@solidxai/core 0.1.13-beta.19 → 0.1.13-beta.20

package/dist/constants/error-messages.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-messages.js","sourceRoot":"","sources":["../../src/constants/error-messages.ts"],"names":[],"mappings":";;;AAEa,QAAA,cAAc,GAAG;IAE1B,cAAc,EAAE,sBAAsB;IACtC,eAAe,EAAE,gCAAgC;IACjD,aAAa,EAAE,mBAAmB;IAClC,eAAe,EAAE,sEAAsE;IACvF,kBAAkB,EAAE,0BAA0B;IAC9C,4BAA4B,EAAE,oCAAoC;IAClE,2BAA2B,EAAE,yCAAyC;IACtE,kCAAkC,EAAE,2CAA2C;IAC/E,6BAA6B,EAAE,iEAAiE;IAChG,6BAA6B,EAAE,gDAAgD;IAC/E,8BAA8B,EAAE,kDAAkD;IAClF,mBAAmB,EAAE,sCAAsC;IAC3D,0BAA0B,EAAE,6CAA6C;IACzE,WAAW,EAAE,cAAc;IAC3B,WAAW,EAAE,kBAAkB;IAC/B,yBAAyB,EAAE,+CAA+C;IAC1E,kBAAkB,EAAE,8DAA8D;IAClF,gBAAgB,EAAE,yBAAyB;IAC3C,iBAAiB,EAAE,+BAA+B;IAClD,0BAA0B,EAAE,uCAAuC;IACnE,eAAe,EAAE,0BAA0B;IAC3C,0BAA0B,EAAE,4BAA4B;IACxD,qBAAqB,EAAE,uBAAuB;IAC9C,aAAa,EAAE,eAAe;IAC9B,oBAAoB,EAAE,sBAAsB;IAC5C,iCAAiC,EAAE,wDAAwD;IAC3F,qDAAqD,EAAE,4EAA4E;IACnI,aAAa,EAAE,2CAA2C;IAE1D,mBAAmB,EAAE,qBAAqB;IAC1C,YAAY,EAAE,cAAc;IAC5B,sBAAsB,EAAE,+CAA+C;IACvE,oBAAoB,EAAE,uBAAuB;IAC7C,sBAAsB,EAAE,iCAAiC;IAGzD,uBAAuB,EAAE,yCAAyC;IAClE,mBAAmB,EAAE,2CAA2C;IAChE,eAAe,EAAE,4CAA4C;IAC7D,eAAe,EAAE,CAAC,KAAe,EAAE,EAAE,CAAC,uCAAuC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IAC/F,0BAA0B,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,uBAAuB,QAAQ,cAAc;IAC/F,cAAc,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,QAAQ,cAAc;IACrE,oBAAoB,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAe,UAAU,mBAAmB;IAG1F,eAAe,EAAE,uDAAuD;IACxE,eAAe,EAAE,gDAAgD;IAGjE,cAAc,EAAE,iEAAiE;IACjF,sBAAsB,EAAE,iEAAiE;IAGzF,SAAS,EAAE,WAAW;IACtB,kBAAkB,EAAE,uCAAuC;IAI3D,eAAe,EAAE,sEAAsE;IAGvF,sBAAsB,EAAE,4BAA4B;IACpD,sBAAsB,EAAE,8BAA8B;IAGtD,2BAA2B,EAAE,8CAA8C;IAC3E,4BAA4B,EAAE,iDAAiD;IAC/E,+BAA+B,EAAE,wJAAwJ;IACzL,6BAA6B,EAAE,yCAAyC;IACxE,gBAAgB,EAAE,4BAA4B;IAI9C,2BAA2B,EAAE,2DAA2D;IACxF,kBAAkB,EAAE,2EAA2E;IAC/F,cAAc,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,WAAW,MAAM,SAAS;IAI9D,0BAA0B,EAAE,+CAA+C;IAC3E,iDAAiD,EAAE,wDAAwD;IAC3G,2DAA2D,EAAE,kEAAkE;IAC/H,eAAe,EAAE,CAAC,EAAmB,EAAE,EAAE,CAAC,qBAAqB,EAAE,SAAS;IAC1E,kBAAkB,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,uDAAuD,QAAQ,yBAAyB;IAClI,iBAAiB,EAAE,gDAAgD;IACnE,kBAAkB,EAAE,gDAAgD;IAEpE,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,oBAAoB;IACrC,yBAAyB,EAAE,+DAA+D;IAG1F,wBAAwB,EAAE,CAAC,EAAmB,EAAE,EAAE,CAAC,0BAA0B,EAAE,aAAa;IAC5F,uBAAuB,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,qBAAqB,KAAK,aAAa;IACnF,uCAAuC,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,kEAAkE,SAAS,EAAE;IAC7I,eAAe,EAAE,CAAC,YAAqB,EAAE,EAAE,CAAC,QAAQ,YAAY,CAAC,CAAC,CAAC,wBAAwB,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa;IAC5H,kCAAkC,EAAE,yDAAyD;IAG7F,gBAAgB,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,oBAAoB,UAAU,aAAa;IACrF,mBAAmB,EAAE,CAAC,EAAmB,EAAE,EAAE,CAAC,kBAAkB,EAAE,aAAa;IAG/E,gBAAgB,EAAE,CAAC,MAAwB,EAAE,EAAE,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa;IAChG,oBAAoB,EAAE,6CAA6C;IACnE,kBAAkB,EAAE,2CAA2C;IAG/D,uBAAuB,EAAE,CAAC,EAAmB,EAAE,EAAE,CAAC,wDAAwD,EAAE,GAAG;IAC/G,yBAAyB,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,iCAAiC,GAAG,EAAE;IAGlF,mCAAmC,EAAE,CAAC,EAAmB,EAAE,EAAE,CAAC,gCAAgC,EAAE,aAAa;IAC7G,gCAAgC,EAAE,kCAAkC;IAGpE,wBAAwB,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,6BAA6B,QAAQ,EAAE;IAGvF,gCAAgC,EAAE,gEAAgE;IAClG,+BAA+B,EAAE,iFAAiF;IAClH,6BAA6B,EAAE,uCAAuC;IAEtE,4CAA4C,EAAE,wBAAwB;IAEtE,mBAAmB,EAAE;QACrB,UAAU,EAAE,CAAC,KAAc,EAAE,EAAE,CAC7B,wCAAwC,KAAK,IAAI,OAAO,WAAW;KACtB;CAElD,CAAC","sourcesContent":["// backend/common/constants/error-messages.ts\n\nexport const ERROR_MESSAGES = {\n    //authentication errors\n    USER_NOT_FOUND: 'User does not exist.',\n    USER_NOT_ACTIVE: 'User profile is not activated.',\n    USER_INACTIVE: 'User is inactive.',\n    ACCOUNT_BLOCKED: 'Your account has been blocked due to multiple failed login attempts.',\n    PASSWORD_INCORRECT: 'Password does not match.',\n    PUBLIC_REGISTRATION_DISABLED: 'Public registrations are disabled.',\n    UNIQUE_CONSTRAINT_VIOLATION: 'A unique constraint violation occurred.',\n    PASSWORDLESS_REGISTRATION_DISABLED: 'Passwordless registration is not enabled.',\n    REGISTRATION_REQUIRES_CONTACT: 'Either mobile or email is required for initiating registration.',\n    EMAIL_REQUIRED_FOR_VALIDATION: 'Email is required for email validation source.',\n    MOBILE_REQUIRED_FOR_VALIDATION: 'Mobile is required for mobile validation source.',\n    USER_ALREADY_EXISTS: 'User already exists. Please sign in.',\n    VALIDATION_SOURCE_REQUIRED: 'At least one validation source is required.',\n    INVALID_OTP: 'Invalid OTP.',\n    OTP_EXPIRED: 'OTP has expired.',\n    INVALID_VERIFICATION_TYPE: 'Invalid type. Must be either email or mobile.',\n    NON_LOCAL_PROVIDER: 'User seems to have used a passwordless mode to authenticate.',\n    USER_ID_MISMATCH: \"User ID's do not match.\",\n    USERNAME_MISMATCH: \"User username's do not match.\",\n    INCORRECT_CURRENT_PASSWORD: 'Incorrect current password specified.',\n    PASSWORD_REUSED: 'Try a different password',\n    INVALID_VERIFICATION_TOKEN: 'Invalid verification token',\n    INVALID_REFRESH_TOKEN: 'Invalid refresh token',\n    ACCESS_DENIED: 'Access denied',\n    INVALID_USER_PROFILE: 'Invalid user profile',\n    GOOGLE_OAUTH_PROFILE_FETCH_FAILED: 'Failed to fetch user profile from Google OAuth service',\n    MICROSOFT_ACTIVE_DIRECTORY_OAUTH_PROFILE_FETCH_FAILED: 'Failed to fetch user profile from Microsoft Active Directory OAuth service',\n    LOGOUT_FAILED: 'Logout failed due to an unexpected error.',\n\n    INVALID_CREDENTIALS: 'Invalid credentials',\n    LOGIN_FAILED: 'Login Failed',\n    OLD_PASSWORD_INCORRECT: 'You have specified an incorrect old password.',\n    INVALID_NEW_PASSWORD: 'Invalid new password.',\n    PASSWORDS_DO_NOT_MATCH: 'New passwords are not matching.',\n\n    // user management errors\n    DELETE_SELF_NOT_ALLOWED: 'Deleting logged-in user is not allowed.',\n    DELETE_IDS_REQUIRED: 'At least one ID is required for deletion.',\n    USER_MISSING_ID: 'User must exist before initializing roles.',\n    ROLES_NOT_FOUND: (roles: string[]) => `The following roles were not found: ${roles.join(', ')}`,\n    USER_NOT_FOUND_BY_USERNAME: (username: string) => `User with username '${username}' not found.`,\n    ROLE_NOT_FOUND: (roleName: string) => `Role '${roleName}' not found.`,\n    PERMISSION_NOT_EXIST: (permission: string) => `Permission '${permission}' does not exist.`,\n\n    // session errors\n    SESSION_INVALID: 'Your session is no longer valid. Please log in again.',\n    SESSION_EXPIRED: 'Your session has expired. Please log in again.',\n\n    // filter errors\n    GROUP_BY_LIMIT: 'buildFilterQuery: Only 1 Group by field is supported currently.',\n    INVALID_GROUP_BY_COUNT: 'Exactly one groupBy field is required to count grouped records.',\n\n    // general errors\n    FORBIDDEN: 'Forbidden',\n    RESOURCE_NOT_FOUND: 'The requested resource was not found.',\n\n\n    // database errors\n    DUPLICATE_ENTRY: 'Duplicate entry. A record with similar unique fields already exists.',\n\n    // validation errors\n    ID_REQUIRED_FOR_UPDATE: 'Id is required for update.',\n    ID_REQUIRED_FOR_DELETE: 'Id is required for deletion.',\n\n    // CRUD service errors\n    RELATION_TYPE_NOT_SUPPORTED: 'Relation type not supported in CRUD service.',\n    NO_SOFT_DELETED_RECORD_FOUND: 'No soft-deleted record found with the given ID.',\n    CONFLICTING_RECORD_ON_UNARCHIVE: 'Another record is conflicting with the record you are attempting to Un-Archive, either delete or change the other record so as to avoid this conflict.',\n    NO_SOFT_DELETED_RECORDS_FOUND: 'No matching soft-deleted records found.',\n    EMPTY_PATH_PARTS: 'Path parts cannot be empty',\n\n\n    // CSV/Excel service errors\n    MISSING_HEADERS_OR_FUNCTION: 'Either headers or data records function must be provided.',\n    INVALID_CHUNK_SIZE: 'Chunk size must be greater than 0 when data records function is provided.',\n    INVALID_FORMAT: (format: string) => `Invalid ${format} format`,\n\n\n    //field errors\n    INVALID_INVERSE_FIELD_TYPE: 'Only relation fields can have inverse fields.',\n    MODEL_AND_MODULE_REQUIRED_TO_UPDATE_INVERSE_FIELD: 'Model and module are required to update inverse field.',\n    MODEL_NAME_AND_MODULE_NAME_REQUIRED_TO_CREATE_INVERSE_FIELD: 'Model name and module name are required to create inverse field.',\n    FIELD_NOT_FOUND: (id: number | string) => `No field with id #${id} exists`,\n    PROVIDER_NOT_FOUND: (provider: string) => `Field incorrectly configured. No provider with name ${provider} registered in backend.`,\n    FILE_WRITE_FAILED: 'File creation failed, rolling back transaction',\n    FILE_DELETE_FAILED: 'File deletion failed, rolling back transaction',\n    // file service errors\n    FILE_NOT_FOUND: 'File not found',\n    FILE_COPY_ERROR: 'Error copying file',\n    S3_CLIENT_NOT_INITIALIZED: 'S3 Client not initialized. Please check the S3 configuration.',\n\n    // model errors\n    MODEL_METADATA_NOT_FOUND: (id: string | number) => `Model metadata with ID ${id} not found.`,\n    MODEL_SERVICE_NOT_FOUND: (model: string) => `Model service for ${model} not found.`,\n    RELATION_CO_MODEL_NOT_DEFINED_FOR_FIELD: (fieldName: string) => `Relation coModelSingularName is not defined for relation field ${fieldName}`,\n    MODEL_NOT_FOUND: (singularName?: string) => `Model${singularName ? ` with singular name \"${singularName}\"` : ''} not found.`,\n    MODEL_REQUIRED_FOR_CODE_GENERATION: 'Model ID or Model Name is required for generating code.',\n\n    //module errors\n    MODULE_NOT_FOUND: (moduleName: string) => `Module with name ${moduleName} not found.`,\n    MODULE_ID_NOT_FOUND: (id: string | number) => `Module with ID ${id} not found.`,\n\n    //entity errors\n    ENTITY_NOT_FOUND: (entity?: string | number) => `Entity${entity ? ' ' + entity : ''} not found.`,\n    ENTITY_NAME_REQUIRED: 'Entity name is required to find the entity.',\n    ENTITY_ID_REQUIRED: 'Entity ID is required to find the entity.',\n\n    // import errors\n    NO_ERROR_LOG_FOR_IMPORT: (id: string | number) => `No error log entries found for import transaction ID ${id}.`,\n    FILE_READ_FAILED_FROM_URL: (url: string) => `Failed to read file from URL: ${url}`,\n\n    // media storage provider errors\n    MEDIA_STORAGE_PROVIDER_ID_NOT_FOUND: (id: number | string) => `Media Storage Provider with #${id} not found.`,\n    MEDIA_STORAGE_PROVIDER_NOT_FOUND: 'Media Storage Provider not found',\n\n    // SQL errors\n    UNSUPPORTED_SQL_OPERATOR: (operator: string) => `Unsupported SQL operator: ${operator}`,\n\n    // AI interaction errors\n    PYTHON_EXECUTABLE_NOT_CONFIGURED: 'SolidX AI MCP python executable or client path not configured.',\n    UNABLE_TO_RESOLVE_SOLID_COMMAND: 'Unable to resolve a solid_ command that was used to come up with this response.',\n    UNABLE_TO_RESOLVE_MCP_HANDLER: 'Unable to resolve a mcp tool handler.',\n\n    DEFAULT_REGEX_PATTERN_NOT_MATCHING_ERROR_MSG: 'Invalid regex pattern.',\n\n    PERMISSION_MESSAGES: {\n    insertMany: (model?: string) =>\n      `You do not have permission to import ${model ?? 'these'} records.`,\n    } as Record<string, (model?: string) => string>,\n\n};\n"]}
+{"version":3,"file":"error-messages.js","sourceRoot":"","sources":["../../src/constants/error-messages.ts"],"names":[],"mappings":";;;AAEa,QAAA,cAAc,GAAG;IAE1B,cAAc,EAAE,sBAAsB;IACtC,eAAe,EAAE,gCAAgC;IACjD,aAAa,EAAE,mBAAmB;IAClC,eAAe,EAAE,sEAAsE;IACvF,kBAAkB,EAAE,0BAA0B;IAC9C,4BAA4B,EAAE,oCAAoC;IAClE,2BAA2B,EAAE,yCAAyC;IACtE,kCAAkC,EAAE,2CAA2C;IAC/E,6BAA6B,EAAE,iEAAiE;IAChG,6BAA6B,EAAE,gDAAgD;IAC/E,8BAA8B,EAAE,kDAAkD;IAClF,mBAAmB,EAAE,sCAAsC;IAC3D,0BAA0B,EAAE,6CAA6C;IACzE,WAAW,EAAE,cAAc;IAC3B,WAAW,EAAE,kBAAkB;IAC/B,yBAAyB,EAAE,+CAA+C;IAC1E,kBAAkB,EAAE,8DAA8D;IAClF,gBAAgB,EAAE,yBAAyB;IAC3C,iBAAiB,EAAE,+BAA+B;IAClD,0BAA0B,EAAE,uCAAuC;IACnE,eAAe,EAAE,0BAA0B;IAC3C,0BAA0B,EAAE,4BAA4B;IACxD,qBAAqB,EAAE,uBAAuB;IAC9C,aAAa,EAAE,eAAe;IAC9B,oBAAoB,EAAE,sBAAsB;IAC5C,iCAAiC,EAAE,wDAAwD;IAC3F,qDAAqD,EAAE,4EAA4E;IACnI,aAAa,EAAE,2CAA2C;IAE1D,mBAAmB,EAAE,qBAAqB;IAC1C,YAAY,EAAE,cAAc;IAC5B,sBAAsB,EAAE,+CAA+C;IACvE,oBAAoB,EAAE,uBAAuB;IAC7C,sBAAsB,EAAE,iCAAiC;IAGzD,uBAAuB,EAAE,yCAAyC;IAClE,mBAAmB,EAAE,2CAA2C;IAChE,eAAe,EAAE,4CAA4C;IAC7D,eAAe,EAAE,CAAC,KAAe,EAAE,EAAE,CAAC,uCAAuC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IAC/F,0BAA0B,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,uBAAuB,QAAQ,cAAc;IAC/F,cAAc,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,QAAQ,cAAc;IACrE,oBAAoB,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAe,UAAU,mBAAmB;IAG1F,eAAe,EAAE,uDAAuD;IACxE,eAAe,EAAE,gDAAgD;IAGjE,cAAc,EAAE,iEAAiE;IACjF,sBAAsB,EAAE,iEAAiE;IAGzF,SAAS,EAAE,WAAW;IACtB,kBAAkB,EAAE,uCAAuC;IAI3D,eAAe,EAAE,sEAAsE;IAGvF,sBAAsB,EAAE,4BAA4B;IACpD,sBAAsB,EAAE,8BAA8B;IAGtD,2BAA2B,EAAE,8CAA8C;IAC3E,4BAA4B,EAAE,iDAAiD;IAC/E,+BAA+B,EAAE,wJAAwJ;IACzL,6BAA6B,EAAE,yCAAyC;IACxE,gBAAgB,EAAE,4BAA4B;IAI9C,2BAA2B,EAAE,2DAA2D;IACxF,kBAAkB,EAAE,2EAA2E;IAC/F,cAAc,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,WAAW,MAAM,SAAS;IAI9D,0BAA0B,EAAE,+CAA+C;IAC3E,iDAAiD,EAAE,wDAAwD;IAC3G,2DAA2D,EAAE,kEAAkE;IAC/H,eAAe,EAAE,CAAC,EAAmB,EAAE,EAAE,CAAC,qBAAqB,EAAE,SAAS;IAC1E,kBAAkB,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,uDAAuD,QAAQ,yBAAyB;IAClI,iBAAiB,EAAE,gDAAgD;IACnE,kBAAkB,EAAE,gDAAgD;IAEpE,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,oBAAoB;IACrC,yBAAyB,EAAE,+DAA+D;IAG1F,wBAAwB,EAAE,CAAC,EAAmB,EAAE,EAAE,CAAC,0BAA0B,EAAE,aAAa;IAC5F,uBAAuB,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,qBAAqB,KAAK,aAAa;IACnF,uCAAuC,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,kEAAkE,SAAS,EAAE;IAC7I,eAAe,EAAE,CAAC,YAAqB,EAAE,EAAE,CAAC,QAAQ,YAAY,CAAC,CAAC,CAAC,wBAAwB,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa;IAC5H,kCAAkC,EAAE,yDAAyD;IAG7F,gBAAgB,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,oBAAoB,UAAU,aAAa;IACrF,mBAAmB,EAAE,CAAC,EAAmB,EAAE,EAAE,CAAC,kBAAkB,EAAE,aAAa;IAG/E,gBAAgB,EAAE,CAAC,MAAwB,EAAE,EAAE,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa;IAChG,oBAAoB,EAAE,6CAA6C;IACnE,kBAAkB,EAAE,2CAA2C;IAG/D,uBAAuB,EAAE,CAAC,EAAmB,EAAE,EAAE,CAAC,wDAAwD,EAAE,GAAG;IAC/G,yBAAyB,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,iCAAiC,GAAG,EAAE;IAGlF,mCAAmC,EAAE,CAAC,EAAmB,EAAE,EAAE,CAAC,gCAAgC,EAAE,aAAa;IAC7G,gCAAgC,EAAE,kCAAkC;IAGpE,wBAAwB,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,6BAA6B,QAAQ,EAAE;IAGvF,gCAAgC,EAAE,gEAAgE;IAClG,+BAA+B,EAAE,iFAAiF;IAClH,6BAA6B,EAAE,uCAAuC;IAEtE,4CAA4C,EAAE,wBAAwB;IAQtE,YAAY,EAAE,eAAe;IAC7B,WAAW,EAAE,qEAAqE;IAClF,YAAY,EAAE,0EAA0E;IACxF,gBAAgB,EAAE,8BAA8B;IAChD,mBAAmB,EAAE,yCAAyC;IAC9D,oBAAoB,EAAE,iEAAiE;IACvF,yBAAyB,EAAE,mCAAmC;IAE9D,mBAAmB,EAAE;QACrB,UAAU,EAAE,CAAC,KAAc,EAAE,EAAE,CAC7B,wCAAwC,KAAK,IAAI,OAAO,WAAW;KACtB;CAElD,CAAC","sourcesContent":["// backend/common/constants/error-messages.ts\n\nexport const ERROR_MESSAGES = {\n    //authentication errors\n    USER_NOT_FOUND: 'User does not exist.',\n    USER_NOT_ACTIVE: 'User profile is not activated.',\n    USER_INACTIVE: 'User is inactive.',\n    ACCOUNT_BLOCKED: 'Your account has been blocked due to multiple failed login attempts.',\n    PASSWORD_INCORRECT: 'Password does not match.',\n    PUBLIC_REGISTRATION_DISABLED: 'Public registrations are disabled.',\n    UNIQUE_CONSTRAINT_VIOLATION: 'A unique constraint violation occurred.',\n    PASSWORDLESS_REGISTRATION_DISABLED: 'Passwordless registration is not enabled.',\n    REGISTRATION_REQUIRES_CONTACT: 'Either mobile or email is required for initiating registration.',\n    EMAIL_REQUIRED_FOR_VALIDATION: 'Email is required for email validation source.',\n    MOBILE_REQUIRED_FOR_VALIDATION: 'Mobile is required for mobile validation source.',\n    USER_ALREADY_EXISTS: 'User already exists. Please sign in.',\n    VALIDATION_SOURCE_REQUIRED: 'At least one validation source is required.',\n    INVALID_OTP: 'Invalid OTP.',\n    OTP_EXPIRED: 'OTP has expired.',\n    INVALID_VERIFICATION_TYPE: 'Invalid type. Must be either email or mobile.',\n    NON_LOCAL_PROVIDER: 'User seems to have used a passwordless mode to authenticate.',\n    USER_ID_MISMATCH: \"User ID's do not match.\",\n    USERNAME_MISMATCH: \"User username's do not match.\",\n    INCORRECT_CURRENT_PASSWORD: 'Incorrect current password specified.',\n    PASSWORD_REUSED: 'Try a different password',\n    INVALID_VERIFICATION_TOKEN: 'Invalid verification token',\n    INVALID_REFRESH_TOKEN: 'Invalid refresh token',\n    ACCESS_DENIED: 'Access denied',\n    INVALID_USER_PROFILE: 'Invalid user profile',\n    GOOGLE_OAUTH_PROFILE_FETCH_FAILED: 'Failed to fetch user profile from Google OAuth service',\n    MICROSOFT_ACTIVE_DIRECTORY_OAUTH_PROFILE_FETCH_FAILED: 'Failed to fetch user profile from Microsoft Active Directory OAuth service',\n    LOGOUT_FAILED: 'Logout failed due to an unexpected error.',\n\n    INVALID_CREDENTIALS: 'Invalid credentials',\n    LOGIN_FAILED: 'Login Failed',\n    OLD_PASSWORD_INCORRECT: 'You have specified an incorrect old password.',\n    INVALID_NEW_PASSWORD: 'Invalid new password.',\n    PASSWORDS_DO_NOT_MATCH: 'New passwords are not matching.',\n\n    // user management errors\n    DELETE_SELF_NOT_ALLOWED: 'Deleting logged-in user is not allowed.',\n    DELETE_IDS_REQUIRED: 'At least one ID is required for deletion.',\n    USER_MISSING_ID: 'User must exist before initializing roles.',\n    ROLES_NOT_FOUND: (roles: string[]) => `The following roles were not found: ${roles.join(', ')}`,\n    USER_NOT_FOUND_BY_USERNAME: (username: string) => `User with username '${username}' not found.`,\n    ROLE_NOT_FOUND: (roleName: string) => `Role '${roleName}' not found.`,\n    PERMISSION_NOT_EXIST: (permission: string) => `Permission '${permission}' does not exist.`,\n\n    // session errors\n    SESSION_INVALID: 'Your session is no longer valid. Please log in again.',\n    SESSION_EXPIRED: 'Your session has expired. Please log in again.',\n\n    // filter errors\n    GROUP_BY_LIMIT: 'buildFilterQuery: Only 1 Group by field is supported currently.',\n    INVALID_GROUP_BY_COUNT: 'Exactly one groupBy field is required to count grouped records.',\n\n    // general errors\n    FORBIDDEN: 'Forbidden',\n    RESOURCE_NOT_FOUND: 'The requested resource was not found.',\n\n\n    // database errors\n    DUPLICATE_ENTRY: 'Duplicate entry. A record with similar unique fields already exists.',\n\n    // validation errors\n    ID_REQUIRED_FOR_UPDATE: 'Id is required for update.',\n    ID_REQUIRED_FOR_DELETE: 'Id is required for deletion.',\n\n    // CRUD service errors\n    RELATION_TYPE_NOT_SUPPORTED: 'Relation type not supported in CRUD service.',\n    NO_SOFT_DELETED_RECORD_FOUND: 'No soft-deleted record found with the given ID.',\n    CONFLICTING_RECORD_ON_UNARCHIVE: 'Another record is conflicting with the record you are attempting to Un-Archive, either delete or change the other record so as to avoid this conflict.',\n    NO_SOFT_DELETED_RECORDS_FOUND: 'No matching soft-deleted records found.',\n    EMPTY_PATH_PARTS: 'Path parts cannot be empty',\n\n\n    // CSV/Excel service errors\n    MISSING_HEADERS_OR_FUNCTION: 'Either headers or data records function must be provided.',\n    INVALID_CHUNK_SIZE: 'Chunk size must be greater than 0 when data records function is provided.',\n    INVALID_FORMAT: (format: string) => `Invalid ${format} format`,\n\n\n    //field errors\n    INVALID_INVERSE_FIELD_TYPE: 'Only relation fields can have inverse fields.',\n    MODEL_AND_MODULE_REQUIRED_TO_UPDATE_INVERSE_FIELD: 'Model and module are required to update inverse field.',\n    MODEL_NAME_AND_MODULE_NAME_REQUIRED_TO_CREATE_INVERSE_FIELD: 'Model name and module name are required to create inverse field.',\n    FIELD_NOT_FOUND: (id: number | string) => `No field with id #${id} exists`,\n    PROVIDER_NOT_FOUND: (provider: string) => `Field incorrectly configured. No provider with name ${provider} registered in backend.`,\n    FILE_WRITE_FAILED: 'File creation failed, rolling back transaction',\n    FILE_DELETE_FAILED: 'File deletion failed, rolling back transaction',\n    // file service errors\n    FILE_NOT_FOUND: 'File not found',\n    FILE_COPY_ERROR: 'Error copying file',\n    S3_CLIENT_NOT_INITIALIZED: 'S3 Client not initialized. Please check the S3 configuration.',\n\n    // model errors\n    MODEL_METADATA_NOT_FOUND: (id: string | number) => `Model metadata with ID ${id} not found.`,\n    MODEL_SERVICE_NOT_FOUND: (model: string) => `Model service for ${model} not found.`,\n    RELATION_CO_MODEL_NOT_DEFINED_FOR_FIELD: (fieldName: string) => `Relation coModelSingularName is not defined for relation field ${fieldName}`,\n    MODEL_NOT_FOUND: (singularName?: string) => `Model${singularName ? ` with singular name \"${singularName}\"` : ''} not found.`,\n    MODEL_REQUIRED_FOR_CODE_GENERATION: 'Model ID or Model Name is required for generating code.',\n\n    //module errors\n    MODULE_NOT_FOUND: (moduleName: string) => `Module with name ${moduleName} not found.`,\n    MODULE_ID_NOT_FOUND: (id: string | number) => `Module with ID ${id} not found.`,\n\n    //entity errors\n    ENTITY_NOT_FOUND: (entity?: string | number) => `Entity${entity ? ' ' + entity : ''} not found.`,\n    ENTITY_NAME_REQUIRED: 'Entity name is required to find the entity.',\n    ENTITY_ID_REQUIRED: 'Entity ID is required to find the entity.',\n\n    // import errors\n    NO_ERROR_LOG_FOR_IMPORT: (id: string | number) => `No error log entries found for import transaction ID ${id}.`,\n    FILE_READ_FAILED_FROM_URL: (url: string) => `Failed to read file from URL: ${url}`,\n\n    // media storage provider errors\n    MEDIA_STORAGE_PROVIDER_ID_NOT_FOUND: (id: number | string) => `Media Storage Provider with #${id} not found.`,\n    MEDIA_STORAGE_PROVIDER_NOT_FOUND: 'Media Storage Provider not found',\n\n    // SQL errors\n    UNSUPPORTED_SQL_OPERATOR: (operator: string) => `Unsupported SQL operator: ${operator}`,\n\n    // AI interaction errors\n    PYTHON_EXECUTABLE_NOT_CONFIGURED: 'SolidX AI MCP python executable or client path not configured.',\n    UNABLE_TO_RESOLVE_SOLID_COMMAND: 'Unable to resolve a solid_ command that was used to come up with this response.',\n    UNABLE_TO_RESOLVE_MCP_HANDLER: 'Unable to resolve a mcp tool handler.',\n\n    DEFAULT_REGEX_PATTERN_NOT_MATCHING_ERROR_MSG: 'Invalid regex pattern.',\n\n    // MPIN errors.\n    // MPIN_INVALID is deliberately shared by \"wrong MPIN\" and \"unknown handle\",\n    // so a failed sign-in never reveals whether the credential handle was real.\n    // MPIN_REVOKED is separate and is returned for any attempt against a\n    // deactivated credential - it discloses nothing useful, since a dead\n    // credential grants no capability, and it lets the client stop retrying.\n    MPIN_INVALID: 'Invalid MPIN.',\n    MPIN_LOCKED: 'MPIN sign-in is temporarily locked due to repeated failed attempts.',\n    MPIN_REVOKED: 'MPIN sign-in has been disabled for this device. Please sign in normally.',\n    MPIN_NOT_ENABLED: 'MPIN sign-in is not enabled.',\n    MPIN_FORMAT_INVALID: 'MPIN does not meet the required format.',\n    MPIN_TOO_PREDICTABLE: 'MPIN is too easy to guess. Avoid repeated or sequential digits.',\n    MPIN_CREDENTIAL_NOT_FOUND: 'MPIN device credential not found.',\n\n    PERMISSION_MESSAGES: {\n    insertMany: (model?: string) =>\n      `You do not have permission to import ${model ?? 'these'} records.`,\n    } as Record<string, (model?: string) => string>,\n\n};\n"]}

package/dist/constants/success-messages.d.ts

@@ -5,6 +5,9 @@ export declare const SUCCESS_MESSAGES: {
     FORGOT_PASSWORD_CONFIRMED: string;
     LOGOUT_SUCCESS: string;
     USER_REGISTERED: string;
+    MPIN_SETUP_SUCCESS: string;
+    MPIN_CHANGED_SUCCESS: string;
+    MPIN_DEVICE_REVOKED: string;
     RECORD_RECOVERED: string;
     SELECTED_RECORDS_RECOVERED: string;
 };

package/dist/constants/success-messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"success-messages.d.ts","sourceRoot":"","sources":["../../src/constants/success-messages.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB;;;;;;;;;CAY5B,CAAC"}
+{"version":3,"file":"success-messages.d.ts","sourceRoot":"","sources":["../../src/constants/success-messages.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB;;;;;;;;;;;;CAiB5B,CAAC"}

package/dist/constants/success-messages.js

@@ -8,6 +8,9 @@ exports.SUCCESS_MESSAGES = {
     FORGOT_PASSWORD_CONFIRMED: 'Forgot password confirmed.',
     LOGOUT_SUCCESS: 'Logged out successfully',
     USER_REGISTERED: 'User registered successfully.',
+    MPIN_SETUP_SUCCESS: 'MPIN set up successfully.',
+    MPIN_CHANGED_SUCCESS: 'MPIN changed successfully.',
+    MPIN_DEVICE_REVOKED: 'MPIN sign-in removed for this device.',
     RECORD_RECOVERED: 'Record successfully recovered',
     SELECTED_RECORDS_RECOVERED: 'Selected records successfully recovered',
 };

package/dist/constants/success-messages.js.map

@@ -1 +1 @@
-{"version":3,"file":"success-messages.js","sourceRoot":"","sources":["../../src/constants/success-messages.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG;IAC5B,6BAA6B,EAAE,oDAAoD;IACnF,sBAAsB,EAAE,6CAA6C;IACrE,0BAA0B,EAAE,6CAA6C;IACzE,yBAAyB,EAAE,4BAA4B;IACvD,cAAc,EAAE,yBAAyB;IACzC,eAAe,EAAE,+BAA+B;IAGhD,gBAAgB,EAAE,+BAA+B;IACjD,0BAA0B,EAAE,yCAAyC;CAExE,CAAC","sourcesContent":["export const SUCCESS_MESSAGES = {\n    OTP_SENT_SUCCESS_REGISTRATION: 'User registration initiated. OTP sent to the user.',\n    OTP_SENT_SUCCESS_LOGIN: 'User login initiated. OTP sent to the user.',\n    FORGOT_PASSWORD_TOKEN_SENT: 'Forgot password - token generated and sent.',\n    FORGOT_PASSWORD_CONFIRMED: 'Forgot password confirmed.',\n    LOGOUT_SUCCESS: 'Logged out successfully',\n    USER_REGISTERED: 'User registered successfully.',\n\n    // CRUD service messages\n    RECORD_RECOVERED: 'Record successfully recovered',\n    SELECTED_RECORDS_RECOVERED: 'Selected records successfully recovered',\n\n};\n"]}
+{"version":3,"file":"success-messages.js","sourceRoot":"","sources":["../../src/constants/success-messages.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG;IAC5B,6BAA6B,EAAE,oDAAoD;IACnF,sBAAsB,EAAE,6CAA6C;IACrE,0BAA0B,EAAE,6CAA6C;IACzE,yBAAyB,EAAE,4BAA4B;IACvD,cAAc,EAAE,yBAAyB;IACzC,eAAe,EAAE,+BAA+B;IAGhD,kBAAkB,EAAE,2BAA2B;IAC/C,oBAAoB,EAAE,4BAA4B;IAClD,mBAAmB,EAAE,uCAAuC;IAG5D,gBAAgB,EAAE,+BAA+B;IACjD,0BAA0B,EAAE,yCAAyC;CAExE,CAAC","sourcesContent":["export const SUCCESS_MESSAGES = {\n    OTP_SENT_SUCCESS_REGISTRATION: 'User registration initiated. OTP sent to the user.',\n    OTP_SENT_SUCCESS_LOGIN: 'User login initiated. OTP sent to the user.',\n    FORGOT_PASSWORD_TOKEN_SENT: 'Forgot password - token generated and sent.',\n    FORGOT_PASSWORD_CONFIRMED: 'Forgot password confirmed.',\n    LOGOUT_SUCCESS: 'Logged out successfully',\n    USER_REGISTERED: 'User registered successfully.',\n\n    // MPIN messages\n    MPIN_SETUP_SUCCESS: 'MPIN set up successfully.',\n    MPIN_CHANGED_SUCCESS: 'MPIN changed successfully.',\n    MPIN_DEVICE_REVOKED: 'MPIN sign-in removed for this device.',\n\n    // CRUD service messages\n    RECORD_RECOVERED: 'Record successfully recovered',\n    SELECTED_RECORDS_RECOVERED: 'Selected records successfully recovered',\n\n};\n"]}

package/dist/controllers/mpin-authentication.controller.d.ts

@@ -0,0 +1,44 @@
+import { ChangeMpinDto } from '../dtos/change-mpin.dto';
+import { MpinLoginDto } from '../dtos/mpin-login.dto';
+import { SetupMpinDto } from '../dtos/setup-mpin.dto';
+import { ActiveUserData } from '../interfaces/active-user-data.interface';
+import { MpinService } from '../services/mpin.service';
+export declare class MpinAuthenticationController {
+    private readonly mpinService;
+    constructor(mpinService: MpinService);
+    setup(setupMpinDto: SetupMpinDto, activeUser: ActiveUserData): Promise<{
+        credentialRef: string;
+        message: string;
+    }>;
+    change(changeMpinDto: ChangeMpinDto, activeUser: ActiveUserData): Promise<{
+        credentialRef: string;
+        message: string;
+    }>;
+    login(mpinLoginDto: MpinLoginDto): Promise<{
+        accessToken: string;
+        refreshToken: string;
+        user: {
+            id: number;
+            email: string;
+            mobile: string;
+            username: string;
+            forcePasswordChange: boolean;
+            roles: string[];
+        };
+    }>;
+    listDevices(activeUser: ActiveUserData): Promise<{
+        id: number;
+        deviceId: string;
+        deviceName: string;
+        platform: string;
+        isActive: boolean;
+        failedAttempts: number;
+        lockedUntil: Date;
+        lastUsedAt: Date;
+        createdAt: Date;
+    }[]>;
+    revokeDevice(id: number, activeUser: ActiveUserData): Promise<{
+        message: string;
+    }>;
+}
+//# sourceMappingURL=mpin-authentication.controller.d.ts.map

package/dist/controllers/mpin-authentication.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mpin-authentication.controller.d.ts","sourceRoot":"","sources":["../../src/controllers/mpin-authentication.controller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAQvD,qBAEa,4BAA4B;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,WAAW;IAKrD,KAAK,CACO,YAAY,EAAE,YAAY,EACpB,UAAU,EAAE,cAAc;;;;IAQ5C,MAAM,CACM,aAAa,EAAE,aAAa,EACtB,UAAU,EAAE,cAAc;;;;IAU5C,KAAK,CAAS,YAAY,EAAE,YAAY;;;;;;;;;;;;IAMxC,WAAW,CAAe,UAAU,EAAE,cAAc;;;;;;;;;;;IAQpD,YAAY,CACmB,EAAE,EAAE,MAAM,EACvB,UAAU,EAAE,cAAc;;;CAI/C"}

package/dist/controllers/mpin-authentication.controller.js

@@ -0,0 +1,102 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MpinAuthenticationController = void 0;
+const openapi = require("@nestjs/swagger");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const active_user_decorator_1 = require("../decorators/active-user.decorator");
+const public_decorator_1 = require("../decorators/public.decorator");
+const change_mpin_dto_1 = require("../dtos/change-mpin.dto");
+const mpin_login_dto_1 = require("../dtos/mpin-login.dto");
+const setup_mpin_dto_1 = require("../dtos/setup-mpin.dto");
+const mpin_service_1 = require("../services/mpin.service");
+let MpinAuthenticationController = class MpinAuthenticationController {
+    constructor(mpinService) {
+        this.mpinService = mpinService;
+    }
+    setup(setupMpinDto, activeUser) {
+        return this.mpinService.setupMpin(activeUser, setupMpinDto);
+    }
+    change(changeMpinDto, activeUser) {
+        return this.mpinService.changeMpin(activeUser, changeMpinDto);
+    }
+    login(mpinLoginDto) {
+        return this.mpinService.loginWithMpin(mpinLoginDto);
+    }
+    listDevices(activeUser) {
+        return this.mpinService.listDevices(activeUser);
+    }
+    revokeDevice(id, activeUser) {
+        return this.mpinService.revokeDevice(activeUser, id);
+    }
+};
+exports.MpinAuthenticationController = MpinAuthenticationController;
+__decorate([
+    (0, swagger_1.ApiBearerAuth)('jwt'),
+    (0, common_1.Post)('setup'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    openapi.ApiResponse({ status: common_1.HttpStatus.OK }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, active_user_decorator_1.ActiveUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [setup_mpin_dto_1.SetupMpinDto, Object]),
+    __metadata("design:returntype", void 0)
+], MpinAuthenticationController.prototype, "setup", null);
+__decorate([
+    (0, swagger_1.ApiBearerAuth)('jwt'),
+    (0, common_1.Post)('change'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    openapi.ApiResponse({ status: common_1.HttpStatus.OK }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, active_user_decorator_1.ActiveUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [change_mpin_dto_1.ChangeMpinDto, Object]),
+    __metadata("design:returntype", void 0)
+], MpinAuthenticationController.prototype, "change", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, common_1.Post)('login'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    openapi.ApiResponse({ status: common_1.HttpStatus.OK }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [mpin_login_dto_1.MpinLoginDto]),
+    __metadata("design:returntype", void 0)
+], MpinAuthenticationController.prototype, "login", null);
+__decorate([
+    (0, swagger_1.ApiBearerAuth)('jwt'),
+    (0, common_1.Get)('devices'),
+    openapi.ApiResponse({ status: 200 }),
+    __param(0, (0, active_user_decorator_1.ActiveUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], MpinAuthenticationController.prototype, "listDevices", null);
+__decorate([
+    (0, swagger_1.ApiBearerAuth)('jwt'),
+    (0, common_1.Delete)('devices/:id'),
+    openapi.ApiResponse({ status: 200 }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseIntPipe)),
+    __param(1, (0, active_user_decorator_1.ActiveUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Number, Object]),
+    __metadata("design:returntype", void 0)
+], MpinAuthenticationController.prototype, "revokeDevice", null);
+exports.MpinAuthenticationController = MpinAuthenticationController = __decorate([
+    (0, common_1.Controller)('iam/mpin'),
+    (0, swagger_1.ApiTags)('Solid Core'),
+    __metadata("design:paramtypes", [mpin_service_1.MpinService])
+], MpinAuthenticationController);
+//# sourceMappingURL=mpin-authentication.controller.js.map

package/dist/controllers/mpin-authentication.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mpin-authentication.controller.js","sourceRoot":"","sources":["../../src/controllers/mpin-authentication.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAgH;AAChH,6CAAyD;AACzD,+EAAiE;AACjE,qEAAwD;AACxD,6DAAwD;AACxD,2DAAsD;AACtD,2DAAsD;AAEtD,2DAAuD;AAUhD,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IACrC,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAI,CAAC;IAK1D,KAAK,CACO,YAA0B,EACpB,UAA0B;QAExC,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAChE,CAAC;IAKD,MAAM,CACM,aAA4B,EACtB,UAA0B;QAExC,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAClE,CAAC;IAOD,KAAK,CAAS,YAA0B;QACpC,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAID,WAAW,CAAe,UAA0B;QAChD,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAMD,YAAY,CACmB,EAAU,EACvB,UAA0B;QAExC,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;CACJ,CAAA;AAhDY,oEAA4B;AAMrC;IAHC,IAAA,uBAAa,EAAC,KAAK,CAAC;IACpB,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;kCAAd,mBAAU,CAAC,EAAE;IAElB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,kCAAU,GAAE,CAAA;;qCADS,6BAAY;;yDAIrC;AAKD;IAHC,IAAA,uBAAa,EAAC,KAAK,CAAC;IACpB,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;kCAAd,mBAAU,CAAC,EAAE;IAElB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,kCAAU,GAAE,CAAA;;qCADU,+BAAa;;0DAIvC;AAOD;IAHC,IAAA,yBAAM,GAAE;IACR,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;kCAAd,mBAAU,CAAC,EAAE;IAChB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAe,6BAAY;;yDAEvC;AAID;IAFC,IAAA,uBAAa,EAAC,KAAK,CAAC;IACpB,IAAA,YAAG,EAAC,SAAS,CAAC;;IACF,WAAA,IAAA,kCAAU,GAAE,CAAA;;;;+DAExB;AAMD;IAFC,IAAA,uBAAa,EAAC,KAAK,CAAC;IACpB,IAAA,eAAM,EAAC,aAAa,CAAC;;IAEjB,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,qBAAY,CAAC,CAAA;IACzB,WAAA,IAAA,kCAAU,GAAE,CAAA;;;;gEAGhB;uCA/CQ,4BAA4B;IAFxC,IAAA,mBAAU,EAAC,UAAU,CAAC;IACtB,IAAA,iBAAO,EAAC,YAAY,CAAC;qCAEwB,0BAAW;GAD5C,4BAA4B,CAgDxC","sourcesContent":["import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Param, ParseIntPipe, Post } from '@nestjs/common';\nimport { ApiBearerAuth, ApiTags } from '@nestjs/swagger';\nimport { ActiveUser } from '../decorators/active-user.decorator';\nimport { Public } from '../decorators/public.decorator';\nimport { ChangeMpinDto } from '../dtos/change-mpin.dto';\nimport { MpinLoginDto } from '../dtos/mpin-login.dto';\nimport { SetupMpinDto } from '../dtos/setup-mpin.dto';\nimport { ActiveUserData } from '../interfaces/active-user-data.interface';\nimport { MpinService } from '../services/mpin.service';\n\n/**\n * There is deliberately no public \"is MPIN set up for this identifier\" route.\n * That would reintroduce exactly the user-enumeration oracle the opaque\n * credential handle removes. The client decides whether to show the MPIN\n * screen from the presence of its own stored handle.\n */\n@Controller('iam/mpin')\n@ApiTags('Solid Core')\nexport class MpinAuthenticationController {\n    constructor(private readonly mpinService: MpinService) { }\n\n    @ApiBearerAuth('jwt')\n    @Post('setup')\n    @HttpCode(HttpStatus.OK)\n    setup(\n        @Body() setupMpinDto: SetupMpinDto,\n        @ActiveUser() activeUser: ActiveUserData,\n    ) {\n        return this.mpinService.setupMpin(activeUser, setupMpinDto);\n    }\n\n    @ApiBearerAuth('jwt')\n    @Post('change')\n    @HttpCode(HttpStatus.OK)\n    change(\n        @Body() changeMpinDto: ChangeMpinDto,\n        @ActiveUser() activeUser: ActiveUserData,\n    ) {\n        return this.mpinService.changeMpin(activeUser, changeMpinDto);\n    }\n\n    // Public by necessity - the caller has no session yet. The credential\n    // handle is unguessable, so this carries no enumeration surface.\n    @Public()\n    @Post('login')\n    @HttpCode(HttpStatus.OK)\n    login(@Body() mpinLoginDto: MpinLoginDto) {\n        return this.mpinService.loginWithMpin(mpinLoginDto);\n    }\n\n    @ApiBearerAuth('jwt')\n    @Get('devices')\n    listDevices(@ActiveUser() activeUser: ActiveUserData) {\n        return this.mpinService.listDevices(activeUser);\n    }\n\n    // By row id, never by credential handle, so the management UI never has to\n    // hold the secret.\n    @ApiBearerAuth('jwt')\n    @Delete('devices/:id')\n    revokeDevice(\n        @Param('id', ParseIntPipe) id: number,\n        @ActiveUser() activeUser: ActiveUserData,\n    ) {\n        return this.mpinService.revokeDevice(activeUser, id);\n    }\n}\n"]}

package/dist/dtos/change-mpin.dto.d.ts

@@ -0,0 +1,6 @@
+export declare class ChangeMpinDto {
+    credentialRef: string;
+    currentMpin: string;
+    newMpin: string;
+}
+//# sourceMappingURL=change-mpin.dto.d.ts.map

package/dist/dtos/change-mpin.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-mpin.dto.d.ts","sourceRoot":"","sources":["../../src/dtos/change-mpin.dto.ts"],"names":[],"mappings":"AAEA,qBAAa,aAAa;IAItB,aAAa,EAAE,MAAM,CAAC;IAKtB,WAAW,EAAE,MAAM,CAAC;IAKpB,OAAO,EAAE,MAAM,CAAC;CACnB"}

package/dist/dtos/change-mpin.dto.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChangeMpinDto = void 0;
+const openapi = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class ChangeMpinDto {
+    static _OPENAPI_METADATA_FACTORY() {
+        return { credentialRef: { required: true, type: () => String, maxLength: 128 }, currentMpin: { required: true, type: () => String, maxLength: 32 }, newMpin: { required: true, type: () => String, maxLength: 32 } };
+    }
+}
+exports.ChangeMpinDto = ChangeMpinDto;
+__decorate([
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(128),
+    __metadata("design:type", String)
+], ChangeMpinDto.prototype, "credentialRef", void 0);
+__decorate([
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(32),
+    __metadata("design:type", String)
+], ChangeMpinDto.prototype, "currentMpin", void 0);
+__decorate([
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(32),
+    __metadata("design:type", String)
+], ChangeMpinDto.prototype, "newMpin", void 0);
+//# sourceMappingURL=change-mpin.dto.js.map

package/dist/dtos/change-mpin.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-mpin.dto.js","sourceRoot":"","sources":["../../src/dtos/change-mpin.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,qDAAkE;AAElE,MAAa,aAAa;;;;CAezB;AAfD,sCAeC;AAXG;IAHC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,GAAG,CAAC;;oDACO;AAKtB;IAHC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;;kDACM;AAKpB;IAHC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;;8CACE","sourcesContent":["import { IsNotEmpty, IsString, MaxLength } from 'class-validator';\n\nexport class ChangeMpinDto {\n    @IsNotEmpty()\n    @IsString()\n    @MaxLength(128)\n    credentialRef: string;\n\n    @IsNotEmpty()\n    @IsString()\n    @MaxLength(32)\n    currentMpin: string;\n\n    @IsNotEmpty()\n    @IsString()\n    @MaxLength(32)\n    newMpin: string;\n}\n"]}

package/dist/dtos/mpin-login.dto.d.ts

@@ -0,0 +1,5 @@
+export declare class MpinLoginDto {
+    credentialRef: string;
+    mpin: string;
+}
+//# sourceMappingURL=mpin-login.dto.d.ts.map

package/dist/dtos/mpin-login.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mpin-login.dto.d.ts","sourceRoot":"","sources":["../../src/dtos/mpin-login.dto.ts"],"names":[],"mappings":"AAWA,qBAAa,YAAY;IAMrB,aAAa,EAAE,MAAM,CAAC;IAKtB,IAAI,EAAE,MAAM,CAAC;CAChB"}

package/dist/dtos/mpin-login.dto.js

@@ -0,0 +1,33 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MpinLoginDto = void 0;
+const openapi = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class MpinLoginDto {
+    static _OPENAPI_METADATA_FACTORY() {
+        return { credentialRef: { required: true, type: () => String, maxLength: 128 }, mpin: { required: true, type: () => String, maxLength: 32 } };
+    }
+}
+exports.MpinLoginDto = MpinLoginDto;
+__decorate([
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(128),
+    __metadata("design:type", String)
+], MpinLoginDto.prototype, "credentialRef", void 0);
+__decorate([
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(32),
+    __metadata("design:type", String)
+], MpinLoginDto.prototype, "mpin", void 0);
+//# sourceMappingURL=mpin-login.dto.js.map

package/dist/dtos/mpin-login.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mpin-login.dto.js","sourceRoot":"","sources":["../../src/dtos/mpin-login.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,qDAAkE;AAWlE,MAAa,YAAY;;;;CAYxB;AAZD,oCAYC;AANG;IAHC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,GAAG,CAAC;;mDACO;AAKtB;IAHC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;;0CACD","sourcesContent":["import { IsNotEmpty, IsString, MaxLength } from 'class-validator';\n\n/**\n * Deliberately carries no identifier - no mobile, email or username.\n *\n * `credentialRef` is a server-issued 256-bit handle that already points at a\n * single credential row, and therefore at a single user. That is what removes\n * the user-enumeration surface a public login route would otherwise have: an\n * attacker cannot probe \"does this phone number have MPIN?\" because there is\n * nowhere to put a phone number.\n */\nexport class MpinLoginDto {\n    // Bounded so a pathological payload never reaches the regex test or the\n    // hash comparison. The handle is always 64 hex characters.\n    @IsNotEmpty()\n    @IsString()\n    @MaxLength(128)\n    credentialRef: string;\n\n    @IsNotEmpty()\n    @IsString()\n    @MaxLength(32)\n    mpin: string;\n}\n"]}

package/dist/dtos/setup-mpin.dto.d.ts

@@ -0,0 +1,7 @@
+export declare class SetupMpinDto {
+    deviceId: string;
+    mpin: string;
+    deviceName?: string;
+    platform?: string;
+}
+//# sourceMappingURL=setup-mpin.dto.d.ts.map

package/dist/dtos/setup-mpin.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-mpin.dto.d.ts","sourceRoot":"","sources":["../../src/dtos/setup-mpin.dto.ts"],"names":[],"mappings":"AAEA,qBAAa,YAAY;IAOrB,QAAQ,EAAE,MAAM,CAAC;IAsBjB,IAAI,EAAE,MAAM,CAAC;IAYb,UAAU,CAAC,EAAE,MAAM,CAAC;IAMpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/dtos/setup-mpin.dto.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SetupMpinDto = void 0;
+const openapi = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class SetupMpinDto {
+    static _OPENAPI_METADATA_FACTORY() {
+        return { deviceId: { required: true, type: () => String }, mpin: { required: true, type: () => String, maxLength: 32 }, deviceName: { required: false, type: () => String, maxLength: 64, pattern: "/^[\\w\\s.'()-]*$/" }, platform: { required: false, type: () => String, maxLength: 32, pattern: "/^[\\w.-]*$/" } };
+    }
+}
+exports.SetupMpinDto = SetupMpinDto;
+__decorate([
+    (0, class_validator_1.IsUUID)(),
+    __metadata("design:type", String)
+], SetupMpinDto.prototype, "deviceId", void 0);
+__decorate([
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(32),
+    __metadata("design:type", String)
+], SetupMpinDto.prototype, "mpin", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(64),
+    (0, class_validator_1.Matches)(/^[\w\s.'()-]*$/, {
+        message: 'deviceName may contain only letters, numbers, spaces and . \' ( ) - _',
+    }),
+    __metadata("design:type", String)
+], SetupMpinDto.prototype, "deviceName", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(32),
+    (0, class_validator_1.Matches)(/^[\w.-]*$/, { message: 'platform may contain only letters, numbers and . - _' }),
+    __metadata("design:type", String)
+], SetupMpinDto.prototype, "platform", void 0);
+//# sourceMappingURL=setup-mpin.dto.js.map

package/dist/dtos/setup-mpin.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-mpin.dto.js","sourceRoot":"","sources":["../../src/dtos/setup-mpin.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,qDAA+F;AAE/F,MAAa,YAAY;;;;CAgDxB;AAhDD,oCAgDC;AAzCG;IADC,IAAA,wBAAM,GAAE;;8CACQ;AAsBjB;IAHC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;;0CACD;AAYb;IANC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;IACb,IAAA,yBAAO,EAAC,gBAAgB,EAAE;QACvB,OAAO,EAAE,uEAAuE;KACnF,CAAC;;gDACkB;AAMpB;IAJC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;IACb,IAAA,yBAAO,EAAC,WAAW,EAAE,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;;8CACxE","sourcesContent":["import { IsNotEmpty, IsOptional, IsString, IsUUID, Matches, MaxLength } from 'class-validator';\n\nexport class SetupMpinDto {\n    /**\n     * Stable identifier for the physical device, generated once by the client.\n     * Validated as a UUID before it ever reaches a cache key or a bucket name,\n     * so it cannot smuggle delimiters into the keyspace.\n     */\n    @IsUUID()\n    deviceId: string;\n\n    /**\n     * A string, not a number, even though it looks like digits.\n     *\n     * A numeric MPIN cannot carry a leading zero: JSON forbids leading zeros in\n     * number literals, so a client serialising `012345` numerically emits\n     * `12345` and the server stores a five-digit MPIN the user never chose -\n     * which still satisfies the default `^\\d{4,6}$` and so raises no error.\n     * `mpinRegex` is also tenant-configurable and may permit non-digits.\n     *\n     * Note this cannot be enforced here: the global ValidationPipe runs with\n     * `enableImplicitConversion`, so a numeric payload is coerced to a string\n     * before @IsString() sees it. Clients must send a quoted JSON string; that\n     * requirement is documented in the mobile integration guide.\n     *\n     * Length and shape are checked server-side against `mpinRegex`, since that\n     * setting is the single authority. This only bounds the input.\n     */\n    @IsNotEmpty()\n    @IsString()\n    @MaxLength(32)\n    mpin: string;\n\n    /**\n     * Rendered in a device-management list, so it is bounded here rather than\n     * trusting every consuming UI to escape it.\n     */\n    @IsOptional()\n    @IsString()\n    @MaxLength(64)\n    @Matches(/^[\\w\\s.'()-]*$/, {\n        message: 'deviceName may contain only letters, numbers, spaces and . \\' ( ) - _',\n    })\n    deviceName?: string;\n\n    @IsOptional()\n    @IsString()\n    @MaxLength(32)\n    @Matches(/^[\\w.-]*$/, { message: 'platform may contain only letters, numbers and . - _' })\n    platform?: string;\n}\n"]}

package/dist/entities/user-device-credential.entity.d.ts

@@ -0,0 +1,18 @@
+import { CommonEntity } from "../entities/common.entity";
+import { User } from "./user.entity";
+export declare class UserDeviceCredential extends CommonEntity {
+    hashedCredentialRef: string;
+    hashedMpin: string;
+    mpinScheme: string;
+    mpinSchemeVersion: number;
+    deviceId: string;
+    credentialKey: string;
+    deviceName: string;
+    platform: string;
+    isActive: boolean;
+    failedAttempts: number;
+    lockedUntil: Date;
+    lastUsedAt: Date;
+    user: User;
+}
+//# sourceMappingURL=user-device-credential.entity.d.ts.map

package/dist/entities/user-device-credential.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-device-credential.entity.d.ts","sourceRoot":"","sources":["../../src/entities/user-device-credential.entity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAUrC,qBAKa,oBAAqB,SAAQ,YAAY;IASlD,mBAAmB,EAAE,MAAM,CAAC;IAM5B,UAAU,EAAE,MAAM,CAAC;IAKnB,UAAU,EAAE,MAAM,CAAC;IAoBnB,iBAAiB,EAAE,MAAM,CAAC;IAO1B,QAAQ,EAAE,MAAM,CAAC;IAqBjB,aAAa,EAAE,MAAM,CAAC;IAItB,UAAU,EAAE,MAAM,CAAC;IAInB,QAAQ,EAAE,MAAM,CAAC;IAOjB,QAAQ,EAAE,OAAO,CAAC;IAOlB,cAAc,EAAE,MAAM,CAAC;IAIvB,WAAW,EAAE,IAAI,CAAC;IAIlB,UAAU,EAAE,IAAI,CAAC;IAYjB,IAAI,EAAE,IAAI,CAAC;CACd"}

package/dist/entities/user-device-credential.entity.js

@@ -0,0 +1,91 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserDeviceCredential = void 0;
+const openapi = require("@nestjs/swagger");
+const class_transformer_1 = require("class-transformer");
+const common_entity_1 = require("./common.entity");
+const typeorm_1 = require("typeorm");
+const user_entity_1 = require("./user.entity");
+let UserDeviceCredential = class UserDeviceCredential extends common_entity_1.CommonEntity {
+    static _OPENAPI_METADATA_FACTORY() {
+        return { hashedCredentialRef: { required: true, type: () => String }, hashedMpin: { required: true, type: () => String }, mpinScheme: { required: true, type: () => String }, mpinSchemeVersion: { required: true, type: () => Number }, deviceId: { required: true, type: () => String }, credentialKey: { required: true, type: () => String }, deviceName: { required: true, type: () => String }, platform: { required: true, type: () => String }, isActive: { required: true, type: () => Boolean }, failedAttempts: { required: true, type: () => Number }, lockedUntil: { required: true, type: () => Date }, lastUsedAt: { required: true, type: () => Date }, user: { required: true, type: () => require("./user.entity").User } };
+    }
+};
+exports.UserDeviceCredential = UserDeviceCredential;
+__decorate([
+    (0, typeorm_1.Index)({ unique: true }),
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], UserDeviceCredential.prototype, "hashedCredentialRef", void 0);
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], UserDeviceCredential.prototype, "hashedMpin", void 0);
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], UserDeviceCredential.prototype, "mpinScheme", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ default: 1 }),
+    __metadata("design:type", Number)
+], UserDeviceCredential.prototype, "mpinSchemeVersion", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], UserDeviceCredential.prototype, "deviceId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, typeorm_1.Index)({ unique: true }),
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], UserDeviceCredential.prototype, "credentialKey", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, typeorm_1.Column)({ nullable: true }),
+    __metadata("design:type", String)
+], UserDeviceCredential.prototype, "deviceName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, typeorm_1.Column)({ nullable: true }),
+    __metadata("design:type", String)
+], UserDeviceCredential.prototype, "platform", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, typeorm_1.Column)({ default: true }),
+    __metadata("design:type", Boolean)
+], UserDeviceCredential.prototype, "isActive", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, typeorm_1.Column)({ default: 0 }),
+    __metadata("design:type", Number)
+], UserDeviceCredential.prototype, "failedAttempts", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, typeorm_1.Column)({ nullable: true }),
+    __metadata("design:type", Date)
+], UserDeviceCredential.prototype, "lockedUntil", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, typeorm_1.Column)({ nullable: true }),
+    __metadata("design:type", Date)
+], UserDeviceCredential.prototype, "lastUsedAt", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => user_entity_1.User, { nullable: false }),
+    __metadata("design:type", user_entity_1.User)
+], UserDeviceCredential.prototype, "user", void 0);
+exports.UserDeviceCredential = UserDeviceCredential = __decorate([
+    (0, typeorm_1.Entity)("ss_user_device_credential"),
+    (0, typeorm_1.Index)(["user", "deviceId"]),
+    (0, class_transformer_1.Exclude)()
+], UserDeviceCredential);
+//# sourceMappingURL=user-device-credential.entity.js.map

package/dist/entities/user-device-credential.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-device-credential.entity.js","sourceRoot":"","sources":["../../src/entities/user-device-credential.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,yDAAoD;AACpD,mDAA0D;AAC1D,qCAA2D;AAC3D,+CAAqC;AAe9B,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,4BAAY;;;;CA+GrD,CAAA;AA/GY,oDAAoB;AAS7B;IAFC,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,IAAA,gBAAM,GAAE;;iEACmB;AAM5B;IADC,IAAA,gBAAM,GAAE;;wDACU;AAKnB;IADC,IAAA,gBAAM,GAAE;;wDACU;AAoBnB;IADC,IAAA,gBAAM,EAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;;+DACG;AAO1B;IAFC,IAAA,0BAAM,GAAE;IACR,IAAA,gBAAM,GAAE;;sDACQ;AAqBjB;IAHC,IAAA,0BAAM,GAAE;IACR,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,IAAA,gBAAM,GAAE;;2DACa;AAItB;IAFC,IAAA,0BAAM,GAAE;IACR,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;wDACR;AAInB;IAFC,IAAA,0BAAM,GAAE;IACR,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACV;AAOjB;IAFC,IAAA,0BAAM,GAAE;IACR,IAAA,gBAAM,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;sDACR;AAOlB;IAFC,IAAA,0BAAM,GAAE;IACR,IAAA,gBAAM,EAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;;4DACA;AAIvB;IAFC,IAAA,0BAAM,GAAE;IACR,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;8BACd,IAAI;yDAAC;AAIlB;IAFC,IAAA,0BAAM,GAAE;IACR,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;8BACf,IAAI;wDAAC;AAYjB;IADC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,kBAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;8BACrC,kBAAI;kDAAC;+BA9GF,oBAAoB;IALhC,IAAA,gBAAM,EAAC,2BAA2B,CAAC;IAGnC,IAAA,eAAK,EAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3B,IAAA,2BAAO,GAAE;GACG,oBAAoB,CA+GhC","sourcesContent":["import { Exclude, Expose } from \"class-transformer\";\nimport { CommonEntity } from \"src/entities/common.entity\";\nimport { Column, Entity, Index, ManyToOne } from \"typeorm\";\nimport { User } from \"./user.entity\";\n\n/**\n * A per-device MPIN credential.\n *\n * Login presents `credentialRef` (a server-issued opaque handle) plus the MPIN.\n * The handle - not a mobile number or email - is what identifies the account,\n * which is why the login route needs no identifier and offers no user\n * enumeration surface.\n */\n@Entity(\"ss_user_device_credential\")\n// Non-unique: one physical device may legitimately hold credentials for\n// several accounts, and each account setup mints its own row.\n@Index([\"user\", \"deviceId\"])\n@Exclude()\nexport class UserDeviceCredential extends CommonEntity {\n\n    // SHA-256 of the opaque handle, and the login lookup key. Never exposed:\n    // the raw handle is returned to the client once at setup and never stored.\n    // SHA-256 rather than bcrypt because the handle is 256 bits of randomness -\n    // there is nothing to brute-force, so a slow hash would only add latency.\n    // Same treatment as UserApiKey.hashedKey.\n    @Index({ unique: true })\n    @Column()\n    hashedCredentialRef: string;\n\n    // bcrypt hash of the MPIN, via HashingService. Never exposed - same\n    // treatment as User.password. Slow hashing is warranted here: a 4-6 digit\n    // secret is exactly the low-entropy case bcrypt exists for.\n    @Column()\n    hashedMpin: string;\n\n    // Mirrors User.passwordScheme / passwordSchemeVersion so\n    // HashingService.needsRehash can upgrade the hash on a successful login.\n    @Column()\n    mpinScheme: string;\n\n    /**\n     * The hashing *policy* version this row was hashed under - not a version of\n     * MPIN itself. It comes from `HashingService.currentVersion()`, which\n     * `BcryptService` currently returns as **2**, so freshly created rows read\n     * 2, exactly as `ss_user.password_scheme_version` does.\n     *\n     * It matters because `BcryptService.normalize` applies the configured\n     * pepper only when `version >= 2`. Storing the version per row means an\n     * older hash still verifies after the policy changes: `compare()` uses the\n     * version the row was written with, and `needsRehash()` upgrades it on the\n     * next successful login.\n     *\n     * The `default: 1` is inherited from the `User` precedent and is never\n     * reached, since every write path sets this explicitly. Note it would be\n     * *wrong* if it ever were: a row hashed at 2 but recorded as 1 would be\n     * compared without the pepper and could never authenticate.\n     */\n    @Column({ default: 1 })\n    mpinSchemeVersion: number;\n\n    // Client-supplied, stable for the physical device. Used for grouping and\n    // the device-management UI only - never a lookup key. Deliberately NOT\n    // unique: several accounts on one device share a deviceId.\n    @Expose()\n    @Column()\n    deviceId: string;\n\n    /**\n     * Human-readable natural key - `<username>-<deviceId>` - unique per row.\n     *\n     * Neither column alone can serve as the model's user key: `deviceId` is\n     * shared by every account on a device, and `deviceName` is nullable.\n     * Combining them is unique in both directions - one user across many\n     * devices, and many users on one device.\n     *\n     * Populated by MpinService rather than declared as a `computed` field in\n     * the metadata manifest. Computed fields are evaluated by\n     * ComputedFieldCrudManager on the generic CRUD path (`crud.service.ts`),\n     * which this service bypasses by writing through the repository directly,\n     * so a computed declaration would silently leave this null. It is also\n     * beyond ConcatComputedFieldProvider, which resolves `dto[field]` flatly\n     * within one model and cannot reach `username` across the user relation.\n     */\n    @Expose()\n    @Index({ unique: true })\n    @Column()\n    credentialKey: string;\n\n    @Expose()\n    @Column({ nullable: true })\n    deviceName: string;\n\n    @Expose()\n    @Column({ nullable: true })\n    platform: string;\n\n    // Revocation is a soft-delete: the row survives so that a correct MPIN can\n    // be answered with \"this device was removed\" rather than a baffling\n    // \"incorrect MPIN\". Only active rows count towards mpinMaxDevicesPerUser.\n    @Expose()\n    @Column({ default: true })\n    isActive: boolean;\n\n    // Cumulative, and reset only on a successful login - never when a lockout\n    // expires. That is what makes the second threshold detectable without a\n    // separate lockout counter.\n    @Expose()\n    @Column({ default: 0 })\n    failedAttempts: number;\n\n    @Expose()\n    @Column({ nullable: true })\n    lockedUntil: Date;\n\n    @Expose()\n    @Column({ nullable: true })\n    lastUsedAt: Date;\n\n    // Deliberately no inverse property on User. Nothing needs\n    // `user.deviceCredentials`, and leaving the most widely referenced entity\n    // in the system untouched keeps this feature purely additive.\n    //\n    // `nullable: false` because TypeORM makes relations nullable by default,\n    // which would let a credential exist with no owner. Such a row could never\n    // authenticate - loginWithMpin rejects it - so it would simply be dead\n    // data, but the database should refuse it outright. This also keeps the\n    // column honest against the metadata manifest, which declares it required.\n    @ManyToOne(() => User, { nullable: false })\n    user: User;\n}\n"]}

package/dist/helpers/solid-core-error-codes-provider.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"solid-core-error-codes-provider.service.d.ts","sourceRoot":"","sources":["../../src/helpers/solid-core-error-codes-provider.service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAG1E,qBAEa,2BAA4B,YAAW,kBAAkB;IAClE,IAAI,IAAI,MAAM;IAId,KAAK,IAAI,aAAa,CAAC,SAAS,CAAC;IAwEjC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;CAI/C"}
+{"version":3,"file":"solid-core-error-codes-provider.service.d.ts","sourceRoot":"","sources":["../../src/helpers/solid-core-error-codes-provider.service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAG1E,qBAEa,2BAA4B,YAAW,kBAAkB;IAClE,IAAI,IAAI,MAAM;IAId,KAAK,IAAI,aAAa,CAAC,SAAS,CAAC;IA6HjC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;CAI/C"}

package/dist/helpers/solid-core-error-codes-provider.service.js

@@ -34,6 +34,51 @@ let SolidCoreErrorCodesProvider = class SolidCoreErrorCodesProvider {
                     httpStatus: 401,
                 },
             },
+            {
+                code: 'solidx-mpin-locked',
+                priority: 120,
+                match: (txt) => txt.includes(error_messages_1.ERROR_MESSAGES.MPIN_LOCKED.toLowerCase()),
+                meta: {
+                    message: error_messages_1.ERROR_MESSAGES.MPIN_LOCKED,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-mpin-revoked',
+                priority: 120,
+                match: (txt) => txt.includes(error_messages_1.ERROR_MESSAGES.MPIN_REVOKED.toLowerCase()),
+                meta: {
+                    message: error_messages_1.ERROR_MESSAGES.MPIN_REVOKED,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-mpin-invalid',
+                priority: 120,
+                match: (txt) => txt.includes(error_messages_1.ERROR_MESSAGES.MPIN_INVALID.toLowerCase()),
+                meta: {
+                    message: error_messages_1.ERROR_MESSAGES.MPIN_INVALID,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-mpin-too-predictable',
+                priority: 120,
+                match: (txt) => txt.includes(error_messages_1.ERROR_MESSAGES.MPIN_TOO_PREDICTABLE.toLowerCase()),
+                meta: {
+                    message: error_messages_1.ERROR_MESSAGES.MPIN_TOO_PREDICTABLE,
+                    httpStatus: 400,
+                },
+            },
+            {
+                code: 'solidx-mpin-format-invalid',
+                priority: 120,
+                match: (txt) => txt.includes(error_messages_1.ERROR_MESSAGES.MPIN_FORMAT_INVALID.toLowerCase()),
+                meta: {
+                    message: error_messages_1.ERROR_MESSAGES.MPIN_FORMAT_INVALID,
+                    httpStatus: 400,
+                },
+            },
             {
                 code: 'solidx-mcp-server-unavailable',
                 priority: 100,