@nauth-toolkit/core 0.1.13 → 0.1.17

package/dist/dto/logout.dto.d.ts

@@ -1,5 +1,50 @@
+/**
+ * Logout DTO
+ *
+ * Request DTO for logging out a user from the current authenticated session.
+ *
+ * Security:
+ * - Session ID is automatically extracted from JWT token context (via ClientInfoService)
+ * - User sub validated (UUID) - optional, for additional verification
+ * - Prevents unauthorized logout attempts
+ *
+ * @example
+ * ```typescript
+ * await authService.logout({
+ *   forgetMe: false
+ * });
+ * ```
+ */
+/**
+ * Request DTO for logout
+ */
 export declare class LogoutDTO {
+    /**
+     * User's unique identifier (UUID v4) - Optional
+     *
+     * If provided, validates that the authenticated user matches this sub.
+     * Session ID is automatically extracted from JWT token context.
+     *
+     * Validation:
+     * - Must be a valid UUID v4 format if provided
+     * - Matches DB constraint: char(36) or uuid
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Lowercased for consistency
+     *
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
+     */
     sub?: string;
+    /**
+     * If true, also removes trusted device
+     *
+     * Validation:
+     * - Must be a boolean if present
+     * - Default: false
+     *
+     * @example false
+     */
     forgetMe?: boolean;
 }
 //# sourceMappingURL=logout.dto.d.ts.map

package/dist/dto/logout.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.dto.d.ts","sourceRoot":"","sources":["../../src/dto/logout.dto.ts"],"names":[],"mappings":"AAwBA,qBAAa,SAAS;IAyBpB,GAAG,CAAC,EAAE,MAAM,CAAC;IAab,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB"}
+{"version":3,"file":"logout.dto.d.ts","sourceRoot":"","sources":["../../src/dto/logout.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH;;GAEG;AACH,qBAAa,SAAS;IACpB;;;;;;;;;;;;;;;OAeG;IASH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;;;;;OAQG;IAGH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB"}

package/dist/dto/logout.dto.js

@@ -1,4 +1,21 @@
 "use strict";
+/**
+ * Logout DTO
+ *
+ * Request DTO for logging out a user from the current authenticated session.
+ *
+ * Security:
+ * - Session ID is automatically extracted from JWT token context (via ClientInfoService)
+ * - User sub validated (UUID) - optional, for additional verification
+ * - Prevents unauthorized logout attempts
+ *
+ * @example
+ * ```typescript
+ * await authService.logout({
+ *   forgetMe: false
+ * });
+ * ```
+ */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -12,8 +29,36 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LogoutDTO = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
+/**
+ * Request DTO for logout
+ */
 class LogoutDTO {
+    /**
+     * User's unique identifier (UUID v4) - Optional
+     *
+     * If provided, validates that the authenticated user matches this sub.
+     * Session ID is automatically extracted from JWT token context.
+     *
+     * Validation:
+     * - Must be a valid UUID v4 format if provided
+     * - Matches DB constraint: char(36) or uuid
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Lowercased for consistency
+     *
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
+     */
     sub;
+    /**
+     * If true, also removes trusted device
+     *
+     * Validation:
+     * - Must be a boolean if present
+     * - Default: false
+     *
+     * @example false
+     */
     forgetMe;
 }
 exports.LogoutDTO = LogoutDTO;

package/dist/dto/logout.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.dto.js","sourceRoot":"","sources":["../../src/dto/logout.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAkBA,qDAAgE;AAChE,yDAA8C;AAK9C,MAAa,SAAS;IAyBpB,GAAG,CAAU;IAab,QAAQ,CAAW;CACpB;AAvCD,8BAuCC;AAdC;IARC,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;sCACW;AAab;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;;2CAClC"}
+{"version":3,"file":"logout.dto.js","sourceRoot":"","sources":["../../src/dto/logout.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;AAEH,qDAAgE;AAChE,yDAA8C;AAE9C;;GAEG;AACH,MAAa,SAAS;IACpB;;;;;;;;;;;;;;;OAeG;IASH,GAAG,CAAU;IAEb;;;;;;;;OAQG;IAGH,QAAQ,CAAW;CACpB;AAvCD,8BAuCC;AAdC;IARC,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;sCACW;AAab;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;;2CAClC"}

package/dist/dto/refresh-token.dto.d.ts

@@ -1,4 +1,32 @@
+/**
+ * Refresh Token DTO
+ *
+ * Used for refreshing access tokens with a valid refresh token.
+ *
+ * Security:
+ * - Token length validated (prevents DoS)
+ * - JWT tokens can be long, but we validate input length
+ * - Token is validated in service layer for format and signature
+ *
+ * @example
+ * ```typescript
+ * POST /auth/refresh
+ * {
+ *   "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
+ * }
+ * ```
+ */
 export declare class RefreshTokenDTO {
+    /**
+     * JWT refresh token
+     *
+     * Validation:
+     * - Must be a string
+     * - Min 10 characters (minimum valid JWT length)
+     * - Max 2048 characters (prevents DoS, typical JWT is 200-500 chars)
+     *
+     * Note: Token format and signature validated in service layer
+     */
     refreshToken: string;
 }
 //# sourceMappingURL=refresh-token.dto.d.ts.map

package/dist/dto/refresh-token.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.dto.d.ts","sourceRoot":"","sources":["../../src/dto/refresh-token.dto.ts"],"names":[],"mappings":"AAoBA,qBAAa,eAAe;IAc1B,YAAY,EAAG,MAAM,CAAC;CACvB"}
+{"version":3,"file":"refresh-token.dto.d.ts","sourceRoot":"","sources":["../../src/dto/refresh-token.dto.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,eAAe;IAC1B;;;;;;;;;OASG;IAIH,YAAY,EAAG,MAAM,CAAC;CACvB"}

package/dist/dto/refresh-token.dto.js

@@ -11,7 +11,35 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RefreshTokenDTO = void 0;
 const class_validator_1 = require("class-validator");
+/**
+ * Refresh Token DTO
+ *
+ * Used for refreshing access tokens with a valid refresh token.
+ *
+ * Security:
+ * - Token length validated (prevents DoS)
+ * - JWT tokens can be long, but we validate input length
+ * - Token is validated in service layer for format and signature
+ *
+ * @example
+ * ```typescript
+ * POST /auth/refresh
+ * {
+ *   "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
+ * }
+ * ```
+ */
 class RefreshTokenDTO {
+    /**
+     * JWT refresh token
+     *
+     * Validation:
+     * - Must be a string
+     * - Min 10 characters (minimum valid JWT length)
+     * - Max 2048 characters (prevents DoS, typical JWT is 200-500 chars)
+     *
+     * Note: Token format and signature validated in service layer
+     */
     refreshToken;
 }
 exports.RefreshTokenDTO = RefreshTokenDTO;

package/dist/dto/refresh-token.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.dto.js","sourceRoot":"","sources":["../../src/dto/refresh-token.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAiE;AAoBjE,MAAa,eAAe;IAc1B,YAAY,CAAU;CACvB;AAfD,0CAeC;AADC;IAHC,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACvD,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACvD,IAAA,2BAAS,EAAC,IAAI,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;;qDACxD"}
+{"version":3,"file":"refresh-token.dto.js","sourceRoot":"","sources":["../../src/dto/refresh-token.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAiE;AAEjE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,eAAe;IAC1B;;;;;;;;;OASG;IAIH,YAAY,CAAU;CACvB;AAfD,0CAeC;AADC;IAHC,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACvD,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACvD,IAAA,2BAAS,EAAC,IAAI,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;;qDACxD"}

package/dist/dto/remove-devices.dto.d.ts

@@ -1,9 +1,60 @@
+/**
+ * DTO for removing MFA devices
+ *
+ * Used to remove all MFA devices of a specific method type for a user.
+ * Automatically disables MFA if this was the last device.
+ *
+ * @example
+ * ```typescript
+ * const result = await mfaService.removeDevices({
+ *   userSub: 'user-uuid',
+ *   methodType: 'totp'
+ * });
+ * ```
+ */
+/**
+ * DTO for removing MFA devices
+ */
 export declare class RemoveDevicesDTO {
+    /**
+     * User's unique identifier (UUID v4)
+     *
+     * Validation:
+     * - Must be a valid UUID v4 format
+     * - Matches DB constraint: char(36) or uuid
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Lowercased for consistency
+     *
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
+     */
     userSub: string;
+    /**
+     * MFA method type to remove
+     *
+     * Validation:
+     * - Must be one of: totp, sms, email, passkey
+     * - Max 50 characters
+     *
+     * Sanitization:
+     * - Trimmed and lowercased
+     *
+     * @example "totp"
+     */
     methodType: string;
 }
+/**
+ * Response DTO for removing devices
+ */
 export declare class RemoveDevicesResponseDTO {
+    /**
+     * Number of devices deleted
+     */
     deletedCount: number;
+    /**
+     * Whether MFA was disabled (if this was the last device)
+     */
     mfaDisabled: boolean;
 }
 //# sourceMappingURL=remove-devices.dto.d.ts.map

package/dist/dto/remove-devices.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remove-devices.dto.d.ts","sourceRoot":"","sources":["../../src/dto/remove-devices.dto.ts"],"names":[],"mappings":"AAsBA,qBAAa,gBAAgB;IAqB3B,OAAO,EAAG,MAAM,CAAC;IAyBjB,UAAU,EAAG,MAAM,CAAC;CACrB;AAKD,qBAAa,wBAAwB;IAInC,YAAY,EAAG,MAAM,CAAC;IAKtB,WAAW,EAAG,OAAO,CAAC;CACvB"}
+{"version":3,"file":"remove-devices.dto.d.ts","sourceRoot":"","sources":["../../src/dto/remove-devices.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;GAEG;AACH,qBAAa,gBAAgB;IAC3B;;;;;;;;;;;;OAYG;IAQH,OAAO,EAAG,MAAM,CAAC;IAEjB;;;;;;;;;;;OAWG;IAYH,UAAU,EAAG,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,qBAAa,wBAAwB;IACnC;;OAEG;IACH,YAAY,EAAG,MAAM,CAAC;IAEtB;;OAEG;IACH,WAAW,EAAG,OAAO,CAAC;CACvB"}

package/dist/dto/remove-devices.dto.js

@@ -1,4 +1,18 @@
 "use strict";
+/**
+ * DTO for removing MFA devices
+ *
+ * Used to remove all MFA devices of a specific method type for a user.
+ * Automatically disables MFA if this was the last device.
+ *
+ * @example
+ * ```typescript
+ * const result = await mfaService.removeDevices({
+ *   userSub: 'user-uuid',
+ *   methodType: 'totp'
+ * });
+ * ```
+ */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -13,8 +27,36 @@ exports.RemoveDevicesResponseDTO = exports.RemoveDevicesDTO = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
 const mfa_method_enum_1 = require("../enums/mfa-method.enum");
+/**
+ * DTO for removing MFA devices
+ */
 class RemoveDevicesDTO {
+    /**
+     * User's unique identifier (UUID v4)
+     *
+     * Validation:
+     * - Must be a valid UUID v4 format
+     * - Matches DB constraint: char(36) or uuid
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Lowercased for consistency
+     *
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
+     */
     userSub;
+    /**
+     * MFA method type to remove
+     *
+     * Validation:
+     * - Must be one of: totp, sms, email, passkey
+     * - Max 50 characters
+     *
+     * Sanitization:
+     * - Trimmed and lowercased
+     *
+     * @example "totp"
+     */
     methodType;
 }
 exports.RemoveDevicesDTO = RemoveDevicesDTO;
@@ -42,8 +84,17 @@ __decorate([
     }),
     __metadata("design:type", String)
 ], RemoveDevicesDTO.prototype, "methodType", void 0);
+/**
+ * Response DTO for removing devices
+ */
 class RemoveDevicesResponseDTO {
+    /**
+     * Number of devices deleted
+     */
     deletedCount;
+    /**
+     * Whether MFA was disabled (if this was the last device)
+     */
     mfaDisabled;
 }
 exports.RemoveDevicesResponseDTO = RemoveDevicesResponseDTO;

package/dist/dto/remove-devices.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"remove-devices.dto.js","sourceRoot":"","sources":["../../src/dto/remove-devices.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAeA,qDAAsE;AACtE,yDAA8C;AAC9C,8DAAqD;AAKrD,MAAa,gBAAgB;IAqB3B,OAAO,CAAU;IAyBjB,UAAU,CAAU;CACrB;AA/CD,4CA+CC;AA1BC;IAPC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;iDACe;AAyBjB;IAXC,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACrD,IAAA,wBAAM,EAAC,CAAC,2BAAS,CAAC,IAAI,EAAE,2BAAS,CAAC,GAAG,EAAE,2BAAS,CAAC,KAAK,EAAE,2BAAS,CAAC,OAAO,CAAC,EAAE;QAC3E,OAAO,EAAE,uDAAuD;KACjE,CAAC;IACD,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACvE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;oDACkB;AAMtB,MAAa,wBAAwB;IAInC,YAAY,CAAU;IAKtB,WAAW,CAAW;CACvB;AAVD,4DAUC"}
+{"version":3,"file":"remove-devices.dto.js","sourceRoot":"","sources":["../../src/dto/remove-devices.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;AAEH,qDAAsE;AACtE,yDAA8C;AAC9C,8DAAqD;AAErD;;GAEG;AACH,MAAa,gBAAgB;IAC3B;;;;;;;;;;;;OAYG;IAQH,OAAO,CAAU;IAEjB;;;;;;;;;;;OAWG;IAYH,UAAU,CAAU;CACrB;AA/CD,4CA+CC;AA1BC;IAPC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;iDACe;AAyBjB;IAXC,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACrD,IAAA,wBAAM,EAAC,CAAC,2BAAS,CAAC,IAAI,EAAE,2BAAS,CAAC,GAAG,EAAE,2BAAS,CAAC,KAAK,EAAE,2BAAS,CAAC,OAAO,CAAC,EAAE;QAC3E,OAAO,EAAE,uDAAuD;KACjE,CAAC;IACD,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACvE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;oDACkB;AAGtB;;GAEG;AACH,MAAa,wBAAwB;IACnC;;OAEG;IACH,YAAY,CAAU;IAEtB;;OAEG;IACH,WAAW,CAAW;CACvB;AAVD,4DAUC"}

package/dist/dto/resend-code-response.dto.d.ts

@@ -1,4 +1,32 @@
+/**
+ * Resend Code Response DTO
+ *
+ * Response DTO for resending verification codes.
+ * No validators needed - this is generated internally by the library.
+ *
+ * Security:
+ * - Email/phone masked for privacy
+ * - Only shows destination, not full details
+ *
+ * @example
+ * ```typescript
+ * const result = await authService.resendCode({ session: 'session-uuid' });
+ * // Returns: { destination: 'u***r@example.com' }
+ * ```
+ */
+/**
+ * Response DTO for resend code
+ */
 export declare class ResendCodeResponseDTO {
+    /**
+     * Masked destination where code was sent
+     *
+     * Format:
+     * - Email: "u***r@example.com"
+     * - Phone: "+1***5678"
+     *
+     * @example "u***r@example.com"
+     */
     destination: string;
 }
 //# sourceMappingURL=resend-code-response.dto.d.ts.map

package/dist/dto/resend-code-response.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resend-code-response.dto.d.ts","sourceRoot":"","sources":["../../src/dto/resend-code-response.dto.ts"],"names":[],"mappings":"AAoBA,qBAAa,qBAAqB;IAUhC,WAAW,EAAG,MAAM,CAAC;CACtB"}
+{"version":3,"file":"resend-code-response.dto.d.ts","sourceRoot":"","sources":["../../src/dto/resend-code-response.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;GAEG;AACH,qBAAa,qBAAqB;IAChC;;;;;;;;OAQG;IACH,WAAW,EAAG,MAAM,CAAC;CACtB"}

package/dist/dto/resend-code-response.dto.js

@@ -1,7 +1,35 @@
 "use strict";
+/**
+ * Resend Code Response DTO
+ *
+ * Response DTO for resending verification codes.
+ * No validators needed - this is generated internally by the library.
+ *
+ * Security:
+ * - Email/phone masked for privacy
+ * - Only shows destination, not full details
+ *
+ * @example
+ * ```typescript
+ * const result = await authService.resendCode({ session: 'session-uuid' });
+ * // Returns: { destination: 'u***r@example.com' }
+ * ```
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ResendCodeResponseDTO = void 0;
+/**
+ * Response DTO for resend code
+ */
 class ResendCodeResponseDTO {
+    /**
+     * Masked destination where code was sent
+     *
+     * Format:
+     * - Email: "u***r@example.com"
+     * - Phone: "+1***5678"
+     *
+     * @example "u***r@example.com"
+     */
     destination;
 }
 exports.ResendCodeResponseDTO = ResendCodeResponseDTO;

package/dist/dto/resend-code-response.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"resend-code-response.dto.js","sourceRoot":"","sources":["../../src/dto/resend-code-response.dto.ts"],"names":[],"mappings":";;;AAoBA,MAAa,qBAAqB;IAUhC,WAAW,CAAU;CACtB;AAXD,sDAWC"}
+{"version":3,"file":"resend-code-response.dto.js","sourceRoot":"","sources":["../../src/dto/resend-code-response.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH;;GAEG;AACH,MAAa,qBAAqB;IAChC;;;;;;;;OAQG;IACH,WAAW,CAAU;CACtB;AAXD,sDAWC"}

package/dist/dto/resend-code.dto.d.ts

@@ -1,4 +1,41 @@
+/**
+ * DTO for resending verification code
+ *
+ * Used to resend email/SMS verification codes during challenges:
+ * - Email verification (VERIFY_EMAIL)
+ * - Phone verification (VERIFY_PHONE)
+ * - MFA verification (MFA_REQUIRED with SMS/Email method)
+ *
+ * Security:
+ * - Session token length limited (prevents DoS)
+ * - Rate limiting enforced in service layer
+ *
+ * @example
+ * ```typescript
+ * const result = await authService.resendCode({
+ *   session: 'challenge-session-token'
+ * });
+ * // Returns: { destination: 'u***r@example.com' }
+ * ```
+ */
+/**
+ * DTO for resending verification code
+ */
 export declare class ResendCodeDTO {
+    /**
+     * Challenge session token (UUID v4)
+     *
+     * Validation:
+     * - Must be a valid UUID v4 format
+     * - Generated using randomUUID() in challenge service
+     * - Matches DB constraint: varchar(255) but UUID format enforced
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Lowercased for consistency
+     *
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
+     */
     session: string;
 }
 //# sourceMappingURL=resend-code.dto.d.ts.map

package/dist/dto/resend-code.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resend-code.dto.d.ts","sourceRoot":"","sources":["../../src/dto/resend-code.dto.ts"],"names":[],"mappings":"AA2BA,qBAAa,aAAa;IAsBxB,OAAO,EAAG,MAAM,CAAC;CAClB"}
+{"version":3,"file":"resend-code.dto.d.ts","sourceRoot":"","sources":["../../src/dto/resend-code.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH;;GAEG;AACH,qBAAa,aAAa;IACxB;;;;;;;;;;;;;OAaG;IAQH,OAAO,EAAG,MAAM,CAAC;CAClB"}

package/dist/dto/resend-code.dto.js

@@ -1,4 +1,24 @@
 "use strict";
+/**
+ * DTO for resending verification code
+ *
+ * Used to resend email/SMS verification codes during challenges:
+ * - Email verification (VERIFY_EMAIL)
+ * - Phone verification (VERIFY_PHONE)
+ * - MFA verification (MFA_REQUIRED with SMS/Email method)
+ *
+ * Security:
+ * - Session token length limited (prevents DoS)
+ * - Rate limiting enforced in service layer
+ *
+ * @example
+ * ```typescript
+ * const result = await authService.resendCode({
+ *   session: 'challenge-session-token'
+ * });
+ * // Returns: { destination: 'u***r@example.com' }
+ * ```
+ */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -12,7 +32,24 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ResendCodeDTO = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
+/**
+ * DTO for resending verification code
+ */
 class ResendCodeDTO {
+    /**
+     * Challenge session token (UUID v4)
+     *
+     * Validation:
+     * - Must be a valid UUID v4 format
+     * - Generated using randomUUID() in challenge service
+     * - Matches DB constraint: varchar(255) but UUID format enforced
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Lowercased for consistency
+     *
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
+     */
     session;
 }
 exports.ResendCodeDTO = ResendCodeDTO;

package/dist/dto/resend-code.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"resend-code.dto.js","sourceRoot":"","sources":["../../src/dto/resend-code.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAqBA,qDAAyC;AACzC,yDAA8C;AAK9C,MAAa,aAAa;IAsBxB,OAAO,CAAU;CAClB;AAvBD,sCAuBC;AADC;IAPC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IACxE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;8CACe"}
+{"version":3,"file":"resend-code.dto.js","sourceRoot":"","sources":["../../src/dto/resend-code.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;;;;;;;AAEH,qDAAyC;AACzC,yDAA8C;AAE9C;;GAEG;AACH,MAAa,aAAa;IACxB;;;;;;;;;;;;;OAaG;IAQH,OAAO,CAAU;CAClB;AAvBD,sCAuBC;AADC;IAPC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IACxE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;8CACe"}

package/dist/dto/reset-password.dto.d.ts

@@ -1,8 +1,82 @@
+/**
+ * Reset Password Request DTO
+ *
+ * Used to request a password reset token via email or phone.
+ *
+ * Security:
+ * - Identifier validated (email or phone)
+ * - Input sanitization applied
+ *
+ * @example
+ * ```typescript
+ * POST /auth/reset-password/request
+ * {
+ *   "identifier": "user@example.com"
+ * }
+ * ```
+ */
 export declare class ResetPasswordRequestDTO {
+    /**
+     * User identifier (email or phone)
+     *
+     * Validation:
+     * - Must be a string
+     * - Min 1 character
+     * - Max 255 characters (matches DB constraint for email)
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Lowercased if email format detected
+     */
     identifier: string;
 }
+/**
+ * Reset Password DTO
+ *
+ * Used to reset password with a valid reset token.
+ *
+ * Security:
+ * - Token length validated (matches DB constraint: varchar(255))
+ * - Password strength enforced (8-128 chars)
+ * - Token format validated in service layer
+ *
+ * @example
+ * ```typescript
+ * POST /auth/reset-password
+ * {
+ *   "token": "reset-token-from-email",
+ *   "newPassword": "NewSecurePassword123!"
+ * }
+ * ```
+ */
 export declare class ResetPasswordDTO {
+    /**
+     * Password reset token from email
+     *
+     * Validation:
+     * - Must be a string
+     * - Min 1 character (prevents empty strings)
+     * - Max 255 characters (matches DB constraint: varchar(255))
+     *
+     * Sanitization:
+     * - Trimmed
+     *
+     * Note: Token format and validity validated in service layer
+     */
     token: string;
+    /**
+     * New password
+     *
+     * Validation:
+     * - Must be a string
+     * - Min 8 characters (security requirement)
+     * - Max 128 characters (prevents DoS via bcrypt)
+     *
+     * Note: NOT trimmed (passwords can have leading/trailing spaces)
+     * Additional checks in service layer:
+     * - Password strength (if configured)
+     * - Password history (prevent reuse)
+     */
     newPassword: string;
 }
 //# sourceMappingURL=reset-password.dto.d.ts.map

package/dist/dto/reset-password.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset-password.dto.d.ts","sourceRoot":"","sources":["../../src/dto/reset-password.dto.ts"],"names":[],"mappings":"AAoBA,qBAAa,uBAAuB;IA4BlC,UAAU,EAAG,MAAM,CAAC;CACrB;AAqBD,qBAAa,gBAAgB;IAwB3B,KAAK,EAAG,MAAM,CAAC;IAmBf,WAAW,EAAG,MAAM,CAAC;CACtB"}
+{"version":3,"file":"reset-password.dto.d.ts","sourceRoot":"","sources":["../../src/dto/reset-password.dto.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAuB;IAClC;;;;;;;;;;;OAWG;IAgBH,UAAU,EAAG,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAgB;IAC3B;;;;;;;;;;;;OAYG;IAWH,KAAK,EAAG,MAAM,CAAC;IAEf;;;;;;;;;;;;OAYG;IAKH,WAAW,EAAG,MAAM,CAAC;CACtB"}