@futdevpro/nts-dynamo 1.15.233 → 1.15.240

package/build/_enums/email-submission-outcome.enum.d.ts

@@ -0,0 +1,8 @@
+/** SMTP submission evidence, never a mailbox-delivery or deduplication guarantee. */
+export declare enum DyNTS_EmailSubmissionOutcome_Enum {
+    accepted = "accepted",
+    partial = "partial",
+    rejected = "rejected",
+    indeterminate = "indeterminate"
+}
+//# sourceMappingURL=email-submission-outcome.enum.d.ts.map

package/build/_enums/email-submission-outcome.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-submission-outcome.enum.d.ts","sourceRoot":"","sources":["../../src/_enums/email-submission-outcome.enum.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,oBAAY,iCAAiC;IAC3C,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,aAAa,kBAAkB;CAChC"}

package/build/_enums/email-submission-outcome.enum.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_EmailSubmissionOutcome_Enum = void 0;
+/** SMTP submission evidence, never a mailbox-delivery or deduplication guarantee. */
+var DyNTS_EmailSubmissionOutcome_Enum;
+(function (DyNTS_EmailSubmissionOutcome_Enum) {
+    DyNTS_EmailSubmissionOutcome_Enum["accepted"] = "accepted";
+    DyNTS_EmailSubmissionOutcome_Enum["partial"] = "partial";
+    DyNTS_EmailSubmissionOutcome_Enum["rejected"] = "rejected";
+    DyNTS_EmailSubmissionOutcome_Enum["indeterminate"] = "indeterminate";
+})(DyNTS_EmailSubmissionOutcome_Enum || (exports.DyNTS_EmailSubmissionOutcome_Enum = DyNTS_EmailSubmissionOutcome_Enum = {}));
+//# sourceMappingURL=email-submission-outcome.enum.js.map

package/build/_enums/email-submission-outcome.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-submission-outcome.enum.js","sourceRoot":"","sources":["../../src/_enums/email-submission-outcome.enum.ts"],"names":[],"mappings":";;;AAAA,qFAAqF;AACrF,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,0DAAqB,CAAA;IACrB,wDAAmB,CAAA;IACnB,0DAAqB,CAAA;IACrB,oEAA+B,CAAA;AACjC,CAAC,EALW,iCAAiC,iDAAjC,iCAAiC,QAK5C"}

package/build/_models/interfaces/email-submission-receipt.interface.d.ts

@@ -0,0 +1,19 @@
+import { DyNTS_EmailSubmissionOutcome_Enum } from '../../_enums/email-submission-outcome.enum';
+/** Submission evidence only: SMTP acceptance is neither inbox delivery nor provider idempotency. */
+export interface DyNTS_EmailSubmissionReceipt_Interface {
+    /** Versioned, content-free receipt contract. */
+    contractVersion: 'dynts-email-submission-receipt/1';
+    /** Test-sink acknowledgement must never be interpreted as real SMTP submission. */
+    channel: 'smtp' | 'test-sink';
+    /** Partial or indeterminate submission must not trigger a blind automatic resend. */
+    outcome: DyNTS_EmailSubmissionOutcome_Enum;
+    /** Digest of the transport message ID, which may be locally generated; not a provider queue ID. */
+    submissionReference: string;
+    /** Aggregate accepted recipient count, without addresses. */
+    acceptedCount: number;
+    /** Aggregate rejected recipient count, without addresses. */
+    rejectedCount: number;
+    /** Aggregate pending recipient count, without addresses. */
+    pendingCount: number;
+}
+//# sourceMappingURL=email-submission-receipt.interface.d.ts.map

package/build/_models/interfaces/email-submission-receipt.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-submission-receipt.interface.d.ts","sourceRoot":"","sources":["../../../src/_models/interfaces/email-submission-receipt.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAE/F,oGAAoG;AACpG,MAAM,WAAW,sCAAsC;IACrD,gDAAgD;IAChD,eAAe,EAAE,kCAAkC,CAAC;IACpD,mFAAmF;IACnF,OAAO,EAAE,MAAM,GAAG,WAAW,CAAC;IAC9B,qFAAqF;IACrF,OAAO,EAAE,iCAAiC,CAAC;IAC3C,mGAAmG;IACnG,mBAAmB,EAAE,MAAM,CAAC;IAC5B,6DAA6D;IAC7D,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;CACtB"}

package/build/_models/interfaces/email-submission-receipt.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=email-submission-receipt.interface.js.map

package/build/_models/interfaces/email-submission-receipt.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-submission-receipt.interface.js","sourceRoot":"","sources":["../../../src/_models/interfaces/email-submission-receipt.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-challenge-transaction-settings.interface.d.ts

@@ -0,0 +1,21 @@
+import { ClientSession, Connection, mongo } from 'mongoose';
+import { DyNTS_AccountChallengeRecord_Interface } from './account-challenge-record.interface';
+/** Trusted storage mapping; challenge authority fields retain their canonical names and values. */
+export interface DyNTS_AccountChallengeDocumentCodec_Interface {
+    encode(record: DyNTS_AccountChallengeRecord_Interface): mongo.Document;
+    decode(document: mongo.Document): DyNTS_AccountChallengeRecord_Interface;
+    /** Additional audit fields only; may not replace challenge fields or introduce update operators. */
+    stamp(at: string, subjectId: string): mongo.Document;
+}
+/** A short-lived adapter bound to one authenticated subject and one caller-owned strong transaction. */
+export interface DyNTS_AccountChallengeTransactionSettings_Interface {
+    readonly connection: Connection;
+    readonly session: ClientSession;
+    readonly subjectId: string;
+    readonly collectionName: string;
+    readonly maxOperationTimeMs: number;
+    readonly codec: DyNTS_AccountChallengeDocumentCodec_Interface;
+    /** Must perform a real subject-eligibility write fence in this session; snapshot-only reads are insufficient. */
+    readonly lockSubject: (subjectId: string, session: ClientSession) => Promise<boolean>;
+}
+//# sourceMappingURL=account-challenge-transaction-settings.interface.d.ts.map

package/build/_modules/account-security/_models/account-challenge-transaction-settings.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-transaction-settings.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-transaction-settings.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAE5D,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAE9F,mGAAmG;AACnG,MAAM,WAAW,6CAA6C;IAC5D,MAAM,CAAC,MAAM,EAAE,sCAAsC,GAAG,KAAK,CAAC,QAAQ,CAAC;IACvE,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,sCAAsC,CAAC;IACzE,oGAAoG;IACpG,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC;CACtD;AAED,wGAAwG;AACxG,MAAM,WAAW,mDAAmD;IAClE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,6CAA6C,CAAC;IAC9D,iHAAiH;IACjH,QAAQ,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF"}

package/build/_modules/account-security/_models/account-challenge-transaction-settings.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-challenge-transaction-settings.interface.js.map

package/build/_modules/account-security/_models/account-challenge-transaction-settings.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-transaction-settings.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-challenge-transaction-settings.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/_models/account-session-transaction-settings.interface.d.ts

@@ -0,0 +1,12 @@
+import { ClientSession, Connection } from 'mongoose';
+import { DyNTS_AccountSessionClaims_Interface } from './account-session-claims.interface';
+/** Trusted physical mapping for a short-lived session fence; no alternative account or token engine. */
+export interface DyNTS_AccountSessionTransactionSettings_Interface {
+    readonly connection: Connection;
+    readonly session: ClientSession;
+    readonly collectionName: string;
+    readonly maxOperationTimeMs: number;
+    /** Must write-fence an active, verified, undeleted subject with this exact authorizationVersion in this session. */
+    readonly lockSubject: (claims: Readonly<DyNTS_AccountSessionClaims_Interface>, session: ClientSession) => Promise<boolean>;
+}
+//# sourceMappingURL=account-session-transaction-settings.interface.d.ts.map

package/build/_modules/account-security/_models/account-session-transaction-settings.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-transaction-settings.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-transaction-settings.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAErD,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAE1F,wGAAwG;AACxG,MAAM,WAAW,iDAAiD;IAChE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,oHAAoH;IACpH,QAAQ,CAAC,WAAW,EAAE,CACpB,MAAM,EAAE,QAAQ,CAAC,oCAAoC,CAAC,EAAE,OAAO,EAAE,aAAa,KAC3E,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB"}

package/build/_modules/account-security/_models/account-session-transaction-settings.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=account-session-transaction-settings.interface.js.map

package/build/_modules/account-security/_models/account-session-transaction-settings.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-transaction-settings.interface.js","sourceRoot":"","sources":["../../../../src/_modules/account-security/_models/account-session-transaction-settings.interface.ts"],"names":[],"mappings":""}

package/build/_modules/account-security/account-challenge-transaction.mongo-adapter.d.ts

@@ -0,0 +1,44 @@
+import { DyNTS_AccountChallengePurpose_Type } from './_enums/account-challenge-purpose.type-enum';
+import { DyNTS_AccountChallengeAdapter_Interface } from './_models/account-challenge-adapter.interface';
+import { DyNTS_AccountChallengeRecord_Interface } from './_models/account-challenge-record.interface';
+import { DyNTS_AccountChallengeTransactionSettings_Interface } from './_models/account-challenge-transaction-settings.interface';
+/**
+ * Persistence for the existing challenge service, never a second token engine. All operations share the caller's
+ * snapshot/majority transaction and authenticated subject fence. Errors must escape the outer transaction.
+ * Bootstrap owns collection/index readiness; this adapter neither migrates schemas nor creates transactions.
+ */
+export declare class DyNTS_AccountChallengeTransaction_MongoAdapter implements DyNTS_AccountChallengeAdapter_Interface {
+    private readonly settings;
+    private readonly ownedErrors;
+    /** Captures trusted connection, physical mapping and authority without reading or storing raw credentials. */
+    constructor(settings: DyNTS_AccountChallengeTransactionSettings_Interface);
+    /** Replaces active grants only within the bound subject; the outer commit publishes the new hash. */
+    replaceActiveChallenge(record: DyNTS_AccountChallengeRecord_Interface): Promise<void>;
+    /** Atomically consumes the exact subject/hash/purpose grant; a failed outer transaction restores it. */
+    consumeActiveChallenge(tokenHash: string, purpose: DyNTS_AccountChallengePurpose_Type, consumedAt: string): Promise<DyNTS_AccountChallengeRecord_Interface | null>;
+    /** Revokes one purpose without touching foreign subjects or already-terminal grants. */
+    revokeSubjectChallenges(subjectId: string, purpose: DyNTS_AccountChallengePurpose_Type, revokedAt: string): Promise<void>;
+    /** Checks session ownership before invoking the trusted account fence, preserving only safe driver retry labels. */
+    private execute;
+    /** Ensures trusted metadata conversion cannot substitute canonical persisted challenge authority. */
+    private decode;
+    /** Validates the canonical hash-only record after physical storage mapping, never echoing rejected data. */
+    private assertRecord;
+    /** Keeps audit-field hooks from replacing security state or injecting Mongo update paths. */
+    private stamp;
+    /** Uses immutable adapter authority, never a subject discovered by looking up a token. */
+    private active;
+    /** Passes the same caller-owned session and operation bound to every database call. */
+    private options;
+    /** Resolves only the caller's already-provisioned collection on the exact connection. */
+    private collection;
+    /** Requires the fixed ISO representation used by challenge services for safe indexed date comparisons. */
+    private date;
+    /** Bounds opaque server-derived identifiers without imposing a product naming convention. */
+    private subject;
+    /** Restricts issuance, consumption and revocation to the shared closed purpose vocabulary. */
+    private purpose;
+    /** Produces stable diagnostics without identifiers, token hashes, database commands or callback messages. */
+    private error;
+}
+//# sourceMappingURL=account-challenge-transaction.mongo-adapter.d.ts.map

package/build/_modules/account-security/account-challenge-transaction.mongo-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-transaction.mongo-adapter.d.ts","sourceRoot":"","sources":["../../../src/_modules/account-security/account-challenge-transaction.mongo-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAClG,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EACL,mDAAmD,EACpD,MAAM,4DAA4D,CAAC;AAMpE;;;;GAIG;AACH,qBAAa,8CAA+C,YAAW,uCAAuC;IAC5G,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsD;IAC/E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAE7D,8GAA8G;gBAClG,QAAQ,EAAE,mDAAmD;IAYzE,qGAAqG;IACxF,sBAAsB,CAAC,MAAM,EAAE,sCAAsC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBlG,wGAAwG;IAC3F,sBAAsB,CACjC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,kCAAkC,EAAE,UAAU,EAAE,MAAM,GACjF,OAAO,CAAC,sCAAsC,GAAG,IAAI,CAAC;IA0BzD,wFAAwF;IAC3E,uBAAuB,CAClC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,kCAAkC,EAAE,SAAS,EAAE,MAAM,GAChF,OAAO,CAAC,IAAI,CAAC;IAWhB,oHAAoH;YACtG,OAAO;IAkCrB,qGAAqG;IACrG,OAAO,CAAC,MAAM;IAcd,4GAA4G;IAC5G,OAAO,CAAC,YAAY;IAWpB,6FAA6F;IAC7F,OAAO,CAAC,KAAK;IAYb,0FAA0F;IAC1F,OAAO,CAAC,MAAM;IAId,uFAAuF;IACvF,OAAO,CAAC,OAAO;IAIf,yFAAyF;IACzF,OAAO,CAAC,UAAU;IAIlB,0GAA0G;IAC1G,OAAO,CAAC,IAAI;IAKZ,6FAA6F;IAC7F,OAAO,CAAC,OAAO;IAIf,8FAA8F;IAC9F,OAAO,CAAC,OAAO;IAIf,6GAA6G;IAC7G,OAAO,CAAC,KAAK;CAOd"}

package/build/_modules/account-security/account-challenge-transaction.mongo-adapter.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_AccountChallengeTransaction_MongoAdapter = void 0;
+const mongoose_1 = require("mongoose");
+const account_challenge_purpose_type_enum_1 = require("./_enums/account-challenge-purpose.type-enum");
+const PROTECTED_FIELDS = [
+    '_id', 'challengeId', 'subjectId', 'purpose', 'tokenHash', 'createdAt', 'expiresAt', 'consumedAt', 'revokedAt',
+];
+/**
+ * Persistence for the existing challenge service, never a second token engine. All operations share the caller's
+ * snapshot/majority transaction and authenticated subject fence. Errors must escape the outer transaction.
+ * Bootstrap owns collection/index readiness; this adapter neither migrates schemas nor creates transactions.
+ */
+class DyNTS_AccountChallengeTransaction_MongoAdapter {
+    settings;
+    ownedErrors = new WeakSet();
+    /** Captures trusted connection, physical mapping and authority without reading or storing raw credentials. */
+    constructor(settings) {
+        if (!settings?.connection || !settings.session || !this.subject(settings.subjectId)
+            || typeof settings.collectionName !== 'string' || !/^[A-Za-z][A-Za-z0-9_]{0,119}$/u.test(settings.collectionName)
+            || !Number.isSafeInteger(settings.maxOperationTimeMs) || settings.maxOperationTimeMs < 1
+            || settings.maxOperationTimeMs > 2_147_483_647 || typeof settings.lockSubject !== 'function'
+            || typeof settings.codec?.encode !== 'function' || typeof settings.codec?.decode !== 'function'
+            || typeof settings.codec?.stamp !== 'function') {
+            throw this.error('SETTINGS_INVALID');
+        }
+        this.settings = Object.freeze({ ...settings });
+    }
+    /** Replaces active grants only within the bound subject; the outer commit publishes the new hash. */
+    async replaceActiveChallenge(record) {
+        await this.execute(async () => {
+            this.assertRecord(record);
+            if (record.consumedAt !== '' || record.revokedAt !== '') {
+                throw this.error('RECORD_INVALID');
+            }
+            const document = this.settings.codec.encode(Object.freeze({ ...record }));
+            const decoded = this.decode(document);
+            if (Object.keys(record).some((field) => (Reflect.get(record, field) !== Reflect.get(decoded, field)))) {
+                throw this.error('MAPPING_INVALID');
+            }
+            await this.collection().updateMany(this.active(record.purpose), {
+                $set: { ...this.stamp(record.createdAt), revokedAt: record.createdAt },
+            }, this.options());
+            await this.collection().insertOne(document, this.options());
+        });
+    }
+    /** Atomically consumes the exact subject/hash/purpose grant; a failed outer transaction restores it. */
+    async consumeActiveChallenge(tokenHash, purpose, consumedAt) {
+        return this.execute(async () => {
+            if (typeof tokenHash !== 'string' || !/^[a-f0-9]{64}$/u.test(tokenHash)
+                || !this.date(consumedAt) || !this.purpose(purpose)) {
+                throw this.error('CONSUME_INVALID');
+            }
+            const document = await this.collection().findOneAndUpdate({
+                ...this.active(purpose), tokenHash: tokenHash, expiresAt: { $gt: consumedAt },
+            }, { $set: { ...this.stamp(consumedAt), consumedAt: consumedAt } }, {
+                ...this.options(), returnDocument: 'after', includeResultMetadata: false,
+            });
+            if (!document) {
+                return null;
+            }
+            const record = this.decode(document);
+            if (record.tokenHash !== tokenHash || record.purpose !== purpose || record.consumedAt !== consumedAt
+                || record.revokedAt !== '' || record.expiresAt <= consumedAt) {
+                throw this.error('MAPPING_INVALID');
+            }
+            return record;
+        });
+    }
+    /** Revokes one purpose without touching foreign subjects or already-terminal grants. */
+    async revokeSubjectChallenges(subjectId, purpose, revokedAt) {
+        await this.execute(async () => {
+            if (subjectId !== this.settings.subjectId || !this.purpose(purpose) || !this.date(revokedAt)) {
+                throw this.error('REVOCATION_INVALID');
+            }
+            await this.collection().updateMany(this.active(purpose), {
+                $set: { ...this.stamp(revokedAt), revokedAt: revokedAt },
+            }, this.options());
+        });
+    }
+    /** Checks session ownership before invoking the trusted account fence, preserving only safe driver retry labels. */
+    async execute(task) {
+        const session = this.settings.session;
+        const concern = session?.transaction?.options?.readConcern;
+        if (!session?.inTransaction() || session.transaction.options.writeConcern?.w !== 'majority'
+            || (typeof concern === 'string' ? concern : concern?.level) !== 'snapshot') {
+            throw this.error('OWNING_TRANSACTION_REQUIRED');
+        }
+        try {
+            // The driver rejects a foreign MongoClient session before dispatching this indexed, content-free probe.
+            await this.collection().findOne({ _id: { $in: [] } }, this.options());
+            if (await this.settings.lockSubject(this.settings.subjectId, session) !== true) {
+                throw this.error('SUBJECT_NOT_ELIGIBLE');
+            }
+            return await task();
+        }
+        catch (error) {
+            if (error instanceof mongoose_1.mongo.MongoError && error.hasErrorLabel('TransientTransactionError')) {
+                const retryable = new mongoose_1.mongo.MongoError('DyNTS|ACCOUNT_CHALLENGE_TRANSACTION|FAILED');
+                retryable.addErrorLabel('TransientTransactionError');
+                throw retryable;
+            }
+            if (error instanceof Error && this.ownedErrors.has(error)) {
+                throw error;
+            }
+            throw this.error('FAILED');
+        }
+    }
+    /** Ensures trusted metadata conversion cannot substitute canonical persisted challenge authority. */
+    decode(document) {
+        const record = this.settings.codec.decode(document);
+        this.assertRecord(record);
+        for (const field of PROTECTED_FIELDS.filter((entry) => entry !== '_id' && entry !== 'createdAt')) {
+            if (document[field] !== Reflect.get(record, field)) {
+                throw this.error('MAPPING_INVALID');
+            }
+        }
+        return record;
+    }
+    /** Validates the canonical hash-only record after physical storage mapping, never echoing rejected data. */
+    assertRecord(record) {
+        if (record?.subjectId !== this.settings.subjectId || !this.subject(record.challengeId)
+            || !this.purpose(record.purpose) || typeof record.tokenHash !== 'string'
+            || !/^[a-f0-9]{64}$/u.test(record.tokenHash)
+            || !this.date(record.createdAt) || !this.date(record.expiresAt) || record.expiresAt <= record.createdAt
+            || (record.consumedAt !== '' && !this.date(record.consumedAt))
+            || (record.revokedAt !== '' && !this.date(record.revokedAt))) {
+            throw this.error('RECORD_INVALID');
+        }
+    }
+    /** Keeps audit-field hooks from replacing security state or injecting Mongo update paths. */
+    stamp(at) {
+        const fields = this.settings.codec.stamp(at, this.settings.subjectId);
+        if (!fields || typeof fields !== 'object' || Array.isArray(fields)
+            || Object.keys(fields).some((key) => PROTECTED_FIELDS.includes(key)
+                || key.startsWith('$') || key.includes('.') || key.includes('\0'))) {
+            throw this.error('STAMP_INVALID');
+        }
+        return fields;
+    }
+    /** Uses immutable adapter authority, never a subject discovered by looking up a token. */
+    active(purpose) {
+        return { subjectId: this.settings.subjectId, purpose: purpose, consumedAt: '', revokedAt: '' };
+    }
+    /** Passes the same caller-owned session and operation bound to every database call. */
+    options() {
+        return { session: this.settings.session, maxTimeMS: this.settings.maxOperationTimeMs };
+    }
+    /** Resolves only the caller's already-provisioned collection on the exact connection. */
+    collection() {
+        return this.settings.connection.db.collection(this.settings.collectionName);
+    }
+    /** Requires the fixed ISO representation used by challenge services for safe indexed date comparisons. */
+    date(value) {
+        return typeof value === 'string' && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(value)
+            && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
+    }
+    /** Bounds opaque server-derived identifiers without imposing a product naming convention. */
+    subject(value) {
+        return typeof value === 'string' && value.length > 0 && value.length <= 256 && !value.includes('\0');
+    }
+    /** Restricts issuance, consumption and revocation to the shared closed purpose vocabulary. */
+    purpose(value) {
+        return Object.values(account_challenge_purpose_type_enum_1.DyNTS_AccountChallengePurpose_Type).includes(value);
+    }
+    /** Produces stable diagnostics without identifiers, token hashes, database commands or callback messages. */
+    error(code) {
+        const error = new Error(`DyNTS|ACCOUNT_CHALLENGE_TRANSACTION|${code}`);
+        this.ownedErrors.add(error);
+        return error;
+    }
+}
+exports.DyNTS_AccountChallengeTransaction_MongoAdapter = DyNTS_AccountChallengeTransaction_MongoAdapter;
+//# sourceMappingURL=account-challenge-transaction.mongo-adapter.js.map

package/build/_modules/account-security/account-challenge-transaction.mongo-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-challenge-transaction.mongo-adapter.js","sourceRoot":"","sources":["../../../src/_modules/account-security/account-challenge-transaction.mongo-adapter.ts"],"names":[],"mappings":";;;AAAA,uCAAgD;AAEhD,sGAAkG;AAOlG,MAAM,gBAAgB,GAAsB;IAC1C,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;CAC/G,CAAC;AAEF;;;;GAIG;AACH,MAAa,8CAA8C;IACxC,QAAQ,CAAsD;IAC9D,WAAW,GAAmB,IAAI,OAAO,EAAE,CAAC;IAE7D,8GAA8G;IAC9G,YAAY,QAA6D;QACvE,IAAI,CAAC,QAAQ,EAAE,UAAU,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;eAC9E,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;eAC9G,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,kBAAkB,GAAG,CAAC;eACrF,QAAQ,CAAC,kBAAkB,GAAG,aAAa,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,UAAU;eACzF,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,KAAK,UAAU,IAAI,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,KAAK,UAAU;eAC5F,OAAO,QAAQ,CAAC,KAAK,EAAE,KAAK,KAAK,UAAU,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,qGAAqG;IAC9F,KAAK,CAAC,sBAAsB,CAAC,MAA8C;QAChF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,IAAmB,EAAE;YAC3C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAE1B,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;gBACxD,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,QAAQ,GAAmB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;YAC1F,MAAM,OAAO,GAA2C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE9E,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,CACvD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAC3D,CAAC,EAAE,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;gBAC9D,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;aACvE,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACnB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wGAAwG;IACjG,KAAK,CAAC,sBAAsB,CACjC,SAAiB,EAAE,OAA2C,EAAE,UAAkB;QAElF,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAA4D,EAAE;YACrF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;mBAClE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,QAAQ,GAA0B,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,gBAAgB,CAAC;gBAC/E,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;aAC9E,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE;gBAClE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK;aACzE,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAA2C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE7E,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU;mBAC/F,MAAM,CAAC,SAAS,KAAK,EAAE,IAAI,MAAM,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACtC,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wFAAwF;IACjF,KAAK,CAAC,uBAAuB,CAClC,SAAiB,EAAE,OAA2C,EAAE,SAAiB;QAEjF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,IAAmB,EAAE;YAC3C,IAAI,SAAS,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7F,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;gBACvD,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;aACzD,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oHAAoH;IAC5G,KAAK,CAAC,OAAO,CAAI,IAAsB;QAC7C,MAAM,OAAO,GAAkB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACrD,MAAM,OAAO,GAAsC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC;QAE9F,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,UAAU;eACtF,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,UAAU,EAAE,CAAC;YAC7E,MAAM,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC;YACH,wGAAwG;YACxG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAEtE,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/E,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC3C,CAAC;YAED,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,KAAK,YAAY,gBAAK,CAAC,UAAU,IAAI,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,EAAE,CAAC;gBAC1F,MAAM,SAAS,GAAqB,IAAI,gBAAK,CAAC,UAAU,CAAC,4CAA4C,CAAC,CAAC;gBAEvG,SAAS,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;gBAErD,MAAM,SAAS,CAAC;YAClB,CAAC;YAED,IAAI,KAAK,YAAY,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,qGAAqG;IAC7F,MAAM,CAAC,QAAwB;QACrC,MAAM,MAAM,GAA2C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5F,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAE1B,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,WAAW,CAAC,EAAE,CAAC;YAClH,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4GAA4G;IACpG,YAAY,CAAC,MAA8C;QACjE,IAAI,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;eACjF,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;eACrE,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;eACzC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS;eACpG,CAAC,MAAM,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;eAC3D,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,6FAA6F;IACrF,KAAK,CAAC,EAAU;QACtB,MAAM,MAAM,GAAmB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEtF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;eAC7D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAW,EAAW,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;mBAC/E,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0FAA0F;IAClF,MAAM,CAAC,OAA2C;QACxD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACjG,CAAC;IAED,uFAAuF;IAC/E,OAAO;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;IACzF,CAAC;IAED,yFAAyF;IACjF,UAAU;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC9E,CAAC;IAED,0GAA0G;IAClG,IAAI,CAAC,KAAc;QACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC;eAC3F,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;IACrF,CAAC;IAED,6FAA6F;IACrF,OAAO,CAAC,KAAc;QAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvG,CAAC;IAED,8FAA8F;IACtF,OAAO,CAAC,KAAyC;QACvD,OAAO,MAAM,CAAC,MAAM,CAAC,wEAAkC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED,6GAA6G;IACrG,KAAK,CAAC,IAAY;QACxB,MAAM,KAAK,GAAU,IAAI,KAAK,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAE5B,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AArMD,wGAqMC"}

package/build/_modules/account-security/account-session-transaction.mongo-store.d.ts

@@ -0,0 +1,24 @@
+import { DyNTS_AccountSessionRecord_Interface } from './_models/account-session-record.interface';
+import { DyNTS_AccountSessionTransactionSettings_Interface } from './_models/account-session-transaction-settings.interface';
+/**
+ * Opt-in authorization write fence for the existing opaque-session service and canonical persisted session fields.
+ * A caller owns collection readiness, subject mapping and the snapshot/majority business transaction.
+ * Every failure must abort that transaction. This store never stores raw credentials or creates sessions.
+ */
+export declare class DyNTS_AccountSessionTransaction_MongoStore {
+    private readonly settings;
+    private readonly ownedErrors;
+    /** Captures only trusted persistence configuration, not browser-supplied authority. */
+    constructor(settings: DyNTS_AccountSessionTransactionSettings_Interface);
+    /**
+     * Called with a record just authenticated by the existing session service, not cached request claims.
+     * Advances only persistence revision, never token generation/hash/expiry. Concurrent refresh may require retry;
+     * a stale token or snapshot is never silently upgraded to the replacement credential.
+     */
+    lockAuthenticatedSession(record: Readonly<DyNTS_AccountSessionRecord_Interface>): Promise<boolean>;
+    /** Fails closed on malformed persisted authority and safe-integer overflow before any subject mutation. */
+    private assertRecord;
+    /** Retains stable failure categories without account IDs, hashes, commands or callback diagnostics. */
+    private error;
+}
+//# sourceMappingURL=account-session-transaction.mongo-store.d.ts.map

package/build/_modules/account-security/account-session-transaction.mongo-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-transaction.mongo-store.d.ts","sourceRoot":"","sources":["../../../src/_modules/account-security/account-session-transaction.mongo-store.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAClG,OAAO,EACL,iDAAiD,EAClD,MAAM,0DAA0D,CAAC;AAElE;;;;GAIG;AACH,qBAAa,0CAA0C;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoD;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAE7D,uFAAuF;gBAC3E,QAAQ,EAAE,iDAAiD;IAUvE;;;;OAIG;IACU,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,oCAAoC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA0D/G,2GAA2G;IAC3G,OAAO,CAAC,YAAY;IAgBpB,uGAAuG;IACvG,OAAO,CAAC,KAAK;CAOd"}

package/build/_modules/account-security/account-session-transaction.mongo-store.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_AccountSessionTransaction_MongoStore = void 0;
+const mongoose_1 = require("mongoose");
+const account_session_state_type_enum_1 = require("./_enums/account-session-state.type-enum");
+/**
+ * Opt-in authorization write fence for the existing opaque-session service and canonical persisted session fields.
+ * A caller owns collection readiness, subject mapping and the snapshot/majority business transaction.
+ * Every failure must abort that transaction. This store never stores raw credentials or creates sessions.
+ */
+class DyNTS_AccountSessionTransaction_MongoStore {
+    settings;
+    ownedErrors = new WeakSet();
+    /** Captures only trusted persistence configuration, not browser-supplied authority. */
+    constructor(settings) {
+        if (!settings?.connection || !settings.session || typeof settings.lockSubject !== 'function'
+            || typeof settings.collectionName !== 'string' || !/^[A-Za-z][A-Za-z0-9_]{0,119}$/u.test(settings.collectionName)
+            || !Number.isSafeInteger(settings.maxOperationTimeMs) || settings.maxOperationTimeMs < 1
+            || settings.maxOperationTimeMs > 2_147_483_647) {
+            throw this.error('SETTINGS_INVALID');
+        }
+        this.settings = Object.freeze({ ...settings });
+    }
+    /**
+     * Called with a record just authenticated by the existing session service, not cached request claims.
+     * Advances only persistence revision, never token generation/hash/expiry. Concurrent refresh may require retry;
+     * a stale token or snapshot is never silently upgraded to the replacement credential.
+     */
+    async lockAuthenticatedSession(record) {
+        this.assertRecord(record);
+        const session = this.settings.session;
+        const concern = session?.transaction?.options?.readConcern;
+        if (!session?.inTransaction() || session.transaction.options.writeConcern?.w !== 'majority'
+            || (typeof concern === 'string' ? concern : concern?.level) !== 'snapshot') {
+            throw this.error('OWNING_TRANSACTION_REQUIRED');
+        }
+        try {
+            const collection = this.settings.connection.db.collection(this.settings.collectionName);
+            const options = {
+                session: session, maxTimeMS: this.settings.maxOperationTimeMs,
+            };
+            // Validate the actual owning MongoClient before allowing a subject callback to write anything.
+            await collection.findOne({ _id: { $in: [] } }, options);
+            if (await this.settings.lockSubject(Object.freeze({
+                subjectId: record.subjectId, sessionId: record.sessionId, familyId: record.familyId,
+                authorizationVersion: record.authorizationVersion,
+            }), session) !== true) {
+                throw this.error('SUBJECT_NOT_ELIGIBLE');
+            }
+            const result = await collection.updateOne({
+                subjectId: record.subjectId, sessionId: record.sessionId, familyId: record.familyId,
+                authorizationVersion: record.authorizationVersion, accessTokenHash: record.accessTokenHash,
+                accessExpiresAt: record.accessExpiresAt, revision: record.revision, generation: record.generation,
+                state: account_session_state_type_enum_1.DyNTS_AccountSessionState_Type.active, revokedAt: '', revocationReason: '',
+                $expr: { $gt: [
+                        { $convert: { input: '$accessExpiresAt', to: 'date', onError: null, onNull: null } }, '$$NOW',
+                    ] },
+            }, { $inc: { revision: 1 } }, options);
+            if (result.modifiedCount !== 1) {
+                throw this.error('SESSION_NOT_ELIGIBLE');
+            }
+            return true;
+        }
+        catch (error) {
+            if (error instanceof mongoose_1.mongo.MongoError && error.hasErrorLabel('TransientTransactionError')) {
+                const retryable = new mongoose_1.mongo.MongoError('DyNTS|ACCOUNT_SESSION_TRANSACTION|FAILED');
+                retryable.addErrorLabel('TransientTransactionError');
+                throw retryable;
+            }
+            if (error instanceof Error && this.ownedErrors.has(error)) {
+                throw error;
+            }
+            throw this.error('FAILED');
+        }
+    }
+    /** Fails closed on malformed persisted authority and safe-integer overflow before any subject mutation. */
+    assertRecord(record) {
+        if (!record || ![record.subjectId, record.sessionId, record.familyId].every((id) => (typeof id === 'string' && id.length > 0 && id.length <= 256 && !id.includes('\0'))) || ![record.revision, record.generation, record.authorizationVersion].every((value) => (Number.isSafeInteger(value) && value >= 0)) || record.revision >= Number.MAX_SAFE_INTEGER || record.state !== account_session_state_type_enum_1.DyNTS_AccountSessionState_Type.active
+            || record.revokedAt !== '' || record.revocationReason !== ''
+            || typeof record.accessTokenHash !== 'string' || !/^[a-f0-9]{64}$/u.test(record.accessTokenHash)
+            || typeof record.accessExpiresAt !== 'string'
+            || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(record.accessExpiresAt)
+            || !Number.isFinite(Date.parse(record.accessExpiresAt))
+            || new Date(record.accessExpiresAt).toISOString() !== record.accessExpiresAt) {
+            throw this.error('RECORD_INVALID');
+        }
+    }
+    /** Retains stable failure categories without account IDs, hashes, commands or callback diagnostics. */
+    error(code) {
+        const error = new Error(`DyNTS|ACCOUNT_SESSION_TRANSACTION|${code}`);
+        this.ownedErrors.add(error);
+        return error;
+    }
+}
+exports.DyNTS_AccountSessionTransaction_MongoStore = DyNTS_AccountSessionTransaction_MongoStore;
+//# sourceMappingURL=account-session-transaction.mongo-store.js.map

package/build/_modules/account-security/account-session-transaction.mongo-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-session-transaction.mongo-store.js","sourceRoot":"","sources":["../../../src/_modules/account-security/account-session-transaction.mongo-store.ts"],"names":[],"mappings":";;;AAAA,uCAAgD;AAEhD,8FAA0F;AAM1F;;;;GAIG;AACH,MAAa,0CAA0C;IACpC,QAAQ,CAAoD;IAC5D,WAAW,GAAmB,IAAI,OAAO,EAAE,CAAC;IAE7D,uFAAuF;IACvF,YAAY,QAA2D;QACrE,IAAI,CAAC,QAAQ,EAAE,UAAU,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,UAAU;eACvF,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;eAC9G,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,kBAAkB,GAAG,CAAC;eACrF,QAAQ,CAAC,kBAAkB,GAAG,aAAa,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,wBAAwB,CAAC,MAAsD;QAC1F,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAkB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACrD,MAAM,OAAO,GAAsC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC;QAE9F,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,UAAU;eACtF,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,UAAU,EAAE,CAAC;YAC7E,MAAM,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,UAAU,GAAqC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CACzF,IAAI,CAAC,QAAQ,CAAC,cAAc,CAC7B,CAAC;YACF,MAAM,OAAO,GAAkD;gBAC7D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB;aAC9D,CAAC;YAEF,+FAA+F;YAC/F,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YAExD,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;gBAChD,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACnF,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;aAClD,CAAC,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,MAAM,GAAuB,MAAM,UAAU,CAAC,SAAS,CAAC;gBAC5D,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACnF,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe;gBAC1F,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;gBACjG,KAAK,EAAE,gEAA8B,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE;gBACjF,KAAK,EAAE,EAAE,GAAG,EAAE;wBACZ,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO;qBAC9F,EAAE;aACJ,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YAEvC,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC3C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,KAAK,YAAY,gBAAK,CAAC,UAAU,IAAI,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,EAAE,CAAC;gBAC1F,MAAM,SAAS,GAAqB,IAAI,gBAAK,CAAC,UAAU,CAAC,0CAA0C,CAAC,CAAC;gBAErG,SAAS,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;gBAErD,MAAM,SAAS,CAAC;YAClB,CAAC;YAED,IAAI,KAAK,YAAY,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,2GAA2G;IACnG,YAAY,CAAC,MAAsD;QACzE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAE,CAAC,KAAK,CAAC,CAAC,EAAU,EAAW,EAAE,CAAC,CACrG,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAClF,CAAC,IAAI,CAAC,CAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,oBAAoB,CAAE,CAAC,KAAK,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,CAC3G,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAC1C,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,KAAK,KAAK,gEAA8B,CAAC,MAAM;eACrG,MAAM,CAAC,SAAS,KAAK,EAAE,IAAI,MAAM,CAAC,gBAAgB,KAAK,EAAE;eACzD,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;eAC7F,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;eAC1C,CAAC,gDAAgD,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;eAC9E,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;eACpD,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;YAC/E,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,uGAAuG;IAC/F,KAAK,CAAC,IAAY;QACxB,MAAM,KAAK,GAAU,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAE5B,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAvGD,gGAuGC"}

package/build/_modules/account-security/account-session.control-service.d.ts

@@ -1,5 +1,6 @@
 import { DyNTS_AccountSessionClaims_Interface } from './_models/account-session-claims.interface';
 import { DyNTS_AccountSessionContext_Interface } from './_models/account-session-context.interface';
+import { DyNTS_AccountSessionRecord_Interface } from './_models/account-session-record.interface';
 import { DyNTS_AccountSessionSettings_Interface } from './_models/account-session-settings.interface';
 import { DyNTS_AccountSessionTokenPair_Interface } from './_models/account-session-token-pair.interface';
 import { DyNTS_AccountSessionView_Interface } from './_models/account-session-view.interface';
@@ -19,6 +20,17 @@ export declare class DyNTS_AccountSession_ControlService {
     issueSession(subjectId: string, authorizationVersion: number, context: DyNTS_AccountSessionContext_Interface): Promise<DyNTS_AccountSessionTokenPair_Interface>;
     /** Resolves an opaque access token through the server-side active-session record. */
     authenticateAccessToken(accessToken: string): Promise<DyNTS_AccountSessionClaims_Interface>;
+    /**
+     * Reauthenticates the actual access credential and fences its exact record in the caller's business transaction.
+     * The callback must write-fence both the subject authorization version and session, returning true only on success.
+     * Use the shared Mongo transaction store; propagate failures and keep every protected write in that transaction.
+     * This is opt-in: ordinary authentication retains its existing read-only behavior.
+     */
+    authenticateAccessTokenForMutation(accessToken: string, lockSession: (record: Readonly<DyNTS_AccountSessionRecord_Interface>) => Promise<boolean>): Promise<DyNTS_AccountSessionClaims_Interface>;
+    /** Resolves the existing token/hash contract once, before either read-only or write-fenced authentication. */
+    private authenticateSessionRecord;
+    /** Keeps the public claims projection identical for both authentication modes; no hashes leave this boundary. */
+    private toClaims;
     /** Rotates a one-time refresh token; replay revokes the complete token family. */
     rotateRefreshToken(refreshToken: string, context: DyNTS_AccountSessionContext_Interface): Promise<DyNTS_AccountSessionTokenPair_Interface>;
     /** Revokes one server-side session. */

package/build/_modules/account-security/account-session.control-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-session.control-service.d.ts","sourceRoot":"","sources":["../../../src/_modules/account-security/account-session.control-service.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAClG,OAAO,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AAEpG,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EAAE,uCAAuC,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAc9F;;GAEG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,8EAA8E;gBAClE,GAAG,EAAE,sCAAsC;IAUvD,qFAAqF;IACxE,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,oBAAoB,EAAE,MAAM,EAC5B,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,uCAAuC,CAAC;IAkCnD,qFAAqF;IACxE,uBAAuB,CAClC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oCAAoC,CAAC;IA8BhD,kFAAkF;IACrE,kBAAkB,CAC7B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,uCAAuC,CAAC;IAiFnD,uCAAuC;IAC1B,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF,sDAAsD;IACzC,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3F,mEAAmE;IACtD,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kCAAkC,EAAE,CAAC;IAmBlG,OAAO,CAAC,cAAc;IAoDtB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,gBAAgB;IA0BxB,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,iBAAiB;CAS1B"}
+{"version":3,"file":"account-session.control-service.d.ts","sourceRoot":"","sources":["../../../src/_modules/account-security/account-session.control-service.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAClG,OAAO,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAClG,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EAAE,uCAAuC,EAAE,MAAM,gDAAgD,CAAC;AACzG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAc9F;;GAEG;AACH,qBAAa,mCAAmC;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,8EAA8E;gBAClE,GAAG,EAAE,sCAAsC;IAUvD,qFAAqF;IACxE,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,oBAAoB,EAAE,MAAM,EAC5B,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,uCAAuC,CAAC;IAkCnD,qFAAqF;IACxE,uBAAuB,CAClC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oCAAoC,CAAC;IAIhD;;;;;OAKG;IACU,kCAAkC,CAC7C,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,oCAAoC,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GACxF,OAAO,CAAC,oCAAoC,CAAC;IAgBhD,8GAA8G;YAChG,yBAAyB;IAyBvC,iHAAiH;IACjH,OAAO,CAAC,QAAQ;IAOhB,kFAAkF;IACrE,kBAAkB,CAC7B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,uCAAuC,CAAC;IAiFnD,uCAAuC;IAC1B,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF,sDAAsD;IACzC,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3F,mEAAmE;IACtD,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kCAAkC,EAAE,CAAC;IAmBlG,OAAO,CAAC,cAAc;IAoDtB,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,gBAAgB;IA0BxB,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,iBAAiB;CAS1B"}

package/build/_modules/account-security/account-session.control-service.js

@@ -60,6 +60,29 @@ class DyNTS_AccountSession_ControlService {
     }
     /** Resolves an opaque access token through the server-side active-session record. */
     async authenticateAccessToken(accessToken) {
+        return this.toClaims(await this.authenticateSessionRecord(accessToken));
+    }
+    /**
+     * Reauthenticates the actual access credential and fences its exact record in the caller's business transaction.
+     * The callback must write-fence both the subject authorization version and session, returning true only on success.
+     * Use the shared Mongo transaction store; propagate failures and keep every protected write in that transaction.
+     * This is opt-in: ordinary authentication retains its existing read-only behavior.
+     */
+    async authenticateAccessTokenForMutation(accessToken, lockSession) {
+        if (typeof lockSession !== 'function') {
+            throw this.buildUnauthorized('SESSION_MUTATION_FENCE_REQUIRED');
+        }
+        const record = await this.authenticateSessionRecord(accessToken);
+        const snapshot = Object.freeze({
+            ...record, context: Object.freeze({ ...record.context }),
+        });
+        if (await lockSession(snapshot) !== true) {
+            throw this.buildUnauthorized('SESSION_MUTATION_NOT_AUTHORIZED');
+        }
+        return this.toClaims(snapshot);
+    }
+    /** Resolves the existing token/hash contract once, before either read-only or write-fenced authentication. */
+    async authenticateSessionRecord(accessToken) {
         if (!accessToken || accessToken.length > 512) {
             throw this.buildUnauthorized('ACCESS_TOKEN_INVALID');
         }
@@ -75,10 +98,12 @@ class DyNTS_AccountSession_ControlService {
             || session.authorizationVersion < 0) {
             throw this.buildUnauthorized('ACCESS_TOKEN_INVALID');
         }
+        return session;
+    }
+    /** Keeps the public claims projection identical for both authentication modes; no hashes leave this boundary. */
+    toClaims(session) {
         return {
-            subjectId: session.subjectId,
-            sessionId: session.sessionId,
-            familyId: session.familyId,
+            subjectId: session.subjectId, sessionId: session.sessionId, familyId: session.familyId,
             authorizationVersion: session.authorizationVersion,
         };
     }