is calling (the user and the
+ * key or agent connection the request arrived through), and how to name what
+ * they call. The MCP proxy creates one per request that has a principal and
+ * routes every call through it; a request with none (a browser JWT, an
+ * internal token minted before connections existed) gets no instance and
+ * records nothing.
+ *
+ * Holds nothing that outlives the request. The skill catalog it may need to
+ * tell a skill read from a file read is fetched at most once, and only when
+ * a platform read names a path.
+ */
+export declare class RequestAudit {
+    private readonly recorder;
+    private readonly userId;
+    private readonly principal;
+    private readonly ctx;
+    private skills;
+    constructor(recorder: IAgentEventRecorder, userId: string, principal: AuditPrincipalRef, ctx: {
+        kbManualName: string;
+        /** Read at classification time — the surface (and its catalog names) is built lazily. */
+        catalogNames: () => ReadonlyMap<string, string>;
+        /** The caller's skill catalog, for telling a skill read from a file read. */
+        loadSkills: () => Promise<readonly SkillFolder[]>;
+    });
+    /** Record one already-classified call. Never throws. */
+    emit(call: ClassifiedCall, outcome: AgentEventOutcome, durationMs: number | null): void;
+    /** What a UTCP call is logged as — fetching the skill catalog first when the call might be a skill read. */
+    classify(utcpName: string, args: Record<string, unknown>): Promise<ClassifiedCall>;
+    /**
+     * Run a UTCP call and record it: `error` when it throws or `isError` says
+     * the result is one, `ok` otherwise. The result (or the throw) reaches the
+     * caller unchanged — recording is a side effect, never a filter.
+     *
+     * The call starts FIRST and is classified alongside: naming a read may cost
+     * a loopback fetch of the skill catalog, and that is the log's business,
+     * not the tool's — a tool result never waits on its own bookkeeping.
+     */
+    call<T>(utcpName: string, args: Record<string, unknown>, run: () => Promise<T>, isError: (result: T) => boolean): Promise<T>;
+    /** A call refused before it ran, because the caller's sign-in for its manual is missing. */
+    denied(utcpName: string, args: Record<string, unknown>): Promise<void>;
+    /**
+     * Record every tool call made from INSIDE `call_tool_chain`: the chain
+     * bridges each in-isolate tool function to `client.callTool`, so wrapping
+     * that one entry point catches them all. Installed after the downstream
+     * routing wrapper so the timing covers the pool lease and any retry too.
+     * The direct MCP path (`callToolStreaming`) is deliberately NOT wrapped —
+     * the proxy's tool handler records those itself, with the result's
+     * `isError` in hand.
+     */
+    instrumentChainCalls(client: CodeModeUtcpClient): void;
+    private skillCatalog;
+}
+//# sourceMappingURL=request-audit.d.ts.map

package/dist/modules/audit/request-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-audit.d.ts","sourceRoot":"","sources":["../../../src/modules/audit/request-audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAGL,KAAK,cAAc,EAEnB,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAI/B;;;;;;;;;;;GAWG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,MAAM,CAAqD;gBAGhD,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,iBAAiB,EAC5B,GAAG,EAAE;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,yFAAyF;QACzF,YAAY,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,6EAA6E;QAC7E,UAAU,EAAE,MAAM,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;KACnD;IAGH,wDAAwD;IACxD,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAgBvF,4GAA4G;IACtG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;IAOxF;;;;;;;;OAQG;IACG,IAAI,CAAC,CAAC,EACV,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACrB,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,GAC9B,OAAO,CAAC,CAAC,CAAC;IAeb,4FAA4F;IACtF,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5E;;;;;;;;OAQG;IACH,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAMtD,OAAO,CAAC,YAAY;CAUrB"}

package/dist/modules/audit/request-audit.js

@@ -0,0 +1,117 @@
+import { logger } from '../../shared/logging.js';
+import { classifyToolCall, skillReadPath, } from './event-classifier.js';
+const log = logger('audit');
+/**
+ * The Audit log's view of ONE MCP request: who is calling (the user and the
+ * key or agent connection the request arrived through), and how to name what
+ * they call. The MCP proxy creates one per request that has a principal and
+ * routes every call through it; a request with none (a browser JWT, an
+ * internal token minted before connections existed) gets no instance and
+ * records nothing.
+ *
+ * Holds nothing that outlives the request. The skill catalog it may need to
+ * tell a skill read from a file read is fetched at most once, and only when
+ * a platform read names a path.
+ */
+export class RequestAudit {
+    recorder;
+    userId;
+    principal;
+    ctx;
+    skills;
+    constructor(recorder, userId, principal, ctx) {
+        this.recorder = recorder;
+        this.userId = userId;
+        this.principal = principal;
+        this.ctx = ctx;
+    }
+    /** Record one already-classified call. Never throws. */
+    emit(call, outcome, durationMs) {
+        try {
+            this.recorder.record({
+                userId: this.userId,
+                principal: this.principal,
+                kind: call.kind,
+                manual: call.manual,
+                name: call.name,
+                outcome,
+                durationMs,
+            });
+        }
+        catch (err) {
+            log.warn('recording an agent event failed:', { err });
+        }
+    }
+    /** What a UTCP call is logged as — fetching the skill catalog first when the call might be a skill read. */
+    async classify(utcpName, args) {
+        const ctx = { kbManualName: this.ctx.kbManualName, catalogNames: this.ctx.catalogNames() };
+        const wantsSkills = skillReadPath(utcpName, args, ctx.kbManualName) !== null;
+        const skills = wantsSkills ? await this.skillCatalog() : null;
+        return classifyToolCall(utcpName, args, ctx, skills);
+    }
+    /**
+     * Run a UTCP call and record it: `error` when it throws or `isError` says
+     * the result is one, `ok` otherwise. The result (or the throw) reaches the
+     * caller unchanged — recording is a side effect, never a filter.
+     *
+     * The call starts FIRST and is classified alongside: naming a read may cost
+     * a loopback fetch of the skill catalog, and that is the log's business,
+     * not the tool's — a tool result never waits on its own bookkeeping.
+     */
+    async call(utcpName, args, run, isError) {
+        const started = performance.now();
+        const classified = this.classify(utcpName, args);
+        try {
+            const result = await run();
+            const duration = elapsed(started);
+            this.emit(await classified, isError(result) ? 'error' : 'ok', duration);
+            return result;
+        }
+        catch (err) {
+            const duration = elapsed(started);
+            this.emit(await classified, 'error', duration);
+            throw err;
+        }
+    }
+    /** A call refused before it ran, because the caller's sign-in for its manual is missing. */
+    async denied(utcpName, args) {
+        this.emit(await this.classify(utcpName, args), 'denied', null);
+    }
+    /**
+     * Record every tool call made from INSIDE `call_tool_chain`: the chain
+     * bridges each in-isolate tool function to `client.callTool`, so wrapping
+     * that one entry point catches them all. Installed after the downstream
+     * routing wrapper so the timing covers the pool lease and any retry too.
+     * The direct MCP path (`callToolStreaming`) is deliberately NOT wrapped —
+     * the proxy's tool handler records those itself, with the result's
+     * `isError` in hand.
+     */
+    instrumentChainCalls(client) {
+        const callTool = client.callTool.bind(client);
+        client.callTool = (toolName, toolArgs) => this.call(toolName, toolArgs, () => callTool(toolName, toolArgs), isErrorShaped);
+    }
+    skillCatalog() {
+        // A failed fetch is remembered as "no catalog" for the rest of the
+        // request: the read is then logged as a capability, and one hiccup does
+        // not cost a loopback round-trip per subsequent call.
+        this.skills ??= this.ctx.loadSkills().catch((err) => {
+            log.warn('skill catalog unavailable for audit classification:', { err });
+            return null;
+        });
+        return this.skills;
+    }
+}
+function elapsed(started) {
+    return Math.max(0, Math.round(performance.now() - started));
+}
+/**
+ * A chain-internal result that is the tool saying it failed. A downstream
+ * MCP server answers a failed call with `{ isError: true, content }` as a
+ * VALUE (the UTCP mcp protocol hands it through rather than throwing), and
+ * the direct path records that as an error — so must the chain path, or the
+ * same failure would read `ok` inside a chain and `error` outside one.
+ */
+function isErrorShaped(result) {
+    return typeof result === 'object' && result !== null && result.isError === true;
+}
+//# sourceMappingURL=request-audit.js.map

package/dist/modules/audit/request-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-audit.js","sourceRoot":"","sources":["../../../src/modules/audit/request-audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,EACL,gBAAgB,EAChB,aAAa,GAId,MAAM,uBAAuB,CAAC;AAE/B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAE5B;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAY;IAIJ;IACA;IACA;IACA;IANX,MAAM,CAAqD;IAEnE,YACmB,QAA6B,EAC7B,MAAc,EACd,SAA4B,EAC5B,GAMhB;QATgB,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAAmB;QAC5B,QAAG,GAAH,GAAG,CAMnB;IACA,CAAC;IAEJ,wDAAwD;IACxD,IAAI,CAAC,IAAoB,EAAE,OAA0B,EAAE,UAAyB;QAC9E,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO;gBACP,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,4GAA4G;IAC5G,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,IAA6B;QAC5D,MAAM,GAAG,GAAsB,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC;QAC9G,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;QAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,OAAO,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,CACR,QAAgB,EAChB,IAA6B,EAC7B,GAAqB,EACrB,OAA+B;QAE/B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,MAAM,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,MAAM,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAA6B;QAC1D,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;OAQG;IACH,oBAAoB,CAAC,MAA0B;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,GAAG,CAAC,QAAgB,EAAE,QAAiC,EAAE,EAAE,CACxE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;IACrF,CAAC;IAEO,YAAY;QAClB,mEAAmE;QACnE,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAClD,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,MAAe;IACpC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAK,MAAgC,CAAC,OAAO,KAAK,IAAI,CAAC;AAC7G,CAAC"}

package/dist/modules/auth/account-admission.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Whether a NEW account may be provisioned on this deployment, asked before
+ * the row is inserted. The one seam a host that sells seats needs: core
+ * admits everyone, and a cloud overlay answers from its plan without
+ * forking any sign-in path.
+ *
+ * Asked only for an address with no account yet. An existing user's sign-in
+ * is never a provisioning, so a refusal can never lock out someone who is
+ * already in.
+ */
+export type AccountProvisionReason = 
+/** A first sign-in through single sign-on, which provisions on its own. */
+'sso'
+/** An admin creating an account from the app. */
+ | 'admin-create'
+/** The deployment owner's first password sign-in, which creates their row. */
+ | 'bootstrap'
+/** A verified identity from an embedding surface that needs a row without a session. */
+ | 'embed';
+export type AccountAdmissionVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+export interface IAccountAdmission {
+    canProvision(email: string, reason: AccountProvisionReason): Promise<AccountAdmissionVerdict>;
+}
+/** Core's default: every account is admitted. */
+export declare const admitEveryone: IAccountAdmission;
+/**
+ * The port said no. Carries the port's own words, which the routes surface
+ * to the person or admin who asked, and a 403: the identity was fine, the
+ * deployment has no place for it.
+ */
+export declare class AccountAdmissionRefusedError extends Error {
+    readonly status = 403;
+    constructor(message: string);
+}
+//# sourceMappingURL=account-admission.d.ts.map

package/dist/modules/auth/account-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-admission.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB;AAChC,2EAA2E;AACzE,KAAK;AACP,iDAAiD;GAC/C,cAAc;AAChB,8EAA8E;GAC5E,WAAW;AACb,wFAAwF;GACtF,OAAO,CAAC;AAEZ,MAAM,MAAM,uBAAuB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/F;AAED,iDAAiD;AACjD,eAAO,MAAM,aAAa,EAAE,iBAE3B,CAAC;AAEF;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,OAAO;gBAEV,OAAO,EAAE,MAAM;CAI5B"}

package/dist/modules/auth/account-admission.js

@@ -0,0 +1,17 @@
+/** Core's default: every account is admitted. */
+export const admitEveryone = {
+    canProvision: async () => ({ ok: true }),
+};
+/**
+ * The port said no. Carries the port's own words, which the routes surface
+ * to the person or admin who asked, and a 403: the identity was fine, the
+ * deployment has no place for it.
+ */
+export class AccountAdmissionRefusedError extends Error {
+    status = 403;
+    constructor(message) {
+        super(message);
+        this.name = 'AccountAdmissionRefusedError';
+    }
+}
+//# sourceMappingURL=account-admission.js.map

package/dist/modules/auth/account-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-admission.js","sourceRoot":"","sources":["../../../src/modules/auth/account-admission.ts"],"names":[],"mappings":"AA0BA,iDAAiD;AACjD,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;CACzC,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,MAAM,GAAG,GAAG,CAAC;IAEtB,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF"}

package/dist/modules/auth/account.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAGzF,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,eAAe,GAAG,aAAa,CAAC,EAChF,WAAW,EAAE,mBAAmB,EAChC,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,EACzD,aAAa,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GACtG,OAAO,CAAC,MAAM,CA0JhB"}
+{"version":3,"file":"account.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAGzF,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,eAAe,GAAG,aAAa,CAAC,EAChF,WAAW,EAAE,mBAAmB,EAChC,cAAc,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,EACzD,aAAa,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,GAAG,aAAa,CAAC,GACtG,OAAO,CAAC,MAAM,CA4JhB"}

package/dist/modules/auth/account.routes.js

@@ -3,6 +3,7 @@ import { randomUUID } from 'node:crypto';
 import { logger } from '../../shared/logging.js';
 import { printable } from '../../shared/printable.js';
 const log = logger('accounts');
+import { AccountAdmissionRefusedError } from './account-admission.js';
 import { erasedAccountId } from './account-erasure.service.js';
 import { sendError } from '../access/admin-route-helpers.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
@@ -47,7 +48,9 @@ export function createAccountRoutes(authService, adminAccess, accountErasure, ac
         }
         catch (error) {
             const msg = error instanceof Error ? error.message : 'Unknown error';
-            res.status(400).json({ error: msg });
+            // The deployment has no place for the account (a seat limit, say): the
+            // port's own words, as a refusal rather than a malformed request.
+            res.status(error instanceof AccountAdmissionRefusedError ? 403 : 400).json({ error: msg });
         }
     });
     // GET /api/admin/accounts/:userId/references — how many places in the

package/dist/modules/auth/account.routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAG/B,OAAO,EAAE,eAAe,EAA+B,MAAM,8BAA8B,CAAC;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,sBAAsB,CAAC,CAAC,+BAA+B;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAgF,EAChF,WAAgC,EAChC,cAAyD,EACzD,aAAuG;IAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAIrC,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC;QAE1F,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,KAAK,GAAoB,IAAI,CAAC;QAClC,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACnB,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,aAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC5C,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;oBACzE,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;oBAC3B,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;oBACjC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;iBACjC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC;gBACvD,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5I,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,GAAG,CAAC,KAAK,CAAC,2BAA2B,SAAS,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,wEAAwE;YACxE,IAAI,YAAY,GAAoB,IAAI,CAAC;YACzC,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,aAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,wDAAwD,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,OAAO,GACX,GAAG,YAAY,mBAAmB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBACpD,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,sEAAsE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"account.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/account.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAG/B,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,eAAe,EAA+B,MAAM,8BAA8B,CAAC;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,sBAAsB,CAAC,CAAC,+BAA+B;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAgF,EAChF,WAAgC,EAChC,cAAyD,EACzD,aAAuG;IAEvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAIrC,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC;QAE1F,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,KAAK,GAAoB,IAAI,CAAC;QAClC,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACnB,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,aAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC5C,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;oBACzE,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;oBAC3B,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;oBACjC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;iBACjC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB;gBAC7B,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC;gBACvD,CAAC,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAc,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5I,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,GAAG,CAAC,KAAK,CAAC,2BAA2B,SAAS,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,wEAAwE;YACxE,IAAI,YAAY,GAAoB,IAAI,CAAC;YACzC,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,aAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,wDAAwD,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,OAAO,GACX,GAAG,YAAY,mBAAmB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBACpD,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,sEAAsE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,SAAS,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/modules/auth/auth.service.d.ts

@@ -1,5 +1,6 @@
 import type { Database } from '../database/connection.js';
 import type { AuthUser } from '@bevel-software/platform-shared';
+import { type IAccountAdmission } from './account-admission.js';
 /**
  * What this service needs from the deployment's configuration, and nothing
  * more. Narrowed from `CoreConfig` so the caller can supply a value that is
@@ -24,7 +25,24 @@ export interface AuthConfig {
 export declare class AuthService {
     private readonly db;
     private readonly config;
-    constructor(db: Database, config: AuthConfig);
+    /**
+     * Whether a new account may be provisioned — see `account-admission.ts`.
+     * Core admits everyone; a host that sells seats answers from its plan.
+     */
+    private readonly admission;
+    constructor(db: Database, config: AuthConfig, 
+    /**
+     * Whether a new account may be provisioned — see `account-admission.ts`.
+     * Core admits everyone; a host that sells seats answers from its plan.
+     */
+    admission?: IAccountAdmission);
+    /**
+     * Ask the admission port before an account is CREATED: an address that
+     * already has a row is never asked about, so a refusal cannot lock an
+     * existing user out. The default port is not asked at all, which also
+     * spares the lookup.
+     */
+    private assertAdmitted;
     /**
      * Password login. Two credential sources, in order:
      *

package/dist/modules/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAuDhE;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAGrC;;;;;;;;;;;;;;;;;;;OAmBG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IA8D7C;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAW7C;;;;;;;;;;;;;OAaG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC;IA+BpB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;OAgBG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAqBhB;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAC3B,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,OAAO,CAAC;QACrB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC,CACH;IAYD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAQhD,iBAAiB;IAS/B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;;;;OASG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY7D;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAsDhC;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;gBANT,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IACnC;;;OAGG;IACc,SAAS,GAAE,iBAAiC;IAG/D;;;;;OAKG;YACW,cAAc;IAY5B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IA+D7C;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAY7C;;;;;;;;;;;;;OAaG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC;IAgCpB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;OAgBG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAqBhB;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAC3B,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,OAAO,CAAC;QACrB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC,CACH;IAYD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAShD,iBAAiB;IAS/B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;;;;OASG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY7D;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}

package/dist/modules/auth/auth.service.js

@@ -2,6 +2,7 @@ import jwt from 'jsonwebtoken';
 import { eq } from 'drizzle-orm';
 import { users } from '../database/schema.js';
 import { canonicalEmail, hashEmail } from '../../shared/email-identity.js';
+import { AccountAdmissionRefusedError, admitEveryone, } from './account-admission.js';
 import { hashPassword, verifyPassword, timingSafeStringEqual, MIN_PASSWORD_LENGTH, } from './password-hash.js';
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 /**
@@ -41,9 +42,36 @@ function toAuthUser(user) {
 export class AuthService {
     db;
     config;
-    constructor(db, config) {
+    admission;
+    constructor(db, config, 
+    /**
+     * Whether a new account may be provisioned — see `account-admission.ts`.
+     * Core admits everyone; a host that sells seats answers from its plan.
+     */
+    admission = admitEveryone) {
         this.db = db;
         this.config = config;
+        this.admission = admission;
+    }
+    /**
+     * Ask the admission port before an account is CREATED: an address that
+     * already has a row is never asked about, so a refusal cannot lock an
+     * existing user out. The default port is not asked at all, which also
+     * spares the lookup.
+     */
+    async assertAdmitted(normalizedEmail, reason) {
+        if (this.admission === admitEveryone)
+            return;
+        const [existing] = await this.db
+            .select({ id: users.id })
+            .from(users)
+            .where(eq(users.email, normalizedEmail))
+            .limit(1);
+        if (existing)
+            return;
+        const verdict = await this.admission.canProvision(normalizedEmail, reason);
+        if (!verdict.ok)
+            throw new AccountAdmissionRefusedError(verdict.message);
     }
     /**
      * Password login. Two credential sources, in order:
@@ -107,6 +135,7 @@ export class AuthService {
                 throw new Error('Invalid credentials');
             }
             const defaultName = normalizedEmail.split('@')[0] || normalizedEmail;
+            await this.assertAdmitted(normalizedEmail, 'bootstrap');
             const admin = await this.upsertUserByEmail(normalizedEmail, defaultName);
             return { token: this.signToken(admin.id, admin.email), user: this.toClientUser(admin) };
         }
@@ -134,6 +163,7 @@ export class AuthService {
             throw new Error('Sign-in returned an invalid email');
         }
         this.assertAllowedDomain(normalizedEmail);
+        await this.assertAdmitted(normalizedEmail, 'sso');
         const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
         const user = await this.upsertUserByEmail(normalizedEmail, displayName);
         return { token: this.signToken(user.id, user.email), user: this.toClientUser(user) };
@@ -163,6 +193,7 @@ export class AuthService {
             throw new Error(ENV_ADMIN_PASSWORD_REFUSAL);
         }
         this.assertPasswordPolicy(password);
+        await this.assertAdmitted(normalizedEmail, 'admin-create');
         const suppliedName = (name ?? '').trim();
         const displayName = suppliedName || normalizedEmail.split('@')[0] || normalizedEmail;
         const passwordHash = await hashPassword(password);
@@ -300,6 +331,7 @@ export class AuthService {
         const normalizedEmail = canonicalEmail(email ?? '');
         if (!EMAIL_REGEX.test(normalizedEmail))
             return null;
+        await this.assertAdmitted(normalizedEmail, 'embed');
         const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
         const user = await this.upsertUserByEmail(normalizedEmail, displayName);
         return { id: user.id, email: user.email, name: user.name };