@breadstone/archipel-mcp 0.0.9 → 0.0.10

package/data/packages/platform-authentication/api/Variable.User.md

@@ -3,7 +3,6 @@ title: 'Variable: User'
 generated: true
 editUrl: false
 ---
-
 # Variable: User
 
 ```ts
@@ -16,8 +15,8 @@ Represents the `User` decorator.
 
 ## Parameters
 
-| Parameter        | Type        |
-| ---------------- | ----------- |
+| Parameter | Type |
+| ------ | ------ |
 | ...`dataOrPipes` | `unknown`[] |
 
 ## Returns

package/data/packages/platform-authentication/api/index.md

@@ -3,111 +3,110 @@ title: '@breadstone/archipel-platform-authentication'
 generated: true
 editUrl: false
 ---
-
 # @breadstone/archipel-platform-authentication
 
 ## Classes
 
-| Class                                                    | Description                                                                                                                                                                                                                                 |
-| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [AnonymousAuthGuard](Class.AnonymousAuthGuard)           | The `AnonymousAuthGuard` protects routes using anonymous authentication.                                                                                                                                                                    |
-| [AppleConnector](Class.AppleConnector)                   | The `AppleConnector` integrates Apple Sign In authentication.                                                                                                                                                                               |
-| [AuthModule](Class.AuthModule)                           | The `AuthModule` handles JWT-based authentication, including token creation and validation.                                                                                                                                                 |
-| [AuthSubjectPort](Class.AuthSubjectPort)                 | Abstract port for resolving authentication subjects by identity. Used by the JWT, Local, and Anonymous strategies.                                                                                                                          |
-| [AuthTokenService](Class.AuthTokenService)               | Generic service responsible for creating JWT access tokens. Builds a base payload from [IAuthSubject](Interface.IAuthSubject) and optionally enriches it via the [TokenEnricherPort](Class.TokenEnricherPort) with product-specific claims. |
-| [ChallengeService](Class.ChallengeService)               | Stores and validates MFA login challenges.                                                                                                                                                                                                  |
-| [GithubAuthGuard](Class.GithubAuthGuard)                 | The `GithubAuthGuard` protects routes using GitHub authentication.                                                                                                                                                                          |
-| [GithubConnector](Class.GithubConnector)                 | -                                                                                                                                                                                                                                           |
-| [GoogleConnector](Class.GoogleConnector)                 | The `GoogleConnector` integrates Google OAuth authentication.                                                                                                                                                                               |
-| [JwtAuthGuard](Class.JwtAuthGuard)                       | The `JwtAuthGuard` protects routes using JWT-based authentication.                                                                                                                                                                          |
-| [JwtPayloadBase](Class.JwtPayloadBase)                   | Abstract base class for JWT payloads. Products extend this to add their own claims (e.g. `profileId`, `isPro`). Used as both a serialization contract and NestJS injection token.                                                           |
-| [LastActiveMiddleware](Class.LastActiveMiddleware)       | Middleware to automatically update the lastActive timestamp for authenticated sessions. Extracts the JWT token from the Authorization header and updates the session asynchronously.                                                        |
-| [LocalAuthGuard](Class.LocalAuthGuard)                   | The `LocalAuthGuard` protects routes using local authentication.                                                                                                                                                                            |
-| [MfaService](Class.MfaService)                           | Orchestrates MFA channels, backup codes, and user preferences.                                                                                                                                                                              |
-| [MfaSubjectPort](Class.MfaSubjectPort)                   | Abstract port for reading and writing MFA state on the underlying subject entity. Used by the MfaService and all MFA channel implementations.                                                                                               |
-| [MicrosoftConnector](Class.MicrosoftConnector)           | The `MicrosoftConnector` integrates Microsoft OAuth authentication.                                                                                                                                                                         |
-| [RolesGuard](Class.RolesGuard)                           | -                                                                                                                                                                                                                                           |
-| [SessionMappingProfile](Class.SessionMappingProfile)     | Mapping profile for Session entity to response transformations.                                                                                                                                                                             |
-| [SessionPersistencePort](Class.SessionPersistencePort)   | Abstract port for persisting and querying sessions. Used by the SessionService and LastActiveMiddleware.                                                                                                                                    |
-| [SessionResponse](Class.SessionResponse)                 | The `SessionResponse` class.                                                                                                                                                                                                                |
-| [SessionService](Class.SessionService)                   | Manages user sessions via the [SessionPersistencePort](Class.SessionPersistencePort).                                                                                                                                                       |
-| [SocialAuthGuard](Class.SocialAuthGuard)                 | -                                                                                                                                                                                                                                           |
-| [SocialAuthPort](Class.SocialAuthPort)                   | Abstract port for resolving or creating subjects from social / OAuth profiles. Used by all social strategies (GitHub, Google, Microsoft, Apple).                                                                                            |
-| [TokenEnricherPort](Class.TokenEnricherPort)             | Abstract port for enriching JWT claims with product-specific data. This is an optional port: when not provided, the token contains only base claims.                                                                                        |
-| [TotpMfaChannel](Class.TotpMfaChannel)                   | -                                                                                                                                                                                                                                           |
-| [VerificationService](Class.VerificationService)         | Manages email / PIN verification tokens via the [VerificationSubjectPort](Class.VerificationSubjectPort).                                                                                                                                   |
-| [VerificationSubjectPort](Class.VerificationSubjectPort) | Abstract port for verifiable subject persistence. Used by the VerificationService to manage email/PIN verification.                                                                                                                         |
+| Class | Description |
+| ------ | ------ |
+| [AnonymousAuthGuard](Class.AnonymousAuthGuard) | The `AnonymousAuthGuard` protects routes using anonymous authentication. |
+| [AppleConnector](Class.AppleConnector) | The `AppleConnector` integrates Apple Sign In authentication. |
+| [AuthModule](Class.AuthModule) | The `AuthModule` handles JWT-based authentication, including token creation and validation. |
+| [AuthSubjectPort](Class.AuthSubjectPort) | Abstract port for resolving authentication subjects by identity. Used by the JWT, Local, and Anonymous strategies. |
+| [AuthTokenService](Class.AuthTokenService) | Generic service responsible for creating JWT access tokens. Builds a base payload from [IAuthSubject](Interface.IAuthSubject) and optionally enriches it via the [TokenEnricherPort](Class.TokenEnricherPort) with product-specific claims. |
+| [ChallengeService](Class.ChallengeService) | Stores and validates MFA login challenges. |
+| [GithubAuthGuard](Class.GithubAuthGuard) | The `GithubAuthGuard` protects routes using GitHub authentication. |
+| [GithubConnector](Class.GithubConnector) | - |
+| [GoogleConnector](Class.GoogleConnector) | The `GoogleConnector` integrates Google OAuth authentication. |
+| [JwtAuthGuard](Class.JwtAuthGuard) | The `JwtAuthGuard` protects routes using JWT-based authentication. |
+| [JwtPayloadBase](Class.JwtPayloadBase) | Abstract base class for JWT payloads. Products extend this to add their own claims (e.g. `profileId`, `isPro`). Used as both a serialization contract and NestJS injection token. |
+| [LastActiveMiddleware](Class.LastActiveMiddleware) | Middleware to automatically update the lastActive timestamp for authenticated sessions. Extracts the JWT token from the Authorization header and updates the session asynchronously. |
+| [LocalAuthGuard](Class.LocalAuthGuard) | The `LocalAuthGuard` protects routes using local authentication. |
+| [MfaService](Class.MfaService) | Orchestrates MFA channels, backup codes, and user preferences. |
+| [MfaSubjectPort](Class.MfaSubjectPort) | Abstract port for reading and writing MFA state on the underlying subject entity. Used by the MfaService and all MFA channel implementations. |
+| [MicrosoftConnector](Class.MicrosoftConnector) | The `MicrosoftConnector` integrates Microsoft OAuth authentication. |
+| [RolesGuard](Class.RolesGuard) | - |
+| [SessionMappingProfile](Class.SessionMappingProfile) | Mapping profile for Session entity to response transformations. |
+| [SessionPersistencePort](Class.SessionPersistencePort) | Abstract port for persisting and querying sessions. Used by the SessionService and LastActiveMiddleware. |
+| [SessionResponse](Class.SessionResponse) | The `SessionResponse` class. |
+| [SessionService](Class.SessionService) | Manages user sessions via the [SessionPersistencePort](Class.SessionPersistencePort). |
+| [SocialAuthGuard](Class.SocialAuthGuard) | - |
+| [SocialAuthPort](Class.SocialAuthPort) | Abstract port for resolving or creating subjects from social / OAuth profiles. Used by all social strategies (GitHub, Google, Microsoft, Apple). |
+| [TokenEnricherPort](Class.TokenEnricherPort) | Abstract port for enriching JWT claims with product-specific data. This is an optional port: when not provided, the token contains only base claims. |
+| [TotpMfaChannel](Class.TotpMfaChannel) | - |
+| [VerificationService](Class.VerificationService) | Manages email / PIN verification tokens via the [VerificationSubjectPort](Class.VerificationSubjectPort). |
+| [VerificationSubjectPort](Class.VerificationSubjectPort) | Abstract port for verifiable subject persistence. Used by the VerificationService to manage email/PIN verification. |
 
 ## Interfaces
 
-| Interface                                              | Description                                                                                                                                                         |
-| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [IAuthModuleOptions](Interface.IAuthModuleOptions)     | Options for configuring the `AuthModule`.                                                                                                                           |
-| [IAuthSubject](Interface.IAuthSubject)                 | Generic authentication subject returned by the [AuthSubjectPort](Class.AuthSubjectPort). Represents any entity that can authenticate (user, service account, etc.). |
-| [IMfaChallengePayload](Interface.IMfaChallengePayload) | Represents the MFA challenge payload encoded in a challenge token.                                                                                                  |
-| [IMfaChallengeState](Interface.IMfaChallengeState)     | -                                                                                                                                                                   |
-| [IMfaConfirmation](Interface.IMfaConfirmation)         | Represents the activation result for multi-factor authentication.                                                                                                   |
-| [IMfaSetup](Interface.IMfaSetup)                       | Represents the data required to onboard a multi-factor authenticator.                                                                                               |
-| [IMfaSubject](Interface.IMfaSubject)                   | Represents an MFA-enabled subject. Contains the data the MFA subsystem needs to read and write MFA state on the underlying user-like entity.                        |
-| [IMfaSubjectUpdate](Interface.IMfaSubjectUpdate)       | Data payload for updating MFA state on the underlying entity. All properties are optional — only the provided ones are applied.                                     |
-| [ISessionRecord](Interface.ISessionRecord)             | Represents a persisted session record.                                                                                                                              |
-| [ISignInResult](Interface.ISignInResult)               | Represents the outcome of a sign-in attempt.                                                                                                                        |
-| [ISocialProfile](Interface.ISocialProfile)             | Profile data received from a social / OAuth provider.                                                                                                               |
-| [IStoreSessionArgs](Interface.IStoreSessionArgs)       | Arguments for storing a new session.                                                                                                                                |
-| [IVerifiableSubject](Interface.IVerifiableSubject)     | Represents a verifiable authentication subject. Used by the [VerificationService](Class.VerificationService) to verify email / PIN.                                 |
+| Interface | Description |
+| ------ | ------ |
+| [IAuthModuleOptions](Interface.IAuthModuleOptions) | Options for configuring the `AuthModule`. |
+| [IAuthSubject](Interface.IAuthSubject) | Generic authentication subject returned by the [AuthSubjectPort](Class.AuthSubjectPort). Represents any entity that can authenticate (user, service account, etc.). |
+| [IMfaChallengePayload](Interface.IMfaChallengePayload) | Represents the MFA challenge payload encoded in a challenge token. |
+| [IMfaChallengeState](Interface.IMfaChallengeState) | - |
+| [IMfaConfirmation](Interface.IMfaConfirmation) | Represents the activation result for multi-factor authentication. |
+| [IMfaSetup](Interface.IMfaSetup) | Represents the data required to onboard a multi-factor authenticator. |
+| [IMfaSubject](Interface.IMfaSubject) | Represents an MFA-enabled subject. Contains the data the MFA subsystem needs to read and write MFA state on the underlying user-like entity. |
+| [IMfaSubjectUpdate](Interface.IMfaSubjectUpdate) | Data payload for updating MFA state on the underlying entity. All properties are optional — only the provided ones are applied. |
+| [ISessionRecord](Interface.ISessionRecord) | Represents a persisted session record. |
+| [ISignInResult](Interface.ISignInResult) | Represents the outcome of a sign-in attempt. |
+| [ISocialProfile](Interface.ISocialProfile) | Profile data received from a social / OAuth provider. |
+| [IStoreSessionArgs](Interface.IStoreSessionArgs) | Arguments for storing a new session. |
+| [IVerifiableSubject](Interface.IVerifiableSubject) | Represents a verifiable authentication subject. Used by the [VerificationService](Class.VerificationService) to verify email / PIN. |
 
 ## Variables
 
-| Variable                                                                                  | Description                                                                    |
-| ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
-| [APPLE_AUTH_CONFIG_ENTRIES](Variable.APPLE_AUTH_CONFIG_ENTRIES)                           | Configuration entries required by Apple Sign-In authentication.                |
-| [AUTH_APPLE_CALLBACK_URL](Variable.AUTH_APPLE_CALLBACK_URL)                               | Apple Sign-In callback URL.                                                    |
-| [AUTH_APPLE_CLIENT_ID](Variable.AUTH_APPLE_CLIENT_ID)                                     | Apple Sign-In client (service) ID.                                             |
-| [AUTH_APPLE_KEY_ID](Variable.AUTH_APPLE_KEY_ID)                                           | Apple Sign-In key ID.                                                          |
-| [AUTH_APPLE_PRIVATE_KEY](Variable.AUTH_APPLE_PRIVATE_KEY)                                 | Apple Sign-In private key (PEM string).                                        |
-| [AUTH_APPLE_SCOPE](Variable.AUTH_APPLE_SCOPE)                                             | Comma-separated list of Apple Sign-In scopes (e.g. `'name,email'`).            |
-| [AUTH_APPLE_TEAM_ID](Variable.AUTH_APPLE_TEAM_ID)                                         | Apple developer team ID.                                                       |
-| [AUTH_GITHUB_CALLBACK_URL](Variable.AUTH_GITHUB_CALLBACK_URL)                             | GitHub OAuth callback URL.                                                     |
-| [AUTH_GITHUB_CLIENT_ID](Variable.AUTH_GITHUB_CLIENT_ID)                                   | GitHub OAuth client ID.                                                        |
-| [AUTH_GITHUB_CLIENT_SECRET](Variable.AUTH_GITHUB_CLIENT_SECRET)                           | GitHub OAuth client secret.                                                    |
-| [AUTH_GITHUB_SCOPE](Variable.AUTH_GITHUB_SCOPE)                                           | Comma-separated list of GitHub OAuth scopes (e.g. `'user:email,read:user'`).   |
-| [AUTH_GOOGLE_CALLBACK_URL](Variable.AUTH_GOOGLE_CALLBACK_URL)                             | Google OAuth2 callback URL.                                                    |
-| [AUTH_GOOGLE_CLIENT_ID](Variable.AUTH_GOOGLE_CLIENT_ID)                                   | Google OAuth2 client ID.                                                       |
-| [AUTH_GOOGLE_CLIENT_SECRET](Variable.AUTH_GOOGLE_CLIENT_SECRET)                           | Google OAuth2 client secret.                                                   |
-| [AUTH_GOOGLE_SCOPE](Variable.AUTH_GOOGLE_SCOPE)                                           | Comma-separated list of Google OAuth scopes (e.g. `'email,profile'`).          |
-| [AUTH_JWT_EXPIRES_IN](Variable.AUTH_JWT_EXPIRES_IN)                                       | Lifetime of access tokens (e.g. `'15m'`, `'1h'`).                              |
-| [AUTH_JWT_SECRET](Variable.AUTH_JWT_SECRET)                                               | Secret used to sign JWTs.                                                      |
-| [AUTH_MFA_CHALLENGE_EXPIRES_IN](Variable.AUTH_MFA_CHALLENGE_EXPIRES_IN)                   | How long an MFA challenge stays valid (e.g. `'5m'`).                           |
-| [AUTH_MFA_EMAIL_CODE_TTL](Variable.AUTH_MFA_EMAIL_CODE_TTL)                               | Time-to-live for email OTP codes (e.g. `'10m'`).                               |
-| [AUTH_MFA_EMAIL_MIN_RESEND](Variable.AUTH_MFA_EMAIL_MIN_RESEND)                           | Minimum interval between email OTP resend requests (e.g. `'30s'`).             |
-| [AUTH_MFA_ENCRYPTION_KEY](Variable.AUTH_MFA_ENCRYPTION_KEY)                               | AES encryption key used to encrypt MFA secrets at rest.                        |
-| [AUTH_MFA_ISSUER](Variable.AUTH_MFA_ISSUER)                                               | Issuer name shown in authenticator apps for TOTP MFA.                          |
-| [AUTH_MFA_MAX_ATTEMPTS](Variable.AUTH_MFA_MAX_ATTEMPTS)                                   | Maximum number of failed MFA attempts before lockout.                          |
-| [AUTH_MFA_PUSH_CODE_TTL](Variable.AUTH_MFA_PUSH_CODE_TTL)                                 | Time-to-live for push OTP codes (e.g. `'10m'`).                                |
-| [AUTH_MFA_PUSH_MIN_RESEND](Variable.AUTH_MFA_PUSH_MIN_RESEND)                             | Minimum interval between push OTP resend requests (e.g. `'30s'`).              |
-| [AUTH_MFA_SMS_CODE_TTL](Variable.AUTH_MFA_SMS_CODE_TTL)                                   | Time-to-live for SMS OTP codes (e.g. `'10m'`).                                 |
-| [AUTH_MFA_SMS_MIN_RESEND](Variable.AUTH_MFA_SMS_MIN_RESEND)                               | Minimum interval between SMS resend requests (e.g. `'30s'`).                   |
-| [AUTH_MICROSOFT_CALLBACK_URL](Variable.AUTH_MICROSOFT_CALLBACK_URL)                       | Microsoft OAuth2 callback URL.                                                 |
-| [AUTH_MICROSOFT_CLIENT_ID](Variable.AUTH_MICROSOFT_CLIENT_ID)                             | Microsoft OAuth2 client ID.                                                    |
-| [AUTH_MICROSOFT_CLIENT_SECRET](Variable.AUTH_MICROSOFT_CLIENT_SECRET)                     | Microsoft OAuth2 client secret.                                                |
-| [AUTH_MICROSOFT_SCOPE](Variable.AUTH_MICROSOFT_SCOPE)                                     | Comma-separated list of Microsoft OAuth scopes (e.g. `'user.read,mail.read'`). |
-| [AUTH_MICROSOFT_TENANT](Variable.AUTH_MICROSOFT_TENANT)                                   | Microsoft tenant ID or `'common'` for multi-tenant.                            |
-| [AUTH_VERIFY_JWT_EXPIRES_IN](Variable.AUTH_VERIFY_JWT_EXPIRES_IN)                         | Lifetime of email-verification JWTs.                                           |
-| [GITHUB_AUTH_CONFIG_ENTRIES](Variable.GITHUB_AUTH_CONFIG_ENTRIES)                         | Configuration entries required by GitHub OAuth authentication.                 |
-| [GOOGLE_AUTH_CONFIG_ENTRIES](Variable.GOOGLE_AUTH_CONFIG_ENTRIES)                         | Configuration entries required by Google OAuth authentication.                 |
-| [MICROSOFT_AUTH_CONFIG_ENTRIES](Variable.MICROSOFT_AUTH_CONFIG_ENTRIES)                   | Configuration entries required by Microsoft OAuth authentication.              |
-| [PLATFORM_AUTHENTICATION_CONFIG_ENTRIES](Variable.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES) | Core configuration entries required by `platform-authentication`.              |
-| [ROLES_KEY](Variable.ROLES_KEY)                                                           | Represents the key for the `UseRoles` decorator.                               |
-| [SEED_ANONYMOUS_USERNAME](Variable.SEED_ANONYMOUS_USERNAME)                               | Username used for the anonymous seed user.                                     |
-| [SESSION_LIST_MAPPING_KEY](Variable.SESSION_LIST_MAPPING_KEY)                             | Type-safe mapping key for Session entity list to response list transformation. |
-| [SESSION_MAPPING_KEY](Variable.SESSION_MAPPING_KEY)                                       | Type-safe mapping key for Session entity to response transformation.           |
-| [TOTP_MFA_PROVIDERS](Variable.TOTP_MFA_PROVIDERS)                                         | Providers required by the [TotpMfaChannel](Class.TotpMfaChannel).              |
-| [User](Variable.User)                                                                     | Represents the `User` decorator.                                               |
+| Variable | Description |
+| ------ | ------ |
+| [APPLE\_AUTH\_CONFIG\_ENTRIES](Variable.APPLE_AUTH_CONFIG_ENTRIES) | Configuration entries required by Apple Sign-In authentication. |
+| [AUTH\_APPLE\_CALLBACK\_URL](Variable.AUTH_APPLE_CALLBACK_URL) | Apple Sign-In callback URL. |
+| [AUTH\_APPLE\_CLIENT\_ID](Variable.AUTH_APPLE_CLIENT_ID) | Apple Sign-In client (service) ID. |
+| [AUTH\_APPLE\_KEY\_ID](Variable.AUTH_APPLE_KEY_ID) | Apple Sign-In key ID. |
+| [AUTH\_APPLE\_PRIVATE\_KEY](Variable.AUTH_APPLE_PRIVATE_KEY) | Apple Sign-In private key (PEM string). |
+| [AUTH\_APPLE\_SCOPE](Variable.AUTH_APPLE_SCOPE) | Comma-separated list of Apple Sign-In scopes (e.g. `'name,email'`). |
+| [AUTH\_APPLE\_TEAM\_ID](Variable.AUTH_APPLE_TEAM_ID) | Apple developer team ID. |
+| [AUTH\_GITHUB\_CALLBACK\_URL](Variable.AUTH_GITHUB_CALLBACK_URL) | GitHub OAuth callback URL. |
+| [AUTH\_GITHUB\_CLIENT\_ID](Variable.AUTH_GITHUB_CLIENT_ID) | GitHub OAuth client ID. |
+| [AUTH\_GITHUB\_CLIENT\_SECRET](Variable.AUTH_GITHUB_CLIENT_SECRET) | GitHub OAuth client secret. |
+| [AUTH\_GITHUB\_SCOPE](Variable.AUTH_GITHUB_SCOPE) | Comma-separated list of GitHub OAuth scopes (e.g. `'user:email,read:user'`). |
+| [AUTH\_GOOGLE\_CALLBACK\_URL](Variable.AUTH_GOOGLE_CALLBACK_URL) | Google OAuth2 callback URL. |
+| [AUTH\_GOOGLE\_CLIENT\_ID](Variable.AUTH_GOOGLE_CLIENT_ID) | Google OAuth2 client ID. |
+| [AUTH\_GOOGLE\_CLIENT\_SECRET](Variable.AUTH_GOOGLE_CLIENT_SECRET) | Google OAuth2 client secret. |
+| [AUTH\_GOOGLE\_SCOPE](Variable.AUTH_GOOGLE_SCOPE) | Comma-separated list of Google OAuth scopes (e.g. `'email,profile'`). |
+| [AUTH\_JWT\_EXPIRES\_IN](Variable.AUTH_JWT_EXPIRES_IN) | Lifetime of access tokens (e.g. `'15m'`, `'1h'`). |
+| [AUTH\_JWT\_SECRET](Variable.AUTH_JWT_SECRET) | Secret used to sign JWTs. |
+| [AUTH\_MFA\_CHALLENGE\_EXPIRES\_IN](Variable.AUTH_MFA_CHALLENGE_EXPIRES_IN) | How long an MFA challenge stays valid (e.g. `'5m'`). |
+| [AUTH\_MFA\_EMAIL\_CODE\_TTL](Variable.AUTH_MFA_EMAIL_CODE_TTL) | Time-to-live for email OTP codes (e.g. `'10m'`). |
+| [AUTH\_MFA\_EMAIL\_MIN\_RESEND](Variable.AUTH_MFA_EMAIL_MIN_RESEND) | Minimum interval between email OTP resend requests (e.g. `'30s'`). |
+| [AUTH\_MFA\_ENCRYPTION\_KEY](Variable.AUTH_MFA_ENCRYPTION_KEY) | AES encryption key used to encrypt MFA secrets at rest. |
+| [AUTH\_MFA\_ISSUER](Variable.AUTH_MFA_ISSUER) | Issuer name shown in authenticator apps for TOTP MFA. |
+| [AUTH\_MFA\_MAX\_ATTEMPTS](Variable.AUTH_MFA_MAX_ATTEMPTS) | Maximum number of failed MFA attempts before lockout. |
+| [AUTH\_MFA\_PUSH\_CODE\_TTL](Variable.AUTH_MFA_PUSH_CODE_TTL) | Time-to-live for push OTP codes (e.g. `'10m'`). |
+| [AUTH\_MFA\_PUSH\_MIN\_RESEND](Variable.AUTH_MFA_PUSH_MIN_RESEND) | Minimum interval between push OTP resend requests (e.g. `'30s'`). |
+| [AUTH\_MFA\_SMS\_CODE\_TTL](Variable.AUTH_MFA_SMS_CODE_TTL) | Time-to-live for SMS OTP codes (e.g. `'10m'`). |
+| [AUTH\_MFA\_SMS\_MIN\_RESEND](Variable.AUTH_MFA_SMS_MIN_RESEND) | Minimum interval between SMS resend requests (e.g. `'30s'`). |
+| [AUTH\_MICROSOFT\_CALLBACK\_URL](Variable.AUTH_MICROSOFT_CALLBACK_URL) | Microsoft OAuth2 callback URL. |
+| [AUTH\_MICROSOFT\_CLIENT\_ID](Variable.AUTH_MICROSOFT_CLIENT_ID) | Microsoft OAuth2 client ID. |
+| [AUTH\_MICROSOFT\_CLIENT\_SECRET](Variable.AUTH_MICROSOFT_CLIENT_SECRET) | Microsoft OAuth2 client secret. |
+| [AUTH\_MICROSOFT\_SCOPE](Variable.AUTH_MICROSOFT_SCOPE) | Comma-separated list of Microsoft OAuth scopes (e.g. `'user.read,mail.read'`). |
+| [AUTH\_MICROSOFT\_TENANT](Variable.AUTH_MICROSOFT_TENANT) | Microsoft tenant ID or `'common'` for multi-tenant. |
+| [AUTH\_VERIFY\_JWT\_EXPIRES\_IN](Variable.AUTH_VERIFY_JWT_EXPIRES_IN) | Lifetime of email-verification JWTs. |
+| [GITHUB\_AUTH\_CONFIG\_ENTRIES](Variable.GITHUB_AUTH_CONFIG_ENTRIES) | Configuration entries required by GitHub OAuth authentication. |
+| [GOOGLE\_AUTH\_CONFIG\_ENTRIES](Variable.GOOGLE_AUTH_CONFIG_ENTRIES) | Configuration entries required by Google OAuth authentication. |
+| [MICROSOFT\_AUTH\_CONFIG\_ENTRIES](Variable.MICROSOFT_AUTH_CONFIG_ENTRIES) | Configuration entries required by Microsoft OAuth authentication. |
+| [PLATFORM\_AUTHENTICATION\_CONFIG\_ENTRIES](Variable.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES) | Core configuration entries required by `platform-authentication`. |
+| [ROLES\_KEY](Variable.ROLES_KEY) | Represents the key for the `UseRoles` decorator. |
+| [SEED\_ANONYMOUS\_USERNAME](Variable.SEED_ANONYMOUS_USERNAME) | Username used for the anonymous seed user. |
+| [SESSION\_LIST\_MAPPING\_KEY](Variable.SESSION_LIST_MAPPING_KEY) | Type-safe mapping key for Session entity list to response list transformation. |
+| [SESSION\_MAPPING\_KEY](Variable.SESSION_MAPPING_KEY) | Type-safe mapping key for Session entity to response transformation. |
+| [TOTP\_MFA\_PROVIDERS](Variable.TOTP_MFA_PROVIDERS) | Providers required by the [TotpMfaChannel](Class.TotpMfaChannel). |
+| [User](Variable.User) | Represents the `User` decorator. |
 
 ## Functions
 
-| Function                                                  | Description                          |
-| --------------------------------------------------------- | ------------------------------------ |
-| [socialAuthGuardFactory](Function.socialAuthGuardFactory) | -                                    |
-| [Token](Function.Token)                                   | Represents the `Token` decorator.    |
-| [UseRoles](Function.UseRoles)                             | Represents the `UseRoles` decorator. |
+| Function | Description |
+| ------ | ------ |
+| [socialAuthGuardFactory](Function.socialAuthGuardFactory) | - |
+| [Token](Function.Token) | Represents the `Token` decorator. |
+| [UseRoles](Function.UseRoles) | Represents the `UseRoles` decorator. |

package/data/packages/platform-blob-storage/api/Class.AwsS3BlobProvider.md

@@ -3,7 +3,6 @@ title: 'Class: AwsS3BlobProvider'
 generated: true
 editUrl: false
 ---
-
 # Class: AwsS3BlobProvider
 
 Defined in: [providers/AwsS3BlobProvider.ts:38](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-blob-storage/src/providers/AwsS3BlobProvider.ts#L38)
@@ -28,8 +27,8 @@ Initializes a new instance of the AwsS3BlobProvider class.
 
 #### Parameters
 
-| Parameter | Type                                                       | Description                         |
-| --------- | ---------------------------------------------------------- | ----------------------------------- |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `options` | [`IAwsS3ProviderOptions`](Interface.IAwsS3ProviderOptions) | The provider configuration options. |
 
 #### Returns
@@ -58,7 +57,7 @@ Gets the default bucket configured for the provider.
 
 [`IBlobProvider`](Interface.IBlobProvider).[`defaultBucket`](Interface.IBlobProvider#defaultbucket)
 
----
+***
 
 ### providerId
 
@@ -94,8 +93,8 @@ Creates a pre-signed URL for the specified blob object.
 
 #### Parameters
 
-| Parameter | Type                                                       | Description                                |
-| --------- | ---------------------------------------------------------- | ------------------------------------------ |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `request` | [`IBlobSignedUrlRequest`](Interface.IBlobSignedUrlRequest) | The request describing the object to link. |
 
 #### Returns
@@ -108,7 +107,7 @@ The generated pre-signed URL.
 
 [`IBlobProvider`](Interface.IBlobProvider).[`createSignedUrl`](Interface.IBlobProvider#createsignedurl)
 
----
+***
 
 ### deleteObject()
 
@@ -122,8 +121,8 @@ Deletes a blob object from Amazon S3.
 
 #### Parameters
 
-| Parameter | Type                                                 | Description                                         |
-| --------- | ---------------------------------------------------- | --------------------------------------------------- |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `request` | [`IBlobDeleteRequest`](Interface.IBlobDeleteRequest) | The delete request describing the object to remove. |
 
 #### Returns
@@ -134,7 +133,7 @@ Deletes a blob object from Amazon S3.
 
 [`IBlobProvider`](Interface.IBlobProvider).[`deleteObject`](Interface.IBlobProvider#deleteobject)
 
----
+***
 
 ### downloadObject()
 
@@ -149,13 +148,13 @@ Downloads a blob object from Amazon S3.
 #### Type Parameters
 
 | Type Parameter |
-| -------------- |
-| `TData`        |
+| ------ |
+| `TData` |
 
 #### Parameters
 
-| Parameter | Type                                                     | Description                                             |
-| --------- | -------------------------------------------------------- | ------------------------------------------------------- |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `request` | [`IBlobDownloadRequest`](Interface.IBlobDownloadRequest) | The download request describing the object to download. |
 
 #### Returns
@@ -168,7 +167,7 @@ The download result including payload and metadata.
 
 [`IBlobProvider`](Interface.IBlobProvider).[`downloadObject`](Interface.IBlobProvider#downloadobject)
 
----
+***
 
 ### uploadObject()
 
@@ -182,8 +181,8 @@ Uploads a blob object to Amazon S3.
 
 #### Parameters
 
-| Parameter | Type                                                 | Description                                         |
-| --------- | ---------------------------------------------------- | --------------------------------------------------- |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `request` | [`IBlobUploadRequest`](Interface.IBlobUploadRequest) | The upload request describing the object to upload. |
 
 #### Returns

package/data/packages/platform-blob-storage/api/Class.AzureBlobProvider.md

@@ -3,7 +3,6 @@ title: 'Class: AzureBlobProvider'
 generated: true
 editUrl: false
 ---
-
 # Class: AzureBlobProvider
 
 Defined in: [providers/AzureBlobProvider.ts:34](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-blob-storage/src/providers/AzureBlobProvider.ts#L34)
@@ -28,8 +27,8 @@ Initializes a new instance of the AzureBlobProvider class.
 
 #### Parameters
 
-| Parameter | Type                                                               | Description                         |
-| --------- | ------------------------------------------------------------------ | ----------------------------------- |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `options` | [`IAzureBlobProviderOptions`](Interface.IAzureBlobProviderOptions) | The provider configuration options. |
 
 #### Returns
@@ -58,7 +57,7 @@ Gets the default bucket (container) configured for the provider.
 
 [`IBlobProvider`](Interface.IBlobProvider).[`defaultBucket`](Interface.IBlobProvider#defaultbucket)
 
----
+***
 
 ### providerId
 
@@ -94,8 +93,8 @@ Creates a SAS-signed URL for the specified blob object.
 
 #### Parameters
 
-| Parameter | Type                                                       | Description                                |
-| --------- | ---------------------------------------------------------- | ------------------------------------------ |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `request` | [`IBlobSignedUrlRequest`](Interface.IBlobSignedUrlRequest) | The request describing the object to link. |
 
 #### Returns
@@ -108,7 +107,7 @@ The generated SAS URL.
 
 [`IBlobProvider`](Interface.IBlobProvider).[`createSignedUrl`](Interface.IBlobProvider#createsignedurl)
 
----
+***
 
 ### deleteObject()
 
@@ -122,8 +121,8 @@ Deletes a blob object from Azure Blob Storage.
 
 #### Parameters
 
-| Parameter | Type                                                 | Description                                         |
-| --------- | ---------------------------------------------------- | --------------------------------------------------- |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `request` | [`IBlobDeleteRequest`](Interface.IBlobDeleteRequest) | The delete request describing the object to remove. |
 
 #### Returns
@@ -134,7 +133,7 @@ Deletes a blob object from Azure Blob Storage.
 
 [`IBlobProvider`](Interface.IBlobProvider).[`deleteObject`](Interface.IBlobProvider#deleteobject)
 
----
+***
 
 ### downloadObject()
 
@@ -149,13 +148,13 @@ Downloads a blob object from Azure Blob Storage.
 #### Type Parameters
 
 | Type Parameter |
-| -------------- |
-| `TData`        |
+| ------ |
+| `TData` |
 
 #### Parameters
 
-| Parameter | Type                                                     | Description                                             |
-| --------- | -------------------------------------------------------- | ------------------------------------------------------- |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `request` | [`IBlobDownloadRequest`](Interface.IBlobDownloadRequest) | The download request describing the object to download. |
 
 #### Returns
@@ -168,7 +167,7 @@ The download result including payload and metadata.
 
 [`IBlobProvider`](Interface.IBlobProvider).[`downloadObject`](Interface.IBlobProvider#downloadobject)
 
----
+***
 
 ### uploadObject()
 
@@ -182,8 +181,8 @@ Uploads a blob object to Azure Blob Storage.
 
 #### Parameters
 
-| Parameter | Type                                                 | Description                                         |
-| --------- | ---------------------------------------------------- | --------------------------------------------------- |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `request` | [`IBlobUploadRequest`](Interface.IBlobUploadRequest) | The upload request describing the object to upload. |
 
 #### Returns

package/data/packages/platform-blob-storage/api/Class.BlobHealthIndicator.md

@@ -3,7 +3,6 @@ title: 'Class: BlobHealthIndicator'
 generated: true
 editUrl: false
 ---
-
 # Class: BlobHealthIndicator
 
 Defined in: [terminus/BlobHealthIndicator.ts:16](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-blob-storage/src/terminus/BlobHealthIndicator.ts#L16)
@@ -28,9 +27,9 @@ Constructs a new instance of the `BlobHealthIndicator` class.
 
 #### Parameters
 
-| Parameter             | Type                  |
-| --------------------- | --------------------- |
-| `configService`       | `ConfigService`       |
+| Parameter | Type |
+| ------ | ------ |
+| `configService` | `ConfigService` |
 | `httpHealthIndicator` | `HttpHealthIndicator` |
 
 #### Returns
@@ -52,7 +51,7 @@ Unique key identifying the indicator
 #### Implementation of
 
 ```ts
-IHealthIndicator.key;
+IHealthIndicator.key
 ```
 
 ## Methods
@@ -76,5 +75,5 @@ The health indicator result.
 #### Implementation of
 
 ```ts
-IHealthIndicator.check;
+IHealthIndicator.check
 ```

package/data/packages/platform-blob-storage/api/Class.BlobModule.md

@@ -3,7 +3,6 @@ title: 'Class: BlobModule'
 generated: true
 editUrl: false
 ---
-
 # Class: BlobModule
 
 Defined in: [BlobModule.ts:98](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-blob-storage/src/BlobModule.ts#L98)
@@ -39,8 +38,8 @@ service works without metadata tracking.
 
 #### Parameters
 
-| Parameter  | Type                                                 | Description                       |
-| ---------- | ---------------------------------------------------- | --------------------------------- |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `options?` | [`IBlobModuleOptions`](Interface.IBlobModuleOptions) | The module configuration options. |
 
 #### Returns

package/data/packages/platform-blob-storage/api/Class.BlobObjectPersistencePort.md

@@ -3,7 +3,6 @@ title: 'Abstract Class: BlobObjectPersistencePort'
 generated: true
 editUrl: false
 ---
-
 # Abstract Class: BlobObjectPersistencePort
 
 Defined in: [contracts/BlobObjectPersistencePort.ts:14](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-blob-storage/src/contracts/BlobObjectPersistencePort.ts#L14)
@@ -38,23 +37,23 @@ Persists metadata for a newly uploaded blob object.
 
 #### Parameters
 
-| Parameter  | Type                                                   | Description                                                     |
-| ---------- | ------------------------------------------------------ | --------------------------------------------------------------- |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
 | `metadata` | [`IBlobObjectMetadata`](Interface.IBlobObjectMetadata) | The object metadata returned by the blob provider after upload. |
 
 #### Returns
 
 `Promise`\<`void`\>
 
----
+***
 
 ### markAsDeleted()
 
 ```ts
 abstract markAsDeleted(
-   provider,
-   bucket,
-   key,
+   provider, 
+   bucket, 
+   key, 
 versionId?): Promise<void>;
 ```
 
@@ -64,12 +63,12 @@ Marks an existing blob object as deleted.
 
 #### Parameters
 
-| Parameter    | Type     | Description                      |
-| ------------ | -------- | -------------------------------- |
-| `provider`   | `string` | The storage provider identifier. |
-| `bucket`     | `string` | The bucket name.                 |
-| `key`        | `string` | The object key.                  |
-| `versionId?` | `string` | Optional version identifier.     |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `provider` | `string` | The storage provider identifier. |
+| `bucket` | `string` | The bucket name. |
+| `key` | `string` | The object key. |
+| `versionId?` | `string` | Optional version identifier. |
 
 #### Returns