npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (972) hide show

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"webauthn.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAGL,SAAS,EACT,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AAC/C,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAC3D,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAC7D;;;GAGG;AACH,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,gDAAe,CAAA;IACf,oDAAmB,CAAA;AACrB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAED;;;;;;;;;;;;GAYG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAIqB;IACU;IACJ;IACY;IACL;IAPlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EAC7C,YAA0B,EACd,aAA8C,EACnD,YAAwC;QAJrD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QAC7C,iBAAY,GAAZ,YAAY,CAAc;QACd,kBAAa,GAAb,aAAa,CAAiC;QACnD,iBAAY,GAAZ,YAAY,CAA4B;QAEzG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,gEAAgE;IAEhE,IAAY,IAAI;QACd,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IAC9D,CAAC;IAED,IAAY,MAAM;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IAChE,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACH,IAAY,eAAe;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACjE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,2BAA2B,CAC/B,EAAyB,EACzB,MAAc,EACd,KAAa;QAEb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,IAAI,EAAE,CAAC;QAChG,IAAI,mBAAmB,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,WAAW,mBAAmB,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,wEAAwE;YACxE,0EAA0E;YAC1E,eAAe,EAAE,GAAG,CAAC,WAA+C;YACpE,OAAO,EAAE,GAAG,CAAC,cAAc,GAAG,IAAI;YAClC,sBAAsB,EAAE;gBACtB,uBAAuB,EAAE,GAAG,CAAC,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB;gBACxG,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;gBAC9D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;aACvC;YACD,kBAAkB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,wBAAwB,GAAG,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAyB,EACzB,MAAc,EACd,QAAkC,EAClC,cAAuB;QAEvB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,GAAG,MAAM,CAAC,CAAC;QAC/F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;YACpD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,uBAAuB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,UAAU;SACzE,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC;QAE/F,MAAM,aAAa,GAA2B;YAC5C,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAa;YACrD,oBAAoB,EAAE,oBAAoB,IAAI,cAAc;YAC5D,kBAAkB,EAAE,kBAAkB,IAAI,KAAK;YAC/C,IAAI,EAAE,cAAc,IAAI,SAAS;YACjC,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,MAAM;YAC5C,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,kCAAkC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,CAAC,GAAG,mBAAmB,EAAE,aAAa,CAAC,CAAC;QAEnE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1F,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,6BAA6B,CACjC,EAAyB,EACzB,MAAc,EACd,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAErH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,4BAA4B,CAChC,EAAyB,EACzB,MAAc,EACd,QAAoC,EACpC,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,gGAAgG;QAChG,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,MAAM;gBACN,YAAY,EAAE,QAAQ,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,4FAA4F;YAC5F,wFAAwF;YACxF,uBAAuB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,gBAAgB,CAAC,QAAQ;YAC1F,UAAU,EAAE;gBACV,EAAE,EAAE,iBAAiB,CAAC,YAAY;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC;gBAChE,OAAO,EAAE,iBAAiB,CAAC,OAAO;gBAClC,UAAU,EAAE,iBAAiB,CAAC,UAAsC;aACrE;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,yCAAyC;QACzC,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gEAAgE,EAAE;gBACjF,MAAM;gBACN,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,aAAa,EAAE,iBAAiB,CAAC,OAAO;gBACxC,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY;YAC/C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;YACvD,CAAC,CAAC,CAAC,CACN,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC;IAC1E,CAAC;IAED,gEAAgE;IAEhE;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,EAAyB,EAAE,MAAc;QAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,OAAQ,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB;QACpF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE9F,IAAI,kBAAkB,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB,EAAE,OAAe;QACrG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE/E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAC9D,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,gBAAgB,CAAC,QAAuC,EAAE,MAAc;QAC9E,MAAM,MAAM,GAAG,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YAC/D,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,yBAAyB,CAAC;QAC9B,OAAO,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED;;;;;;;;OAQG;IACK,oBAAoB,CAAC,QAAuC;QAClE,OAAO,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YACvD,CAAC,CAAC,gBAAgB,CAAC,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,SAAiB;QAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAW;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAS,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,KAAK,CAAC,wBAAwB,CACpC,EAAyB,EACzB,MAAc;QAId,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AA5XY,sBAAsB;IADlC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAJa,aAAa;QACO,uBAAuB;QAC/B,YAAY;QACC,+BAA+B;QACrC,0BAA0B;GARhG,sBAAsB,CA4XlC","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport {\n generateRegistrationOptions,\n verifyRegistrationResponse,\n generateAuthenticationOptions,\n verifyAuthenticationResponse,\n} from '@simplewebauthn/server';\nimport type {\n PublicKeyCredentialCreationOptionsJSON,\n PublicKeyCredentialRequestOptionsJSON,\n RegistrationResponseJSON,\n AuthenticationResponseJSON,\n} from '@simplewebauthn/server';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { UserVerification } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { AuthCredentialOpsBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-credential-ops.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n UserCredentials,\n PasskeyCredentialEntry,\n ErrorType,\n ErrorCustomMessageReference,\n} from '@wildo-ai/saas-models';\n\nconst CHALLENGE_TTL_SECONDS = 300; // 5 minutes\nconst CHALLENGE_KEY_PREFIX_REG = 'webauthn_challenge:reg:';\nconst CHALLENGE_KEY_PREFIX_AUTH = 'webauthn_challenge:auth:';\n/*\n SEPARATE from the login prefix on purpose — see {@link PasskeyAuthenticationCeremony}. Sharing one\n * key would let an assertion the user produced for LOGIN be redeemed at the step-up door.\n /\nconst CHALLENGE_KEY_PREFIX_STEP_UP = 'webauthn_challenge:stepup:';\n\n/\n Which ceremony a passkey assertion belongs to.\n \n The two differ in the QUESTION they answer, and therefore in what they must demand:\n \n - LOGIN asks \"which principal is this?\". The passkey IS the factor, so possession of the\n * authenticator is the claim, and the app's `passkeyOperational.userVerification` policy decides\n * whether a PIN/biometric is also required.\n * - STEP_UP asks \"is the human still here, right now, and do they intend this irreversible\n * thing?\". Possession alone cannot answer that — a resident credential on an already-unlocked\n * machine would satisfy it with no human intent — so this ceremony pins user verification to\n * REQUIRED regardless of the app policy. Under the common `preferred` setting a login assertion\n * may legitimately carry no UV, and accepting one here would make the strongest-LOOKING factor the\n * weakest door onto the operations `requiresStepUpAuthentication` guards.\n \n They also use SEPARATE challenge keys, which is the load-bearing half. Both challenges are\n * single-use (atomic get-and-delete), but single-use alone does not say WHICH door a signed\n * assertion may open: with a shared key, an assertion the user produced for a login could be\n * replayed to `/auth/reauth` and minted into a step-up token. Distinct keys make a login challenge\n * structurally unredeemable at the step-up door and vice versa.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — a re-proof ceremony must not be\n * satisfiable by a credential presented for a different purpose.\n /\nexport enum PasskeyAuthenticationCeremony {\n LOGIN = 'login',\n STEP_UP = 'step_up',\n}\n\n/\n WebAuthnBackendService\n \n Encapsulates all WebAuthn/FIDO2 ceremony logic using @simplewebauthn/server.\n * Handles option generation, response verification, challenge management (Redis),\n * and credential CRUD on user credential documents.\n \n This service does NOT:\n * - Manage sessions (AuthSessionStore)\n * - Issue tokens (AuthTokenIssuer)\n * - Audit log (orchestrator/controller responsibility)\n * - Know about the authentication flow (orchestrator's job)\n /\n@injectable()\nexport class WebAuthnBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialOpsService) private readonly credentialOps: AuthCredentialOpsBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n ) {\n this.logDebug = this.logger.debugByType('WebAuthn');\n this.logger.setDebugTypeLogging('WebAuthn', false);\n }\n\n // ─── Configuration ───────────────────────────────────────────\n\n private get rpId(): string {\n return this.appConfigService.config.auth.passkeyConfig.rpId;\n }\n\n private get rpName(): string {\n return this.appConfigService.config.auth.passkeyConfig.rpName;\n }\n\n private get passkeyOps() {\n return this.appConfigService.config.auth.passkeyOperational;\n }\n\n /\n Derive the expected origin(s) from the app config's runtime endpoints.\n * Returns all configured publicUrl values as valid origins.\n /\n private get expectedOrigins(): string[] {\n const endPoints = this.appConfigService.config.runtime.endPoints;\n const origins: string[] = [];\n for (const [, urls] of Object.entries(endPoints)) {\n if (urls?.publicUrl) {\n origins.push(urls.publicUrl.replace(/\\/$/, ''));\n }\n }\n if (origins.length === 0) {\n origins.push(`https://${this.rpId}`);\n }\n return origins;\n }\n\n // ─── Registration ────────────────────────────────────────────\n\n /\n Generate WebAuthn registration options for a user.\n * The caller is responsible for ensuring the user is authenticated.\n /\n async generateRegistrationOptions(\n ec: ExecutionContext<any>,\n userId: string,\n email: string,\n ): Promise<PublicKeyCredentialCreationOptionsJSON> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n const maxPasskeys = this.appConfigService.config?.auth?.passkeyConfig?.maxPasskeysPerUser ?? 10;\n if (existingCredentials.length >= maxPasskeys) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: `Maximum of ${maxPasskeys} passkeys reached` },\n });\n }\n\n const ops = this.passkeyOps;\n const options = await generateRegistrationOptions({\n rpName: this.rpName,\n rpID: this.rpId,\n userName: email,\n userDisplayName: email,\n userID: new TextEncoder().encode(userId),\n // Cast: @simplewebauthn narrows to 'direct'\|'enterprise'\|'none' but W3C\n // AttestationConveyancePreference includes 'indirect' — valid at runtime.\n attestationType: ops.attestation as 'direct' \| 'enterprise' \| 'none',\n timeout: ops.timeoutSeconds 1000,\n authenticatorSelection: {\n authenticatorAttachment: ops.authenticatorAttachment === 'any' ? undefined : ops.authenticatorAttachment,\n residentKey: ops.requireResidentKey ? 'required' : 'preferred',\n userVerification: ops.userVerification,\n },\n excludeCredentials: existingCredentials.map((c) => ({\n id: c.credentialId,\n transports: c.transports as AuthenticatorTransport[],\n })),\n });\n\n await this._storeChallenge(CHALLENGE_KEY_PREFIX_REG + userId, options.challenge);\n this.logDebug('Registration options generated', { userId, excludeCount: existingCredentials.length });\n\n return options;\n }\n\n /*\n Verify a WebAuthn registration response and store the new credential.\n * Returns the new credential entry on success.\n /\n async verifyRegistrationResponse(\n ec: ExecutionContext<any>,\n userId: string,\n response: RegistrationResponseJSON,\n credentialName?: string,\n ): Promise<PasskeyCredentialEntry> {\n const expectedChallenge = await this._getAndDeleteChallenge(CHALLENGE_KEY_PREFIX_REG + userId);\n if (!expectedChallenge) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'WebAuthn registration challenge expired or not found' },\n });\n }\n\n const verification = await verifyRegistrationResponse({\n response,\n expectedChallenge,\n expectedOrigin: this.expectedOrigins,\n expectedRPID: this.rpId,\n requireUserVerification: this.passkeyOps.userVerification === 'required',\n });\n\n if (!verification.verified \|\| !verification.registrationInfo) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'WebAuthn registration verification failed' },\n });\n }\n\n const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;\n\n const newCredential: PasskeyCredentialEntry = {\n credentialId: credential.id,\n publicKey: Buffer.from(credential.publicKey).toString('base64url'),\n counter: credential.counter,\n transports: (credential.transports ?? []) as string[],\n credentialDeviceType: credentialDeviceType ?? 'singleDevice',\n credentialBackedUp: credentialBackedUp ?? false,\n name: credentialName ?? 'Passkey',\n aaguid: verification.registrationInfo.aaguid,\n createdAt: new Date(),\n lastUsedAt: undefined,\n };\n\n // Append to the credential record\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const updatedCredentials = [...existingCredentials, newCredential];\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey registered', { userId, credentialId: newCredential.credentialId });\n return newCredential;\n }\n\n // ─── Authentication ──────────────────────────────────────────\n\n /\n Generate WebAuthn authentication options for a user.\n * Populates allowCredentials from the user's stored passkeys.\n /\n async generateAuthenticationOptions(\n ec: ExecutionContext<any>,\n userId: string,\n ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n ): Promise<PublicKeyCredentialRequestOptionsJSON> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n if (existingCredentials.length === 0) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'No passkey credentials registered for this user' },\n });\n }\n\n const options = await generateAuthenticationOptions({\n rpID: this.rpId,\n userVerification: this._userVerificationFor(ceremony),\n timeout: this.passkeyOps.timeoutSeconds 1000,\n allowCredentials: existingCredentials.map((c) => ({\n id: c.credentialId,\n transports: c.transports as AuthenticatorTransport[],\n })),\n });\n\n await this._storeChallenge(this._challengeKeyFor(ceremony, userId), options.challenge);\n this.logDebug('Authentication options generated', { userId, ceremony, credentialCount: existingCredentials.length });\n\n return options;\n }\n\n /*\n Verify a WebAuthn authentication response.\n * Updates the credential counter and lastUsedAt on success.\n /\n async verifyAuthenticationResponse(\n ec: ExecutionContext<any>,\n userId: string,\n response: AuthenticationResponseJSON,\n ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n ): Promise<{ verified: boolean; credentialId: string }> {\n // Reads ONLY this ceremony's challenge, so an assertion signed for the other door finds nothing\n // to match and is refused — see `PasskeyAuthenticationCeremony`.\n const expectedChallenge = await this._getAndDeleteChallenge(this._challengeKeyFor(ceremony, userId));\n if (!expectedChallenge) {\n return { verified: false, credentialId: response.id };\n }\n\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const matchedCredential = existingCredentials.find((c) => c.credentialId === response.id);\n\n if (!matchedCredential) {\n this.logger.warn('WebAuthn authentication failed: credential not found', {\n userId,\n credentialId: response.id,\n });\n return { verified: false, credentialId: response.id };\n }\n\n const verification = await verifyAuthenticationResponse({\n response,\n expectedChallenge,\n expectedOrigin: this.expectedOrigins,\n expectedRPID: this.rpId,\n // STEP_UP pins this true even when the app policy is `preferred` — an assertion carrying no\n // user verification proves possession of the authenticator, not presence of the person.\n requireUserVerification: this._userVerificationFor(ceremony) === UserVerification.REQUIRED,\n credential: {\n id: matchedCredential.credentialId,\n publicKey: Buffer.from(matchedCredential.publicKey, 'base64url'),\n counter: matchedCredential.counter,\n transports: matchedCredential.transports as AuthenticatorTransport[],\n },\n });\n\n if (!verification.verified) {\n return { verified: false, credentialId: response.id };\n }\n\n // Counter verification (clone detection)\n const newCounter = verification.authenticationInfo.newCounter;\n if (newCounter > 0 && newCounter <= matchedCredential.counter) {\n this.logger.warn('WebAuthn counter did not increment — possible credential clone', {\n userId,\n credentialId: matchedCredential.credentialId,\n storedCounter: matchedCredential.counter,\n receivedCounter: newCounter,\n });\n }\n\n // Update counter and lastUsedAt\n const updatedCredentials = existingCredentials.map((c) =>\n c.credentialId === matchedCredential.credentialId\n ? { ...c, counter: newCounter, lastUsedAt: new Date() }\n : c,\n );\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey authentication verified', { userId, credentialId: matchedCredential.credentialId });\n return { verified: true, credentialId: matchedCredential.credentialId };\n }\n\n // ─── Credential CRUD ─────────────────────────────────────────\n\n /\n List all passkey credentials for a user (safe fields only — no publicKey/counter).\n /\n async getCredentials(ec: ExecutionContext<any>, userId: string): Promise<PasskeyCredentialEntry[]> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n return (cred as UserCredentials).passkeyCredentials ?? [];\n }\n\n /\n Remove a passkey credential by its credential ID.\n /\n async removeCredential(ec: ExecutionContext<any>, userId: string, credentialId: string): Promise<void> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const updatedCredentials = existingCredentials.filter((c) => c.credentialId !== credentialId);\n\n if (updatedCredentials.length === existingCredentials.length) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Passkey credential not found', credentialId },\n });\n }\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey removed', { userId, credentialId });\n }\n\n /\n Rename a passkey credential.\n /\n async renameCredential(ec: ExecutionContext<any>, userId: string, credentialId: string, newName: string): Promise<void> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const found = existingCredentials.find((c) => c.credentialId === credentialId);\n\n if (!found) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Passkey credential not found', credentialId },\n });\n }\n\n const updatedCredentials = existingCredentials.map((c) =>\n c.credentialId === credentialId ? { ...c, name: newName } : c,\n );\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey renamed', { userId, credentialId, newName });\n }\n\n // ─── Challenge Management (Redis) ────────────────────────────\n\n /\n The Redis challenge key for a ceremony. Distinct per ceremony so a challenge issued for one door\n * cannot be redeemed at the other — see {@link PasskeyAuthenticationCeremony}.\n /\n private _challengeKeyFor(ceremony: PasskeyAuthenticationCeremony, userId: string): string {\n const prefix = ceremony === PasskeyAuthenticationCeremony.STEP_UP\n ? CHALLENGE_KEY_PREFIX_STEP_UP\n : CHALLENGE_KEY_PREFIX_AUTH;\n return prefix + userId;\n }\n\n /\n The user-verification requirement for a ceremony.\n \n STEP_UP is REQUIRED unconditionally; LOGIN follows the app's `passkeyOperational` policy. The\n * override deliberately does not read the policy at all: an application that lowers it to\n * `preferred` (the common setting) is making a decision about LOGIN ergonomics, and inheriting it\n * here would silently weaken the re-proof that guards irreversible operations. Same reasoning as\n * `requiresStepUpAuthentication` refusing to inherit the per-user-type freshness policy.\n /\n private _userVerificationFor(ceremony: PasskeyAuthenticationCeremony): UserVerification {\n return ceremony === PasskeyAuthenticationCeremony.STEP_UP\n ? UserVerification.REQUIRED\n : this.passkeyOps.userVerification;\n }\n\n private async _storeChallenge(key: string, challenge: string): Promise<void> {\n await this.redisService.set(key, challenge, { ttl: CHALLENGE_TTL_SECONDS });\n }\n\n /\n Atomically read-and-consume a stored challenge. Delegates to\n * `RedisService.getDel`, which applies the same tenant-key scoping and\n * `JSON.parse` deserialization as the `set()` used by `_storeChallenge` —\n * keeping the store/read serialization contract symmetric. (The prior\n * hand-rolled `eval` GETDEL skipped `JSON.parse`, so the challenge came\n * back wrapped in literal quotes and every verification failed.)\n /\n private async _getAndDeleteChallenge(key: string): Promise<string \| null> {\n return this.redisService.getDel<string>(key);\n }\n\n // ─── Internal Helpers ────────────────────────────────────────\n\n /\n Resolve the credential record for a user.\n * Returns the credential document (throws if not found).\n */\n private async _resolveCredentialRecord(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{\n cred: UserCredentials;\n }> {\n const cred = await this.credentialOps.readByUserId(ec, userId);\n if (!cred) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'User credentials not found', userId },\n });\n }\n return { cred };\n }\n}\n\ntype AuthenticatorTransport = 'ble' \| 'cable' \| 'hybrid' \| 'internal' \| 'nfc' \| 'smart-card' \| 'usb';\n"]}
1	+ {"version":3,"file":"webauthn.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAGL,SAAS,EACT,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AAC/C,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAC3D,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAC7D;;;GAGG;AACH,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,gDAAe,CAAA;IACf,oDAAmB,CAAA;AACrB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAwBD;;;;;;;;;;;;GAYG;AAGI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAIqB;IACU;IACJ;IACY;IACL;IAPlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EAC7C,YAA0B,EACd,aAA8C,EACnD,YAAwC;QAJrD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QAC7C,iBAAY,GAAZ,YAAY,CAAc;QACd,kBAAa,GAAb,aAAa,CAAiC;QACnD,iBAAY,GAAZ,YAAY,CAA4B;QAEzG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,gEAAgE;IAEhE,IAAY,IAAI;QACd,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IAC9D,CAAC;IAED,IAAY,MAAM;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IAChE,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACH,IAAY,eAAe;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACjE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,2BAA2B,CAC/B,EAAyB,EACzB,MAAc,EACd,KAAa;QAEb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,IAAI,EAAE,CAAC;QAChG,IAAI,mBAAmB,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,WAAW,mBAAmB,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,wEAAwE;YACxE,0EAA0E;YAC1E,eAAe,EAAE,GAAG,CAAC,WAA+C;YACpE,OAAO,EAAE,GAAG,CAAC,cAAc,GAAG,IAAI;YAClC,sBAAsB,EAAE;gBACtB,uBAAuB,EAAE,GAAG,CAAC,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB;gBACxG,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;gBAC9D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;aACvC;YACD,kBAAkB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,wBAAwB,GAAG,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAyB,EACzB,MAAc,EACd,QAAkC,EAClC,cAAuB;QAEvB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,GAAG,MAAM,CAAC,CAAC;QAC/F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;YACpD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,uBAAuB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,UAAU;SACzE,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC;QAE/F,MAAM,aAAa,GAA2B;YAC5C,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAa;YACrD,oBAAoB,EAAE,oBAAoB,IAAI,cAAc;YAC5D,kBAAkB,EAAE,kBAAkB,IAAI,KAAK;YAC/C,IAAI,EAAE,cAAc,IAAI,SAAS;YACjC,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,MAAM;YAC5C,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,kCAAkC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,CAAC,GAAG,mBAAmB,EAAE,aAAa,CAAC,CAAC;QAEnE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1F,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,6BAA6B,CACjC,EAAyB,EACzB,MAAc,EACd,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAErH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,4BAA4B,CAChC,EAAyB,EACzB,MAAc,EACd,QAAoC,EACpC,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,gGAAgG;QAChG,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,MAAM;gBACN,YAAY,EAAE,QAAQ,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,4FAA4F;YAC5F,wFAAwF;YACxF,uBAAuB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,gBAAgB,CAAC,QAAQ;YAC1F,UAAU,EAAE;gBACV,EAAE,EAAE,iBAAiB,CAAC,YAAY;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC;gBAChE;;;;;;;;;;;;;;;;;;;;mBAoBG;gBACH,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,iBAAiB,CAAC,UAAsC;aACrE;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,iBAAiB,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,UAAU,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YACjG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+EAA+E,EAAE;gBAChG,MAAM;gBACN,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,aAAa,EAAE,iBAAiB,CAAC,OAAO;gBACxC,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,6FAA6F;YAC7F,4CAA4C;YAC5C,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,cAAc,EAAE;oBACd,YAAY,EAAE,iBAAiB,CAAC,YAAY;oBAC5C,aAAa,EAAE,iBAAiB,CAAC,OAAO;oBACxC,eAAe,EAAE,UAAU;oBAC3B,oFAAoF;oBACpF,oFAAoF;oBACpF,6EAA6E;oBAC7E,oBAAoB,EAAE,iBAAiB,CAAC,oBAAoB;oBAC5D,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;oBACxD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY;YAC/C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;YACvD,CAAC,CAAC,CAAC,CACN,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC;IAC1E,CAAC;IAED,gEAAgE;IAEhE;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,EAAyB,EAAE,MAAc;QAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,OAAQ,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB;QACpF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE9F,IAAI,kBAAkB,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB,EAAE,OAAe;QACrG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE/E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAC9D,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,gBAAgB,CAAC,QAAuC,EAAE,MAAc;QAC9E,MAAM,MAAM,GAAG,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YAC/D,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,yBAAyB,CAAC;QAC9B,OAAO,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED;;;;;;;;OAQG;IACK,oBAAoB,CAAC,QAAuC;QAClE,OAAO,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YACvD,CAAC,CAAC,gBAAgB,CAAC,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,SAAiB;QAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAW;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAS,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,KAAK,CAAC,wBAAwB,CACpC,EAAyB,EACzB,MAAc;QAId,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AApcY,sBAAsB;IAFlC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAJa,aAAa;QACO,uBAAuB;QAC/B,YAAY;QACC,+BAA+B;QACrC,0BAA0B;GARhG,sBAAsB,CAoclC","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport {\n generateRegistrationOptions,\n verifyRegistrationResponse,\n generateAuthenticationOptions,\n verifyAuthenticationResponse,\n} from '@simplewebauthn/server';\nimport type {\n PublicKeyCredentialCreationOptionsJSON,\n PublicKeyCredentialRequestOptionsJSON,\n RegistrationResponseJSON,\n AuthenticationResponseJSON,\n} from '@simplewebauthn/server';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { UserVerification } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { AuthCredentialOpsBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-credential-ops.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n UserCredentials,\n PasskeyCredentialEntry,\n ErrorType,\n ErrorCustomMessageReference,\n} from '@wildo-ai/saas-models';\n\nconst CHALLENGE_TTL_SECONDS = 300; // 5 minutes\nconst CHALLENGE_KEY_PREFIX_REG = 'webauthn_challenge:reg:';\nconst CHALLENGE_KEY_PREFIX_AUTH = 'webauthn_challenge:auth:';\n/*\n SEPARATE from the login prefix on purpose — see {@link PasskeyAuthenticationCeremony}. Sharing one\n * key would let an assertion the user produced for LOGIN be redeemed at the step-up door.\n /\nconst CHALLENGE_KEY_PREFIX_STEP_UP = 'webauthn_challenge:stepup:';\n\n/\n Which ceremony a passkey assertion belongs to.\n \n The two differ in the QUESTION they answer, and therefore in what they must demand:\n \n - LOGIN asks \"which principal is this?\". The passkey IS the factor, so possession of the\n * authenticator is the claim, and the app's `passkeyOperational.userVerification` policy decides\n * whether a PIN/biometric is also required.\n * - STEP_UP asks \"is the human still here, right now, and do they intend this irreversible\n * thing?\". Possession alone cannot answer that — a resident credential on an already-unlocked\n * machine would satisfy it with no human intent — so this ceremony pins user verification to\n * REQUIRED regardless of the app policy. Under the common `preferred` setting a login assertion\n * may legitimately carry no UV, and accepting one here would make the strongest-LOOKING factor the\n * weakest door onto the operations `requiresStepUpAuthentication` guards.\n \n They also use SEPARATE challenge keys, which is the load-bearing half. Both challenges are\n * single-use (atomic get-and-delete), but single-use alone does not say WHICH door a signed\n * assertion may open: with a shared key, an assertion the user produced for a login could be\n * replayed to `/auth/reauth` and minted into a step-up token. Distinct keys make a login challenge\n * structurally unredeemable at the step-up door and vice versa.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — a re-proof ceremony must not be\n * satisfiable by a credential presented for a different purpose.\n /\nexport enum PasskeyAuthenticationCeremony {\n LOGIN = 'login',\n STEP_UP = 'step_up',\n}\n\n/\n What a passkey assertion verification answers.\n \n `cloneSuspicion` is present ONLY when the assertion's signature verified and its counter did not\n * advance — the W3C cloned-authenticator signal. It is returned rather than audited here because\n * this service deliberately emits no audit rows (see the class header): the caller holds the\n * request's device information and is where the trail is written.\n /\nexport interface PasskeyAuthenticationVerificationResult {\n verified: boolean;\n credentialId: string;\n cloneSuspicion?: {\n credentialId: string;\n storedCounter: number;\n receivedCounter: number;\n credentialDeviceType: string;\n credentialBackedUp: boolean;\n aaguid?: string;\n ceremony: PasskeyAuthenticationCeremony;\n };\n}\n\n/\n WebAuthnBackendService\n \n Encapsulates all WebAuthn/FIDO2 ceremony logic using @simplewebauthn/server.\n * Handles option generation, response verification, challenge management (Redis),\n * and credential CRUD on user credential documents.\n \n This service does NOT:\n * - Manage sessions (AuthSessionStore)\n * - Issue tokens (AuthTokenIssuer)\n * - Audit log (orchestrator/controller responsibility)\n * - Know about the authentication flow (orchestrator's job)\n /\n@injectable()\n\nexport class WebAuthnBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialOpsService) private readonly credentialOps: AuthCredentialOpsBackendService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n ) {\n this.logDebug = this.logger.debugByType('WebAuthn');\n this.logger.setDebugTypeLogging('WebAuthn', false);\n }\n\n // ─── Configuration ───────────────────────────────────────────\n\n private get rpId(): string {\n return this.appConfigService.config.auth.passkeyConfig.rpId;\n }\n\n private get rpName(): string {\n return this.appConfigService.config.auth.passkeyConfig.rpName;\n }\n\n private get passkeyOps() {\n return this.appConfigService.config.auth.passkeyOperational;\n }\n\n /\n Derive the expected origin(s) from the app config's runtime endpoints.\n * Returns all configured publicUrl values as valid origins.\n /\n private get expectedOrigins(): string[] {\n const endPoints = this.appConfigService.config.runtime.endPoints;\n const origins: string[] = [];\n for (const [, urls] of Object.entries(endPoints)) {\n if (urls?.publicUrl) {\n origins.push(urls.publicUrl.replace(/\\/$/, ''));\n }\n }\n if (origins.length === 0) {\n origins.push(`https://${this.rpId}`);\n }\n return origins;\n }\n\n // ─── Registration ────────────────────────────────────────────\n\n /\n Generate WebAuthn registration options for a user.\n * The caller is responsible for ensuring the user is authenticated.\n /\n async generateRegistrationOptions(\n ec: ExecutionContext<any>,\n userId: string,\n email: string,\n ): Promise<PublicKeyCredentialCreationOptionsJSON> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n const maxPasskeys = this.appConfigService.config?.auth?.passkeyConfig?.maxPasskeysPerUser ?? 10;\n if (existingCredentials.length >= maxPasskeys) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: `Maximum of ${maxPasskeys} passkeys reached` },\n });\n }\n\n const ops = this.passkeyOps;\n const options = await generateRegistrationOptions({\n rpName: this.rpName,\n rpID: this.rpId,\n userName: email,\n userDisplayName: email,\n userID: new TextEncoder().encode(userId),\n // Cast: @simplewebauthn narrows to 'direct'\|'enterprise'\|'none' but W3C\n // AttestationConveyancePreference includes 'indirect' — valid at runtime.\n attestationType: ops.attestation as 'direct' \| 'enterprise' \| 'none',\n timeout: ops.timeoutSeconds 1000,\n authenticatorSelection: {\n authenticatorAttachment: ops.authenticatorAttachment === 'any' ? undefined : ops.authenticatorAttachment,\n residentKey: ops.requireResidentKey ? 'required' : 'preferred',\n userVerification: ops.userVerification,\n },\n excludeCredentials: existingCredentials.map((c) => ({\n id: c.credentialId,\n transports: c.transports as AuthenticatorTransport[],\n })),\n });\n\n await this._storeChallenge(CHALLENGE_KEY_PREFIX_REG + userId, options.challenge);\n this.logDebug('Registration options generated', { userId, excludeCount: existingCredentials.length });\n\n return options;\n }\n\n /*\n Verify a WebAuthn registration response and store the new credential.\n * Returns the new credential entry on success.\n /\n async verifyRegistrationResponse(\n ec: ExecutionContext<any>,\n userId: string,\n response: RegistrationResponseJSON,\n credentialName?: string,\n ): Promise<PasskeyCredentialEntry> {\n const expectedChallenge = await this._getAndDeleteChallenge(CHALLENGE_KEY_PREFIX_REG + userId);\n if (!expectedChallenge) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'WebAuthn registration challenge expired or not found' },\n });\n }\n\n const verification = await verifyRegistrationResponse({\n response,\n expectedChallenge,\n expectedOrigin: this.expectedOrigins,\n expectedRPID: this.rpId,\n requireUserVerification: this.passkeyOps.userVerification === 'required',\n });\n\n if (!verification.verified \|\| !verification.registrationInfo) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'WebAuthn registration verification failed' },\n });\n }\n\n const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;\n\n const newCredential: PasskeyCredentialEntry = {\n credentialId: credential.id,\n publicKey: Buffer.from(credential.publicKey).toString('base64url'),\n counter: credential.counter,\n transports: (credential.transports ?? []) as string[],\n credentialDeviceType: credentialDeviceType ?? 'singleDevice',\n credentialBackedUp: credentialBackedUp ?? false,\n name: credentialName ?? 'Passkey',\n aaguid: verification.registrationInfo.aaguid,\n createdAt: new Date(),\n lastUsedAt: undefined,\n };\n\n // Append to the credential record\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const updatedCredentials = [...existingCredentials, newCredential];\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey registered', { userId, credentialId: newCredential.credentialId });\n return newCredential;\n }\n\n // ─── Authentication ──────────────────────────────────────────\n\n /\n Generate WebAuthn authentication options for a user.\n * Populates allowCredentials from the user's stored passkeys.\n /\n async generateAuthenticationOptions(\n ec: ExecutionContext<any>,\n userId: string,\n ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n ): Promise<PublicKeyCredentialRequestOptionsJSON> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n if (existingCredentials.length === 0) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n context: { reason: 'No passkey credentials registered for this user' },\n });\n }\n\n const options = await generateAuthenticationOptions({\n rpID: this.rpId,\n userVerification: this._userVerificationFor(ceremony),\n timeout: this.passkeyOps.timeoutSeconds 1000,\n allowCredentials: existingCredentials.map((c) => ({\n id: c.credentialId,\n transports: c.transports as AuthenticatorTransport[],\n })),\n });\n\n await this._storeChallenge(this._challengeKeyFor(ceremony, userId), options.challenge);\n this.logDebug('Authentication options generated', { userId, ceremony, credentialCount: existingCredentials.length });\n\n return options;\n }\n\n /*\n Verify a WebAuthn authentication response.\n * Updates the credential counter and lastUsedAt on success.\n /\n async verifyAuthenticationResponse(\n ec: ExecutionContext<any>,\n userId: string,\n response: AuthenticationResponseJSON,\n ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n ): Promise<PasskeyAuthenticationVerificationResult> {\n // Reads ONLY this ceremony's challenge, so an assertion signed for the other door finds nothing\n // to match and is refused — see `PasskeyAuthenticationCeremony`.\n const expectedChallenge = await this._getAndDeleteChallenge(this._challengeKeyFor(ceremony, userId));\n if (!expectedChallenge) {\n return { verified: false, credentialId: response.id };\n }\n\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const matchedCredential = existingCredentials.find((c) => c.credentialId === response.id);\n\n if (!matchedCredential) {\n this.logger.warn('WebAuthn authentication failed: credential not found', {\n userId,\n credentialId: response.id,\n });\n return { verified: false, credentialId: response.id };\n }\n\n const verification = await verifyAuthenticationResponse({\n response,\n expectedChallenge,\n expectedOrigin: this.expectedOrigins,\n expectedRPID: this.rpId,\n // STEP_UP pins this true even when the app policy is `preferred` — an assertion carrying no\n // user verification proves possession of the authenticator, not presence of the person.\n requireUserVerification: this._userVerificationFor(ceremony) === UserVerification.REQUIRED,\n credential: {\n id: matchedCredential.credentialId,\n publicKey: Buffer.from(matchedCredential.publicKey, 'base64url'),\n /\n * DELIBERATELY 0, NOT the stored counter — and this line is load-bearing, so read the\n * reason before \"fixing\" it.\n \n `@simplewebauthn/server` evaluates its own counter guard BEFORE `verifySignature`\n * (verifyAuthenticationResponse.js:144-151 in 13.3.x, then :154). Handing it the real\n * stored value therefore refuses a counter regression on an assertion whose signature was\n * never checked — so ANY caller who knows a credential id could trigger the refusal, and\n * an alert raised there would be forgeable by an unauthenticated party.\n \n W3C WebAuthn L3 puts the counter comparison at §7.2 step 22, AFTER signature\n * verification at step 21, precisely because a counter regression only means something\n * when the assertion is known to come from something holding the private key. Passing 0\n * makes the library's predicate unsatisfiable — `(counter > 0 \|\| 0 > 0) && counter <= 0`\n * is false for every input — so the library does what we want from it (verify the\n * signature) and the counter decision stays here, below, where it is ours and where it is\n * post-authentication.\n \n spec-cite: W3C Web Authentication Level 3 §7.2 steps 21-22\n * (https://www.w3.org/TR/webauthn-3/#sctn-verifying-assertion).\n /\n counter: 0,\n transports: matchedCredential.transports as AuthenticatorTransport[],\n },\n });\n\n if (!verification.verified) {\n return { verified: false, credentialId: response.id };\n }\n\n /\n * CLONE DETECTION — the spec's predicate, on a signature-verified assertion.\n \n \"If either is non-zero, and the new signCount value is less than or equal to the stored\n * value, a cloned authenticator may exist, or the authenticator may be malfunctioning, or a\n * race condition might exist\" — W3C WebAuthn L3 §6.1.1.\n \n EITHER non-zero, not just the received one. The previous check here read\n * `newCounter > 0 && newCounter <= stored`, which misses the case that matters most\n * operationally: a credential that previously counted and now reports 0. It was also dead\n * code — the library threw first — and it only warned.\n \n A credential whose counter is permanently 0 — which every SYNCED passkey is, because a set\n * of devices cannot maintain a coherent counter — compares 0-against-0, fails the first\n * disjunct, and authenticates normally. That is the whole passkey accommodation and it is why\n * refusing here is not hostile to passkeys.\n \n Refusal, not step-up, and not configurable: three of the four major server implementations\n * fail closed with no switch (SimpleWebAuthn, Duo py_webauthn, ASP.NET Core Identity) and the\n * fourth (Yubico) defaults to it. Nothing authoritative recommends escalating instead.\n \n Returned rather than thrown so BOTH callers take their existing `!verified` branch and\n * produce the same clean AUTHENTICATION refusal — the step-up path used to wrap a library\n * throw as a generic error while login refused cleanly.\n \n spec-cite: W3C Web Authentication Level 3 §6.1.1\n * (https://www.w3.org/TR/webauthn-3/#sctn-sign-counter).\n /\n const newCounter = verification.authenticationInfo.newCounter;\n if ((newCounter > 0 \|\| matchedCredential.counter > 0) && newCounter <= matchedCredential.counter) {\n this.logger.warn('WebAuthn signature counter did not advance on a verified assertion — refusing', {\n userId,\n credentialId: matchedCredential.credentialId,\n storedCounter: matchedCredential.counter,\n receivedCounter: newCounter,\n });\n // The stored counter is NOT advanced: a refused assertion must not move the baseline a later\n // legitimate assertion is compared against.\n return {\n verified: false,\n credentialId: matchedCredential.credentialId,\n cloneSuspicion: {\n credentialId: matchedCredential.credentialId,\n storedCounter: matchedCredential.counter,\n receivedCounter: newCounter,\n // Carried for TRIAGE only — nothing branches on them. A synced credential that once\n // reported a non-zero counter and then regresses is still a signal, so exempting by\n // device type would disable clone detection for the majority of credentials.\n credentialDeviceType: matchedCredential.credentialDeviceType,\n credentialBackedUp: matchedCredential.credentialBackedUp,\n ...(matchedCredential.aaguid ? { aaguid: matchedCredential.aaguid } : {}),\n ceremony,\n },\n };\n }\n\n // Update counter and lastUsedAt\n const updatedCredentials = existingCredentials.map((c) =>\n c.credentialId === matchedCredential.credentialId\n ? { ...c, counter: newCounter, lastUsedAt: new Date() }\n : c,\n );\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey authentication verified', { userId, credentialId: matchedCredential.credentialId });\n return { verified: true, credentialId: matchedCredential.credentialId };\n }\n\n // ─── Credential CRUD ─────────────────────────────────────────\n\n /\n List all passkey credentials for a user, as STORED.\n \n This returns the whole `PasskeyCredentialEntry`, `publicKey` and `counter` included. It is not a\n * safe-field projection, and must not be handed to a caller as one: the projection that reaches a\n * client is built at the controller (`handlePasskeyList`), which selects the credential id, name,\n * timestamps and device flags and nothing else. A new consumer of this method owes its own\n * projection, or it will disclose the stored credential material.\n /\n async getCredentials(ec: ExecutionContext<any>, userId: string): Promise<PasskeyCredentialEntry[]> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n return (cred as UserCredentials).passkeyCredentials ?? [];\n }\n\n /\n Remove a passkey credential by its credential ID.\n /\n async removeCredential(ec: ExecutionContext<any>, userId: string, credentialId: string): Promise<void> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const updatedCredentials = existingCredentials.filter((c) => c.credentialId !== credentialId);\n\n if (updatedCredentials.length === existingCredentials.length) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Passkey credential not found', credentialId },\n });\n }\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey removed', { userId, credentialId });\n }\n\n /\n Rename a passkey credential.\n /\n async renameCredential(ec: ExecutionContext<any>, userId: string, credentialId: string, newName: string): Promise<void> {\n const { cred } = await this._resolveCredentialRecord(ec, userId);\n const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n const found = existingCredentials.find((c) => c.credentialId === credentialId);\n\n if (!found) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Passkey credential not found', credentialId },\n });\n }\n\n const updatedCredentials = existingCredentials.map((c) =>\n c.credentialId === credentialId ? { ...c, name: newName } : c,\n );\n\n await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n this.logDebug('Passkey renamed', { userId, credentialId, newName });\n }\n\n // ─── Challenge Management (Redis) ────────────────────────────\n\n /\n The Redis challenge key for a ceremony. Distinct per ceremony so a challenge issued for one door\n * cannot be redeemed at the other — see {@link PasskeyAuthenticationCeremony}.\n /\n private _challengeKeyFor(ceremony: PasskeyAuthenticationCeremony, userId: string): string {\n const prefix = ceremony === PasskeyAuthenticationCeremony.STEP_UP\n ? CHALLENGE_KEY_PREFIX_STEP_UP\n : CHALLENGE_KEY_PREFIX_AUTH;\n return prefix + userId;\n }\n\n /\n The user-verification requirement for a ceremony.\n \n STEP_UP is REQUIRED unconditionally; LOGIN follows the app's `passkeyOperational` policy. The\n * override deliberately does not read the policy at all: an application that lowers it to\n * `preferred` (the common setting) is making a decision about LOGIN ergonomics, and inheriting it\n * here would silently weaken the re-proof that guards irreversible operations. Same reasoning as\n * `requiresStepUpAuthentication` refusing to inherit the per-user-type freshness policy.\n /\n private _userVerificationFor(ceremony: PasskeyAuthenticationCeremony): UserVerification {\n return ceremony === PasskeyAuthenticationCeremony.STEP_UP\n ? UserVerification.REQUIRED\n : this.passkeyOps.userVerification;\n }\n\n private async _storeChallenge(key: string, challenge: string): Promise<void> {\n await this.redisService.set(key, challenge, { ttl: CHALLENGE_TTL_SECONDS });\n }\n\n /\n Atomically read-and-consume a stored challenge. Delegates to\n * `RedisService.getDel`, which applies the same tenant-key scoping and\n * `JSON.parse` deserialization as the `set()` used by `_storeChallenge` —\n * keeping the store/read serialization contract symmetric. (The prior\n * hand-rolled `eval` GETDEL skipped `JSON.parse`, so the challenge came\n * back wrapped in literal quotes and every verification failed.)\n /\n private async _getAndDeleteChallenge(key: string): Promise<string \| null> {\n return this.redisService.getDel<string>(key);\n }\n\n // ─── Internal Helpers ────────────────────────────────────────\n\n /\n Resolve the credential record for a user.\n * Returns the credential document (throws if not found).\n */\n private async _resolveCredentialRecord(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{\n cred: UserCredentials;\n }> {\n const cred = await this.credentialOps.readByUserId(ec, userId);\n if (!cred) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'User credentials not found', userId },\n });\n }\n return { cred };\n }\n}\n\ntype AuthenticatorTransport = 'ble' \| 'cable' \| 'hybrid' \| 'internal' \| 'nfc' \| 'smart-card' \| 'usb';\n"]}

package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.d.ts CHANGED Viewed

@@ -4,9 +4,11 @@ import { AppConfigurationService } from '../../../config/services/app-configurat
 import { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service';
 import { RedisService } from '../../../databases/services/redis.service';
 import { JwtBackendService } from '../../../security/jwt/services/jwt.backend.service';
+import { AuditLogsBackendService } from '../../../compliance/audit-trails/services/audit-logs.backend.service';
 import type { ServicesRegistryHandlerBackendService } from '../../../base-classes/services/services/services-registry-handler.backend.service';
 import { AuthExecutionContextFactoryBackendService } from '../../../security/authentications/services/auth-execution-context-factory.backend.service';
 import { AuthenticationSession, SessionType } from '@wildo-ai/saas-models';
+import { type AuditObservationLossMetricsRecorder } from '../../../monitoring/observability/audit-observation-emission.backend';
 /**
  * Result of token issuance.
  */
@@ -63,8 +65,10 @@ export declare class AuthTokenIssuerBackendService {
     private readonly redisService;
     private readonly servicesRegistryHandler;
     private readonly authEcFactory;
+    private readonly auditLogsService;
+    private readonly metricsService?;
     private readonly logDebug;
-    constructor(logger: LoggerService, appConfigService: AppConfigurationService, jwtService: JwtBackendService, errorBuilder: ErrorBuilderBackendService, redisService: RedisService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, authEcFactory: AuthExecutionContextFactoryBackendService);
+    constructor(logger: LoggerService, appConfigService: AppConfigurationService, jwtService: JwtBackendService, errorBuilder: ErrorBuilderBackendService, redisService: RedisService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, authEcFactory: AuthExecutionContextFactoryBackendService, auditLogsService?: AuditLogsBackendService | null, metricsService?: AuditObservationLossMetricsRecorder);
     /**
      * Issue access + refresh tokens for a completed authentication session.
      */
@@ -154,5 +158,41 @@ export declare class AuthTokenIssuerBackendService {
      * eviction arbitrary.
      */
     private _trackAndEnforceSessionLimit;
+    /**
+     * Record each retired refresh chain in the audit trail.
+     *
+     * Until 2026-09-02 the only trace of an eviction was the debug line above — a security-relevant
+     * token-lifecycle act with no durable record, which is exactly what `CLAUDE.md`'s
+     * assurance-by-construction rule asks for by name. The cap exists to bound the blast radius of
+     * undetected token theft, so a burst of evictions for one principal is among the more interesting
+     * things the trail can carry, and it was not carrying it.
+     *
+     * `evictedIssuedAt` is what makes the record worth having: the cap's security property is that the
+     * OLDEST chain goes, and a record naming only the victim would prove a session ended without
+     * proving the right one did. An unreadable score yields ABSENCE rather than a synthesised instant —
+     * a fabricated timestamp would make the first-in-first-out claim unfalsifiable.
+     *
+     * Feature-DETECTED rather than null-checked, for the reason recorded at the cross-tenant emitter:
+     * adding a `log*` method breaks partially-mocked doubles, the property is absent, and the CALL
+     * throws synchronously before any `.catch()` can make it fire-and-forget.
+     *
+     * ## Why the detection decides an ARGUMENT rather than an early return
+     *
+     * Every emission goes through {@link emitAuditObservation}, which counts a lost one on
+     * `audit_observation_dropped_total`. Handing the seam `undefined` is how this site reports
+     * `SERVICE_UNAVAILABLE` — the loss shape that reaches no `_createAuditLog` and therefore used to
+     * leave nothing behind at all. Returning early on an absent method would restore that silence,
+     * which matters here more than it looks: an unbound audit service makes the eviction trail
+     * PERMANENTLY empty, and an empty eviction trail reads as "the cap never fired".
+     *
+     * The count is per RETIRED CHAIN, not per enforcement — one lost row is one lost row, and a cap
+     * that evicts four chains while the sink is down has lost four pieces of evidence. The
+     * `!evictedJti` skip stays ABOVE the emission for the opposite reason: a pair with no jti is
+     * nothing owed, and counting a deliberate skip would fire the loss signal on correct behaviour.
+     *
+     * assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is
+     * evidenced, naming WHICH chain was retired and when it was issued.
+     */
+    private recordEvictions;
 }
 //# sourceMappingURL=auth-token-issuer.backend.service.d.ts.map

package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-token-issuer.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-token-issuer.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;~~AAEjG~~,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qBAAqB,EAAkC,WAAW,EAAwE,MAAM,uBAAuB,CAAC;~~AAsBjL~~;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,aAAa,EAAE,OAAO,CAAC;CACxB;AAUD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAuB,GAAG,CAAC,CAQzG;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAK7F;AAED;;;;;;;;;;;GAWG;AACH,qBACa,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;~~IATxF~~,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACxC,UAAU,EAAE,iBAAiB,EAC3B,YAAY,EAAE,0BAA0B,EAC/C,YAAY,EAAE,YAAY,EACR,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC;~~IAMnI~~;;OAEG;IACU,WAAW,CACtB,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GACrG,OAAO,CAAC,UAAU,CAAC;IAgBtB;;;;OAIG;IACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE;QACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,EACD,OAAO,CAAC,EAAE;QACR,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,qBAAqB,CAAC,EAAE,IAAI,CAAC;KAC9B,GACA,OAAO,CAAC,UAAU,CAAC;IAItB;;;OAGG;YACW,mBAAmB;IAiKjC;;;;;;;;;;;;OAYG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkS1E;;;;;OAKG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+CpE;;;;;;;;OAQG;IACU,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtE;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhE;;;;;;;;;;;;;;;OAeG;YACW,4BAA4B;~~CAgD3C~~"}
1	+ {"version":3,"file":"auth-token-issuer.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-token-issuer.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qBAAqB,EAAkC,WAAW,EAAwE,MAAM,uBAAuB,CAAC;AAejL,OAAO,EAEL,KAAK,mCAAmC,EAEzC,MAAM,gFAAgF,CAAC;AASxF;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,aAAa,EAAE,OAAO,CAAC;CACxB;AAUD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAuB,GAAG,CAAC,CAQzG;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAK7F;AAED;;;;;;;;;;;GAWG;AACH,qBACa,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAQtF,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IASjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA1BlC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACxC,UAAU,EAAE,iBAAiB,EAC3B,YAAY,EAAE,0BAA0B,EAC/C,YAAY,EAAE,YAAY,EACR,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAQhH,gBAAgB,GAAE,uBAAuB,GAAG,IAAW,EASvD,cAAc,CAAC,EAAE,mCAAmC;IAMvE;;OAEG;IACU,WAAW,CACtB,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GACrG,OAAO,CAAC,UAAU,CAAC;IAgBtB;;;;OAIG;IACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE;QACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,EACD,OAAO,CAAC,EAAE;QACR,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,qBAAqB,CAAC,EAAE,IAAI,CAAC;KAC9B,GACA,OAAO,CAAC,UAAU,CAAC;IAItB;;;OAGG;YACW,mBAAmB;IAiKjC;;;;;;;;;;;;OAYG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkS1E;;;;;OAKG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+CpE;;;;;;;;OAQG;IACU,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtE;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhE;;;;;;;;;;;;;;;OAeG;YACW,4BAA4B;IAkD1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,OAAO,CAAC,eAAe;CAyCxB"}

package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.js CHANGED Viewed

@@ -12,21 +12,23 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import 'reflect-metadata';
 import crypto from 'crypto';
-import { inject, injectable } from 'inversify';
+import { inject, injectable, optional } from 'inversify';
 import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
 import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
 import { AppConfigurationService } from '../../../config/services/app-configuration.backend.service.js';
 import { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service.js';
 import { RedisService } from '../../../databases/services/redis.service.js';
 import { JwtBackendService } from '../../../security/jwt/services/jwt.backend.service.js';
+import { AuditLogsBackendService } from '../../../compliance/audit-trails/services/audit-logs.backend.service.js';
 import { projectCaughtErrorLogFields } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
 import { AuthExecutionContextFactoryBackendService } from '../../../security/authentications/services/auth-execution-context-factory.backend.service.js';
 import { ExecutionContext_ExecutionType, SessionType, ErrorType, ErrorCustomMessageReference, CoreResourceType, UserStatus } from '@wildo-ai/saas-models';
 import { JwtClaim_App_Auth_UserRequest_Schema, JwtClaim_App_RefreshToken_Schema, } from '../../../security/authentications/models/authentications.backend.schemas.js';
 import { AUTH_REDIS_KEYS, RefreshTokenBlacklistReason, REFRESH_TOKEN_ROTATION_GRACE_SECONDS } from '../../../security/authentications/models/auth-constants.backend.js';
-import { buildSessionOrderingScore, CONCURRENT_SESSION_EVICTION_LUA, resolveEvictedJtiBlacklistSeconds, } from '../../../security/authentications/services/utils/concurrent-session-eviction.backend.utils.js';
+import { buildSessionOrderingScore, CONCURRENT_SESSION_EVICTION_LUA, readIssuedAtMilliseconds, resolveEvictedJtiBlacklistSeconds, } from '../../../security/authentications/services/utils/concurrent-session-eviction.backend.utils.js';
 import { evaluateUserTokenInvalidationFence } from '../../../security/token-invalidation-fence.backend.utils.js';
 import { evaluateSessionInvalidationFence } from '../../../security/session-invalidation-fence.backend.utils.js';
+import { AuditObservationKind, emitAuditObservation, } from '../../../monitoring/observability/audit-observation-emission.backend.js';
 import { getUserAuthorizationVersion, } from '../../../security/authentications/models/user-authorization-version.backend.utils.js';
 /** L3: Default max concurrent refresh tokens per user. */
 const DEFAULT_MAX_CONCURRENT_SESSIONS = 10;
@@ -81,8 +83,10 @@ let AuthTokenIssuerBackendService = class AuthTokenIssuerBackendService {
     redisService;
     servicesRegistryHandler;
     authEcFactory;
+    auditLogsService;
+    metricsService;
     logDebug;
-    constructor(logger, appConfigService, jwtService, errorBuilder, redisService, servicesRegistryHandler, authEcFactory) {
+    constructor(logger, appConfigService, jwtService, errorBuilder, redisService, servicesRegistryHandler, authEcFactory, auditLogsService = null, metricsService) {
         this.logger = logger;
         this.appConfigService = appConfigService;
         this.jwtService = jwtService;
@@ -90,6 +94,8 @@ let AuthTokenIssuerBackendService = class AuthTokenIssuerBackendService {
         this.redisService = redisService;
         this.servicesRegistryHandler = servicesRegistryHandler;
         this.authEcFactory = authEcFactory;
+        this.auditLogsService = auditLogsService;
+        this.metricsService = metricsService;
         this.logDebug = this.logger.debugByType('AuthTokenIssuer');
         this.logger.setDebugTypeLogging('AuthTokenIssuer', false);
     }
@@ -572,6 +578,7 @@ let AuthTokenIssuerBackendService = class AuthTokenIssuerBackendService {
                     evictedCount: evictedPairs.length / 2,
                     maxSessions,
                 });
+                this.recordEvictions({ userId, evictedPairs, maxSessions, nowMilliseconds });
             }
         }
         catch (error) {
@@ -582,6 +589,77 @@ let AuthTokenIssuerBackendService = class AuthTokenIssuerBackendService {
             });
         }
     }
+    /**
+     * Record each retired refresh chain in the audit trail.
+     *
+     * Until 2026-09-02 the only trace of an eviction was the debug line above — a security-relevant
+     * token-lifecycle act with no durable record, which is exactly what `CLAUDE.md`'s
+     * assurance-by-construction rule asks for by name. The cap exists to bound the blast radius of
+     * undetected token theft, so a burst of evictions for one principal is among the more interesting
+     * things the trail can carry, and it was not carrying it.
+     *
+     * `evictedIssuedAt` is what makes the record worth having: the cap's security property is that the
+     * OLDEST chain goes, and a record naming only the victim would prove a session ended without
+     * proving the right one did. An unreadable score yields ABSENCE rather than a synthesised instant —
+     * a fabricated timestamp would make the first-in-first-out claim unfalsifiable.
+     *
+     * Feature-DETECTED rather than null-checked, for the reason recorded at the cross-tenant emitter:
+     * adding a `log*` method breaks partially-mocked doubles, the property is absent, and the CALL
+     * throws synchronously before any `.catch()` can make it fire-and-forget.
+     *
+     * ## Why the detection decides an ARGUMENT rather than an early return
+     *
+     * Every emission goes through {@link emitAuditObservation}, which counts a lost one on
+     * `audit_observation_dropped_total`. Handing the seam `undefined` is how this site reports
+     * `SERVICE_UNAVAILABLE` — the loss shape that reaches no `_createAuditLog` and therefore used to
+     * leave nothing behind at all. Returning early on an absent method would restore that silence,
+     * which matters here more than it looks: an unbound audit service makes the eviction trail
+     * PERMANENTLY empty, and an empty eviction trail reads as "the cap never fired".
+     *
+     * The count is per RETIRED CHAIN, not per enforcement — one lost row is one lost row, and a cap
+     * that evicts four chains while the sink is down has lost four pieces of evidence. The
+     * `!evictedJti` skip stays ABOVE the emission for the opposite reason: a pair with no jti is
+     * nothing owed, and counting a deliberate skip would fire the loss signal on correct behaviour.
+     *
+     * assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is
+     * evidenced, naming WHICH chain was retired and when it was issued.
+     */
+    recordEvictions(input) {
+        // Narrowed to a VALUE rather than to a boolean flag: the emitting closure is created inside the
+        // loop, and a captured `const` that is already non-nullish needs no narrowing to survive into it.
+        const emitter = typeof this.auditLogsService?.logUserSessionEvicted === 'function'
+            ? this.auditLogsService
+            : undefined;
+        for (let index = 0; index < input.evictedPairs.length; index += 2) {
+            const evictedJti = input.evictedPairs[index];
+            // Nothing was owed for this pair — a deliberate skip, kept above the emission so it can never
+            // be counted as a loss.
+            if (!evictedJti)
+                continue;
+            const issuedAtMilliseconds = readIssuedAtMilliseconds(input.evictedPairs[index + 1]);
+            emitAuditObservation({
+                observation: AuditObservationKind.USER_SESSION_EVICTED,
+                emit: emitter
+                    ? () => emitter.logUserSessionEvicted({
+                        userId: input.userId,
+                        evictedJti,
+                        ...(issuedAtMilliseconds === undefined ? {} : { evictedIssuedAt: new Date(issuedAtMilliseconds) }),
+                        configuredMaximum: input.maxSessions,
+                        retainedCount: input.maxSessions,
+                    })
+                    : undefined,
+                metricsService: this.metricsService,
+                logger: this.logger,
+                // Enough to reconstruct the lost row from the application log: WHOSE session, WHICH chain,
+                // and under what bound. The jti is the identity the audit row itself would have carried.
+                context: {
+                    observedUserId: input.userId,
+                    observedEvictedJti: evictedJti,
+                    observedConfiguredMaximum: input.maxSessions,
+                },
+            });
+        }
+    }
 };
 AuthTokenIssuerBackendService = __decorate([
     injectable(),
@@ -592,11 +670,16 @@ AuthTokenIssuerBackendService = __decorate([
     __param(4, inject(SAAS_SERVICE_TYPES.RedisService)),
     __param(5, inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService)),
     __param(6, inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory)),
+    __param(7, inject(SAAS_SERVICE_TYPES.AuditLogsService)),
+    __param(7, optional()),
+    __param(8, inject(SAAS_SERVICE_TYPES.MetricsService)),
+    __param(8, optional()),
     __metadata("design:paramtypes", [LoggerService,
         AppConfigurationService,
         JwtBackendService,
         ErrorBuilderBackendService,
-        RedisService, Function, AuthExecutionContextFactoryBackendService])
+        RedisService, Function, AuthExecutionContextFactoryBackendService,
+        AuditLogsBackendService, Object])
 ], AuthTokenIssuerBackendService);
 export { AuthTokenIssuerBackendService };
 //# sourceMappingURL=auth-token-issuer.backend.service.js.map