@futdevpro/nts-dynamo 1.15.140 → 1.15.141

package/build/_modules/account-security/_models/account-session-rotate.interface.d.ts

@@ -0,0 +1,11 @@
+import { DyNTS_AccountRefreshTokenRecord_Interface } from './account-refresh-token-record.interface';
+import { DyNTS_AccountSessionRecord_Interface } from './account-session-record.interface';
+/** Atomic one-time refresh rotation payload for a concrete Dynamo DataService adapter. */
+export interface DyNTS_AccountSessionRotate_Interface {
+    expectedSessionRevision: number;
+    currentRefreshTokenHash: string;
+    usedAt: string;
+    replacementSession: DyNTS_AccountSessionRecord_Interface;
+    replacementRefreshToken: DyNTS_AccountRefreshTokenRecord_Interface;
+}
+//# sourceMappingURL=account-session-rotate.interface.d.ts.map

package/build/_modules/account-security/_models/account-session-rotate.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-rotate.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-rotate.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAE1F,0FAA0F;AAC1F,MAAM,WAAW,oCAAoC;IACnD,uBAAuB,EAAE,MAAM,CAAC;IAChC,uBAAuB,EAAE,MAAM,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,oCAAoC,CAAC;IACzD,uBAAuB,EAAE,yCAAyC,CAAC;CACpE"}

package/build/_modules/account-security/_models/account-session-rotate.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-session-rotate.interface.js.map

package/build/_modules/account-security/_models/account-session-rotate.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-rotate.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-rotate.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-session-settings.interface.d.ts

@@ -0,0 +1,11 @@
+import { DyNTS_AccountSessionAdapter_Interface } from './account-session-adapter.interface';
+/** Runtime settings for opaque access credentials and rotating one-time refresh families. */
+export interface DyNTS_AccountSessionSettings_Interface {
+    adapter: DyNTS_AccountSessionAdapter_Interface;
+    accessTtlMs?: number;
+    refreshTtlMs?: number;
+    tokenBytes?: number;
+    maxRefreshRotations?: number;
+    clock?: () => Date;
+}
+//# sourceMappingURL=account-session-settings.interface.d.ts.map

package/build/_modules/account-security/_models/account-session-settings.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-settings.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-settings.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAE5F,6FAA6F;AAC7F,MAAM,WAAW,sCAAsC;IACrD,OAAO,EAAE,qCAAqC,CAAC;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB"}

package/build/_modules/account-security/_models/account-session-settings.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-session-settings.interface.js.map

package/build/_modules/account-security/_models/account-session-settings.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-settings.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-settings.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-session-token-pair.interface.d.ts

@@ -0,0 +1,9 @@
+/** Raw credentials returned exactly once to the transport layer after an atomic persistence commit. */
+export interface DyNTS_AccountSessionTokenPair_Interface {
+    sessionId: string;
+    accessToken: string;
+    refreshToken: string;
+    accessExpiresAt: string;
+    refreshExpiresAt: string;
+}
+//# sourceMappingURL=account-session-token-pair.interface.d.ts.map

package/build/_modules/account-security/_models/account-session-token-pair.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-token-pair.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-token-pair.interface.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,MAAM,WAAW,uCAAuC;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B"}

package/build/_modules/account-security/_models/account-session-token-pair.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-session-token-pair.interface.js.map

package/build/_modules/account-security/_models/account-session-token-pair.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-token-pair.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-token-pair.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-session-view.interface.d.ts

@@ -0,0 +1,13 @@
+import { DyNTS_AccountSessionState_Type } from '../_enums/account-session-state.type-enum';
+import { DyNTS_AccountSessionContext_Interface } from './account-session-context.interface';
+/** User-safe session list item without access or refresh token hashes. */
+export interface DyNTS_AccountSessionView_Interface {
+    sessionId: string;
+    state: DyNTS_AccountSessionState_Type;
+    createdAt: string;
+    lastRotatedAt: string;
+    accessExpiresAt: string;
+    refreshExpiresAt: string;
+    context: DyNTS_AccountSessionContext_Interface;
+}
+//# sourceMappingURL=account-session-view.interface.d.ts.map

package/build/_modules/account-security/_models/account-session-view.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-view.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-view.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAE5F,0EAA0E;AAC1E,MAAM,WAAW,kCAAkC;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,8BAA8B,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,qCAAqC,CAAC;CAChD"}

package/build/_modules/account-security/_models/account-session-view.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-session-view.interface.js.map

package/build/_modules/account-security/_models/account-session-view.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-view.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-view.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/account-challenge.control-service.d.ts

@@ -0,0 +1,24 @@
+import { DyNTS_AccountChallengePurpose_Type } from './_enums/account-challenge-purpose.type-enum';
+import { DyNTS_AccountChallengeIssued_Interface } from './_models/account-challenge-issued.interface';
+import { DyNTS_AccountChallengeResult_Interface } from './_models/account-challenge-result.interface';
+import { DyNTS_AccountChallengeSettings_Interface } from './_models/account-challenge-settings.interface';
+/** Issues and atomically consumes opaque email-verification and password-reset credentials. */
+export declare class DyNTS_AccountChallenge_ControlService {
+    private readonly adapter;
+    private readonly ttlMs;
+    private readonly tokenBytes;
+    private readonly clock;
+    /** Creates a challenge service over an atomic persistence adapter. */
+    constructor(set: DyNTS_AccountChallengeSettings_Interface);
+    /** Replaces any active subject-purpose challenge before returning the new raw credential once. */
+    issueChallenge(subjectId: string, purpose: DyNTS_AccountChallengePurpose_Type): Promise<DyNTS_AccountChallengeIssued_Interface>;
+    /** Atomically consumes one unexpired challenge and returns its trusted subject binding. */
+    consumeChallenge(token: string, purpose: DyNTS_AccountChallengePurpose_Type): Promise<DyNTS_AccountChallengeResult_Interface>;
+    /** Revokes every active challenge for a subject-purpose pair. */
+    revokeSubjectChallenges(subjectId: string, purpose: DyNTS_AccountChallengePurpose_Type): Promise<void>;
+    private hashToken;
+    private validateSettings;
+    private isFutureDate;
+    private buildInvalid;
+}
+//# sourceMappingURL=account-challenge.control-service.d.ts.map

package/build/_modules/account-security/account-challenge.control-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge.control-service.d.ts","sourceRoot":"","sources":["../../../src/_modules/account-security/account-challenge.control-service.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAElG,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AAEtG,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAK1G,+FAA+F;AAC/F,qBAAa,qCAAqC;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0C;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,sEAAsE;gBAC1D,GAAG,EAAE,wCAAwC;IAQzD,kGAAkG;IACrF,cAAc,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,sCAAsC,CAAC;IA+BlD,2FAA2F;IAC9E,gBAAgB,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,sCAAsC,CAAC;IAkClD,iEAAiE;IACpD,uBAAuB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC;IAYhB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,YAAY;CASrB"}

package/build/_modules/account-security/account-challenge.control-service.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_AccountChallenge_ControlService = void 0;
+const crypto_1 = require("crypto");
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const global_settings_const_1 = require("../../_collections/global-settings.const");
+const account_challenge_purpose_type_enum_1 = require("./_enums/account-challenge-purpose.type-enum");
+const DEFAULT_CHALLENGE_TTL_MS = 15 * 60 * 1000;
+const DEFAULT_TOKEN_BYTES = 32;
+/** Issues and atomically consumes opaque email-verification and password-reset credentials. */
+class DyNTS_AccountChallenge_ControlService {
+    adapter;
+    ttlMs;
+    tokenBytes;
+    clock;
+    /** Creates a challenge service over an atomic persistence adapter. */
+    constructor(set) {
+        this.adapter = set.adapter;
+        this.ttlMs = set.ttlMs ?? DEFAULT_CHALLENGE_TTL_MS;
+        this.tokenBytes = set.tokenBytes ?? DEFAULT_TOKEN_BYTES;
+        this.clock = set.clock ?? (() => new Date());
+        this.validateSettings();
+    }
+    /** Replaces any active subject-purpose challenge before returning the new raw credential once. */
+    async issueChallenge(subjectId, purpose) {
+        if (!subjectId
+            || subjectId.length > 256
+            || !Object.values(account_challenge_purpose_type_enum_1.DyNTS_AccountChallengePurpose_Type).includes(purpose)) {
+            throw this.buildInvalid('CHALLENGE_REQUEST_INVALID');
+        }
+        const now = this.clock();
+        const token = (0, crypto_1.randomBytes)(this.tokenBytes).toString('base64url');
+        const record = {
+            challengeId: (0, crypto_1.randomUUID)(),
+            subjectId: subjectId,
+            purpose: purpose,
+            tokenHash: this.hashToken(token),
+            createdAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + this.ttlMs).toISOString(),
+            consumedAt: '',
+            revokedAt: '',
+        };
+        await this.adapter.replaceActiveChallenge(record);
+        return {
+            challengeId: record.challengeId,
+            token: token,
+            expiresAt: record.expiresAt,
+        };
+    }
+    /** Atomically consumes one unexpired challenge and returns its trusted subject binding. */
+    async consumeChallenge(token, purpose) {
+        if (!token
+            || token.length > 512
+            || !Object.values(account_challenge_purpose_type_enum_1.DyNTS_AccountChallengePurpose_Type).includes(purpose)) {
+            throw this.buildInvalid('CHALLENGE_INVALID');
+        }
+        const now = this.clock();
+        const tokenHash = this.hashToken(token);
+        const record = await this.adapter.consumeActiveChallenge(tokenHash, purpose, now.toISOString());
+        if (record?.purpose !== purpose
+            || record.tokenHash !== tokenHash
+            || !record.consumedAt
+            || !!record.revokedAt
+            || !this.isFutureDate(record.expiresAt, now)) {
+            throw this.buildInvalid('CHALLENGE_INVALID');
+        }
+        return {
+            challengeId: record.challengeId,
+            subjectId: record.subjectId,
+            purpose: record.purpose,
+        };
+    }
+    /** Revokes every active challenge for a subject-purpose pair. */
+    async revokeSubjectChallenges(subjectId, purpose) {
+        if (!subjectId
+            || subjectId.length > 256
+            || !Object.values(account_challenge_purpose_type_enum_1.DyNTS_AccountChallengePurpose_Type).includes(purpose)) {
+            throw this.buildInvalid('CHALLENGE_REQUEST_INVALID');
+        }
+        await this.adapter.revokeSubjectChallenges(subjectId, purpose, this.clock().toISOString());
+    }
+    hashToken(token) {
+        return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+    }
+    validateSettings() {
+        if (!this.adapter
+            || !Number.isSafeInteger(this.ttlMs)
+            || this.ttlMs < 60_000
+            || this.ttlMs > 24 * 60 * 60 * 1000
+            || !Number.isSafeInteger(this.tokenBytes)
+            || this.tokenBytes < 32
+            || this.tokenBytes > 128) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                status: 500,
+                errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|ACCOUNT_SECURITY|CHALLENGE_SETTINGS_INVALID`,
+                message: 'The account challenge settings are outside supported safe bounds.',
+                userMessage: 'The account security service is unavailable.',
+                issuerService: this.constructor.name,
+            });
+        }
+    }
+    isFutureDate(value, now) {
+        const timestamp = new Date(value).getTime();
+        return Number.isFinite(timestamp) && timestamp > now.getTime();
+    }
+    buildInvalid(errorCode) {
+        return new fsm_dynamo_1.DyFM_Error({
+            status: 401,
+            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|ACCOUNT_SECURITY|${errorCode}`,
+            message: 'Opaque one-time account challenge validation failed.',
+            userMessage: 'The verification request is invalid or has expired. Please request a new one.',
+            issuerService: this.constructor.name,
+        });
+    }
+}
+exports.DyNTS_AccountChallenge_ControlService = DyNTS_AccountChallenge_ControlService;
+//# sourceMappingURL=account-challenge.control-service.js.map

package/build/_modules/account-security/account-challenge.control-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge.control-service.js","sourceRoot":"","sources":["../../../src/_modules/account-security/account-challenge.control-service.ts"],"names":[],"mappings":";;;AAAA,mCAIgB;AAEhB,sDAAmD;AAEnD,oFAAiF;AACjF,sGAAkG;AAOlG,MAAM,wBAAwB,GAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,MAAM,mBAAmB,GAAW,EAAE,CAAC;AAEvC,+FAA+F;AAC/F,MAAa,qCAAqC;IAC/B,OAAO,CAA0C;IACjD,KAAK,CAAS;IACd,UAAU,CAAS;IACnB,KAAK,CAAa;IAEnC,sEAAsE;IACtE,YAAY,GAA6C;QACvD,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,wBAAwB,CAAC;QACnD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,mBAAmB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,GAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC1B,CAAC;IAED,kGAAkG;IAC3F,KAAK,CAAC,cAAc,CACzB,SAAiB,EACjB,OAA2C;QAE3C,IACE,CAAC,SAAS;eACP,SAAS,CAAC,MAAM,GAAG,GAAG;eACtB,CAAC,MAAM,CAAC,MAAM,CAAC,wEAAkC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EACvE,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,GAAG,GAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAW,IAAA,oBAAW,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,MAAM,GAA2C;YACrD,WAAW,EAAE,IAAA,mBAAU,GAAE;YACzB,SAAS,EAAE,SAAS;YACpB,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAChC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YAC7D,UAAU,EAAE,EAAE;YACd,SAAS,EAAE,EAAE;SACd,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAElD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,2FAA2F;IACpF,KAAK,CAAC,gBAAgB,CAC3B,KAAa,EACb,OAA2C;QAE3C,IACE,CAAC,KAAK;eACH,KAAK,CAAC,MAAM,GAAG,GAAG;eAClB,CAAC,MAAM,CAAC,MAAM,CAAC,wEAAkC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EACvE,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,MAAM,GAAkD,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CACrG,SAAS,EACT,OAAO,EACP,GAAG,CAAC,WAAW,EAAE,CAClB,CAAC;QAEF,IACE,MAAM,EAAE,OAAO,KAAK,OAAO;eACxB,MAAM,CAAC,SAAS,KAAK,SAAS;eAC9B,CAAC,MAAM,CAAC,UAAU;eAClB,CAAC,CAAC,MAAM,CAAC,SAAS;eAClB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,EAC5C,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;IAED,iEAAiE;IAC1D,KAAK,CAAC,uBAAuB,CAClC,SAAiB,EACjB,OAA2C;QAE3C,IACE,CAAC,SAAS;eACP,SAAS,CAAC,MAAM,GAAG,GAAG;eACtB,CAAC,MAAM,CAAC,MAAM,CAAC,wEAAkC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EACvE,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7F,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,gBAAgB;QACtB,IACE,CAAC,IAAI,CAAC,OAAO;eACV,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;eACjC,IAAI,CAAC,KAAK,GAAG,MAAM;eACnB,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;eAChC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;eACtC,IAAI,CAAC,UAAU,GAAG,EAAE;eACpB,IAAI,CAAC,UAAU,GAAG,GAAG,EACxB,CAAC;YACD,MAAM,IAAI,uBAAU,CAAC;gBACnB,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,GAAG,6CAAqB,CAAC,mBAAmB,8CAA8C;gBACrG,OAAO,EAAE,mEAAmE;gBAC5E,WAAW,EAAE,8CAA8C;gBAC3D,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,KAAa,EAAE,GAAS;QAC3C,MAAM,SAAS,GAAW,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAEpD,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACjE,CAAC;IAEO,YAAY,CAAC,SAAiB;QACpC,OAAO,IAAI,uBAAU,CAAC;YACpB,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,GAAG,6CAAqB,CAAC,mBAAmB,qBAAqB,SAAS,EAAE;YACvF,OAAO,EAAE,sDAAsD;YAC/D,WAAW,EAAE,+EAA+E;YAC5F,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;CACF;AA/ID,sFA+IC"}

package/build/_modules/account-security/account-password.control-service.d.ts

@@ -0,0 +1,24 @@
+import { DyNTS_AccountPasswordPolicy_Interface } from './_models/account-password-policy.interface';
+import { DyNTS_AccountPasswordVerification_Interface } from './_models/account-password-verification.interface';
+/**
+ * Standalone password capability using versioned Node scrypt hashes.
+ * Passwords and derived bytes never enter errors, logs or result objects.
+ */
+export declare class DyNTS_AccountPassword_ControlService {
+    private readonly policy;
+    /** Creates a validated immutable policy snapshot. */
+    constructor(policy?: Partial<DyNTS_AccountPasswordPolicy_Interface>);
+    /** Validates and hashes one password to a self-describing scrypt record. */
+    hashPassword(password: string): Promise<string>;
+    /** Performs constant-time verification and reports whether the stored cost should be upgraded. */
+    verifyPassword(password: string, storedHash: string): Promise<DyNTS_AccountPasswordVerification_Interface>;
+    /** Rejects weak, oversized and configured common passwords without exposing their content. */
+    validatePassword(password: string): void;
+    private parseHash;
+    private runDummyDerivation;
+    private deriveKey;
+    private validatePolicy;
+    private isPowerOfTwo;
+    private buildError;
+}
+//# sourceMappingURL=account-password.control-service.d.ts.map

package/build/_modules/account-security/account-password.control-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-password.control-service.d.ts","sourceRoot":"","sources":["../../../src/_modules/account-security/account-password.control-service.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,qCAAqC,EACtC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,2CAA2C,EAC5C,MAAM,mDAAmD,CAAC;AAqC3D;;;GAGG;AACH,qBAAa,oCAAoC;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,qDAAqD;gBACzC,MAAM,CAAC,EAAE,OAAO,CAAC,qCAAqC,CAAC;IAWnE,4EAA4E;IAC/D,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuB5D,kGAAkG;IACrF,cAAc,CACzB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,2CAA2C,CAAC;IA+CvD,8FAA8F;IACvF,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IA0B/C,OAAO,CAAC,SAAS;YA2CH,kBAAkB;IAWhC,OAAO,CAAC,SAAS;IAqBjB,OAAO,CAAC,cAAc;IA0BtB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,UAAU;CASnB"}

package/build/_modules/account-security/account-password.control-service.js

@@ -0,0 +1,214 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_AccountPassword_ControlService = void 0;
+const crypto_1 = require("crypto");
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const global_settings_const_1 = require("../../_collections/global-settings.const");
+const PASSWORD_HASH_VERSION = 'dyn-scrypt-v1';
+const DEFAULT_POLICY = {
+    minLength: 12,
+    maxLength: 128,
+    scryptCost: 16_384,
+    scryptBlockSize: 8,
+    scryptParallelization: 1,
+    derivedKeyLength: 32,
+    saltLength: 16,
+    commonPasswordSha256: [],
+};
+const MAX_VERIFY_COST = 131_072;
+const MAX_VERIFY_BLOCK_SIZE = 8;
+const MAX_VERIFY_PARALLELIZATION = 2;
+const MAX_VERIFY_KEY_LENGTH = 64;
+const MAX_PASSWORD_LENGTH = 1_024;
+const MAX_STORED_HASH_LENGTH = 1_024;
+/**
+ * Standalone password capability using versioned Node scrypt hashes.
+ * Passwords and derived bytes never enter errors, logs or result objects.
+ */
+class DyNTS_AccountPassword_ControlService {
+    policy;
+    /** Creates a validated immutable policy snapshot. */
+    constructor(policy) {
+        this.policy = {
+            ...DEFAULT_POLICY,
+            ...policy,
+            commonPasswordSha256: [
+                ...(policy?.commonPasswordSha256 ?? DEFAULT_POLICY.commonPasswordSha256),
+            ],
+        };
+        this.validatePolicy();
+    }
+    /** Validates and hashes one password to a self-describing scrypt record. */
+    async hashPassword(password) {
+        this.validatePassword(password);
+        const salt = (0, crypto_1.randomBytes)(this.policy.saltLength);
+        const derivedKey = await this.deriveKey({
+            password: password,
+            salt: salt,
+            cost: this.policy.scryptCost,
+            blockSize: this.policy.scryptBlockSize,
+            parallelization: this.policy.scryptParallelization,
+            keyLength: this.policy.derivedKeyLength,
+        });
+        return [
+            PASSWORD_HASH_VERSION,
+            this.policy.scryptCost,
+            this.policy.scryptBlockSize,
+            this.policy.scryptParallelization,
+            salt.toString('base64url'),
+            derivedKey.toString('base64url'),
+        ].join('$');
+    }
+    /** Performs constant-time verification and reports whether the stored cost should be upgraded. */
+    async verifyPassword(password, storedHash) {
+        if (typeof password !== 'string' || Array.from(password).length > this.policy.maxLength) {
+            await this.runDummyDerivation('invalid-password-candidate');
+            return { isValid: false, needsRehash: false };
+        }
+        const parsed = this.parseHash(storedHash);
+        if (!parsed) {
+            await this.runDummyDerivation(password);
+            return { isValid: false, needsRehash: false };
+        }
+        let candidate;
+        try {
+            candidate = await this.deriveKey({
+                password: password,
+                salt: parsed.salt,
+                cost: parsed.cost,
+                blockSize: parsed.blockSize,
+                parallelization: parsed.parallelization,
+                keyLength: parsed.derivedKey.length,
+            });
+        }
+        catch {
+            await this.runDummyDerivation(password);
+            return { isValid: false, needsRehash: false };
+        }
+        const isValid = candidate.length === parsed.derivedKey.length
+            && (0, crypto_1.timingSafeEqual)(candidate, parsed.derivedKey);
+        return {
+            isValid: isValid,
+            needsRehash: isValid && (parsed.cost !== this.policy.scryptCost
+                || parsed.blockSize !== this.policy.scryptBlockSize
+                || parsed.parallelization !== this.policy.scryptParallelization
+                || parsed.derivedKey.length !== this.policy.derivedKeyLength
+                || parsed.salt.length !== this.policy.saltLength),
+        };
+    }
+    /** Rejects weak, oversized and configured common passwords without exposing their content. */
+    validatePassword(password) {
+        if (typeof password !== 'string') {
+            throw this.buildError('PASSWORD_POLICY_LENGTH', 'Password input must be a string.');
+        }
+        const passwordLength = Array.from(password).length;
+        if (passwordLength < this.policy.minLength || passwordLength > this.policy.maxLength) {
+            throw this.buildError('PASSWORD_POLICY_LENGTH', `Password length must be between ${this.policy.minLength} and ${this.policy.maxLength} characters.`);
+        }
+        const commonDigest = (0, crypto_1.createHash)('sha256')
+            .update(password.normalize('NFKC').toLocaleLowerCase('en-US'))
+            .digest('hex');
+        if (this.policy.commonPasswordSha256.includes(commonDigest)) {
+            throw this.buildError('PASSWORD_POLICY_COMMON', 'The password matches a configured common-password denylist entry.');
+        }
+    }
+    parseHash(storedHash) {
+        if (typeof storedHash !== 'string' || storedHash.length > MAX_STORED_HASH_LENGTH) {
+            return null;
+        }
+        const parts = storedHash.split('$');
+        if (parts.length !== 6 || parts[0] !== PASSWORD_HASH_VERSION) {
+            return null;
+        }
+        const cost = Number(parts[1]);
+        const blockSize = Number(parts[2]);
+        const parallelization = Number(parts[3]);
+        const salt = Buffer.from(parts[4], 'base64url');
+        const derivedKey = Buffer.from(parts[5], 'base64url');
+        if (!this.isPowerOfTwo(cost)
+            || cost < 2
+            || cost > MAX_VERIFY_COST
+            || !Number.isInteger(blockSize)
+            || blockSize < 1
+            || blockSize > MAX_VERIFY_BLOCK_SIZE
+            || !Number.isInteger(parallelization)
+            || parallelization < 1
+            || parallelization > MAX_VERIFY_PARALLELIZATION
+            || !salt.length
+            || !derivedKey.length
+            || derivedKey.length > MAX_VERIFY_KEY_LENGTH) {
+            return null;
+        }
+        return {
+            cost: cost,
+            blockSize: blockSize,
+            parallelization: parallelization,
+            salt: salt,
+            derivedKey: derivedKey,
+        };
+    }
+    async runDummyDerivation(password) {
+        await this.deriveKey({
+            password: password,
+            salt: Buffer.alloc(this.policy.saltLength),
+            cost: this.policy.scryptCost,
+            blockSize: this.policy.scryptBlockSize,
+            parallelization: this.policy.scryptParallelization,
+            keyLength: this.policy.derivedKeyLength,
+        });
+    }
+    deriveKey(set) {
+        return new Promise((resolve, reject) => {
+            const maxmem = Math.max(32 * 1024 * 1024, 256 * set.cost * set.blockSize);
+            (0, crypto_1.scrypt)(set.password, set.salt, set.keyLength, {
+                N: set.cost,
+                r: set.blockSize,
+                p: set.parallelization,
+                maxmem: maxmem,
+            }, (error, derivedKey) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve(derivedKey);
+            });
+        });
+    }
+    validatePolicy() {
+        if (!Number.isInteger(this.policy.minLength)
+            || !Number.isInteger(this.policy.maxLength)
+            || this.policy.minLength < 8
+            || this.policy.maxLength < this.policy.minLength
+            || this.policy.maxLength > MAX_PASSWORD_LENGTH
+            || !this.isPowerOfTwo(this.policy.scryptCost)
+            || this.policy.scryptCost > MAX_VERIFY_COST
+            || !Number.isInteger(this.policy.scryptBlockSize)
+            || this.policy.scryptBlockSize < 1
+            || this.policy.scryptBlockSize > MAX_VERIFY_BLOCK_SIZE
+            || !Number.isInteger(this.policy.scryptParallelization)
+            || this.policy.scryptParallelization < 1
+            || this.policy.scryptParallelization > MAX_VERIFY_PARALLELIZATION
+            || !Number.isInteger(this.policy.derivedKeyLength)
+            || this.policy.derivedKeyLength < 16
+            || this.policy.derivedKeyLength > MAX_VERIFY_KEY_LENGTH
+            || !Number.isInteger(this.policy.saltLength)
+            || this.policy.saltLength < 16
+            || this.policy.saltLength > 64) {
+            throw this.buildError('PASSWORD_POLICY_INVALID', 'The password policy is outside supported safe bounds.');
+        }
+    }
+    isPowerOfTwo(value) {
+        return Number.isSafeInteger(value) && value > 0 && (value & (value - 1)) === 0;
+    }
+    buildError(errorCode, message) {
+        return new fsm_dynamo_1.DyFM_Error({
+            status: 400,
+            errorCode: `${global_settings_const_1.DyNTS_global_settings.systemShortCodeName}|ACCOUNT_SECURITY|${errorCode}`,
+            message: message,
+            userMessage: 'The credential does not satisfy the account security policy.',
+            issuerService: this.constructor.name,
+        });
+    }
+}
+exports.DyNTS_AccountPassword_ControlService = DyNTS_AccountPassword_ControlService;
+//# sourceMappingURL=account-password.control-service.js.map

package/build/_modules/account-security/account-password.control-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-password.control-service.js","sourceRoot":"","sources":["../../../src/_modules/account-security/account-password.control-service.ts"],"names":[],"mappings":";;;AAAA,mCAKgB;AAEhB,sDAAmD;AAEnD,oFAAiF;AAQjF,MAAM,qBAAqB,GAAW,eAAe,CAAC;AACtD,MAAM,cAAc,GAA0C;IAC5D,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,GAAG;IACd,UAAU,EAAE,MAAM;IAClB,eAAe,EAAE,CAAC;IAClB,qBAAqB,EAAE,CAAC;IACxB,gBAAgB,EAAE,EAAE;IACpB,UAAU,EAAE,EAAE;IACd,oBAAoB,EAAE,EAAE;CACzB,CAAC;AACF,MAAM,eAAe,GAAW,OAAO,CAAC;AACxC,MAAM,qBAAqB,GAAW,CAAC,CAAC;AACxC,MAAM,0BAA0B,GAAW,CAAC,CAAC;AAC7C,MAAM,qBAAqB,GAAW,EAAE,CAAC;AACzC,MAAM,mBAAmB,GAAW,KAAK,CAAC;AAC1C,MAAM,sBAAsB,GAAW,KAAK,CAAC;AAmB7C;;;GAGG;AACH,MAAa,oCAAoC;IAC9B,MAAM,CAAwC;IAE/D,qDAAqD;IACrD,YAAY,MAAuD;QACjE,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,cAAc;YACjB,GAAG,MAAM;YACT,oBAAoB,EAAE;gBACpB,GAAG,CAAC,MAAM,EAAE,oBAAoB,IAAI,cAAc,CAAC,oBAAoB,CAAC;aACzE;SACF,CAAC;QACF,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED,4EAA4E;IACrE,KAAK,CAAC,YAAY,CAAC,QAAgB;QACxC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAEhC,MAAM,IAAI,GAAW,IAAA,oBAAW,EAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,UAAU,GAAW,MAAM,IAAI,CAAC,SAAS,CAAC;YAC9C,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAC5B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YACtC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;YAClD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACxC,CAAC,CAAC;QAEH,OAAO;YACL,qBAAqB;YACrB,IAAI,CAAC,MAAM,CAAC,UAAU;YACtB,IAAI,CAAC,MAAM,CAAC,eAAe;YAC3B,IAAI,CAAC,MAAM,CAAC,qBAAqB;YACjC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC1B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;SACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED,kGAAkG;IAC3F,KAAK,CAAC,cAAc,CACzB,QAAgB,EAChB,UAAkB;QAElB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACxF,MAAM,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;YAE5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,MAAM,GAAoC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAE3E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAExC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QAED,IAAI,SAAiB,CAAC;QAEtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;gBAC/B,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAExC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,OAAO,GAAY,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,UAAU,CAAC,MAAM;eACjE,IAAA,wBAAe,EAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAEnD,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,OAAO,IAAI,CACtB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU;mBACnC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,eAAe;mBAChD,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,MAAM,CAAC,qBAAqB;mBAC5D,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,gBAAgB;mBACzD,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,CACjD;SACF,CAAC;IACJ,CAAC;IAED,8FAA8F;IACvF,gBAAgB,CAAC,QAAgB;QACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,cAAc,GAAW,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAE3D,IAAI,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACrF,MAAM,IAAI,CAAC,UAAU,CACnB,wBAAwB,EACxB,mCAAmC,IAAI,CAAC,MAAM,CAAC,SAAS,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,cAAc,CACpG,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAW,IAAA,mBAAU,EAAC,QAAQ,CAAC;aAC9C,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;aAC7D,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,CAAC,UAAU,CACnB,wBAAwB,EACxB,mEAAmE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,UAAkB;QAClC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAa,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,qBAAqB,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,SAAS,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,eAAe,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,IAAI,GAAW,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,UAAU,GAAW,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAE9D,IACE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;eACrB,IAAI,GAAG,CAAC;eACR,IAAI,GAAG,eAAe;eACtB,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC;eAC5B,SAAS,GAAG,CAAC;eACb,SAAS,GAAG,qBAAqB;eACjC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC;eAClC,eAAe,GAAG,CAAC;eACnB,eAAe,GAAG,0BAA0B;eAC5C,CAAC,IAAI,CAAC,MAAM;eACZ,CAAC,UAAU,CAAC,MAAM;eAClB,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,SAAS;YACpB,eAAe,EAAE,eAAe;YAChC,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,UAAU;SACvB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QAC/C,MAAM,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;YAC1C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAC5B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YACtC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;YAClD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACxC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,GAAmC;QACnD,OAAO,IAAI,OAAO,CAAS,CAAC,OAAgC,EAAE,MAAiC,EAAQ,EAAE;YACvG,MAAM,MAAM,GAAW,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;YAElF,IAAA,eAAM,EAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE;gBAC5C,CAAC,EAAE,GAAG,CAAC,IAAI;gBACX,CAAC,EAAE,GAAG,CAAC,SAAS;gBAChB,CAAC,EAAE,GAAG,CAAC,eAAe;gBACtB,MAAM,EAAE,MAAM;aACf,EAAE,CAAC,KAAmB,EAAE,UAAkB,EAAQ,EAAE;gBACnD,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,KAAK,CAAC,CAAC;oBAEd,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc;QACpB,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;eACrC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;eACxC,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC;eACzB,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;eAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,mBAAmB;eAC3C,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;eAC1C,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,eAAe;eACxC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;eAC9C,IAAI,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC;eAC/B,IAAI,CAAC,MAAM,CAAC,eAAe,GAAG,qBAAqB;eACnD,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;eACpD,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,CAAC;eACrC,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,0BAA0B;eAC9D,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;eAC/C,IAAI,CAAC,MAAM,CAAC,gBAAgB,GAAG,EAAE;eACjC,IAAI,CAAC,MAAM,CAAC,gBAAgB,GAAG,qBAAqB;eACpD,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;eACzC,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,EAAE;eAC3B,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,EAAE,EAC9B,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,yBAAyB,EAAE,uDAAuD,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,KAAa;QAChC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjF,CAAC;IAEO,UAAU,CAAC,SAAiB,EAAE,OAAe;QACnD,OAAO,IAAI,uBAAU,CAAC;YACpB,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,GAAG,6CAAqB,CAAC,mBAAmB,qBAAqB,SAAS,EAAE;YACvF,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,8DAA8D;YAC3E,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;CACF;AAvOD,oFAuOC"}

package/build/_modules/account-security/account-session.control-service.d.ts

@@ -0,0 +1,39 @@
+import { DyNTS_AccountSessionClaims_Interface } from './_models/account-session-claims.interface';
+import { DyNTS_AccountSessionContext_Interface } from './_models/account-session-context.interface';
+import { DyNTS_AccountSessionSettings_Interface } from './_models/account-session-settings.interface';
+import { DyNTS_AccountSessionTokenPair_Interface } from './_models/account-session-token-pair.interface';
+import { DyNTS_AccountSessionView_Interface } from './_models/account-session-view.interface';
+/**
+ * Opaque, server-revocable account session families with one-time refresh rotation and replay detection.
+ */
+export declare class DyNTS_AccountSession_ControlService {
+    private readonly adapter;
+    private readonly accessTtlMs;
+    private readonly refreshTtlMs;
+    private readonly tokenBytes;
+    private readonly maxRefreshRotations;
+    private readonly clock;
+    /** Creates a validated session service over an atomic persistence adapter. */
+    constructor(set: DyNTS_AccountSessionSettings_Interface);
+    /** Atomically persists a new session family before returning its raw credentials. */
+    issueSession(subjectId: string, authorizationVersion: number, context: DyNTS_AccountSessionContext_Interface): Promise<DyNTS_AccountSessionTokenPair_Interface>;
+    /** Resolves an opaque access token through the server-side active-session record. */
+    authenticateAccessToken(accessToken: string): Promise<DyNTS_AccountSessionClaims_Interface>;
+    /** Rotates a one-time refresh token; replay revokes the complete token family. */
+    rotateRefreshToken(refreshToken: string, context: DyNTS_AccountSessionContext_Interface): Promise<DyNTS_AccountSessionTokenPair_Interface>;
+    /** Revokes one server-side session. */
+    revokeSession(sessionId: string, reasonCode: string): Promise<void>;
+    /** Revokes every session belonging to one subject. */
+    revokeAllSubjectSessions(subjectId: string, reasonCode: string): Promise<void>;
+    /** Returns a user-safe session projection without token hashes. */
+    listSubjectSessions(subjectId: string): Promise<DyNTS_AccountSessionView_Interface[]>;
+    private createMaterial;
+    private toTokenPair;
+    private hashToken;
+    private validateSettings;
+    private validateContext;
+    private validateRevocation;
+    private isFutureDate;
+    private buildUnauthorized;
+}
+//# sourceMappingURL=account-session.control-service.d.ts.map

package/build/_modules/account-security/account-session.control-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session.control-service.d.ts","sourceRoot":"","sources":["../../../src/_modules/account-security/account-session.control-service.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAClG,OAAO,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AAEpG,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EAAE,uCAAuC,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAc9F;;GAEG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,8EAA8E;gBAClE,GAAG,EAAE,sCAAsC;IAUvD,qFAAqF;IACxE,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,oBAAoB,EAAE,MAAM,EAC5B,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,uCAAuC,CAAC;IAkCnD,qFAAqF;IACxE,uBAAuB,CAClC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oCAAoC,CAAC;IA8BhD,kFAAkF;IACrE,kBAAkB,CAC7B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,uCAAuC,CAAC;IAiFnD,uCAAuC;IAC1B,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF,sDAAsD;IACzC,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3F,mEAAmE;IACtD,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kCAAkC,EAAE,CAAC;IAmBlG,OAAO,CAAC,cAAc;IAoDtB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,gBAAgB;IA0BxB,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,iBAAiB;CAS1B"}