@veruna/api-contracts 19.1.0 → 20.1.0

package/build-esm/v1/auth/admin/schemas/admin-sessions.schema.js

@@ -1,5 +1,13 @@
 import { z } from 'zod';
 import { UUID_REGEX, DATETIME_REGEX } from '../../../../shared/regex';
+/**
+ * Session row for admin view. Distinct from the user-facing
+ * `SessionResponseSchema`: the admin needs the *raw* `ipInfo` /
+ * `deviceInfo` JSON blobs from the DB (for debugging / abuse
+ * triage), not the rendered `deviceName / deviceType / location`
+ * derived strings the user sees. `isCurrent` is also dropped — the
+ * admin's session is not the user's, so the flag is meaningless.
+ */
 export const AdminSessionItemSchema = z.object({
     uuid: z.string().regex(UUID_REGEX),
     ip: z.string(),
@@ -11,9 +19,16 @@ export const AdminSessionItemSchema = z.object({
 export const AdminSessionsResponseSchema = z.object({
     items: z.array(AdminSessionItemSchema),
 });
+/**
+ * Single-session terminate — surfaces the sessionId that was just
+ * deactivated so the FE can grey it out locally without refetching.
+ */
 export const AdminTerminateSessionResponseSchema = z.object({
     sessionId: z.string().regex(UUID_REGEX),
 });
+/**
+ * Bulk terminate-all — count of deactivated rows.
+ */
 export const AdminTerminateSessionsResponseSchema = z.object({
     sessionsTerminated: z.number().int().nonnegative(),
 });

package/build-esm/v1/auth/admin/schemas/admin-sessions.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-sessions.schema.js","sourceRoot":"","sources":["../../../../../v1/auth/admin/schemas/admin-sessions.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAUtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC/C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CACzC,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;CAC1C,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACrD,CAAC,CAAC"}
+{"version":3,"file":"admin-sessions.schema.js","sourceRoot":"","sources":["../../../../../v1/auth/admin/schemas/admin-sessions.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC/C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CACzC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;CAC1C,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACrD,CAAC,CAAC"}

package/build-esm/v1/auth/commands/delete-session.command.js

@@ -3,10 +3,12 @@ import { REST_API } from '../../../rest-api';
 import { HttpMethod } from '../../../shared/http-method.enum';
 export var AuthDeleteSessionCommand;
 (function (AuthDeleteSessionCommand) {
+    // Request/Response
     AuthDeleteSessionCommand.Request = z.object({});
     AuthDeleteSessionCommand.Response = z.object({
         sessionId: z.string().uuid(),
     });
+    // URL/Method
     AuthDeleteSessionCommand.URL = (id) => REST_API.V1.AUTH.REG.SESSION_BY_ID(id);
     AuthDeleteSessionCommand.METHOD = HttpMethod.DELETE;
 })(AuthDeleteSessionCommand || (AuthDeleteSessionCommand = {}));

package/build-esm/v1/auth/commands/delete-session.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"delete-session.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/delete-session.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,wBAAwB,CAcxC;AAdD,WAAiB,wBAAwB;IAE1B,gCAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,iCAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;KAC7B,CAAC,CAAC;IAGU,4BAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7D,+BAAM,GAAG,UAAU,CAAC,MAAM,CAAC;AAK1C,CAAC,EAdgB,wBAAwB,KAAxB,wBAAwB,QAcxC"}
+{"version":3,"file":"delete-session.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/delete-session.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,wBAAwB,CAcxC;AAdD,WAAiB,wBAAwB;IACvC,mBAAmB;IACN,gCAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,iCAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;KAC7B,CAAC,CAAC;IAEH,aAAa;IACA,4BAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7D,+BAAM,GAAG,UAAU,CAAC,MAAM,CAAC;AAK1C,CAAC,EAdgB,wBAAwB,KAAxB,wBAAwB,QAcxC"}

package/build-esm/v1/auth/commands/express-signup.command.js

@@ -4,8 +4,10 @@ import { REST_API } from '../../../rest-api';
 import { HttpMethod } from '../../../shared/http-method.enum';
 export var AuthExpressSignupCommand;
 (function (AuthExpressSignupCommand) {
+    // Request/Response — response mirrors signin so the frontend reuses its login handler.
     AuthExpressSignupCommand.Request = ExpressSignupRequestSchema;
     AuthExpressSignupCommand.Response = AuthResponseSchema;
+    // URL/Method
     AuthExpressSignupCommand.URL = REST_API.V1.AUTH.REG.EXPRESS_SIGNUP;
     AuthExpressSignupCommand.METHOD = HttpMethod.POST;
 })(AuthExpressSignupCommand || (AuthExpressSignupCommand = {}));

package/build-esm/v1/auth/commands/express-signup.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"express-signup.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/express-signup.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,wBAAwB,CAYxC;AAZD,WAAiB,wBAAwB;IAExB,gCAAO,GAAG,0BAA0B,CAAC;IACrC,iCAAQ,GAAG,kBAAkB,CAAC;IAG9B,4BAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,+BAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAZgB,wBAAwB,KAAxB,wBAAwB,QAYxC"}
+{"version":3,"file":"express-signup.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/express-signup.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,wBAAwB,CAYxC;AAZD,WAAiB,wBAAwB;IACrC,uFAAuF;IAC1E,gCAAO,GAAG,0BAA0B,CAAC;IACrC,iCAAQ,GAAG,kBAAkB,CAAC;IAE3C,aAAa;IACA,4BAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,+BAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAZgB,wBAAwB,KAAxB,wBAAwB,QAYxC"}

package/build-esm/v1/auth/commands/login-code-request.command.js

@@ -3,8 +3,10 @@ import { REST_API } from '../../../rest-api';
 import { HttpMethod } from '../../../shared/http-method.enum';
 export var AuthLoginCodeRequestCommand;
 (function (AuthLoginCodeRequestCommand) {
+    // Request/Response
     AuthLoginCodeRequestCommand.Request = LoginCodeRequestSchema;
     AuthLoginCodeRequestCommand.Response = LoginCodeRequestResponseSchema;
+    // URL/Method
     AuthLoginCodeRequestCommand.URL = REST_API.V1.AUTH.REG.LOGIN_CODE_REQUEST;
     AuthLoginCodeRequestCommand.METHOD = HttpMethod.POST;
 })(AuthLoginCodeRequestCommand || (AuthLoginCodeRequestCommand = {}));

package/build-esm/v1/auth/commands/login-code-request.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-code-request.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/login-code-request.command.ts"],"names":[],"mappings":"AACA,OAAO,EACH,sBAAsB,EACtB,8BAA8B,GACjC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,2BAA2B,CAY3C;AAZD,WAAiB,2BAA2B;IAE3B,mCAAO,GAAG,sBAAsB,CAAC;IACjC,oCAAQ,GAAG,8BAA8B,CAAC;IAG1C,+BAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC9C,kCAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAZgB,2BAA2B,KAA3B,2BAA2B,QAY3C"}
+{"version":3,"file":"login-code-request.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/login-code-request.command.ts"],"names":[],"mappings":"AACA,OAAO,EACH,sBAAsB,EACtB,8BAA8B,GACjC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,2BAA2B,CAY3C;AAZD,WAAiB,2BAA2B;IACxC,mBAAmB;IACN,mCAAO,GAAG,sBAAsB,CAAC;IACjC,oCAAQ,GAAG,8BAA8B,CAAC;IAEvD,aAAa;IACA,+BAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC9C,kCAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAZgB,2BAA2B,KAA3B,2BAA2B,QAY3C"}

package/build-esm/v1/auth/commands/login-code-verify.command.js

@@ -4,8 +4,10 @@ import { REST_API } from '../../../rest-api';
 import { HttpMethod } from '../../../shared/http-method.enum';
 export var AuthLoginCodeVerifyCommand;
 (function (AuthLoginCodeVerifyCommand) {
+    // Request/Response — response mirrors signin so the frontend reuses its login handler.
     AuthLoginCodeVerifyCommand.Request = LoginCodeVerifyRequestSchema;
     AuthLoginCodeVerifyCommand.Response = AuthResponseSchema;
+    // URL/Method
     AuthLoginCodeVerifyCommand.URL = REST_API.V1.AUTH.REG.LOGIN_CODE_VERIFY;
     AuthLoginCodeVerifyCommand.METHOD = HttpMethod.POST;
 })(AuthLoginCodeVerifyCommand || (AuthLoginCodeVerifyCommand = {}));

package/build-esm/v1/auth/commands/login-code-verify.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-code-verify.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/login-code-verify.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,0BAA0B,CAY1C;AAZD,WAAiB,0BAA0B;IAE1B,kCAAO,GAAG,4BAA4B,CAAC;IACvC,mCAAQ,GAAG,kBAAkB,CAAC;IAG9B,8BAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7C,iCAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAZgB,0BAA0B,KAA1B,0BAA0B,QAY1C"}
+{"version":3,"file":"login-code-verify.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/login-code-verify.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,0BAA0B,CAY1C;AAZD,WAAiB,0BAA0B;IACvC,uFAAuF;IAC1E,kCAAO,GAAG,4BAA4B,CAAC;IACvC,mCAAQ,GAAG,kBAAkB,CAAC;IAE3C,aAAa;IACA,8BAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7C,iCAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAZgB,0BAA0B,KAA1B,0BAA0B,QAY1C"}

package/build-esm/v1/auth/commands/logout-all.command.js

@@ -3,10 +3,12 @@ import { REST_API } from '../../../rest-api';
 import { HttpMethod } from '../../../shared/http-method.enum';
 export var AuthLogoutAllCommand;
 (function (AuthLogoutAllCommand) {
+    // Request/Response
     AuthLogoutAllCommand.Request = z.object({});
     AuthLogoutAllCommand.Response = z.object({
         sessionIds: z.array(z.string().uuid()),
     });
+    // URL/Method
     AuthLogoutAllCommand.URL = REST_API.V1.AUTH.REG.LOGOUT_ALL;
     AuthLogoutAllCommand.METHOD = HttpMethod.POST;
 })(AuthLogoutAllCommand || (AuthLogoutAllCommand = {}));

package/build-esm/v1/auth/commands/logout-all.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout-all.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/logout-all.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,oBAAoB,CAcpC;AAdD,WAAiB,oBAAoB;IAEpB,4BAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,6BAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;KACzC,CAAC,CAAC;IAGU,wBAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;IACtC,2BAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAdgB,oBAAoB,KAApB,oBAAoB,QAcpC"}
+{"version":3,"file":"logout-all.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/logout-all.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,oBAAoB,CAcpC;AAdD,WAAiB,oBAAoB;IACjC,mBAAmB;IACN,4BAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,6BAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;KACzC,CAAC,CAAC;IAEH,aAAa;IACA,wBAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;IACtC,2BAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAdgB,oBAAoB,KAApB,oBAAoB,QAcpC"}

package/build-esm/v1/auth/commands/logout.command.js

@@ -3,10 +3,12 @@ import { REST_API } from '../../../rest-api';
 import { HttpMethod } from '../../../shared/http-method.enum';
 export var AuthLogoutCommand;
 (function (AuthLogoutCommand) {
+    // Request/Response
     AuthLogoutCommand.Request = z.object({});
     AuthLogoutCommand.Response = z.object({
         sessionId: z.string().uuid(),
     });
+    // URL/Method
     AuthLogoutCommand.URL = REST_API.V1.AUTH.REG.LOGOUT;
     AuthLogoutCommand.METHOD = HttpMethod.POST;
 })(AuthLogoutCommand || (AuthLogoutCommand = {}));

package/build-esm/v1/auth/commands/logout.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/logout.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,iBAAiB,CAcjC;AAdD,WAAiB,iBAAiB;IAEjB,yBAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,0BAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;KAC/B,CAAC,CAAC;IAGU,qBAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;IAClC,wBAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAdgB,iBAAiB,KAAjB,iBAAiB,QAcjC"}
+{"version":3,"file":"logout.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/logout.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,iBAAiB,CAcjC;AAdD,WAAiB,iBAAiB;IAC9B,mBAAmB;IACN,yBAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,0BAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;KAC/B,CAAC,CAAC;IAEH,aAAa;IACA,qBAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;IAClC,wBAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAdgB,iBAAiB,KAAjB,iBAAiB,QAcjC"}

package/build-esm/v1/auth/commands/signin.command.js

@@ -4,8 +4,10 @@ import { REST_API } from '../../../rest-api';
 import { HttpMethod } from '../../../shared/http-method.enum';
 export var AuthSignInCommand;
 (function (AuthSignInCommand) {
+    // Request/Response
     AuthSignInCommand.Request = SignInRequestSchema;
     AuthSignInCommand.Response = AuthResponseSchema;
+    // URL/Method
     AuthSignInCommand.URL = REST_API.V1.AUTH.REG.SIGNIN;
     AuthSignInCommand.METHOD = HttpMethod.POST;
 })(AuthSignInCommand || (AuthSignInCommand = {}));

package/build-esm/v1/auth/commands/signin.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"signin.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/signin.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,iBAAiB,CAYjC;AAZD,WAAiB,iBAAiB;IAEnB,yBAAO,GAAG,mBAAmB,CAAC;IAC9B,0BAAQ,GAAG,kBAAkB,CAAC;IAG9B,qBAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;IAClC,wBAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAKxC,CAAC,EAZgB,iBAAiB,KAAjB,iBAAiB,QAYjC"}
+{"version":3,"file":"signin.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/signin.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,iBAAiB,CAYjC;AAZD,WAAiB,iBAAiB;IAChC,mBAAmB;IACN,yBAAO,GAAG,mBAAmB,CAAC;IAC9B,0BAAQ,GAAG,kBAAkB,CAAC;IAE3C,aAAa;IACA,qBAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;IAClC,wBAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAKxC,CAAC,EAZgB,iBAAiB,KAAjB,iBAAiB,QAYjC"}

package/build-esm/v1/auth/commands/signup.command.js

@@ -4,8 +4,10 @@ import { REST_API } from '../../../rest-api';
 import { HttpMethod } from '../../../shared/http-method.enum';
 export var AuthSignupCommand;
 (function (AuthSignupCommand) {
+    // Request/Response
     AuthSignupCommand.Request = SignUpRequestSchema;
     AuthSignupCommand.Response = SignupResponseSchema;
+    // URL/Method
     AuthSignupCommand.URL = REST_API.V1.AUTH.REG.SIGNUP;
     AuthSignupCommand.METHOD = HttpMethod.POST;
 })(AuthSignupCommand || (AuthSignupCommand = {}));

package/build-esm/v1/auth/commands/signup.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"signup.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/signup.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,iBAAiB,CAYjC;AAZD,WAAiB,iBAAiB;IAEjB,yBAAO,GAAG,mBAAmB,CAAC;IAC9B,0BAAQ,GAAG,oBAAoB,CAAC;IAGhC,qBAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;IAClC,wBAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAZgB,iBAAiB,KAAjB,iBAAiB,QAYjC"}
+{"version":3,"file":"signup.command.js","sourceRoot":"","sources":["../../../../v1/auth/commands/signup.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,iBAAiB,CAYjC;AAZD,WAAiB,iBAAiB;IAC9B,mBAAmB;IACN,yBAAO,GAAG,mBAAmB,CAAC;IAC9B,0BAAQ,GAAG,oBAAoB,CAAC;IAE7C,aAAa;IACA,qBAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;IAClC,wBAAM,GAAG,UAAU,CAAC,IAAI,CAAC;AAK1C,CAAC,EAZgB,iBAAiB,KAAjB,iBAAiB,QAYjC"}

package/build-esm/v1/auth/index.js

@@ -3,6 +3,7 @@ export * from './auth.errors';
 export * from './commands';
 export * from './queries';
 export * from './admin';
+// Re-export from centralized locations
 export { AUTH_CONTROLLER } from '../../controllers';
 export { AUTH_ROUTES } from '../../routes';
 //# sourceMappingURL=index.js.map

package/build-esm/v1/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../v1/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../v1/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,uCAAuC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/build-esm/v1/auth/queries/get-sessions.query.js

@@ -4,8 +4,10 @@ import { REST_API } from '../../../rest-api';
 import { HttpMethod } from '../../../shared/http-method.enum';
 export var AuthGetSessionsQuery;
 (function (AuthGetSessionsQuery) {
+    // Request/Response
     AuthGetSessionsQuery.Request = z.object({});
     AuthGetSessionsQuery.Response = SessionsListResponseSchema;
+    // URL/Method
     AuthGetSessionsQuery.URL = REST_API.V1.AUTH.REG.SESSIONS;
     AuthGetSessionsQuery.METHOD = HttpMethod.GET;
 })(AuthGetSessionsQuery || (AuthGetSessionsQuery = {}));

package/build-esm/v1/auth/queries/get-sessions.query.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-sessions.query.js","sourceRoot":"","sources":["../../../../v1/auth/queries/get-sessions.query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,oBAAoB,CAYpC;AAZD,WAAiB,oBAAoB;IAEtB,4BAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,6BAAQ,GAAG,0BAA0B,CAAC;IAGtC,wBAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IACpC,2BAAM,GAAG,UAAU,CAAC,GAAG,CAAC;AAKvC,CAAC,EAZgB,oBAAoB,KAApB,oBAAoB,QAYpC"}
+{"version":3,"file":"get-sessions.query.js","sourceRoot":"","sources":["../../../../v1/auth/queries/get-sessions.query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,KAAW,oBAAoB,CAYpC;AAZD,WAAiB,oBAAoB;IACnC,mBAAmB;IACN,4BAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,6BAAQ,GAAG,0BAA0B,CAAC;IAEnD,aAAa;IACA,wBAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IACpC,2BAAM,GAAG,UAAU,CAAC,GAAG,CAAC;AAKvC,CAAC,EAZgB,oBAAoB,KAApB,oBAAoB,QAYpC"}

package/build-esm/v1/auth/schemas/auth-response.schema.js

@@ -3,11 +3,19 @@ import { UserResponseSchema } from '../../users/schemas/user-response.schema';
 import { SessionResponseSchema } from './session-response.schema';
 import { EmailStatusSchema } from '../../antifraud/schemas/email-status.schema';
 import { TrustStatus } from '../../antifraud/enums/trust-status.enum';
+/**
+ * Auth Response Schema (signin/login — no emailStatus)
+ */
 export const AuthResponseSchema = z.object({
     user: UserResponseSchema,
     accessToken: z.string(),
     session: SessionResponseSchema,
 });
+/**
+ * Signup Response Schema — includes emailStatus block and optional scoring state.
+ * trustStatus is omitted when antifraud is disabled; PENDING_REVIEW means the
+ * frontend shows the "проверяем" status until the review resolves.
+ */
 export const SignupResponseSchema = z.object({
     user: UserResponseSchema,
     accessToken: z.string(),
@@ -15,6 +23,9 @@ export const SignupResponseSchema = z.object({
     emailStatus: EmailStatusSchema,
     trustStatus: z.enum(TrustStatus).optional(),
 });
+/**
+ * Sessions List Response Schema
+ */
 export const SessionsListResponseSchema = z.object({
     sessions: z.array(SessionResponseSchema),
 });

package/build-esm/v1/auth/schemas/auth-response.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-response.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/auth-response.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAKtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,qBAAqB;CAC/B,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,qBAAqB;IAC9B,WAAW,EAAE,iBAAiB;IAC9B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;CACzC,CAAC,CAAC"}
+{"version":3,"file":"auth-response.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/auth-response.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,qBAAqB;CAC/B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,qBAAqB;IAC9B,WAAW,EAAE,iBAAiB;IAC9B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;CACzC,CAAC,CAAC"}

package/build-esm/v1/auth/schemas/express-signup-request.schema.js

@@ -1,5 +1,11 @@
 import { z } from 'zod';
 import { normalizedEmailSchema } from '../../../shared/common-schemas';
+/**
+ * Express (passwordless) signup request — fast-buy flow. Email only; the account
+ * is created without a password (set later) and a session is returned immediately.
+ *
+ * Error messages: ExpressSignupRequest.{field}.{rule}
+ */
 export const ExpressSignupRequestSchema = z.object({
     email: normalizedEmailSchema('ExpressSignupRequest.email.required', 'ExpressSignupRequest.email.invalid'),
     marketingConsent: z

package/build-esm/v1/auth/schemas/express-signup-request.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"express-signup-request.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/express-signup-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAQvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,qBAAqB,CACxB,qCAAqC,EACrC,oCAAoC,CACvC;IACD,gBAAgB,EAAE,CAAC;SACd,OAAO,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;SACnE,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;CACrB,CAAC,CAAC"}
+{"version":3,"file":"express-signup-request.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/express-signup-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,qBAAqB,CACxB,qCAAqC,EACrC,oCAAoC,CACvC;IACD,gBAAgB,EAAE,CAAC;SACd,OAAO,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;SACnE,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;CACrB,CAAC,CAAC"}

package/build-esm/v1/auth/schemas/login-code-request.schema.js

@@ -1,8 +1,20 @@
 import { z } from 'zod';
 import { normalizedEmailSchema } from '../../../shared/common-schemas';
+/**
+ * Login-by-code request (step 1): user asks for a one-time code to be sent to
+ * their email. Response is intentionally uniform — it never reveals whether the
+ * email belongs to an existing account (anti-enumeration).
+ *
+ * Error messages: LoginCodeRequest.{field}.{rule}
+ */
 export const LoginCodeRequestSchema = z.object({
     email: normalizedEmailSchema('LoginCodeRequest.email.required', 'LoginCodeRequest.email.invalid'),
 });
+/**
+ * Opaque correlation id for the request — generated uniformly on every call
+ * (existing account or not), so it carries no account-existence signal. Useful
+ * for client-side correlation / support, not required to verify the code.
+ */
 export const LoginCodeRequestResponseSchema = z.object({
     requestId: z.string().uuid(),
 });

package/build-esm/v1/auth/schemas/login-code-request.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-code-request.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/login-code-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AASvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,qBAAqB,CACxB,iCAAiC,EACjC,gCAAgC,CACnC;CACJ,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC/B,CAAC,CAAC"}
+{"version":3,"file":"login-code-request.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/login-code-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,qBAAqB,CACxB,iCAAiC,EACjC,gCAAgC,CACnC;CACJ,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC/B,CAAC,CAAC"}

package/build-esm/v1/auth/schemas/login-code-verify.schema.js

@@ -1,5 +1,12 @@
 import { z } from 'zod';
 import { normalizedEmailSchema } from '../../../shared/common-schemas';
+/**
+ * Login-by-code verify (step 2): user submits the 6-digit code they received.
+ * On success the response mirrors signin (AuthResponseSchema) so the frontend
+ * reuses its existing login handler 1:1.
+ *
+ * Error messages: LoginCodeVerifyRequest.{field}.{rule}
+ */
 export const LoginCodeVerifyRequestSchema = z.object({
     email: normalizedEmailSchema('LoginCodeVerifyRequest.email.required', 'LoginCodeVerifyRequest.email.invalid'),
     code: z

package/build-esm/v1/auth/schemas/login-code-verify.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-code-verify.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/login-code-verify.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AASvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,qBAAqB,CACxB,uCAAuC,EACvC,sCAAsC,CACzC;IACD,IAAI,EAAE,CAAC;SACF,MAAM,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;SACzD,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;CAC5E,CAAC,CAAC"}
+{"version":3,"file":"login-code-verify.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/login-code-verify.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,qBAAqB,CACxB,uCAAuC,EACvC,sCAAsC,CACzC;IACD,IAAI,EAAE,CAAC;SACF,MAAM,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;SACzD,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;CAC5E,CAAC,CAAC"}

package/build-esm/v1/auth/schemas/session-response.schema.js

@@ -1,5 +1,9 @@
 import { z } from 'zod';
 import { UUID_REGEX, DATETIME_REGEX, DeviceType } from '../../../shared';
+/**
+ * Session Response Schema
+ * Error messages are in locales (en.ts, ru.ts)
+ */
 export const SessionResponseSchema = z.object({
     uuid: z.string().regex(UUID_REGEX),
     deviceName: z.string(),

package/build-esm/v1/auth/schemas/session-response.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-response.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/session-response.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAMzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC/C,CAAC,CAAC"}
+{"version":3,"file":"session-response.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/session-response.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;CAC/C,CAAC,CAAC"}

package/build-esm/v1/auth/schemas/signin-request.schema.js

@@ -1,5 +1,9 @@
 import { z } from 'zod';
 import { normalizedEmailSchema } from '../../../shared/common-schemas';
+/**
+ * SignIn Request Schema
+ * Error messages: SignInRequest.{field}.{rule}
+ */
 export const SignInRequestSchema = z.object({
     email: normalizedEmailSchema('SignInRequest.email.required', 'SignInRequest.email.invalid'),
     password: z

package/build-esm/v1/auth/schemas/signin-request.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"signin-request.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/signin-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAMvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,6BAA6B,CAAC;IAC3F,QAAQ,EAAE,CAAC;SACN,MAAM,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;SACpD,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;CACzD,CAAC,CAAC"}
+{"version":3,"file":"signin-request.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/signin-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,6BAA6B,CAAC;IAC3F,QAAQ,EAAE,CAAC;SACN,MAAM,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;SACpD,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;CACzD,CAAC,CAAC"}

package/build-esm/v1/auth/schemas/signup-request.schema.js

@@ -1,5 +1,9 @@
 import { z } from 'zod';
 import { normalizedEmailSchema } from '../../../shared/common-schemas';
+/**
+ * Sign Up Request Schema
+ * Error messages: SignUpRequest.{field}.{rule}
+ */
 export const SignUpRequestSchema = z.object({
     email: normalizedEmailSchema('SignUpRequest.email.required', 'SignUpRequest.email.invalid'),
     password: z

package/build-esm/v1/auth/schemas/signup-request.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"signup-request.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/signup-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAMvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,6BAA6B,CAAC;IAC3F,QAAQ,EAAE,CAAC;SACN,MAAM,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;SACpD,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;SACjD,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IACxD,IAAI,EAAE,CAAC;SACF,MAAM,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;SAChD,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;SAC7C,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpD,gBAAgB,EAAE,CAAC;SACd,OAAO,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;SAC5D,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;CACrB,CAAC,CAAC"}
+{"version":3,"file":"signup-request.schema.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/signup-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,qBAAqB,CAAC,8BAA8B,EAAE,6BAA6B,CAAC;IAC3F,QAAQ,EAAE,CAAC;SACN,MAAM,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;SACpD,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;SACjD,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IACxD,IAAI,EAAE,CAAC;SACF,MAAM,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;SAChD,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;SAC7C,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpD,gBAAgB,EAAE,CAAC;SACd,OAAO,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;SAC5D,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;CACrB,CAAC,CAAC"}

package/build-esm/v1/auth/schemas/user-role.enum.js

@@ -1,3 +1,6 @@
+/**
+ * User Role enum
+ */
 export var UserRole;
 (function (UserRole) {
     UserRole["USER"] = "USER";

package/build-esm/v1/auth/schemas/user-role.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-role.enum.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/user-role.enum.ts"],"names":[],"mappings":"AAGA,MAAM,CAAN,IAAY,QAGX;AAHD,WAAY,QAAQ;IAClB,yBAAa,CAAA;IACb,2BAAe,CAAA;AACjB,CAAC,EAHW,QAAQ,KAAR,QAAQ,QAGnB"}
+{"version":3,"file":"user-role.enum.js","sourceRoot":"","sources":["../../../../v1/auth/schemas/user-role.enum.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAN,IAAY,QAGX;AAHD,WAAY,QAAQ;IAClB,yBAAa,CAAA;IACb,2BAAe,CAAA;AACjB,CAAC,EAHW,QAAQ,KAAR,QAAQ,QAGnB"}

package/build-esm/v1/avatar/avatar-owner-type.enum.js

@@ -1,3 +1,7 @@
+/**
+ * Type of entity an avatar belongs to. The avatar module is generic so other
+ * domain entities (users, etc.) can be added without schema changes.
+ */
 export var AvatarOwnerType;
 (function (AvatarOwnerType) {
     AvatarOwnerType["ASSISTANT"] = "ASSISTANT";

package/build-esm/v1/avatar/avatar-owner-type.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"avatar-owner-type.enum.js","sourceRoot":"","sources":["../../../v1/avatar/avatar-owner-type.enum.ts"],"names":[],"mappings":"AAIA,MAAM,CAAN,IAAY,eAEX;AAFD,WAAY,eAAe;IACvB,0CAAuB,CAAA;AAC3B,CAAC,EAFW,eAAe,KAAf,eAAe,QAE1B"}
+{"version":3,"file":"avatar-owner-type.enum.js","sourceRoot":"","sources":["../../../v1/avatar/avatar-owner-type.enum.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAN,IAAY,eAEX;AAFD,WAAY,eAAe;IACvB,0CAAuB,CAAA;AAC3B,CAAC,EAFW,eAAe,KAAf,eAAe,QAE1B"}

package/build-esm/v1/avatar/avatar.constants.js

@@ -9,9 +9,15 @@ export const AVATAR_IMAGE_EXTENSION_MAP = {
     'image/png': 'png',
     'image/webp': 'webp',
 };
+/**
+ * First N magic bytes per MIME. Used for server-side content sniffing so
+ * a client cannot upload arbitrary bytes under a faked image/* header.
+ */
 export const AVATAR_IMAGE_MAGIC_BYTES = {
     'image/jpeg': [0xff, 0xd8, 0xff],
     'image/png': [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a],
+    // RIFF....WEBP — bytes 8..11 spell "WEBP"; null = wildcard for the
+    // 4-byte little-endian file-size in between.
     'image/webp': [
         0x52, 0x49, 0x46, 0x46,
         null, null, null, null,
@@ -29,6 +35,11 @@ export const AVATAR_VALIDATION_LIMITS = {
         maxSizeBytes: FIVE_MB,
     },
 };
+/** Time after which a PENDING avatar (uploaded but never attached) is purged. */
 export const AVATAR_PENDING_TTL_HOURS = 24;
+/**
+ * Hard cap on simultaneous PENDING avatars per (ownerUserId, ownerType).
+ * Protects S3 + DB from a user who uploads in a loop without ever attaching.
+ */
 export const AVATAR_MAX_PENDING_PER_USER = 5;
 //# sourceMappingURL=avatar.constants.js.map

package/build-esm/v1/avatar/avatar.constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"avatar.constants.js","sourceRoot":"","sources":["../../../v1/avatar/avatar.constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAG3D,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACnC,YAAY;IACZ,WAAW;IACX,YAAY;CACN,CAAC;AAIX,MAAM,CAAC,MAAM,0BAA0B,GAAwC;IAC3E,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,MAAM;CACvB,CAAC;AAMF,MAAM,CAAC,MAAM,wBAAwB,GAA4D;IAC7F,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAChC,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAG7D,YAAY,EAAE;QACV,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QACtB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QACtB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KACzB;CACJ,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IACzB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACd,CAAC;AAIX,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhC,MAAM,CAAC,MAAM,wBAAwB,GAAoD;IACrF,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE;QACzB,gBAAgB,EAAE,uBAAuB;QACzC,YAAY,EAAE,OAAO;KACxB;CACJ,CAAC;AAGF,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAM3C,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC"}
+{"version":3,"file":"avatar.constants.js","sourceRoot":"","sources":["../../../v1/avatar/avatar.constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAG3D,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACnC,YAAY;IACZ,WAAW;IACX,YAAY;CACN,CAAC;AAIX,MAAM,CAAC,MAAM,0BAA0B,GAAwC;IAC3E,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,MAAM;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA4D;IAC7F,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAChC,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAC7D,mEAAmE;IACnE,6CAA6C;IAC7C,YAAY,EAAE;QACV,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QACtB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QACtB,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;KACzB;CACJ,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IACzB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACd,CAAC;AAIX,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhC,MAAM,CAAC,MAAM,wBAAwB,GAAoD;IACrF,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE;QACzB,gBAAgB,EAAE,uBAAuB;QACzC,YAAY,EAAE,OAAO;KACxB;CACJ,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC"}

package/build-esm/v1/avatar/avatar.errors.js

@@ -7,7 +7,9 @@ export var AvatarErrorCode;
     AvatarErrorCode["AVATAR_TOO_LARGE"] = "AVATAR_TOO_LARGE";
     AvatarErrorCode["AVATAR_INVALID_OWNER_TYPE"] = "AVATAR_INVALID_OWNER_TYPE";
     AvatarErrorCode["AVATAR_UPLOAD_FAILED"] = "AVATAR_UPLOAD_FAILED";
+    /** Concurrent attach to the same (ownerType, ownerId). 409 Conflict. */
     AvatarErrorCode["AVATAR_CONFLICT"] = "AVATAR_CONFLICT";
+    /** Per-user cap on simultaneous PENDING avatars exceeded. 429-ish. */
     AvatarErrorCode["AVATAR_TOO_MANY_PENDING"] = "AVATAR_TOO_MANY_PENDING";
 })(AvatarErrorCode || (AvatarErrorCode = {}));
 export const AVATAR_ERRORS = {

package/build-esm/v1/avatar/avatar.errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"avatar.errors.js","sourceRoot":"","sources":["../../../v1/avatar/avatar.errors.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,eAYX;AAZD,WAAY,eAAe;IACvB,wDAAqC,CAAA;IACrC,wDAAqC,CAAA;IACrC,kEAA+C,CAAA;IAC/C,8DAA2C,CAAA;IAC3C,wDAAqC,CAAA;IACrC,0EAAuD,CAAA;IACvD,gEAA6C,CAAA;IAE7C,sDAAmC,CAAA;IAEnC,sEAAmD,CAAA;AACvD,CAAC,EAZW,eAAe,KAAf,eAAe,QAY1B;AAED,MAAM,CAAC,MAAM,aAAa,GAA2C;IACjE,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE;QAChC,IAAI,EAAE,eAAe,CAAC,gBAAgB;QACtC,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE;QAChC,IAAI,EAAE,eAAe,CAAC,gBAAgB;QACtC,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE;QACrC,IAAI,EAAE,eAAe,CAAC,qBAAqB;QAC3C,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE;QACnC,IAAI,EAAE,eAAe,CAAC,mBAAmB;QACzC,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE;QAChC,IAAI,EAAE,eAAe,CAAC,gBAAgB;QACtC,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,yBAAyB,CAAC,EAAE;QACzC,IAAI,EAAE,eAAe,CAAC,yBAAyB;QAC/C,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,oBAAoB,CAAC,EAAE;QACpC,IAAI,EAAE,eAAe,CAAC,oBAAoB;QAC1C,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE;QAC/B,IAAI,EAAE,eAAe,CAAC,eAAe;QACrC,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,uBAAuB,CAAC,EAAE;QACvC,IAAI,EAAE,eAAe,CAAC,uBAAuB;QAC7C,UAAU,EAAE,GAAG;KAClB;CACK,CAAC"}
+{"version":3,"file":"avatar.errors.js","sourceRoot":"","sources":["../../../v1/avatar/avatar.errors.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,eAYX;AAZD,WAAY,eAAe;IACvB,wDAAqC,CAAA;IACrC,wDAAqC,CAAA;IACrC,kEAA+C,CAAA;IAC/C,8DAA2C,CAAA;IAC3C,wDAAqC,CAAA;IACrC,0EAAuD,CAAA;IACvD,gEAA6C,CAAA;IAC7C,wEAAwE;IACxE,sDAAmC,CAAA;IACnC,sEAAsE;IACtE,sEAAmD,CAAA;AACvD,CAAC,EAZW,eAAe,KAAf,eAAe,QAY1B;AAED,MAAM,CAAC,MAAM,aAAa,GAA2C;IACjE,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE;QAChC,IAAI,EAAE,eAAe,CAAC,gBAAgB;QACtC,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE;QAChC,IAAI,EAAE,eAAe,CAAC,gBAAgB;QACtC,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,qBAAqB,CAAC,EAAE;QACrC,IAAI,EAAE,eAAe,CAAC,qBAAqB;QAC3C,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,mBAAmB,CAAC,EAAE;QACnC,IAAI,EAAE,eAAe,CAAC,mBAAmB;QACzC,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,gBAAgB,CAAC,EAAE;QAChC,IAAI,EAAE,eAAe,CAAC,gBAAgB;QACtC,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,yBAAyB,CAAC,EAAE;QACzC,IAAI,EAAE,eAAe,CAAC,yBAAyB;QAC/C,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,oBAAoB,CAAC,EAAE;QACpC,IAAI,EAAE,eAAe,CAAC,oBAAoB;QAC1C,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE;QAC/B,IAAI,EAAE,eAAe,CAAC,eAAe;QACrC,UAAU,EAAE,GAAG;KAClB;IACD,CAAC,eAAe,CAAC,uBAAuB,CAAC,EAAE;QACvC,IAAI,EAAE,eAAe,CAAC,uBAAuB;QAC7C,UAAU,EAAE,GAAG;KAClB;CACK,CAAC"}

package/build-esm/v1/avatar/schemas/avatar-attach-request.schema.js

@@ -1,6 +1,10 @@
 import { z } from 'zod';
 import { UUID_REGEX } from '../../../shared';
 import { AvatarOwnerType } from '../avatar-owner-type.enum';
+/**
+ * S2S request: claim a PENDING avatar for a domain entity (e.g. assistant)
+ * and atomically release the previously attached avatar (if any).
+ */
 export const AvatarAttachRequestSchema = z.object({
     uuid: z
         .string({ error: 'AvatarAttachRequest.uuid.required' })

package/build-esm/v1/avatar/schemas/avatar-attach-request.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"avatar-attach-request.schema.js","sourceRoot":"","sources":["../../../../v1/avatar/schemas/avatar-attach-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAM5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC;SACF,MAAM,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;SACtD,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;IACvE,WAAW,EAAE,CAAC;SACT,MAAM,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;SAC7D,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE;QAC/B,KAAK,EAAE,uCAAuC;KACjD,CAAC;IACF,OAAO,EAAE,CAAC;SACL,MAAM,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;SACzD,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;CAC7E,CAAC,CAAC"}
+{"version":3,"file":"avatar-attach-request.schema.js","sourceRoot":"","sources":["../../../../v1/avatar/schemas/avatar-attach-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC;SACF,MAAM,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;SACtD,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;IACvE,WAAW,EAAE,CAAC;SACT,MAAM,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;SAC7D,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IAC9E,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE;QAC/B,KAAK,EAAE,uCAAuC;KACjD,CAAC;IACF,OAAO,EAAE,CAAC;SACL,MAAM,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;SACzD,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;CAC7E,CAAC,CAAC"}

package/build-esm/v1/avatar/schemas/avatar-release-by-uuid-request.schema.js

@@ -1,5 +1,12 @@
 import { z } from 'zod';
 import { UUID_REGEX } from '../../../shared';
+/**
+ * S2S request: release exactly one avatar by uuid. Used as a compensating
+ * action by the api service after a local DB failure that followed a
+ * successful attach — release the just-attached uuid only, never blindly
+ * the current avatar of the owner (which may be a concurrent successful
+ * attach by another request).
+ */
 export const AvatarReleaseByUuidRequestSchema = z.object({
     uuid: z
         .string({ error: 'AvatarReleaseByUuidRequest.uuid.required' })

package/build-esm/v1/avatar/schemas/avatar-release-by-uuid-request.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"avatar-release-by-uuid-request.schema.js","sourceRoot":"","sources":["../../../../v1/avatar/schemas/avatar-release-by-uuid-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAS7C,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,CAAC;SACF,MAAM,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;SAC7D,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IAC9E,WAAW,EAAE,CAAC;SACT,MAAM,CAAC,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;SACpE,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;CACxF,CAAC,CAAC"}
+{"version":3,"file":"avatar-release-by-uuid-request.schema.js","sourceRoot":"","sources":["../../../../v1/avatar/schemas/avatar-release-by-uuid-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,CAAC;SACF,MAAM,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;SAC7D,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IAC9E,WAAW,EAAE,CAAC;SACT,MAAM,CAAC,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;SACpE,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;CACxF,CAAC,CAAC"}

package/build-esm/v1/avatar/schemas/avatar-release-request.schema.js

@@ -1,6 +1,14 @@
 import { z } from 'zod';
 import { UUID_REGEX } from '../../../shared';
 import { AvatarOwnerType } from '../avatar-owner-type.enum';
+/**
+ * S2S request: release the avatar attached to a domain entity. Used on entity
+ * deletion or when the user explicitly resets their avatar.
+ *
+ * `ownerUserId` is required for defense-in-depth: even if the S2S key leaks,
+ * an attacker would need both the assistant's id AND its owner's userId to
+ * release the avatar.
+ */
 export const AvatarReleaseRequestSchema = z.object({
     ownerUserId: z
         .string({ error: 'AvatarReleaseRequest.ownerUserId.required' })

package/build-esm/v1/avatar/schemas/avatar-release-request.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"avatar-release-request.schema.js","sourceRoot":"","sources":["../../../../v1/avatar/schemas/avatar-release-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAU5D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,WAAW,EAAE,CAAC;SACT,MAAM,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;SAC9D,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE;QAC/B,KAAK,EAAE,wCAAwC;KAClD,CAAC;IACF,OAAO,EAAE,CAAC;SACL,MAAM,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;SAC1D,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;CAC9E,CAAC,CAAC"}
+{"version":3,"file":"avatar-release-request.schema.js","sourceRoot":"","sources":["../../../../v1/avatar/schemas/avatar-release-request.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,WAAW,EAAE,CAAC;SACT,MAAM,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;SAC9D,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE;QAC/B,KAAK,EAAE,wCAAwC;KAClD,CAAC;IACF,OAAO,EAAE,CAAC;SACL,MAAM,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;SAC1D,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;CAC9E,CAAC,CAAC"}

package/build-esm/v1/avatar/schemas/avatar-upload-query.schema.js

@@ -1,5 +1,10 @@
 import { z } from 'zod';
 import { AvatarOwnerType } from '../avatar-owner-type.enum';
+/**
+ * Avatar upload accepts the owner type as a query parameter so the multipart
+ * body can stay reserved for the file part. Server uses this to pick the
+ * validation limits and the storage key prefix.
+ */
 export const AvatarUploadQuerySchema = z.object({
     ownerType: z.enum(AvatarOwnerType, {
         error: 'AvatarUploadQuery.ownerType.invalid',

package/build-esm/v1/avatar/schemas/avatar-upload-query.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"avatar-upload-query.schema.js","sourceRoot":"","sources":["../../../../v1/avatar/schemas/avatar-upload-query.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAO5D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE;QAC/B,KAAK,EAAE,qCAAqC;KAC/C,CAAC;CACL,CAAC,CAAC"}
+{"version":3,"file":"avatar-upload-query.schema.js","sourceRoot":"","sources":["../../../../v1/avatar/schemas/avatar-upload-query.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE;QAC/B,KAAK,EAAE,qCAAqC;KAC/C,CAAC;CACL,CAAC,CAAC"}

package/build-esm/v1/billing/billing.errors.js

@@ -1,16 +1,32 @@
 export var BillingErrorCode;
 (function (BillingErrorCode) {
+    // Markup tier
     BillingErrorCode["MARKUP_TIER_NOT_FOUND"] = "MARKUP_TIER_NOT_FOUND";
     BillingErrorCode["MARKUP_TIER_RANGE_INVALID"] = "MARKUP_TIER_RANGE_INVALID";
     BillingErrorCode["MARKUP_TIER_RANGE_OVERLAPS"] = "MARKUP_TIER_RANGE_OVERLAPS";
     BillingErrorCode["NO_ACTIVE_MARKUP_TIER"] = "NO_ACTIVE_MARKUP_TIER";
+    // Pricing
     BillingErrorCode["PRICING_CALCULATION_FAILED"] = "PRICING_CALCULATION_FAILED";
+    /**
+     * Caller asked to record settlement on a step that has not yet
+     * received an `external_price`. Indicates a programming error in
+     * the stream orchestrator — settlement must not be attempted from
+     * the PENDING billing state.
+     */
     BillingErrorCode["SETTLEMENT_BEFORE_PRICED"] = "SETTLEMENT_BEFORE_PRICED";
+    /**
+     * `recordSettlement` was called with an `overflow` payload that
+     * violates the per-step invariant `requested = charged + discount`
+     * (or the discount component is negative). Indicates a programming
+     * error in StreamResultHandler's DISCOUNT branch math.
+     */
     BillingErrorCode["SETTLEMENT_OVERFLOW_INVARIANT"] = "SETTLEMENT_OVERFLOW_INVARIANT";
+    // Hold orchestration
     BillingErrorCode["BUDGET_LOCK_FAILED"] = "BUDGET_LOCK_FAILED";
     BillingErrorCode["TOP_UP_FAILED"] = "TOP_UP_FAILED";
     BillingErrorCode["HOLD_NOT_OWNED_BY_USER"] = "HOLD_NOT_OWNED_BY_USER";
     BillingErrorCode["BILLING_FINALIZE_FAILED"] = "BILLING_FINALIZE_FAILED";
+    // Validation
     BillingErrorCode["INVALID_PERCENT"] = "INVALID_PERCENT";
     BillingErrorCode["INVALID_AMOUNT_RANGE"] = "INVALID_AMOUNT_RANGE";
 })(BillingErrorCode || (BillingErrorCode = {}));