@endora-commerce/mod-mfa 0.100.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Endora sp. z o.o. and the Endora Commerce contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,58 @@
+# MFA module (feature 042)
+
+Two-factor authentication (TOTP + recovery codes) and federated sign-in
+(Google / Microsoft) for both the Storefront (customer accounts) and the
+Admin UI (admin users).
+
+See `specs/042-mfa-authentication/` for the full spec, plan, data model, and
+contracts.
+
+## Status
+
+Complete (US1–US6). Capabilities:
+
+- **TOTP 2FA** (enrol / activate / disable / regenerate / status) on both
+  surfaces, with single-use recovery codes and a replay-guarded second step.
+- **Two-step login** — credential step returns `authenticated` |
+  `mfaRequired` | `mfaSetupRequired`; a separate verify step issues the session.
+- **Enforcement** — per-scope settings (admin global; storefront global/channel)
+  and per-organization policy (org-admin + platform-admin); enforced-but-
+  unenrolled accounts enrol via a setup ticket at login.
+- **Federated sign-in** — Google / Microsoft (OIDC via `openid-client`);
+  storefront auto-creates a standalone account, admin matches existing only.
+- **Admin reset** — single account + organization-wide.
+
+Self-service setup is gated on the per-scope "2FA enabled" setting (FR-001).
+
+## Routes (by file)
+
+- `routes.public.ts` — second-step verify + setup-ticket begin/complete (both surfaces)
+- `routes.self-service.ts` — `/{account,admin/account}/mfa/*` (setup/activate/disable/regenerate/status)
+- `routes.oauth.ts` — `/auth/{customer,admin}/oauth/:provider/{start,callback}`
+- `routes.org.ts` — storefront org-admin enforcement
+- `routes.admin.ts` — platform-admin reset (single/bulk) + org enforcement
+
+## Notable decisions
+
+- **TOTP**: reuses the existing `otpauth` dependency (no new dep). New
+  dependency `openid-client` is for Google/Microsoft OIDC (research §R2).
+- **Secret at rest**: AES-256-GCM (`SecretCipher`), key from
+  `MFA_SECRET_ENCRYPTION_KEY` (base64, 32 bytes). Recovery codes are stored as
+  SHA-256 hashes only.
+- **Ephemeral login state**: Redis (`ChallengeStore`) — pending-login
+  challenge, setup ticket, OAuth transaction — all TTL-bounded.
+- **Module name `mfa`**: a singular acronym; a documented Principle VI
+  carve-out (see plan Complexity Tracking).
+- **Removability** (Principle I): login services consult MFA through an
+  injected port; absent ⇒ password-only fallback. The legacy
+  `*.two_factor_secret` columns are superseded by `mfa_enrolments` and left
+  dormant (research §R8) — dropping them is tracked tech-debt.
+
+## Environment
+
+| Var | Purpose |
+|---|---|
+| `MFA_SECRET_ENCRYPTION_KEY` | base64-encoded 32-byte AES key for TOTP secrets |
+| `MFA_OAUTH_GOOGLE_CLIENT_ID` / `_SECRET` | Google OIDC client |
+| `MFA_OAUTH_MICROSOFT_CLIENT_ID` / `_SECRET` | Microsoft Entra OIDC client |
+| `MFA_OAUTH_*_REDIRECT_URI` | per-surface callback URLs |

package/dist/admin/index.d.ts

@@ -0,0 +1,37 @@
+/**
+ * `mfa`' admin surface — one route and no sidebar entry, declared by the module
+ * that owns it (feature 091, Phase 4, batch four;
+ * `specs/091-module-owned-admin-surfaces/contracts/admin-contribution.md`).
+ *
+ * **The nav-less shape, and it is the reason this module is in the batch.**
+ * Batch two rejected `mfa` on the ground that it contributes no sidebar entry,
+ * so *"half the ratchet would not move and half the evidence would be
+ * missing"*. `plan.md`'s Ruling 1 measured that as sound pilot-evidence
+ * reasoning and wrong as a selection rule: `admin/src/App.tsx`'s `ModuleRoute`
+ * gates **every** registry-contributed route on `useSurfaceVisibility` — both
+ * axes, rendering `NotFoundPage` — so a nav-less module's off-state proof is
+ * driven over the **route**, which is what an operator following a stale deep
+ * link actually meets. `admin/test/modules/mfa.module-owned-surface.test.tsx`
+ * is that proof, and the ratchet's `{ routes: 1, nav: 0 }` entry is removed
+ * like any other: a zero that stays zero is a passing assertion, not a missing
+ * one.
+ *
+ * **The route carries no `requiredPermission`, and that is read from the route
+ * rather than guessed.** `/security` is the signed-in admin's own two-factor
+ * self-service (`packages/modules/mfa/src/backend/routes.self-service.ts`), and
+ * every one of its six endpoints is gated by the bare admin guard —
+ * `{ preHandler: requireGuard }`, no `requireAdmin(...)` anywhere. An operator
+ * manages their own second factor; there is no permission code that could gate
+ * it without locking somebody out of their own account. So the declaration
+ * omits the field, `isSurfaceVisible` treats an absent requirement as
+ * satisfied, and the module's presence is the whole of the gate.
+ *
+ * **This entry exports data and nothing else** (R2), like every `./admin`
+ * layer: `check:module-boundary`'s D-171 rule designates a subpath as contract
+ * surface when it emits no runtime binding, and `./admin` deliberately does not
+ * qualify, so a consumer reaching into another module's `./admin` stays a
+ * counted boundary reach.
+ */
+import type { AdminContributions } from '@endora-commerce/admin-kit/contributions';
+export declare const contributions: AdminContributions;
+//# sourceMappingURL=index.d.ts.map

package/dist/admin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAKnF,eAAO,MAAM,aAAa,EAAE,kBAQ3B,CAAC"}

package/dist/admin/index.js

@@ -0,0 +1,12 @@
+/** The module's only admin route: the signed-in admin's own 2FA settings. */
+const ROUTE_PATH = '/security';
+export const contributions = {
+    routes: [
+        {
+            path: ROUTE_PATH,
+            component: () => import('./pages/AdminSecuritySettings.js'),
+            index: true,
+        },
+    ],
+};
+//# sourceMappingURL=index.js.map

package/dist/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAoCA,6EAA6E;AAC7E,MAAM,UAAU,GAAG,WAAW,CAAC;AAE/B,MAAM,CAAC,MAAM,aAAa,GAAuB;IAC/C,MAAM,EAAE;QACN;YACE,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,kCAAkC,CAAC;YAC3D,KAAK,EAAE,IAAI;SACZ;KACF;CACF,CAAC"}

package/dist/admin/pages/AdminSecuritySettings.d.ts

@@ -0,0 +1,3 @@
+import { type ReactNode } from 'react';
+export default function AdminSecuritySettings(): ReactNode;
+//# sourceMappingURL=AdminSecuritySettings.d.ts.map

package/dist/admin/pages/AdminSecuritySettings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminSecuritySettings.d.ts","sourceRoot":"","sources":["../../../src/admin/pages/AdminSecuritySettings.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AA+BzF,MAAM,CAAC,OAAO,UAAU,qBAAqB,IAAI,SAAS,CAmKzD"}

package/dist/admin/pages/AdminSecuritySettings.js

@@ -0,0 +1,71 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useEffect, useState } from 'react';
+import { ShieldCheck, ShieldAlert } from 'lucide-react';
+import { Alert, AlertDescription, AlertTitle, Button, Card, CardContent, CardDescription, CardHeader, CardTitle, Input, Label, } from '@endora-commerce/admin-kit/ui';
+import { ApiError, apiClient } from '@endora-commerce/admin-kit/lib';
+const BASE = '/api/v1/admin/account/mfa';
+export default function AdminSecuritySettings() {
+    const [status, setStatus] = useState(null);
+    const [setup, setSetup] = useState(null);
+    const [recoveryCodes, setRecoveryCodes] = useState(null);
+    const [code, setCode] = useState('');
+    const [error, setError] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const loadStatus = useCallback(async () => {
+        const res = await apiClient.get(`${BASE}/status`);
+        setStatus(res.data);
+    }, []);
+    useEffect(() => {
+        void loadStatus();
+    }, [loadStatus]);
+    const run = useCallback(async (fn) => {
+        setBusy(true);
+        setError(null);
+        try {
+            await fn();
+        }
+        catch (err) {
+            setError(err instanceof ApiError ? err.envelope.error.message : 'Something went wrong.');
+        }
+        finally {
+            setBusy(false);
+        }
+    }, []);
+    const startSetup = () => void run(async () => {
+        const res = await apiClient.post(`${BASE}/setup`);
+        setSetup(res.data);
+        setRecoveryCodes(null);
+    });
+    const confirm = (e) => {
+        e.preventDefault();
+        void run(async () => {
+            const res = await apiClient.post(`${BASE}/activate`, {
+                code,
+            });
+            setRecoveryCodes(res.data.recoveryCodes);
+            setSetup(null);
+            setCode('');
+            await loadStatus();
+        });
+    };
+    const disable = (e) => {
+        e.preventDefault();
+        void run(async () => {
+            await apiClient.post(`${BASE}/disable`, { code });
+            setCode('');
+            setRecoveryCodes(null);
+            await loadStatus();
+        });
+    };
+    const regenerate = (e) => {
+        e.preventDefault();
+        void run(async () => {
+            const res = await apiClient.post(`${BASE}/recovery-codes/regenerate`, { code });
+            setRecoveryCodes(res.data.recoveryCodes);
+            setCode('');
+            await loadStatus();
+        });
+    };
+    return (_jsx("div", { className: "mx-auto max-w-2xl space-y-6 p-4", children: _jsxs(Card, { children: [_jsxs(CardHeader, { children: [_jsxs(CardTitle, { className: "flex items-center gap-2 text-lg", children: [_jsx(ShieldCheck, { className: "size-5 text-primary" }), "Two-factor authentication"] }), _jsx(CardDescription, { children: "Protect your admin account with a time-based code from an authenticator app." })] }), _jsxs(CardContent, { className: "space-y-4", children: [error ? (_jsxs(Alert, { variant: "destructive", children: [_jsx(ShieldAlert, { className: "size-4" }), _jsx(AlertTitle, { children: "Error" }), _jsx(AlertDescription, { children: error })] })) : null, recoveryCodes ? (_jsxs(Alert, { children: [_jsx(AlertTitle, { children: "Save your recovery codes" }), _jsxs(AlertDescription, { children: [_jsx("p", { children: "Each code works once. They are shown only now." }), _jsx("ul", { className: "mt-2 grid grid-cols-2 gap-1 font-mono text-sm", children: recoveryCodes.map((c) => (_jsx("li", { children: c }, c))) })] })] })) : null, status === null ? (_jsx("p", { className: "text-sm text-muted-foreground", children: "Loading\u2026" })) : status.totpActive ? (_jsxs("div", { className: "space-y-6", children: [_jsxs("p", { className: "text-sm", children: ["2FA is ", _jsx("strong", { children: "enabled" }), ". Unused recovery codes: ", status.recoveryCodesRemaining, "."] }), _jsxs("form", { className: "space-y-2", onSubmit: disable, children: [_jsx(Label, { htmlFor: "disable-code", children: "Enter a current code to disable 2FA" }), _jsx(Input, { id: "disable-code", value: code, onChange: (e) => setCode(e.target.value), required: true }), _jsx(Button, { type: "submit", variant: "destructive", disabled: busy, children: "Disable 2FA" })] }), _jsxs("form", { className: "space-y-2", onSubmit: regenerate, children: [_jsx(Label, { htmlFor: "regen-code", children: "Enter a current code to regenerate recovery codes" }), _jsx(Input, { id: "regen-code", value: code, onChange: (e) => setCode(e.target.value), required: true }), _jsx(Button, { type: "submit", variant: "outline", disabled: busy, children: "Regenerate recovery codes" })] })] })) : setup ? (_jsxs("form", { className: "space-y-3", onSubmit: confirm, children: [_jsx("p", { className: "text-sm", children: "Add this account to your authenticator app:" }), _jsx("p", { className: "break-all rounded bg-muted px-2 py-1 font-mono text-xs", children: setup.otpauthUri }), _jsxs("p", { className: "text-sm", children: ["Manual key: ", _jsx("code", { className: "font-mono", children: setup.secret })] }), _jsx(Label, { htmlFor: "confirm-code", children: "Enter the 6-digit code to confirm" }), _jsx(Input, { id: "confirm-code", inputMode: "numeric", value: code, onChange: (e) => setCode(e.target.value), required: true, placeholder: "123456" }), _jsx(Button, { type: "submit", disabled: busy, children: "Confirm and enable" })] })) : (_jsx(Button, { onClick: startSetup, disabled: busy, children: "Enable 2FA" }))] })] }) }));
+}
+//# sourceMappingURL=AdminSecuritySettings.js.map

package/dist/admin/pages/AdminSecuritySettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminSecuritySettings.js","sourceRoot":"","sources":["../../../src/admin/pages/AdminSecuritySettings.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAkC,MAAM,OAAO,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EACL,KAAK,EACL,gBAAgB,EAChB,UAAU,EACV,MAAM,EACN,IAAI,EACJ,WAAW,EACX,eAAe,EACf,UAAU,EACV,SAAS,EACT,KAAK,EACL,KAAK,GACN,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAcrE,MAAM,IAAI,GAAG,2BAA2B,CAAC;AAEzC,MAAM,CAAC,OAAO,UAAU,qBAAqB;IAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAmB,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgD,IAAI,CAAC,CAAC;IACxF,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAkB,IAAI,CAAC,CAAC;IAC1E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAExC,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACvD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAsB,GAAG,IAAI,SAAS,CAAC,CAAC;QACvE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,UAAU,EAAE,CAAC;IACpB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,GAAG,GAAG,WAAW,CACrB,KAAK,EAAE,EAAuB,EAAiB,EAAE;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAC3F,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,GAAS,EAAE,CAC5B,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAC9B,GAAG,IAAI,QAAQ,CAChB,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,GAAG,CAAC,CAAY,EAAQ,EAAE;QACrC,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;YAClB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAwC,GAAG,IAAI,WAAW,EAAE;gBAC1F,IAAI;aACL,CAAC,CAAC;YACH,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,OAAO,CAAC,EAAE,CAAC,CAAC;YACZ,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,CAAY,EAAQ,EAAE;QACrC,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;YAClB,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,EAAE,CAAC,CAAC;YACZ,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,CAAY,EAAQ,EAAE;QACxC,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;YAClB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAC9B,GAAG,IAAI,4BAA4B,EACnC,EAAE,IAAI,EAAE,CACT,CAAC;YACF,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACzC,OAAO,CAAC,EAAE,CAAC,CAAC;YACZ,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,CACL,cAAK,SAAS,EAAC,iCAAiC,YAC9C,MAAC,IAAI,eACH,MAAC,UAAU,eACT,MAAC,SAAS,IAAC,SAAS,EAAC,iCAAiC,aACpD,KAAC,WAAW,IAAC,SAAS,EAAC,qBAAqB,GAAG,iCAErC,EACZ,KAAC,eAAe,+FAEE,IACP,EACb,MAAC,WAAW,IAAC,SAAS,EAAC,WAAW,aAC/B,KAAK,CAAC,CAAC,CAAC,CACP,MAAC,KAAK,IAAC,OAAO,EAAC,aAAa,aAC1B,KAAC,WAAW,IAAC,SAAS,EAAC,QAAQ,GAAG,EAClC,KAAC,UAAU,wBAAmB,EAC9B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,IACtC,CACT,CAAC,CAAC,CAAC,IAAI,EAEP,aAAa,CAAC,CAAC,CAAC,CACf,MAAC,KAAK,eACJ,KAAC,UAAU,2CAAsC,EACjD,MAAC,gBAAgB,eACf,yEAAqD,EACrD,aAAI,SAAS,EAAC,+CAA+C,YAC1D,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACxB,uBAAa,CAAC,IAAL,CAAC,CAAU,CACrB,CAAC,GACC,IACY,IACb,CACT,CAAC,CAAC,CAAC,IAAI,EAEP,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CACjB,YAAG,SAAS,EAAC,+BAA+B,8BAAa,CAC1D,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CACtB,eAAK,SAAS,EAAC,WAAW,aACxB,aAAG,SAAS,EAAC,SAAS,wBACb,uCAAwB,+BAA0B,MAAM,CAAC,sBAAsB,SACpF,EACJ,gBAAM,SAAS,EAAC,WAAW,EAAC,QAAQ,EAAE,OAAO,aAC3C,KAAC,KAAK,IAAC,OAAO,EAAC,cAAc,oDAA4C,EACzE,KAAC,KAAK,IAAC,EAAE,EAAC,cAAc,EAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,EACjG,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,aAAa,EAAC,QAAQ,EAAE,IAAI,4BAEjD,IACJ,EACP,gBAAM,SAAS,EAAC,WAAW,EAAC,QAAQ,EAAE,UAAU,aAC9C,KAAC,KAAK,IAAC,OAAO,EAAC,YAAY,kEAA0D,EACrF,KAAC,KAAK,IAAC,EAAE,EAAC,YAAY,EAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,EAC/F,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAC,SAAS,EAAC,QAAQ,EAAE,IAAI,0CAE7C,IACJ,IACH,CACP,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CACV,gBAAM,SAAS,EAAC,WAAW,EAAC,QAAQ,EAAE,OAAO,aAC3C,YAAG,SAAS,EAAC,SAAS,4DAAgD,EACtE,YAAG,SAAS,EAAC,wDAAwD,YAAE,KAAK,CAAC,UAAU,GAAK,EAC5F,aAAG,SAAS,EAAC,SAAS,6BACR,eAAM,SAAS,EAAC,WAAW,YAAE,KAAK,CAAC,MAAM,GAAQ,IAC3D,EACJ,KAAC,KAAK,IAAC,OAAO,EAAC,cAAc,kDAA0C,EACvE,KAAC,KAAK,IACJ,EAAE,EAAC,cAAc,EACjB,SAAS,EAAC,SAAS,EACnB,KAAK,EAAE,IAAI,EACX,QAAQ,EAAE,CAAC,CAAC,EAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC9C,QAAQ,QACR,WAAW,EAAC,QAAQ,GACpB,EACF,KAAC,MAAM,IAAC,IAAI,EAAC,QAAQ,EAAC,QAAQ,EAAE,IAAI,mCAE3B,IACJ,CACR,CAAC,CAAC,CAAC,CACF,KAAC,MAAM,IAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,2BAElC,CACV,IACW,IACT,GACH,CACP,CAAC;AACJ,CAAC"}

package/dist/backend/entities/mfa-enrolment.entity.d.ts

@@ -0,0 +1,33 @@
+import { OptionalProps } from '@mikro-orm/core';
+/**
+ * Per-account TOTP enrolment (feature 042). At most one `active` row per
+ * subject (enforced by a partial unique index, see migration 067).
+ *
+ * The subject is polymorphic across the two identity stores
+ * (`customer_accounts` / `admin_users`); no DB FK is declared to those tables
+ * to keep the `mfa` module isolated (Constitution Principle I). The TOTP
+ * secret is stored encrypted at rest (AES-256-GCM); the plaintext base32
+ * secret never touches the database.
+ */
+export declare class MfaEnrolment {
+    [OptionalProps]?: 'id' | 'status' | 'lastAcceptedStep' | 'confirmedAt' | 'createdAt' | 'updatedAt';
+    id: string;
+    /** `'customer'` | `'admin'`. */
+    subjectType: string;
+    /** `customer_accounts.id` or `admin_users.id` — service-enforced, no DB FK. */
+    subjectId: string;
+    /** `'pending'` (setup started, unconfirmed) | `'active'`. */
+    status: string;
+    /** AES-256-GCM ciphertext of the base32 TOTP secret. */
+    secretCiphertext: Buffer;
+    /** GCM initialisation vector (per row). */
+    secretIv: Buffer;
+    /** GCM authentication tag. */
+    secretAuthTag: Buffer;
+    /** Last accepted TOTP time-step — guards against in-window replay. */
+    lastAcceptedStep?: string | null;
+    confirmedAt?: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+//# sourceMappingURL=mfa-enrolment.entity.d.ts.map

package/dist/backend/entities/mfa-enrolment.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-enrolment.entity.d.ts","sourceRoot":"","sources":["../../../src/backend/entities/mfa-enrolment.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,aAAa,EAAwB,MAAM,iBAAiB,CAAC;AAIrF;;;;;;;;;GASG;AACH,qBAEa,YAAY;IACvB,CAAC,aAAa,CAAC,CAAC,EACZ,IAAI,GACJ,QAAQ,GACR,kBAAkB,GAClB,aAAa,GACb,WAAW,GACX,WAAW,CAAC;IAGhB,EAAE,EAAE,MAAM,CAAgB;IAE1B,gCAAgC;IAGhC,WAAW,EAAG,MAAM,CAAC;IAErB,+EAA+E;IAG/E,SAAS,EAAG,MAAM,CAAC;IAEnB,6DAA6D;IAE7D,MAAM,EAAE,MAAM,CAAa;IAE3B,wDAAwD;IAExD,gBAAgB,EAAG,MAAM,CAAC;IAE1B,2CAA2C;IAE3C,QAAQ,EAAG,MAAM,CAAC;IAElB,8BAA8B;IAE9B,aAAa,EAAG,MAAM,CAAC;IAEvB,sEAAsE;IAEtE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGjC,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAG1B,SAAS,EAAE,IAAI,CAAc;IAG7B,SAAS,EAAE,IAAI,CAAc;CAC9B"}

package/dist/backend/entities/mfa-enrolment.entity.js

@@ -0,0 +1,95 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Entity, Index, OptionalProps, PrimaryKey, Property } from '@mikro-orm/core';
+import { GlobalEntity } from '@endora-commerce/platform/tenancy';
+import { randomUUID } from 'crypto';
+/**
+ * Per-account TOTP enrolment (feature 042). At most one `active` row per
+ * subject (enforced by a partial unique index, see migration 067).
+ *
+ * The subject is polymorphic across the two identity stores
+ * (`customer_accounts` / `admin_users`); no DB FK is declared to those tables
+ * to keep the `mfa` module isolated (Constitution Principle I). The TOTP
+ * secret is stored encrypted at rest (AES-256-GCM); the plaintext base32
+ * secret never touches the database.
+ */
+let MfaEnrolment = class MfaEnrolment {
+    [OptionalProps];
+    id = randomUUID();
+    /** `'customer'` | `'admin'`. */
+    subjectType;
+    /** `customer_accounts.id` or `admin_users.id` — service-enforced, no DB FK. */
+    subjectId;
+    /** `'pending'` (setup started, unconfirmed) | `'active'`. */
+    status = 'pending';
+    /** AES-256-GCM ciphertext of the base32 TOTP secret. */
+    secretCiphertext;
+    /** GCM initialisation vector (per row). */
+    secretIv;
+    /** GCM authentication tag. */
+    secretAuthTag;
+    /** Last accepted TOTP time-step — guards against in-window replay. */
+    lastAcceptedStep;
+    confirmedAt;
+    createdAt = new Date();
+    updatedAt = new Date();
+};
+__decorate([
+    PrimaryKey({ type: 'uuid' }),
+    __metadata("design:type", String)
+], MfaEnrolment.prototype, "id", void 0);
+__decorate([
+    Property({ type: 'string', length: 16 }),
+    Index(),
+    __metadata("design:type", String)
+], MfaEnrolment.prototype, "subjectType", void 0);
+__decorate([
+    Property({ type: 'uuid' }),
+    Index(),
+    __metadata("design:type", String)
+], MfaEnrolment.prototype, "subjectId", void 0);
+__decorate([
+    Property({ type: 'string', length: 16 }),
+    __metadata("design:type", String)
+], MfaEnrolment.prototype, "status", void 0);
+__decorate([
+    Property({ type: 'bytea' }),
+    __metadata("design:type", Buffer)
+], MfaEnrolment.prototype, "secretCiphertext", void 0);
+__decorate([
+    Property({ type: 'bytea' }),
+    __metadata("design:type", Buffer)
+], MfaEnrolment.prototype, "secretIv", void 0);
+__decorate([
+    Property({ type: 'bytea' }),
+    __metadata("design:type", Buffer)
+], MfaEnrolment.prototype, "secretAuthTag", void 0);
+__decorate([
+    Property({ type: 'bigint', nullable: true }),
+    __metadata("design:type", Object)
+], MfaEnrolment.prototype, "lastAcceptedStep", void 0);
+__decorate([
+    Property({ type: 'datetime', nullable: true }),
+    __metadata("design:type", Object)
+], MfaEnrolment.prototype, "confirmedAt", void 0);
+__decorate([
+    Property({ type: 'datetime', onCreate: () => new Date() }),
+    __metadata("design:type", Date)
+], MfaEnrolment.prototype, "createdAt", void 0);
+__decorate([
+    Property({ type: 'datetime', onUpdate: () => new Date() }),
+    __metadata("design:type", Date)
+], MfaEnrolment.prototype, "updatedAt", void 0);
+MfaEnrolment = __decorate([
+    GlobalEntity(),
+    Entity({ tableName: 'mfa_enrolments' })
+], MfaEnrolment);
+export { MfaEnrolment };
+//# sourceMappingURL=mfa-enrolment.entity.js.map

package/dist/backend/entities/mfa-enrolment.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-enrolment.entity.js","sourceRoot":"","sources":["../../../src/backend/entities/mfa-enrolment.entity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;;;;;;GASG;AAGI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACvB,CAAC,aAAa,CAAC,CAMC;IAGhB,EAAE,GAAW,UAAU,EAAE,CAAC;IAE1B,gCAAgC;IAGhC,WAAW,CAAU;IAErB,+EAA+E;IAG/E,SAAS,CAAU;IAEnB,6DAA6D;IAE7D,MAAM,GAAW,SAAS,CAAC;IAE3B,wDAAwD;IAExD,gBAAgB,CAAU;IAE1B,2CAA2C;IAE3C,QAAQ,CAAU;IAElB,8BAA8B;IAE9B,aAAa,CAAU;IAEvB,sEAAsE;IAEtE,gBAAgB,CAAiB;IAGjC,WAAW,CAAe;IAG1B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;IAG7B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;CAC9B,CAAA;AAxCC;IADC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;wCACH;AAK1B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxC,KAAK,EAAE;;iDACa;AAKrB;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE;;+CACW;AAInB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;4CACd;AAI3B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;8BACT,MAAM;sDAAC;AAI1B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;8BACjB,MAAM;8CAAC;AAIlB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;8BACZ,MAAM;mDAAC;AAIvB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACZ;AAGjC;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACrB;AAG1B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;+CAAc;AAG7B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;+CAAc;AAjDlB,YAAY;IAFxB,YAAY,EAAE;IACd,MAAM,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;GAC3B,YAAY,CAkDxB"}

package/dist/backend/entities/mfa-organization-policy.entity.d.ts

@@ -0,0 +1,19 @@
+import { OptionalProps } from '@mikro-orm/core';
+/**
+ * Per-Organization 2FA enforcement flag (feature 042, FR-014). Managed by
+ * Organization Administrators (storefront) and Platform Administrators
+ * (admin). Owned by the `mfa` module for removability; `organizationId`
+ * references the organizations module by value (no hard FK) to preserve
+ * module isolation (Constitution Principle I). Absence of a row ⇒ not enforced.
+ */
+export declare class MfaOrganizationPolicy {
+    [OptionalProps]?: 'id' | 'enforceTotp' | 'updatedByActor' | 'createdAt' | 'updatedAt';
+    id: string;
+    organizationId: string;
+    enforceTotp: boolean;
+    /** Audit hint — admin user id or org-admin customer id that last changed it. */
+    updatedByActor?: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+//# sourceMappingURL=mfa-organization-policy.entity.d.ts.map

package/dist/backend/entities/mfa-organization-policy.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-organization-policy.entity.d.ts","sourceRoot":"","sources":["../../../src/backend/entities/mfa-organization-policy.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,aAAa,EAAgC,MAAM,iBAAiB,CAAC;AAItF;;;;;;GAMG;AACH,qBAEa,qBAAqB;IAChC,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,GAAG,aAAa,GAAG,gBAAgB,GAAG,WAAW,GAAG,WAAW,CAAC;IAGtF,EAAE,EAAE,MAAM,CAAgB;IAI1B,cAAc,EAAG,MAAM,CAAC;IAGxB,WAAW,EAAE,OAAO,CAAS;IAE7B,gFAAgF;IAEhF,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG/B,SAAS,EAAE,IAAI,CAAc;IAG7B,SAAS,EAAE,IAAI,CAAc;CAC9B"}

package/dist/backend/entities/mfa-organization-policy.entity.js

@@ -0,0 +1,60 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Entity, OptionalProps, PrimaryKey, Property, Unique } from '@mikro-orm/core';
+import { GlobalEntity } from '@endora-commerce/platform/tenancy';
+import { randomUUID } from 'crypto';
+/**
+ * Per-Organization 2FA enforcement flag (feature 042, FR-014). Managed by
+ * Organization Administrators (storefront) and Platform Administrators
+ * (admin). Owned by the `mfa` module for removability; `organizationId`
+ * references the organizations module by value (no hard FK) to preserve
+ * module isolation (Constitution Principle I). Absence of a row ⇒ not enforced.
+ */
+let MfaOrganizationPolicy = class MfaOrganizationPolicy {
+    [OptionalProps];
+    id = randomUUID();
+    organizationId;
+    enforceTotp = false;
+    /** Audit hint — admin user id or org-admin customer id that last changed it. */
+    updatedByActor;
+    createdAt = new Date();
+    updatedAt = new Date();
+};
+__decorate([
+    PrimaryKey({ type: 'uuid' }),
+    __metadata("design:type", String)
+], MfaOrganizationPolicy.prototype, "id", void 0);
+__decorate([
+    Property({ type: 'uuid' }),
+    Unique(),
+    __metadata("design:type", String)
+], MfaOrganizationPolicy.prototype, "organizationId", void 0);
+__decorate([
+    Property({ type: 'boolean' }),
+    __metadata("design:type", Boolean)
+], MfaOrganizationPolicy.prototype, "enforceTotp", void 0);
+__decorate([
+    Property({ type: 'string', length: 64, nullable: true }),
+    __metadata("design:type", Object)
+], MfaOrganizationPolicy.prototype, "updatedByActor", void 0);
+__decorate([
+    Property({ type: 'datetime', onCreate: () => new Date() }),
+    __metadata("design:type", Date)
+], MfaOrganizationPolicy.prototype, "createdAt", void 0);
+__decorate([
+    Property({ type: 'datetime', onUpdate: () => new Date() }),
+    __metadata("design:type", Date)
+], MfaOrganizationPolicy.prototype, "updatedAt", void 0);
+MfaOrganizationPolicy = __decorate([
+    GlobalEntity(),
+    Entity({ tableName: 'mfa_organization_policies' })
+], MfaOrganizationPolicy);
+export { MfaOrganizationPolicy };
+//# sourceMappingURL=mfa-organization-policy.entity.js.map

package/dist/backend/entities/mfa-organization-policy.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-organization-policy.entity.js","sourceRoot":"","sources":["../../../src/backend/entities/mfa-organization-policy.entity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;;;GAMG;AAGI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,CAAC,aAAa,CAAC,CAAuE;IAGtF,EAAE,GAAW,UAAU,EAAE,CAAC;IAI1B,cAAc,CAAU;IAGxB,WAAW,GAAY,KAAK,CAAC;IAE7B,gFAAgF;IAEhF,cAAc,CAAiB;IAG/B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;IAG7B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;CAC9B,CAAA;AAlBC;IADC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;iDACH;AAI1B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE;;6DACe;AAGxB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;0DACD;AAI7B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6DAC1B;AAG/B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;wDAAc;AAG7B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;wDAAc;AArBlB,qBAAqB;IAFjC,YAAY,EAAE;IACd,MAAM,CAAC,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC;GACtC,qBAAqB,CAsBjC"}

package/dist/backend/entities/mfa-recovery-code.entity.d.ts

@@ -0,0 +1,17 @@
+import { OptionalProps } from '@mikro-orm/core';
+/**
+ * Single-use backup code for a TOTP enrolment (feature 042). Stored only as a
+ * SHA-256 hash; the plaintext is shown once at activation/regeneration.
+ * Cascade-deleted with its parent enrolment (FK declared in migration 067).
+ */
+export declare class MfaRecoveryCode {
+    [OptionalProps]?: 'id' | 'usedAt' | 'createdAt';
+    id: string;
+    enrolmentId: string;
+    /** SHA-256 hex of the plaintext recovery code. */
+    codeHash: string;
+    /** Set when the code is consumed; a used code is never re-accepted. */
+    usedAt?: Date | null;
+    createdAt: Date;
+}
+//# sourceMappingURL=mfa-recovery-code.entity.d.ts.map

package/dist/backend/entities/mfa-recovery-code.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-recovery-code.entity.d.ts","sourceRoot":"","sources":["../../../src/backend/entities/mfa-recovery-code.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,aAAa,EAAwB,MAAM,iBAAiB,CAAC;AAIrF;;;;GAIG;AACH,qBAEa,eAAe;IAC1B,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,CAAC;IAGhD,EAAE,EAAE,MAAM,CAAgB;IAI1B,WAAW,EAAG,MAAM,CAAC;IAErB,kDAAkD;IAElD,QAAQ,EAAG,MAAM,CAAC;IAElB,uEAAuE;IAEvE,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAGrB,SAAS,EAAE,IAAI,CAAc;CAC9B"}

package/dist/backend/entities/mfa-recovery-code.entity.js

@@ -0,0 +1,54 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Entity, Index, OptionalProps, PrimaryKey, Property } from '@mikro-orm/core';
+import { GlobalEntity } from '@endora-commerce/platform/tenancy';
+import { randomUUID } from 'crypto';
+/**
+ * Single-use backup code for a TOTP enrolment (feature 042). Stored only as a
+ * SHA-256 hash; the plaintext is shown once at activation/regeneration.
+ * Cascade-deleted with its parent enrolment (FK declared in migration 067).
+ */
+let MfaRecoveryCode = class MfaRecoveryCode {
+    [OptionalProps];
+    id = randomUUID();
+    enrolmentId;
+    /** SHA-256 hex of the plaintext recovery code. */
+    codeHash;
+    /** Set when the code is consumed; a used code is never re-accepted. */
+    usedAt;
+    createdAt = new Date();
+};
+__decorate([
+    PrimaryKey({ type: 'uuid' }),
+    __metadata("design:type", String)
+], MfaRecoveryCode.prototype, "id", void 0);
+__decorate([
+    Property({ type: 'uuid' }),
+    Index(),
+    __metadata("design:type", String)
+], MfaRecoveryCode.prototype, "enrolmentId", void 0);
+__decorate([
+    Property({ type: 'string', length: 128 }),
+    __metadata("design:type", String)
+], MfaRecoveryCode.prototype, "codeHash", void 0);
+__decorate([
+    Property({ type: 'datetime', nullable: true }),
+    __metadata("design:type", Object)
+], MfaRecoveryCode.prototype, "usedAt", void 0);
+__decorate([
+    Property({ type: 'datetime', onCreate: () => new Date() }),
+    __metadata("design:type", Date)
+], MfaRecoveryCode.prototype, "createdAt", void 0);
+MfaRecoveryCode = __decorate([
+    GlobalEntity(),
+    Entity({ tableName: 'mfa_recovery_codes' })
+], MfaRecoveryCode);
+export { MfaRecoveryCode };
+//# sourceMappingURL=mfa-recovery-code.entity.js.map

package/dist/backend/entities/mfa-recovery-code.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-recovery-code.entity.js","sourceRoot":"","sources":["../../../src/backend/entities/mfa-recovery-code.entity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;GAIG;AAGI,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,CAAC,aAAa,CAAC,CAAiC;IAGhD,EAAE,GAAW,UAAU,EAAE,CAAC;IAI1B,WAAW,CAAU;IAErB,kDAAkD;IAElD,QAAQ,CAAU;IAElB,uEAAuE;IAEvE,MAAM,CAAe;IAGrB,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;CAC9B,CAAA;AAhBC;IADC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;2CACH;AAI1B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE;;oDACa;AAIrB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;iDACxB;AAIlB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CAC1B;AAGrB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;kDAAc;AAnBlB,eAAe;IAF3B,YAAY,EAAE;IACd,MAAM,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;GAC/B,eAAe,CAoB3B"}

package/dist/backend/entities/mfa-social-identity.entity.d.ts

@@ -0,0 +1,24 @@
+import { OptionalProps } from '@mikro-orm/core';
+/**
+ * Link between a platform account and an external provider identity
+ * (Google / Microsoft) — feature 042. Resolution is by the provider's
+ * verified primary email; the `providerSubject` (`sub` claim) is the stable
+ * provider-side id. Uniqueness constraints (declared in migration 067):
+ *   - (provider, provider_subject): one platform account per IdP identity;
+ *   - (subject_type, subject_id, provider): one link per provider per account.
+ */
+export declare class MfaSocialIdentity {
+    [OptionalProps]?: 'id' | 'lastUsedAt' | 'linkedAt';
+    id: string;
+    subjectType: string;
+    subjectId: string;
+    /** `'google'` | `'microsoft'`. */
+    provider: string;
+    /** The IdP `sub` claim — stable provider-side identifier. */
+    providerSubject: string;
+    /** Verified email at link time (used for resolution). */
+    email: string;
+    linkedAt: Date;
+    lastUsedAt?: Date | null;
+}
+//# sourceMappingURL=mfa-social-identity.entity.d.ts.map

package/dist/backend/entities/mfa-social-identity.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-social-identity.entity.d.ts","sourceRoot":"","sources":["../../../src/backend/entities/mfa-social-identity.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,aAAa,EAAwB,MAAM,iBAAiB,CAAC;AAIrF;;;;;;;GAOG;AACH,qBAEa,iBAAiB;IAC5B,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,GAAG,YAAY,GAAG,UAAU,CAAC;IAGnD,EAAE,EAAE,MAAM,CAAgB;IAG1B,WAAW,EAAG,MAAM,CAAC;IAGrB,SAAS,EAAG,MAAM,CAAC;IAEnB,kCAAkC;IAElC,QAAQ,EAAG,MAAM,CAAC;IAElB,6DAA6D;IAE7D,eAAe,EAAG,MAAM,CAAC;IAEzB,yDAAyD;IAGzD,KAAK,EAAG,MAAM,CAAC;IAGf,QAAQ,EAAE,IAAI,CAAc;IAG5B,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B"}