@marinoscar/platform-contract 0.1.0-next.3 → 0.1.0-next.4

package/dist/cjs/identity/constants.d.ts

@@ -0,0 +1,273 @@
+/**
+ * The CLOSED set of sign-in failure codes.
+ *
+ * A failed Google sign-in always ends as a 302 to
+ * `${appUrl}/auth/callback?error=<code>`, where `<code>` is one of these and
+ * nothing else: never an exception message, never raw JSON. Free text in that
+ * query string let anyone craft a link that rendered attacker-chosen copy on a
+ * trusted origin.
+ *
+ * - `not_allowlisted`: the email is not on the allowlist.
+ * - `account_disabled`: the account exists but is deactivated.
+ * - `access_denied`: the person cancelled or denied consent at the provider.
+ * - `authentication_failed`: token exchange failed, code replayed or expired,
+ *   no email on the profile, or anything unexpected.
+ * - `server_misconfigured`: seed data is missing.
+ * - `no_organization`: multi-org tenancy mode (`TENANCY_MODE=multi`) and the
+ *   user has no active organization membership.
+ *
+ * The single source: the API resolves every failure to one of these, and the
+ * web app keys its copy off this list (so a new code is a type error there
+ * until it has copy).
+ *
+ * @stability stable
+ */
+export declare const AUTH_ERROR_CODES: readonly ["not_allowlisted", "account_disabled", "access_denied", "authentication_failed", "server_misconfigured", "no_organization"];
+/**
+ * One sign-in failure code: a member of {@link AUTH_ERROR_CODES}.
+ *
+ * @stability stable
+ */
+export type AuthErrorCode = (typeof AUTH_ERROR_CODES)[number];
+/**
+ * The code used for every failure that has no more specific one, and the code
+ * a client shows for an unknown, legacy or missing value (never echo the raw
+ * input).
+ *
+ * @stability stable
+ */
+export declare const DEFAULT_AUTH_ERROR_CODE: AuthErrorCode;
+/**
+ * Whether `value` is one of the closed set of sign-in failure codes.
+ *
+ * @param value - anything, typically the `error` query parameter.
+ * @returns `true` when `value` is an {@link AuthErrorCode}.
+ *
+ * @example
+ * ```ts
+ * const code = isAuthErrorCode(raw) ? raw : DEFAULT_AUTH_ERROR_CODE;
+ * ```
+ *
+ * @stability stable
+ */
+export declare function isAuthErrorCode(value: unknown): value is AuthErrorCode;
+/**
+ * The deployment's tenancy modes (`TENANCY_MODE`): one organization everyone
+ * auto-joins (`single`) or one organization per customer (`multi`).
+ *
+ * @stability stable
+ */
+export declare const TENANCY_MODES: readonly ["single", "multi"];
+/**
+ * One tenancy mode: a member of {@link TENANCY_MODES}.
+ *
+ * @stability stable
+ */
+export type TenancyModeValue = (typeof TENANCY_MODES)[number];
+/**
+ * The org roles the platform ships and an organization administrator can hand
+ * out by default, highest first. A built-in list, no longer the set of
+ * assignable roles: an app or package registers more, and the API reports what
+ * a caller may assign at `GET /api/roles?scope=org`. `admin` is a SYSTEM role
+ * and is never assignable on a membership or an invitation.
+ *
+ * @stability stable
+ */
+export declare const BUILTIN_ORG_ROLES: readonly ["org_admin", "contributor", "viewer"];
+/**
+ * The org roles an organization administrator can hand out, on a membership or
+ * an invitation.
+ *
+ * @deprecated Renamed {@link BUILTIN_ORG_ROLES}: the assignable set is open now
+ *   (read it from `GET /api/roles?scope=org`). Kept as an alias for one release.
+ * @stability stable
+ */
+export declare const ASSIGNABLE_ORG_ROLES: readonly ["org_admin", "contributor", "viewer"];
+/**
+ * One built-in org role: a member of {@link BUILTIN_ORG_ROLES}.
+ *
+ * @stability stable
+ */
+export type BuiltinOrgRole = (typeof BUILTIN_ORG_ROLES)[number];
+/**
+ * An org role id on the wire: a built-in one (autocompleted) or any string an
+ * app or package registered. The API checks it against the role registry and
+ * answers 400 (`code: ROLE_NOT_ASSIGNABLE`) for an unknown or
+ * non-assignable role.
+ *
+ * @stability stable
+ */
+export type AssignableOrgRole = BuiltinOrgRole | (string & {});
+/**
+ * The shape of a role id: lower-case letters, digits, `_` and `-`, starting
+ * with a letter, 1 to 64 characters. Every built-in id matches, and so does an
+ * app's `coach`.
+ *
+ * @stability experimental
+ */
+export declare const ROLE_ID_PATTERN: RegExp;
+/**
+ * The two scopes of a role: `system` (held in `user_roles`, operates the
+ * deployment) and `org` (held on a membership, operates one organization).
+ *
+ * @stability experimental
+ */
+export declare const ROLE_SCOPES: readonly ["system", "org"];
+/**
+ * One role scope: a member of {@link ROLE_SCOPES}.
+ *
+ * @stability experimental
+ */
+export type RoleScopeValue = (typeof ROLE_SCOPES)[number];
+/**
+ * The error `code` (and `details.reason`) of the 400 the API answers when a
+ * role is unknown, of the wrong scope, or registered as not assignable.
+ *
+ * @stability experimental
+ */
+export declare const ROLE_NOT_ASSIGNABLE_REASON = "ROLE_NOT_ASSIGNABLE";
+/**
+ * An organization slug: 2 to 63 lower-case letters, digits or hyphens,
+ * starting and ending with a letter or digit.
+ *
+ * @stability stable
+ */
+export declare const ORG_SLUG_PATTERN: RegExp;
+/**
+ * The statuses of a membership: `active` (grants its role) or `suspended`
+ * (listed, grants nothing).
+ *
+ * @stability stable
+ */
+export declare const ORG_MEMBER_STATUSES: readonly ["active", "suspended"];
+/**
+ * One membership status: a member of {@link ORG_MEMBER_STATUSES}.
+ *
+ * @stability stable
+ */
+export type OrgMemberStatus = (typeof ORG_MEMBER_STATUSES)[number];
+/**
+ * The statuses of an organization invitation.
+ *
+ * @stability stable
+ */
+export declare const ORG_INVITE_STATUSES: readonly ["pending", "accepted", "revoked", "expired"];
+/**
+ * One invitation status: a member of {@link ORG_INVITE_STATUSES}.
+ *
+ * @stability stable
+ */
+export type OrgInviteStatus = (typeof ORG_INVITE_STATUSES)[number];
+/**
+ * The units a personal access token's lifetime is expressed in.
+ *
+ * @stability stable
+ */
+export declare const PAT_DURATION_UNITS: readonly ["minutes", "days", "months"];
+/**
+ * One duration unit: a member of {@link PAT_DURATION_UNITS}.
+ *
+ * @stability stable
+ */
+export type PatDurationUnitValue = (typeof PAT_DURATION_UNITS)[number];
+/**
+ * The bounds of a personal access token's `name` (characters, after trimming)
+ * and `durationValue` (in its unit).
+ *
+ * @stability stable
+ */
+export declare const PAT_LIMITS: {
+    /** The longest accepted token name. */
+    readonly nameMaxLength: 100;
+    /** The smallest accepted duration value. */
+    readonly durationMin: 1;
+    /** The largest accepted duration value. */
+    readonly durationMax: 999;
+};
+/**
+ * The credential a device flow mints on the poll after approval: `session`
+ * (an access JWT plus a refresh token; the default) or `pat` (a personal
+ * access token).
+ *
+ * @stability stable
+ */
+export declare const DEVICE_TOKEN_TYPES: readonly ["session", "pat"];
+/**
+ * One device credential type: a member of {@link DEVICE_TOKEN_TYPES}.
+ *
+ * @stability stable
+ */
+export type DeviceTokenTypeValue = (typeof DEVICE_TOKEN_TYPES)[number];
+/**
+ * The human-readable user code of a device flow: `XXXX-XXXX`, upper-case
+ * letters and digits.
+ *
+ * @stability stable
+ */
+export declare const DEVICE_USER_CODE_PATTERN: RegExp;
+/**
+ * The RFC 8628 section 3.5 / RFC 6749 section 5.2 error codes of
+ * `POST /api/auth/device/token`. A client branches on these, never on the
+ * description or the HTTP status.
+ *
+ * @stability stable
+ */
+export declare const DEVICE_TOKEN_ERROR_CODES: readonly ["authorization_pending", "slow_down", "expired_token", "access_denied", "invalid_grant", "invalid_request"];
+/**
+ * One device token error code: a member of {@link DEVICE_TOKEN_ERROR_CODES}.
+ *
+ * @stability stable
+ */
+export type DeviceTokenErrorCode = (typeof DEVICE_TOKEN_ERROR_CODES)[number];
+/**
+ * The statuses a listed device session can have. `approved` means approved but
+ * not yet collected by the device; `expired` means the device collected its
+ * credential.
+ *
+ * @stability stable
+ */
+export declare const DEVICE_SESSION_STATUSES: readonly ["pending", "approved", "denied", "expired"];
+/**
+ * One device session status: a member of {@link DEVICE_SESSION_STATUSES}.
+ *
+ * @stability stable
+ */
+export type DeviceSessionStatus = (typeof DEVICE_SESSION_STATUSES)[number];
+/**
+ * The id of a user extension (`registerCurrentUserExtension`,
+ * `registerUserListExtension` of `@marinoscar/platform-api/identity`): the key
+ * of its contribution under `extensions` in `GET /api/auth/me` and in each row
+ * of `GET /api/users`. Lower-case, starting with a letter, 2 to 48 characters.
+ *
+ * @extensionPoint schema
+ * @stability experimental
+ */
+export declare const USER_EXTENSION_ID_PATTERN: RegExp;
+/**
+ * The bounds the API holds a user extension's contribution to. A contribution
+ * is JSON, nested at most {@link USER_EXTENSION_LIMITS.maxDepth} levels, with no
+ * key that names a secret; one over a byte bound is dropped (and logged), never
+ * truncated. The bounds are part of the contract so a client can rely on the
+ * size of `extensions`.
+ *
+ * - `currentUserBytes`: one extension's JSON in `GET /api/auth/me`.
+ * - `currentUserTotalBytes`: all extensions together in `GET /api/auth/me`.
+ * - `userListBytes`: one extension's JSON for one row of `GET /api/users`.
+ * - `userListTotalBytes`: all extensions together for one row.
+ * - `maxDepth`: the deepest nesting of a contribution (the extension's own object is level 1).
+ *
+ * @stability experimental
+ */
+export declare const USER_EXTENSION_LIMITS: {
+    /** One extension's JSON in `GET /api/auth/me`, in UTF-8 bytes. */
+    readonly currentUserBytes: 4096;
+    /** All extensions together in `GET /api/auth/me`, in UTF-8 bytes. */
+    readonly currentUserTotalBytes: 16384;
+    /** One extension's JSON for one row of `GET /api/users`, in UTF-8 bytes. */
+    readonly userListBytes: 1024;
+    /** All extensions together for one row of `GET /api/users`, in UTF-8 bytes. */
+    readonly userListTotalBytes: 4096;
+    /** The deepest nesting of a contribution; the extension's own object is level 1. */
+    readonly maxDepth: 5;
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/cjs/identity/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/identity/constants.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,gBAAgB,uIAOnB,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAuC,CAAC;AAE9E;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAEtE;AAMD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,8BAA+B,CAAC;AAE1D;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,iDAAkD,CAAC;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,iDAAoB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,MAAkC,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,WAAW,4BAA6B,CAAC;AAEtD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,wBAAwB,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAgD,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,kCAAmC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,wDAAyD,CAAC;AAE1F;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAMnE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,wCAAyC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,UAAU;IACrB,uCAAuC;;IAEvC,4CAA4C;;IAE5C,2CAA2C;;CAEnC,CAAC;AAMX;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,6BAA8B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAoC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,uHAO3B,CAAC;AAEX;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,uDAAwD,CAAC;AAE7F;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAM3E;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAiC,CAAC;AAE1E;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB;IAChC,kEAAkE;;IAElE,qEAAqE;;IAErE,4EAA4E;;IAE5E,+EAA+E;;IAE/E,oFAAoF;;CAE5E,CAAC"}

package/dist/cjs/identity/constants.js

@@ -0,0 +1,248 @@
+"use strict";
+// The identity slice's plain values (issue #727, PP-6.6). Zod-free by rule: a
+// browser that only needs an error code, an enum list or a type never pulls the
+// schemas, and with them zod, into its bundle (test/no-zod-in-constants.test.ts).
+//
+// Every list here is the one the schemas validate with: the schemas import
+// them, so a value cannot drift between what the API enforces and what the web
+// app offers. Moved verbatim from the API (`packages/platform-api/src/identity/auth/auth-error-codes.ts`
+// and the DTO files of auth, pat, device-auth and organizations); no value
+// changed.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.USER_EXTENSION_LIMITS = exports.USER_EXTENSION_ID_PATTERN = exports.DEVICE_SESSION_STATUSES = exports.DEVICE_TOKEN_ERROR_CODES = exports.DEVICE_USER_CODE_PATTERN = exports.DEVICE_TOKEN_TYPES = exports.PAT_LIMITS = exports.PAT_DURATION_UNITS = exports.ORG_INVITE_STATUSES = exports.ORG_MEMBER_STATUSES = exports.ORG_SLUG_PATTERN = exports.ROLE_NOT_ASSIGNABLE_REASON = exports.ROLE_SCOPES = exports.ROLE_ID_PATTERN = exports.ASSIGNABLE_ORG_ROLES = exports.BUILTIN_ORG_ROLES = exports.TENANCY_MODES = exports.DEFAULT_AUTH_ERROR_CODE = exports.AUTH_ERROR_CODES = void 0;
+exports.isAuthErrorCode = isAuthErrorCode;
+// =============================================================================
+// Sign-in failure codes (issue #652)
+// =============================================================================
+/**
+ * The CLOSED set of sign-in failure codes.
+ *
+ * A failed Google sign-in always ends as a 302 to
+ * `${appUrl}/auth/callback?error=<code>`, where `<code>` is one of these and
+ * nothing else: never an exception message, never raw JSON. Free text in that
+ * query string let anyone craft a link that rendered attacker-chosen copy on a
+ * trusted origin.
+ *
+ * - `not_allowlisted`: the email is not on the allowlist.
+ * - `account_disabled`: the account exists but is deactivated.
+ * - `access_denied`: the person cancelled or denied consent at the provider.
+ * - `authentication_failed`: token exchange failed, code replayed or expired,
+ *   no email on the profile, or anything unexpected.
+ * - `server_misconfigured`: seed data is missing.
+ * - `no_organization`: multi-org tenancy mode (`TENANCY_MODE=multi`) and the
+ *   user has no active organization membership.
+ *
+ * The single source: the API resolves every failure to one of these, and the
+ * web app keys its copy off this list (so a new code is a type error there
+ * until it has copy).
+ *
+ * @stability stable
+ */
+exports.AUTH_ERROR_CODES = [
+    'not_allowlisted',
+    'account_disabled',
+    'access_denied',
+    'authentication_failed',
+    'server_misconfigured',
+    'no_organization',
+];
+/**
+ * The code used for every failure that has no more specific one, and the code
+ * a client shows for an unknown, legacy or missing value (never echo the raw
+ * input).
+ *
+ * @stability stable
+ */
+exports.DEFAULT_AUTH_ERROR_CODE = 'authentication_failed';
+/**
+ * Whether `value` is one of the closed set of sign-in failure codes.
+ *
+ * @param value - anything, typically the `error` query parameter.
+ * @returns `true` when `value` is an {@link AuthErrorCode}.
+ *
+ * @example
+ * ```ts
+ * const code = isAuthErrorCode(raw) ? raw : DEFAULT_AUTH_ERROR_CODE;
+ * ```
+ *
+ * @stability stable
+ */
+function isAuthErrorCode(value) {
+    return typeof value === 'string' && exports.AUTH_ERROR_CODES.includes(value);
+}
+// =============================================================================
+// Tenancy and organizations
+// =============================================================================
+/**
+ * The deployment's tenancy modes (`TENANCY_MODE`): one organization everyone
+ * auto-joins (`single`) or one organization per customer (`multi`).
+ *
+ * @stability stable
+ */
+exports.TENANCY_MODES = ['single', 'multi'];
+/**
+ * The org roles the platform ships and an organization administrator can hand
+ * out by default, highest first. A built-in list, no longer the set of
+ * assignable roles: an app or package registers more, and the API reports what
+ * a caller may assign at `GET /api/roles?scope=org`. `admin` is a SYSTEM role
+ * and is never assignable on a membership or an invitation.
+ *
+ * @stability stable
+ */
+exports.BUILTIN_ORG_ROLES = ['org_admin', 'contributor', 'viewer'];
+/**
+ * The org roles an organization administrator can hand out, on a membership or
+ * an invitation.
+ *
+ * @deprecated Renamed {@link BUILTIN_ORG_ROLES}: the assignable set is open now
+ *   (read it from `GET /api/roles?scope=org`). Kept as an alias for one release.
+ * @stability stable
+ */
+exports.ASSIGNABLE_ORG_ROLES = exports.BUILTIN_ORG_ROLES;
+/**
+ * The shape of a role id: lower-case letters, digits, `_` and `-`, starting
+ * with a letter, 1 to 64 characters. Every built-in id matches, and so does an
+ * app's `coach`.
+ *
+ * @stability experimental
+ */
+exports.ROLE_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+/**
+ * The two scopes of a role: `system` (held in `user_roles`, operates the
+ * deployment) and `org` (held on a membership, operates one organization).
+ *
+ * @stability experimental
+ */
+exports.ROLE_SCOPES = ['system', 'org'];
+/**
+ * The error `code` (and `details.reason`) of the 400 the API answers when a
+ * role is unknown, of the wrong scope, or registered as not assignable.
+ *
+ * @stability experimental
+ */
+exports.ROLE_NOT_ASSIGNABLE_REASON = 'ROLE_NOT_ASSIGNABLE';
+/**
+ * An organization slug: 2 to 63 lower-case letters, digits or hyphens,
+ * starting and ending with a letter or digit.
+ *
+ * @stability stable
+ */
+exports.ORG_SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61})[a-z0-9]$/;
+/**
+ * The statuses of a membership: `active` (grants its role) or `suspended`
+ * (listed, grants nothing).
+ *
+ * @stability stable
+ */
+exports.ORG_MEMBER_STATUSES = ['active', 'suspended'];
+/**
+ * The statuses of an organization invitation.
+ *
+ * @stability stable
+ */
+exports.ORG_INVITE_STATUSES = ['pending', 'accepted', 'revoked', 'expired'];
+// =============================================================================
+// Personal access tokens
+// =============================================================================
+/**
+ * The units a personal access token's lifetime is expressed in.
+ *
+ * @stability stable
+ */
+exports.PAT_DURATION_UNITS = ['minutes', 'days', 'months'];
+/**
+ * The bounds of a personal access token's `name` (characters, after trimming)
+ * and `durationValue` (in its unit).
+ *
+ * @stability stable
+ */
+exports.PAT_LIMITS = {
+    /** The longest accepted token name. */
+    nameMaxLength: 100,
+    /** The smallest accepted duration value. */
+    durationMin: 1,
+    /** The largest accepted duration value. */
+    durationMax: 999,
+};
+// =============================================================================
+// Device authorization (RFC 8628)
+// =============================================================================
+/**
+ * The credential a device flow mints on the poll after approval: `session`
+ * (an access JWT plus a refresh token; the default) or `pat` (a personal
+ * access token).
+ *
+ * @stability stable
+ */
+exports.DEVICE_TOKEN_TYPES = ['session', 'pat'];
+/**
+ * The human-readable user code of a device flow: `XXXX-XXXX`, upper-case
+ * letters and digits.
+ *
+ * @stability stable
+ */
+exports.DEVICE_USER_CODE_PATTERN = /^[A-Z0-9]{4}-[A-Z0-9]{4}$/;
+/**
+ * The RFC 8628 section 3.5 / RFC 6749 section 5.2 error codes of
+ * `POST /api/auth/device/token`. A client branches on these, never on the
+ * description or the HTTP status.
+ *
+ * @stability stable
+ */
+exports.DEVICE_TOKEN_ERROR_CODES = [
+    'authorization_pending',
+    'slow_down',
+    'expired_token',
+    'access_denied',
+    'invalid_grant',
+    'invalid_request',
+];
+/**
+ * The statuses a listed device session can have. `approved` means approved but
+ * not yet collected by the device; `expired` means the device collected its
+ * credential.
+ *
+ * @stability stable
+ */
+exports.DEVICE_SESSION_STATUSES = ['pending', 'approved', 'denied', 'expired'];
+// =============================================================================
+// User extensions (PP-14.25)
+// =============================================================================
+/**
+ * The id of a user extension (`registerCurrentUserExtension`,
+ * `registerUserListExtension` of `@marinoscar/platform-api/identity`): the key
+ * of its contribution under `extensions` in `GET /api/auth/me` and in each row
+ * of `GET /api/users`. Lower-case, starting with a letter, 2 to 48 characters.
+ *
+ * @extensionPoint schema
+ * @stability experimental
+ */
+exports.USER_EXTENSION_ID_PATTERN = /^[a-z][a-z0-9-]{1,47}$/;
+/**
+ * The bounds the API holds a user extension's contribution to. A contribution
+ * is JSON, nested at most {@link USER_EXTENSION_LIMITS.maxDepth} levels, with no
+ * key that names a secret; one over a byte bound is dropped (and logged), never
+ * truncated. The bounds are part of the contract so a client can rely on the
+ * size of `extensions`.
+ *
+ * - `currentUserBytes`: one extension's JSON in `GET /api/auth/me`.
+ * - `currentUserTotalBytes`: all extensions together in `GET /api/auth/me`.
+ * - `userListBytes`: one extension's JSON for one row of `GET /api/users`.
+ * - `userListTotalBytes`: all extensions together for one row.
+ * - `maxDepth`: the deepest nesting of a contribution (the extension's own object is level 1).
+ *
+ * @stability experimental
+ */
+exports.USER_EXTENSION_LIMITS = {
+    /** One extension's JSON in `GET /api/auth/me`, in UTF-8 bytes. */
+    currentUserBytes: 4096,
+    /** All extensions together in `GET /api/auth/me`, in UTF-8 bytes. */
+    currentUserTotalBytes: 16384,
+    /** One extension's JSON for one row of `GET /api/users`, in UTF-8 bytes. */
+    userListBytes: 1024,
+    /** All extensions together for one row of `GET /api/users`, in UTF-8 bytes. */
+    userListTotalBytes: 4096,
+    /** The deepest nesting of a contribution; the extension's own object is level 1. */
+    maxDepth: 5,
+};
+//# sourceMappingURL=constants.js.map

package/dist/cjs/identity/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/identity/constants.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,yGAAyG;AACzG,2EAA2E;AAC3E,WAAW;;;AAoEX,0CAEC;AApED,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACU,QAAA,gBAAgB,GAAG;IAC9B,iBAAiB;IACjB,kBAAkB;IAClB,eAAe;IACf,uBAAuB;IACvB,sBAAsB;IACtB,iBAAiB;CACT,CAAC;AASX;;;;;;GAMG;AACU,QAAA,uBAAuB,GAAkB,uBAAuB,CAAC;AAE9E;;;;;;;;;;;;GAYG;AACH,SAAgB,eAAe,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,wBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9F,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;;;GAKG;AACU,QAAA,aAAa,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AAS1D;;;;;;;;GAQG;AACU,QAAA,iBAAiB,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAU,CAAC;AAEjF;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAG,yBAAiB,CAAC;AAmBtD;;;;;;GAMG;AACU,QAAA,eAAe,GAAW,yBAAyB,CAAC;AAEjE;;;;;GAKG;AACU,QAAA,WAAW,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAU,CAAC;AAStD;;;;;GAKG;AACU,QAAA,0BAA0B,GAAG,qBAAqB,CAAC;AAEhE;;;;;GAKG;AACU,QAAA,gBAAgB,GAAW,uCAAuC,CAAC;AAEhF;;;;;GAKG;AACU,QAAA,mBAAmB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAU,CAAC;AASpE;;;;GAIG;AACU,QAAA,mBAAmB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAS1F,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;;GAIG;AACU,QAAA,kBAAkB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AASzE;;;;;GAKG;AACU,QAAA,UAAU,GAAG;IACxB,uCAAuC;IACvC,aAAa,EAAE,GAAG;IAClB,4CAA4C;IAC5C,WAAW,EAAE,CAAC;IACd,2CAA2C;IAC3C,WAAW,EAAE,GAAG;CACR,CAAC;AAEX,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF;;;;;;GAMG;AACU,QAAA,kBAAkB,GAAG,CAAC,SAAS,EAAE,KAAK,CAAU,CAAC;AAS9D;;;;;GAKG;AACU,QAAA,wBAAwB,GAAW,2BAA2B,CAAC;AAE5E;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG;IACtC,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;IACf,eAAe;IACf,iBAAiB;CACT,CAAC;AASX;;;;;;GAMG;AACU,QAAA,uBAAuB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAS7F,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;;;;;;GAQG;AACU,QAAA,yBAAyB,GAAW,wBAAwB,CAAC;AAE1E;;;;;;;;;;;;;;GAcG;AACU,QAAA,qBAAqB,GAAG;IACnC,kEAAkE;IAClE,gBAAgB,EAAE,IAAI;IACtB,qEAAqE;IACrE,qBAAqB,EAAE,KAAK;IAC5B,4EAA4E;IAC5E,aAAa,EAAE,IAAI;IACnB,+EAA+E;IAC/E,kBAAkB,EAAE,IAAI;IACxB,oFAAoF;IACpF,QAAQ,EAAE,CAAC;CACH,CAAC"}

package/dist/cjs/identity/index.d.ts

@@ -0,0 +1,5 @@
+export { ASSIGNABLE_ORG_ROLES, AUTH_ERROR_CODES, BUILTIN_ORG_ROLES, DEFAULT_AUTH_ERROR_CODE, DEVICE_SESSION_STATUSES, DEVICE_TOKEN_ERROR_CODES, DEVICE_TOKEN_TYPES, DEVICE_USER_CODE_PATTERN, ORG_INVITE_STATUSES, ORG_MEMBER_STATUSES, ORG_SLUG_PATTERN, PAT_DURATION_UNITS, PAT_LIMITS, ROLE_ID_PATTERN, ROLE_NOT_ASSIGNABLE_REASON, ROLE_SCOPES, TENANCY_MODES, USER_EXTENSION_ID_PATTERN, USER_EXTENSION_LIMITS, isAuthErrorCode, } from './constants.js';
+export type { AssignableOrgRole, AuthErrorCode, BuiltinOrgRole, DeviceSessionStatus, DeviceTokenErrorCode, DeviceTokenTypeValue, OrgInviteStatus, OrgMemberStatus, PatDurationUnitValue, RoleScopeValue, TenancyModeValue, } from './constants.js';
+export { activeOrgSchema, authErrorCodeSchema, authMembershipSchema, authProviderSchema, authProvidersResponseSchema, authRoleSchema, createOrgInviteSchema, createOrganizationSchema, createPatSchema, currentUserSchema, deviceActivateResponseSchema, deviceAuthorizeRequestSchema, deviceAuthorizeResponseSchema, deviceClientInfoSchema, deviceCodeRequestSchema, deviceCodeResponseSchema, deviceSessionSchema, deviceSessionsResponseSchema, deviceTokenErrorSchema, deviceTokenRequestSchema, deviceTokenResponseSchema, deviceTokenTypeSchema, orgInviteListQuerySchema, orgInviteResponseSchema, orgMemberListQuerySchema, orgMemberResponseSchema, organizationListQuerySchema, organizationResponseSchema, patCreatedResponseSchema, patListItemSchema, renameOrganizationSchema, roleDescriptorSchema, roleIdSchema, roleListQuerySchema, roleListResponseSchema, switchOrgSchema, tokenResponseSchema, updateOrgMemberSchema, userExtensionsSchema, } from './schemas.js';
+export type { ActiveOrg, AssignableOrgRoleEnum, AuthErrorCodeEnum, DeviceSessionStatusEnum, DeviceTokenErrorCodeEnum, DeviceTokenTypeEnum, OrgInviteStatusEnum, OrgInviteStatusFilterEnum, OrgMemberStatusEnum, OrgMemberStatusFilterEnum, PatDurationUnitEnum, RoleScopeEnum, TenancyModeEnum, AuthMembership, AuthProvidersResponse, CreateOrgInviteRequest, CreateOrganizationRequest, CreatePatRequest, CurrentUser, DeviceActivateResponse, DeviceAuthorizeRequest, DeviceAuthorizeResponse, DeviceClientInfo, DeviceCodeRequest, DeviceCodeResponse, DeviceSession, DeviceSessionsResponse, DeviceTokenError, DeviceTokenRequest, DeviceTokenResponse, OrgInviteListQuery, OrgInviteResponse, OrgMemberListQuery, OrgMemberResponse, OrganizationListQuery, OrganizationResponse, PatCreatedResponse, PatListItem, RenameOrganizationRequest, RoleDescriptor, RoleListQuery, SwitchOrgRequest, TokenResponse, UpdateOrgMemberRequest, UserExtensions, } from './schemas.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/index.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,0BAA0B,EAC1B,WAAW,EACX,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,cAAc,EACd,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,4BAA4B,EAC5B,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,SAAS,EACT,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,cAAc,GACf,MAAM,cAAc,CAAC"}

package/dist/cjs/identity/index.js

@@ -0,0 +1,73 @@
+"use strict";
+// `@marinoscar/platform-contract/identity`: the identity slice's wire shapes,
+// shared by `@marinoscar/platform-api/identity` (its request DTOs wrap these
+// schemas) and the web app (types and the sign-in error codes) (issue #727).
+// Documented in ./README.md. Explicit named exports only.
+//
+// constants.ts is zod-free; a consumer that imports only the constants and the
+// types (the web app) never bundles schemas.ts or zod (`"sideEffects": false`).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.patListItemSchema = exports.patCreatedResponseSchema = exports.organizationResponseSchema = exports.organizationListQuerySchema = exports.orgMemberResponseSchema = exports.orgMemberListQuerySchema = exports.orgInviteResponseSchema = exports.orgInviteListQuerySchema = exports.deviceTokenTypeSchema = exports.deviceTokenResponseSchema = exports.deviceTokenRequestSchema = exports.deviceTokenErrorSchema = exports.deviceSessionsResponseSchema = exports.deviceSessionSchema = exports.deviceCodeResponseSchema = exports.deviceCodeRequestSchema = exports.deviceClientInfoSchema = exports.deviceAuthorizeResponseSchema = exports.deviceAuthorizeRequestSchema = exports.deviceActivateResponseSchema = exports.currentUserSchema = exports.createPatSchema = exports.createOrganizationSchema = exports.createOrgInviteSchema = exports.authRoleSchema = exports.authProvidersResponseSchema = exports.authProviderSchema = exports.authMembershipSchema = exports.authErrorCodeSchema = exports.activeOrgSchema = exports.isAuthErrorCode = exports.USER_EXTENSION_LIMITS = exports.USER_EXTENSION_ID_PATTERN = exports.TENANCY_MODES = exports.ROLE_SCOPES = exports.ROLE_NOT_ASSIGNABLE_REASON = exports.ROLE_ID_PATTERN = exports.PAT_LIMITS = exports.PAT_DURATION_UNITS = exports.ORG_SLUG_PATTERN = exports.ORG_MEMBER_STATUSES = exports.ORG_INVITE_STATUSES = exports.DEVICE_USER_CODE_PATTERN = exports.DEVICE_TOKEN_TYPES = exports.DEVICE_TOKEN_ERROR_CODES = exports.DEVICE_SESSION_STATUSES = exports.DEFAULT_AUTH_ERROR_CODE = exports.BUILTIN_ORG_ROLES = exports.AUTH_ERROR_CODES = exports.ASSIGNABLE_ORG_ROLES = void 0;
+exports.userExtensionsSchema = exports.updateOrgMemberSchema = exports.tokenResponseSchema = exports.switchOrgSchema = exports.roleListResponseSchema = exports.roleListQuerySchema = exports.roleIdSchema = exports.roleDescriptorSchema = exports.renameOrganizationSchema = void 0;
+var constants_js_1 = require("./constants.js");
+Object.defineProperty(exports, "ASSIGNABLE_ORG_ROLES", { enumerable: true, get: function () { return constants_js_1.ASSIGNABLE_ORG_ROLES; } });
+Object.defineProperty(exports, "AUTH_ERROR_CODES", { enumerable: true, get: function () { return constants_js_1.AUTH_ERROR_CODES; } });
+Object.defineProperty(exports, "BUILTIN_ORG_ROLES", { enumerable: true, get: function () { return constants_js_1.BUILTIN_ORG_ROLES; } });
+Object.defineProperty(exports, "DEFAULT_AUTH_ERROR_CODE", { enumerable: true, get: function () { return constants_js_1.DEFAULT_AUTH_ERROR_CODE; } });
+Object.defineProperty(exports, "DEVICE_SESSION_STATUSES", { enumerable: true, get: function () { return constants_js_1.DEVICE_SESSION_STATUSES; } });
+Object.defineProperty(exports, "DEVICE_TOKEN_ERROR_CODES", { enumerable: true, get: function () { return constants_js_1.DEVICE_TOKEN_ERROR_CODES; } });
+Object.defineProperty(exports, "DEVICE_TOKEN_TYPES", { enumerable: true, get: function () { return constants_js_1.DEVICE_TOKEN_TYPES; } });
+Object.defineProperty(exports, "DEVICE_USER_CODE_PATTERN", { enumerable: true, get: function () { return constants_js_1.DEVICE_USER_CODE_PATTERN; } });
+Object.defineProperty(exports, "ORG_INVITE_STATUSES", { enumerable: true, get: function () { return constants_js_1.ORG_INVITE_STATUSES; } });
+Object.defineProperty(exports, "ORG_MEMBER_STATUSES", { enumerable: true, get: function () { return constants_js_1.ORG_MEMBER_STATUSES; } });
+Object.defineProperty(exports, "ORG_SLUG_PATTERN", { enumerable: true, get: function () { return constants_js_1.ORG_SLUG_PATTERN; } });
+Object.defineProperty(exports, "PAT_DURATION_UNITS", { enumerable: true, get: function () { return constants_js_1.PAT_DURATION_UNITS; } });
+Object.defineProperty(exports, "PAT_LIMITS", { enumerable: true, get: function () { return constants_js_1.PAT_LIMITS; } });
+Object.defineProperty(exports, "ROLE_ID_PATTERN", { enumerable: true, get: function () { return constants_js_1.ROLE_ID_PATTERN; } });
+Object.defineProperty(exports, "ROLE_NOT_ASSIGNABLE_REASON", { enumerable: true, get: function () { return constants_js_1.ROLE_NOT_ASSIGNABLE_REASON; } });
+Object.defineProperty(exports, "ROLE_SCOPES", { enumerable: true, get: function () { return constants_js_1.ROLE_SCOPES; } });
+Object.defineProperty(exports, "TENANCY_MODES", { enumerable: true, get: function () { return constants_js_1.TENANCY_MODES; } });
+Object.defineProperty(exports, "USER_EXTENSION_ID_PATTERN", { enumerable: true, get: function () { return constants_js_1.USER_EXTENSION_ID_PATTERN; } });
+Object.defineProperty(exports, "USER_EXTENSION_LIMITS", { enumerable: true, get: function () { return constants_js_1.USER_EXTENSION_LIMITS; } });
+Object.defineProperty(exports, "isAuthErrorCode", { enumerable: true, get: function () { return constants_js_1.isAuthErrorCode; } });
+var schemas_js_1 = require("./schemas.js");
+Object.defineProperty(exports, "activeOrgSchema", { enumerable: true, get: function () { return schemas_js_1.activeOrgSchema; } });
+Object.defineProperty(exports, "authErrorCodeSchema", { enumerable: true, get: function () { return schemas_js_1.authErrorCodeSchema; } });
+Object.defineProperty(exports, "authMembershipSchema", { enumerable: true, get: function () { return schemas_js_1.authMembershipSchema; } });
+Object.defineProperty(exports, "authProviderSchema", { enumerable: true, get: function () { return schemas_js_1.authProviderSchema; } });
+Object.defineProperty(exports, "authProvidersResponseSchema", { enumerable: true, get: function () { return schemas_js_1.authProvidersResponseSchema; } });
+Object.defineProperty(exports, "authRoleSchema", { enumerable: true, get: function () { return schemas_js_1.authRoleSchema; } });
+Object.defineProperty(exports, "createOrgInviteSchema", { enumerable: true, get: function () { return schemas_js_1.createOrgInviteSchema; } });
+Object.defineProperty(exports, "createOrganizationSchema", { enumerable: true, get: function () { return schemas_js_1.createOrganizationSchema; } });
+Object.defineProperty(exports, "createPatSchema", { enumerable: true, get: function () { return schemas_js_1.createPatSchema; } });
+Object.defineProperty(exports, "currentUserSchema", { enumerable: true, get: function () { return schemas_js_1.currentUserSchema; } });
+Object.defineProperty(exports, "deviceActivateResponseSchema", { enumerable: true, get: function () { return schemas_js_1.deviceActivateResponseSchema; } });
+Object.defineProperty(exports, "deviceAuthorizeRequestSchema", { enumerable: true, get: function () { return schemas_js_1.deviceAuthorizeRequestSchema; } });
+Object.defineProperty(exports, "deviceAuthorizeResponseSchema", { enumerable: true, get: function () { return schemas_js_1.deviceAuthorizeResponseSchema; } });
+Object.defineProperty(exports, "deviceClientInfoSchema", { enumerable: true, get: function () { return schemas_js_1.deviceClientInfoSchema; } });
+Object.defineProperty(exports, "deviceCodeRequestSchema", { enumerable: true, get: function () { return schemas_js_1.deviceCodeRequestSchema; } });
+Object.defineProperty(exports, "deviceCodeResponseSchema", { enumerable: true, get: function () { return schemas_js_1.deviceCodeResponseSchema; } });
+Object.defineProperty(exports, "deviceSessionSchema", { enumerable: true, get: function () { return schemas_js_1.deviceSessionSchema; } });
+Object.defineProperty(exports, "deviceSessionsResponseSchema", { enumerable: true, get: function () { return schemas_js_1.deviceSessionsResponseSchema; } });
+Object.defineProperty(exports, "deviceTokenErrorSchema", { enumerable: true, get: function () { return schemas_js_1.deviceTokenErrorSchema; } });
+Object.defineProperty(exports, "deviceTokenRequestSchema", { enumerable: true, get: function () { return schemas_js_1.deviceTokenRequestSchema; } });
+Object.defineProperty(exports, "deviceTokenResponseSchema", { enumerable: true, get: function () { return schemas_js_1.deviceTokenResponseSchema; } });
+Object.defineProperty(exports, "deviceTokenTypeSchema", { enumerable: true, get: function () { return schemas_js_1.deviceTokenTypeSchema; } });
+Object.defineProperty(exports, "orgInviteListQuerySchema", { enumerable: true, get: function () { return schemas_js_1.orgInviteListQuerySchema; } });
+Object.defineProperty(exports, "orgInviteResponseSchema", { enumerable: true, get: function () { return schemas_js_1.orgInviteResponseSchema; } });
+Object.defineProperty(exports, "orgMemberListQuerySchema", { enumerable: true, get: function () { return schemas_js_1.orgMemberListQuerySchema; } });
+Object.defineProperty(exports, "orgMemberResponseSchema", { enumerable: true, get: function () { return schemas_js_1.orgMemberResponseSchema; } });
+Object.defineProperty(exports, "organizationListQuerySchema", { enumerable: true, get: function () { return schemas_js_1.organizationListQuerySchema; } });
+Object.defineProperty(exports, "organizationResponseSchema", { enumerable: true, get: function () { return schemas_js_1.organizationResponseSchema; } });
+Object.defineProperty(exports, "patCreatedResponseSchema", { enumerable: true, get: function () { return schemas_js_1.patCreatedResponseSchema; } });
+Object.defineProperty(exports, "patListItemSchema", { enumerable: true, get: function () { return schemas_js_1.patListItemSchema; } });
+Object.defineProperty(exports, "renameOrganizationSchema", { enumerable: true, get: function () { return schemas_js_1.renameOrganizationSchema; } });
+Object.defineProperty(exports, "roleDescriptorSchema", { enumerable: true, get: function () { return schemas_js_1.roleDescriptorSchema; } });
+Object.defineProperty(exports, "roleIdSchema", { enumerable: true, get: function () { return schemas_js_1.roleIdSchema; } });
+Object.defineProperty(exports, "roleListQuerySchema", { enumerable: true, get: function () { return schemas_js_1.roleListQuerySchema; } });
+Object.defineProperty(exports, "roleListResponseSchema", { enumerable: true, get: function () { return schemas_js_1.roleListResponseSchema; } });
+Object.defineProperty(exports, "switchOrgSchema", { enumerable: true, get: function () { return schemas_js_1.switchOrgSchema; } });
+Object.defineProperty(exports, "tokenResponseSchema", { enumerable: true, get: function () { return schemas_js_1.tokenResponseSchema; } });
+Object.defineProperty(exports, "updateOrgMemberSchema", { enumerable: true, get: function () { return schemas_js_1.updateOrgMemberSchema; } });
+Object.defineProperty(exports, "userExtensionsSchema", { enumerable: true, get: function () { return schemas_js_1.userExtensionsSchema; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/index.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,0DAA0D;AAC1D,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;;;;AAEhF,+CAqBwB;AApBtB,oHAAA,oBAAoB,OAAA;AACpB,gHAAA,gBAAgB,OAAA;AAChB,iHAAA,iBAAiB,OAAA;AACjB,uHAAA,uBAAuB,OAAA;AACvB,uHAAA,uBAAuB,OAAA;AACvB,wHAAA,wBAAwB,OAAA;AACxB,kHAAA,kBAAkB,OAAA;AAClB,wHAAA,wBAAwB,OAAA;AACxB,mHAAA,mBAAmB,OAAA;AACnB,mHAAA,mBAAmB,OAAA;AACnB,gHAAA,gBAAgB,OAAA;AAChB,kHAAA,kBAAkB,OAAA;AAClB,0GAAA,UAAU,OAAA;AACV,+GAAA,eAAe,OAAA;AACf,0HAAA,0BAA0B,OAAA;AAC1B,2GAAA,WAAW,OAAA;AACX,6GAAA,aAAa,OAAA;AACb,yHAAA,yBAAyB,OAAA;AACzB,qHAAA,qBAAqB,OAAA;AACrB,+GAAA,eAAe,OAAA;AAejB,2CAwCsB;AAvCpB,6GAAA,eAAe,OAAA;AACf,iHAAA,mBAAmB,OAAA;AACnB,kHAAA,oBAAoB,OAAA;AACpB,gHAAA,kBAAkB,OAAA;AAClB,yHAAA,2BAA2B,OAAA;AAC3B,4GAAA,cAAc,OAAA;AACd,mHAAA,qBAAqB,OAAA;AACrB,sHAAA,wBAAwB,OAAA;AACxB,6GAAA,eAAe,OAAA;AACf,+GAAA,iBAAiB,OAAA;AACjB,0HAAA,4BAA4B,OAAA;AAC5B,0HAAA,4BAA4B,OAAA;AAC5B,2HAAA,6BAA6B,OAAA;AAC7B,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,iHAAA,mBAAmB,OAAA;AACnB,0HAAA,4BAA4B,OAAA;AAC5B,oHAAA,sBAAsB,OAAA;AACtB,sHAAA,wBAAwB,OAAA;AACxB,uHAAA,yBAAyB,OAAA;AACzB,mHAAA,qBAAqB,OAAA;AACrB,sHAAA,wBAAwB,OAAA;AACxB,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,qHAAA,uBAAuB,OAAA;AACvB,yHAAA,2BAA2B,OAAA;AAC3B,wHAAA,0BAA0B,OAAA;AAC1B,sHAAA,wBAAwB,OAAA;AACxB,+GAAA,iBAAiB,OAAA;AACjB,sHAAA,wBAAwB,OAAA;AACxB,kHAAA,oBAAoB,OAAA;AACpB,0GAAA,YAAY,OAAA;AACZ,iHAAA,mBAAmB,OAAA;AACnB,oHAAA,sBAAsB,OAAA;AACtB,6GAAA,eAAe,OAAA;AACf,iHAAA,mBAAmB,OAAA;AACnB,mHAAA,qBAAqB,OAAA;AACrB,kHAAA,oBAAoB,OAAA"}