@futdevpro/nts-dynamo 1.15.140 → 1.15.141

package/README.md

@@ -301,6 +301,33 @@ Dynamo-NTS provides an abstract `DyNTS_AuthService` class that you can extend to
 - Session management
 - Route-level security configuration
 
+For product-local accounts, the optional `@futdevpro/nts-dynamo/account-security` entry point adds production
+security primitives without coupling a product to a shared account provider:
+
+- versioned adaptive password hashing and rehash detection;
+- hash-only email-verification and password-reset challenges with atomic one-time consumption;
+- opaque, hash-only access credentials backed by revocable server-side sessions;
+- one-time refresh rotation, replay detection, session listing and subject-wide revocation.
+
+Persistence remains application-owned through explicit atomic adapters. Transports must never put the raw
+credentials in URLs, logs, analytics or durable client storage. A consuming application must also apply its
+rate-limit, authorization, cookie/storage and audit-redaction policy at the API boundary.
+
+### Privacy lifecycle
+
+The optional `@futdevpro/nts-dynamo/privacy-lifecycle` entry point provides the shared machinery for standalone
+GDPR-capable products:
+
+- identity-gated, deadline-bearing data-subject requests;
+- explicit `received → identity-verified → scoped → planned → executing → verifying` processing;
+- deterministic product-domain contributors with resumable partial outcomes and documented retention bases;
+- append-only, checksummed legal acceptances;
+- versioned, purpose-specific consent grants and withdrawals.
+
+The Bedrock module coordinates state and evidence only. Each consuming product must register every data domain,
+implement hard-delete/anonymization/export behavior, and provide transaction-safe persistence. A request is
+never reported complete while a registered contributor has a failed outcome.
+
 ## Modules Overview
 
 Dynamo-NTS is organized into focused modules, each providing specific functionality:

package/__documentations/2026-08-18-standalone-account-security-and-privacy-bedrock.md

@@ -0,0 +1,131 @@
+# Standalone account security and privacy Bedrock
+
+**Date:** 2026-08-18  
+**Status:** implemented and verified at package-contract level  
+**Packages:** `@futdevpro/nts-dynamo/account-security`, `@futdevpro/nts-dynamo/privacy-lifecycle`
+
+## Purpose and boundary
+
+This capability lets a Dynamo application own its identity and GDPR lifecycle without redirecting to, or
+depending on, a shared Fleet account. It is reusable Bedrock code, not a complete application account system.
+The consuming product remains responsible for typed persistence models, email delivery, organization and
+permission decisions, HTTP transport, secure browser credential handling, rate limiting, audit wiring and each
+product data-domain contributor.
+
+The modules deliberately expose direct Dynamo contracts. They do not add provider-swapping or replacement
+abstractions around Dynamo.
+
+## Account-security contract
+
+### Passwords
+
+`DyNTS_AccountPassword_ControlService` uses the versioned `dyn-scrypt-v1` format with a unique random salt,
+bounded scrypt parameters and timing-safe verification. It supports a SHA-256 common-password denylist and
+returns `needsRehash` when stored parameters differ from current policy. Malformed stored hashes and
+attacker-controlled work factors produce a safe negative result while still performing bounded dummy work.
+Passwords are never copied into errors.
+
+### Email verification and password reset
+
+`DyNTS_AccountChallenge_ControlService` issues opaque 256-bit-or-stronger credentials for two isolated purposes:
+email verification and password reset. Only SHA-256 token hashes enter persistence. Issuing a replacement
+atomically revokes its active predecessor for the same subject and purpose. Consumption must be a single
+compare-and-set operation that validates purpose, active state and expiry before marking the record consumed.
+Raw tokens are returned only once after successful persistence.
+
+Enumeration-neutral register/reset responses are an HTTP-boundary responsibility: the service must not reveal
+whether an email exists. The application must rate-limit issue and consume operations and deliver the raw token
+only through an approved out-of-band channel.
+
+### Sessions
+
+`DyNTS_AccountSession_ControlService` uses opaque random access and refresh credentials; no self-contained JWT is
+required. Only hashes are stored. An access credential resolves through an active server-side session, so
+logout, password change, account restriction and incident response can revoke it immediately.
+
+Refresh credentials are one-time ledger entries. Rotation uses an adapter-provided compare-and-set transaction.
+Reuse of an already consumed credential, including a concurrent rotation race, revokes the entire family. The
+user-safe session projection excludes subject, family and token hashes. The application decides authorization
+before calling individual or subject-wide revocation methods.
+
+The adapter contract is normative: session creation, token replacement and token-state changes must be atomic.
+An in-memory or multi-step production adapter would invalidate replay protection.
+
+## Privacy lifecycle contract
+
+### Data-subject requests
+
+`DyNTS_PrivacyLifecycle_ControlService` creates subject-, organization- and request-type-scoped idempotency
+hashes. The raw idempotency key is never stored. Each request has an explicit policy-supplied deadline and uses
+the following durable state family:
+
+`received → identity-verified → scoped → planned → executing → verifying → completed`
+
+Supported terminal/non-happy states are `partially-completed`, `rejected-with-reason`, `cancelled`,
+`failed-retryable` and `failed-terminal`. The current orchestrator produces `completed` or
+`partially-completed`; policy-specific rejection/cancellation/failure entry points remain consumer-owned until a
+shared cross-product transition contract is justified.
+
+Every registered contributor is ordered deterministically. Its durable `plan`, idempotent `execute` and
+read-only `verify` operations return content-free structured outcomes. Planning finishes and is persisted before
+the request enters `planned`; a planning failure becomes a resumable partial outcome without executing another
+domain against an incomplete plan set. Successful contributors are skipped on resume and failed contributors
+are retried. A retention result is valid only with an explicit matching basis code. Cross-subject reads return
+the same not-found response as an absent request.
+
+The consuming application must register contributors for identity, session, membership, pipelines/projects,
+agent sessions, artifacts, audit, support, subscription/billing and backup where those domains exist. Export
+contributors must generate machine-readable, checksummed, short-lived artifacts; erasure contributors must use
+hard delete by default and anonymize only where a documented retention basis requires it.
+
+### Legal acceptance and consent
+
+`DyNTS_PrivacyLedger_ControlService` keeps legal acceptance separate from optional-purpose consent. Legal records
+bind the subject to an exact document type, version and SHA-256 checksum. Consent is append-only and scoped by
+purpose and policy version; withdrawal creates a new event instead of mutating history. The ledger projection
+returns both full history and the latest decision per purpose.
+
+Adapters must enforce tenant/subject scoping and idempotency uniqueness. Document and privacy-notice content is
+not stored in these event records; the checksum binds the separately versioned canonical document.
+
+## Data-minimization and diagnostics
+
+- No password, bearer credential, challenge credential or raw idempotency key is persisted by these services.
+- Stable error messages contain no email address, token, password, file content, cell content or contributor
+  exception text.
+- Session context is intentionally pre-redacted: device label plus IP and user-agent hashes only.
+- Contributor outcomes carry codes, counts, checksums and retention basis, not exported personal data.
+- User-facing request, consent and legal-acceptance views omit idempotency hashes and request fingerprints;
+  those fields remain server-side persistence metadata.
+- Consumers must preserve this boundary in logs, audits, HTTP errors and analytics snapshots.
+
+## Required production integrations
+
+Before a product can claim production readiness, it must provide and test:
+
+1. transaction-safe MongoDB adapters for challenges, sessions, privacy requests and ledgers;
+2. normalized unique identity records and verified-email privilege gates;
+3. API rate limits for register, login, challenge issue/consume and refresh;
+4. a reviewed browser credential transport/storage threat model;
+5. organization membership and permission checks at every tenant-scoped route;
+6. all applicable DSAR contributors, export delivery expiry and backup restore/re-erasure procedure;
+7. content-redaction snapshots for logs, errors, analytics and audit events;
+8. automated feature and cross-feature user-journey E2E coverage including cleanup.
+
+## Verification
+
+Measured on 2026-08-18:
+
+- account password suite: 7 specs, 0 failures;
+- session suite: 10 specs, 0 failures;
+- one-time challenge suite: 5 specs, 0 failures;
+- privacy lifecycle suite: 7 specs, 0 failures;
+- privacy ledger suite: 5 specs, 0 failures;
+- complete package suite: 1,687 specs, 0 failures, 146 explicitly pending specs;
+- TypeScript build: passed;
+- changed-module ESLint: passed with zero warnings;
+- package import validator: existing baseline, 82 findings in 76 files;
+- package naming validator: existing baseline, 101 findings in 68 files.
+
+The repository-wide convention findings predate this capability and are not represented as fixed. The new
+modules pass their direct compiler, lint and regression gates.

package/build/_modules/account-security/_enums/account-challenge-purpose.type-enum.d.ts

@@ -0,0 +1,6 @@
+/** Supported one-time account challenge purposes. */
+export declare enum DyNTS_AccountChallengePurpose_Type {
+    emailVerification = "email-verification",
+    passwordReset = "password-reset"
+}
+//# sourceMappingURL=account-challenge-purpose.type-enum.d.ts.map

package/build/_modules/account-security/_enums/account-challenge-purpose.type-enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-purpose.type-enum.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_enums/account-challenge-purpose.type-enum.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,oBAAY,kCAAkC;IAC5C,iBAAiB,uBAAuB;IACxC,aAAa,mBAAmB;CACjC"}

package/build/_modules/account-security/_enums/account-challenge-purpose.type-enum.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_AccountChallengePurpose_Type = void 0;
+/** Supported one-time account challenge purposes. */
+var DyNTS_AccountChallengePurpose_Type;
+(function (DyNTS_AccountChallengePurpose_Type) {
+    DyNTS_AccountChallengePurpose_Type["emailVerification"] = "email-verification";
+    DyNTS_AccountChallengePurpose_Type["passwordReset"] = "password-reset";
+})(DyNTS_AccountChallengePurpose_Type || (exports.DyNTS_AccountChallengePurpose_Type = DyNTS_AccountChallengePurpose_Type = {}));
+//# sourceMappingURL=account-challenge-purpose.type-enum.js.map

package/build/_modules/account-security/_enums/account-challenge-purpose.type-enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-purpose.type-enum.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_enums/account-challenge-purpose.type-enum.ts"],"names":[],"mappings":";;;AAAA,qDAAqD;AACrD,IAAY,kCAGX;AAHD,WAAY,kCAAkC;IAC5C,8EAAwC,CAAA;IACxC,sEAAgC,CAAA;AAClC,CAAC,EAHW,kCAAkC,kDAAlC,kCAAkC,QAG7C"}

package/build/_modules/account-security/_enums/account-refresh-token-state.type-enum.d.ts

@@ -0,0 +1,7 @@
+/** One-time refresh-token ledger states. */
+export declare enum DyNTS_AccountRefreshTokenState_Type {
+    active = "active",
+    used = "used",
+    revoked = "revoked"
+}
+//# sourceMappingURL=account-refresh-token-state.type-enum.d.ts.map

package/build/_modules/account-security/_enums/account-refresh-token-state.type-enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-refresh-token-state.type-enum.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_enums/account-refresh-token-state.type-enum.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,oBAAY,mCAAmC;IAC7C,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,OAAO,YAAY;CACpB"}

package/build/_modules/account-security/_enums/account-refresh-token-state.type-enum.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_AccountRefreshTokenState_Type = void 0;
+/** One-time refresh-token ledger states. */
+var DyNTS_AccountRefreshTokenState_Type;
+(function (DyNTS_AccountRefreshTokenState_Type) {
+    DyNTS_AccountRefreshTokenState_Type["active"] = "active";
+    DyNTS_AccountRefreshTokenState_Type["used"] = "used";
+    DyNTS_AccountRefreshTokenState_Type["revoked"] = "revoked";
+})(DyNTS_AccountRefreshTokenState_Type || (exports.DyNTS_AccountRefreshTokenState_Type = DyNTS_AccountRefreshTokenState_Type = {}));
+//# sourceMappingURL=account-refresh-token-state.type-enum.js.map

package/build/_modules/account-security/_enums/account-refresh-token-state.type-enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-refresh-token-state.type-enum.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_enums/account-refresh-token-state.type-enum.ts"],"names":[],"mappings":";;;AAAA,4CAA4C;AAC5C,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,wDAAiB,CAAA;IACjB,oDAAa,CAAA;IACb,0DAAmB,CAAA;AACrB,CAAC,EAJW,mCAAmC,mDAAnC,mCAAmC,QAI9C"}

package/build/_modules/account-security/_enums/account-session-state.type-enum.d.ts

@@ -0,0 +1,7 @@
+/** Persisted standalone account-session states. */
+export declare enum DyNTS_AccountSessionState_Type {
+    active = "active",
+    revoked = "revoked",
+    expired = "expired"
+}
+//# sourceMappingURL=account-session-state.type-enum.d.ts.map

package/build/_modules/account-security/_enums/account-session-state.type-enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-state.type-enum.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_enums/account-session-state.type-enum.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,oBAAY,8BAA8B;IACxC,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB"}

package/build/_modules/account-security/_enums/account-session-state.type-enum.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_AccountSessionState_Type = void 0;
+/** Persisted standalone account-session states. */
+var DyNTS_AccountSessionState_Type;
+(function (DyNTS_AccountSessionState_Type) {
+    DyNTS_AccountSessionState_Type["active"] = "active";
+    DyNTS_AccountSessionState_Type["revoked"] = "revoked";
+    DyNTS_AccountSessionState_Type["expired"] = "expired";
+})(DyNTS_AccountSessionState_Type || (exports.DyNTS_AccountSessionState_Type = DyNTS_AccountSessionState_Type = {}));
+//# sourceMappingURL=account-session-state.type-enum.js.map

package/build/_modules/account-security/_enums/account-session-state.type-enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-state.type-enum.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_enums/account-session-state.type-enum.ts"],"names":[],"mappings":";;;AAAA,mDAAmD;AACnD,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,mDAAiB,CAAA;IACjB,qDAAmB,CAAA;IACnB,qDAAmB,CAAA;AACrB,CAAC,EAJW,8BAA8B,8CAA9B,8BAA8B,QAIzC"}

package/build/_modules/account-security/_models/account-challenge-adapter.interface.d.ts

@@ -0,0 +1,9 @@
+import { DyNTS_AccountChallengePurpose_Type } from '../_enums/account-challenge-purpose.type-enum';
+import { DyNTS_AccountChallengeRecord_Interface } from './account-challenge-record.interface';
+/** Atomic persistence contract for replacing and consuming one-time account challenges. */
+export interface DyNTS_AccountChallengeAdapter_Interface {
+    replaceActiveChallenge(record: DyNTS_AccountChallengeRecord_Interface): Promise<void>;
+    consumeActiveChallenge(tokenHash: string, purpose: DyNTS_AccountChallengePurpose_Type, consumedAt: string): Promise<DyNTS_AccountChallengeRecord_Interface | null>;
+    revokeSubjectChallenges(subjectId: string, purpose: DyNTS_AccountChallengePurpose_Type, revokedAt: string): Promise<void>;
+}
+//# sourceMappingURL=account-challenge-adapter.interface.d.ts.map

package/build/_modules/account-security/_models/account-challenge-adapter.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-adapter.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-adapter.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,+CAA+C,CAAC;AACnG,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAE9F,2FAA2F;AAC3F,MAAM,WAAW,uCAAuC;IACtD,sBAAsB,CAAC,MAAM,EAAE,sCAAsC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,sBAAsB,CACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,kCAAkC,EAC3C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,sCAAsC,GAAG,IAAI,CAAC,CAAC;IAC1D,uBAAuB,CACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,kCAAkC,EAC3C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/build/_modules/account-security/_models/account-challenge-adapter.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-challenge-adapter.interface.js.map

package/build/_modules/account-security/_models/account-challenge-adapter.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-adapter.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-adapter.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-challenge-issued.interface.d.ts

@@ -0,0 +1,7 @@
+/** Raw one-time challenge returned once after its hash is persisted. */
+export interface DyNTS_AccountChallengeIssued_Interface {
+    challengeId: string;
+    token: string;
+    expiresAt: string;
+}
+//# sourceMappingURL=account-challenge-issued.interface.d.ts.map

package/build/_modules/account-security/_models/account-challenge-issued.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-issued.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-issued.interface.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,WAAW,sCAAsC;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/build/_modules/account-security/_models/account-challenge-issued.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-challenge-issued.interface.js.map

package/build/_modules/account-security/_models/account-challenge-issued.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-issued.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-issued.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-challenge-record.interface.d.ts

@@ -0,0 +1,13 @@
+import { DyNTS_AccountChallengePurpose_Type } from '../_enums/account-challenge-purpose.type-enum';
+/** Server-only one-time account challenge record containing a credential hash only. */
+export interface DyNTS_AccountChallengeRecord_Interface {
+    challengeId: string;
+    subjectId: string;
+    purpose: DyNTS_AccountChallengePurpose_Type;
+    tokenHash: string;
+    createdAt: string;
+    expiresAt: string;
+    consumedAt: string;
+    revokedAt: string;
+}
+//# sourceMappingURL=account-challenge-record.interface.d.ts.map

package/build/_modules/account-security/_models/account-challenge-record.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-record.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-record.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,+CAA+C,CAAC;AAEnG,uFAAuF;AACvF,MAAM,WAAW,sCAAsC;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,kCAAkC,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/build/_modules/account-security/_models/account-challenge-record.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-challenge-record.interface.js.map

package/build/_modules/account-security/_models/account-challenge-record.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-record.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-record.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-challenge-result.interface.d.ts

@@ -0,0 +1,8 @@
+import { DyNTS_AccountChallengePurpose_Type } from '../_enums/account-challenge-purpose.type-enum';
+/** Trusted identity binding returned after an atomic one-time challenge consumption. */
+export interface DyNTS_AccountChallengeResult_Interface {
+    challengeId: string;
+    subjectId: string;
+    purpose: DyNTS_AccountChallengePurpose_Type;
+}
+//# sourceMappingURL=account-challenge-result.interface.d.ts.map

package/build/_modules/account-security/_models/account-challenge-result.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-result.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-result.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,+CAA+C,CAAC;AAEnG,wFAAwF;AACxF,MAAM,WAAW,sCAAsC;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,kCAAkC,CAAC;CAC7C"}

package/build/_modules/account-security/_models/account-challenge-result.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-challenge-result.interface.js.map

package/build/_modules/account-security/_models/account-challenge-result.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-result.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-result.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-challenge-settings.interface.d.ts

@@ -0,0 +1,9 @@
+import { DyNTS_AccountChallengeAdapter_Interface } from './account-challenge-adapter.interface';
+/** Runtime settings for one-time account challenges. */
+export interface DyNTS_AccountChallengeSettings_Interface {
+    adapter: DyNTS_AccountChallengeAdapter_Interface;
+    ttlMs?: number;
+    tokenBytes?: number;
+    clock?: () => Date;
+}
+//# sourceMappingURL=account-challenge-settings.interface.d.ts.map

package/build/_modules/account-security/_models/account-challenge-settings.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-settings.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-settings.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,uCAAuC,CAAC;AAEhG,wDAAwD;AACxD,MAAM,WAAW,wCAAwC;IACvD,OAAO,EAAE,uCAAuC,CAAC;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB"}

package/build/_modules/account-security/_models/account-challenge-settings.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-challenge-settings.interface.js.map

package/build/_modules/account-security/_models/account-challenge-settings.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-settings.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-settings.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-password-policy.interface.d.ts

@@ -0,0 +1,12 @@
+/** Password-hashing and validation policy for the standalone Dynamo account capability. */
+export interface DyNTS_AccountPasswordPolicy_Interface {
+    minLength: number;
+    maxLength: number;
+    scryptCost: number;
+    scryptBlockSize: number;
+    scryptParallelization: number;
+    derivedKeyLength: number;
+    saltLength: number;
+    commonPasswordSha256: string[];
+}
+//# sourceMappingURL=account-password-policy.interface.d.ts.map

package/build/_modules/account-security/_models/account-password-policy.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-password-policy.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-password-policy.interface.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,MAAM,WAAW,qCAAqC;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC"}

package/build/_modules/account-security/_models/account-password-policy.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-password-policy.interface.js.map

package/build/_modules/account-security/_models/account-password-policy.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-password-policy.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-password-policy.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-password-verification.interface.d.ts

@@ -0,0 +1,6 @@
+/** Content-free password verification result; never carries the password or derived bytes. */
+export interface DyNTS_AccountPasswordVerification_Interface {
+    isValid: boolean;
+    needsRehash: boolean;
+}
+//# sourceMappingURL=account-password-verification.interface.d.ts.map

package/build/_modules/account-security/_models/account-password-verification.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-password-verification.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-password-verification.interface.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,MAAM,WAAW,2CAA2C;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;CACtB"}

package/build/_modules/account-security/_models/account-password-verification.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-password-verification.interface.js.map

package/build/_modules/account-security/_models/account-password-verification.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-password-verification.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-password-verification.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-refresh-token-record.interface.d.ts

@@ -0,0 +1,13 @@
+import { DyNTS_AccountRefreshTokenState_Type } from '../_enums/account-refresh-token-state.type-enum';
+/** Server-only one-time refresh-token ledger record. */
+export interface DyNTS_AccountRefreshTokenRecord_Interface {
+    tokenHash: string;
+    sessionId: string;
+    familyId: string;
+    subjectId: string;
+    generation: number;
+    state: DyNTS_AccountRefreshTokenState_Type;
+    expiresAt: string;
+    usedAt: string;
+}
+//# sourceMappingURL=account-refresh-token-record.interface.d.ts.map

package/build/_modules/account-security/_models/account-refresh-token-record.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-refresh-token-record.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-refresh-token-record.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AAEtG,wDAAwD;AACxD,MAAM,WAAW,yCAAyC;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,mCAAmC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/build/_modules/account-security/_models/account-refresh-token-record.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-refresh-token-record.interface.js.map

package/build/_modules/account-security/_models/account-refresh-token-record.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-refresh-token-record.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-refresh-token-record.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-session-adapter.interface.d.ts

@@ -0,0 +1,19 @@
+import { DyNTS_AccountRefreshTokenRecord_Interface } from './account-refresh-token-record.interface';
+import { DyNTS_AccountSessionCreate_Interface } from './account-session-create.interface';
+import { DyNTS_AccountSessionRecord_Interface } from './account-session-record.interface';
+import { DyNTS_AccountSessionRotate_Interface } from './account-session-rotate.interface';
+/**
+ * Persistence contract. Implementations must make create and rotate atomic and apply compare-and-set semantics.
+ */
+export interface DyNTS_AccountSessionAdapter_Interface {
+    createSession(set: DyNTS_AccountSessionCreate_Interface): Promise<void>;
+    findSessionById(sessionId: string): Promise<DyNTS_AccountSessionRecord_Interface | null>;
+    findSessionByAccessTokenHash(accessTokenHash: string): Promise<DyNTS_AccountSessionRecord_Interface | null>;
+    findRefreshTokenByHash(tokenHash: string): Promise<DyNTS_AccountRefreshTokenRecord_Interface | null>;
+    rotateSession(set: DyNTS_AccountSessionRotate_Interface): Promise<boolean>;
+    revokeSession(sessionId: string, revokedAt: string, reasonCode: string): Promise<void>;
+    revokeFamily(familyId: string, revokedAt: string, reasonCode: string): Promise<void>;
+    revokeSubject(subjectId: string, revokedAt: string, reasonCode: string): Promise<void>;
+    listSubjectSessions(subjectId: string): Promise<DyNTS_AccountSessionRecord_Interface[]>;
+}
+//# sourceMappingURL=account-session-adapter.interface.d.ts.map

package/build/_modules/account-security/_models/account-session-adapter.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-adapter.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-adapter.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAC1F,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAC1F,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAE1F;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,aAAa,CAAC,GAAG,EAAE,oCAAoC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAAC;IACzF,4BAA4B,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAAC;IAC5G,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,yCAAyC,GAAG,IAAI,CAAC,CAAC;IACrG,aAAa,CAAC,GAAG,EAAE,oCAAoC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,EAAE,CAAC,CAAC;CACzF"}

package/build/_modules/account-security/_models/account-session-adapter.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-session-adapter.interface.js.map

package/build/_modules/account-security/_models/account-session-adapter.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-adapter.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-adapter.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-session-claims.interface.d.ts

@@ -0,0 +1,8 @@
+/** Authenticated server-side subject projection derived from an opaque access token. */
+export interface DyNTS_AccountSessionClaims_Interface {
+    subjectId: string;
+    sessionId: string;
+    familyId: string;
+    authorizationVersion: number;
+}
+//# sourceMappingURL=account-session-claims.interface.d.ts.map

package/build/_modules/account-security/_models/account-session-claims.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-claims.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-claims.interface.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,MAAM,WAAW,oCAAoC;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;CAC9B"}

package/build/_modules/account-security/_models/account-session-claims.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-session-claims.interface.js.map

package/build/_modules/account-security/_models/account-session-claims.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-claims.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-claims.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-session-context.interface.d.ts

@@ -0,0 +1,7 @@
+/** Minimal, pre-redacted session context persisted for user-facing session recognition. */
+export interface DyNTS_AccountSessionContext_Interface {
+    deviceName: string;
+    ipAddressHash: string;
+    userAgentHash: string;
+}
+//# sourceMappingURL=account-session-context.interface.d.ts.map

package/build/_modules/account-security/_models/account-session-context.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-context.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-context.interface.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,MAAM,WAAW,qCAAqC;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB"}

package/build/_modules/account-security/_models/account-session-context.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-session-context.interface.js.map

package/build/_modules/account-security/_models/account-session-context.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-context.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-context.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-session-create.interface.d.ts

@@ -0,0 +1,8 @@
+import { DyNTS_AccountRefreshTokenRecord_Interface } from './account-refresh-token-record.interface';
+import { DyNTS_AccountSessionRecord_Interface } from './account-session-record.interface';
+/** Atomic session creation payload for a concrete Dynamo DataService adapter. */
+export interface DyNTS_AccountSessionCreate_Interface {
+    session: DyNTS_AccountSessionRecord_Interface;
+    refreshToken: DyNTS_AccountRefreshTokenRecord_Interface;
+}
+//# sourceMappingURL=account-session-create.interface.d.ts.map

package/build/_modules/account-security/_models/account-session-create.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-create.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-create.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAE1F,iFAAiF;AACjF,MAAM,WAAW,oCAAoC;IACnD,OAAO,EAAE,oCAAoC,CAAC;IAC9C,YAAY,EAAE,yCAAyC,CAAC;CACzD"}

package/build/_modules/account-security/_models/account-session-create.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-session-create.interface.js.map

package/build/_modules/account-security/_models/account-session-create.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-create.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-create.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-session-record.interface.d.ts

@@ -0,0 +1,21 @@
+import { DyNTS_AccountSessionState_Type } from '../_enums/account-session-state.type-enum';
+import { DyNTS_AccountSessionContext_Interface } from './account-session-context.interface';
+/** Server-only session record. It stores token hashes, never bearer credentials. */
+export interface DyNTS_AccountSessionRecord_Interface {
+    sessionId: string;
+    familyId: string;
+    subjectId: string;
+    accessTokenHash: string;
+    accessExpiresAt: string;
+    refreshExpiresAt: string;
+    state: DyNTS_AccountSessionState_Type;
+    generation: number;
+    revision: number;
+    authorizationVersion: number;
+    createdAt: string;
+    lastRotatedAt: string;
+    revokedAt: string;
+    revocationReason: string;
+    context: DyNTS_AccountSessionContext_Interface;
+}
+//# sourceMappingURL=account-session-record.interface.d.ts.map

package/build/_modules/account-security/_models/account-session-record.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-record.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-record.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAE5F,oFAAoF;AACpF,MAAM,WAAW,oCAAoC;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,8BAA8B,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,qCAAqC,CAAC;CAChD"}

package/build/_modules/account-security/_models/account-session-record.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-session-record.interface.js.map

package/build/_modules/account-security/_models/account-session-record.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-record.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-record.interface.ts"],"names":[],"mappings":""}