@endora-commerce/mod-mfa 0.100.0

package/dist/backend/routes.self-service.js

@@ -0,0 +1,113 @@
+import { mfaActivateRequestSchema, mfaDisableRequestSchema, mfaRegenerateRequestSchema, mfaSocialUnlinkParamsSchema, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { currentSalesChannel } from '@endora-commerce/platform/kernel';
+export async function registerMfaSelfServiceRoutes(app, opts) {
+    const { pathPrefix, subjectType, auditObjectType, requireGuard, resolveSubjectId, enrolmentService, policyResolver, socialLinkService, auditLogService, } = opts;
+    const subjectOf = (req) => ({
+        subjectType,
+        subjectId: resolveSubjectId(req),
+    });
+    app.post(`${pathPrefix}/setup`, { preHandler: requireGuard }, async (request) => {
+        const subject = subjectOf(request);
+        // FR-001 — enrolment is only permitted when 2FA is enabled for the scope.
+        const policy = await policyResolver.resolve(subject, {
+            salesChannelId: currentSalesChannel()?.id ?? null,
+            organizationId: opts.resolveOrganizationId?.(request) ?? null,
+        });
+        if (!policy.totpEnabled) {
+            throw new HttpError(403, 'MFA_NOT_ENABLED', 'Two-factor authentication is not enabled for your account.');
+        }
+        const label = (await opts.resolveAccountEmail(subjectType, subject.subjectId)) ?? subject.subjectId;
+        return { data: await enrolmentService.setup(subject, label) };
+    });
+    app.post(`${pathPrefix}/activate`, { preHandler: requireGuard, schema: { body: mfaActivateRequestSchema } }, async (request) => {
+        const body = mfaActivateRequestSchema.parse(request.body);
+        const subject = subjectOf(request);
+        const res = await enrolmentService.activate(subject, body.code);
+        await auditLogService.record({
+            action: 'mfa.enabled',
+            objectType: auditObjectType,
+            objectId: subject.subjectId,
+            ...(request.ip ? { ipAddress: request.ip } : {}),
+        });
+        return { data: res };
+    });
+    app.post(`${pathPrefix}/disable`, { preHandler: requireGuard, schema: { body: mfaDisableRequestSchema } }, async (request) => {
+        const body = mfaDisableRequestSchema.parse(request.body);
+        const subject = subjectOf(request);
+        await reauthenticate(opts, subject, body);
+        await enrolmentService.disable(subject);
+        await auditLogService.record({
+            action: 'mfa.disabled',
+            objectType: auditObjectType,
+            objectId: subject.subjectId,
+            ...(request.ip ? { ipAddress: request.ip } : {}),
+        });
+        return { data: { status: 'disabled' } };
+    });
+    app.post(`${pathPrefix}/recovery-codes/regenerate`, { preHandler: requireGuard, schema: { body: mfaRegenerateRequestSchema } }, async (request) => {
+        const body = mfaRegenerateRequestSchema.parse(request.body);
+        const subject = subjectOf(request);
+        const verified = await enrolmentService.verifySecondFactor(subject, body.code);
+        if (!verified.ok)
+            throw new HttpError(401, 'MFA_INVALID_CODE', 'The code is invalid or expired.');
+        const res = await enrolmentService.regenerateRecoveryCodes(subject);
+        await auditLogService.record({
+            action: 'mfa.recovery_codes_regenerated',
+            objectType: auditObjectType,
+            objectId: subject.subjectId,
+            ...(request.ip ? { ipAddress: request.ip } : {}),
+        });
+        return { data: res };
+    });
+    app.get(`${pathPrefix}/status`, { preHandler: requireGuard }, async (request) => {
+        const subject = subjectOf(request);
+        const status = await enrolmentService.status(subject);
+        const policy = await policyResolver.resolve(subject, {
+            salesChannelId: currentSalesChannel()?.id ?? null,
+            organizationId: opts.resolveOrganizationId?.(request) ?? null,
+        });
+        return {
+            data: {
+                totpActive: status.totpActive,
+                recoveryCodesRemaining: status.recoveryCodesRemaining,
+                totpEnabledForScope: policy.totpEnabled,
+                totpEnforcedForScope: policy.totpEnforced,
+                // Issue #194 — the contract has declared this field since feature 042
+                // and the handler answered `[]` unconditionally, so the account holder
+                // could neither see a linked identity nor reach the route that removes
+                // one. The verdict travels with each link, so the surface renders the
+                // refusal instead of discovering it on the click.
+                socialLinks: await socialLinkService.list(subject),
+            },
+        };
+    });
+    /**
+     * Sever a federated identity (issue #194). Refused when it is the account's
+     * only link — see {@link SocialLinkService} for why that is the rule and what
+     * would be needed to relax it.
+     */
+    app.delete(`${pathPrefix}/social-links/:provider`, { preHandler: requireGuard, schema: { params: mfaSocialUnlinkParamsSchema } }, async (request) => {
+        const { provider } = mfaSocialUnlinkParamsSchema.parse(request.params);
+        const subject = subjectOf(request);
+        await socialLinkService.unlink(subject, provider);
+        return { data: { status: 'unlinked', provider } };
+    });
+}
+/** Re-auth on self-disable: a current TOTP/recovery code or the password. */
+async function reauthenticate(opts, subject, body) {
+    if (body.code) {
+        const verified = await opts.enrolmentService.verifySecondFactor(subject, body.code);
+        if (verified.ok)
+            return;
+        throw new HttpError(401, 'MFA_INVALID_CODE', 'The code is invalid or expired.');
+    }
+    if (body.password) {
+        const ok = await opts.verifyAccountPassword(subject.subjectType, subject.subjectId, body.password);
+        if (ok)
+            return;
+        throw new HttpError(401, 'INVALID_CREDENTIALS', 'The password is incorrect.');
+    }
+    throw new HttpError(400, 'MFA_REAUTH_REQUIRED', 'A current code is required to disable 2FA.');
+}
+//# sourceMappingURL=routes.self-service.js.map

package/dist/backend/routes.self-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.self-service.js","sourceRoot":"","sources":["../../src/backend/routes.self-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAwCvE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAoB,EACpB,IAA2B;IAE3B,MAAM,EACJ,UAAU,EACV,WAAW,EACX,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,GAAG,IAAI,CAAC;IAET,MAAM,SAAS,GAAG,CAAC,GAAmB,EAAiB,EAAE,CAAC,CAAC;QACzD,WAAW;QACX,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC;KACjC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,QAAQ,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9E,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE;YACnD,cAAc,EAAE,mBAAmB,EAAE,EAAE,EAAE,IAAI,IAAI;YACjD,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,4DAA4D,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,KAAK,GACT,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC;QACxF,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,GAAG,UAAU,WAAW,EACxB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAAE,EACxE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,eAAe,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,eAAe;YAC3B,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACvB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,GAAG,UAAU,UAAU,EACvB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EACvE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,eAAe,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,cAAc;YACtB,UAAU,EAAE,eAAe;YAC3B,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;IAC1C,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,GAAG,UAAU,4BAA4B,EACzC,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAC1E,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;QAClG,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,eAAe,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,gCAAgC;YACxC,UAAU,EAAE,eAAe;YAC3B,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACvB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,SAAS,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9E,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE;YACnD,cAAc,EAAE,mBAAmB,EAAE,EAAE,EAAE,IAAI,IAAI;YACjD,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI;SAC9D,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE;gBACJ,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;gBACrD,mBAAmB,EAAE,MAAM,CAAC,WAAW;gBACvC,oBAAoB,EAAE,MAAM,CAAC,YAAY;gBACzC,sEAAsE;gBACtE,uEAAuE;gBACvE,uEAAuE;gBACvE,sEAAsE;gBACtE,kDAAkD;gBAClD,WAAW,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;aACnD;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,GAAG,CAAC,MAAM,CACR,GAAG,UAAU,yBAAyB,EACtC,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,EAC7E,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAmB,EAAE,QAAQ,EAAE,EAAE,CAAC;IAC7D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,cAAc,CAC3B,IAA2B,EAC3B,OAAsB,EACtB,IAAkE;IAElE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO;QACxB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnG,IAAI,EAAE;YAAE,OAAO;QACf,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,4BAA4B,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;AAChG,CAAC"}

package/dist/backend/services/account-identity.d.ts

@@ -0,0 +1,71 @@
+import type { AdminPasswordVerificationPort, AdminUserReadPort, CustomerAccountReadPort, CustomerPasswordVerificationPort } from '@endora-commerce/contracts';
+/**
+ * The four questions MFA asks the two identity modules about an account
+ * (`specs/110-instance-repository/` T118c).
+ *
+ * All four were `MfaActorBridge` members — closures a composition root wrote,
+ * once in `backend/src/composition.ts` and once in
+ * `backend/test/helpers/test-server.ts`. None of them was a composition's answer
+ * to give: every one is `adminUserReadPort`, `customerAccountReadPort`,
+ * `adminPasswordVerificationPort` or `customerPasswordVerificationPort` and
+ * nothing else, and the two roots spelled the same body twice — where they
+ * spelled it at all. Two of the four the harness did not spell, which is what
+ * made them invisible; see the note on each.
+ *
+ * They are functions of the ports they read rather than of a `ModuleContext`, so
+ * `backend/index.ts` supplies the real inputs and this file is testable over a
+ * stub with nothing composed.
+ *
+ * **No `catch` anywhere below, deliberately.** Each call goes through a
+ * `lazyPort` proxy that throws `ModuleDisabledError` when its owner is absent,
+ * and reading that as "this account has no e-mail" or "the password does not
+ * match" is the fail-open the composition checklist's item 7 refuses — on an
+ * authentication path, where it is the difference between requiring a second
+ * factor and accepting a credential nobody verified. `admin_users` and
+ * `customer_accounts` both declare `nonDeactivatable`, so it cannot happen
+ * today; the absence of the `catch` is what keeps it fail-closed if that ever
+ * changes.
+ */
+/**
+ * The caller's organisation, and the assertion that they may set policy for it
+ * (US3, FR-014).
+ *
+ * Takes the account id rather than the request: who is asking is
+ * `customerActorResolver`'s answer, which the platform contributes and eight
+ * other modules already read, and asking it a second time here is the duplicate
+ * spelling this drain removes.
+ */
+export declare function createOrganizationAdminResolver(accounts: Pick<CustomerAccountReadPort, 'findById'>): (customerAccountId: string) => Promise<{
+    organizationId: string;
+    actor: string;
+}>;
+/** The accounts a bulk 2FA reset by organisation covers (US6, FR-026/028). */
+export declare function createOrganizationCustomerIdsResolver(accounts: Pick<CustomerAccountReadPort, 'listByOrganization'>): (organizationId: string) => Promise<string[]>;
+/**
+ * The address that labels an authenticator entry.
+ *
+ * **This is one of the two members no test in the tree could see.** Production
+ * contributed it and the harness did not, so under test the label fell back to
+ * the subject id and the `otpauth://` URI carried a UUID where a real enrolment
+ * carries an e-mail address — a difference every MFA test was blind to, because
+ * the one assertion over that URI is `toContain('otpauth://totp/')`.
+ *
+ * `null` for an account that does not resolve; the route falls back to the
+ * subject id, which is a worse label and nothing more.
+ */
+export declare function createAccountEmailResolver(customers: Pick<CustomerAccountReadPort, 'findById'>, admins: Pick<AdminUserReadPort, 'findById'>): (subjectType: 'customer' | 'admin', subjectId: string) => Promise<string | null>;
+/**
+ * Does the account's stored credential match the password presented?
+ *
+ * **The other member no test could see**, and the one whose absence changed
+ * behaviour rather than a label: `reauthenticate` accepts either a current
+ * second factor or the account password before disabling 2FA, and with no
+ * verifier the password branch is unreachable, so the harness answered 400
+ * `MFA_REAUTH_REQUIRED` where production answers 401 or lets the disable
+ * through. Every `/disable` call in the tree passes a code, so nothing ever
+ * took the branch that differed.
+ *
+ * Only the boolean crosses: the hash stays behind each owner's port (T052).
+ */
+export declare function createAccountPasswordVerifier(customers: CustomerPasswordVerificationPort, admins: AdminPasswordVerificationPort): (subjectType: 'customer' | 'admin', subjectId: string, password: string) => Promise<boolean>;
+//# sourceMappingURL=account-identity.d.ts.map

package/dist/backend/services/account-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-identity.d.ts","sourceRoot":"","sources":["../../../src/backend/services/account-identity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,6BAA6B,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,gCAAgC,EACjC,MAAM,4BAA4B,CAAC;AAGpC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,IAAI,CAAC,uBAAuB,EAAE,UAAU,CAAC,GAClD,CAAC,iBAAiB,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAYnF;AAED,8EAA8E;AAC9E,wBAAgB,qCAAqC,CACnD,QAAQ,EAAE,IAAI,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,GAC5D,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAG/C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,IAAI,CAAC,uBAAuB,EAAE,UAAU,CAAC,EACpD,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAC1C,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKlF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,gCAAgC,EAC3C,MAAM,EAAE,6BAA6B,GACpC,CACD,WAAW,EAAE,UAAU,GAAG,OAAO,EACjC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,OAAO,CAAC,CAKpB"}

package/dist/backend/services/account-identity.js

@@ -0,0 +1,87 @@
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+/**
+ * The four questions MFA asks the two identity modules about an account
+ * (`specs/110-instance-repository/` T118c).
+ *
+ * All four were `MfaActorBridge` members — closures a composition root wrote,
+ * once in `backend/src/composition.ts` and once in
+ * `backend/test/helpers/test-server.ts`. None of them was a composition's answer
+ * to give: every one is `adminUserReadPort`, `customerAccountReadPort`,
+ * `adminPasswordVerificationPort` or `customerPasswordVerificationPort` and
+ * nothing else, and the two roots spelled the same body twice — where they
+ * spelled it at all. Two of the four the harness did not spell, which is what
+ * made them invisible; see the note on each.
+ *
+ * They are functions of the ports they read rather than of a `ModuleContext`, so
+ * `backend/index.ts` supplies the real inputs and this file is testable over a
+ * stub with nothing composed.
+ *
+ * **No `catch` anywhere below, deliberately.** Each call goes through a
+ * `lazyPort` proxy that throws `ModuleDisabledError` when its owner is absent,
+ * and reading that as "this account has no e-mail" or "the password does not
+ * match" is the fail-open the composition checklist's item 7 refuses — on an
+ * authentication path, where it is the difference between requiring a second
+ * factor and accepting a credential nobody verified. `admin_users` and
+ * `customer_accounts` both declare `nonDeactivatable`, so it cannot happen
+ * today; the absence of the `catch` is what keeps it fail-closed if that ever
+ * changes.
+ */
+/**
+ * The caller's organisation, and the assertion that they may set policy for it
+ * (US3, FR-014).
+ *
+ * Takes the account id rather than the request: who is asking is
+ * `customerActorResolver`'s answer, which the platform contributes and eight
+ * other modules already read, and asking it a second time here is the duplicate
+ * spelling this drain removes.
+ */
+export function createOrganizationAdminResolver(accounts) {
+    return async (customerAccountId) => {
+        const account = await accounts.findById(customerAccountId);
+        if (!account || account.role !== 'organization_admin' || !account.organizationId) {
+            throw new HttpError(403, ERROR_CODES.FORBIDDEN, 'Organization administrator role required.');
+        }
+        return { organizationId: account.organizationId, actor: account.id };
+    };
+}
+/** The accounts a bulk 2FA reset by organisation covers (US6, FR-026/028). */
+export function createOrganizationCustomerIdsResolver(accounts) {
+    return async (organizationId) => (await accounts.listByOrganization(organizationId)).map((account) => account.id);
+}
+/**
+ * The address that labels an authenticator entry.
+ *
+ * **This is one of the two members no test in the tree could see.** Production
+ * contributed it and the harness did not, so under test the label fell back to
+ * the subject id and the `otpauth://` URI carried a UUID where a real enrolment
+ * carries an e-mail address — a difference every MFA test was blind to, because
+ * the one assertion over that URI is `toContain('otpauth://totp/')`.
+ *
+ * `null` for an account that does not resolve; the route falls back to the
+ * subject id, which is a worse label and nothing more.
+ */
+export function createAccountEmailResolver(customers, admins) {
+    return async (subjectType, subjectId) => subjectType === 'admin'
+        ? ((await admins.findById(subjectId))?.email ?? null)
+        : ((await customers.findById(subjectId))?.email ?? null);
+}
+/**
+ * Does the account's stored credential match the password presented?
+ *
+ * **The other member no test could see**, and the one whose absence changed
+ * behaviour rather than a label: `reauthenticate` accepts either a current
+ * second factor or the account password before disabling 2FA, and with no
+ * verifier the password branch is unreachable, so the harness answered 400
+ * `MFA_REAUTH_REQUIRED` where production answers 401 or lets the disable
+ * through. Every `/disable` call in the tree passes a code, so nothing ever
+ * took the branch that differed.
+ *
+ * Only the boolean crosses: the hash stays behind each owner's port (T052).
+ */
+export function createAccountPasswordVerifier(customers, admins) {
+    return async (subjectType, subjectId, password) => subjectType === 'admin'
+        ? admins.verifyPassword(subjectId, password)
+        : customers.verifyPassword(subjectId, password);
+}
+//# sourceMappingURL=account-identity.js.map

package/dist/backend/services/account-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-identity.js","sourceRoot":"","sources":["../../../src/backend/services/account-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAOzD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAmD;IAEnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACjF,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,SAAS,EACrB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IACvE,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qCAAqC,CACnD,QAA6D;IAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,EAAE,CAC9B,CAAC,MAAM,QAAQ,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAoD,EACpD,MAA2C;IAE3C,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,CACtC,WAAW,KAAK,OAAO;QACrB,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;QACrD,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAA2C,EAC3C,MAAqC;IAMrC,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAChD,WAAW,KAAK,OAAO;QACrB,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC;QAC5C,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC"}

package/dist/backend/services/challenge-store.d.ts

@@ -0,0 +1,40 @@
+import type { Redis } from 'ioredis';
+export interface PendingChallenge {
+    subjectType: 'customer' | 'admin';
+    subjectId: string;
+    salesChannelId: string | null;
+    attemptsRemaining: number;
+}
+export interface SetupTicket {
+    subjectType: 'customer' | 'admin';
+    subjectId: string;
+    salesChannelId: string | null;
+}
+export interface OAuthTransaction {
+    surface: 'customer' | 'admin';
+    provider: 'google' | 'microsoft';
+    salesChannelId: string | null;
+    pkceVerifier: string;
+    nonce: string;
+    next: string;
+}
+export declare class ChallengeStore {
+    private readonly redis;
+    constructor(redis: Redis);
+    issueChallenge(input: Omit<PendingChallenge, 'attemptsRemaining'>, attemptBudget?: number): Promise<string>;
+    getChallenge(id: string): Promise<PendingChallenge | null>;
+    /**
+     * Record a failed attempt: decrement the budget and burn the challenge when
+     * it reaches zero. Returns the remaining budget (0 ⇒ burned).
+     */
+    recordFailedAttempt(id: string): Promise<number>;
+    consumeChallenge(id: string): Promise<void>;
+    issueSetupTicket(input: SetupTicket): Promise<string>;
+    getSetupTicket(id: string): Promise<SetupTicket | null>;
+    consumeSetupTicket(id: string): Promise<void>;
+    /** The `state` value is returned to the provider and echoed on callback. */
+    issueOAuthTransaction(input: OAuthTransaction): Promise<string>;
+    getOAuthTransaction(state: string): Promise<OAuthTransaction | null>;
+    consumeOAuthTransaction(state: string): Promise<void>;
+}
+//# sourceMappingURL=challenge-store.d.ts.map

package/dist/backend/services/challenge-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-store.d.ts","sourceRoot":"","sources":["../../../src/backend/services/challenge-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAuBrC,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,UAAU,GAAG,OAAO,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,UAAU,GAAG,OAAO,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;IAC9B,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAMD,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,KAAK;IAInC,cAAc,CAClB,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,EAClD,aAAa,SAAyB,GACrC,OAAO,CAAC,MAAM,CAAC;IAeZ,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAKhE;;;OAGG;IACG,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBhD,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3C,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAWrD,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAKvD,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnD,4EAA4E;IACtE,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAW/D,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAKpE,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG5D"}

package/dist/backend/services/challenge-store.js

@@ -0,0 +1,90 @@
+import { randomBytes } from 'crypto';
+/**
+ * Short-lived, server-held login state in Redis (feature 042, R4/R9).
+ *
+ * Three kinds of ephemeral token, all TTL-bounded so abandonment never
+ * materializes into a session:
+ *   - pending-login challenge (`mfa:chal:<id>`) — after a correct password,
+ *     before the second factor; carries an attempt budget;
+ *   - setup ticket (`mfa:setup:<id>`) — enforced-but-unenrolled subject, may
+ *     only call the enrolment endpoints until activation;
+ *   - OAuth transaction (`mfa:oauth:<state>`) — PKCE verifier + nonce + next.
+ */
+const CHAL_PREFIX = 'mfa:chal:';
+const SETUP_PREFIX = 'mfa:setup:';
+const OAUTH_PREFIX = 'mfa:oauth:';
+const CHALLENGE_TTL_SECONDS = 5 * 60;
+const SETUP_TTL_SECONDS = 10 * 60;
+const OAUTH_TTL_SECONDS = 10 * 60;
+const DEFAULT_ATTEMPT_BUDGET = 5;
+function newToken() {
+    return randomBytes(32).toString('base64url');
+}
+export class ChallengeStore {
+    redis;
+    constructor(redis) {
+        this.redis = redis;
+    }
+    // --- pending-login challenge ---------------------------------------------
+    async issueChallenge(input, attemptBudget = DEFAULT_ATTEMPT_BUDGET) {
+        const id = newToken();
+        const payload = {
+            ...input,
+            attemptsRemaining: attemptBudget,
+        };
+        await this.redis.set(CHAL_PREFIX + id, JSON.stringify(payload), 'EX', CHALLENGE_TTL_SECONDS);
+        return id;
+    }
+    async getChallenge(id) {
+        const raw = await this.redis.get(CHAL_PREFIX + id);
+        return raw ? JSON.parse(raw) : null;
+    }
+    /**
+     * Record a failed attempt: decrement the budget and burn the challenge when
+     * it reaches zero. Returns the remaining budget (0 ⇒ burned).
+     */
+    async recordFailedAttempt(id) {
+        const challenge = await this.getChallenge(id);
+        if (!challenge)
+            return 0;
+        const remaining = challenge.attemptsRemaining - 1;
+        if (remaining <= 0) {
+            await this.consumeChallenge(id);
+            return 0;
+        }
+        const ttl = await this.redis.ttl(CHAL_PREFIX + id);
+        await this.redis.set(CHAL_PREFIX + id, JSON.stringify({ ...challenge, attemptsRemaining: remaining }), 'EX', ttl > 0 ? ttl : CHALLENGE_TTL_SECONDS);
+        return remaining;
+    }
+    async consumeChallenge(id) {
+        await this.redis.del(CHAL_PREFIX + id);
+    }
+    // --- setup ticket ---------------------------------------------------------
+    async issueSetupTicket(input) {
+        const id = newToken();
+        await this.redis.set(SETUP_PREFIX + id, JSON.stringify(input), 'EX', SETUP_TTL_SECONDS);
+        return id;
+    }
+    async getSetupTicket(id) {
+        const raw = await this.redis.get(SETUP_PREFIX + id);
+        return raw ? JSON.parse(raw) : null;
+    }
+    async consumeSetupTicket(id) {
+        await this.redis.del(SETUP_PREFIX + id);
+    }
+    // --- OAuth transaction ----------------------------------------------------
+    /** The `state` value is returned to the provider and echoed on callback. */
+    async issueOAuthTransaction(input) {
+        const state = newToken();
+        await this.redis.set(OAUTH_PREFIX + state, JSON.stringify(input), 'EX', OAUTH_TTL_SECONDS);
+        return state;
+    }
+    async getOAuthTransaction(state) {
+        const raw = await this.redis.get(OAUTH_PREFIX + state);
+        return raw ? JSON.parse(raw) : null;
+    }
+    async consumeOAuthTransaction(state) {
+        await this.redis.del(OAUTH_PREFIX + state);
+    }
+}
+//# sourceMappingURL=challenge-store.js.map

package/dist/backend/services/challenge-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-store.js","sourceRoot":"","sources":["../../../src/backend/services/challenge-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,YAAY,GAAG,YAAY,CAAC;AAElC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,CAAC;AACrC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,CAAC;AAClC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,CAAC;AAClC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAwBjC,SAAS,QAAQ;IACf,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,KAAY;QAAZ,UAAK,GAAL,KAAK,CAAO;IAAG,CAAC;IAE7C,4EAA4E;IAE5E,KAAK,CAAC,cAAc,CAClB,KAAkD,EAClD,aAAa,GAAG,sBAAsB;QAEtC,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;QACtB,MAAM,OAAO,GAAqB;YAChC,GAAG,KAAK;YACR,iBAAiB,EAAE,aAAa;SACjC,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,WAAW,GAAG,EAAE,EAChB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACvB,IAAI,EACJ,qBAAqB,CACtB,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,EAAU;QAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,SAAS,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAClD,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAChC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,WAAW,GAAG,EAAE,EAChB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,EAC9D,IAAI,EACJ,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,CACtC,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,gBAAgB,CAAC,KAAkB;QACvC,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,YAAY,GAAG,EAAE,EACjB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACrB,IAAI,EACJ,iBAAiB,CAClB,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,6EAA6E;IAE7E,4EAA4E;IAC5E,KAAK,CAAC,qBAAqB,CAAC,KAAuB;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,YAAY,GAAG,KAAK,EACpB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACrB,IAAI,EACJ,iBAAiB,CAClB,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC;QACvD,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/backend/services/mfa-enrolment-count.service.d.ts

@@ -0,0 +1,26 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { MfaActiveEnrolmentCounts, MfaEnrolmentCountPort } from '@endora-commerce/contracts';
+/**
+ * How many subjects hold an active second factor (owner ruling on D-96.5).
+ *
+ * The deactivation-confirmation dialog on `/platform/modules` renders one
+ * static sentence per dependent, from a manifest. This is the first **live**
+ * datum in it, and it is the most decision-relevant fact an operator can be
+ * shown before switching this module off: the `whenAbsent` sentence says what
+ * stops working, the count says to how many people.
+ *
+ * It lives here, behind a port, because `mfa_enrolments` is this module's
+ * table. The kernel does not name it and no other module queries it; the
+ * lifecycle surface asks a question and this module answers it.
+ *
+ * Nothing about the count is cached, denormalised or persisted outside this
+ * table, deliberately: a number that survived deactivation would be a second
+ * copy of the fact, and the only moment it is asked for is a moment at which
+ * the real one is readable.
+ */
+export declare class MfaEnrolmentCountService implements MfaEnrolmentCountPort {
+    private readonly emFactory;
+    constructor(emFactory: () => EntityManager);
+    countActiveEnrolments(): Promise<MfaActiveEnrolmentCounts>;
+}
+//# sourceMappingURL=mfa-enrolment-count.service.d.ts.map

package/dist/backend/services/mfa-enrolment-count.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-enrolment-count.service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/mfa-enrolment-count.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGlG;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,wBAAyB,YAAW,qBAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,aAAa;IAErD,qBAAqB,IAAI,OAAO,CAAC,wBAAwB,CAAC;CAQjE"}

package/dist/backend/services/mfa-enrolment-count.service.js

@@ -0,0 +1,34 @@
+import { MfaEnrolment } from '../entities/mfa-enrolment.entity.js';
+/**
+ * How many subjects hold an active second factor (owner ruling on D-96.5).
+ *
+ * The deactivation-confirmation dialog on `/platform/modules` renders one
+ * static sentence per dependent, from a manifest. This is the first **live**
+ * datum in it, and it is the most decision-relevant fact an operator can be
+ * shown before switching this module off: the `whenAbsent` sentence says what
+ * stops working, the count says to how many people.
+ *
+ * It lives here, behind a port, because `mfa_enrolments` is this module's
+ * table. The kernel does not name it and no other module queries it; the
+ * lifecycle surface asks a question and this module answers it.
+ *
+ * Nothing about the count is cached, denormalised or persisted outside this
+ * table, deliberately: a number that survived deactivation would be a second
+ * copy of the fact, and the only moment it is asked for is a moment at which
+ * the real one is readable.
+ */
+export class MfaEnrolmentCountService {
+    emFactory;
+    constructor(emFactory) {
+        this.emFactory = emFactory;
+    }
+    async countActiveEnrolments() {
+        const em = this.emFactory();
+        const [admins, customers] = await Promise.all([
+            em.count(MfaEnrolment, { status: 'active', subjectType: 'admin' }),
+            em.count(MfaEnrolment, { status: 'active', subjectType: 'customer' }),
+        ]);
+        return { admins, customers };
+    }
+}
+//# sourceMappingURL=mfa-enrolment-count.service.js.map

package/dist/backend/services/mfa-enrolment-count.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-enrolment-count.service.js","sourceRoot":"","sources":["../../../src/backend/services/mfa-enrolment-count.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAE/D,KAAK,CAAC,qBAAqB;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;YAClE,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/backend/services/mfa-enrolment-service.d.ts

@@ -0,0 +1,54 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { MfaSubjectRef } from '@endora-commerce/contracts';
+import type { SecretCipher } from './secret-cipher.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+/**
+ * TOTP enrolment lifecycle (feature 042): setup → activate (issue recovery
+ * codes) → disable / regenerate, plus the second-factor verification used by
+ * the login flow. The TOTP secret is encrypted at rest via `SecretCipher`;
+ * recovery codes are stored only as SHA-256 hashes.
+ */
+export declare class MfaEnrolmentService {
+    #private;
+    private readonly emFactory;
+    private readonly cipher;
+    private readonly auditLog?;
+    constructor(emFactory: () => EntityManager, cipher: SecretCipher, auditLog?: AuditPort | undefined);
+    /** Begin (or restart) enrolment — creates a `pending` enrolment. */
+    setup(subject: MfaSubjectRef, accountLabel: string): Promise<{
+        secret: string;
+        otpauthUri: string;
+    }>;
+    /** Confirm the pending enrolment with a live code; issue recovery codes. */
+    activate(subject: MfaSubjectRef, code: string): Promise<{
+        recoveryCodes: string[];
+    }>;
+    /**
+     * Admin reset — clear ALL enrolments (active + pending) for a subject.
+     * Recovery codes cascade. Returns whether anything was removed (so a bulk
+     * caller can report affected vs skipped). FR-025.
+     */
+    reset(subject: MfaSubjectRef): Promise<boolean>;
+    /** Disable 2FA for the subject (idempotent). Removes secret + recovery codes. */
+    disable(subject: MfaSubjectRef): Promise<void>;
+    /** Invalidate the old recovery-code set and issue a fresh one. */
+    regenerateRecoveryCodes(subject: MfaSubjectRef): Promise<{
+        recoveryCodes: string[];
+    }>;
+    status(subject: MfaSubjectRef): Promise<{
+        totpActive: boolean;
+        recoveryCodesRemaining: number;
+    }>;
+    /**
+     * Verify a second factor (TOTP or recovery code) for an active enrolment.
+     * A 6-digit input is treated as a TOTP code (with replay guard); anything
+     * else is matched against unused recovery codes (single-use). Reports which
+     * factor matched so callers can audit recovery-code use.
+     */
+    verifySecondFactor(subject: MfaSubjectRef, code: string): Promise<{
+        ok: boolean;
+        factor?: 'totp' | 'recovery';
+    }>;
+    private decryptSecret;
+}
+//# sourceMappingURL=mfa-enrolment-service.d.ts.map

package/dist/backend/services/mfa-enrolment-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-enrolment-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/mfa-enrolment-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAOlE;;;;;GAKG;AACH,qBAAa,mBAAmB;;IAE5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAFT,SAAS,EAAE,MAAM,aAAa,EAC9B,MAAM,EAAE,YAAY,EACpB,QAAQ,CAAC,EAAE,SAAS,YAAA;IAevC,oEAAoE;IAC9D,KAAK,CACT,OAAO,EAAE,aAAa,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAkClD,4EAA4E;IACtE,QAAQ,CACZ,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAiCvC;;;;OAIG;IACG,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAarD,iFAAiF;IAC3E,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAapD,kEAAkE;IAC5D,uBAAuB,CAC3B,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAyBjC,MAAM,CACV,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,CAAC;IAenE;;;;;OAKG;IACG,kBAAkB,CACtB,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAC;IAqCzD,OAAO,CAAC,aAAa;CAOtB"}