@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/identity/device-auth/dto/device-token-error.dto.js

@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceTokenErrorDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+/**
+ * Error response for `POST /auth/device/token`, per RFC 8628 §3.5.
+ *
+ * This is NOT the shared `ErrorDto` envelope, and that is deliberate: the RFC
+ * fixes the token endpoint's error body, and `error` is the whole protocol —
+ * a client polls on `authorization_pending`, backs off on `slow_down`,
+ * restarts on `expired_token`, and stops on `access_denied`. `DeviceAuthService`
+ * throws these through `deviceTokenError()`, which brands the exception so
+ * `HttpExceptionFilter` sends this body verbatim rather than flattening it into
+ * the envelope, which used to make all four outcomes byte-identical (#153).
+ */
+class DeviceTokenErrorDto {
+    error;
+    error_description;
+}
+exports.DeviceTokenErrorDto = DeviceTokenErrorDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'RFC 8628 §3.5 / RFC 6749 §5.2 error code. Branch on this, never on the ' +
+            'description or the HTTP status.',
+        enum: [
+            'authorization_pending',
+            'slow_down',
+            'expired_token',
+            'access_denied',
+            'invalid_grant',
+            'invalid_request',
+        ],
+        example: 'authorization_pending',
+    }),
+    __metadata("design:type", String)
+], DeviceTokenErrorDto.prototype, "error", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Human-readable error description. Prose; may change.',
+        example: 'User has not yet authorized this device',
+    }),
+    __metadata("design:type", String)
+], DeviceTokenErrorDto.prototype, "error_description", void 0);
+//# sourceMappingURL=device-token-error.dto.js.map

package/dist/identity/device-auth/dto/device-token-error.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-token-error.dto.js","sourceRoot":"","sources":["../../../../src/identity/device-auth/dto/device-token-error.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAE9C;;;;;;;;;;GAUG;AACH,MAAa,mBAAmB;IAe9B,KAAK,CAAU;IAMf,iBAAiB,CAAU;CAC5B;AAtBD,kDAsBC;AAPC;IAdC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,yEAAyE;YACzE,iCAAiC;QACnC,IAAI,EAAE;YACJ,uBAAuB;YACvB,WAAW;YACX,eAAe;YACf,eAAe;YACf,eAAe;YACf,iBAAiB;SAClB;QACD,OAAO,EAAE,uBAAuB;KACjC,CAAC;;kDACa;AAMf;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,yCAAyC;KACnD,CAAC;;8DACyB"}

package/dist/identity/device-auth/dto/device-token-request.dto.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Request DTO for polling device authorization status
+ */
+export declare const DeviceTokenRequestSchema: import("zod").ZodObject<{
+    deviceCode: import("zod").ZodString;
+}, import("zod/v4/core").$strip>;
+declare const DeviceTokenRequestDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    deviceCode: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, false>;
+export declare class DeviceTokenRequestDto extends DeviceTokenRequestDto_base {
+    deviceCode: string;
+}
+export {};
+//# sourceMappingURL=device-token-request.dto.d.ts.map

package/dist/identity/device-auth/dto/device-token-request.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-token-request.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/device-auth/dto/device-token-request.dto.ts"],"names":[],"mappings":"AAIA;;GAEG;AAEH,eAAO,MAAM,wBAAwB;;gCAA2B,CAAC;;;;AAEjE,qBAAa,qBAAsB,SAAQ,0BAAsC;IAO/E,UAAU,EAAG,MAAM,CAAC;CACrB"}

package/dist/identity/device-auth/dto/device-token-request.dto.js

@@ -0,0 +1,33 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceTokenRequestDto = exports.DeviceTokenRequestSchema = void 0;
+const nestjs_zod_1 = require("nestjs-zod");
+const identity_1 = require("@marinoscar/platform-contract/identity");
+const swagger_1 = require("@nestjs/swagger");
+/**
+ * Request DTO for polling device authorization status
+ */
+// The schema is the contract's (#727).
+exports.DeviceTokenRequestSchema = identity_1.deviceTokenRequestSchema;
+class DeviceTokenRequestDto extends (0, nestjs_zod_1.createZodDto)(exports.DeviceTokenRequestSchema) {
+    deviceCode;
+}
+exports.DeviceTokenRequestDto = DeviceTokenRequestDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Device verification code returned by `POST /auth/device/code` (the `deviceCode` ' +
+            'field). Opaque; not the human-readable user code.',
+        example: 'a4f3b8c9d2e1f5a6b7c8d9e0f1a2b3c4',
+    }),
+    __metadata("design:type", String)
+], DeviceTokenRequestDto.prototype, "deviceCode", void 0);
+//# sourceMappingURL=device-token-request.dto.js.map

package/dist/identity/device-auth/dto/device-token-request.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-token-request.dto.js","sourceRoot":"","sources":["../../../../src/identity/device-auth/dto/device-token-request.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA0C;AAC1C,qEAAkF;AAClF,6CAA8C;AAE9C;;GAEG;AACH,uCAAuC;AAC1B,QAAA,wBAAwB,GAAG,mCAAwB,CAAC;AAEjE,MAAa,qBAAsB,SAAQ,IAAA,yBAAY,EAAC,gCAAwB,CAAC;IAO/E,UAAU,CAAU;CACrB;AARD,sDAQC;AADC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,kFAAkF;YAClF,mDAAmD;QACrD,OAAO,EAAE,kCAAkC;KAC5C,CAAC;;yDACkB"}

package/dist/identity/device-auth/dto/device-token-response.dto.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Response DTO for successful device authorization.
+ *
+ * ---------------------------------------------------------------------------
+ * WHY ONE DTO WITH OPTIONAL FIELDS RATHER THAN TWO RESPONSE SHAPES (#141)
+ * ---------------------------------------------------------------------------
+ * RFC 8628 §3.5 says the token response IS an OAuth 2.0 token response:
+ * `access_token` + `token_type` required, `refresh_token` and `expires_in`
+ * optional. Both credentials this flow can mint fit that contract; they differ
+ * only in which optional parts they carry. So this stays ONE shape.
+ *
+ * The governing constraint is that the SESSION path's response must be
+ * byte-for-byte what it has always been (epic #110, success criterion 9). It
+ * is: no field it emitted was removed, renamed, or re-typed on the wire, and
+ * no field was ADDED to it either. Everything new below is populated only on
+ * the `pat` branch. `refreshToken` became optional in TypeScript and in
+ * OpenAPI, but the session branch still populates it, so no existing client
+ * sees a change.
+ *
+ * `tokenType` stays the literal `'Bearer'` for BOTH paths. This is deliberate
+ * and is the one field it would be tempting to overload: a PAT *is* presented
+ * as `Authorization: Bearer pat_...`, and `JwtAuthGuard` accepts it on exactly
+ * that header (it branches on the `pat_` prefix before delegating to the JWT
+ * strategy). Returning `tokenType: 'PAT'` would tell a spec-compliant OAuth
+ * client that it does NOT hold a bearer credential, and it would stop sending
+ * the only header that works. `token_type` describes HOW to present a
+ * credential, never what kind of record backs it.
+ *
+ * HOW A CLIENT TELLS THE TWO APART: `credentialType`. It is present and equal
+ * to `'pat'` on the PAT branch and ABSENT on the session branch — the exact
+ * mirror of the request side, where `clientInfo.tokenType` absent likewise
+ * means session. One rule, stated once, holding in both directions: no tag
+ * means the legacy session credential. Discriminating instead on
+ * `refreshToken === undefined` would happen to work today but is an accidental
+ * signal — a client cannot distinguish "this kind has no refresh token" from
+ * "the server failed to send one", and it would mis-handle any future
+ * credential kind. An explicit tag is checkable and greppable.
+ * ---------------------------------------------------------------------------
+ */
+export declare class DeviceTokenResponseDto {
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: string;
+    expiresIn: number;
+    credentialType?: 'pat';
+    expiresAt?: string;
+    tokenId?: string;
+    tokenName?: string;
+}
+//# sourceMappingURL=device-token-response.dto.d.ts.map

package/dist/identity/device-auth/dto/device-token-response.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-token-response.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/device-auth/dto/device-token-response.dto.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,qBAAa,sBAAsB;IAQjC,WAAW,EAAG,MAAM,CAAC;IAWrB,YAAY,CAAC,EAAE,MAAM,CAAC;IAStB,SAAS,EAAG,MAAM,CAAC;IAUnB,SAAS,EAAG,MAAM,CAAC;IAYnB,cAAc,CAAC,EAAE,KAAK,CAAC;IAWvB,SAAS,CAAC,EAAE,MAAM,CAAC;IAUnB,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/identity/device-auth/dto/device-token-response.dto.js

@@ -0,0 +1,145 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceTokenResponseDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+/**
+ * Response DTO for successful device authorization.
+ *
+ * ---------------------------------------------------------------------------
+ * WHY ONE DTO WITH OPTIONAL FIELDS RATHER THAN TWO RESPONSE SHAPES (#141)
+ * ---------------------------------------------------------------------------
+ * RFC 8628 §3.5 says the token response IS an OAuth 2.0 token response:
+ * `access_token` + `token_type` required, `refresh_token` and `expires_in`
+ * optional. Both credentials this flow can mint fit that contract; they differ
+ * only in which optional parts they carry. So this stays ONE shape.
+ *
+ * The governing constraint is that the SESSION path's response must be
+ * byte-for-byte what it has always been (epic #110, success criterion 9). It
+ * is: no field it emitted was removed, renamed, or re-typed on the wire, and
+ * no field was ADDED to it either. Everything new below is populated only on
+ * the `pat` branch. `refreshToken` became optional in TypeScript and in
+ * OpenAPI, but the session branch still populates it, so no existing client
+ * sees a change.
+ *
+ * `tokenType` stays the literal `'Bearer'` for BOTH paths. This is deliberate
+ * and is the one field it would be tempting to overload: a PAT *is* presented
+ * as `Authorization: Bearer pat_...`, and `JwtAuthGuard` accepts it on exactly
+ * that header (it branches on the `pat_` prefix before delegating to the JWT
+ * strategy). Returning `tokenType: 'PAT'` would tell a spec-compliant OAuth
+ * client that it does NOT hold a bearer credential, and it would stop sending
+ * the only header that works. `token_type` describes HOW to present a
+ * credential, never what kind of record backs it.
+ *
+ * HOW A CLIENT TELLS THE TWO APART: `credentialType`. It is present and equal
+ * to `'pat'` on the PAT branch and ABSENT on the session branch — the exact
+ * mirror of the request side, where `clientInfo.tokenType` absent likewise
+ * means session. One rule, stated once, holding in both directions: no tag
+ * means the legacy session credential. Discriminating instead on
+ * `refreshToken === undefined` would happen to work today but is an accidental
+ * signal — a client cannot distinguish "this kind has no refresh token" from
+ * "the server failed to send one", and it would mis-handle any future
+ * credential kind. An explicit tag is checkable and greppable.
+ * ---------------------------------------------------------------------------
+ */
+class DeviceTokenResponseDto {
+    accessToken;
+    refreshToken;
+    tokenType;
+    expiresIn;
+    credentialType;
+    expiresAt;
+    tokenId;
+    tokenName;
+}
+exports.DeviceTokenResponseDto = DeviceTokenResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'The credential to present as `Authorization: Bearer <token>`. A signed ' +
+            'JWT for a session credential; an opaque `pat_...` token when ' +
+            '`credentialType` is `pat`.',
+        example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
+    }),
+    __metadata("design:type", String)
+], DeviceTokenResponseDto.prototype, "accessToken", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Refresh token for obtaining new access tokens. Present for the session ' +
+            'credential only. A personal access token has no refresh token by design: ' +
+            're-running the device login is its renewal path, and this API\'s refresh ' +
+            'flow relies on an HttpOnly cookie that a CLI does not have.',
+        example: 'a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6',
+        required: false,
+    }),
+    __metadata("design:type", String)
+], DeviceTokenResponseDto.prototype, "refreshToken", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'OAuth 2.0 token type — always `Bearer`, for both credential kinds. It ' +
+            'describes how to present the token, not which kind it is; branch on ' +
+            '`credentialType` for that.',
+        example: 'Bearer',
+    }),
+    __metadata("design:type", String)
+], DeviceTokenResponseDto.prototype, "tokenType", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Token lifetime in seconds. For the session credential this is ' +
+            '`DEVICE_TOKEN_EXPIRY_DAYS` (7 days = 604800 seconds by default), not the ordinary ' +
+            '15-minute web access-token TTL. For a PAT it is the remaining time until `expiresAt` ' +
+            '(`DEVICE_PAT_EXPIRY_DAYS`, 90 days by default); prefer the absolute `expiresAt` there.',
+        example: 604800,
+    }),
+    __metadata("design:type", Number)
+], DeviceTokenResponseDto.prototype, "expiresIn", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Set to `pat` when the device requested `clientInfo.tokenType: "pat"` and ' +
+            'a personal access token was issued. ABSENT for the default session ' +
+            'credential, mirroring the request side where an absent ' +
+            '`clientInfo.tokenType` means session. Clients should branch on this.',
+        enum: ['pat'],
+        example: 'pat',
+        required: false,
+    }),
+    __metadata("design:type", String)
+], DeviceTokenResponseDto.prototype, "credentialType", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Absolute expiry, ISO-8601. PAT only. A CLI persists its token to a config ' +
+            'file and re-reads it days later, where a relative `expiresIn` captured at ' +
+            'issue time is useless without also storing the issue instant; an absolute ' +
+            'timestamp survives that round trip on its own.',
+        example: '2026-11-28T12:00:00.000Z',
+        required: false,
+    }),
+    __metadata("design:type", String)
+], DeviceTokenResponseDto.prototype, "expiresAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Identifier of the issued personal access token. PAT only. Lets a client ' +
+            'name the exact row to revoke in the Access Tokens page ' +
+            '(`DELETE /api/pat/{id}`). Not a secret — it is already returned by `GET /api/pat`.',
+        example: '123e4567-e89b-12d3-a456-426614174000',
+        required: false,
+    }),
+    __metadata("design:type", String)
+], DeviceTokenResponseDto.prototype, "tokenId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Display name given to the issued personal access token, so a client can ' +
+            'tell the user which row to look for in the Access Tokens list. PAT only.',
+        example: 'Device: oscar-laptop',
+        required: false,
+    }),
+    __metadata("design:type", String)
+], DeviceTokenResponseDto.prototype, "tokenName", void 0);
+//# sourceMappingURL=device-token-response.dto.js.map

package/dist/identity/device-auth/dto/device-token-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-token-response.dto.js","sourceRoot":"","sources":["../../../../src/identity/device-auth/dto/device-token-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAa,sBAAsB;IAQjC,WAAW,CAAU;IAWrB,YAAY,CAAU;IAStB,SAAS,CAAU;IAUnB,SAAS,CAAU;IAYnB,cAAc,CAAS;IAWvB,SAAS,CAAU;IAUnB,OAAO,CAAU;IASjB,SAAS,CAAU;CACpB;AAjFD,wDAiFC;AAzEC;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,yEAAyE;YACzE,+DAA+D;YAC/D,4BAA4B;QAC9B,OAAO,EAAE,yCAAyC;KACnD,CAAC;;2DACmB;AAWrB;IATC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,6DAA6D;QAC/D,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,KAAK;KAChB,CAAC;;4DACoB;AAStB;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,wEAAwE;YACxE,sEAAsE;YACtE,4BAA4B;QAC9B,OAAO,EAAE,QAAQ;KAClB,CAAC;;yDACiB;AAUnB;IARC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,gEAAgE;YAChE,oFAAoF;YACpF,uFAAuF;YACvF,wFAAwF;QAC1F,OAAO,EAAE,MAAM;KAChB,CAAC;;yDACiB;AAYnB;IAVC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,2EAA2E;YAC3E,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;QACxE,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK;KAChB,CAAC;;8DACqB;AAWvB;IATC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,4EAA4E;YAC5E,4EAA4E;YAC5E,4EAA4E;YAC5E,gDAAgD;QAClD,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,KAAK;KAChB,CAAC;;yDACiB;AAUnB;IARC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,0EAA0E;YAC1E,yDAAyD;YACzD,oFAAoF;QACtF,OAAO,EAAE,sCAAsC;QAC/C,QAAQ,EAAE,KAAK;KAChB,CAAC;;uDACe;AASjB;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,0EAA0E;YAC1E,0EAA0E;QAC5E,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,KAAK;KAChB,CAAC;;yDACiB"}

package/dist/identity/device-auth/dto/index.d.ts

@@ -0,0 +1,10 @@
+export * from './device-code-request.dto';
+export * from './device-code-response.dto';
+export * from './device-token-request.dto';
+export * from './device-token-response.dto';
+export * from './device-token-error.dto';
+export * from './device-authorize-request.dto';
+export * from './device-authorize-response.dto';
+export * from './device-activate-response.dto';
+export * from './device-session.dto';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/device-auth/dto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/identity/device-auth/dto/index.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sBAAsB,CAAC"}

package/dist/identity/device-auth/dto/index.js

@@ -0,0 +1,26 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./device-code-request.dto"), exports);
+__exportStar(require("./device-code-response.dto"), exports);
+__exportStar(require("./device-token-request.dto"), exports);
+__exportStar(require("./device-token-response.dto"), exports);
+__exportStar(require("./device-token-error.dto"), exports);
+__exportStar(require("./device-authorize-request.dto"), exports);
+__exportStar(require("./device-authorize-response.dto"), exports);
+__exportStar(require("./device-activate-response.dto"), exports);
+__exportStar(require("./device-session.dto"), exports);
+//# sourceMappingURL=index.js.map

package/dist/identity/device-auth/dto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/identity/device-auth/dto/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4DAA0C;AAC1C,6DAA2C;AAC3C,6DAA2C;AAC3C,8DAA4C;AAC5C,2DAAyC;AACzC,iEAA+C;AAC/C,kEAAgD;AAChD,iEAA+C;AAC/C,uDAAqC"}

package/dist/identity/device-auth/exceptions/device-token-error.exception.d.ts

@@ -0,0 +1,38 @@
+import { HttpException } from '@nestjs/common';
+/**
+ * The error codes `POST /auth/device/token` can return.
+ *
+ * A closed union, not `string`, so a typo is a compile error rather than an
+ * error code no client has ever heard of. RFC 8628 §3.5 defines the first four;
+ * `invalid_grant` and `invalid_request` come from RFC 6749 §5.2, which §3.5
+ * defers to for everything else.
+ */
+export type DeviceTokenErrorCode = 'authorization_pending' | 'slow_down' | 'expired_token' | 'access_denied' | 'invalid_grant' | 'invalid_request';
+/**
+ * Build the RFC 8628 error for the device token endpoint.
+ *
+ * ---------------------------------------------------------------------------
+ * WHY EVERY TOKEN-ENDPOINT ERROR GOES THROUGH THIS ONE FUNCTION (#153)
+ * ---------------------------------------------------------------------------
+ * Because the alternative is what the bug already was. The service used to
+ * throw `new BadRequestException(\{ error: 'authorization_pending', … \})`
+ * directly — a shape that looks obviously correct at the throw site and was
+ * silently flattened by the global exception filter into a generic
+ * `\{ statusCode: 400, code: 'BAD_REQUEST', message: 'An unexpected error occurred' \}`. All four RFC outcomes came out byte-identical, so a client
+ * could not tell "still waiting" from "the user said no", and the failure was
+ * invisible to unit tests (which assert the thrown exception, before the filter
+ * runs) and to integration tests (which never polled).
+ *
+ * Routing every one of them through this function means the opt-out brand is
+ * applied in one place instead of at nine throw sites, so a NEW outcome added
+ * later cannot forget it: writing `throw deviceTokenError('…')` is the only way
+ * to name a code, and the union type refuses anything that is not a real one.
+ * That is the property worth having — a future contributor who has never read
+ * #153 gets a compliant response by copying the line next to theirs.
+ *
+ * The returned instance is still a `BadRequestException` /
+ * `UnauthorizedException`, so callers and tests that branch on the exception
+ * type are unaffected; the only added fact is "send this body verbatim".
+ */
+export declare function deviceTokenError(error: DeviceTokenErrorCode, errorDescription: string): HttpException;
+//# sourceMappingURL=device-token-error.exception.d.ts.map

package/dist/identity/device-auth/exceptions/device-token-error.exception.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-token-error.exception.d.ts","sourceRoot":"","sources":["../../../../src/identity/device-auth/exceptions/device-token-error.exception.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,aAAa,EAEd,MAAM,gBAAgB,CAAC;AAGxB;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAE5B,uBAAuB,GAEvB,WAAW,GAEX,eAAe,GAEf,eAAe,GAEf,eAAe,GAEf,iBAAiB,CAAC;AAuBtB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,oBAAoB,EAC3B,gBAAgB,EAAE,MAAM,GACvB,aAAa,CAWf"}

package/dist/identity/device-auth/exceptions/device-token-error.exception.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deviceTokenError = deviceTokenError;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../../core/index");
+/**
+ * HTTP status per error code.
+ *
+ * `invalid_grant` maps to 401 because that is what this endpoint has ALWAYS
+ * returned, and #153 is about the response BODY, not its status line. Note for
+ * whoever revisits this: RFC 6749 §5.2 actually specifies 400 for every code
+ * here except `invalid_client`, so the 401 is a deviation. It is left alone
+ * deliberately — changing a status is a separate, independently testable
+ * behaviour change, and a device client keys off the `error` value (which is
+ * now correct) rather than off the status. Fix it in its own issue if it ever
+ * matters, not as a side effect of this one.
+ */
+const STATUS_BY_CODE = {
+    authorization_pending: 400,
+    slow_down: 400,
+    expired_token: 400,
+    access_denied: 400,
+    invalid_grant: 401,
+    invalid_request: 400,
+};
+/**
+ * Build the RFC 8628 error for the device token endpoint.
+ *
+ * ---------------------------------------------------------------------------
+ * WHY EVERY TOKEN-ENDPOINT ERROR GOES THROUGH THIS ONE FUNCTION (#153)
+ * ---------------------------------------------------------------------------
+ * Because the alternative is what the bug already was. The service used to
+ * throw `new BadRequestException(\{ error: 'authorization_pending', … \})`
+ * directly — a shape that looks obviously correct at the throw site and was
+ * silently flattened by the global exception filter into a generic
+ * `\{ statusCode: 400, code: 'BAD_REQUEST', message: 'An unexpected error occurred' \}`. All four RFC outcomes came out byte-identical, so a client
+ * could not tell "still waiting" from "the user said no", and the failure was
+ * invisible to unit tests (which assert the thrown exception, before the filter
+ * runs) and to integration tests (which never polled).
+ *
+ * Routing every one of them through this function means the opt-out brand is
+ * applied in one place instead of at nine throw sites, so a NEW outcome added
+ * later cannot forget it: writing `throw deviceTokenError('…')` is the only way
+ * to name a code, and the union type refuses anything that is not a real one.
+ * That is the property worth having — a future contributor who has never read
+ * #153 gets a compliant response by copying the line next to theirs.
+ *
+ * The returned instance is still a `BadRequestException` /
+ * `UnauthorizedException`, so callers and tests that branch on the exception
+ * type are unaffected; the only added fact is "send this body verbatim".
+ */
+function deviceTokenError(error, errorDescription) {
+    // Snake_case on the wire, per the RFC. This object is what the client
+    // receives — the filter sends it untouched, adding nothing.
+    const body = { error, error_description: errorDescription };
+    const exception = STATUS_BY_CODE[error] === 401
+        ? new common_1.UnauthorizedException(body)
+        : new common_1.BadRequestException(body);
+    return (0, index_1.withVerbatimErrorBody)(exception);
+}
+//# sourceMappingURL=device-token-error.exception.js.map

package/dist/identity/device-auth/exceptions/device-token-error.exception.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-token-error.exception.js","sourceRoot":"","sources":["../../../../src/identity/device-auth/exceptions/device-token-error.exception.ts"],"names":[],"mappings":";;AA4EA,4CAcC;AA1FD,2CAIwB;AACxB,+CAA4D;AAwB5D;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAA4C;IAC9D,qBAAqB,EAAE,GAAG;IAC1B,SAAS,EAAE,GAAG;IACd,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,GAAG;IAClB,eAAe,EAAE,GAAG;CACrB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAgB,gBAAgB,CAC9B,KAA2B,EAC3B,gBAAwB;IAExB,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IAE5D,MAAM,SAAS,GACb,cAAc,CAAC,KAAK,CAAC,KAAK,GAAG;QAC3B,CAAC,CAAC,IAAI,8BAAqB,CAAC,IAAI,CAAC;QACjC,CAAC,CAAC,IAAI,4BAAmB,CAAC,IAAI,CAAC,CAAC;IAEpC,OAAO,IAAA,6BAAqB,EAAC,SAAS,CAAC,CAAC;AAC1C,CAAC"}

package/dist/identity/device-auth/handlers/device-code-cleanup.handler.d.ts

@@ -0,0 +1,30 @@
+import { OnModuleInit } from '@nestjs/common';
+import { type IdentityJobHandler, type IdentityJobRecord as Job, type IdentityJobsPort } from '../../ports';
+import { DeviceAuthService } from '../device-auth.service';
+/**
+ * The handler key, and therefore the `Job.type` every device-code-cleanup row
+ * carries. PERMANENT — rows outlive handlers. Exported so the scheduling task
+ * asks about the same string it queues.
+ *
+ * @stability stable
+ */
+export declare const DEVICE_CODE_CLEANUP_TYPE = "device-auth.code.cleanup";
+export declare class DeviceCodeCleanupHandler implements IdentityJobHandler, OnModuleInit {
+    private readonly jobs;
+    private readonly deviceAuth;
+    private readonly logger;
+    readonly type = "device-auth.code.cleanup";
+    readonly label = "Device code cleanup";
+    constructor(jobs: IdentityJobsPort, deviceAuth: DeviceAuthService);
+    /** Self-registration — the only wiring a handler needs. */
+    onModuleInit(): void;
+    /**
+     * Deletes expired device codes.
+     *
+     * THROWS TO FAIL. The old cron caught and logged; a handler must not, because
+     * swallowing here would report a cleanup that did not happen as a `succeeded`
+     * job — which is strictly worse than the log line it replaced.
+     */
+    process(job: Job): Promise<void>;
+}
+//# sourceMappingURL=device-code-cleanup.handler.d.ts.map

package/dist/identity/device-auth/handlers/device-code-cleanup.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code-cleanup.handler.d.ts","sourceRoot":"","sources":["../../../../src/identity/device-auth/handlers/device-code-cleanup.handler.ts"],"names":[],"mappings":"AAqBA,OAAO,EAA8B,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1E,OAAO,EAAiB,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,IAAI,GAAG,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3H,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,qBACa,wBAAyB,YAAW,kBAAkB,EAAE,YAAY;IAQtD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAR7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IAEpE,QAAQ,CAAC,IAAI,8BAA4B;IAEzC,QAAQ,CAAC,KAAK,yBAAyB;gBAGG,IAAI,EAAE,gBAAgB,EAC7C,UAAU,EAAE,iBAAiB;IAGhD,2DAA2D;IAC3D,YAAY,IAAI,IAAI;IAIpB;;;;;;OAMG;IACG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CAKvC"}

package/dist/identity/device-auth/handlers/device-code-cleanup.handler.js

@@ -0,0 +1,80 @@
+"use strict";
+// =============================================================================
+// `device-auth.code.cleanup` — expired device codes, as a queue job
+// (issue #353, epic #345)
+// =============================================================================
+//
+// The work is unchanged: `DeviceAuthService.cleanupExpiredCodes` deletes
+// `device_codes` past their expiry, plus `expired` rows more than a day old.
+// WHAT CHANGED IS THE EXECUTOR — until #353 the delete ran inline in a 2am
+// `@Cron` that caught its own errors and logged them, which meant a failed
+// cleanup was invisible in the admin job list, got no retry, and left rows an
+// operator could only find by grepping.
+//
+// SERVER-ONLY BY DERIVATION: neither `nodeResultSchema` nor `persistNodeResult`
+// (see `job-handler.interface.ts`), which is also the only correct answer for a
+// job that is one `deleteMany` against this application's own database.
+//
+// NO PROFILE: one indexed delete is ordinary queue work, and it is idempotent,
+// so the deployment-wide timeout and attempt budget are right for it. See
+// `auth/handlers/token-cleanup.handler.ts` for the same argument at length.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var DeviceCodeCleanupHandler_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceCodeCleanupHandler = exports.DEVICE_CODE_CLEANUP_TYPE = void 0;
+const common_1 = require("@nestjs/common");
+const ports_1 = require("../../ports");
+const device_auth_service_1 = require("../device-auth.service");
+/**
+ * The handler key, and therefore the `Job.type` every device-code-cleanup row
+ * carries. PERMANENT — rows outlive handlers. Exported so the scheduling task
+ * asks about the same string it queues.
+ *
+ * @stability stable
+ */
+exports.DEVICE_CODE_CLEANUP_TYPE = 'device-auth.code.cleanup';
+let DeviceCodeCleanupHandler = DeviceCodeCleanupHandler_1 = class DeviceCodeCleanupHandler {
+    jobs;
+    deviceAuth;
+    logger = new common_1.Logger(DeviceCodeCleanupHandler_1.name);
+    type = exports.DEVICE_CODE_CLEANUP_TYPE;
+    label = 'Device code cleanup';
+    constructor(jobs, deviceAuth) {
+        this.jobs = jobs;
+        this.deviceAuth = deviceAuth;
+    }
+    /** Self-registration — the only wiring a handler needs. */
+    onModuleInit() {
+        this.jobs.registerHandler(this);
+    }
+    /**
+     * Deletes expired device codes.
+     *
+     * THROWS TO FAIL. The old cron caught and logged; a handler must not, because
+     * swallowing here would report a cleanup that did not happen as a `succeeded`
+     * job — which is strictly worse than the log line it replaced.
+     */
+    async process(job) {
+        const count = await this.deviceAuth.cleanupExpiredCodes();
+        this.logger.log(`Device code cleanup job ${job.id} removed ${count} record(s)`);
+    }
+};
+exports.DeviceCodeCleanupHandler = DeviceCodeCleanupHandler;
+exports.DeviceCodeCleanupHandler = DeviceCodeCleanupHandler = DeviceCodeCleanupHandler_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(ports_1.IDENTITY_JOBS)),
+    __metadata("design:paramtypes", [Object, device_auth_service_1.DeviceAuthService])
+], DeviceCodeCleanupHandler);
+//# sourceMappingURL=device-code-cleanup.handler.js.map

package/dist/identity/device-auth/handlers/device-code-cleanup.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code-cleanup.handler.js","sourceRoot":"","sources":["../../../../src/identity/device-auth/handlers/device-code-cleanup.handler.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oEAAoE;AACpE,0BAA0B;AAC1B,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,wCAAwC;AACxC,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,wEAAwE;AACxE,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,gFAAgF;;;;;;;;;;;;;;;;AAEhF,2CAA0E;AAE1E,uCAA2H;AAC3H,gEAA2D;AAE3D;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG,0BAA0B,CAAC;AAG5D,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAQO;IACvB;IARF,MAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAE3D,IAAI,GAAG,gCAAwB,CAAC;IAEhC,KAAK,GAAG,qBAAqB,CAAC;IAEvC,YAC0C,IAAsB,EAC7C,UAA6B;QADN,SAAI,GAAJ,IAAI,CAAkB;QAC7C,eAAU,GAAV,UAAU,CAAmB;IAC7C,CAAC;IAEJ,2DAA2D;IAC3D,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,GAAQ;QACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;QAE1D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,EAAE,YAAY,KAAK,YAAY,CAAC,CAAC;IAClF,CAAC;CACF,CAAA;AA7BY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,eAAM,EAAC,qBAAa,CAAC,CAAA;6CACO,uCAAiB;GATrC,wBAAwB,CA6BpC"}

package/dist/identity/device-auth/tasks/device-code-cleanup.task.d.ts

@@ -0,0 +1,8 @@
+import { type IdentityJobsPort } from '../../ports';
+export declare class DeviceCodeCleanupTask {
+    private readonly jobs;
+    private readonly logger;
+    constructor(jobs: IdentityJobsPort);
+    handleCleanup(): Promise<void>;
+}
+//# sourceMappingURL=device-code-cleanup.task.d.ts.map

package/dist/identity/device-auth/tasks/device-code-cleanup.task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code-cleanup.task.d.ts","sourceRoot":"","sources":["../../../../src/identity/device-auth/tasks/device-code-cleanup.task.ts"],"names":[],"mappings":"AAeA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGnE,qBACa,qBAAqB;IAIP,OAAO,CAAC,QAAQ,CAAC,IAAI;IAH9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAGvB,IAAI,EAAE,gBAAgB;IAI1D,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;CAOrC"}