@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/dist/types/model/service/AuthLogService.d.ts

@@ -1,12 +1,33 @@
-import { DatabaseContext } from '../utils';
-import { Response } from '../utils/Response';
-import { AuthActionType } from '../type/AuthLog';
+import { DatabaseContext } from '../utils/index.js';
+import { Response } from '../utils/Response.js';
+import { AuthActionType } from '../type/AuthLog.js';
+import { JSONValue } from '@contember/schema';
 declare class AuthLogService {
     logAuthAction(db: DatabaseContext, ctx: {
         identityId: string;
         clientIp?: string;
         userAgent?: string;
+        forwarderIp?: string;
+        forwarderUserAgent?: string;
+        /** A03: country from the trusted reverse-proxy geo header, when present. */
+        geoCountry?: string;
+        /** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */
+        deviceFingerprint?: string;
     }, data: AuthLogService.LogArgs): Promise<void>;
+    /**
+     * Focused, response-agnostic emit for internal auth-path events (A19) that
+     * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth
+     * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
+     */
+    logSessionEvent(db: DatabaseContext, entry: {
+        type: AuthActionType;
+        identityId: string;
+        personId?: string | null;
+        ipAddress?: string;
+        userAgent?: string;
+        success: boolean;
+        eventData?: JSONValue;
+    }): Promise<void>;
 }
 declare namespace AuthLogService {
     export const Key: unique symbol;
@@ -15,6 +36,9 @@ declare namespace AuthLogService {
         personInput?: string;
         tokenId?: string;
         identityProviderId?: string;
+        targetPersonId?: string;
+        metadata?: JSONValue;
+        eventData?: JSONValue;
     };
     export type LogArgs = {
         response: Response<null | {

package/dist/types/model/service/AuthLogService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.d.ts","sourceRoot":"","sources":["../../../../src/model/service/AuthLogService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,cAAM,cAAc;IACb,aAAa,CAClB,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAClE,IAAI,EAAE,cAAc,CAAC,OAAO,GAC1B,OAAO,CAAC,IAAI,CAAC;CAyBhB;AAED,kBAAU,cAAc,CAAC;IACxB,MAAM,CAAC,MAAM,GAAG,eAAwB,CAAA;IACxC,KAAK,IAAI,GAAG;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;IAED,MAAM,MAAM,OAAO,GAAG;QACrB,QAAQ,EAAE,QAAQ,CACjB,IAAI,GAAG;YAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAA;SAAE,EACtB,GAAG,EACH,EAAE,GAAG;YAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAA;SAAE,CACpB,CAAA;QACD,IAAI,EAAE,cAAc,CAAA;KACpB,GAAG,IAAI,CAAA;IAER,MAAM,OAAO,GAAG;iBAEE,IAAI,EAAE,IAAI;oBAAV,IAAI,EAAE,IAAI;KAG3B;;CACD;AAED,OAAO,EAAE,cAAc,EAAE,CAAA"}
+{"version":3,"file":"AuthLogService.d.ts","sourceRoot":"","sources":["../../../../src/model/service/AuthLogService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,cAAM,cAAc;IACb,aAAa,CAClB,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE;QACJ,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,4EAA4E;QAC5E,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,8FAA8F;QAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAC1B,EACD,IAAI,EAAE,cAAc,CAAC,OAAO,GAC1B,OAAO,CAAC,IAAI,CAAC;IAyChB;;;;OAIG;IACG,eAAe,CACpB,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE;QACN,IAAI,EAAE,cAAc,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACxB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,OAAO,CAAA;QAChB,SAAS,CAAC,EAAE,SAAS,CAAA;KACrB,GACC,OAAO,CAAC,IAAI,CAAC;CAahB;AAED,kBAAU,cAAc,CAAC;IACxB,MAAM,CAAC,MAAM,GAAG,eAAwB,CAAA;IACxC,KAAK,IAAI,GAAG;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,EAAE,SAAS,CAAA;QACpB,SAAS,CAAC,EAAE,SAAS,CAAA;KACrB,CAAA;IAED,MAAM,MAAM,OAAO,GAAG;QACrB,QAAQ,EAAE,QAAQ,CACjB,IAAI,GAAG;YAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAA;SAAE,EACtB,GAAG,EACH,EAAE,GAAG;YAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAA;SAAE,CACpB,CAAA;QACD,IAAI,EAAE,cAAc,CAAA;KACpB,GAAG,IAAI,CAAA;IAER,MAAM,OAAO,GAAG;iBAEE,IAAI,EAAE,IAAI;oBAAV,IAAI,EAAE,IAAI;KAG3B;;CACD;AAED,OAAO,EAAE,cAAc,EAAE,CAAA"}

package/dist/types/model/service/AuthPolicyManager.d.ts

@@ -0,0 +1,37 @@
+import { DatabaseContext } from '../utils/index.js';
+import { Response } from '../utils/Response.js';
+import { ProjectManager } from './ProjectManager.js';
+import { AuthPolicyRow, AuthPolicyScope } from '../type/index.js';
+import { CreateAuthPolicyErrorCode, DeleteAuthPolicyErrorCode, UpdateAuthPolicyErrorCode } from '../../schema/index.js';
+export type AuthPolicyInputValues = {
+    scope: AuthPolicyScope;
+    /** Project slug; resolved to project_id. Required for scope='project', forbidden for scope='global'. */
+    project?: string | null;
+    roles: string[];
+    mfaRequired?: boolean | null;
+    tokenExpiration?: string | null;
+    idleTimeout?: string | null;
+    graceDuration?: string | null;
+    rememberMeAllowed?: boolean | null;
+};
+/**
+ * CRUD over the `auth_policy` table (shared infra reused by A19). Project is
+ * always addressed by slug in the API and resolved to project_id here.
+ */
+export declare class AuthPolicyManager {
+    private readonly projectManager;
+    constructor(projectManager: ProjectManager);
+    listPolicies(db: DatabaseContext): Promise<AuthPolicyRow[]>;
+    createPolicy(db: DatabaseContext, input: AuthPolicyInputValues): Promise<Response<{
+        id: string;
+    }, CreateAuthPolicyErrorCode>>;
+    updatePolicy(db: DatabaseContext, id: string, input: AuthPolicyInputValues): Promise<Response<null, UpdateAuthPolicyErrorCode>>;
+    deletePolicy(db: DatabaseContext, id: string): Promise<Response<null, DeleteAuthPolicyErrorCode>>;
+    /**
+     * Validates scope/project consistency and resolves a slug to project_id.
+     * `scope='project'` requires a project (which must exist); `scope='global'`
+     * forbids one.
+     */
+    private resolveProjectId;
+}
+//# sourceMappingURL=AuthPolicyManager.d.ts.map

package/dist/types/model/service/AuthPolicyManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/AuthPolicyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAGpD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAEvH,MAAM,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,eAAe,CAAA;IACtB,wGAAwG;IACxG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,iBAAiB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;CAClC,CAAA;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAE5B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAAd,cAAc,EAAE,cAAc;IAG1C,YAAY,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAI3D,YAAY,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,yBAAyB,CAAC,CAAC;IAoB7H,YAAY,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAuB/H,YAAY,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAQvG;;;;OAIG;YACW,gBAAgB;CA2B9B"}

package/dist/types/model/service/AuthPolicyResolver.d.ts

@@ -0,0 +1,25 @@
+import { DatabaseContext } from '../utils/index.js';
+import { EffectivePolicy } from '../type/index.js';
+/**
+ * Resolves the effective auth policy for an identity by aggregating all matching
+ * `auth_policy` rows across the identity's entire role set (global roles + every
+ * project-membership role across all projects).
+ *
+ * Shared by A06 (consumes `mfaRequired`) and A19 (consumes the session fields).
+ *
+ * Aggregation:
+ * - `mfaRequired` = OR of every matched row's `mfa_required` (NULL = no opinion).
+ * - session fields = strictest wins: the shortest `tokenExpiration` / `idleTimeout`
+ *   and the logical AND of `rememberMeAllowed` (any matched `false` wins).
+ *
+ * When nothing matches, the result is the inert baseline
+ * (`mfaRequired=false`, session fields null) — i.e. today's behavior.
+ */
+export declare class AuthPolicyResolver {
+    resolveForIdentity(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<EffectivePolicy>;
+    private matches;
+    private aggregate;
+    /** Strictest wins: returns the shorter of two intervals (NULL = unconstrained). */
+    private shortest;
+}
+//# sourceMappingURL=AuthPolicyResolver.d.ts.map

package/dist/types/model/service/AuthPolicyResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyResolver.d.ts","sourceRoot":"","sources":["../../../../src/model/service/AuthPolicyResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAiB,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAIjE;;;;;;;;;;;;;;GAcG;AACH,qBAAa,kBAAkB;IACxB,kBAAkB,CAAC,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC;IA2B3H,OAAO,CAAC,OAAO;IAiBf,OAAO,CAAC,SAAS;IAwBjB,mFAAmF;IACnF,OAAO,CAAC,QAAQ;CAShB"}

package/dist/types/model/service/BackupCodeManager.d.ts

@@ -0,0 +1,36 @@
+import { DatabaseContext } from '../utils/index.js';
+import { Providers } from '../providers.js';
+import { UserMailer } from '../mailing/index.js';
+import { PersonRow } from '../queries/index.js';
+/**
+ * Manages MFA backup/recovery codes (the `person_backup_code` table).
+ *
+ * Codes only exist for a person who has enrolled TOTP. Behavior for everyone
+ * else is unchanged. Plaintext codes are shown exactly once (on generation);
+ * only their sha256 hashes are stored.
+ */
+export declare class BackupCodeManager {
+    private readonly mailer;
+    private readonly providers;
+    constructor(mailer: UserMailer, providers: Pick<Providers, 'uuid' | 'now' | 'randomBytes'>);
+    /**
+     * Replaces the whole set: deletes any existing codes for the person, issues
+     * {@link BACKUP_CODE_COUNT} fresh ones, stores their hashes and returns the
+     * formatted plaintext codes (to be shown once).
+     */
+    generate(dbContext: DatabaseContext, personId: string): Promise<string[]>;
+    /**
+     * Normalizes the supplied code, then atomically consumes a single unused
+     * matching code. Returns whether a code was actually consumed. Safe against
+     * double-spend (see {@link ConsumeBackupCodeCommand}).
+     */
+    verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean>;
+    deleteForPerson(dbContext: DatabaseContext, personId: string): Promise<void>;
+    /** Number of still-usable backup codes for the person. */
+    countUnused(dbContext: DatabaseContext, personId: string): Promise<number>;
+    /** Strips formatting (hyphens/whitespace) and lowercases — display formatting must not affect verification. */
+    private normalize;
+    private hash;
+    private generateCode;
+}
+//# sourceMappingURL=BackupCodeManager.d.ts.map

package/dist/types/model/service/BackupCodeManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackupCodeManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/BackupCodeManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAG3C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAY/C;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,aAAa,CAAC;IAG5E;;;;OAIG;IACG,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkB/E;;;;OAIG;IACG,gBAAgB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB/F,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlF,0DAA0D;IACpD,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUhF,+GAA+G;IAC/G,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,IAAI;YAIE,YAAY;CAU1B"}

package/dist/types/model/service/ConfigurationManager.d.ts

@@ -1,6 +1,6 @@
-import { ConfigInput, ConfigureErrorCode } from '../../schema';
-import { Response } from '../utils/Response';
-import { DatabaseContext } from '../utils';
+import { ConfigInput, ConfigureErrorCode } from '../../schema/index.js';
+import { Response } from '../utils/Response.js';
+import { DatabaseContext } from '../utils/index.js';
 export declare class ConfigurationManager {
     updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>>;
 }

package/dist/types/model/service/ConfigurationManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ConfigurationManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAc,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAG1C,qBAAa,oBAAoB;IACnB,mBAAmB,CAAC,EAAE,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;CAO9H"}
+{"version":3,"file":"ConfigurationManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ConfigurationManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,EAAE,QAAQ,EAAc,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,qBAAa,oBAAoB;IACnB,mBAAmB,CAAC,EAAE,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;CAO9H"}

package/dist/types/model/service/EmailChangeManager.d.ts

@@ -0,0 +1,41 @@
+import { Response } from '../utils/Response.js';
+import { UserMailer } from '../mailing/index.js';
+import { PersonRow } from '../queries/index.js';
+import { PermissionContext, PermissionContextFactory } from '../authorization/index.js';
+import { ProjectManager } from './ProjectManager.js';
+import { ApiKeyManager } from './apiKey/index.js';
+import { EmailValidator, EmailValidatorError } from './EmailValidator.js';
+import { DatabaseContext } from '../utils/index.js';
+import { PersonToken } from '../type/index.js';
+import { AuthLogService } from './AuthLogService.js';
+interface MailOptions {
+    project?: string;
+    mailVariant?: string;
+}
+export declare class EmailChangeManager {
+    private readonly mailer;
+    private readonly projectManager;
+    private readonly emailValidator;
+    private readonly apiKeyManager;
+    private readonly permissionContextFactory;
+    constructor(mailer: UserMailer, projectManager: ProjectManager, emailValidator: EmailValidator, apiKeyManager: ApiKeyManager, permissionContextFactory: PermissionContextFactory);
+    /**
+     * Request an e-mail change. Validation and rate-limiting run BEFORE any
+     * write, so a rejected request never leaves a half-applied profile (e.g. a
+     * persisted name change without the e-mail change going through). Any
+     * immediate side-changes the caller wants applied atomically with the token
+     * (the name change) are passed via `applyWithinTransaction`.
+     */
+    requestEmailChange(dbContext: DatabaseContext, permissionContext: PermissionContext, person: PersonRow, newEmail: string, mailOptions?: MailOptions, applyWithinTransaction?: (db: DatabaseContext) => Promise<void>): Promise<RequestEmailChangeResponse>;
+    confirmEmailChange(dbContext: DatabaseContext, token: string): Promise<ConfirmEmailChangeResponse>;
+}
+export type RequestEmailChangeResponse = Response<null, EmailValidatorError | 'RATE_LIMIT_EXCEEDED'>;
+export type ConfirmEmailChangeResponse = Response<{
+    personId: string;
+    newEmail: string;
+    [AuthLogService.Key]: AuthLogService.Bag;
+}, PersonToken.TokenValidationError | EmailValidatorError, {
+    [AuthLogService.Key]: AuthLogService.Bag;
+}>;
+export {};
+//# sourceMappingURL=EmailChangeManager.d.ts.map

package/dist/types/model/service/EmailChangeManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailChangeManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/EmailChangeManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAA;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAQnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD,UAAU,WAAW;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,kBAAkB;IAE7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;gBAJxB,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,cAAc,EAC9B,aAAa,EAAE,aAAa,EAC5B,wBAAwB,EAAE,wBAAwB;IAGpE;;;;;;OAMG;IACU,kBAAkB,CAC9B,SAAS,EAAE,eAAe,EAC1B,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,WAAgB,EAC7B,sBAAsB,CAAC,EAAE,CAAC,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,GAC7D,OAAO,CAAC,0BAA0B,CAAC;IAgDzB,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC;CA6E/G;AAED,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,qBAAqB,CAAC,CAAA;AAEpG,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAChD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CAAE,EAChF,WAAW,CAAC,oBAAoB,GAAG,mBAAmB,EACtD;IAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CAAE,CAC5C,CAAA"}

package/dist/types/model/service/EmailOtpManager.d.ts

@@ -0,0 +1,45 @@
+import { PersonRow } from '../queries/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { Providers } from '../providers.js';
+import { UserMailer } from '../mailing/index.js';
+import { RateLimitDecision, RateLimiter } from './RateLimiter.js';
+import { Config } from '../type/Config.js';
+/**
+ * Email OTP as a second factor (A05). Opt-in per person via
+ * `person_mfa.email_otp_enabled`. The emitted code is a 6-digit numeric code,
+ * transported through a short-lived `mfa_email_otp` person_token (the code's hash
+ * lives in `otp_hash`), validated through the shared `'otp'` token path (max 3
+ * attempts). Behavior for anyone who hasn't enabled it is unchanged.
+ */
+export declare class EmailOtpManager {
+    private readonly mailer;
+    private readonly providers;
+    private readonly rateLimiter;
+    constructor(mailer: UserMailer, providers: Pick<Providers, 'randomBytes' | 'now' | 'uuid'>, rateLimiter: RateLimiter);
+    /**
+     * Generates a fresh code, invalidates any prior unused email-OTP tokens for the
+     * person, persists the new one and emails the code. Must run inside the request's
+     * db context (it issues commands + sends mail).
+     *
+     * Gated by the per-person `email_otp_per_person` rate limit so an attacker who
+     * knows the password cannot re-issue codes to reset the per-code 3-attempt
+     * counter, nor email-bomb a person. When the limit is hit nothing is sent and
+     * the returned decision is `ok: false` (the caller decides how to surface it);
+     * a previously emailed, still-valid code remains usable.
+     */
+    sendCode(dbContext: DatabaseContext, person: PersonRow, config: Config): Promise<RateLimitDecision>;
+    /**
+     * Fetches the latest unused email-OTP token for the person and validates the
+     * supplied code via the shared `'otp'` path; on success, consumes (invalidates)
+     * the token. Returns whether the code was accepted.
+     *
+     * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}
+     * — a single conditional UPDATE that increments `otp_attempts` only while it is
+     * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent
+     * writers on the row, N parallel guesses can never collectively exceed the cap;
+     * a plain read-then-increment let them all pass with a stale counter.
+     */
+    verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean>;
+    private generateCode;
+}
+//# sourceMappingURL=EmailOtpManager.d.ts.map

package/dist/types/model/service/EmailOtpManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailOtpManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/EmailOtpManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAmC,MAAM,mBAAmB,CAAA;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAGhD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEjE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAM1C;;;;;;GAMG;AACH,qBAAa,eAAe;IAE1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAFX,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,GAAG,KAAK,GAAG,MAAM,CAAC,EAC1D,WAAW,EAAE,WAAW;IAG1C;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmBzG;;;;;;;;;;OAUG;IACG,gBAAgB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YA0BvF,YAAY;CAU1B"}

package/dist/types/model/service/EmailValidator.d.ts

@@ -1,8 +1,9 @@
-import { DatabaseContext } from '../utils';
-import { ResponseError } from '../utils/Response';
+import { DatabaseContext } from '../utils/index.js';
+import { ResponseError } from '../utils/Response.js';
+import { PersonRow } from '../queries/index.js';
 export declare class EmailValidator {
     validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null>;
-    private isEmailAlreadyUsed;
+    findExistingPerson(db: DatabaseContext, email: string): Promise<PersonRow | null>;
 }
 export type EmailValidatorError = 'EMAIL_ALREADY_EXISTS' | 'INVALID_EMAIL_FORMAT';
 //# sourceMappingURL=EmailValidator.d.ts.map

package/dist/types/model/service/EmailValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EmailValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/EmailValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,qBAAa,cAAc;IACb,aAAa,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC;YAUpG,kBAAkB;CAIhC;AAED,MAAM,MAAM,mBAAmB,GAC5B,sBAAsB,GACtB,sBAAsB,CAAA"}
+{"version":3,"file":"EmailValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/EmailValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE5D,qBAAa,cAAc;IACb,aAAa,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC;IAUrG,kBAAkB,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;CAG9F;AAED,MAAM,MAAM,mBAAmB,GAC5B,sBAAsB,GACtB,sBAAsB,CAAA"}

package/dist/types/model/service/EmailVerificationManager.d.ts

@@ -0,0 +1,33 @@
+import { Response } from '../utils/Response.js';
+import { UserMailer } from '../mailing/index.js';
+import { PersonRow } from '../queries/index.js';
+import { PermissionContext } from '../authorization/index.js';
+import { ProjectManager } from './ProjectManager.js';
+import { DatabaseContext } from '../utils/index.js';
+import { PersonToken } from '../type/index.js';
+import { AuthLogService } from './AuthLogService.js';
+interface MailOptions {
+    project?: string;
+    mailVariant?: string;
+}
+export declare class EmailVerificationManager {
+    private readonly mailer;
+    private readonly projectManager;
+    constructor(mailer: UserMailer, projectManager: ProjectManager);
+    /**
+     * Sends a verification mail unless the per-email backoff says to hold off.
+     * Returns whether a mail was actually sent, so the caller only records an
+     * `email_verify_init` audit entry for mails that really went out — otherwise
+     * a throttled attempt would both tell the user to check their inbox and log
+     * a phantom init that pushes the backoff out further.
+     */
+    sendVerificationEmail(dbContext: DatabaseContext, permissionContext: PermissionContext, person: PersonRow, mailOptions?: MailOptions): Promise<boolean>;
+    verifyEmail(dbContext: DatabaseContext, token: string): Promise<VerifyEmailResponse>;
+}
+export type VerifyEmailResponse = Response<{
+    [AuthLogService.Key]: AuthLogService.Bag;
+}, PersonToken.TokenValidationError, {
+    [AuthLogService.Key]: AuthLogService.Bag;
+}>;
+export {};
+//# sourceMappingURL=EmailVerificationManager.d.ts.map

package/dist/types/model/service/EmailVerificationManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailVerificationManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/EmailVerificationManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAOnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD,UAAU,WAAW;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,wBAAwB;IAEnC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc;IAGhD;;;;;;OAMG;IACU,qBAAqB,CACjC,SAAS,EAAE,eAAe,EAC1B,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,SAAS,EACjB,WAAW,GAAE,WAAgB,GAC3B,OAAO,CAAC,OAAO,CAAC;IAmCN,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAsCjG;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CACzC;IAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CAAE,EAC5C,WAAW,CAAC,oBAAoB,EAChC;IAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CAAE,CAC5C,CAAA"}

package/dist/types/model/service/HibpChecker.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Looks up a password in the Have-I-Been-Pwned passwords corpus using its
+ * k-anonymity API: the client sends only the first 5 hex chars of the SHA-1
+ * hash, the server returns all matching suffixes plus counts.
+ *
+ * https://haveibeenpwned.com/API/v3#PwnedPasswords
+ *
+ * Implementations are expected to be fail-open: when the upstream is down or
+ * misbehaves, `isCompromised` should resolve to `false`, never throw.
+ */
+export interface HibpChecker {
+    isCompromised(password: string): Promise<boolean>;
+}
+export declare class HttpHibpChecker implements HibpChecker {
+    private readonly endpoint;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    constructor(endpoint?: string, fetchImpl?: typeof fetch, timeoutMs?: number);
+    isCompromised(password: string): Promise<boolean>;
+}
+/** Disabled checker — used when HIBP integration is turned off in tenant config. */
+export declare class NoopHibpChecker implements HibpChecker {
+    isCompromised(_password: string): Promise<boolean>;
+}
+//# sourceMappingURL=HibpChecker.d.ts.map

package/dist/types/model/service/HibpChecker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HibpChecker.d.ts","sourceRoot":"","sources":["../../../../src/model/service/HibpChecker.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC3B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACjD;AAED,qBAAa,eAAgB,YAAW,WAAW;IAEjD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,QAAQ,GAAE,MAAgD,EAC1D,SAAS,GAAE,OAAO,KAAa,EAC/B,SAAS,GAAE,MAAa;IAGpC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CA4BvD;AAED,oFAAoF;AACpF,qBAAa,eAAgB,YAAW,WAAW;IAC5C,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAGxD"}

package/dist/types/model/service/IDPSignInManager.d.ts

@@ -1,21 +1,27 @@
-import { ApiKeyManager } from './apiKey';
-import { PersonRow } from '../queries';
-import { IDPHandlerRegistry } from './idp';
-import { Response } from '../utils/Response';
-import { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema';
-import { DatabaseContext } from '../utils';
-import { AuthLogService } from './AuthLogService';
+import { ApiKeyManager } from './apiKey/index.js';
+import { PersonRow } from '../queries/index.js';
+import { IDPHandlerRegistry } from './idp/index.js';
+import { Response } from '../utils/Response.js';
+import { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { ApiKeyRequestInfo } from '../commands/index.js';
+import { AuthLogService } from './AuthLogService.js';
 declare class IDPSignInManager {
     private readonly apiKeyManager;
     private readonly idpRegistry;
     constructor(apiKeyManager: ApiKeyManager, idpRegistry: IDPHandlerRegistry);
-    signInIDP(dbContext: DatabaseContext, idpSlug: string, responseData: unknown, expiration?: number): Promise<IDPSignInManager.SignInIDPResponse>;
+    signInIDP(dbContext: DatabaseContext, idpSlug: string, responseData: unknown, expiration?: number, requestInfo?: ApiKeyRequestInfo, trustForwardedInfo?: boolean): Promise<IDPSignInManager.SignInIDPResponse>;
     initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse>;
     private resolvePerson;
     private signUp;
     private saveIdpIdentifier;
 }
 declare namespace IDPSignInManager {
+    export type ResolvePersonResult = {
+        readonly person: PersonRow | null;
+        readonly blockedReason?: 'idp_email_unverified';
+        readonly blockedPersonId?: string;
+    };
     export type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>;
     interface SignInIDPResult {
         readonly person: PersonRow;

package/dist/types/model/service/IDPSignInManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IDPSignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/IDPSignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAA8D,SAAS,EAAE,MAAM,YAAY,CAAA;AAClG,OAAO,EAAE,kBAAkB,EAAqD,MAAM,OAAO,CAAA;AAC7F,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAK1C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,cAAM,gBAAgB;IAEpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,kBAAkB;IAG3C,SAAS,CACd,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,OAAO,EACrB,UAAU,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,CAAC,iBAAiB,CAAC;IAqExC,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;YA0BlH,aAAa;YAwBb,MAAM;YAmBN,iBAAiB;CAG/B;AAED,kBAAU,gBAAgB,CAAC;IAC1B,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAA;IAEzF,UAAU,eAAe;QACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC9C,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC;IAED,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,eAAe,EAAE,kBAAkB,EAAE;QAC7E,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CAAC,CAAA;;CACF;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA"}
+{"version":3,"file":"IDPSignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/IDPSignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAA8D,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC3G,OAAO,EAAE,kBAAkB,EAAqD,MAAM,gBAAgB,CAAA;AACtG,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAA6F,MAAM,sBAAsB,CAAA;AAMnJ,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD,cAAM,gBAAgB;IAEpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,kBAAkB;IAG3C,SAAS,CACd,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,OAAO,EACrB,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,gBAAgB,CAAC,iBAAiB,CAAC;IAiHxC,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;YA0BlH,aAAa;YAoCb,MAAM;YAmBN,iBAAiB;CAG/B;AAED,kBAAU,gBAAgB,CAAC;IAC1B,MAAM,MAAM,mBAAmB,GAAG;QACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAA;QACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAA;QAC/C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KACjC,CAAA;IAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAA;IAEzF,UAAU,eAAe;QACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC9C,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC;IAED,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,eAAe,EAAE,kBAAkB,EAAE;QAC7E,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CAAC,CAAA;;CACF;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA"}

package/dist/types/model/service/InviteManager.d.ts

@@ -1,10 +1,10 @@
-import { Providers } from '../providers';
-import { PersonRow } from '../queries';
-import { Project, ProjectSchemaResolver } from '../type';
-import { InviteErrorCode, InviteMethod } from '../../schema';
-import { UserMailer } from '../mailing';
-import { Response } from '../utils/Response';
-import { DatabaseContext, TokenHash } from '../utils';
+import { Providers } from '../providers.js';
+import { PersonRow } from '../queries/index.js';
+import { Project, ProjectSchemaResolver } from '../type/index.js';
+import { InviteErrorCode, InviteMethod } from '../../schema/index.js';
+import { UserMailer } from '../mailing/index.js';
+import { Response } from '../utils/Response.js';
+import { DatabaseContext, TokenHash } from '../utils/index.js';
 import { Acl } from '@contember/schema';
 export interface InviteData {
     email: string;

package/dist/types/model/service/InviteManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"InviteManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/InviteManager.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAe,SAAS,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAIvC,MAAM,WAAW,UAAU;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,sBAAsB,CAAC,EAAE,SAAS,CAAA;CAClC;AAED,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBAFrB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,UAAU,EAClB,qBAAqB,EAAE,qBAAqB;IAGxD,MAAM,CACX,SAAS,EAAE,eAAe,EAC1B,EACC,KAAK,EACL,OAAO,EACP,IAAI,EACJ,WAAW,EACX,MAAM,EACN,YAAY,EACZ,OAAe,EACf,QAAQ,EACR,sBAAsB,GACtB,EAAE,UAAU,GACX,OAAO,CAAC,cAAc,CAAC;YA2DZ,mBAAmB;CAKjC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;AAEpE,qBAAa,YAAY;aACI,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;aAAkB,KAAK,EAAE,OAAO;gBAAhE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAkB,KAAK,EAAE,OAAO;CAC5F"}
+{"version":3,"file":"InviteManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/InviteManager.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE9D,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAIvC,MAAM,WAAW,UAAU;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,sBAAsB,CAAC,EAAE,SAAS,CAAA;CAClC;AAED,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBAFrB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,UAAU,EAClB,qBAAqB,EAAE,qBAAqB;IAGxD,MAAM,CACX,SAAS,EAAE,eAAe,EAC1B,EACC,KAAK,EACL,OAAO,EACP,IAAI,EACJ,WAAW,EACX,MAAM,EACN,YAAY,EACZ,OAAe,EACf,QAAQ,EACR,sBAAsB,GACtB,EAAE,UAAU,GACX,OAAO,CAAC,cAAc,CAAC;YA2DZ,mBAAmB;CAKjC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;AAEpE,qBAAa,YAAY;aACI,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;aAAkB,KAAK,EAAE,OAAO;gBAAhE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAkB,KAAK,EAAE,OAAO;CAC5F"}

package/dist/types/model/service/LoginRiskAnalyzer.d.ts

@@ -0,0 +1,97 @@
+import { BinaryLike } from 'node:crypto';
+import { DatabaseContext } from '../utils/index.js';
+import { Config } from '../type/Config.js';
+/**
+ * Risk weights per signal (A03 v1). Cumulative: a login from a new country on a
+ * new device scores HIGH + MEDIUM. Chosen so that the shipped default thresholds
+ * (email >= 1, step-up >= 3) map intuitively to "any single low signal emails,
+ * a high signal steps up".
+ */
+export declare const RiskWeight: {
+    /** New country (from the trusted reverse-proxy geo header). */
+    readonly newCountry: 3;
+    /** New user-agent fingerprint. */
+    readonly newDevice: 2;
+    /** New IP / IP-prefix. */
+    readonly newIpPrefix: 1;
+};
+export type RiskAction = 'allow' | 'email' | 'stepUp';
+/**
+ * Auth-log `type` values that represent a successful *interactive* sign-in which
+ * issued a session for the person from their own client — i.e. the rows whose
+ * geo/device/IP form the baseline for the next sign-in's anomaly check. Password
+ * (`login`), federated (`idp_login`), and magic-link (`passwordless_login`) all
+ * qualify. Deliberately excluded: `passwordless_login_exchange` (the OTP
+ * activation step issues no session) and `create_session_token` (an admin minting
+ * a token carries the admin's client info, not the person's).
+ */
+export declare const BASELINE_SIGN_IN_TYPES: readonly ["login", "idp_login", "passwordless_login"];
+export interface LoginSignals {
+    /** Country code from the trusted geo header, or null when unavailable. */
+    readonly geoCountry: string | null;
+    /** Hash of the client user-agent, or null when no UA was provided. */
+    readonly deviceFingerprint: string | null;
+    /** Client IP, or null when unavailable. */
+    readonly ip: string | null;
+}
+export interface PriorLogin {
+    readonly geoCountry: string | null;
+    readonly deviceFingerprint: string | null;
+    readonly ip: string | null;
+}
+export interface RiskAssessment {
+    readonly score: number;
+    readonly action: RiskAction;
+    /** Greppable list of which signals fired, e.g. ['new_country', 'new_device']. */
+    readonly reasons: readonly string[];
+}
+/**
+ * A03 — sign-in anomaly detection (v1). Runs after password verification (and any
+ * standing MFA), before a session is issued. Pure scoring lives in {@link score};
+ * {@link analyze} loads the comparison history and applies the configured policy.
+ *
+ * v1 scope (locked): no GeoIP DB — country comes from a trusted reverse-proxy
+ * header read through the same trust gate as the forwarded IP/UA. No
+ * impossible-travel detection. Opt-in, disabled by default.
+ */
+export declare class LoginRiskAnalyzer {
+    private readonly hash;
+    constructor(hash: (value: BinaryLike, algo: string) => Buffer);
+    /**
+     * Deterministic user-agent fingerprint: a hex sha256 of the raw UA. We never
+     * store the raw UA in a second column nor any cross-site fingerprint — just a
+     * stable hash so "same browser" comparisons work without retaining the string.
+     * Returns null for an absent/empty UA.
+     */
+    fingerprint(userAgent: string | undefined | null): string | null;
+    /**
+     * Pure scoring. Compares the current sign-in's signals against the set of prior
+     * successful logins. A signal fires only when (a) the current value is known,
+     * (b) a baseline for *that* signal exists in history — at least one prior login
+     * recorded a non-null value for it — and (c) the current value is absent from
+     * that baseline. With no history at all, or no baseline yet for a given signal
+     * (e.g. the geo header or device fingerprint only started being collected when
+     * the feature was enabled, so every prior row is null for it), that signal is
+     * treated as known. This keeps the documented "no baseline to deviate from →
+     * trusted" rule true per signal, so turning the feature on does not score every
+     * returning user's first login as anomalous.
+     */
+    score(current: LoginSignals, history: readonly PriorLogin[], config: Config['login']['anomalyDetection']): RiskAssessment;
+    private decide;
+    /**
+     * Loads the last N successful logins for the person and scores the current
+     * sign-in against them. Returns `allow` with no DB work when the feature is
+     * disabled (the default), so an opted-out deployment runs exactly as before.
+     */
+    analyze(dbContext: DatabaseContext, personId: string, current: LoginSignals, config: Config['login']['anomalyDetection']): Promise<RiskAssessment>;
+}
+/**
+ * Coarsens an IP to a prefix so a roaming client on the same network is treated
+ * as "known": /24 for IPv4, /48 for IPv6 (the typical site-allocation boundary).
+ * Returns null for an absent or unparseable address. Intentionally string-based
+ * to avoid pulling a parser onto the sign-in hot path, but the IPv6 form is fully
+ * canonicalized (lower-cased, leading zeros stripped, `::` expanded) so the same
+ * /48 written two different ways compares equal against stored values.
+ */
+export declare const ipPrefix: (ip: string | null) => string | null;
+//# sourceMappingURL=LoginRiskAnalyzer.d.ts.map

package/dist/types/model/service/LoginRiskAnalyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginRiskAnalyzer.d.ts","sourceRoot":"","sources":["../../../../src/model/service/LoginRiskAnalyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,UAAU;IACtB,+DAA+D;;IAE/D,kCAAkC;;IAElC,0BAA0B;;CAEjB,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,uDAAwD,CAAA;AAE3F,MAAM,WAAW,YAAY;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,sEAAsE;IACtE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM;IAGnE;;;;;OAKG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI;IAOhE;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,cAAc;IAqCzH,OAAO,CAAC,MAAM;IAYd;;;;OAIG;IACG,OAAO,CACZ,SAAS,EAAE,eAAe,EAC1B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,GACzC,OAAO,CAAC,cAAc,CAAC;CAiC1B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,GAAI,IAAI,MAAM,GAAG,IAAI,KAAG,MAAM,GAAG,IAoCrD,CAAA"}

package/dist/types/model/service/MailTemplateManager.d.ts

@@ -1,5 +1,5 @@
-import { MailTemplate, MailTemplateIdentifier } from '../mailing';
-import { DatabaseContext } from '../utils';
+import { MailTemplate, MailTemplateIdentifier } from '../mailing/index.js';
+import { DatabaseContext } from '../utils/index.js';
 export declare class MailTemplateManager {
     addMailTemplate(dbContext: DatabaseContext, mailTemplate: MailTemplate): Promise<void>;
     removeMailTemplate(dbContext: DatabaseContext, mailTemplateId: MailTemplateIdentifier): Promise<boolean>;

package/dist/types/model/service/MailTemplateManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/MailTemplateManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,qBAAa,mBAAmB;IAClB,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC;CAGrH"}
+{"version":3,"file":"MailTemplateManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/MailTemplateManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,qBAAa,mBAAmB;IAClB,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC;CAGrH"}

package/dist/types/model/service/MembershipValidator.d.ts

@@ -1,4 +1,4 @@
-import { ProjectSchemaResolver } from '../type';
+import { ProjectSchemaResolver } from '../type/index.js';
 import { MembershipResolver, MembershipValidationError, MembershipValidationErrorType } from '@contember/schema-utils';
 import { Acl } from '@contember/schema';
 export declare class MembershipValidator {

package/dist/types/model/service/MembershipValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/MembershipValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAC/C,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAA;AACtH,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,mBAAmB;IAE9B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,cAAc,EAAE,qBAAqB,EACrC,QAAQ,GAAE,kBAA6C;IAGnE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;CAO7G;AAED,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,CAAA"}
+{"version":3,"file":"MembershipValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/MembershipValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAA;AACtH,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,mBAAmB;IAE9B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,cAAc,EAAE,qBAAqB,EACrC,QAAQ,GAAE,kBAA6C;IAGnE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;CAO7G;AAED,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,CAAA"}

package/dist/types/model/service/OtpAuthenticator.d.ts

@@ -1,4 +1,4 @@
-import { Providers } from '../providers';
+import { Providers } from '../providers.js';
 export interface OtpData {
     secret: string;
     uri: string;

package/dist/types/model/service/OtpAuthenticator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OtpAuthenticator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/OtpAuthenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAGxC,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACX;AAID,qBAAa,gBAAgB;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,aAAa,CAAC;IAI5D,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAUpD,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAQ9B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAYlE;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA"}
+{"version":3,"file":"OtpAuthenticator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/OtpAuthenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAG3C,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACX;AAID,qBAAa,gBAAgB;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,aAAa,CAAC;IAI5D,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAUpD,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAQ9B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAYlE;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA"}