@acorex-platform/module-security-management-server 0.0.18 → 2.0.0-next.42

package/contracts/src/permission.keys.js

@@ -1,34 +1,62 @@
 "use strict";
-//#region ----   Permission Keys   ----
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AXPSecurityManagementPermissionKeys = void 0;
+exports.AXPSecurityManagementPermissionKeys = exports.AXPAdministrationPermissionKeys = void 0;
+/**
+ * Administration capabilities used by this module.
+ * Domain capability keys for this module. Root groups live in `AXPCommonPermissionGroupKeys` (common contracts).
+ */
+exports.AXPAdministrationPermissionKeys = {
+    Access: 'Administration:Permission:Access',
+    /** Create and maintain users, roles, role assignments, and related security-access reports. */
+    MaintainUsersAndRoles: 'Administration:Permission:MaintainUsersAndRoles',
+    ManageSessions: 'Administration:Permission:ManageSessions',
+    MaintainPolicies: 'Administration:Permission:MaintainPolicies',
+    ViewIntegrations: 'Administration:Permission:ViewIntegrations',
+    MaintainConnections: 'Administration:Permission:MaintainConnections',
+    ManageIntegrationActions: 'Administration:Permission:ManageIntegrationActions',
+    MaintainWorkflows: 'Administration:Permission:MaintainWorkflows',
+    ManageWorkflowActions: 'Administration:Permission:ManageWorkflowActions',
+    ViewRules: 'Administration:Permission:ViewRules',
+    MaintainRules: 'Administration:Permission:MaintainRules',
+    ManageRuleActions: 'Administration:Permission:ManageRuleActions',
+    MaintainAi: 'Administration:Permission:MaintainAi',
+    UseAiAssist: 'Administration:Permission:UseAiAssist',
+    MaintainDashboards: 'Administration:Permission:MaintainDashboards',
+    ViewJobs: 'Administration:Permission:ViewJobs',
+    ManageJobActions: 'Administration:Permission:ManageJobActions',
+    ViewObservability: 'Administration:Permission:ViewObservability',
+    MaintainObservability: 'Administration:Permission:MaintainObservability',
+};
+/**
+ * @deprecated Prefer {@link AXPAdministrationPermissionKeys}.
+ * Legacy nested shape kept so existing imports compile during migration.
+ */
 exports.AXPSecurityManagementPermissionKeys = {
     User: {
-        Management: 'SecurityManagement:Permission:User.Management',
-        View: 'SecurityManagement:Permission:User.View',
-        Edit: 'SecurityManagement:Permission:User.Edit',
-        Delete: 'SecurityManagement:Permission:User.Delete',
-        Create: 'SecurityManagement:Permission:User.Create',
+        Management: exports.AXPAdministrationPermissionKeys.MaintainUsersAndRoles,
+        View: exports.AXPAdministrationPermissionKeys.MaintainUsersAndRoles,
+        Edit: exports.AXPAdministrationPermissionKeys.MaintainUsersAndRoles,
+        Delete: exports.AXPAdministrationPermissionKeys.MaintainUsersAndRoles,
+        Create: exports.AXPAdministrationPermissionKeys.MaintainUsersAndRoles,
     },
     Role: {
-        Management: 'SecurityManagement:Permission:Role.Management',
-        View: 'SecurityManagement:Permission:Role.View',
-        Edit: 'SecurityManagement:Permission:Role.Edit',
-        Delete: 'SecurityManagement:Permission:Role.Delete',
-        Create: 'SecurityManagement:Permission:Role.Create',
+        Management: exports.AXPAdministrationPermissionKeys.MaintainUsersAndRoles,
+        View: exports.AXPAdministrationPermissionKeys.MaintainUsersAndRoles,
+        Edit: exports.AXPAdministrationPermissionKeys.MaintainUsersAndRoles,
+        Delete: exports.AXPAdministrationPermissionKeys.MaintainUsersAndRoles,
+        Create: exports.AXPAdministrationPermissionKeys.MaintainUsersAndRoles,
     },
     DeviceSession: {
-        Management: 'SecurityManagement:Permission:DeviceSession.Management',
-        View: 'SecurityManagement:Permission:DeviceSession.View',
-        Terminate: 'SecurityManagement:Permission:DeviceSession.Terminate',
+        Management: exports.AXPAdministrationPermissionKeys.ManageSessions,
+        View: exports.AXPAdministrationPermissionKeys.ManageSessions,
+        Terminate: exports.AXPAdministrationPermissionKeys.ManageSessions,
     },
     Policy: {
-        Management: 'SecurityManagement:Permission:Policy.Management',
-        View: 'SecurityManagement:Permission:Policy.View',
-        Edit: 'SecurityManagement:Permission:Policy.Edit',
-        Delete: 'SecurityManagement:Permission:Policy.Delete',
-        Create: 'SecurityManagement:Permission:Policy.Create',
+        Management: exports.AXPAdministrationPermissionKeys.MaintainPolicies,
+        View: exports.AXPAdministrationPermissionKeys.MaintainPolicies,
+        Edit: exports.AXPAdministrationPermissionKeys.MaintainPolicies,
+        Delete: exports.AXPAdministrationPermissionKeys.MaintainPolicies,
+        Create: exports.AXPAdministrationPermissionKeys.MaintainPolicies,
     },
 };
-//#endregion
 //# sourceMappingURL=permission.keys.js.map

package/contracts/src/permission.keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/permission.keys.ts"],"names":[],"mappings":";AAAA,uCAAuC;;;AAE1B,QAAA,mCAAmC,GAAG;IACjD,IAAI,EAAE;QACJ,UAAU,EAAE,+CAA+C;QAC3D,IAAI,EAAE,yCAAyC;QAC/C,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,2CAA2C;KACpD;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,+CAA+C;QAC3D,IAAI,EAAE,yCAAyC;QAC/C,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EAAE,2CAA2C;QACnD,MAAM,EAAE,2CAA2C;KACpD;IACD,aAAa,EAAE;QACb,UAAU,EAAE,wDAAwD;QACpE,IAAI,EAAE,kDAAkD;QACxD,SAAS,EAAE,uDAAuD;KACnE;IACD,MAAM,EAAE;QACN,UAAU,EAAE,iDAAiD;QAC7D,IAAI,EAAE,2CAA2C;QACjD,IAAI,EAAE,2CAA2C;QACjD,MAAM,EAAE,6CAA6C;QACrD,MAAM,EAAE,6CAA6C;KACtD;CACO,CAAC;AAEX,YAAY"}
+{"version":3,"file":"permission.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/permission.keys.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACU,QAAA,+BAA+B,GAAG;IAC7C,MAAM,EAAE,kCAAkC;IAC1C,+FAA+F;IAC/F,qBAAqB,EAAE,iDAAiD;IACxE,cAAc,EAAE,0CAA0C;IAC1D,gBAAgB,EAAE,4CAA4C;IAC9D,gBAAgB,EAAE,4CAA4C;IAC9D,mBAAmB,EAAE,+CAA+C;IACpE,wBAAwB,EAAE,oDAAoD;IAC9E,iBAAiB,EAAE,6CAA6C;IAChE,qBAAqB,EAAE,iDAAiD;IACxE,SAAS,EAAE,qCAAqC;IAChD,aAAa,EAAE,yCAAyC;IACxD,iBAAiB,EAAE,6CAA6C;IAChE,UAAU,EAAE,sCAAsC;IAClD,WAAW,EAAE,uCAAuC;IACpD,kBAAkB,EAAE,8CAA8C;IAClE,QAAQ,EAAE,oCAAoC;IAC9C,gBAAgB,EAAE,4CAA4C;IAC9D,iBAAiB,EAAE,6CAA6C;IAChE,qBAAqB,EAAE,iDAAiD;CAChE,CAAC;AAEX;;;GAGG;AACU,QAAA,mCAAmC,GAAG;IACjD,IAAI,EAAE;QACJ,UAAU,EAAE,uCAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,uCAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,uCAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,uCAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,uCAA+B,CAAC,qBAAqB;KAC9D;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,uCAA+B,CAAC,qBAAqB;QACjE,IAAI,EAAE,uCAA+B,CAAC,qBAAqB;QAC3D,IAAI,EAAE,uCAA+B,CAAC,qBAAqB;QAC3D,MAAM,EAAE,uCAA+B,CAAC,qBAAqB;QAC7D,MAAM,EAAE,uCAA+B,CAAC,qBAAqB;KAC9D;IACD,aAAa,EAAE;QACb,UAAU,EAAE,uCAA+B,CAAC,cAAc;QAC1D,IAAI,EAAE,uCAA+B,CAAC,cAAc;QACpD,SAAS,EAAE,uCAA+B,CAAC,cAAc;KAC1D;IACD,MAAM,EAAE;QACN,UAAU,EAAE,uCAA+B,CAAC,gBAAgB;QAC5D,IAAI,EAAE,uCAA+B,CAAC,gBAAgB;QACtD,IAAI,EAAE,uCAA+B,CAAC,gBAAgB;QACtD,MAAM,EAAE,uCAA+B,CAAC,gBAAgB;QACxD,MAAM,EAAE,uCAA+B,CAAC,gBAAgB;KACzD;CACO,CAAC"}

package/contracts/src/resolve-user-effective-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-user-effective-state.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/resolve-user-effective-state.ts"],"names":[],"mappings":";;AAiBA,oEA6BC;AA9CD,2DAAyD;AACzD,iEAA+D;AAE/D,2CAA2C;AAE3C,MAAM,qBAAqB,GAAG;IAC5B,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX;;;GAGG;AACH,SAAgB,4BAA4B,CAAC,KAG5C;;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,sCAAkB,CAAC,OAAO,CAAW,CAAC;IAEzE,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,4CAAqB,CAAC,QAAQ,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,OAAO,EAAE,CAAC;QAChD,OAAO,4CAAqB,CAAC,OAAO,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,4CAAqB,CAAC,QAAQ,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,SAAS,EAAE,CAAC;QAClD,OAAO,4CAAqB,CAAC,SAAS,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,KAAK,sCAAkB,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,4CAAqB,CAAC,iBAAiB,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,KAAK,sCAAkB,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,4CAAqB,CAAC,aAAa,CAAC;IAC7C,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,MAAM,EAAE,CAAC;QAC/C,OAAO,4CAAqB,CAAC,MAAM,CAAC;IACtC,CAAC;IACD,OAAO,4CAAqB,CAAC,MAAM,CAAC;AACtC,CAAC;AAED,YAAY"}
+{"version":3,"file":"resolve-user-effective-state.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/resolve-user-effective-state.ts"],"names":[],"mappings":";;AAiBA,oEA6BC;AA9CD,2DAAyD;AACzD,iEAA+D;AAE/D,2CAA2C;AAE3C,MAAM,qBAAqB,GAAG;IAC5B,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX;;;GAGG;AACH,SAAgB,4BAA4B,CAAC,KAG5C;;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,sCAAkB,CAAC,OAAO,CAAW,CAAC;IAEzE,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,4CAAqB,CAAC,QAAQ,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,OAAO,EAAE,CAAC;QAChD,OAAO,4CAAqB,CAAC,OAAO,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,4CAAqB,CAAC,QAAQ,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,SAAS,EAAE,CAAC;QAClD,OAAO,4CAAqB,CAAC,SAAS,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,KAAK,sCAAkB,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,4CAAqB,CAAC,iBAAiB,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,KAAK,sCAAkB,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,4CAAqB,CAAC,aAAa,CAAC;IAC7C,CAAC;IACD,IAAI,SAAS,KAAK,qBAAqB,CAAC,MAAM,EAAE,CAAC;QAC/C,OAAO,4CAAqB,CAAC,MAAM,CAAC;IACtC,CAAC;IACD,OAAO,4CAAqB,CAAC,MAAM,CAAC;AACtC,CAAC;AAED,YAAY"}

package/contracts/src/root-config.d.ts

@@ -34,11 +34,44 @@ export declare const RootConfig: {
             readonly titlePlural: `@${string}:roles.entities.role.plural`;
             readonly icon: "fa-light fa-user-tag";
         };
+        readonly rolePermission: {
+            readonly name: "RolePermission";
+            readonly title: `@${string}:role-permissions.entities.role-permission.title`;
+            readonly titlePlural: `@${string}:role-permissions.entities.role-permission.plural`;
+            readonly icon: "fa-light fa-key";
+        };
+        readonly userRole: {
+            readonly name: "UserRole";
+            readonly title: `@${string}:user-roles.entities.user-role.title`;
+            readonly titlePlural: `@${string}:user-roles.entities.user-role.plural`;
+            readonly icon: "fa-light fa-user-tag";
+        };
         readonly profile: {
             readonly name: "Profile";
             readonly title: `@${string}:profile.entities.profile.title`;
             readonly titlePlural: `@${string}:profile.entities.profile.plural`;
             readonly icon: "fa-light fa-user";
         };
+        readonly identityProvider: {
+            readonly name: "IdentityProvider";
+            readonly title: `@${string}:identity-providers.entities.identity-provider.title`;
+            readonly titlePlural: `@${string}:identity-providers.entities.identity-provider.plural`;
+            readonly icon: "fa-light fa-id-badge";
+        };
+        readonly userTwoFactor: {
+            readonly name: "UserTwoFactor";
+            readonly title: `@${string}:user-two-factor.entities.user-two-factor.title`;
+            readonly titlePlural: `@${string}:user-two-factor.entities.user-two-factor.plural`;
+            readonly icon: "fa-light fa-shield-keyhole";
+        };
+    };
+    readonly queries: {
+        readonly reports: {
+            readonly getUserEffectiveRolesHistory: "SecurityManagement:Reports:GetUserEffectiveRolesHistory";
+            readonly getUserEffectivePermissionsHistory: "SecurityManagement:Reports:GetUserEffectivePermissionsHistory";
+            readonly getRoleHoldersHistory: "SecurityManagement:Reports:GetRoleHoldersHistory";
+            readonly getPermissionHoldersHistory: "SecurityManagement:Reports:GetPermissionHoldersHistory";
+            readonly getUserPasswordChangeHistory: "SecurityManagement:Reports:GetUserPasswordChangeHistory";
+        };
     };
 };

package/contracts/src/root-config.js

@@ -38,12 +38,45 @@ exports.RootConfig = {
             titlePlural: `@${config.i18n}:roles.entities.role.plural`,
             icon: 'fa-light fa-user-tag',
         },
+        rolePermission: {
+            name: 'RolePermission',
+            title: `@${config.i18n}:role-permissions.entities.role-permission.title`,
+            titlePlural: `@${config.i18n}:role-permissions.entities.role-permission.plural`,
+            icon: 'fa-light fa-key',
+        },
+        userRole: {
+            name: 'UserRole',
+            title: `@${config.i18n}:user-roles.entities.user-role.title`,
+            titlePlural: `@${config.i18n}:user-roles.entities.user-role.plural`,
+            icon: 'fa-light fa-user-tag',
+        },
         profile: {
             name: 'Profile',
             title: `@${config.i18n}:profile.entities.profile.title`,
             titlePlural: `@${config.i18n}:profile.entities.profile.plural`,
             icon: 'fa-light fa-user',
         },
+        identityProvider: {
+            name: 'IdentityProvider',
+            title: `@${config.i18n}:identity-providers.entities.identity-provider.title`,
+            titlePlural: `@${config.i18n}:identity-providers.entities.identity-provider.plural`,
+            icon: 'fa-light fa-id-badge',
+        },
+        userTwoFactor: {
+            name: 'UserTwoFactor',
+            title: `@${config.i18n}:user-two-factor.entities.user-two-factor.title`,
+            titlePlural: `@${config.i18n}:user-two-factor.entities.user-two-factor.plural`,
+            icon: 'fa-light fa-shield-keyhole',
+        },
+    },
+    queries: {
+        reports: {
+            getUserEffectiveRolesHistory: 'SecurityManagement:Reports:GetUserEffectiveRolesHistory',
+            getUserEffectivePermissionsHistory: 'SecurityManagement:Reports:GetUserEffectivePermissionsHistory',
+            getRoleHoldersHistory: 'SecurityManagement:Reports:GetRoleHoldersHistory',
+            getPermissionHoldersHistory: 'SecurityManagement:Reports:GetPermissionHoldersHistory',
+            getUserPasswordChangeHistory: 'SecurityManagement:Reports:GetUserPasswordChangeHistory',
+        },
     },
 };
 //# sourceMappingURL=root-config.js.map

package/contracts/src/root-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"root-config.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/root-config.ts"],"names":[],"mappings":";;;AAAA,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,qBAAqB;IAC3B,aAAa,EAAE,SAAS;CACzB,CAAC;AACW,QAAA,UAAU,GAAG;IACxB,MAAM;IACN,MAAM,EAAE;QACN,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,eAAe;QACrC,IAAI,EAAE,2BAA2B;KAClC;IACD,QAAQ,EAAE;QACR,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,iCAAiC;YACvD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,kCAAkC;YAC9D,IAAI,EAAE,4BAA4B;SACnC;QACD,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,kCAAkC;YACxD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,mCAAmC;YAC/D,IAAI,EAAE,oBAAoB;SAC3B;QACD,KAAK,EAAE;YACL,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,4BAA4B;YAClD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,6BAA6B;YACzD,IAAI,EAAE,mBAAmB;SAC1B;QACD,KAAK,EAAE;YACL,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,4BAA4B;YAClD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,6BAA6B;YACzD,IAAI,EAAE,sBAAsB;SAC7B;QACD,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,iCAAiC;YACvD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,kCAAkC;YAC9D,IAAI,EAAE,kBAAkB;SACzB;KACF;CACO,CAAC"}
+{"version":3,"file":"root-config.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/root-config.ts"],"names":[],"mappings":";;;AAAA,MAAM,MAAM,GAAG;IACb,IAAI,EAAE,qBAAqB;IAC3B,aAAa,EAAE,SAAS;CACzB,CAAC;AACW,QAAA,UAAU,GAAG;IACxB,MAAM;IACN,MAAM,EAAE;QACN,KAAK,EAAE,qBAAqB;QAC5B,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,eAAe;QACrC,IAAI,EAAE,2BAA2B;KAClC;IACD,QAAQ,EAAE;QACR,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,iCAAiC;YACvD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,kCAAkC;YAC9D,IAAI,EAAE,4BAA4B;SACnC;QACD,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,kCAAkC;YACxD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,mCAAmC;YAC/D,IAAI,EAAE,oBAAoB;SAC3B;QACD,KAAK,EAAE;YACL,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,4BAA4B;YAClD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,6BAA6B;YACzD,IAAI,EAAE,mBAAmB;SAC1B;QACD,KAAK,EAAE;YACL,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,4BAA4B;YAClD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,6BAA6B;YACzD,IAAI,EAAE,sBAAsB;SAC7B;QACD,cAAc,EAAE;YACd,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,kDAAkD;YACxE,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,mDAAmD;YAC/E,IAAI,EAAE,iBAAiB;SACxB;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,sCAAsC;YAC5D,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,uCAAuC;YACnE,IAAI,EAAE,sBAAsB;SAC7B;QACD,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,iCAAiC;YACvD,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,kCAAkC;YAC9D,IAAI,EAAE,kBAAkB;SACzB;QACD,gBAAgB,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,sDAAsD;YAC5E,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,uDAAuD;YACnF,IAAI,EAAE,sBAAsB;SAC7B;QACD,aAAa,EAAE;YACb,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,iDAAiD;YACvE,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,kDAAkD;YAC9E,IAAI,EAAE,4BAA4B;SACnC;KACF;IACD,OAAO,EAAE;QACP,OAAO,EAAE;YACP,4BAA4B,EAAE,yDAAyD;YACvF,kCAAkC,EAChC,+DAA+D;YACjE,qBAAqB,EAAE,kDAAkD;YACzE,2BAA2B,EAAE,wDAAwD;YACrF,4BAA4B,EAAE,yDAAyD;SACxF;KACF;CACO,CAAC"}

package/contracts/src/server-commands.d.ts

@@ -1,9 +1,53 @@
 export declare const AXMSecurityManagementServerCommands: {
     readonly SendPasswordResetEmail: "SecurityManagement:Server:SendPasswordResetEmail";
     readonly CompletePasswordReset: "SecurityManagement:Server:CompletePasswordReset";
+    readonly ChangeOwnPassword: "SecurityManagement:Server:ChangeOwnPassword";
+    readonly GetOwnPasswordStatus: "SecurityManagement:Server:GetOwnPasswordStatus";
+    readonly InviteUser: "SecurityManagement:Server:InviteUser";
+    /** Tenant-subscribed applications for TM invite picker (ADR-TEN-001 D-05). */
+    readonly ListTenantEntitledApplications: "SecurityManagement:Server:ListTenantEntitledApplications";
+    /** Per-app Role overlays for TM invite repeater (bypasses app-catalog list isolation). */
+    readonly ListInviteAssignableRoles: "SecurityManagement:Server:ListInviteAssignableRoles";
+    readonly ResendInvitation: "SecurityManagement:Server:ResendInvitation";
+    readonly CancelInvitation: "SecurityManagement:Server:CancelInvitation";
+    readonly AcceptInvitation: "SecurityManagement:Server:AcceptInvitation";
+    readonly ListMyPendingInvitations: "SecurityManagement:Server:ListMyPendingInvitations";
+    readonly DeclineInvitation: "SecurityManagement:Server:DeclineInvitation";
+    readonly AcceptMyInvitation: "SecurityManagement:Server:AcceptMyInvitation";
+    readonly LookupTenantByUniqueName: "SecurityManagement:Server:LookupTenantByUniqueName";
+    readonly RequestTenantMembership: "SecurityManagement:Server:RequestTenantMembership";
+    readonly ListMyJoinRequests: "SecurityManagement:Server:ListMyJoinRequests";
+    readonly CancelMyJoinRequest: "SecurityManagement:Server:CancelMyJoinRequest";
+    readonly ApproveJoinRequest: "SecurityManagement:Server:ApproveJoinRequest";
+    readonly RejectJoinRequest: "SecurityManagement:Server:RejectJoinRequest";
+    readonly CreateUserInTenant: "SecurityManagement:Server:CreateUserInTenant";
+    readonly StartTwoFactorEnrollment: "SecurityManagement:Server:StartTwoFactorEnrollment";
+    readonly ConfirmTwoFactorEnrollment: "SecurityManagement:Server:ConfirmTwoFactorEnrollment";
+    readonly DisableTwoFactor: "SecurityManagement:Server:DisableTwoFactor";
+    readonly GenerateTwoFactorRecoveryCodes: "SecurityManagement:Server:GenerateTwoFactorRecoveryCodes";
+    readonly GetTwoFactorStatus: "SecurityManagement:Server:GetTwoFactorStatus";
+    readonly AdminResetTwoFactor: "SecurityManagement:Server:AdminResetTwoFactor";
+    /** Public — completes login after password challenge (TOTP or recovery). */
+    readonly VerifyTwoFactorLogin: "SecurityManagement:Server:VerifyTwoFactorLogin";
+};
+/** Stable codes for self-service password change (client maps to i18n). */
+export declare const AXM_CHANGE_OWN_PASSWORD_ERROR_CODES: {
+    readonly NotSignedIn: "CHANGE_OWN_PASSWORD_NOT_SIGNED_IN";
+    readonly IncorrectCurrent: "CHANGE_OWN_PASSWORD_INCORRECT_CURRENT";
+    readonly SameAsCurrent: "CHANGE_OWN_PASSWORD_SAME_AS_CURRENT";
+    readonly InvalidInput: "CHANGE_OWN_PASSWORD_INVALID_INPUT";
 };
 /** Client/UI action key (confirm dialog → server send). */
 export declare const AXM_USER_SEND_PASSWORD_RESET_COMMAND = "SecurityManagement:User:SendPasswordResetEmail";
+/** Client/UI action key (confirm dialog → server admin reset 2FA). */
+export declare const AXM_USER_RESET_TWO_FACTOR_COMMAND = "SecurityManagement:User:ResetTwoFactor";
+/** Client/UI action keys for invite / create-in-tenant flows. */
+export declare const AXM_USER_INVITE_COMMAND = "SecurityManagement:User:Invite";
+export declare const AXM_USER_RESEND_INVITATION_COMMAND = "SecurityManagement:User:ResendInvitation";
+export declare const AXM_USER_CANCEL_INVITATION_COMMAND = "SecurityManagement:User:CancelInvitation";
+export declare const AXM_USER_APPROVE_JOIN_REQUEST_COMMAND = "SecurityManagement:User:ApproveJoinRequest";
+export declare const AXM_USER_REJECT_JOIN_REQUEST_COMMAND = "SecurityManagement:User:RejectJoinRequest";
+export declare const AXM_USER_CREATE_IN_TENANT_COMMAND = "SecurityManagement:User:CreateInTenant";
 export interface AXMSendPasswordResetEmailInput {
     /** Admin path: target user id. */
     userId?: string;
@@ -16,3 +60,281 @@ export interface AXMCompletePasswordResetInput {
     token: string;
     newPassword: string;
 }
+export interface AXMChangeOwnPasswordInput {
+    /** Required when the account already has a password; omit/empty when setting the first password. */
+    currentPassword?: string;
+    newPassword: string;
+}
+export interface AXMChangeOwnPasswordResult {
+    passwordChangedAt: string;
+}
+export interface AXMGetOwnPasswordStatusResult {
+    /** True when the signed-in user has a non-empty stored password credential. */
+    hasPassword: boolean;
+}
+export interface AXMInviteUserInput {
+    email: string;
+    displayName?: string;
+    applicationIds?: string[];
+    /**
+     * Role ids to assign on invite (scoped UserRole grant).
+     * Application invite → app-scoped grant; tenant invite without per-app rows → tenant-wide grant.
+     */
+    roleIds?: string[];
+    /**
+     * TM Tenant Users repeater: roles per selected application.
+     * When present, server upserts a UserRole grant per application (not one tenant-wide grant).
+     */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * True when invite is from Tenant Users (tenant-membership) with multi-app UI.
+     * Server SoT with session edition feature — not Application.code === 'TM'.
+     */
+    tenantMembershipInvite?: boolean;
+    /** Client sets true after warning that the identity already exists. */
+    confirmExisting?: boolean;
+    webOrigin?: string;
+}
+/** One selectable application for TM invite (tenant subscription entitlement). */
+export interface AXMTenantEntitledApplicationItem {
+    id: string;
+    /** Raw MLS / string title — client resolves for display. */
+    title: unknown;
+}
+export interface AXMListTenantEntitledApplicationsResult {
+    items: AXMTenantEntitledApplicationItem[];
+}
+/** One Role overlay selectable on a TM invite repeater row. */
+export interface AXMInviteAssignableRoleItem {
+    id: string;
+    title: unknown;
+    name?: string;
+    applicationId: string;
+}
+export interface AXMListInviteAssignableRolesInput {
+    /** When set, only overlays for this application (current tenant). */
+    applicationId?: string;
+}
+export interface AXMListInviteAssignableRolesResult {
+    items: AXMInviteAssignableRoleItem[];
+}
+export interface AXMInviteUserResult {
+    userId: string;
+    tenantUserId: string;
+    userAlreadyExists: boolean;
+    sent: boolean;
+}
+export interface AXMResendInvitationInput {
+    tenantUserId?: string;
+    userId?: string;
+    webOrigin?: string;
+}
+export interface AXMCancelInvitationInput {
+    tenantUserId?: string;
+    userId?: string;
+}
+/** Stable codes for public invitation accept (client maps invalid/expired to the page, not a toast). */
+export declare const AXM_ACCEPT_INVITATION_ERROR_CODES: {
+    readonly Invalid: "ACCEPT_INVITATION_INVALID";
+    readonly Expired: "ACCEPT_INVITATION_EXPIRED";
+    readonly PasswordRequired: "ACCEPT_INVITATION_PASSWORD_REQUIRED";
+};
+export type AXMAcceptInvitationReason = 'valid' | 'invalid' | 'expired';
+export interface AXMAcceptInvitationInput {
+    token: string;
+    newPassword?: string;
+    /** Check the token only. Does not set a password or consume the link. */
+    preview?: boolean;
+}
+export interface AXMAcceptInvitationPreviewResult {
+    usable: boolean;
+    reason: AXMAcceptInvitationReason;
+}
+export interface AXMPendingInvitationItem {
+    tenantUserId: string;
+    tenantId: string;
+    tenantTitle?: string;
+    /** Tenant branding logo URL / storage id when available. */
+    tenantLogo?: string;
+    invitedByUserId?: string;
+    expiresAt?: string;
+    sentAt?: string;
+    applicationIds?: string[];
+}
+export interface AXMListMyPendingInvitationsResult {
+    items: AXMPendingInvitationItem[];
+}
+export interface AXMAcceptMyInvitationInput {
+    tenantUserId: string;
+    newPassword?: string;
+}
+export interface AXMDeclineInvitationInput {
+    tenantUserId: string;
+}
+/** Stable codes for waiting-room join-by-unique-name (client maps to i18n). */
+export declare const AXM_JOIN_REQUEST_ERROR_CODES: {
+    readonly NotSignedIn: "JOIN_REQUEST_NOT_SIGNED_IN";
+    readonly InvalidInput: "JOIN_REQUEST_INVALID_INPUT";
+    readonly TenantNotFound: "JOIN_REQUEST_TENANT_NOT_FOUND";
+    readonly AlreadyMember: "JOIN_REQUEST_ALREADY_MEMBER";
+    readonly InvitePending: "JOIN_REQUEST_INVITE_PENDING";
+    readonly RequestNotFound: "JOIN_REQUEST_NOT_FOUND";
+    readonly NotPending: "JOIN_REQUEST_NOT_PENDING";
+};
+export interface AXMLookupTenantByUniqueNameInput {
+    /** Tenant unique `name` or display `title` (any locale). Case-insensitive exact match. */
+    uniqueName: string;
+}
+export interface AXMLookupTenantByUniqueNameItem {
+    id: string;
+    /** Stored unique name with original casing. */
+    name: string;
+}
+export interface AXMLookupTenantByUniqueNameResult {
+    /** Present only when the name/title matches exactly one active tenant. */
+    item?: AXMLookupTenantByUniqueNameItem | null;
+}
+export interface AXMRequestTenantMembershipInput {
+    /** Tenant unique `name` or display `title` (any locale). Case-insensitive exact match. */
+    uniqueName: string;
+}
+export interface AXMRequestTenantMembershipResult {
+    tenantUserId: string;
+    tenantId: string;
+    tenantName: string;
+}
+export interface AXMJoinRequestItem {
+    tenantUserId: string;
+    tenantId: string;
+    tenantName?: string;
+    tenantTitle?: string;
+    /** Tenant branding logo URL / storage id when available. */
+    tenantLogo?: string;
+    sentAt?: string;
+    expiresAt?: string;
+}
+export interface AXMListMyJoinRequestsResult {
+    items: AXMJoinRequestItem[];
+}
+export interface AXMCancelMyJoinRequestInput {
+    tenantUserId: string;
+}
+export interface AXMApproveJoinRequestInput {
+    tenantUserId?: string;
+    userId?: string;
+    /** Product / app-scoped approve: roles for the current session application. */
+    roleIds?: string[];
+    applicationIds?: string[];
+    /** TM Tenant Users: per-application role rows (same shape as invite). */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * When true, allow multi-application assignment (TM Tenant Users + edition feature).
+     * Mirrors invite `tenantMembershipInvite`.
+     */
+    tenantMembershipApprove?: boolean;
+}
+export interface AXMRejectJoinRequestInput {
+    tenantUserId?: string;
+    userId?: string;
+}
+export interface AXMCreateUserInTenantInput {
+    email?: string;
+    username?: string;
+    displayName?: string;
+    password?: string;
+    applicationIds?: string[];
+    /** Product Users create: roles for the current session application. */
+    roleIds?: string[];
+    /** TM Tenant Users create: per-application role rows (merged client-side before submit). */
+    applicationRoleAssignments?: Array<{
+        applicationId: string;
+        roleIds: string[];
+    }>;
+    /**
+     * When true, allow multi-application assignment (TM Tenant Users + edition feature).
+     * Parallel to invite `tenantMembershipInvite`; Create path only.
+     */
+    tenantMembershipCreate?: boolean;
+}
+export interface AXMCreateUserInTenantResult {
+    userId: string;
+    tenantUserId: string;
+}
+/** Stable codes for two-factor self-service and login challenge (client maps to i18n). */
+export declare const AXM_TWO_FACTOR_ERROR_CODES: {
+    readonly NotSignedIn: "TWO_FACTOR_NOT_SIGNED_IN";
+    readonly InvalidInput: "TWO_FACTOR_INVALID_INPUT";
+    readonly IncorrectPassword: "TWO_FACTOR_INCORRECT_PASSWORD";
+    readonly IncorrectCode: "TWO_FACTOR_INCORRECT_CODE";
+    readonly AlreadyEnabled: "TWO_FACTOR_ALREADY_ENABLED";
+    readonly NotEnabled: "TWO_FACTOR_NOT_ENABLED";
+    readonly EnrollmentExpired: "TWO_FACTOR_ENROLLMENT_EXPIRED";
+    readonly ChallengeExpired: "TWO_FACTOR_CHALLENGE_EXPIRED";
+    readonly RateLimited: "TWO_FACTOR_RATE_LIMITED";
+    readonly InvalidConfiguration: "TWO_FACTOR_INVALID_CONFIGURATION";
+    readonly ProofRequired: "TWO_FACTOR_PROOF_REQUIRED";
+    readonly UserNotFound: "TWO_FACTOR_USER_NOT_FOUND";
+    readonly Forbidden: "TWO_FACTOR_FORBIDDEN";
+};
+export interface AXMStartTwoFactorEnrollmentInput {
+    password: string;
+}
+export interface AXMStartTwoFactorEnrollmentResult {
+    enrollmentId: string;
+    otpauthUri: string;
+    /** Base32 secret for manual entry (client renders QR via ax-qrcode). */
+    secretBase32: string;
+    expiresAt: string;
+}
+export interface AXMConfirmTwoFactorEnrollmentInput {
+    enrollmentId: string;
+    code: string;
+}
+export interface AXMConfirmTwoFactorEnrollmentResult {
+    enabled: true;
+    verifiedAt: string;
+}
+export interface AXMDisableTwoFactorInput {
+    /** At least one of password or totpCode is required. */
+    password?: string;
+    totpCode?: string;
+}
+export interface AXMDisableTwoFactorResult {
+    enabled: false;
+}
+export interface AXMGenerateTwoFactorRecoveryCodesInput {
+    /** At least one of password or totpCode is required. */
+    password?: string;
+    totpCode?: string;
+}
+export interface AXMGenerateTwoFactorRecoveryCodesResult {
+    /** Plaintext codes shown once only (display format ABCD-EFGH). */
+    codes: string[];
+}
+export interface AXMGetTwoFactorStatusResult {
+    enabled: boolean;
+    enrolled: boolean;
+    verifiedAt?: string | null;
+    hasRecoveryCodes: boolean;
+    unusedRecoveryCodeCount: number;
+}
+export interface AXMAdminResetTwoFactorInput {
+    userId: string;
+    /** When true, only validates that 2FA is enabled; does not wipe or revoke sessions. */
+    dryRun?: boolean;
+}
+export interface AXMAdminResetTwoFactorResult {
+    reset: boolean;
+}
+export interface AXMVerifyTwoFactorLoginInput {
+    challengeId: string;
+    /** TOTP (6 digits) or recovery code. */
+    code: string;
+    rememberMe?: boolean;
+}

package/contracts/src/server-commands.js

@@ -1,12 +1,88 @@
 "use strict";
 //#region ---- Security management server command keys ----
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AXM_USER_SEND_PASSWORD_RESET_COMMAND = exports.AXMSecurityManagementServerCommands = void 0;
+exports.AXM_TWO_FACTOR_ERROR_CODES = exports.AXM_JOIN_REQUEST_ERROR_CODES = exports.AXM_ACCEPT_INVITATION_ERROR_CODES = exports.AXM_USER_CREATE_IN_TENANT_COMMAND = exports.AXM_USER_REJECT_JOIN_REQUEST_COMMAND = exports.AXM_USER_APPROVE_JOIN_REQUEST_COMMAND = exports.AXM_USER_CANCEL_INVITATION_COMMAND = exports.AXM_USER_RESEND_INVITATION_COMMAND = exports.AXM_USER_INVITE_COMMAND = exports.AXM_USER_RESET_TWO_FACTOR_COMMAND = exports.AXM_USER_SEND_PASSWORD_RESET_COMMAND = exports.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES = exports.AXMSecurityManagementServerCommands = void 0;
 exports.AXMSecurityManagementServerCommands = {
     SendPasswordResetEmail: 'SecurityManagement:Server:SendPasswordResetEmail',
     CompletePasswordReset: 'SecurityManagement:Server:CompletePasswordReset',
+    ChangeOwnPassword: 'SecurityManagement:Server:ChangeOwnPassword',
+    GetOwnPasswordStatus: 'SecurityManagement:Server:GetOwnPasswordStatus',
+    InviteUser: 'SecurityManagement:Server:InviteUser',
+    /** Tenant-subscribed applications for TM invite picker (ADR-TEN-001 D-05). */
+    ListTenantEntitledApplications: 'SecurityManagement:Server:ListTenantEntitledApplications',
+    /** Per-app Role overlays for TM invite repeater (bypasses app-catalog list isolation). */
+    ListInviteAssignableRoles: 'SecurityManagement:Server:ListInviteAssignableRoles',
+    ResendInvitation: 'SecurityManagement:Server:ResendInvitation',
+    CancelInvitation: 'SecurityManagement:Server:CancelInvitation',
+    AcceptInvitation: 'SecurityManagement:Server:AcceptInvitation',
+    ListMyPendingInvitations: 'SecurityManagement:Server:ListMyPendingInvitations',
+    DeclineInvitation: 'SecurityManagement:Server:DeclineInvitation',
+    AcceptMyInvitation: 'SecurityManagement:Server:AcceptMyInvitation',
+    LookupTenantByUniqueName: 'SecurityManagement:Server:LookupTenantByUniqueName',
+    RequestTenantMembership: 'SecurityManagement:Server:RequestTenantMembership',
+    ListMyJoinRequests: 'SecurityManagement:Server:ListMyJoinRequests',
+    CancelMyJoinRequest: 'SecurityManagement:Server:CancelMyJoinRequest',
+    ApproveJoinRequest: 'SecurityManagement:Server:ApproveJoinRequest',
+    RejectJoinRequest: 'SecurityManagement:Server:RejectJoinRequest',
+    CreateUserInTenant: 'SecurityManagement:Server:CreateUserInTenant',
+    StartTwoFactorEnrollment: 'SecurityManagement:Server:StartTwoFactorEnrollment',
+    ConfirmTwoFactorEnrollment: 'SecurityManagement:Server:ConfirmTwoFactorEnrollment',
+    DisableTwoFactor: 'SecurityManagement:Server:DisableTwoFactor',
+    GenerateTwoFactorRecoveryCodes: 'SecurityManagement:Server:GenerateTwoFactorRecoveryCodes',
+    GetTwoFactorStatus: 'SecurityManagement:Server:GetTwoFactorStatus',
+    AdminResetTwoFactor: 'SecurityManagement:Server:AdminResetTwoFactor',
+    /** Public — completes login after password challenge (TOTP or recovery). */
+    VerifyTwoFactorLogin: 'SecurityManagement:Server:VerifyTwoFactorLogin',
+};
+/** Stable codes for self-service password change (client maps to i18n). */
+exports.AXM_CHANGE_OWN_PASSWORD_ERROR_CODES = {
+    NotSignedIn: 'CHANGE_OWN_PASSWORD_NOT_SIGNED_IN',
+    IncorrectCurrent: 'CHANGE_OWN_PASSWORD_INCORRECT_CURRENT',
+    SameAsCurrent: 'CHANGE_OWN_PASSWORD_SAME_AS_CURRENT',
+    InvalidInput: 'CHANGE_OWN_PASSWORD_INVALID_INPUT',
 };
 /** Client/UI action key (confirm dialog → server send). */
 exports.AXM_USER_SEND_PASSWORD_RESET_COMMAND = 'SecurityManagement:User:SendPasswordResetEmail';
+/** Client/UI action key (confirm dialog → server admin reset 2FA). */
+exports.AXM_USER_RESET_TWO_FACTOR_COMMAND = 'SecurityManagement:User:ResetTwoFactor';
+/** Client/UI action keys for invite / create-in-tenant flows. */
+exports.AXM_USER_INVITE_COMMAND = 'SecurityManagement:User:Invite';
+exports.AXM_USER_RESEND_INVITATION_COMMAND = 'SecurityManagement:User:ResendInvitation';
+exports.AXM_USER_CANCEL_INVITATION_COMMAND = 'SecurityManagement:User:CancelInvitation';
+exports.AXM_USER_APPROVE_JOIN_REQUEST_COMMAND = 'SecurityManagement:User:ApproveJoinRequest';
+exports.AXM_USER_REJECT_JOIN_REQUEST_COMMAND = 'SecurityManagement:User:RejectJoinRequest';
+exports.AXM_USER_CREATE_IN_TENANT_COMMAND = 'SecurityManagement:User:CreateInTenant';
+/** Stable codes for public invitation accept (client maps invalid/expired to the page, not a toast). */
+exports.AXM_ACCEPT_INVITATION_ERROR_CODES = {
+    Invalid: 'ACCEPT_INVITATION_INVALID',
+    Expired: 'ACCEPT_INVITATION_EXPIRED',
+    PasswordRequired: 'ACCEPT_INVITATION_PASSWORD_REQUIRED',
+};
+/** Stable codes for waiting-room join-by-unique-name (client maps to i18n). */
+exports.AXM_JOIN_REQUEST_ERROR_CODES = {
+    NotSignedIn: 'JOIN_REQUEST_NOT_SIGNED_IN',
+    InvalidInput: 'JOIN_REQUEST_INVALID_INPUT',
+    TenantNotFound: 'JOIN_REQUEST_TENANT_NOT_FOUND',
+    AlreadyMember: 'JOIN_REQUEST_ALREADY_MEMBER',
+    InvitePending: 'JOIN_REQUEST_INVITE_PENDING',
+    RequestNotFound: 'JOIN_REQUEST_NOT_FOUND',
+    NotPending: 'JOIN_REQUEST_NOT_PENDING',
+};
+/** Stable codes for two-factor self-service and login challenge (client maps to i18n). */
+exports.AXM_TWO_FACTOR_ERROR_CODES = {
+    NotSignedIn: 'TWO_FACTOR_NOT_SIGNED_IN',
+    InvalidInput: 'TWO_FACTOR_INVALID_INPUT',
+    IncorrectPassword: 'TWO_FACTOR_INCORRECT_PASSWORD',
+    IncorrectCode: 'TWO_FACTOR_INCORRECT_CODE',
+    AlreadyEnabled: 'TWO_FACTOR_ALREADY_ENABLED',
+    NotEnabled: 'TWO_FACTOR_NOT_ENABLED',
+    EnrollmentExpired: 'TWO_FACTOR_ENROLLMENT_EXPIRED',
+    ChallengeExpired: 'TWO_FACTOR_CHALLENGE_EXPIRED',
+    RateLimited: 'TWO_FACTOR_RATE_LIMITED',
+    InvalidConfiguration: 'TWO_FACTOR_INVALID_CONFIGURATION',
+    ProofRequired: 'TWO_FACTOR_PROOF_REQUIRED',
+    UserNotFound: 'TWO_FACTOR_USER_NOT_FOUND',
+    Forbidden: 'TWO_FACTOR_FORBIDDEN',
+};
 //#endregion
 //# sourceMappingURL=server-commands.js.map

package/contracts/src/server-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-commands.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/server/contracts/src/server-commands.ts"],"names":[],"mappings":";AAAA,2DAA2D;;;AAE9C,QAAA,mCAAmC,GAAG;IACjD,sBAAsB,EAAE,kDAAkD;IAC1E,qBAAqB,EAAE,iDAAiD;CAChE,CAAC;AAEX,2DAA2D;AAC9C,QAAA,oCAAoC,GAAG,gDAAgD,CAAC;AAgBrG,YAAY"}
+{"version":3,"file":"server-commands.js","sourceRoot":"","sources":["../../../../../libs/modules/security-management/contracts/src/server-commands.ts"],"names":[],"mappings":";AAAA,2DAA2D;;;AAE9C,QAAA,mCAAmC,GAAG;IACjD,sBAAsB,EAAE,kDAAkD;IAC1E,qBAAqB,EAAE,iDAAiD;IACxE,iBAAiB,EAAE,6CAA6C;IAChE,oBAAoB,EAAE,gDAAgD;IACtE,UAAU,EAAE,sCAAsC;IAClD,8EAA8E;IAC9E,8BAA8B,EAAE,0DAA0D;IAC1F,0FAA0F;IAC1F,yBAAyB,EAAE,qDAAqD;IAChF,gBAAgB,EAAE,4CAA4C;IAC9D,gBAAgB,EAAE,4CAA4C;IAC9D,gBAAgB,EAAE,4CAA4C;IAC9D,wBAAwB,EAAE,oDAAoD;IAC9E,iBAAiB,EAAE,6CAA6C;IAChE,kBAAkB,EAAE,8CAA8C;IAClE,wBAAwB,EAAE,oDAAoD;IAC9E,uBAAuB,EAAE,mDAAmD;IAC5E,kBAAkB,EAAE,8CAA8C;IAClE,mBAAmB,EAAE,+CAA+C;IACpE,kBAAkB,EAAE,8CAA8C;IAClE,iBAAiB,EAAE,6CAA6C;IAChE,kBAAkB,EAAE,8CAA8C;IAClE,wBAAwB,EAAE,oDAAoD;IAC9E,0BAA0B,EAAE,sDAAsD;IAClF,gBAAgB,EAAE,4CAA4C;IAC9D,8BAA8B,EAAE,0DAA0D;IAC1F,kBAAkB,EAAE,8CAA8C;IAClE,mBAAmB,EAAE,+CAA+C;IACpE,4EAA4E;IAC5E,oBAAoB,EAAE,gDAAgD;CAC9D,CAAC;AAEX,2EAA2E;AAC9D,QAAA,mCAAmC,GAAG;IACjD,WAAW,EAAE,mCAAmC;IAChD,gBAAgB,EAAE,uCAAuC;IACzD,aAAa,EAAE,qCAAqC;IACpD,YAAY,EAAE,mCAAmC;CACzC,CAAC;AAEX,2DAA2D;AAC9C,QAAA,oCAAoC,GAAG,gDAAgD,CAAC;AAErG,sEAAsE;AACzD,QAAA,iCAAiC,GAAG,wCAAwC,CAAC;AAE1F,iEAAiE;AACpD,QAAA,uBAAuB,GAAG,gCAAgC,CAAC;AAC3D,QAAA,kCAAkC,GAAG,0CAA0C,CAAC;AAChF,QAAA,kCAAkC,GAAG,0CAA0C,CAAC;AAChF,QAAA,qCAAqC,GAAG,4CAA4C,CAAC;AACrF,QAAA,oCAAoC,GAAG,2CAA2C,CAAC;AACnF,QAAA,iCAAiC,GAAG,wCAAwC,CAAC;AAqG1F,wGAAwG;AAC3F,QAAA,iCAAiC,GAAG;IAC/C,OAAO,EAAE,2BAA2B;IACpC,OAAO,EAAE,2BAA2B;IACpC,gBAAgB,EAAE,qCAAqC;CAC/C,CAAC;AAyCX,+EAA+E;AAClE,QAAA,4BAA4B,GAAG;IAC1C,WAAW,EAAE,4BAA4B;IACzC,YAAY,EAAE,4BAA4B;IAC1C,cAAc,EAAE,+BAA+B;IAC/C,aAAa,EAAE,6BAA6B;IAC5C,aAAa,EAAE,6BAA6B;IAC5C,eAAe,EAAE,wBAAwB;IACzC,UAAU,EAAE,0BAA0B;CAC9B,CAAC;AA0FX,0FAA0F;AAC7E,QAAA,0BAA0B,GAAG;IACxC,WAAW,EAAE,0BAA0B;IACvC,YAAY,EAAE,0BAA0B;IACxC,iBAAiB,EAAE,+BAA+B;IAClD,aAAa,EAAE,2BAA2B;IAC1C,cAAc,EAAE,4BAA4B;IAC5C,UAAU,EAAE,wBAAwB;IACpC,iBAAiB,EAAE,+BAA+B;IAClD,gBAAgB,EAAE,8BAA8B;IAChD,WAAW,EAAE,yBAAyB;IACtC,oBAAoB,EAAE,kCAAkC;IACxD,aAAa,EAAE,2BAA2B;IAC1C,YAAY,EAAE,2BAA2B;IACzC,SAAS,EAAE,sBAAsB;CACzB,CAAC;AAsEX,YAAY"}

package/contracts/src/settings.keys.d.ts

@@ -0,0 +1,16 @@
+/** Platform settings owned by Security Management. */
+export declare const AXMSecurityManagementSettings: {
+    /**
+     * Which Users-list add actions are available.
+     * `create` and `invite` are primary. `both` shows them as secondary actions.
+     */
+    readonly UserProvisioningMode: "SecurityManagement:Setting:User.ProvisioningMode";
+};
+export declare const AXMUserProvisioningMode: {
+    readonly Create: "create";
+    readonly Invite: "invite";
+    readonly Both: "both";
+};
+export type AXMUserProvisioningMode = (typeof AXMUserProvisioningMode)[keyof typeof AXMUserProvisioningMode];
+/** Used when the platform setting has not been saved yet. */
+export declare const AXM_USER_PROVISIONING_MODE_DEFAULT: "both";