@open-mercato/enterprise 0.6.8-develop.7031.1.005201cd70 → 0.6.8-develop.7037.1.ea0277b01e

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:enterprise] found 328 entry points
+[build:enterprise] found 334 entry points
 [build:enterprise] built successfully

package/dist/modules/security/data/entities.js

@@ -212,6 +212,21 @@ __decorateClass([
 __decorateClass([
   Property({ name: "tenant_id", type: "uuid" })
 ], SudoSession.prototype, "tenantId", 2);
+__decorateClass([
+  Property({ name: "scope_tenant_id", type: "uuid", nullable: true })
+], SudoSession.prototype, "scopeTenantId", 2);
+__decorateClass([
+  Property({ name: "scope_organization_id", type: "uuid", nullable: true })
+], SudoSession.prototype, "scopeOrganizationId", 2);
+__decorateClass([
+  Property({ name: "target_identifier", type: "text", nullable: true })
+], SudoSession.prototype, "targetIdentifier", 2);
+__decorateClass([
+  Property({ name: "sudo_config_id", type: "uuid", nullable: true })
+], SudoSession.prototype, "sudoConfigId", 2);
+__decorateClass([
+  Property({ name: "sudo_config_updated_at", type: Date, nullable: true })
+], SudoSession.prototype, "sudoConfigUpdatedAt", 2);
 __decorateClass([
   Property({ name: "session_token", type: "text" })
 ], SudoSession.prototype, "sessionToken", 2);
@@ -221,6 +236,9 @@ __decorateClass([
 __decorateClass([
   Property({ name: "expires_at", type: Date })
 ], SudoSession.prototype, "expiresAt", 2);
+__decorateClass([
+  Property({ name: "verified_at", type: Date, nullable: true })
+], SudoSession.prototype, "verifiedAt", 2);
 __decorateClass([
   Property({ name: "created_at", type: Date, onCreate: () => /* @__PURE__ */ new Date() })
 ], SudoSession.prototype, "createdAt", 2);

package/dist/modules/security/data/entities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/security/data/entities.ts"],
-  "sourcesContent": ["import { Entity, Index, PrimaryKey, Property } from '@mikro-orm/decorators/legacy'\nimport {\n  ChallengeMethod,\n  EnforcementScope,\n  MfaMethodType,\n  SudoChallengeMethodUsed,\n} from './constants'\n\nexport {\n  ChallengeMethod,\n  EnforcementScope,\n  MfaMethodType,\n  SudoChallengeMethodUsed,\n} from './constants'\n\n@Entity({ tableName: 'user_mfa_methods' })\n@Index({ name: 'idx_user_mfa_methods_user_type', properties: ['userId', 'type', 'isActive'] })\n@Index({ name: 'idx_user_mfa_methods_tenant', properties: ['tenantId'] })\nexport class UserMfaMethod {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'user_id', type: 'uuid' })\n  userId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ type: 'text' })\n  type!: string\n\n  @Property({ type: 'text', nullable: true })\n  label?: string | null\n\n  @Property({ type: 'text', nullable: true })\n  secret?: string | null\n\n  @Property({ name: 'provider_metadata', type: 'jsonb', nullable: true })\n  providerMetadata?: Record<string, unknown> | null\n\n  @Property({ name: 'is_active', type: 'boolean', default: true })\n  isActive: boolean = true\n\n  @Property({ name: 'last_used_at', type: Date, nullable: true })\n  lastUsedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'mfa_recovery_codes' })\n@Index({ name: 'idx_mfa_recovery_codes_user', properties: ['userId', 'isUsed'] })\nexport class MfaRecoveryCode {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'user_id', type: 'uuid' })\n  userId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'code_hash', type: 'text' })\n  codeHash!: string\n\n  @Property({ name: 'is_used', type: 'boolean', default: false })\n  isUsed: boolean = false\n\n  @Property({ name: 'used_at', type: Date, nullable: true })\n  usedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'mfa_enforcement_policies' })\n@Index({ name: 'idx_mfa_enforcement_scope', properties: ['scope', 'tenantId'] })\nexport class MfaEnforcementPolicy {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  scope!: EnforcementScope\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'is_enforced', type: 'boolean', default: true })\n  isEnforced: boolean = true\n\n  @Property({ name: 'allowed_methods', type: 'jsonb', nullable: true })\n  allowedMethods?: string[] | null\n\n  @Property({ name: 'enforcement_deadline', type: Date, nullable: true })\n  enforcementDeadline?: Date | null\n\n  @Property({ name: 'enforced_by', type: 'uuid' })\n  enforcedBy!: string\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'sudo_challenge_configs' })\n@Index({ name: 'idx_sudo_configs_target', properties: ['targetIdentifier'] })\nexport class SudoChallengeConfig {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'label', type: 'text', nullable: true })\n  label: string | null = null\n\n  @Property({ name: 'target_identifier', type: 'text' })\n  targetIdentifier!: string\n\n  @Property({ name: 'is_enabled', type: 'boolean', default: true })\n  isEnabled: boolean = true\n\n  @Property({ name: 'is_developer_default', type: 'boolean', default: false })\n  isDeveloperDefault: boolean = false\n\n  @Property({ name: 'ttl_seconds', type: 'integer', default: 300 })\n  ttlSeconds: number = 300\n\n  @Property({ name: 'challenge_method', type: 'text', default: 'auto' })\n  challengeMethod: ChallengeMethod = ChallengeMethod.AUTO\n\n  @Property({ name: 'configured_by', type: 'uuid', nullable: true })\n  configuredBy?: string | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'sudo_sessions' })\n@Index({ name: 'idx_sudo_sessions_token', properties: ['sessionToken', 'expiresAt'] })\nexport class SudoSession {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'user_id', type: 'uuid' })\n  userId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'session_token', type: 'text' })\n  sessionToken!: string\n\n  @Property({ name: 'challenge_method', type: 'text' })\n  challengeMethod!: string\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'mfa_challenges' })\n@Index({ name: 'idx_mfa_challenges_lookup', properties: ['id', 'expiresAt'] })\nexport class MfaChallenge {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'user_id', type: 'uuid' })\n  userId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'otp_code_hash', type: 'text', nullable: true })\n  otpCodeHash?: string | null\n\n  @Property({ name: 'method_type', type: 'text', nullable: true })\n  methodType?: string | null\n\n  @Property({ name: 'method_id', type: 'uuid', nullable: true })\n  methodId?: string | null\n\n  @Property({ name: 'provider_challenge', type: 'jsonb', nullable: true })\n  providerChallenge?: Record<string, unknown> | null\n\n  @Property({ type: 'integer', default: 0 })\n  attempts: number = 0\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'verified_at', type: Date, nullable: true })\n  verifiedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n"],
-  "mappings": ";;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,YAAY,gBAAgB;AACpD;AAAA,EACE;AAAA,OAIK;AAEP;AAAA,EACE,mBAAAA;AAAA,EACA,oBAAAC;AAAA,EACA,iBAAAC;AAAA,EACA,2BAAAC;AAAA,OACK;AAKA,IAAM,gBAAN,MAAoB;AAAA,EAApB;AA0BL,oBAAoB;AAMpB,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AArCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,cAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAJhC,cAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,cAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVxD,cAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAbf,cAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhB/B,cAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnB/B,cAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAtB3D,cAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,KAAK,CAAC;AAAA,GAzBpD,cA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA5BnD,cA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA/B7D,cAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAlCzF,cAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GArCjD,cAsCX;AAtCW,gBAAN;AAAA,EAHN,OAAO,EAAE,WAAW,mBAAmB,CAAC;AAAA,EACxC,MAAM,EAAE,MAAM,kCAAkC,YAAY,CAAC,UAAU,QAAQ,UAAU,EAAE,CAAC;AAAA,EAC5F,MAAM,EAAE,MAAM,+BAA+B,YAAY,CAAC,UAAU,EAAE,CAAC;AAAA,GAC3D;AA2CN,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AAcL,kBAAkB;AAMlB,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,gBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAJhC,gBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,gBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAVlC,gBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAbnD,gBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhB9C,gBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAnB7D,gBAoBX;AApBW,kBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,qBAAqB,CAAC;AAAA,EAC1C,MAAM,EAAE,MAAM,+BAA+B,YAAY,CAAC,UAAU,QAAQ,EAAE,CAAC;AAAA,GACnE;AAyBN,IAAM,uBAAN,MAA2B;AAAA,EAA3B;AAcL,sBAAsB;AAYtB,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AA/BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,qBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAJf,qBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPlD,qBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVxD,qBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,WAAW,SAAS,KAAK,CAAC;AAAA,GAbtD,qBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAhBzD,qBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,wBAAwB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnB3D,qBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GAtBpC,qBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAzB7D,qBA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA5BzF,qBA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA/BjD,qBAgCX;AAhCW,uBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,2BAA2B,CAAC;AAAA,EAChD,MAAM,EAAE,MAAM,6BAA6B,YAAY,CAAC,SAAS,UAAU,EAAE,CAAC;AAAA,GAClE;AAqCN,IAAM,sBAAN,MAA0B;AAAA,EAA1B;AAWL,iBAAuB;AAMvB,qBAAqB;AAGrB,8BAA8B;AAG9B,sBAAqB;AAGrB,2BAAmC,gBAAgB;AAMnD,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AArCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,oBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAJlD,oBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPxD,oBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,SAAS,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAV9C,oBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,OAAO,CAAC;AAAA,GAb1C,oBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,WAAW,SAAS,KAAK,CAAC;AAAA,GAhBrD,oBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,wBAAwB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAnBhE,oBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,WAAW,SAAS,IAAI,CAAC;AAAA,GAtBrD,oBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,oBAAoB,MAAM,QAAQ,SAAS,OAAO,CAAC;AAAA,GAzB1D,oBA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5BtD,oBA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA/B7D,oBAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAlCzF,oBAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GArCjD,oBAsCX;AAtCW,sBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,yBAAyB,CAAC;AAAA,EAC9C,MAAM,EAAE,MAAM,2BAA2B,YAAY,CAAC,kBAAkB,EAAE,CAAC;AAAA,GAC/D;AA2CN,IAAM,cAAN,MAAkB;AAAA,EAAlB;AAoBL,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,YAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAJhC,YAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,YAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,CAAC;AAAA,GAVtC,YAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,oBAAoB,MAAM,OAAO,CAAC;AAAA,GAbzC,YAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAhBjC,YAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAnB7D,YAoBX;AApBW,cAAN;AAAA,EAFN,OAAO,EAAE,WAAW,gBAAgB,CAAC;AAAA,EACrC,MAAM,EAAE,MAAM,2BAA2B,YAAY,CAAC,gBAAgB,WAAW,EAAE,CAAC;AAAA,GACxE;AAyBN,IAAM,eAAN,MAAmB;AAAA,EAAnB;AAuBL,oBAAmB;AASnB,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA/BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,aAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAJhC,aAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,aAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVtD,aAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbpD,aAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBlD,aAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAnB5D,aAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,SAAS,EAAE,CAAC;AAAA,GAtB9B,aAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAzBjC,aA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA5BlD,aA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA/B7D,aAgCX;AAhCW,eAAN;AAAA,EAFN,OAAO,EAAE,WAAW,iBAAiB,CAAC;AAAA,EACtC,MAAM,EAAE,MAAM,6BAA6B,YAAY,CAAC,MAAM,WAAW,EAAE,CAAC;AAAA,GAChE;",
+  "sourcesContent": ["import { Entity, Index, PrimaryKey, Property } from '@mikro-orm/decorators/legacy'\nimport {\n  ChallengeMethod,\n  EnforcementScope,\n  MfaMethodType,\n  SudoChallengeMethodUsed,\n} from './constants'\n\nexport {\n  ChallengeMethod,\n  EnforcementScope,\n  MfaMethodType,\n  SudoChallengeMethodUsed,\n} from './constants'\n\n@Entity({ tableName: 'user_mfa_methods' })\n@Index({ name: 'idx_user_mfa_methods_user_type', properties: ['userId', 'type', 'isActive'] })\n@Index({ name: 'idx_user_mfa_methods_tenant', properties: ['tenantId'] })\nexport class UserMfaMethod {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'user_id', type: 'uuid' })\n  userId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ type: 'text' })\n  type!: string\n\n  @Property({ type: 'text', nullable: true })\n  label?: string | null\n\n  @Property({ type: 'text', nullable: true })\n  secret?: string | null\n\n  @Property({ name: 'provider_metadata', type: 'jsonb', nullable: true })\n  providerMetadata?: Record<string, unknown> | null\n\n  @Property({ name: 'is_active', type: 'boolean', default: true })\n  isActive: boolean = true\n\n  @Property({ name: 'last_used_at', type: Date, nullable: true })\n  lastUsedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'mfa_recovery_codes' })\n@Index({ name: 'idx_mfa_recovery_codes_user', properties: ['userId', 'isUsed'] })\nexport class MfaRecoveryCode {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'user_id', type: 'uuid' })\n  userId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'code_hash', type: 'text' })\n  codeHash!: string\n\n  @Property({ name: 'is_used', type: 'boolean', default: false })\n  isUsed: boolean = false\n\n  @Property({ name: 'used_at', type: Date, nullable: true })\n  usedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'mfa_enforcement_policies' })\n@Index({ name: 'idx_mfa_enforcement_scope', properties: ['scope', 'tenantId'] })\nexport class MfaEnforcementPolicy {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  scope!: EnforcementScope\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'is_enforced', type: 'boolean', default: true })\n  isEnforced: boolean = true\n\n  @Property({ name: 'allowed_methods', type: 'jsonb', nullable: true })\n  allowedMethods?: string[] | null\n\n  @Property({ name: 'enforcement_deadline', type: Date, nullable: true })\n  enforcementDeadline?: Date | null\n\n  @Property({ name: 'enforced_by', type: 'uuid' })\n  enforcedBy!: string\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'sudo_challenge_configs' })\n@Index({ name: 'idx_sudo_configs_target', properties: ['targetIdentifier'] })\nexport class SudoChallengeConfig {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'label', type: 'text', nullable: true })\n  label: string | null = null\n\n  @Property({ name: 'target_identifier', type: 'text' })\n  targetIdentifier!: string\n\n  @Property({ name: 'is_enabled', type: 'boolean', default: true })\n  isEnabled: boolean = true\n\n  @Property({ name: 'is_developer_default', type: 'boolean', default: false })\n  isDeveloperDefault: boolean = false\n\n  @Property({ name: 'ttl_seconds', type: 'integer', default: 300 })\n  ttlSeconds: number = 300\n\n  @Property({ name: 'challenge_method', type: 'text', default: 'auto' })\n  challengeMethod: ChallengeMethod = ChallengeMethod.AUTO\n\n  @Property({ name: 'configured_by', type: 'uuid', nullable: true })\n  configuredBy?: string | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'sudo_sessions' })\n@Index({ name: 'idx_sudo_sessions_token', properties: ['sessionToken', 'expiresAt'] })\nexport class SudoSession {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'user_id', type: 'uuid' })\n  userId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'scope_tenant_id', type: 'uuid', nullable: true })\n  scopeTenantId?: string | null\n\n  @Property({ name: 'scope_organization_id', type: 'uuid', nullable: true })\n  scopeOrganizationId?: string | null\n\n  @Property({ name: 'target_identifier', type: 'text', nullable: true })\n  targetIdentifier?: string | null\n\n  @Property({ name: 'sudo_config_id', type: 'uuid', nullable: true })\n  sudoConfigId?: string | null\n\n  @Property({ name: 'sudo_config_updated_at', type: Date, nullable: true })\n  sudoConfigUpdatedAt?: Date | null\n\n  @Property({ name: 'session_token', type: 'text' })\n  sessionToken!: string\n\n  @Property({ name: 'challenge_method', type: 'text' })\n  challengeMethod!: string\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'verified_at', type: Date, nullable: true })\n  verifiedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'mfa_challenges' })\n@Index({ name: 'idx_mfa_challenges_lookup', properties: ['id', 'expiresAt'] })\nexport class MfaChallenge {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'user_id', type: 'uuid' })\n  userId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'otp_code_hash', type: 'text', nullable: true })\n  otpCodeHash?: string | null\n\n  @Property({ name: 'method_type', type: 'text', nullable: true })\n  methodType?: string | null\n\n  @Property({ name: 'method_id', type: 'uuid', nullable: true })\n  methodId?: string | null\n\n  @Property({ name: 'provider_challenge', type: 'jsonb', nullable: true })\n  providerChallenge?: Record<string, unknown> | null\n\n  @Property({ type: 'integer', default: 0 })\n  attempts: number = 0\n\n  @Property({ name: 'expires_at', type: Date })\n  expiresAt!: Date\n\n  @Property({ name: 'verified_at', type: Date, nullable: true })\n  verifiedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n"],
+  "mappings": ";;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,YAAY,gBAAgB;AACpD;AAAA,EACE;AAAA,OAIK;AAEP;AAAA,EACE,mBAAAA;AAAA,EACA,oBAAAC;AAAA,EACA,iBAAAC;AAAA,EACA,2BAAAC;AAAA,OACK;AAKA,IAAM,gBAAN,MAAoB;AAAA,EAApB;AA0BL,oBAAoB;AAMpB,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AArCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,cAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAJhC,cAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,cAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVxD,cAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAbf,cAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhB/B,cAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnB/B,cAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAtB3D,cAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,KAAK,CAAC;AAAA,GAzBpD,cA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA5BnD,cA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA/B7D,cAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAlCzF,cAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GArCjD,cAsCX;AAtCW,gBAAN;AAAA,EAHN,OAAO,EAAE,WAAW,mBAAmB,CAAC;AAAA,EACxC,MAAM,EAAE,MAAM,kCAAkC,YAAY,CAAC,UAAU,QAAQ,UAAU,EAAE,CAAC;AAAA,EAC5F,MAAM,EAAE,MAAM,+BAA+B,YAAY,CAAC,UAAU,EAAE,CAAC;AAAA,GAC3D;AA2CN,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AAcL,kBAAkB;AAMlB,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAnBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,gBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAJhC,gBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,gBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAVlC,gBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAbnD,gBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhB9C,gBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAnB7D,gBAoBX;AApBW,kBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,qBAAqB,CAAC;AAAA,EAC1C,MAAM,EAAE,MAAM,+BAA+B,YAAY,CAAC,UAAU,QAAQ,EAAE,CAAC;AAAA,GACnE;AAyBN,IAAM,uBAAN,MAA2B;AAAA,EAA3B;AAcL,sBAAsB;AAYtB,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AA/BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,qBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAJf,qBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPlD,qBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVxD,qBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,WAAW,SAAS,KAAK,CAAC;AAAA,GAbtD,qBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAhBzD,qBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,wBAAwB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnB3D,qBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GAtBpC,qBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAzB7D,qBA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA5BzF,qBA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA/BjD,qBAgCX;AAhCW,uBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,2BAA2B,CAAC;AAAA,EAChD,MAAM,EAAE,MAAM,6BAA6B,YAAY,CAAC,SAAS,UAAU,EAAE,CAAC;AAAA,GAClE;AAqCN,IAAM,sBAAN,MAA0B;AAAA,EAA1B;AAWL,iBAAuB;AAMvB,qBAAqB;AAGrB,8BAA8B;AAG9B,sBAAqB;AAGrB,2BAAmC,gBAAgB;AAMnD,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AArCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,oBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAJlD,oBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAPxD,oBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,SAAS,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAV9C,oBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,OAAO,CAAC;AAAA,GAb1C,oBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,WAAW,SAAS,KAAK,CAAC;AAAA,GAhBrD,oBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,wBAAwB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAnBhE,oBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,WAAW,SAAS,IAAI,CAAC;AAAA,GAtBrD,oBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,oBAAoB,MAAM,QAAQ,SAAS,OAAO,CAAC;AAAA,GAzB1D,oBA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5BtD,oBA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA/B7D,oBAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,GAAG,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAlCzF,oBAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GArCjD,oBAsCX;AAtCW,sBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,yBAAyB,CAAC;AAAA,EAC9C,MAAM,EAAE,MAAM,2BAA2B,YAAY,CAAC,kBAAkB,EAAE,CAAC;AAAA,GAC/D;AA2CN,IAAM,cAAN,MAAkB;AAAA,EAAlB;AAsCL,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AArCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,YAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAJhC,YAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,YAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVxD,YAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,yBAAyB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAb9D,YAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhB1D,YAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnBvD,YAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,0BAA0B,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtB7D,YAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,CAAC;AAAA,GAzBtC,YA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,oBAAoB,MAAM,OAAO,CAAC;AAAA,GA5BzC,YA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GA/BjC,YAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAlClD,YAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GArC7D,YAsCX;AAtCW,cAAN;AAAA,EAFN,OAAO,EAAE,WAAW,gBAAgB,CAAC;AAAA,EACrC,MAAM,EAAE,MAAM,2BAA2B,YAAY,CAAC,gBAAgB,WAAW,EAAE,CAAC;AAAA,GACxE;AA2CN,IAAM,eAAN,MAAmB;AAAA,EAAnB;AAuBL,oBAAmB;AASnB,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA/BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,aAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAJhC,aAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,aAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAVtD,aAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbpD,aAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBlD,aAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAnB5D,aAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,SAAS,EAAE,CAAC;AAAA,GAtB9B,aAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC;AAAA,GAzBjC,aA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA5BlD,aA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA/B7D,aAgCX;AAhCW,eAAN;AAAA,EAFN,OAAO,EAAE,WAAW,iBAAiB,CAAC;AAAA,EACtC,MAAM,EAAE,MAAM,6BAA6B,YAAY,CAAC,MAAM,WAAW,EAAE,CAAC;AAAA,GAChE;",
   "names": ["ChallengeMethod", "EnforcementScope", "MfaMethodType", "SudoChallengeMethodUsed"]
 }

package/dist/modules/security/migrations/Migration20260811143757_security.js

@@ -0,0 +1,13 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260811143757_security extends Migration {
+  up() {
+    this.addSql(`alter table "sudo_sessions" add "scope_tenant_id" uuid null, add "scope_organization_id" uuid null, add "target_identifier" text null, add "sudo_config_id" uuid null, add "sudo_config_updated_at" timestamptz null, add "verified_at" timestamptz null;`);
+  }
+  down() {
+    this.addSql(`alter table "sudo_sessions" drop column "scope_tenant_id", drop column "scope_organization_id", drop column "target_identifier", drop column "sudo_config_id", drop column "sudo_config_updated_at", drop column "verified_at";`);
+  }
+}
+export {
+  Migration20260811143757_security
+};
+//# sourceMappingURL=Migration20260811143757_security.js.map

package/dist/modules/security/migrations/Migration20260811143757_security.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/security/migrations/Migration20260811143757_security.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260811143757_security extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(`alter table \"sudo_sessions\" add \"scope_tenant_id\" uuid null, add \"scope_organization_id\" uuid null, add \"target_identifier\" text null, add \"sudo_config_id\" uuid null, add \"sudo_config_updated_at\" timestamptz null, add \"verified_at\" timestamptz null;`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`alter table \"sudo_sessions\" drop column \"scope_tenant_id\", drop column \"scope_organization_id\", drop column \"target_identifier\", drop column \"sudo_config_id\", drop column \"sudo_config_updated_at\", drop column \"verified_at\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,yCAAyC,UAAU;AAAA,EAErD,KAA2B;AAClC,SAAK,OAAO,2PAA2P;AAAA,EACzQ;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,iOAAiO;AAAA,EAC/O;AAEF;",
+  "names": []
+}

package/dist/modules/security/services/SudoChallengeService.js

@@ -74,29 +74,23 @@ class SudoChallengeService {
   }
   async isProtected(targetIdentifier, tenantId, organizationId) {
     await this.ensureDeveloperDefaultsRegistered();
-    const candidates = await this.em.find(SudoChallengeConfig, {
-      targetIdentifier,
-      deletedAt: null
-    });
-    const resolved = candidates.filter((config) => this.matchesScope(config, tenantId ?? null, organizationId ?? null)).sort((left, right) => this.compareConfigPriority(left, right, tenantId ?? null, organizationId ?? null))[0];
-    if (!resolved || !resolved.isEnabled) {
-      return { protected: false };
-    }
-    return { protected: true, config: resolved };
+    return this.resolveProtection(this.em, targetIdentifier, tenantId ?? null, organizationId ?? null);
   }
   async initiate(userId, targetIdentifier, options) {
+    const user = await this.findUserScope(userId);
+    if (!user?.tenantId) {
+      throw new SudoChallengeServiceError("User not found", 404);
+    }
+    const scopeTenantId = options?.tenantId !== void 0 ? options.tenantId : user.tenantId;
+    const scopeOrganizationId = options?.organizationId !== void 0 ? options.organizationId : user.organizationId;
     const protection = await this.isProtected(
       targetIdentifier,
-      options?.tenantId ?? null,
-      options?.organizationId ?? null
+      scopeTenantId,
+      scopeOrganizationId
     );
     if (!protection.protected || !protection.config) {
       return { required: false };
     }
-    const user = await this.findUserScope(userId);
-    if (!user?.tenantId) {
-      throw new SudoChallengeServiceError("User not found", 404);
-    }
     const userMethods = await this.mfaService.getUserMethods(userId);
     const method = this.resolveChallengeMethod(protection.config.challengeMethod, userMethods.length);
     let sessionToken = randomBytes(16).toString("hex");
@@ -110,9 +104,15 @@ class SudoChallengeService {
     const session = this.em.create(SudoSession, {
       userId,
       tenantId: user.tenantId,
+      scopeTenantId,
+      scopeOrganizationId,
+      targetIdentifier,
+      sudoConfigId: protection.config.id,
+      sudoConfigUpdatedAt: protection.config.updatedAt,
       sessionToken,
       challengeMethod: method,
       expiresAt,
+      verifiedAt: null,
       createdAt: /* @__PURE__ */ new Date()
     });
     this.em.persist(session);
@@ -156,16 +156,27 @@ class SudoChallengeService {
     if (!user?.tenantId) {
       throw new SudoChallengeServiceError("User not found", 404);
     }
-    const scopeTenantId = options.tenantId !== void 0 ? options.tenantId : user.tenantId;
-    const scopeOrganizationId = options.organizationId !== void 0 ? options.organizationId : user.organizationId;
+    if (user.tenantId !== session.tenantId) {
+      throw new SudoChallengeServiceError("Unable to verify sudo challenge", 403);
+    }
+    const requestedTenantId = options.tenantId !== void 0 ? options.tenantId : user.tenantId;
+    const requestedOrganizationId = options.organizationId !== void 0 ? options.organizationId : user.organizationId;
+    if (options.targetIdentifier !== session.targetIdentifier || requestedTenantId !== session.scopeTenantId || requestedOrganizationId !== session.scopeOrganizationId) {
+      throw new SudoChallengeServiceError("Unable to verify sudo challenge", 403);
+    }
+    const scopeTenantId = session.scopeTenantId ?? null;
+    const scopeOrganizationId = session.scopeOrganizationId ?? null;
     const protection = await this.isProtected(
-      options.targetIdentifier,
+      session.targetIdentifier,
       scopeTenantId,
       scopeOrganizationId
     );
     if (!protection.protected || !protection.config) {
       throw new SudoChallengeServiceError("Sudo protection is not configured for this target", 404);
     }
+    if (protection.config.id !== session.sudoConfigId || protection.config.updatedAt.getTime() !== session.sudoConfigUpdatedAt?.getTime()) {
+      throw new SudoChallengeServiceError("Unable to verify sudo challenge", 403);
+    }
     let verified = false;
     let methodUsed = methodType;
     if (session.challengeMethod === "password") {
@@ -186,30 +197,65 @@ class SudoChallengeService {
         userId: session.userId,
         tenantId: user.tenantId,
         organizationId: user.organizationId,
-        targetIdentifier: options.targetIdentifier,
+        targetIdentifier: session.targetIdentifier,
         method: methodUsed
       });
       throw new SudoChallengeServiceError("Unable to verify sudo challenge", 401);
     }
-    const ttlSeconds = this.normalizeTtl(protection.config.ttlSeconds);
-    const expiresAt = new Date(Date.now() + ttlSeconds * 1e3);
-    const sudoToken = this.signToken({
-      sid: session.id,
-      sub: session.userId,
-      tid: scopeTenantId,
-      oid: scopeOrganizationId,
-      tgt: options.targetIdentifier,
-      exp: expiresAt.getTime()
+    const pendingToken = session.sessionToken;
+    const { sudoToken, expiresAt, verifiedAt } = await this.em.transactional(async (transactionalEm) => {
+      await transactionalEm.execute('lock table "sudo_challenge_configs" in share mode');
+      const currentProtection = await this.resolveProtection(
+        transactionalEm,
+        session.targetIdentifier,
+        scopeTenantId,
+        scopeOrganizationId
+      );
+      if (!currentProtection.protected || !currentProtection.config || currentProtection.config.id !== session.sudoConfigId || currentProtection.config.updatedAt.getTime() !== session.sudoConfigUpdatedAt.getTime()) {
+        throw new SudoChallengeServiceError("Unable to verify sudo challenge", 403);
+      }
+      const ttlSeconds = this.normalizeTtl(currentProtection.config.ttlSeconds);
+      const currentVerifiedAt = /* @__PURE__ */ new Date();
+      const currentExpiresAt = new Date(Date.now() + ttlSeconds * 1e3);
+      const currentSudoToken = this.signToken({
+        sid: session.id,
+        sub: session.userId,
+        tid: scopeTenantId,
+        oid: scopeOrganizationId,
+        tgt: session.targetIdentifier,
+        exp: currentExpiresAt.getTime()
+      });
+      const consumedRows = await transactionalEm.nativeUpdate(
+        SudoSession,
+        {
+          id: session.id,
+          sessionToken: pendingToken,
+          verifiedAt: null,
+          expiresAt: { $gt: currentVerifiedAt }
+        },
+        {
+          sessionToken: currentSudoToken,
+          expiresAt: currentExpiresAt,
+          verifiedAt: currentVerifiedAt
+        }
+      );
+      if (consumedRows !== 1) {
+        throw new SudoChallengeServiceError("Unable to verify sudo challenge", 400);
+      }
+      return {
+        sudoToken: currentSudoToken,
+        expiresAt: currentExpiresAt,
+        verifiedAt: currentVerifiedAt
+      };
     });
     session.sessionToken = sudoToken;
-    session.challengeMethod = methodUsed;
     session.expiresAt = expiresAt;
-    await this.em.flush();
+    session.verifiedAt = verifiedAt;
     await emitSecurityEvent("security.sudo.verified", {
       userId: session.userId,
       tenantId: scopeTenantId,
       organizationId: scopeOrganizationId,
-      targetIdentifier: options.targetIdentifier,
+      targetIdentifier: session.targetIdentifier,
       method: methodUsed,
       expiresAt: expiresAt.toISOString()
     });
@@ -227,7 +273,11 @@ class SudoChallengeService {
     const session = await this.em.findOne(SudoSession, {
       id: payload.sid,
       userId: payload.sub,
-      sessionToken: token
+      sessionToken: token,
+      targetIdentifier,
+      scopeTenantId: payload.tid,
+      scopeOrganizationId: payload.oid,
+      verifiedAt: { $ne: null }
     });
     return Boolean(session && session.expiresAt.getTime() > Date.now());
   }
@@ -322,12 +372,17 @@ class SudoChallengeService {
       isDeveloperDefault: true
     });
     if (existing) {
-      existing.isEnabled = true;
-      existing.deletedAt = null;
-      existing.ttlSeconds = this.normalizeTtl(input.ttlSeconds);
-      existing.challengeMethod = input.challengeMethod ?? ChallengeMethod.AUTO;
-      existing.updatedAt = /* @__PURE__ */ new Date();
-      await this.em.flush();
+      const ttlSeconds = this.normalizeTtl(input.ttlSeconds);
+      const challengeMethod = input.challengeMethod ?? ChallengeMethod.AUTO;
+      const changed = !existing.isEnabled || Boolean(existing.deletedAt) || existing.ttlSeconds !== ttlSeconds || existing.challengeMethod !== challengeMethod;
+      if (changed) {
+        existing.isEnabled = true;
+        existing.deletedAt = null;
+        existing.ttlSeconds = ttlSeconds;
+        existing.challengeMethod = challengeMethod;
+        existing.updatedAt = /* @__PURE__ */ new Date();
+        await this.em.flush();
+      }
       return;
     }
     const config = this.em.create(SudoChallengeConfig, {
@@ -418,6 +473,17 @@ class SudoChallengeService {
     }
     return availableMfaMethodCount > 0 ? "mfa" : "password";
   }
+  async resolveProtection(em, targetIdentifier, tenantId, organizationId) {
+    const candidates = await em.find(SudoChallengeConfig, {
+      targetIdentifier,
+      deletedAt: null
+    });
+    const resolved = candidates.filter((config) => this.matchesScope(config, tenantId, organizationId)).sort((left, right) => this.compareConfigPriority(left, right, tenantId, organizationId))[0];
+    if (!resolved || !resolved.isEnabled) {
+      return { protected: false };
+    }
+    return { protected: true, config: resolved };
+  }
   matchesScope(config, tenantId, organizationId) {
     if (config.organizationId) {
       return config.organizationId === organizationId && config.tenantId === tenantId;
@@ -448,6 +514,12 @@ class SudoChallengeService {
     if (!session) {
       throw new SudoChallengeServiceError("Sudo challenge session not found", 404);
     }
+    if (!session.targetIdentifier || !session.sudoConfigId || !session.sudoConfigUpdatedAt) {
+      throw new SudoChallengeServiceError("Sudo challenge session not found", 404);
+    }
+    if (session.verifiedAt) {
+      throw new SudoChallengeServiceError("Unable to verify sudo challenge", 400);
+    }
     if (session.expiresAt.getTime() <= Date.now()) {
       throw new SudoChallengeServiceError("Sudo challenge session expired", 400);
     }

package/dist/modules/security/services/SudoChallengeService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/security/services/SudoChallengeService.ts"],
-  "sourcesContent": ["import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  dedupeSudoTargets,\n  getSecuritySudoTargetEntries,\n  type SecuritySudoTarget,\n} from '../lib/module-security-registry'\nimport {\n  ChallengeMethod,\n  SudoChallengeConfig,\n  SudoChallengeMethodUsed,\n  SudoSession,\n} from '../data/entities'\nimport { emitSecurityEvent } from '../events'\nimport type {\n  SudoConfigInput,\n  SudoConfigUpdateInput,\n} from '../data/validators'\nimport type { PasswordService } from './PasswordService'\nimport type { MfaService } from './MfaService'\nimport type { MfaVerificationService } from './MfaVerificationService'\nimport { sudoTargets as defaultSudoTargets } from '../security.sudo'\nimport type { SecurityModuleConfig } from '../lib/security-config'\nimport { readSecurityModuleConfig } from '../lib/security-config'\n\ntype SudoMethod = 'password' | 'mfa'\n\nexport type SudoAvailableMethod = {\n  type: string\n  label: string\n  icon: string\n}\n\nexport type SudoProtectionResolution = {\n  protected: boolean\n  config?: SudoChallengeConfig\n}\n\nconst signedSudoTokenPayloadSchema = z.object({\n  sid: z.string(),\n  sub: z.string(),\n  tid: z.string().nullable(),\n  oid: z.string().nullable(),\n  tgt: z.string(),\n  exp: z.number(),\n})\n\ntype SignedSudoTokenPayload = z.infer<typeof signedSudoTokenPayloadSchema>\n\ntype UserScope = {\n  id: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nexport type SudoAuthScope = {\n  tenantId: string | null\n  organizationId?: string | null\n  isSuperAdmin?: boolean\n}\n\ntype DeveloperDefaultPayload = {\n  targetIdentifier: string\n  label?: string | null\n  ttlSeconds?: number\n  challengeMethod?: ChallengeMethod\n}\n\nfunction readTrimmedEnv(value: string | undefined): string | undefined {\n  const trimmed = value?.trim()\n  return trimmed ? trimmed : undefined\n}\n\nexport class SudoChallengeServiceError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode: number,\n  ) {\n    super(message)\n    this.name = 'SudoChallengeServiceError'\n  }\n}\n\nexport class SudoChallengeService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly passwordService: PasswordService,\n    private readonly mfaService: MfaService,\n    private readonly mfaVerificationService: MfaVerificationService,\n    private readonly securityConfig: SecurityModuleConfig = readSecurityModuleConfig(),\n  ) {}\n\n  async listConfigs(scope?: SudoAuthScope): Promise<SudoChallengeConfig[]> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const filter: FilterQuery<SudoChallengeConfig> = { deletedAt: null }\n    if (scope && !scope.isSuperAdmin) {\n      if (!scope.tenantId) return []\n      ;(filter as Record<string, unknown>).$or = [\n        { tenantId: scope.tenantId },\n        { tenantId: null },\n      ]\n    }\n    return this.em.find(\n      SudoChallengeConfig,\n      filter,\n      {\n        orderBy: {\n          targetIdentifier: 'asc',\n          tenantId: 'asc',\n          organizationId: 'asc',\n          createdAt: 'asc',\n        },\n      },\n    )\n  }\n\n  async getConfigById(id: string, scope?: SudoAuthScope): Promise<SudoChallengeConfig | null> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) return null\n    if (scope && !this.isConfigVisibleToScope(config, scope)) return null\n    return config\n  }\n\n  async isProtected(\n    targetIdentifier: string,\n    tenantId?: string | null,\n    organizationId?: string | null,\n  ): Promise<SudoProtectionResolution> {\n    await this.ensureDeveloperDefaultsRegistered()\n\n    const candidates = await this.em.find(SudoChallengeConfig, {\n      targetIdentifier,\n      deletedAt: null,\n    })\n\n    const resolved = candidates\n      .filter((config) => this.matchesScope(config, tenantId ?? null, organizationId ?? null))\n      .sort((left, right) => this.compareConfigPriority(left, right, tenantId ?? null, organizationId ?? null))[0]\n\n    if (!resolved || !resolved.isEnabled) {\n      return { protected: false }\n    }\n\n    return { protected: true, config: resolved }\n  }\n\n  async initiate(\n    userId: string,\n    targetIdentifier: string,\n    options?: { tenantId?: string | null; organizationId?: string | null },\n  ): Promise<{\n    required: boolean\n    sessionId?: string\n    method?: SudoMethod\n    availableMfaMethods?: SudoAvailableMethod[]\n    expiresAt?: Date\n  }> {\n    const protection = await this.isProtected(\n      targetIdentifier,\n      options?.tenantId ?? null,\n      options?.organizationId ?? null,\n    )\n\n    if (!protection.protected || !protection.config) {\n      return { required: false }\n    }\n\n    const user = await this.findUserScope(userId)\n    if (!user?.tenantId) {\n      throw new SudoChallengeServiceError('User not found', 404)\n    }\n\n    const userMethods = await this.mfaService.getUserMethods(userId)\n    const method = this.resolveChallengeMethod(protection.config.challengeMethod, userMethods.length)\n\n    let sessionToken = randomBytes(16).toString('hex')\n    let availableMfaMethods: SudoAvailableMethod[] | undefined\n    if (method === 'mfa') {\n      const challenge = await this.mfaVerificationService.createChallenge(userId)\n      sessionToken = challenge.challengeId\n      availableMfaMethods = challenge.availableMethods\n    }\n\n    const expiresAt = new Date(Date.now() + this.securityConfig.sudo.pendingChallengeTtlMs)\n    const session = this.em.create(SudoSession, {\n      userId,\n      tenantId: user.tenantId,\n      sessionToken,\n      challengeMethod: method,\n      expiresAt,\n      createdAt: new Date(),\n    })\n    this.em.persist(session)\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.challenged', {\n      userId,\n      tenantId: user.tenantId,\n      organizationId: user.organizationId,\n      targetIdentifier,\n      method,\n    })\n\n    return {\n      required: true,\n      sessionId: session.id,\n      method,\n      availableMfaMethods,\n      expiresAt,\n    }\n  }\n\n  async prepare(\n    sessionId: string,\n    methodType: string,\n    options: { expectedUserId?: string } = {},\n    request?: Request,\n  ): Promise<{ clientData?: Record<string, unknown> }> {\n    const session = await this.getPendingSession(sessionId)\n    if (options.expectedUserId && session.userId !== options.expectedUserId) {\n      throw new SudoChallengeServiceError('Sudo challenge user mismatch', 403)\n    }\n    if (session.challengeMethod !== 'mfa') {\n      throw new SudoChallengeServiceError('This sudo session does not require MFA', 400)\n    }\n    return this.mfaVerificationService.prepareChallenge(\n      session.sessionToken,\n      methodType,\n      { request },\n      { userId: session.userId },\n    )\n  }\n\n  async verify(\n    sessionId: string,\n    methodType: string,\n    payload: unknown,\n    options: {\n      expectedUserId?: string\n      tenantId?: string | null\n      organizationId?: string | null\n      targetIdentifier: string\n    },\n    request?: Request,\n  ): Promise<{ sudoToken: string; expiresAt: Date }> {\n    const session = await this.getPendingSession(sessionId)\n    if (options.expectedUserId && session.userId !== options.expectedUserId) {\n      throw new SudoChallengeServiceError('Sudo challenge user mismatch', 403)\n    }\n    const user = await this.findUserScope(session.userId)\n    if (!user?.tenantId) {\n      throw new SudoChallengeServiceError('User not found', 404)\n    }\n\n    const scopeTenantId = options.tenantId !== undefined ? options.tenantId : user.tenantId\n    const scopeOrganizationId = options.organizationId !== undefined ? options.organizationId : user.organizationId\n    const protection = await this.isProtected(\n      options.targetIdentifier,\n      scopeTenantId,\n      scopeOrganizationId,\n    )\n    if (!protection.protected || !protection.config) {\n      throw new SudoChallengeServiceError('Sudo protection is not configured for this target', 404)\n    }\n\n    let verified = false\n    let methodUsed: string = methodType\n    if (session.challengeMethod === 'password') {\n      const password = this.readPassword(payload)\n      verified = await this.passwordService.verifyPassword(session.userId, password)\n      methodUsed = SudoChallengeMethodUsed.PASSWORD\n    } else {\n      verified = await this.mfaVerificationService.verifyChallenge(\n        session.sessionToken,\n        methodType,\n        payload,\n        { request },\n        { userId: session.userId },\n      )\n    }\n\n    if (!verified) {\n      await emitSecurityEvent('security.sudo.failed', {\n        userId: session.userId,\n        tenantId: user.tenantId,\n        organizationId: user.organizationId,\n        targetIdentifier: options.targetIdentifier,\n        method: methodUsed,\n      })\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 401)\n    }\n\n    const ttlSeconds = this.normalizeTtl(protection.config.ttlSeconds)\n    const expiresAt = new Date(Date.now() + ttlSeconds * 1000)\n    const sudoToken = this.signToken({\n      sid: session.id,\n      sub: session.userId,\n      tid: scopeTenantId,\n      oid: scopeOrganizationId,\n      tgt: options.targetIdentifier,\n      exp: expiresAt.getTime(),\n    })\n\n    session.sessionToken = sudoToken\n    session.challengeMethod = methodUsed\n    session.expiresAt = expiresAt\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.verified', {\n      userId: session.userId,\n      tenantId: scopeTenantId,\n      organizationId: scopeOrganizationId,\n      targetIdentifier: options.targetIdentifier,\n      method: methodUsed,\n      expiresAt: expiresAt.toISOString(),\n    })\n\n    return { sudoToken, expiresAt }\n  }\n\n  async validateToken(\n    token: string,\n    targetIdentifier: string,\n    options?: {\n      expectedUserId?: string\n      tenantId?: string | null\n      organizationId?: string | null\n    },\n  ): Promise<boolean> {\n    if (!token) return false\n    const payload = this.readSignedToken(token)\n    if (!payload) return false\n    if (payload.exp <= Date.now()) return false\n    if (payload.tgt !== targetIdentifier) return false\n    if (options?.expectedUserId && payload.sub !== options.expectedUserId) return false\n    if (options?.tenantId !== undefined && payload.tid !== (options.tenantId ?? null)) return false\n    if (options?.organizationId !== undefined && payload.oid !== (options.organizationId ?? null)) return false\n\n    const session = await this.em.findOne(SudoSession, {\n      id: payload.sid,\n      userId: payload.sub,\n      sessionToken: token,\n    } as FilterQuery<SudoSession>)\n\n    return Boolean(session && session.expiresAt.getTime() > Date.now())\n  }\n\n  async createConfig(\n    input: SudoConfigInput,\n    configuredBy: string,\n    scope?: SudoAuthScope,\n  ): Promise<SudoChallengeConfig> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const inputTenantId = input.tenantId ?? null\n    const inputOrganizationId = input.organizationId ?? null\n    this.validateScope(inputTenantId, inputOrganizationId)\n    if (scope) this.assertWriteScope(inputTenantId, inputOrganizationId, scope)\n    await this.ensureUniqueConfig(input.targetIdentifier, inputTenantId, inputOrganizationId)\n\n    const config = this.em.create(SudoChallengeConfig, {\n      tenantId: inputTenantId,\n      organizationId: inputOrganizationId,\n      label: input.label ?? null,\n      targetIdentifier: input.targetIdentifier,\n      isEnabled: input.isEnabled,\n      ttlSeconds: this.normalizeTtl(input.ttlSeconds),\n      challengeMethod: input.challengeMethod,\n      configuredBy,\n      isDeveloperDefault: false,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    this.em.persist(config)\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.created', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n      configuredBy,\n    })\n\n    return config\n  }\n\n  async updateConfig(\n    id: string,\n    input: SudoConfigUpdateInput,\n    configuredBy: string,\n    scope?: SudoAuthScope,\n  ): Promise<SudoChallengeConfig> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (scope) {\n      this.assertWriteScope(config.tenantId ?? null, config.organizationId ?? null, scope)\n      if (config.isDeveloperDefault && !scope.isSuperAdmin) {\n        throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n      }\n    }\n\n    const nextTenantId = input.tenantId !== undefined ? input.tenantId ?? null : config.tenantId ?? null\n    const nextOrganizationId = input.organizationId !== undefined ? input.organizationId ?? null : config.organizationId ?? null\n    const nextTargetIdentifier = input.targetIdentifier ?? config.targetIdentifier\n    this.validateScope(nextTenantId, nextOrganizationId)\n    if (scope) this.assertWriteScope(nextTenantId, nextOrganizationId, scope)\n    await this.ensureUniqueConfig(nextTargetIdentifier, nextTenantId, nextOrganizationId, config.id)\n\n    if (input.tenantId !== undefined) config.tenantId = input.tenantId ?? null\n    if (input.organizationId !== undefined) config.organizationId = input.organizationId ?? null\n    if (input.label !== undefined) config.label = input.label ?? null\n    if (input.targetIdentifier !== undefined) config.targetIdentifier = input.targetIdentifier\n    if (input.isEnabled !== undefined) config.isEnabled = input.isEnabled\n    if (input.ttlSeconds !== undefined) config.ttlSeconds = this.normalizeTtl(input.ttlSeconds)\n    if (input.challengeMethod !== undefined) config.challengeMethod = input.challengeMethod\n    config.configuredBy = configuredBy\n    config.updatedAt = new Date()\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.updated', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n      configuredBy,\n    })\n\n    return config\n  }\n\n  async deleteConfig(id: string, scope?: SudoAuthScope): Promise<void> {\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (scope) {\n      this.assertWriteScope(config.tenantId ?? null, config.organizationId ?? null, scope)\n      if (config.isDeveloperDefault && !scope.isSuperAdmin) {\n        throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n      }\n    }\n    config.deletedAt = new Date()\n    config.updatedAt = new Date()\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.deleted', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n    })\n  }\n\n  async registerDeveloperDefault(\n    input: DeveloperDefaultPayload,\n  ): Promise<void> {\n    const existing = await this.em.findOne(SudoChallengeConfig, {\n      targetIdentifier: input.targetIdentifier,\n      tenantId: null,\n      organizationId: null,\n      isDeveloperDefault: true,\n    })\n\n    if (existing) {\n      existing.isEnabled = true\n      existing.deletedAt = null\n      existing.ttlSeconds = this.normalizeTtl(input.ttlSeconds)\n      existing.challengeMethod = input.challengeMethod ?? ChallengeMethod.AUTO\n      existing.updatedAt = new Date()\n      await this.em.flush()\n      return\n    }\n\n    const config = this.em.create(SudoChallengeConfig, {\n      tenantId: null,\n      organizationId: null,\n      label: input.label ?? null,\n      targetIdentifier: input.targetIdentifier,\n      isEnabled: true,\n      isDeveloperDefault: true,\n      ttlSeconds: this.normalizeTtl(input.ttlSeconds),\n      challengeMethod: input.challengeMethod ?? ChallengeMethod.AUTO,\n      configuredBy: null,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    this.em.persist(config)\n    await this.em.flush()\n  }\n\n  async cleanupExpired(): Promise<number> {\n    return this.em.nativeDelete(SudoSession, {\n      expiresAt: { $lte: new Date() },\n    })\n  }\n\n  private async ensureDeveloperDefaultsRegistered(): Promise<void> {\n    const registryEntries = getSecuritySudoTargetEntries()\n    const registryTargets = registryEntries.flatMap((entry) => entry.targets ?? [])\n    const fallbackTargets = registryEntries.length === 0 ? defaultSudoTargets : []\n\n    for (const target of dedupeSudoTargets([\n      ...registryTargets,\n      ...fallbackTargets,\n    ])) {\n      await this.registerDeveloperDefault(this.readDeveloperDefault(target))\n    }\n  }\n\n  private readDeveloperDefault(target: SecuritySudoTarget): DeveloperDefaultPayload {\n    return {\n      targetIdentifier: target.identifier,\n      label: target.label ?? null,\n      ttlSeconds: target.ttlSeconds,\n      challengeMethod: this.toChallengeMethod(target.challengeMethod),\n    }\n  }\n\n  private async ensureUniqueConfig(\n    targetIdentifier: string,\n    tenantId: string | null,\n    organizationId: string | null,\n    ignoreId?: string,\n  ): Promise<void> {\n    const existing = await this.em.findOne(SudoChallengeConfig, {\n      targetIdentifier,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (existing && existing.id !== ignoreId) {\n      throw new SudoChallengeServiceError('A sudo configuration for this target and scope already exists', 409)\n    }\n  }\n\n  private validateScope(tenantId: string | null, organizationId: string | null): void {\n    if (organizationId && !tenantId) {\n      throw new SudoChallengeServiceError('Organization-scoped sudo config requires a tenant', 400)\n    }\n  }\n\n  private isConfigVisibleToScope(config: SudoChallengeConfig, scope: SudoAuthScope): boolean {\n    if (scope.isSuperAdmin) return true\n    if (!scope.tenantId) return false\n    const configTenantId = config.tenantId ?? null\n    if (configTenantId === null) return true\n    return configTenantId === scope.tenantId\n  }\n\n  private assertWriteScope(\n    targetTenantId: string | null,\n    targetOrganizationId: string | null,\n    scope: SudoAuthScope,\n  ): void {\n    if (scope.isSuperAdmin) return\n    if (!scope.tenantId) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if ((targetTenantId ?? null) !== scope.tenantId) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (\n      scope.organizationId !== undefined\n      && scope.organizationId !== null\n      && targetOrganizationId !== null\n      && targetOrganizationId !== scope.organizationId\n    ) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n  }\n\n  private resolveChallengeMethod(\n    configuredMethod: ChallengeMethod,\n    availableMfaMethodCount: number,\n  ): SudoMethod {\n    if (this.securityConfig.mfa.emergencyBypass) {\n      return 'password'\n    }\n    if (configuredMethod === ChallengeMethod.PASSWORD) return 'password'\n    if (configuredMethod === ChallengeMethod.MFA) {\n      if (availableMfaMethodCount === 0) {\n        throw new SudoChallengeServiceError('This sudo target requires MFA, but no MFA methods are configured', 400)\n      }\n      return 'mfa'\n    }\n    return availableMfaMethodCount > 0 ? 'mfa' : 'password'\n  }\n\n  private matchesScope(config: SudoChallengeConfig, tenantId: string | null, organizationId: string | null): boolean {\n    if (config.organizationId) {\n      return config.organizationId === organizationId && config.tenantId === tenantId\n    }\n    if (config.tenantId) {\n      return config.tenantId === tenantId\n    }\n    return true\n  }\n\n  private compareConfigPriority(\n    left: SudoChallengeConfig,\n    right: SudoChallengeConfig,\n    tenantId: string | null,\n    organizationId: string | null,\n  ): number {\n    const leftScore = this.getScopePriority(left, tenantId, organizationId)\n    const rightScore = this.getScopePriority(right, tenantId, organizationId)\n    if (leftScore !== rightScore) return leftScore - rightScore\n    if (left.isDeveloperDefault !== right.isDeveloperDefault) {\n      return left.isDeveloperDefault ? 1 : -1\n    }\n    return right.updatedAt.getTime() - left.updatedAt.getTime()\n  }\n\n  private getScopePriority(\n    config: SudoChallengeConfig,\n    tenantId: string | null,\n    organizationId: string | null,\n  ): number {\n    if (config.organizationId === organizationId && config.tenantId === tenantId) return 0\n    if (!config.organizationId && config.tenantId === tenantId) return 1\n    if (!config.organizationId && !config.tenantId && !config.isDeveloperDefault) return 2\n    if (!config.organizationId && !config.tenantId && config.isDeveloperDefault) return 3\n    return 4\n  }\n\n  private async getPendingSession(sessionId: string): Promise<SudoSession> {\n    const session = await this.em.findOne(SudoSession, { id: sessionId })\n    if (!session) {\n      throw new SudoChallengeServiceError('Sudo challenge session not found', 404)\n    }\n    if (session.expiresAt.getTime() <= Date.now()) {\n      throw new SudoChallengeServiceError('Sudo challenge session expired', 400)\n    }\n    return session\n  }\n\n  private async findUserScope(userId: string): Promise<UserScope | null> {\n    const user = await findOneWithDecryption(\n      this.em,\n      User,\n      { id: userId, deletedAt: null },\n      undefined,\n      {},\n    )\n\n    if (!user) return null\n    return {\n      id: String(user.id),\n      tenantId: user.tenantId ? String(user.tenantId) : null,\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n    }\n  }\n\n  private normalizeTtl(value?: number | null): number {\n    const rawValue = value ?? this.securityConfig.sudo.defaultTtlSeconds\n    return Math.min(\n      Math.max(rawValue, this.securityConfig.sudo.minTtlSeconds),\n      this.securityConfig.sudo.maxTtlSeconds,\n    )\n  }\n\n  private readPassword(payload: unknown): string {\n    if (!payload || typeof payload !== 'object') {\n      throw new SudoChallengeServiceError('Password is required', 400)\n    }\n    const maybePassword = (payload as Record<string, unknown>).password\n    if (typeof maybePassword !== 'string' || maybePassword.trim().length === 0) {\n      throw new SudoChallengeServiceError('Password is required', 400)\n    }\n    return maybePassword\n  }\n\n  private signToken(payload: SignedSudoTokenPayload): string {\n    const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url')\n    const signature = createHmac('sha256', this.getSudoSecret()).update(encodedPayload).digest('base64url')\n    return `${encodedPayload}.${signature}`\n  }\n\n  private readSignedToken(token: string): SignedSudoTokenPayload | null {\n    const [encodedPayload, signature] = token.split('.')\n    if (!encodedPayload || !signature) return null\n\n    const expected = createHmac('sha256', this.getSudoSecret()).update(encodedPayload).digest('base64url')\n    const signatureBuffer = Buffer.from(signature)\n    const expectedBuffer = Buffer.from(expected)\n    if (signatureBuffer.length !== expectedBuffer.length) return null\n    if (!timingSafeEqual(signatureBuffer, expectedBuffer)) return null\n\n    try {\n      const parsed = signedSudoTokenPayloadSchema.safeParse(\n        JSON.parse(Buffer.from(encodedPayload, 'base64url').toString('utf8')),\n      )\n      if (!parsed.success) return null\n      return parsed.data\n    } catch {\n      return null\n    }\n  }\n\n  private getSudoSecret(): string {\n    const secret =\n      readTrimmedEnv(process.env.OM_SECURITY_SUDO_SECRET)\n      ?? readTrimmedEnv(process.env.AUTH_JWT_SECRET)\n      ?? readTrimmedEnv(process.env.AUTH_SECRET)\n      ?? readTrimmedEnv(process.env.JWT_SECRET)\n    if (secret) return secret\n    throw new Error(\n      'Sudo step-up tokens require OM_SECURITY_SUDO_SECRET, AUTH_JWT_SECRET, AUTH_SECRET, or JWT_SECRET to be set.',\n    )\n  }\n\n  private toChallengeMethod(\n    method: SecuritySudoTarget['challengeMethod'],\n  ): ChallengeMethod | undefined {\n    switch (method) {\n      case 'password':\n        return ChallengeMethod.PASSWORD\n      case 'mfa':\n        return ChallengeMethod.MFA\n      case 'auto':\n      default:\n        return ChallengeMethod.AUTO\n    }\n  }\n}\n\nexport default SudoChallengeService\n"],
-  "mappings": "AAAA,SAAS,YAAY,aAAa,uBAAuB;AACzD,SAAS,SAAS;AAElB,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAQlC,SAAS,eAAe,0BAA0B;AAElD,SAAS,gCAAgC;AAezC,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO;AAChB,CAAC;AAuBD,SAAS,eAAe,OAA+C;AACrE,QAAM,UAAU,OAAO,KAAK;AAC5B,SAAO,UAAU,UAAU;AAC7B;AAEO,MAAM,kCAAkC,MAAM;AAAA,EACnD,YACE,SACgB,YAChB;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qBAAqB;AAAA,EAChC,YACmB,IACA,iBACA,YACA,wBACA,iBAAuC,yBAAyB,GACjF;AALiB;AACA;AACA;AACA;AACA;AAAA,EAChB;AAAA,EAEH,MAAM,YAAY,OAAuD;AACvE,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAA2C,EAAE,WAAW,KAAK;AACnE,QAAI,SAAS,CAAC,MAAM,cAAc;AAChC,UAAI,CAAC,MAAM,SAAU,QAAO,CAAC;AAC5B,MAAC,OAAmC,MAAM;AAAA,QACzC,EAAE,UAAU,MAAM,SAAS;AAAA,QAC3B,EAAE,UAAU,KAAK;AAAA,MACnB;AAAA,IACF;AACA,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS;AAAA,UACP,kBAAkB;AAAA,UAClB,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,IAAY,OAA4D;AAC1F,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,SAAS,CAAC,KAAK,uBAAuB,QAAQ,KAAK,EAAG,QAAO;AACjE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YACJ,kBACA,UACA,gBACmC;AACnC,UAAM,KAAK,kCAAkC;AAE7C,UAAM,aAAa,MAAM,KAAK,GAAG,KAAK,qBAAqB;AAAA,MACzD;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,UAAM,WAAW,WACd,OAAO,CAAC,WAAW,KAAK,aAAa,QAAQ,YAAY,MAAM,kBAAkB,IAAI,CAAC,EACtF,KAAK,CAAC,MAAM,UAAU,KAAK,sBAAsB,MAAM,OAAO,YAAY,MAAM,kBAAkB,IAAI,CAAC,EAAE,CAAC;AAE7G,QAAI,CAAC,YAAY,CAAC,SAAS,WAAW;AACpC,aAAO,EAAE,WAAW,MAAM;AAAA,IAC5B;AAEA,WAAO,EAAE,WAAW,MAAM,QAAQ,SAAS;AAAA,EAC7C;AAAA,EAEA,MAAM,SACJ,QACA,kBACA,SAOC;AACD,UAAM,aAAa,MAAM,KAAK;AAAA,MAC5B;AAAA,MACA,SAAS,YAAY;AAAA,MACrB,SAAS,kBAAkB;AAAA,IAC7B;AAEA,QAAI,CAAC,WAAW,aAAa,CAAC,WAAW,QAAQ;AAC/C,aAAO,EAAE,UAAU,MAAM;AAAA,IAC3B;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc,MAAM;AAC5C,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,kBAAkB,GAAG;AAAA,IAC3D;AAEA,UAAM,cAAc,MAAM,KAAK,WAAW,eAAe,MAAM;AAC/D,UAAM,SAAS,KAAK,uBAAuB,WAAW,OAAO,iBAAiB,YAAY,MAAM;AAEhG,QAAI,eAAe,YAAY,EAAE,EAAE,SAAS,KAAK;AACjD,QAAI;AACJ,QAAI,WAAW,OAAO;AACpB,YAAM,YAAY,MAAM,KAAK,uBAAuB,gBAAgB,MAAM;AAC1E,qBAAe,UAAU;AACzB,4BAAsB,UAAU;AAAA,IAClC;AAEA,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,eAAe,KAAK,qBAAqB;AACtF,UAAM,UAAU,KAAK,GAAG,OAAO,aAAa;AAAA,MAC1C;AAAA,MACA,UAAU,KAAK;AAAA,MACf;AAAA,MACA,iBAAiB;AAAA,MACjB;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,OAAO;AACvB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,4BAA4B;AAAA,MAClD;AAAA,MACA,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO;AAAA,MACL,UAAU;AAAA,MACV,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,WACA,YACA,UAAuC,CAAC,GACxC,SACmD;AACnD,UAAM,UAAU,MAAM,KAAK,kBAAkB,SAAS;AACtD,QAAI,QAAQ,kBAAkB,QAAQ,WAAW,QAAQ,gBAAgB;AACvE,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,QAAQ,oBAAoB,OAAO;AACrC,YAAM,IAAI,0BAA0B,0CAA0C,GAAG;AAAA,IACnF;AACA,WAAO,KAAK,uBAAuB;AAAA,MACjC,QAAQ;AAAA,MACR;AAAA,MACA,EAAE,QAAQ;AAAA,MACV,EAAE,QAAQ,QAAQ,OAAO;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,MAAM,OACJ,WACA,YACA,SACA,SAMA,SACiD;AACjD,UAAM,UAAU,MAAM,KAAK,kBAAkB,SAAS;AACtD,QAAI,QAAQ,kBAAkB,QAAQ,WAAW,QAAQ,gBAAgB;AACvE,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,UAAM,OAAO,MAAM,KAAK,cAAc,QAAQ,MAAM;AACpD,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,kBAAkB,GAAG;AAAA,IAC3D;AAEA,UAAM,gBAAgB,QAAQ,aAAa,SAAY,QAAQ,WAAW,KAAK;AAC/E,UAAM,sBAAsB,QAAQ,mBAAmB,SAAY,QAAQ,iBAAiB,KAAK;AACjG,UAAM,aAAa,MAAM,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,WAAW,aAAa,CAAC,WAAW,QAAQ;AAC/C,YAAM,IAAI,0BAA0B,qDAAqD,GAAG;AAAA,IAC9F;AAEA,QAAI,WAAW;AACf,QAAI,aAAqB;AACzB,QAAI,QAAQ,oBAAoB,YAAY;AAC1C,YAAM,WAAW,KAAK,aAAa,OAAO;AAC1C,iBAAW,MAAM,KAAK,gBAAgB,eAAe,QAAQ,QAAQ,QAAQ;AAC7E,mBAAa,wBAAwB;AAAA,IACvC,OAAO;AACL,iBAAW,MAAM,KAAK,uBAAuB;AAAA,QAC3C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,QAAQ;AAAA,QACV,EAAE,QAAQ,QAAQ,OAAO;AAAA,MAC3B;AAAA,IACF;AAEA,QAAI,CAAC,UAAU;AACb,YAAM,kBAAkB,wBAAwB;AAAA,QAC9C,QAAQ,QAAQ;AAAA,QAChB,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK;AAAA,QACrB,kBAAkB,QAAQ;AAAA,QAC1B,QAAQ;AAAA,MACV,CAAC;AACD,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AAEA,UAAM,aAAa,KAAK,aAAa,WAAW,OAAO,UAAU;AACjE,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa,GAAI;AACzD,UAAM,YAAY,KAAK,UAAU;AAAA,MAC/B,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,MACb,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,MACb,KAAK,UAAU,QAAQ;AAAA,IACzB,CAAC;AAED,YAAQ,eAAe;AACvB,YAAQ,kBAAkB;AAC1B,YAAQ,YAAY;AACpB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,0BAA0B;AAAA,MAChD,QAAQ,QAAQ;AAAA,MAChB,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,kBAAkB,QAAQ;AAAA,MAC1B,QAAQ;AAAA,MACR,WAAW,UAAU,YAAY;AAAA,IACnC,CAAC;AAED,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC;AAAA,EAEA,MAAM,cACJ,OACA,kBACA,SAKkB;AAClB,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,UAAU,KAAK,gBAAgB,KAAK;AAC1C,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,OAAO,KAAK,IAAI,EAAG,QAAO;AACtC,QAAI,QAAQ,QAAQ,iBAAkB,QAAO;AAC7C,QAAI,SAAS,kBAAkB,QAAQ,QAAQ,QAAQ,eAAgB,QAAO;AAC9E,QAAI,SAAS,aAAa,UAAa,QAAQ,SAAS,QAAQ,YAAY,MAAO,QAAO;AAC1F,QAAI,SAAS,mBAAmB,UAAa,QAAQ,SAAS,QAAQ,kBAAkB,MAAO,QAAO;AAEtG,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,aAAa;AAAA,MACjD,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,cAAc;AAAA,IAChB,CAA6B;AAE7B,WAAO,QAAQ,WAAW,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,aACJ,OACA,cACA,OAC8B;AAC9B,UAAM,KAAK,kCAAkC;AAC7C,UAAM,gBAAgB,MAAM,YAAY;AACxC,UAAM,sBAAsB,MAAM,kBAAkB;AACpD,SAAK,cAAc,eAAe,mBAAmB;AACrD,QAAI,MAAO,MAAK,iBAAiB,eAAe,qBAAqB,KAAK;AAC1E,UAAM,KAAK,mBAAmB,MAAM,kBAAkB,eAAe,mBAAmB;AAExF,UAAM,SAAS,KAAK,GAAG,OAAO,qBAAqB;AAAA,MACjD,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,OAAO,MAAM,SAAS;AAAA,MACtB,kBAAkB,MAAM;AAAA,MACxB,WAAW,MAAM;AAAA,MACjB,YAAY,KAAK,aAAa,MAAM,UAAU;AAAA,MAC9C,iBAAiB,MAAM;AAAA,MACvB;AAAA,MACA,oBAAoB;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,MAAM;AACtB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,MACzB;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aACJ,IACA,OACA,cACA,OAC8B;AAC9B,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,OAAO;AACT,WAAK,iBAAiB,OAAO,YAAY,MAAM,OAAO,kBAAkB,MAAM,KAAK;AACnF,UAAI,OAAO,sBAAsB,CAAC,MAAM,cAAc;AACpD,cAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,MACzE;AAAA,IACF;AAEA,UAAM,eAAe,MAAM,aAAa,SAAY,MAAM,YAAY,OAAO,OAAO,YAAY;AAChG,UAAM,qBAAqB,MAAM,mBAAmB,SAAY,MAAM,kBAAkB,OAAO,OAAO,kBAAkB;AACxH,UAAM,uBAAuB,MAAM,oBAAoB,OAAO;AAC9D,SAAK,cAAc,cAAc,kBAAkB;AACnD,QAAI,MAAO,MAAK,iBAAiB,cAAc,oBAAoB,KAAK;AACxE,UAAM,KAAK,mBAAmB,sBAAsB,cAAc,oBAAoB,OAAO,EAAE;AAE/F,QAAI,MAAM,aAAa,OAAW,QAAO,WAAW,MAAM,YAAY;AACtE,QAAI,MAAM,mBAAmB,OAAW,QAAO,iBAAiB,MAAM,kBAAkB;AACxF,QAAI,MAAM,UAAU,OAAW,QAAO,QAAQ,MAAM,SAAS;AAC7D,QAAI,MAAM,qBAAqB,OAAW,QAAO,mBAAmB,MAAM;AAC1E,QAAI,MAAM,cAAc,OAAW,QAAO,YAAY,MAAM;AAC5D,QAAI,MAAM,eAAe,OAAW,QAAO,aAAa,KAAK,aAAa,MAAM,UAAU;AAC1F,QAAI,MAAM,oBAAoB,OAAW,QAAO,kBAAkB,MAAM;AACxE,WAAO,eAAe;AACtB,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,MACzB;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,IAAY,OAAsC;AACnE,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,OAAO;AACT,WAAK,iBAAiB,OAAO,YAAY,MAAM,OAAO,kBAAkB,MAAM,KAAK;AACnF,UAAI,OAAO,sBAAsB,CAAC,MAAM,cAAc;AACpD,cAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,MACzE;AAAA,IACF;AACA,WAAO,YAAY,oBAAI,KAAK;AAC5B,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,IAC3B,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,yBACJ,OACe;AACf,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MAC1D,kBAAkB,MAAM;AAAA,MACxB,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,oBAAoB;AAAA,IACtB,CAAC;AAED,QAAI,UAAU;AACZ,eAAS,YAAY;AACrB,eAAS,YAAY;AACrB,eAAS,aAAa,KAAK,aAAa,MAAM,UAAU;AACxD,eAAS,kBAAkB,MAAM,mBAAmB,gBAAgB;AACpE,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,KAAK,GAAG,MAAM;AACpB;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,GAAG,OAAO,qBAAqB;AAAA,MACjD,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,OAAO,MAAM,SAAS;AAAA,MACtB,kBAAkB,MAAM;AAAA,MACxB,WAAW;AAAA,MACX,oBAAoB;AAAA,MACpB,YAAY,KAAK,aAAa,MAAM,UAAU;AAAA,MAC9C,iBAAiB,MAAM,mBAAmB,gBAAgB;AAAA,MAC1D,cAAc;AAAA,MACd,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,MAAM;AACtB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,iBAAkC;AACtC,WAAO,KAAK,GAAG,aAAa,aAAa;AAAA,MACvC,WAAW,EAAE,MAAM,oBAAI,KAAK,EAAE;AAAA,IAChC,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,oCAAmD;AAC/D,UAAM,kBAAkB,6BAA6B;AACrD,UAAM,kBAAkB,gBAAgB,QAAQ,CAAC,UAAU,MAAM,WAAW,CAAC,CAAC;AAC9E,UAAM,kBAAkB,gBAAgB,WAAW,IAAI,qBAAqB,CAAC;AAE7E,eAAW,UAAU,kBAAkB;AAAA,MACrC,GAAG;AAAA,MACH,GAAG;AAAA,IACL,CAAC,GAAG;AACF,YAAM,KAAK,yBAAyB,KAAK,qBAAqB,MAAM,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEQ,qBAAqB,QAAqD;AAChF,WAAO;AAAA,MACL,kBAAkB,OAAO;AAAA,MACzB,OAAO,OAAO,SAAS;AAAA,MACvB,YAAY,OAAO;AAAA,MACnB,iBAAiB,KAAK,kBAAkB,OAAO,eAAe;AAAA,IAChE;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,kBACA,UACA,gBACA,UACe;AACf,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MAC1D;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,YAAY,SAAS,OAAO,UAAU;AACxC,YAAM,IAAI,0BAA0B,iEAAiE,GAAG;AAAA,IAC1G;AAAA,EACF;AAAA,EAEQ,cAAc,UAAyB,gBAAqC;AAClF,QAAI,kBAAkB,CAAC,UAAU;AAC/B,YAAM,IAAI,0BAA0B,qDAAqD,GAAG;AAAA,IAC9F;AAAA,EACF;AAAA,EAEQ,uBAAuB,QAA6B,OAA+B;AACzF,QAAI,MAAM,aAAc,QAAO;AAC/B,QAAI,CAAC,MAAM,SAAU,QAAO;AAC5B,UAAM,iBAAiB,OAAO,YAAY;AAC1C,QAAI,mBAAmB,KAAM,QAAO;AACpC,WAAO,mBAAmB,MAAM;AAAA,EAClC;AAAA,EAEQ,iBACN,gBACA,sBACA,OACM;AACN,QAAI,MAAM,aAAc;AACxB,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,SAAK,kBAAkB,UAAU,MAAM,UAAU;AAC/C,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QACE,MAAM,mBAAmB,UACtB,MAAM,mBAAmB,QACzB,yBAAyB,QACzB,yBAAyB,MAAM,gBAClC;AACA,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AAAA,EACF;AAAA,EAEQ,uBACN,kBACA,yBACY;AACZ,QAAI,KAAK,eAAe,IAAI,iBAAiB;AAC3C,aAAO;AAAA,IACT;AACA,QAAI,qBAAqB,gBAAgB,SAAU,QAAO;AAC1D,QAAI,qBAAqB,gBAAgB,KAAK;AAC5C,UAAI,4BAA4B,GAAG;AACjC,cAAM,IAAI,0BAA0B,oEAAoE,GAAG;AAAA,MAC7G;AACA,aAAO;AAAA,IACT;AACA,WAAO,0BAA0B,IAAI,QAAQ;AAAA,EAC/C;AAAA,EAEQ,aAAa,QAA6B,UAAyB,gBAAwC;AACjH,QAAI,OAAO,gBAAgB;AACzB,aAAO,OAAO,mBAAmB,kBAAkB,OAAO,aAAa;AAAA,IACzE;AACA,QAAI,OAAO,UAAU;AACnB,aAAO,OAAO,aAAa;AAAA,IAC7B;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,sBACN,MACA,OACA,UACA,gBACQ;AACR,UAAM,YAAY,KAAK,iBAAiB,MAAM,UAAU,cAAc;AACtE,UAAM,aAAa,KAAK,iBAAiB,OAAO,UAAU,cAAc;AACxE,QAAI,cAAc,WAAY,QAAO,YAAY;AACjD,QAAI,KAAK,uBAAuB,MAAM,oBAAoB;AACxD,aAAO,KAAK,qBAAqB,IAAI;AAAA,IACvC;AACA,WAAO,MAAM,UAAU,QAAQ,IAAI,KAAK,UAAU,QAAQ;AAAA,EAC5D;AAAA,EAEQ,iBACN,QACA,UACA,gBACQ;AACR,QAAI,OAAO,mBAAmB,kBAAkB,OAAO,aAAa,SAAU,QAAO;AACrF,QAAI,CAAC,OAAO,kBAAkB,OAAO,aAAa,SAAU,QAAO;AACnE,QAAI,CAAC,OAAO,kBAAkB,CAAC,OAAO,YAAY,CAAC,OAAO,mBAAoB,QAAO;AACrF,QAAI,CAAC,OAAO,kBAAkB,CAAC,OAAO,YAAY,OAAO,mBAAoB,QAAO;AACpF,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,kBAAkB,WAAyC;AACvE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,aAAa,EAAE,IAAI,UAAU,CAAC;AACpE,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,0BAA0B,oCAAoC,GAAG;AAAA,IAC7E;AACA,QAAI,QAAQ,UAAU,QAAQ,KAAK,KAAK,IAAI,GAAG;AAC7C,YAAM,IAAI,0BAA0B,kCAAkC,GAAG;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,cAAc,QAA2C;AACrE,UAAM,OAAO,MAAM;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,IAAI,QAAQ,WAAW,KAAK;AAAA,MAC9B;AAAA,MACA,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO;AAAA,MACL,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACtE;AAAA,EACF;AAAA,EAEQ,aAAa,OAA+B;AAClD,UAAM,WAAW,SAAS,KAAK,eAAe,KAAK;AACnD,WAAO,KAAK;AAAA,MACV,KAAK,IAAI,UAAU,KAAK,eAAe,KAAK,aAAa;AAAA,MACzD,KAAK,eAAe,KAAK;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,aAAa,SAA0B;AAC7C,QAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,YAAM,IAAI,0BAA0B,wBAAwB,GAAG;AAAA,IACjE;AACA,UAAM,gBAAiB,QAAoC;AAC3D,QAAI,OAAO,kBAAkB,YAAY,cAAc,KAAK,EAAE,WAAW,GAAG;AAC1E,YAAM,IAAI,0BAA0B,wBAAwB,GAAG;AAAA,IACjE;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,SAAyC;AACzD,UAAM,iBAAiB,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AAChF,UAAM,YAAY,WAAW,UAAU,KAAK,cAAc,CAAC,EAAE,OAAO,cAAc,EAAE,OAAO,WAAW;AACtG,WAAO,GAAG,cAAc,IAAI,SAAS;AAAA,EACvC;AAAA,EAEQ,gBAAgB,OAA8C;AACpE,UAAM,CAAC,gBAAgB,SAAS,IAAI,MAAM,MAAM,GAAG;AACnD,QAAI,CAAC,kBAAkB,CAAC,UAAW,QAAO;AAE1C,UAAM,WAAW,WAAW,UAAU,KAAK,cAAc,CAAC,EAAE,OAAO,cAAc,EAAE,OAAO,WAAW;AACrG,UAAM,kBAAkB,OAAO,KAAK,SAAS;AAC7C,UAAM,iBAAiB,OAAO,KAAK,QAAQ;AAC3C,QAAI,gBAAgB,WAAW,eAAe,OAAQ,QAAO;AAC7D,QAAI,CAAC,gBAAgB,iBAAiB,cAAc,EAAG,QAAO;AAE9D,QAAI;AACF,YAAM,SAAS,6BAA6B;AAAA,QAC1C,KAAK,MAAM,OAAO,KAAK,gBAAgB,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,MACtE;AACA,UAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,aAAO,OAAO;AAAA,IAChB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,gBAAwB;AAC9B,UAAM,SACJ,eAAe,QAAQ,IAAI,uBAAuB,KAC/C,eAAe,QAAQ,IAAI,eAAe,KAC1C,eAAe,QAAQ,IAAI,WAAW,KACtC,eAAe,QAAQ,IAAI,UAAU;AAC1C,QAAI,OAAQ,QAAO;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,kBACN,QAC6B;AAC7B,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO,gBAAgB;AAAA,MACzB,KAAK;AACH,eAAO,gBAAgB;AAAA,MACzB,KAAK;AAAA,MACL;AACE,eAAO,gBAAgB;AAAA,IAC3B;AAAA,EACF;AACF;AAEA,IAAO,+BAAQ;",
+  "sourcesContent": ["import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  dedupeSudoTargets,\n  getSecuritySudoTargetEntries,\n  type SecuritySudoTarget,\n} from '../lib/module-security-registry'\nimport {\n  ChallengeMethod,\n  SudoChallengeConfig,\n  SudoChallengeMethodUsed,\n  SudoSession,\n} from '../data/entities'\nimport { emitSecurityEvent } from '../events'\nimport type {\n  SudoConfigInput,\n  SudoConfigUpdateInput,\n} from '../data/validators'\nimport type { PasswordService } from './PasswordService'\nimport type { MfaService } from './MfaService'\nimport type { MfaVerificationService } from './MfaVerificationService'\nimport { sudoTargets as defaultSudoTargets } from '../security.sudo'\nimport type { SecurityModuleConfig } from '../lib/security-config'\nimport { readSecurityModuleConfig } from '../lib/security-config'\n\ntype SudoMethod = 'password' | 'mfa'\n\nexport type SudoAvailableMethod = {\n  type: string\n  label: string\n  icon: string\n}\n\nexport type SudoProtectionResolution = {\n  protected: boolean\n  config?: SudoChallengeConfig\n}\n\nconst signedSudoTokenPayloadSchema = z.object({\n  sid: z.string(),\n  sub: z.string(),\n  tid: z.string().nullable(),\n  oid: z.string().nullable(),\n  tgt: z.string(),\n  exp: z.number(),\n})\n\ntype SignedSudoTokenPayload = z.infer<typeof signedSudoTokenPayloadSchema>\n\ntype UserScope = {\n  id: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\ntype BoundPendingSudoSession = SudoSession & {\n  targetIdentifier: string\n  sudoConfigId: string\n  sudoConfigUpdatedAt: Date\n}\n\nexport type SudoAuthScope = {\n  tenantId: string | null\n  organizationId?: string | null\n  isSuperAdmin?: boolean\n}\n\ntype DeveloperDefaultPayload = {\n  targetIdentifier: string\n  label?: string | null\n  ttlSeconds?: number\n  challengeMethod?: ChallengeMethod\n}\n\nfunction readTrimmedEnv(value: string | undefined): string | undefined {\n  const trimmed = value?.trim()\n  return trimmed ? trimmed : undefined\n}\n\nexport class SudoChallengeServiceError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode: number,\n  ) {\n    super(message)\n    this.name = 'SudoChallengeServiceError'\n  }\n}\n\nexport class SudoChallengeService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly passwordService: PasswordService,\n    private readonly mfaService: MfaService,\n    private readonly mfaVerificationService: MfaVerificationService,\n    private readonly securityConfig: SecurityModuleConfig = readSecurityModuleConfig(),\n  ) {}\n\n  async listConfigs(scope?: SudoAuthScope): Promise<SudoChallengeConfig[]> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const filter: FilterQuery<SudoChallengeConfig> = { deletedAt: null }\n    if (scope && !scope.isSuperAdmin) {\n      if (!scope.tenantId) return []\n      ;(filter as Record<string, unknown>).$or = [\n        { tenantId: scope.tenantId },\n        { tenantId: null },\n      ]\n    }\n    return this.em.find(\n      SudoChallengeConfig,\n      filter,\n      {\n        orderBy: {\n          targetIdentifier: 'asc',\n          tenantId: 'asc',\n          organizationId: 'asc',\n          createdAt: 'asc',\n        },\n      },\n    )\n  }\n\n  async getConfigById(id: string, scope?: SudoAuthScope): Promise<SudoChallengeConfig | null> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) return null\n    if (scope && !this.isConfigVisibleToScope(config, scope)) return null\n    return config\n  }\n\n  async isProtected(\n    targetIdentifier: string,\n    tenantId?: string | null,\n    organizationId?: string | null,\n  ): Promise<SudoProtectionResolution> {\n    await this.ensureDeveloperDefaultsRegistered()\n    return this.resolveProtection(this.em, targetIdentifier, tenantId ?? null, organizationId ?? null)\n  }\n\n  async initiate(\n    userId: string,\n    targetIdentifier: string,\n    options?: { tenantId?: string | null; organizationId?: string | null },\n  ): Promise<{\n    required: boolean\n    sessionId?: string\n    method?: SudoMethod\n    availableMfaMethods?: SudoAvailableMethod[]\n    expiresAt?: Date\n  }> {\n    const user = await this.findUserScope(userId)\n    if (!user?.tenantId) {\n      throw new SudoChallengeServiceError('User not found', 404)\n    }\n    const scopeTenantId = options?.tenantId !== undefined ? options.tenantId : user.tenantId\n    const scopeOrganizationId = options?.organizationId !== undefined ? options.organizationId : user.organizationId\n    const protection = await this.isProtected(\n      targetIdentifier,\n      scopeTenantId,\n      scopeOrganizationId,\n    )\n\n    if (!protection.protected || !protection.config) {\n      return { required: false }\n    }\n\n    const userMethods = await this.mfaService.getUserMethods(userId)\n    const method = this.resolveChallengeMethod(protection.config.challengeMethod, userMethods.length)\n\n    let sessionToken = randomBytes(16).toString('hex')\n    let availableMfaMethods: SudoAvailableMethod[] | undefined\n    if (method === 'mfa') {\n      const challenge = await this.mfaVerificationService.createChallenge(userId)\n      sessionToken = challenge.challengeId\n      availableMfaMethods = challenge.availableMethods\n    }\n\n    const expiresAt = new Date(Date.now() + this.securityConfig.sudo.pendingChallengeTtlMs)\n    const session = this.em.create(SudoSession, {\n      userId,\n      tenantId: user.tenantId,\n      scopeTenantId,\n      scopeOrganizationId,\n      targetIdentifier,\n      sudoConfigId: protection.config.id,\n      sudoConfigUpdatedAt: protection.config.updatedAt,\n      sessionToken,\n      challengeMethod: method,\n      expiresAt,\n      verifiedAt: null,\n      createdAt: new Date(),\n    })\n    this.em.persist(session)\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.challenged', {\n      userId,\n      tenantId: user.tenantId,\n      organizationId: user.organizationId,\n      targetIdentifier,\n      method,\n    })\n\n    return {\n      required: true,\n      sessionId: session.id,\n      method,\n      availableMfaMethods,\n      expiresAt,\n    }\n  }\n\n  async prepare(\n    sessionId: string,\n    methodType: string,\n    options: { expectedUserId?: string } = {},\n    request?: Request,\n  ): Promise<{ clientData?: Record<string, unknown> }> {\n    const session = await this.getPendingSession(sessionId)\n    if (options.expectedUserId && session.userId !== options.expectedUserId) {\n      throw new SudoChallengeServiceError('Sudo challenge user mismatch', 403)\n    }\n    if (session.challengeMethod !== 'mfa') {\n      throw new SudoChallengeServiceError('This sudo session does not require MFA', 400)\n    }\n    return this.mfaVerificationService.prepareChallenge(\n      session.sessionToken,\n      methodType,\n      { request },\n      { userId: session.userId },\n    )\n  }\n\n  async verify(\n    sessionId: string,\n    methodType: string,\n    payload: unknown,\n    options: {\n      expectedUserId?: string\n      tenantId?: string | null\n      organizationId?: string | null\n      targetIdentifier: string\n    },\n    request?: Request,\n  ): Promise<{ sudoToken: string; expiresAt: Date }> {\n    const session = await this.getPendingSession(sessionId)\n    if (options.expectedUserId && session.userId !== options.expectedUserId) {\n      throw new SudoChallengeServiceError('Sudo challenge user mismatch', 403)\n    }\n    const user = await this.findUserScope(session.userId)\n    if (!user?.tenantId) {\n      throw new SudoChallengeServiceError('User not found', 404)\n    }\n    if (user.tenantId !== session.tenantId) {\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)\n    }\n\n    const requestedTenantId = options.tenantId !== undefined ? options.tenantId : user.tenantId\n    const requestedOrganizationId = options.organizationId !== undefined ? options.organizationId : user.organizationId\n    if (\n      options.targetIdentifier !== session.targetIdentifier\n      || requestedTenantId !== session.scopeTenantId\n      || requestedOrganizationId !== session.scopeOrganizationId\n    ) {\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)\n    }\n\n    const scopeTenantId = session.scopeTenantId ?? null\n    const scopeOrganizationId = session.scopeOrganizationId ?? null\n    const protection = await this.isProtected(\n      session.targetIdentifier,\n      scopeTenantId,\n      scopeOrganizationId,\n    )\n    if (!protection.protected || !protection.config) {\n      throw new SudoChallengeServiceError('Sudo protection is not configured for this target', 404)\n    }\n    if (\n      protection.config.id !== session.sudoConfigId\n      || protection.config.updatedAt.getTime() !== session.sudoConfigUpdatedAt?.getTime()\n    ) {\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)\n    }\n\n    let verified = false\n    let methodUsed: string = methodType\n    if (session.challengeMethod === 'password') {\n      const password = this.readPassword(payload)\n      verified = await this.passwordService.verifyPassword(session.userId, password)\n      methodUsed = SudoChallengeMethodUsed.PASSWORD\n    } else {\n      verified = await this.mfaVerificationService.verifyChallenge(\n        session.sessionToken,\n        methodType,\n        payload,\n        { request },\n        { userId: session.userId },\n      )\n    }\n\n    if (!verified) {\n      await emitSecurityEvent('security.sudo.failed', {\n        userId: session.userId,\n        tenantId: user.tenantId,\n        organizationId: user.organizationId,\n        targetIdentifier: session.targetIdentifier,\n        method: methodUsed,\n      })\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 401)\n    }\n\n    const pendingToken = session.sessionToken\n    const { sudoToken, expiresAt, verifiedAt } = await this.em.transactional(async (transactionalEm) => {\n      await transactionalEm.execute('lock table \"sudo_challenge_configs\" in share mode')\n      const currentProtection = await this.resolveProtection(\n        transactionalEm,\n        session.targetIdentifier,\n        scopeTenantId,\n        scopeOrganizationId,\n      )\n      if (\n        !currentProtection.protected\n        || !currentProtection.config\n        || currentProtection.config.id !== session.sudoConfigId\n        || currentProtection.config.updatedAt.getTime() !== session.sudoConfigUpdatedAt.getTime()\n      ) {\n        throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)\n      }\n\n      const ttlSeconds = this.normalizeTtl(currentProtection.config.ttlSeconds)\n      const currentVerifiedAt = new Date()\n      const currentExpiresAt = new Date(Date.now() + ttlSeconds * 1000)\n      const currentSudoToken = this.signToken({\n        sid: session.id,\n        sub: session.userId,\n        tid: scopeTenantId,\n        oid: scopeOrganizationId,\n        tgt: session.targetIdentifier,\n        exp: currentExpiresAt.getTime(),\n      })\n      const consumedRows = await transactionalEm.nativeUpdate(\n        SudoSession,\n        {\n          id: session.id,\n          sessionToken: pendingToken,\n          verifiedAt: null,\n          expiresAt: { $gt: currentVerifiedAt },\n        },\n        {\n          sessionToken: currentSudoToken,\n          expiresAt: currentExpiresAt,\n          verifiedAt: currentVerifiedAt,\n        },\n      )\n      if (consumedRows !== 1) {\n        throw new SudoChallengeServiceError('Unable to verify sudo challenge', 400)\n      }\n      return {\n        sudoToken: currentSudoToken,\n        expiresAt: currentExpiresAt,\n        verifiedAt: currentVerifiedAt,\n      }\n    })\n    session.sessionToken = sudoToken\n    session.expiresAt = expiresAt\n    session.verifiedAt = verifiedAt\n\n    await emitSecurityEvent('security.sudo.verified', {\n      userId: session.userId,\n      tenantId: scopeTenantId,\n      organizationId: scopeOrganizationId,\n      targetIdentifier: session.targetIdentifier,\n      method: methodUsed,\n      expiresAt: expiresAt.toISOString(),\n    })\n\n    return { sudoToken, expiresAt }\n  }\n\n  async validateToken(\n    token: string,\n    targetIdentifier: string,\n    options?: {\n      expectedUserId?: string\n      tenantId?: string | null\n      organizationId?: string | null\n    },\n  ): Promise<boolean> {\n    if (!token) return false\n    const payload = this.readSignedToken(token)\n    if (!payload) return false\n    if (payload.exp <= Date.now()) return false\n    if (payload.tgt !== targetIdentifier) return false\n    if (options?.expectedUserId && payload.sub !== options.expectedUserId) return false\n    if (options?.tenantId !== undefined && payload.tid !== (options.tenantId ?? null)) return false\n    if (options?.organizationId !== undefined && payload.oid !== (options.organizationId ?? null)) return false\n\n    const session = await this.em.findOne(SudoSession, {\n      id: payload.sid,\n      userId: payload.sub,\n      sessionToken: token,\n      targetIdentifier,\n      scopeTenantId: payload.tid,\n      scopeOrganizationId: payload.oid,\n      verifiedAt: { $ne: null },\n    } as FilterQuery<SudoSession>)\n\n    return Boolean(session && session.expiresAt.getTime() > Date.now())\n  }\n\n  async createConfig(\n    input: SudoConfigInput,\n    configuredBy: string,\n    scope?: SudoAuthScope,\n  ): Promise<SudoChallengeConfig> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const inputTenantId = input.tenantId ?? null\n    const inputOrganizationId = input.organizationId ?? null\n    this.validateScope(inputTenantId, inputOrganizationId)\n    if (scope) this.assertWriteScope(inputTenantId, inputOrganizationId, scope)\n    await this.ensureUniqueConfig(input.targetIdentifier, inputTenantId, inputOrganizationId)\n\n    const config = this.em.create(SudoChallengeConfig, {\n      tenantId: inputTenantId,\n      organizationId: inputOrganizationId,\n      label: input.label ?? null,\n      targetIdentifier: input.targetIdentifier,\n      isEnabled: input.isEnabled,\n      ttlSeconds: this.normalizeTtl(input.ttlSeconds),\n      challengeMethod: input.challengeMethod,\n      configuredBy,\n      isDeveloperDefault: false,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    this.em.persist(config)\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.created', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n      configuredBy,\n    })\n\n    return config\n  }\n\n  async updateConfig(\n    id: string,\n    input: SudoConfigUpdateInput,\n    configuredBy: string,\n    scope?: SudoAuthScope,\n  ): Promise<SudoChallengeConfig> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (scope) {\n      this.assertWriteScope(config.tenantId ?? null, config.organizationId ?? null, scope)\n      if (config.isDeveloperDefault && !scope.isSuperAdmin) {\n        throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n      }\n    }\n\n    const nextTenantId = input.tenantId !== undefined ? input.tenantId ?? null : config.tenantId ?? null\n    const nextOrganizationId = input.organizationId !== undefined ? input.organizationId ?? null : config.organizationId ?? null\n    const nextTargetIdentifier = input.targetIdentifier ?? config.targetIdentifier\n    this.validateScope(nextTenantId, nextOrganizationId)\n    if (scope) this.assertWriteScope(nextTenantId, nextOrganizationId, scope)\n    await this.ensureUniqueConfig(nextTargetIdentifier, nextTenantId, nextOrganizationId, config.id)\n\n    if (input.tenantId !== undefined) config.tenantId = input.tenantId ?? null\n    if (input.organizationId !== undefined) config.organizationId = input.organizationId ?? null\n    if (input.label !== undefined) config.label = input.label ?? null\n    if (input.targetIdentifier !== undefined) config.targetIdentifier = input.targetIdentifier\n    if (input.isEnabled !== undefined) config.isEnabled = input.isEnabled\n    if (input.ttlSeconds !== undefined) config.ttlSeconds = this.normalizeTtl(input.ttlSeconds)\n    if (input.challengeMethod !== undefined) config.challengeMethod = input.challengeMethod\n    config.configuredBy = configuredBy\n    config.updatedAt = new Date()\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.updated', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n      configuredBy,\n    })\n\n    return config\n  }\n\n  async deleteConfig(id: string, scope?: SudoAuthScope): Promise<void> {\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (scope) {\n      this.assertWriteScope(config.tenantId ?? null, config.organizationId ?? null, scope)\n      if (config.isDeveloperDefault && !scope.isSuperAdmin) {\n        throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n      }\n    }\n    config.deletedAt = new Date()\n    config.updatedAt = new Date()\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.deleted', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n    })\n  }\n\n  async registerDeveloperDefault(\n    input: DeveloperDefaultPayload,\n  ): Promise<void> {\n    const existing = await this.em.findOne(SudoChallengeConfig, {\n      targetIdentifier: input.targetIdentifier,\n      tenantId: null,\n      organizationId: null,\n      isDeveloperDefault: true,\n    })\n\n    if (existing) {\n      const ttlSeconds = this.normalizeTtl(input.ttlSeconds)\n      const challengeMethod = input.challengeMethod ?? ChallengeMethod.AUTO\n      const changed = !existing.isEnabled\n        || Boolean(existing.deletedAt)\n        || existing.ttlSeconds !== ttlSeconds\n        || existing.challengeMethod !== challengeMethod\n      if (changed) {\n        existing.isEnabled = true\n        existing.deletedAt = null\n        existing.ttlSeconds = ttlSeconds\n        existing.challengeMethod = challengeMethod\n        existing.updatedAt = new Date()\n        await this.em.flush()\n      }\n      return\n    }\n\n    const config = this.em.create(SudoChallengeConfig, {\n      tenantId: null,\n      organizationId: null,\n      label: input.label ?? null,\n      targetIdentifier: input.targetIdentifier,\n      isEnabled: true,\n      isDeveloperDefault: true,\n      ttlSeconds: this.normalizeTtl(input.ttlSeconds),\n      challengeMethod: input.challengeMethod ?? ChallengeMethod.AUTO,\n      configuredBy: null,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    this.em.persist(config)\n    await this.em.flush()\n  }\n\n  async cleanupExpired(): Promise<number> {\n    return this.em.nativeDelete(SudoSession, {\n      expiresAt: { $lte: new Date() },\n    })\n  }\n\n  private async ensureDeveloperDefaultsRegistered(): Promise<void> {\n    const registryEntries = getSecuritySudoTargetEntries()\n    const registryTargets = registryEntries.flatMap((entry) => entry.targets ?? [])\n    const fallbackTargets = registryEntries.length === 0 ? defaultSudoTargets : []\n\n    for (const target of dedupeSudoTargets([\n      ...registryTargets,\n      ...fallbackTargets,\n    ])) {\n      await this.registerDeveloperDefault(this.readDeveloperDefault(target))\n    }\n  }\n\n  private readDeveloperDefault(target: SecuritySudoTarget): DeveloperDefaultPayload {\n    return {\n      targetIdentifier: target.identifier,\n      label: target.label ?? null,\n      ttlSeconds: target.ttlSeconds,\n      challengeMethod: this.toChallengeMethod(target.challengeMethod),\n    }\n  }\n\n  private async ensureUniqueConfig(\n    targetIdentifier: string,\n    tenantId: string | null,\n    organizationId: string | null,\n    ignoreId?: string,\n  ): Promise<void> {\n    const existing = await this.em.findOne(SudoChallengeConfig, {\n      targetIdentifier,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (existing && existing.id !== ignoreId) {\n      throw new SudoChallengeServiceError('A sudo configuration for this target and scope already exists', 409)\n    }\n  }\n\n  private validateScope(tenantId: string | null, organizationId: string | null): void {\n    if (organizationId && !tenantId) {\n      throw new SudoChallengeServiceError('Organization-scoped sudo config requires a tenant', 400)\n    }\n  }\n\n  private isConfigVisibleToScope(config: SudoChallengeConfig, scope: SudoAuthScope): boolean {\n    if (scope.isSuperAdmin) return true\n    if (!scope.tenantId) return false\n    const configTenantId = config.tenantId ?? null\n    if (configTenantId === null) return true\n    return configTenantId === scope.tenantId\n  }\n\n  private assertWriteScope(\n    targetTenantId: string | null,\n    targetOrganizationId: string | null,\n    scope: SudoAuthScope,\n  ): void {\n    if (scope.isSuperAdmin) return\n    if (!scope.tenantId) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if ((targetTenantId ?? null) !== scope.tenantId) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (\n      scope.organizationId !== undefined\n      && scope.organizationId !== null\n      && targetOrganizationId !== null\n      && targetOrganizationId !== scope.organizationId\n    ) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n  }\n\n  private resolveChallengeMethod(\n    configuredMethod: ChallengeMethod,\n    availableMfaMethodCount: number,\n  ): SudoMethod {\n    if (this.securityConfig.mfa.emergencyBypass) {\n      return 'password'\n    }\n    if (configuredMethod === ChallengeMethod.PASSWORD) return 'password'\n    if (configuredMethod === ChallengeMethod.MFA) {\n      if (availableMfaMethodCount === 0) {\n        throw new SudoChallengeServiceError('This sudo target requires MFA, but no MFA methods are configured', 400)\n      }\n      return 'mfa'\n    }\n    return availableMfaMethodCount > 0 ? 'mfa' : 'password'\n  }\n\n  private async resolveProtection(\n    em: EntityManager,\n    targetIdentifier: string,\n    tenantId: string | null,\n    organizationId: string | null,\n  ): Promise<SudoProtectionResolution> {\n    const candidates = await em.find(SudoChallengeConfig, {\n      targetIdentifier,\n      deletedAt: null,\n    })\n\n    const resolved = candidates\n      .filter((config) => this.matchesScope(config, tenantId, organizationId))\n      .sort((left, right) => this.compareConfigPriority(left, right, tenantId, organizationId))[0]\n\n    if (!resolved || !resolved.isEnabled) {\n      return { protected: false }\n    }\n\n    return { protected: true, config: resolved }\n  }\n\n  private matchesScope(config: SudoChallengeConfig, tenantId: string | null, organizationId: string | null): boolean {\n    if (config.organizationId) {\n      return config.organizationId === organizationId && config.tenantId === tenantId\n    }\n    if (config.tenantId) {\n      return config.tenantId === tenantId\n    }\n    return true\n  }\n\n  private compareConfigPriority(\n    left: SudoChallengeConfig,\n    right: SudoChallengeConfig,\n    tenantId: string | null,\n    organizationId: string | null,\n  ): number {\n    const leftScore = this.getScopePriority(left, tenantId, organizationId)\n    const rightScore = this.getScopePriority(right, tenantId, organizationId)\n    if (leftScore !== rightScore) return leftScore - rightScore\n    if (left.isDeveloperDefault !== right.isDeveloperDefault) {\n      return left.isDeveloperDefault ? 1 : -1\n    }\n    return right.updatedAt.getTime() - left.updatedAt.getTime()\n  }\n\n  private getScopePriority(\n    config: SudoChallengeConfig,\n    tenantId: string | null,\n    organizationId: string | null,\n  ): number {\n    if (config.organizationId === organizationId && config.tenantId === tenantId) return 0\n    if (!config.organizationId && config.tenantId === tenantId) return 1\n    if (!config.organizationId && !config.tenantId && !config.isDeveloperDefault) return 2\n    if (!config.organizationId && !config.tenantId && config.isDeveloperDefault) return 3\n    return 4\n  }\n\n  private async getPendingSession(sessionId: string): Promise<BoundPendingSudoSession> {\n    const session = await this.em.findOne(SudoSession, { id: sessionId })\n    if (!session) {\n      throw new SudoChallengeServiceError('Sudo challenge session not found', 404)\n    }\n    if (!session.targetIdentifier || !session.sudoConfigId || !session.sudoConfigUpdatedAt) {\n      throw new SudoChallengeServiceError('Sudo challenge session not found', 404)\n    }\n    if (session.verifiedAt) {\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 400)\n    }\n    if (session.expiresAt.getTime() <= Date.now()) {\n      throw new SudoChallengeServiceError('Sudo challenge session expired', 400)\n    }\n    return session as BoundPendingSudoSession\n  }\n\n  private async findUserScope(userId: string): Promise<UserScope | null> {\n    const user = await findOneWithDecryption(\n      this.em,\n      User,\n      { id: userId, deletedAt: null },\n      undefined,\n      {},\n    )\n\n    if (!user) return null\n    return {\n      id: String(user.id),\n      tenantId: user.tenantId ? String(user.tenantId) : null,\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n    }\n  }\n\n  private normalizeTtl(value?: number | null): number {\n    const rawValue = value ?? this.securityConfig.sudo.defaultTtlSeconds\n    return Math.min(\n      Math.max(rawValue, this.securityConfig.sudo.minTtlSeconds),\n      this.securityConfig.sudo.maxTtlSeconds,\n    )\n  }\n\n  private readPassword(payload: unknown): string {\n    if (!payload || typeof payload !== 'object') {\n      throw new SudoChallengeServiceError('Password is required', 400)\n    }\n    const maybePassword = (payload as Record<string, unknown>).password\n    if (typeof maybePassword !== 'string' || maybePassword.trim().length === 0) {\n      throw new SudoChallengeServiceError('Password is required', 400)\n    }\n    return maybePassword\n  }\n\n  private signToken(payload: SignedSudoTokenPayload): string {\n    const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url')\n    const signature = createHmac('sha256', this.getSudoSecret()).update(encodedPayload).digest('base64url')\n    return `${encodedPayload}.${signature}`\n  }\n\n  private readSignedToken(token: string): SignedSudoTokenPayload | null {\n    const [encodedPayload, signature] = token.split('.')\n    if (!encodedPayload || !signature) return null\n\n    const expected = createHmac('sha256', this.getSudoSecret()).update(encodedPayload).digest('base64url')\n    const signatureBuffer = Buffer.from(signature)\n    const expectedBuffer = Buffer.from(expected)\n    if (signatureBuffer.length !== expectedBuffer.length) return null\n    if (!timingSafeEqual(signatureBuffer, expectedBuffer)) return null\n\n    try {\n      const parsed = signedSudoTokenPayloadSchema.safeParse(\n        JSON.parse(Buffer.from(encodedPayload, 'base64url').toString('utf8')),\n      )\n      if (!parsed.success) return null\n      return parsed.data\n    } catch {\n      return null\n    }\n  }\n\n  private getSudoSecret(): string {\n    const secret =\n      readTrimmedEnv(process.env.OM_SECURITY_SUDO_SECRET)\n      ?? readTrimmedEnv(process.env.AUTH_JWT_SECRET)\n      ?? readTrimmedEnv(process.env.AUTH_SECRET)\n      ?? readTrimmedEnv(process.env.JWT_SECRET)\n    if (secret) return secret\n    throw new Error(\n      'Sudo step-up tokens require OM_SECURITY_SUDO_SECRET, AUTH_JWT_SECRET, AUTH_SECRET, or JWT_SECRET to be set.',\n    )\n  }\n\n  private toChallengeMethod(\n    method: SecuritySudoTarget['challengeMethod'],\n  ): ChallengeMethod | undefined {\n    switch (method) {\n      case 'password':\n        return ChallengeMethod.PASSWORD\n      case 'mfa':\n        return ChallengeMethod.MFA\n      case 'auto':\n      default:\n        return ChallengeMethod.AUTO\n    }\n  }\n}\n\nexport default SudoChallengeService\n"],
+  "mappings": "AAAA,SAAS,YAAY,aAAa,uBAAuB;AACzD,SAAS,SAAS;AAElB,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAQlC,SAAS,eAAe,0BAA0B;AAElD,SAAS,gCAAgC;AAezC,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO;AAChB,CAAC;AA6BD,SAAS,eAAe,OAA+C;AACrE,QAAM,UAAU,OAAO,KAAK;AAC5B,SAAO,UAAU,UAAU;AAC7B;AAEO,MAAM,kCAAkC,MAAM;AAAA,EACnD,YACE,SACgB,YAChB;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qBAAqB;AAAA,EAChC,YACmB,IACA,iBACA,YACA,wBACA,iBAAuC,yBAAyB,GACjF;AALiB;AACA;AACA;AACA;AACA;AAAA,EAChB;AAAA,EAEH,MAAM,YAAY,OAAuD;AACvE,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAA2C,EAAE,WAAW,KAAK;AACnE,QAAI,SAAS,CAAC,MAAM,cAAc;AAChC,UAAI,CAAC,MAAM,SAAU,QAAO,CAAC;AAC5B,MAAC,OAAmC,MAAM;AAAA,QACzC,EAAE,UAAU,MAAM,SAAS;AAAA,QAC3B,EAAE,UAAU,KAAK;AAAA,MACnB;AAAA,IACF;AACA,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS;AAAA,UACP,kBAAkB;AAAA,UAClB,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,IAAY,OAA4D;AAC1F,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,SAAS,CAAC,KAAK,uBAAuB,QAAQ,KAAK,EAAG,QAAO;AACjE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YACJ,kBACA,UACA,gBACmC;AACnC,UAAM,KAAK,kCAAkC;AAC7C,WAAO,KAAK,kBAAkB,KAAK,IAAI,kBAAkB,YAAY,MAAM,kBAAkB,IAAI;AAAA,EACnG;AAAA,EAEA,MAAM,SACJ,QACA,kBACA,SAOC;AACD,UAAM,OAAO,MAAM,KAAK,cAAc,MAAM;AAC5C,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,kBAAkB,GAAG;AAAA,IAC3D;AACA,UAAM,gBAAgB,SAAS,aAAa,SAAY,QAAQ,WAAW,KAAK;AAChF,UAAM,sBAAsB,SAAS,mBAAmB,SAAY,QAAQ,iBAAiB,KAAK;AAClG,UAAM,aAAa,MAAM,KAAK;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,WAAW,aAAa,CAAC,WAAW,QAAQ;AAC/C,aAAO,EAAE,UAAU,MAAM;AAAA,IAC3B;AAEA,UAAM,cAAc,MAAM,KAAK,WAAW,eAAe,MAAM;AAC/D,UAAM,SAAS,KAAK,uBAAuB,WAAW,OAAO,iBAAiB,YAAY,MAAM;AAEhG,QAAI,eAAe,YAAY,EAAE,EAAE,SAAS,KAAK;AACjD,QAAI;AACJ,QAAI,WAAW,OAAO;AACpB,YAAM,YAAY,MAAM,KAAK,uBAAuB,gBAAgB,MAAM;AAC1E,qBAAe,UAAU;AACzB,4BAAsB,UAAU;AAAA,IAClC;AAEA,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,eAAe,KAAK,qBAAqB;AACtF,UAAM,UAAU,KAAK,GAAG,OAAO,aAAa;AAAA,MAC1C;AAAA,MACA,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,WAAW,OAAO;AAAA,MAChC,qBAAqB,WAAW,OAAO;AAAA,MACvC;AAAA,MACA,iBAAiB;AAAA,MACjB;AAAA,MACA,YAAY;AAAA,MACZ,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,OAAO;AACvB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,4BAA4B;AAAA,MAClD;AAAA,MACA,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO;AAAA,MACL,UAAU;AAAA,MACV,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,WACA,YACA,UAAuC,CAAC,GACxC,SACmD;AACnD,UAAM,UAAU,MAAM,KAAK,kBAAkB,SAAS;AACtD,QAAI,QAAQ,kBAAkB,QAAQ,WAAW,QAAQ,gBAAgB;AACvE,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,QAAQ,oBAAoB,OAAO;AACrC,YAAM,IAAI,0BAA0B,0CAA0C,GAAG;AAAA,IACnF;AACA,WAAO,KAAK,uBAAuB;AAAA,MACjC,QAAQ;AAAA,MACR;AAAA,MACA,EAAE,QAAQ;AAAA,MACV,EAAE,QAAQ,QAAQ,OAAO;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,MAAM,OACJ,WACA,YACA,SACA,SAMA,SACiD;AACjD,UAAM,UAAU,MAAM,KAAK,kBAAkB,SAAS;AACtD,QAAI,QAAQ,kBAAkB,QAAQ,WAAW,QAAQ,gBAAgB;AACvE,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,UAAM,OAAO,MAAM,KAAK,cAAc,QAAQ,MAAM;AACpD,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,kBAAkB,GAAG;AAAA,IAC3D;AACA,QAAI,KAAK,aAAa,QAAQ,UAAU;AACtC,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AAEA,UAAM,oBAAoB,QAAQ,aAAa,SAAY,QAAQ,WAAW,KAAK;AACnF,UAAM,0BAA0B,QAAQ,mBAAmB,SAAY,QAAQ,iBAAiB,KAAK;AACrG,QACE,QAAQ,qBAAqB,QAAQ,oBAClC,sBAAsB,QAAQ,iBAC9B,4BAA4B,QAAQ,qBACvC;AACA,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AAEA,UAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,UAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,UAAM,aAAa,MAAM,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,WAAW,aAAa,CAAC,WAAW,QAAQ;AAC/C,YAAM,IAAI,0BAA0B,qDAAqD,GAAG;AAAA,IAC9F;AACA,QACE,WAAW,OAAO,OAAO,QAAQ,gBAC9B,WAAW,OAAO,UAAU,QAAQ,MAAM,QAAQ,qBAAqB,QAAQ,GAClF;AACA,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AAEA,QAAI,WAAW;AACf,QAAI,aAAqB;AACzB,QAAI,QAAQ,oBAAoB,YAAY;AAC1C,YAAM,WAAW,KAAK,aAAa,OAAO;AAC1C,iBAAW,MAAM,KAAK,gBAAgB,eAAe,QAAQ,QAAQ,QAAQ;AAC7E,mBAAa,wBAAwB;AAAA,IACvC,OAAO;AACL,iBAAW,MAAM,KAAK,uBAAuB;AAAA,QAC3C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,QAAQ;AAAA,QACV,EAAE,QAAQ,QAAQ,OAAO;AAAA,MAC3B;AAAA,IACF;AAEA,QAAI,CAAC,UAAU;AACb,YAAM,kBAAkB,wBAAwB;AAAA,QAC9C,QAAQ,QAAQ;AAAA,QAChB,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK;AAAA,QACrB,kBAAkB,QAAQ;AAAA,QAC1B,QAAQ;AAAA,MACV,CAAC;AACD,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AAEA,UAAM,eAAe,QAAQ;AAC7B,UAAM,EAAE,WAAW,WAAW,WAAW,IAAI,MAAM,KAAK,GAAG,cAAc,OAAO,oBAAoB;AAClG,YAAM,gBAAgB,QAAQ,mDAAmD;AACjF,YAAM,oBAAoB,MAAM,KAAK;AAAA,QACnC;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACA,UACE,CAAC,kBAAkB,aAChB,CAAC,kBAAkB,UACnB,kBAAkB,OAAO,OAAO,QAAQ,gBACxC,kBAAkB,OAAO,UAAU,QAAQ,MAAM,QAAQ,oBAAoB,QAAQ,GACxF;AACA,cAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,MAC5E;AAEA,YAAM,aAAa,KAAK,aAAa,kBAAkB,OAAO,UAAU;AACxE,YAAM,oBAAoB,oBAAI,KAAK;AACnC,YAAM,mBAAmB,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa,GAAI;AAChE,YAAM,mBAAmB,KAAK,UAAU;AAAA,QACtC,KAAK,QAAQ;AAAA,QACb,KAAK,QAAQ;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK,QAAQ;AAAA,QACb,KAAK,iBAAiB,QAAQ;AAAA,MAChC,CAAC;AACD,YAAM,eAAe,MAAM,gBAAgB;AAAA,QACzC;AAAA,QACA;AAAA,UACE,IAAI,QAAQ;AAAA,UACZ,cAAc;AAAA,UACd,YAAY;AAAA,UACZ,WAAW,EAAE,KAAK,kBAAkB;AAAA,QACtC;AAAA,QACA;AAAA,UACE,cAAc;AAAA,UACd,WAAW;AAAA,UACX,YAAY;AAAA,QACd;AAAA,MACF;AACA,UAAI,iBAAiB,GAAG;AACtB,cAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,MAC5E;AACA,aAAO;AAAA,QACL,WAAW;AAAA,QACX,WAAW;AAAA,QACX,YAAY;AAAA,MACd;AAAA,IACF,CAAC;AACD,YAAQ,eAAe;AACvB,YAAQ,YAAY;AACpB,YAAQ,aAAa;AAErB,UAAM,kBAAkB,0BAA0B;AAAA,MAChD,QAAQ,QAAQ;AAAA,MAChB,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,kBAAkB,QAAQ;AAAA,MAC1B,QAAQ;AAAA,MACR,WAAW,UAAU,YAAY;AAAA,IACnC,CAAC;AAED,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC;AAAA,EAEA,MAAM,cACJ,OACA,kBACA,SAKkB;AAClB,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,UAAU,KAAK,gBAAgB,KAAK;AAC1C,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,OAAO,KAAK,IAAI,EAAG,QAAO;AACtC,QAAI,QAAQ,QAAQ,iBAAkB,QAAO;AAC7C,QAAI,SAAS,kBAAkB,QAAQ,QAAQ,QAAQ,eAAgB,QAAO;AAC9E,QAAI,SAAS,aAAa,UAAa,QAAQ,SAAS,QAAQ,YAAY,MAAO,QAAO;AAC1F,QAAI,SAAS,mBAAmB,UAAa,QAAQ,SAAS,QAAQ,kBAAkB,MAAO,QAAO;AAEtG,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,aAAa;AAAA,MACjD,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,cAAc;AAAA,MACd;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB,qBAAqB,QAAQ;AAAA,MAC7B,YAAY,EAAE,KAAK,KAAK;AAAA,IAC1B,CAA6B;AAE7B,WAAO,QAAQ,WAAW,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,aACJ,OACA,cACA,OAC8B;AAC9B,UAAM,KAAK,kCAAkC;AAC7C,UAAM,gBAAgB,MAAM,YAAY;AACxC,UAAM,sBAAsB,MAAM,kBAAkB;AACpD,SAAK,cAAc,eAAe,mBAAmB;AACrD,QAAI,MAAO,MAAK,iBAAiB,eAAe,qBAAqB,KAAK;AAC1E,UAAM,KAAK,mBAAmB,MAAM,kBAAkB,eAAe,mBAAmB;AAExF,UAAM,SAAS,KAAK,GAAG,OAAO,qBAAqB;AAAA,MACjD,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,OAAO,MAAM,SAAS;AAAA,MACtB,kBAAkB,MAAM;AAAA,MACxB,WAAW,MAAM;AAAA,MACjB,YAAY,KAAK,aAAa,MAAM,UAAU;AAAA,MAC9C,iBAAiB,MAAM;AAAA,MACvB;AAAA,MACA,oBAAoB;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,MAAM;AACtB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,MACzB;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aACJ,IACA,OACA,cACA,OAC8B;AAC9B,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,OAAO;AACT,WAAK,iBAAiB,OAAO,YAAY,MAAM,OAAO,kBAAkB,MAAM,KAAK;AACnF,UAAI,OAAO,sBAAsB,CAAC,MAAM,cAAc;AACpD,cAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,MACzE;AAAA,IACF;AAEA,UAAM,eAAe,MAAM,aAAa,SAAY,MAAM,YAAY,OAAO,OAAO,YAAY;AAChG,UAAM,qBAAqB,MAAM,mBAAmB,SAAY,MAAM,kBAAkB,OAAO,OAAO,kBAAkB;AACxH,UAAM,uBAAuB,MAAM,oBAAoB,OAAO;AAC9D,SAAK,cAAc,cAAc,kBAAkB;AACnD,QAAI,MAAO,MAAK,iBAAiB,cAAc,oBAAoB,KAAK;AACxE,UAAM,KAAK,mBAAmB,sBAAsB,cAAc,oBAAoB,OAAO,EAAE;AAE/F,QAAI,MAAM,aAAa,OAAW,QAAO,WAAW,MAAM,YAAY;AACtE,QAAI,MAAM,mBAAmB,OAAW,QAAO,iBAAiB,MAAM,kBAAkB;AACxF,QAAI,MAAM,UAAU,OAAW,QAAO,QAAQ,MAAM,SAAS;AAC7D,QAAI,MAAM,qBAAqB,OAAW,QAAO,mBAAmB,MAAM;AAC1E,QAAI,MAAM,cAAc,OAAW,QAAO,YAAY,MAAM;AAC5D,QAAI,MAAM,eAAe,OAAW,QAAO,aAAa,KAAK,aAAa,MAAM,UAAU;AAC1F,QAAI,MAAM,oBAAoB,OAAW,QAAO,kBAAkB,MAAM;AACxE,WAAO,eAAe;AACtB,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,MACzB;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,IAAY,OAAsC;AACnE,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,OAAO;AACT,WAAK,iBAAiB,OAAO,YAAY,MAAM,OAAO,kBAAkB,MAAM,KAAK;AACnF,UAAI,OAAO,sBAAsB,CAAC,MAAM,cAAc;AACpD,cAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,MACzE;AAAA,IACF;AACA,WAAO,YAAY,oBAAI,KAAK;AAC5B,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,IAC3B,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,yBACJ,OACe;AACf,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MAC1D,kBAAkB,MAAM;AAAA,MACxB,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,oBAAoB;AAAA,IACtB,CAAC;AAED,QAAI,UAAU;AACZ,YAAM,aAAa,KAAK,aAAa,MAAM,UAAU;AACrD,YAAM,kBAAkB,MAAM,mBAAmB,gBAAgB;AACjE,YAAM,UAAU,CAAC,SAAS,aACrB,QAAQ,SAAS,SAAS,KAC1B,SAAS,eAAe,cACxB,SAAS,oBAAoB;AAClC,UAAI,SAAS;AACX,iBAAS,YAAY;AACrB,iBAAS,YAAY;AACrB,iBAAS,aAAa;AACtB,iBAAS,kBAAkB;AAC3B,iBAAS,YAAY,oBAAI,KAAK;AAC9B,cAAM,KAAK,GAAG,MAAM;AAAA,MACtB;AACA;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,GAAG,OAAO,qBAAqB;AAAA,MACjD,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,OAAO,MAAM,SAAS;AAAA,MACtB,kBAAkB,MAAM;AAAA,MACxB,WAAW;AAAA,MACX,oBAAoB;AAAA,MACpB,YAAY,KAAK,aAAa,MAAM,UAAU;AAAA,MAC9C,iBAAiB,MAAM,mBAAmB,gBAAgB;AAAA,MAC1D,cAAc;AAAA,MACd,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,MAAM;AACtB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,iBAAkC;AACtC,WAAO,KAAK,GAAG,aAAa,aAAa;AAAA,MACvC,WAAW,EAAE,MAAM,oBAAI,KAAK,EAAE;AAAA,IAChC,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,oCAAmD;AAC/D,UAAM,kBAAkB,6BAA6B;AACrD,UAAM,kBAAkB,gBAAgB,QAAQ,CAAC,UAAU,MAAM,WAAW,CAAC,CAAC;AAC9E,UAAM,kBAAkB,gBAAgB,WAAW,IAAI,qBAAqB,CAAC;AAE7E,eAAW,UAAU,kBAAkB;AAAA,MACrC,GAAG;AAAA,MACH,GAAG;AAAA,IACL,CAAC,GAAG;AACF,YAAM,KAAK,yBAAyB,KAAK,qBAAqB,MAAM,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEQ,qBAAqB,QAAqD;AAChF,WAAO;AAAA,MACL,kBAAkB,OAAO;AAAA,MACzB,OAAO,OAAO,SAAS;AAAA,MACvB,YAAY,OAAO;AAAA,MACnB,iBAAiB,KAAK,kBAAkB,OAAO,eAAe;AAAA,IAChE;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,kBACA,UACA,gBACA,UACe;AACf,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MAC1D;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,YAAY,SAAS,OAAO,UAAU;AACxC,YAAM,IAAI,0BAA0B,iEAAiE,GAAG;AAAA,IAC1G;AAAA,EACF;AAAA,EAEQ,cAAc,UAAyB,gBAAqC;AAClF,QAAI,kBAAkB,CAAC,UAAU;AAC/B,YAAM,IAAI,0BAA0B,qDAAqD,GAAG;AAAA,IAC9F;AAAA,EACF;AAAA,EAEQ,uBAAuB,QAA6B,OAA+B;AACzF,QAAI,MAAM,aAAc,QAAO;AAC/B,QAAI,CAAC,MAAM,SAAU,QAAO;AAC5B,UAAM,iBAAiB,OAAO,YAAY;AAC1C,QAAI,mBAAmB,KAAM,QAAO;AACpC,WAAO,mBAAmB,MAAM;AAAA,EAClC;AAAA,EAEQ,iBACN,gBACA,sBACA,OACM;AACN,QAAI,MAAM,aAAc;AACxB,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,SAAK,kBAAkB,UAAU,MAAM,UAAU;AAC/C,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QACE,MAAM,mBAAmB,UACtB,MAAM,mBAAmB,QACzB,yBAAyB,QACzB,yBAAyB,MAAM,gBAClC;AACA,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AAAA,EACF;AAAA,EAEQ,uBACN,kBACA,yBACY;AACZ,QAAI,KAAK,eAAe,IAAI,iBAAiB;AAC3C,aAAO;AAAA,IACT;AACA,QAAI,qBAAqB,gBAAgB,SAAU,QAAO;AAC1D,QAAI,qBAAqB,gBAAgB,KAAK;AAC5C,UAAI,4BAA4B,GAAG;AACjC,cAAM,IAAI,0BAA0B,oEAAoE,GAAG;AAAA,MAC7G;AACA,aAAO;AAAA,IACT;AACA,WAAO,0BAA0B,IAAI,QAAQ;AAAA,EAC/C;AAAA,EAEA,MAAc,kBACZ,IACA,kBACA,UACA,gBACmC;AACnC,UAAM,aAAa,MAAM,GAAG,KAAK,qBAAqB;AAAA,MACpD;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,UAAM,WAAW,WACd,OAAO,CAAC,WAAW,KAAK,aAAa,QAAQ,UAAU,cAAc,CAAC,EACtE,KAAK,CAAC,MAAM,UAAU,KAAK,sBAAsB,MAAM,OAAO,UAAU,cAAc,CAAC,EAAE,CAAC;AAE7F,QAAI,CAAC,YAAY,CAAC,SAAS,WAAW;AACpC,aAAO,EAAE,WAAW,MAAM;AAAA,IAC5B;AAEA,WAAO,EAAE,WAAW,MAAM,QAAQ,SAAS;AAAA,EAC7C;AAAA,EAEQ,aAAa,QAA6B,UAAyB,gBAAwC;AACjH,QAAI,OAAO,gBAAgB;AACzB,aAAO,OAAO,mBAAmB,kBAAkB,OAAO,aAAa;AAAA,IACzE;AACA,QAAI,OAAO,UAAU;AACnB,aAAO,OAAO,aAAa;AAAA,IAC7B;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,sBACN,MACA,OACA,UACA,gBACQ;AACR,UAAM,YAAY,KAAK,iBAAiB,MAAM,UAAU,cAAc;AACtE,UAAM,aAAa,KAAK,iBAAiB,OAAO,UAAU,cAAc;AACxE,QAAI,cAAc,WAAY,QAAO,YAAY;AACjD,QAAI,KAAK,uBAAuB,MAAM,oBAAoB;AACxD,aAAO,KAAK,qBAAqB,IAAI;AAAA,IACvC;AACA,WAAO,MAAM,UAAU,QAAQ,IAAI,KAAK,UAAU,QAAQ;AAAA,EAC5D;AAAA,EAEQ,iBACN,QACA,UACA,gBACQ;AACR,QAAI,OAAO,mBAAmB,kBAAkB,OAAO,aAAa,SAAU,QAAO;AACrF,QAAI,CAAC,OAAO,kBAAkB,OAAO,aAAa,SAAU,QAAO;AACnE,QAAI,CAAC,OAAO,kBAAkB,CAAC,OAAO,YAAY,CAAC,OAAO,mBAAoB,QAAO;AACrF,QAAI,CAAC,OAAO,kBAAkB,CAAC,OAAO,YAAY,OAAO,mBAAoB,QAAO;AACpF,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,kBAAkB,WAAqD;AACnF,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,aAAa,EAAE,IAAI,UAAU,CAAC;AACpE,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,0BAA0B,oCAAoC,GAAG;AAAA,IAC7E;AACA,QAAI,CAAC,QAAQ,oBAAoB,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,qBAAqB;AACtF,YAAM,IAAI,0BAA0B,oCAAoC,GAAG;AAAA,IAC7E;AACA,QAAI,QAAQ,YAAY;AACtB,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AACA,QAAI,QAAQ,UAAU,QAAQ,KAAK,KAAK,IAAI,GAAG;AAC7C,YAAM,IAAI,0BAA0B,kCAAkC,GAAG;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,cAAc,QAA2C;AACrE,UAAM,OAAO,MAAM;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,IAAI,QAAQ,WAAW,KAAK;AAAA,MAC9B;AAAA,MACA,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO;AAAA,MACL,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACtE;AAAA,EACF;AAAA,EAEQ,aAAa,OAA+B;AAClD,UAAM,WAAW,SAAS,KAAK,eAAe,KAAK;AACnD,WAAO,KAAK;AAAA,MACV,KAAK,IAAI,UAAU,KAAK,eAAe,KAAK,aAAa;AAAA,MACzD,KAAK,eAAe,KAAK;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,aAAa,SAA0B;AAC7C,QAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,YAAM,IAAI,0BAA0B,wBAAwB,GAAG;AAAA,IACjE;AACA,UAAM,gBAAiB,QAAoC;AAC3D,QAAI,OAAO,kBAAkB,YAAY,cAAc,KAAK,EAAE,WAAW,GAAG;AAC1E,YAAM,IAAI,0BAA0B,wBAAwB,GAAG;AAAA,IACjE;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,SAAyC;AACzD,UAAM,iBAAiB,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AAChF,UAAM,YAAY,WAAW,UAAU,KAAK,cAAc,CAAC,EAAE,OAAO,cAAc,EAAE,OAAO,WAAW;AACtG,WAAO,GAAG,cAAc,IAAI,SAAS;AAAA,EACvC;AAAA,EAEQ,gBAAgB,OAA8C;AACpE,UAAM,CAAC,gBAAgB,SAAS,IAAI,MAAM,MAAM,GAAG;AACnD,QAAI,CAAC,kBAAkB,CAAC,UAAW,QAAO;AAE1C,UAAM,WAAW,WAAW,UAAU,KAAK,cAAc,CAAC,EAAE,OAAO,cAAc,EAAE,OAAO,WAAW;AACrG,UAAM,kBAAkB,OAAO,KAAK,SAAS;AAC7C,UAAM,iBAAiB,OAAO,KAAK,QAAQ;AAC3C,QAAI,gBAAgB,WAAW,eAAe,OAAQ,QAAO;AAC7D,QAAI,CAAC,gBAAgB,iBAAiB,cAAc,EAAG,QAAO;AAE9D,QAAI;AACF,YAAM,SAAS,6BAA6B;AAAA,QAC1C,KAAK,MAAM,OAAO,KAAK,gBAAgB,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,MACtE;AACA,UAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,aAAO,OAAO;AAAA,IAChB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,gBAAwB;AAC9B,UAAM,SACJ,eAAe,QAAQ,IAAI,uBAAuB,KAC/C,eAAe,QAAQ,IAAI,eAAe,KAC1C,eAAe,QAAQ,IAAI,WAAW,KACtC,eAAe,QAAQ,IAAI,UAAU;AAC1C,QAAI,OAAQ,QAAO;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,kBACN,QAC6B;AAC7B,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO,gBAAgB;AAAA,MACzB,KAAK;AACH,eAAO,gBAAgB;AAAA,MACzB,KAAK;AAAA,MACL;AACE,eAAO,gBAAgB;AAAA,IAC3B;AAAA,EACF;AACF;AAEA,IAAO,+BAAQ;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/enterprise",
-  "version": "0.6.8-develop.7031.1.005201cd70",
+  "version": "0.6.8-develop.7037.1.ea0277b01e",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "main": "./dist/index.js",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@open-mercato/core": "0.6.8-develop.7031.1.005201cd70",
-    "@open-mercato/ui": "0.6.8-develop.7031.1.005201cd70",
+    "@open-mercato/core": "0.6.8-develop.7037.1.ea0277b01e",
+    "@open-mercato/ui": "0.6.8-develop.7037.1.ea0277b01e",
     "@simplewebauthn/browser": "^13.3.0",
     "@simplewebauthn/server": "^13.3.2",
     "@simplewebauthn/types": "^12.0.0",
@@ -76,12 +76,12 @@
     "qrcode": "^1.5.4"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.8-develop.7031.1.005201cd70",
+    "@open-mercato/shared": "0.6.8-develop.7037.1.ea0277b01e",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.8-develop.7031.1.005201cd70",
+    "@open-mercato/shared": "0.6.8-develop.7037.1.ea0277b01e",
     "@types/jest": "^30.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",