@happyvertical/smrt-users 0.55.22 → 0.55.24

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.55.22",
+  "packageVersion": "0.55.24",
   "objects": {
     "@happyvertical/smrt-users:AccessRequestCollection": {
       "name": "accessrequestcollection",
@@ -878,23 +878,24 @@
         },
         "indexes": [
           {
-            "name": "group_members_slug_context_idx",
+            "name": "group_members_group_id_user_id_idx",
             "columns": [
-              "slug",
-              "context"
+              "group_id",
+              "user_id"
             ],
             "unique": true
           },
           {
-            "name": "group_members_created_at_idx",
+            "name": "group_members_slug_context_idx",
             "columns": [
-              "created_at"
+              "slug",
+              "context"
             ]
           },
           {
-            "name": "group_members_group_id_idx",
+            "name": "group_members_created_at_idx",
             "columns": [
-              "group_id"
+              "created_at"
             ]
           },
           {
@@ -2051,23 +2052,24 @@
         },
         "indexes": [
           {
-            "name": "membership_overrides_slug_context_idx",
+            "name": "membership_overrides_membership_id_permission_id_idx",
             "columns": [
-              "slug",
-              "context"
+              "membership_id",
+              "permission_id"
             ],
             "unique": true
           },
           {
-            "name": "membership_overrides_created_at_idx",
+            "name": "membership_overrides_slug_context_idx",
             "columns": [
-              "created_at"
+              "slug",
+              "context"
             ]
           },
           {
-            "name": "membership_overrides_membership_id_idx",
+            "name": "membership_overrides_created_at_idx",
             "columns": [
-              "membership_id"
+              "created_at"
             ]
           },
           {
@@ -5472,14 +5474,20 @@
         },
         "indexes": [
           {
-            "name": "tenant_permission_overrides_tenant_id_slug_idx",
+            "name": "tenant_permission_overrides_tenant_id_permission_id_idx",
             "columns": [
               "tenant_id",
-              "slug",
-              "context"
+              "permission_id"
             ],
             "unique": true
           },
+          {
+            "name": "tenant_permission_overrides_slug_context_idx",
+            "columns": [
+              "slug",
+              "context"
+            ]
+          },
           {
             "name": "tenant_permission_overrides_created_at_idx",
             "columns": [
@@ -6543,7 +6551,8 @@
           "required": true,
           "related": "Group",
           "_meta": {
-            "required": true
+            "required": true,
+            "onDelete": "NO ACTION"
           }
         },
         "userId": {
@@ -6551,7 +6560,8 @@
           "required": true,
           "related": "User",
           "_meta": {
-            "required": true
+            "required": true,
+            "onDelete": "NO ACTION"
           }
         }
       },
@@ -6574,7 +6584,11 @@
             "list",
             "get"
           ]
-        }
+        },
+        "conflictColumns": [
+          "group_id",
+          "user_id"
+        ]
       },
       "extends": "SmrtObject",
       "exportName": "GroupMember",
@@ -6647,23 +6661,24 @@
         },
         "indexes": [
           {
-            "name": "group_members_slug_context_idx",
+            "name": "group_members_group_id_user_id_idx",
             "columns": [
-              "slug",
-              "context"
+              "group_id",
+              "user_id"
             ],
             "unique": true
           },
           {
-            "name": "group_members_created_at_idx",
+            "name": "group_members_slug_context_idx",
             "columns": [
-              "created_at"
+              "slug",
+              "context"
             ]
           },
           {
-            "name": "group_members_group_id_idx",
+            "name": "group_members_created_at_idx",
             "columns": [
-              "group_id"
+              "created_at"
             ]
           },
           {
@@ -7075,6 +7090,7 @@
             "failed",
             "succeeded",
             "locked",
+            "source-locked",
             "managed"
           ]
         },
@@ -7665,7 +7681,8 @@
           "required": true,
           "related": "Membership",
           "_meta": {
-            "required": true
+            "required": true,
+            "onDelete": "NO ACTION"
           }
         },
         "permissionId": {
@@ -7673,7 +7690,8 @@
           "required": true,
           "related": "Permission",
           "_meta": {
-            "required": true
+            "required": true,
+            "onDelete": "NO ACTION"
           }
         },
         "effect": {
@@ -7718,7 +7736,11 @@
             "list",
             "get"
           ]
-        }
+        },
+        "conflictColumns": [
+          "membership_id",
+          "permission_id"
+        ]
       },
       "extends": "SmrtObject",
       "exportName": "MembershipOverride",
@@ -7796,23 +7818,24 @@
         },
         "indexes": [
           {
-            "name": "membership_overrides_slug_context_idx",
+            "name": "membership_overrides_membership_id_permission_id_idx",
             "columns": [
-              "slug",
-              "context"
+              "membership_id",
+              "permission_id"
             ],
             "unique": true
           },
           {
-            "name": "membership_overrides_created_at_idx",
+            "name": "membership_overrides_slug_context_idx",
             "columns": [
-              "created_at"
+              "slug",
+              "context"
             ]
           },
           {
-            "name": "membership_overrides_membership_id_idx",
+            "name": "membership_overrides_created_at_idx",
             "columns": [
-              "membership_id"
+              "created_at"
             ]
           },
           {
@@ -11182,7 +11205,8 @@
           "required": true,
           "related": "Tenant",
           "_meta": {
-            "required": true
+            "required": true,
+            "onDelete": "NO ACTION"
           }
         },
         "permissionId": {
@@ -11190,7 +11214,8 @@
           "required": true,
           "related": "Permission",
           "_meta": {
-            "required": true
+            "required": true,
+            "onDelete": "NO ACTION"
           }
         },
         "effect": {
@@ -11254,8 +11279,7 @@
         },
         "conflictColumns": [
           "tenant_id",
-          "slug",
-          "context"
+          "permission_id"
         ]
       },
       "extends": "SmrtObject",
@@ -11334,14 +11358,20 @@
         },
         "indexes": [
           {
-            "name": "tenant_permission_overrides_tenant_id_slug_idx",
+            "name": "tenant_permission_overrides_tenant_id_permission_id_idx",
             "columns": [
               "tenant_id",
-              "slug",
-              "context"
+              "permission_id"
             ],
             "unique": true
           },
+          {
+            "name": "tenant_permission_overrides_slug_context_idx",
+            "columns": [
+              "slug",
+              "context"
+            ]
+          },
           {
             "name": "tenant_permission_overrides_created_at_idx",
             "columns": [

package/dist/migrations/deduplicateAuthorityPairs.d.ts

@@ -0,0 +1,27 @@
+import type { DatabaseInterface } from '@happyvertical/sql';
+import { type NaturalKeyDedupOptions, type NaturalKeyDedupResult } from './natural-key-dedup.js';
+/** Options for the explicit, maintenance-window authority-pair migration. */
+export type DeduplicateAuthorityPairsOptions = NaturalKeyDedupOptions;
+/** Per-table result of {@link deduplicateAuthorityPairs}. */
+export interface DeduplicateAuthorityPairsResult {
+    membershipOverrides: NaturalKeyDedupResult;
+    tenantPermissionOverrides: NaturalKeyDedupResult;
+    groupMembers: NaturalKeyDedupResult;
+}
+/**
+ * Collapse duplicate `MembershipOverride`, `TenantPermissionOverride` and
+ * `GroupMember` rows to one per natural-key pair and install the unique
+ * indexes their models now declare (#3375). Run BEFORE ordinary schema
+ * migration, with every writer stopped: adding the indexes directly fails
+ * while duplicates exist, and older application versions do not write
+ * against them safely.
+ *
+ * Override pairs keep the row whose effect the resolver already applies
+ * (DENY, then GRANT, then INHERIT), so the effective authority of every pair
+ * is unchanged; ties, and group memberships, keep the earliest `created_at`
+ * (lowest `id` breaks ties; null timestamps sort last). Survivors are
+ * unchanged. All three tables commit together; failure leaves them intact.
+ * Re-running is safe.
+ */
+export declare function deduplicateAuthorityPairs(db: DatabaseInterface, options?: DeduplicateAuthorityPairsOptions): Promise<DeduplicateAuthorityPairsResult>;
+//# sourceMappingURL=deduplicateAuthorityPairs.d.ts.map

package/dist/migrations/deduplicateAuthorityPairs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deduplicateAuthorityPairs.d.ts","sourceRoot":"","sources":["../../src/migrations/deduplicateAuthorityPairs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAE3B,MAAM,wBAAwB,CAAC;AAEhC,6EAA6E;AAC7E,MAAM,MAAM,gCAAgC,GAAG,sBAAsB,CAAC;AAEtE,6DAA6D;AAC7D,MAAM,WAAW,+BAA+B;IAC9C,mBAAmB,EAAE,qBAAqB,CAAC;IAC3C,yBAAyB,EAAE,qBAAqB,CAAC;IACjD,YAAY,EAAE,qBAAqB,CAAC;CACrC;AAgCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,+BAA+B,CAAC,CAS1C"}

package/dist/migrations/deduplicateRolePermissions.d.ts

@@ -1,16 +1,9 @@
 import type { DatabaseInterface } from '@happyvertical/sql';
+import { type NaturalKeyDedupOptions, type NaturalKeyDedupResult } from './natural-key-dedup.js';
 /** Options for the explicit, maintenance-window grant migration. */
-export interface DeduplicateRolePermissionsOptions {
-    /** Inspect the duplicate count without changing rows or indexes. */
-    dryRun?: boolean;
-    /** Confirm all application writers and seeders are stopped. */
-    maintenanceConfirmed?: boolean;
-}
+export type DeduplicateRolePermissionsOptions = NaturalKeyDedupOptions;
 /** Result of the grant migration; removed is zero for a dry run. */
-export interface DeduplicateRolePermissionsResult {
-    duplicates: number;
-    removed: number;
-}
+export type DeduplicateRolePermissionsResult = NaturalKeyDedupResult;
 /**
  * Keep the oldest grant for each role/permission pair and install its unique
  * index. Run BEFORE ordinary schema migration, with every writer stopped;

package/dist/migrations/deduplicateRolePermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deduplicateRolePermissions.d.ts","sourceRoot":"","sources":["../../src/migrations/deduplicateRolePermissions.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,oEAAoE;AACpE,MAAM,WAAW,iCAAiC;IAChD,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,oEAAoE;AACpE,MAAM,WAAW,gCAAgC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AASD;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,gCAAgC,CAAC,CA0C3C"}
+{"version":3,"file":"deduplicateRolePermissions.d.ts","sourceRoot":"","sources":["../../src/migrations/deduplicateRolePermissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAEhC,oEAAoE;AACpE,MAAM,MAAM,iCAAiC,GAAG,sBAAsB,CAAC;AAEvE,oEAAoE;AACpE,MAAM,MAAM,gCAAgC,GAAG,qBAAqB,CAAC;AAErE;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,gCAAgC,CAAC,CAc3C"}

package/dist/migrations/natural-key-dedup.d.ts

@@ -0,0 +1,32 @@
+import type { DatabaseInterface } from '@happyvertical/sql';
+/** Options shared by the maintenance-window natural-key migrations. */
+export interface NaturalKeyDedupOptions {
+    /** Inspect the duplicate count without changing rows or indexes. */
+    dryRun?: boolean;
+    /** Confirm all application writers and seeders are stopped. */
+    maintenanceConfirmed?: boolean;
+}
+/** Per-table result; removed is zero for a dry run. */
+export interface NaturalKeyDedupResult {
+    duplicates: number;
+    removed: number;
+}
+/** One table whose rows must be unique on a column pair. */
+export interface NaturalKeyDedupTarget {
+    table: string;
+    columns: readonly [string, string];
+    /** Unique index the generated schema declares for the pair. */
+    index: string;
+    /**
+     * Leading ORDER BY terms that choose the survivor before the oldest-row
+     * rule, e.g. the effect the resolver already applies for the pair.
+     */
+    survivorOrder?: string;
+}
+/**
+ * Remove natural-key duplicates and install each target's unique index in one
+ * transaction, so failure leaves every table as it was. Run BEFORE ordinary
+ * schema migration with every writer stopped. Re-running is safe.
+ */
+export declare function deduplicateNaturalKeys(db: DatabaseInterface, targets: readonly NaturalKeyDedupTarget[], options: NaturalKeyDedupOptions, label: string): Promise<NaturalKeyDedupResult[]>;
+//# sourceMappingURL=natural-key-dedup.d.ts.map

package/dist/migrations/natural-key-dedup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"natural-key-dedup.d.ts","sourceRoot":"","sources":["../../src/migrations/natural-key-dedup.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,uEAAuE;AACvE,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,uDAAuD;AACvD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAcD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,SAAS,qBAAqB,EAAE,EACzC,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAyDlC"}

package/dist/models/GroupMember.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GroupMember.d.ts","sourceRoot":"","sources":["../../src/models/GroupMember.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBASa,WAAY,SAAQ,UAAU;IACzC;;OAEG;IAEH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEJ,OAAO,GAAE,kBAAuB;CAK7C"}
+{"version":3,"file":"GroupMember.d.ts","sourceRoot":"","sources":["../../src/models/GroupMember.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAaa,WAAY,SAAQ,UAAU;IACzC;;OAEG;IAEH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEJ,OAAO,GAAE,kBAAuB;CAK7C"}

package/dist/models/LoginAuditEvent.d.ts

@@ -19,6 +19,11 @@ export type LoginAuditOutcome =
  | 'succeeded'
 /** A failure exhausted the budget and the key is now locked out. */
  | 'locked'
+/**
+ * A failure started a SOURCE lockout (#3531). Carries the source hash only,
+ * never a subject; rate limited per source.
+ */
+ | 'source-locked'
 /** A credential was set, reset, or cleared (administrative). */
  | 'managed';
 export declare class UsersLoginAuditEvent extends SmrtObject {

package/dist/models/LoginAuditEvent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LoginAuditEvent.d.ts","sourceRoot":"","sources":["../../src/models/LoginAuditEvent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAS,UAAU,EAAQ,MAAM,0BAA0B,CAAC;AAEnE,0CAA0C;AAC1C,MAAM,MAAM,iBAAiB;AAC3B,0EAA0E;AACxE,QAAQ;AACV,wDAAwD;GACtD,QAAQ;AACV,yCAAyC;GACvC,WAAW;AACb,oEAAoE;GAClE,QAAQ;AACV,gEAAgE;GAC9D,SAAS,CAAC;AAEd,qBASa,oBAAqB,SAAQ,UAAU;IAClD,2EAA2E;IAE3E,IAAI,SAAM;IAGV,OAAO,EAAE,iBAAiB,CAAY;IAEtC,mEAAmE;IAEnE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAQ;IAErC,gFAAgF;IAEhF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAQ;IAEpC,sEAAsE;IAEtE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAQ;IAExC;;;;OAIG;IAEH,UAAU,OAAc;IAExB;;;;OAIG;IAEH,QAAQ,SAAQ;IAEhB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAWtC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAGlD"}
+{"version":3,"file":"LoginAuditEvent.d.ts","sourceRoot":"","sources":["../../src/models/LoginAuditEvent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAS,UAAU,EAAQ,MAAM,0BAA0B,CAAC;AAEnE,0CAA0C;AAC1C,MAAM,MAAM,iBAAiB;AAC3B,0EAA0E;AACxE,QAAQ;AACV,wDAAwD;GACtD,QAAQ;AACV,yCAAyC;GACvC,WAAW;AACb,oEAAoE;GAClE,QAAQ;AACV;;;GAGG;GACD,eAAe;AACjB,gEAAgE;GAC9D,SAAS,CAAC;AAEd,qBASa,oBAAqB,SAAQ,UAAU;IAClD,2EAA2E;IAE3E,IAAI,SAAM;IAGV,OAAO,EAAE,iBAAiB,CAAY;IAEtC,mEAAmE;IAEnE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAQ;IAErC,gFAAgF;IAEhF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAQ;IAEpC,sEAAsE;IAEtE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAQ;IAExC;;;;OAIG;IAEH,UAAU,OAAc;IAExB;;;;OAIG;IAEH,QAAQ,SAAQ;IAEhB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAWtC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAGlD"}

package/dist/models/MembershipOverride.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipOverride.d.ts","sourceRoot":"","sources":["../../src/models/MembershipOverride.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,iBAAiB;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBASa,kBAAmB,SAAQ,UAAU;IAChD;;OAEG;IAEH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IAEH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IAEH,MAAM,EAAE,cAAc,CAAwB;gBAElC,OAAO,GAAE,yBAA8B;IASnD;;OAEG;IACH,OAAO,IAAI,OAAO;IAIlB;;OAEG;IACH,MAAM,IAAI,OAAO;CAGlB"}
+{"version":3,"file":"MembershipOverride.d.ts","sourceRoot":"","sources":["../../src/models/MembershipOverride.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,iBAAiB;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAaa,kBAAmB,SAAQ,UAAU;IAChD;;OAEG;IAEH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IAEH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IAEH,MAAM,EAAE,cAAc,CAAwB;gBAElC,OAAO,GAAE,yBAA8B;IASnD;;OAEG;IACH,OAAO,IAAI,OAAO;IAIlB;;OAEG;IACH,MAAM,IAAI,OAAO;CAGlB"}

package/dist/models/Session.d.ts

@@ -43,6 +43,15 @@ export declare const SESSION_DATA_KEYS: {
     readonly absoluteExpiresAt: "absoluteExpiresAt";
     /** Sliding idle timeout in seconds, applied on every recorded activity. */
     readonly idleSeconds: "idleSeconds";
+    /**
+     * ISO timestamp of the out-of-band proof (a recovery link, an operator-
+     * issued code) a host verified before minting this session (#3905). Set
+     * only by the host's recovery flow at mint; it is what
+     * `PasswordCredentialService.replaceForgottenPassword` measures freshness
+     * from, and it survives tenant-switch rotation (unlike the row's
+     * `created_at`).
+     */
+    readonly outOfBandProofAt: "outOfBandProofAt";
 };
 /**
  * Expiry for a session minted or extended now: `ttlSeconds` ahead, bounded by

package/dist/models/Session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Session.d.ts","sourceRoot":"","sources":["../../src/models/Session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mEAAmE;IACnE,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,cAAc,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,YAAY,GACZ,UAAU,GACV,QAAQ,GACR,KAAK,GACL,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;GAEG;AACH,eAAO,MAAM,mBAAmB,QAAmB,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;IAC5B,qFAAqF;;IAErF,8EAA8E;;IAE9E,2EAA2E;;CAEnE,CAAC;AAEX;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACxC,IAAI,CASN;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAYa,OAAQ,SAAQ,UAAU;IACrC;;OAEG;IAGH,MAAM,EAAE,MAAM,CAAM;IAEpB;;;OAGG;IAEH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B;;OAEG;IAKH,MAAM,EAAE,aAAa,CAAwB;IAE7C;;;;;OAKG;IAOH,SAAS,EAAE,IAAI,CAAc;IAE7B;;OAEG;IAKH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IAEH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IAEH,cAAc,EAAE,IAAI,CAAc;IAElC;;OAEG;IAIH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM;IAEnC;;;;OAIG;IAMH,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAQ;IAE5C;;;;;;;;;;;;;;;;OAgBG;IAEH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAQ;gBAE1B,OAAO,GAAE,cAAmB;IA0BxC,wDAAwD;IACxD,SAAS,IAAI,OAAO;IAIpB;;;OAGG;IACH,iBAAiB,IAAI,IAAI,GAAG,IAAI;IAUhC;;;OAGG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI;IAO/B;;;OAGG;IACH,oBAAoB,IAAI,MAAM,EAAE,GAAG,IAAI;IAQvC;;;OAGG;IACH,OAAO,IAAI,OAAO;IAUlB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,MAAM,CAAC,UAAU,GAAE,MAA4B,GAAG,IAAI;IAOtD,4EAA4E;IACtE,cAAc,CAClB,SAAS,UAAQ,EACjB,UAAU,GAAE,MAA4B,GACvC,OAAO,CAAC,OAAO,CAAC;YAyBL,wBAAwB;IAQtC;;OAEG;IACH,MAAM,IAAI,IAAI;IAId;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIxC;;OAEG;IACH,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAItC;;OAEG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAI1C;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAG9B"}
+{"version":3,"file":"Session.d.ts","sourceRoot":"","sources":["../../src/models/Session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mEAAmE;IACnE,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,cAAc,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,YAAY,GACZ,UAAU,GACV,QAAQ,GACR,KAAK,GACL,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;GAEG;AACH,eAAO,MAAM,mBAAmB,QAAmB,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;IAC5B,qFAAqF;;IAErF,8EAA8E;;IAE9E,2EAA2E;;IAE3E;;;;;;;OAOG;;CAEK,CAAC;AAEX;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACxC,IAAI,CASN;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAYa,OAAQ,SAAQ,UAAU;IACrC;;OAEG;IAGH,MAAM,EAAE,MAAM,CAAM;IAEpB;;;OAGG;IAEH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B;;OAEG;IAKH,MAAM,EAAE,aAAa,CAAwB;IAE7C;;;;;OAKG;IAOH,SAAS,EAAE,IAAI,CAAc;IAE7B;;OAEG;IAKH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IAEH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IAEH,cAAc,EAAE,IAAI,CAAc;IAElC;;OAEG;IAIH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM;IAEnC;;;;OAIG;IAMH,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAQ;IAE5C;;;;;;;;;;;;;;;;OAgBG;IAEH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAQ;gBAE1B,OAAO,GAAE,cAAmB;IA0BxC,wDAAwD;IACxD,SAAS,IAAI,OAAO;IAIpB;;;OAGG;IACH,iBAAiB,IAAI,IAAI,GAAG,IAAI;IAUhC;;;OAGG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI;IAO/B;;;OAGG;IACH,oBAAoB,IAAI,MAAM,EAAE,GAAG,IAAI;IAQvC;;;OAGG;IACH,OAAO,IAAI,OAAO;IAUlB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,MAAM,CAAC,UAAU,GAAE,MAA4B,GAAG,IAAI;IAOtD,4EAA4E;IACtE,cAAc,CAClB,SAAS,UAAQ,EACjB,UAAU,GAAE,MAA4B,GACvC,OAAO,CAAC,OAAO,CAAC;YAyBL,wBAAwB;IAQtC;;OAEG;IACH,MAAM,IAAI,IAAI;IAId;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIxC;;OAEG;IACH,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAItC;;OAEG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAI1C;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAG9B"}

package/dist/models/TenantPermissionOverride.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TenantPermissionOverride.d.ts","sourceRoot":"","sources":["../../src/models/TenantPermissionOverride.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;GAEG;AACH,MAAM,WAAW,+BAAgC,SAAQ,iBAAiB;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,qBASa,wBAAyB,SAAQ,UAAU;IACtD;;OAEG;IAEH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IAEH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IAEH,MAAM,EAAE,sBAAsB,CAAkC;gBAEpD,OAAO,GAAE,+BAAoC;IAQzD;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,OAAO,IAAI,OAAO;IAIlB;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;OAEG;IACH,iBAAiB,IAAI,OAAO;CAG7B"}
+{"version":3,"file":"TenantPermissionOverride.d.ts","sourceRoot":"","sources":["../../src/models/TenantPermissionOverride.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;GAEG;AACH,MAAM,WAAW,+BAAgC,SAAQ,iBAAiB;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,qBAaa,wBAAyB,SAAQ,UAAU;IACtD;;OAEG;IAEH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IAEH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IAEH,MAAM,EAAE,sBAAsB,CAAkC;gBAEpD,OAAO,GAAE,+BAAoC;IAQzD;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,OAAO,IAAI,OAAO;IAIlB;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;OAEG;IACH,iBAAiB,IAAI,OAAO;CAG7B"}

package/dist/services/LoginAttemptLimiter.d.ts

@@ -21,7 +21,9 @@
  * the client submitted — an email key or user id, never a resolved account)
  * and the **source** (client IP, or the device/station the attempt came
  * from). Either one being exhausted refuses the attempt. Both are stored as
- * hashes.
+ * hashes. Each budget can be sized on its own (`subject`, `source`), and the
+ * source budget can be turned off (`source: false`) where no trustworthy
+ * client address exists (#3531).
  *
  * ## Non-enumeration
  *
@@ -49,7 +51,10 @@
  *
  * Every decision is reported to a {@link LoginAuditSink}. The default sink
  * persists {@link UsersLoginAuditEvent} rows; pass `audit: false` to disable
- * or supply a sink that forwards to the host's own log.
+ * or supply a sink that forwards to the host's own log. When a failure starts
+ * a SOURCE lockout the limiter also reports one `source-locked` entry that
+ * carries the source hash but no subject (so it never names the accounts that
+ * were tried), at most once per source per `sourceLockoutAuditSeconds`.
  *
  * @packageDocumentation
  */
@@ -66,6 +71,8 @@ export declare const DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS = 60;
 export declare const DEFAULT_LOGIN_LOCKOUT_FACTOR = 2;
 /** Default lockout ceiling (1 hour). */
 export declare const DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS: number;
+/** Default minimum spacing of `source-locked` audit entries per source (5 minutes). */
+export declare const DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS: number;
 export interface LoginLockoutOptions {
     baseSeconds?: number;
     factor?: number;
@@ -81,6 +88,18 @@ export interface LoginAuditEntry {
     occurredAt: Date;
     metadata?: Record<string, unknown>;
 }
+/**
+ * One budget's sizing (#3531). Every field falls back to the limiter's
+ * top-level option of the same meaning.
+ */
+export interface LoginBudgetOptions {
+    /** Failed attempts allowed per window (top-level `maxAttempts`). */
+    maxFailures?: number;
+    /** Sliding window in seconds (top-level `windowSeconds`). */
+    windowSeconds?: number;
+    /** Lockout once the budget is exhausted; `false` keeps only the window. */
+    lockout?: LoginLockoutOptions | false;
+}
 /** Where sign-in decisions are reported. Must not throw into the sign-in path. */
 export interface LoginAuditSink {
     record(entry: LoginAuditEntry): Promise<void>;
@@ -96,9 +115,30 @@ export interface LoginAttemptLimiterOptions extends SmrtClassOptions {
      * terminal-approve behaviour).
      */
     lockout?: LoginLockoutOptions | false;
+    /**
+     * Per-account budget (#3531). Omitted fields use the top-level options.
+     */
+    subject?: LoginBudgetOptions;
+    /**
+     * Per-address (or per-device) budget (#3531). Omitted fields use the
+     * top-level options. `false` ignores the source key entirely — for a
+     * deployment that cannot see a trustworthy client address, where every
+     * browser would otherwise share one budget and a handful of failures from
+     * anyone would lock everyone out. A reservation then needs a subject.
+     * This applies to every credential kind using this instance, so a host
+     * whose PIN sign-ins share it should prefer a larger source budget (or a
+     * separate limiter for passwords) over disabling it.
+     */
+    source?: LoginBudgetOptions | false;
+    /**
+     * Minimum spacing, per source, of the `source-locked` audit entry reported
+     * when a failure starts a source lockout. Defaults to
+     * {@link DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS}. Tracked per instance.
+     */
+    sourceLockoutAuditSeconds?: number;
     /**
      * Time since a key's last failure after which its streak is forgiven. Defaults to
-     * twice the larger of the window and the lockout ceiling.
+     * twice the larger of the budget's window and lockout ceiling.
      */
     streakResetSeconds?: number;
     /**
@@ -188,22 +228,26 @@ export declare class DurableLoginAuditSink implements LoginAuditSink {
 }
 export declare class LoginAttemptLimiter {
     private readonly options;
-    private readonly maxAttempts;
-    private readonly windowMs;
-    private readonly lockout;
-    private readonly streakResetMs;
+    private readonly budgets;
     private readonly sourceStreakDecayMs;
+    private readonly sourceLockoutAuditMs;
+    /** Source hash → earliest time its next `source-locked` entry may be reported. */
+    private readonly sourceLockoutAudited;
     private attempts;
     private audit;
     constructor(options: LoginAttemptLimiterOptions);
+    /** False when this limiter was configured with `source: false`. */
+    get limitsSource(): boolean;
     static create(options: LoginAttemptLimiterOptions): Promise<LoginAttemptLimiter>;
     initialize(): Promise<void>;
-    /** How long a row this limiter writes must outlive the retention sweep. */
-    private get retainMs();
     /** Stable, peppered hash for a key. Exposed so hosts can correlate audit rows. */
     hashKey(scope: LoginAttemptScope, raw: string): string;
-    /** Lockout length for the n-th consecutive exhausted budget (0-based). */
-    lockoutMsFor(exhaustedBudgets: number): number;
+    /**
+     * Lockout length for the n-th consecutive exhausted budget (0-based) of the
+     * given scope's budget (the subject's by default).
+     */
+    lockoutMsFor(exhaustedBudgets: number, scope?: LoginAttemptScope): number;
+    private budgetFor;
     /**
      * Reserve one attempt against every key supplied. Subject is reserved
      * first; if the source then refuses, the subject reservation is handed
@@ -222,6 +266,13 @@ export declare class LoginAttemptLimiter {
         dryRun?: boolean;
     }): Promise<number>;
     private releaseAll;
+    /**
+     * Report that a source lockout started, without the subject or the caller's
+     * metadata, so the entry attributes the outage to the address or device but
+     * never names an attempted account. Rate limited per source, in memory, so
+     * a sustained attack yields a bounded number of entries per instance.
+     */
+    private reportSourceLockout;
     private report;
 }
 //# sourceMappingURL=LoginAttemptLimiter.d.ts.map

package/dist/services/LoginAttemptLimiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LoginAttemptLimiter.d.ts","sourceRoot":"","sources":["../../src/services/LoginAttemptLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,+CAA+C;AAC/C,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAC5C,0CAA0C;AAC1C,eAAO,MAAM,oCAAoC,QAAS,CAAC;AAC3D,wCAAwC;AACxC,eAAO,MAAM,kCAAkC,KAAK,CAAC;AACrD,mEAAmE;AACnE,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,wCAAwC;AACxC,eAAO,MAAM,iCAAiC,QAAU,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;IAClE,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,OAAO,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;IACtC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;OAEG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,KAAK,CAAC;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvE,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,+EAA+E;IAC/E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,SAAS,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC;AAED,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAE1E;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAG1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,GAAG,WAAW,CAAC;CAOxE;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAyB;CAI7C;AAED,8EAA8E;AAC9E,qBAAa,qBAAsB,YAAW,cAAc;IAExD,OAAO,CAAC,QAAQ,CAAC,MAAM;IADzB,OAAO;WAIM,MAAM,CACjB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,qBAAqB,CAAC;IAM3B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAYpD;AAaD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,KAAK,CAA+B;gBAEhC,OAAO,EAAE,0BAA0B;WAgClC,MAAM,CACjB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,mBAAmB,CAAC;IAMzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAWjC,2EAA2E;IAC3E,OAAO,KAAK,QAAQ,GAEnB;IAED,kFAAkF;IAClF,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;IAQtD,0EAA0E;IAC1E,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM;IAS9C;;;;OAIG;IACG,OAAO,CACX,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,oBAAoB,CAAC;IAyHhC,uEAAuE;IACjE,gBAAgB,CAAC,KAAK,EAAE;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC;IAajB,iDAAiD;IAC3C,WAAW,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAIxD,UAAU;YAsBV,MAAM;CASrB"}
+{"version":3,"file":"LoginAttemptLimiter.d.ts","sourceRoot":"","sources":["../../src/services/LoginAttemptLimiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,+CAA+C;AAC/C,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAC5C,0CAA0C;AAC1C,eAAO,MAAM,oCAAoC,QAAS,CAAC;AAC3D,wCAAwC;AACxC,eAAO,MAAM,kCAAkC,KAAK,CAAC;AACrD,mEAAmE;AACnE,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,wCAAwC;AACxC,eAAO,MAAM,iCAAiC,QAAU,CAAC;AACzD,uFAAuF;AACvF,eAAO,MAAM,oCAAoC,QAAS,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;CACvC;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;IAClE,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,OAAO,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;IACtC;;OAEG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC;IACpC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;OAEG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,KAAK,CAAC;IAC/B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvE,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,+EAA+E;IAC/E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,SAAS,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC;AAED,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAE1E;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAG1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,GAAG,WAAW,CAAC;CAOxE;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAyB;CAI7C;AAED,8EAA8E;AAC9E,qBAAa,qBAAsB,YAAW,cAAc;IAExD,OAAO,CAAC,QAAQ,CAAC,MAAM;IADzB,OAAO;WAIM,MAAM,CACjB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,qBAAqB,CAAC;IAM3B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAYpD;AAqED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGtB;IACF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,KAAK,CAA+B;gBAEhC,OAAO,EAAE,0BAA0B;IAmB/C,mEAAmE;IACnE,IAAI,YAAY,IAAI,OAAO,CAE1B;WAEY,MAAM,CACjB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,mBAAmB,CAAC;IAMzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAWjC,kFAAkF;IAClF,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;IAQtD;;;OAGG;IACH,YAAY,CACV,gBAAgB,EAAE,MAAM,EACxB,KAAK,GAAE,iBAA6B,GACnC,MAAM;IAUT,OAAO,CAAC,SAAS;IAIjB;;;;OAIG;IACG,OAAO,CACX,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,oBAAoB,CAAC;IA0IhC,uEAAuE;IACjE,gBAAgB,CAAC,KAAK,EAAE;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC;IAajB,iDAAiD;IAC3C,WAAW,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;YAIxD,UAAU;IAsBxB;;;;;OAKG;YACW,mBAAmB;YAoCnB,MAAM;CASrB"}