@seamless-auth/types 0.28.0 → 0.30.0

package/dist/schemas/policy/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/policy/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,eAAe;IACf,gCAAgC;IAChC,yBAAyB;IACzB,2BAA2B;IAC3B,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAInD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,IAAI,CAAC;IAC1D,aAAa,EAAE,IAAI;IACnB,8BAA8B,EAAE,IAAI;IACpC,uBAAuB,EAAE,IAAI;IAC7B,yBAAyB,EAAE,IAAI;IAC/B,oBAAoB,EAAE,IAAI;IAC1B,cAAc,EAAE,IAAI;IACpB,cAAc,EAAE,IAAI;IACpB,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9C,SAAS;IACT,UAAU;IACV,cAAc;IACd,WAAW;CACZ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,yBAAyB;IACjC,WAAW,EAAE,OAAO;IACpB,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,uCAAuC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,oBAAoB;IAC5B,wDAAwD;IACxD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,mCAAmC;AACnC,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,mBAAmB;IAC9B,KAAK,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAIH,yCAAyC;AACzC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,MAAM,EAAE,oBAAoB;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,6FAA6F;AAC7F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,0DAA0D;AAC1D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACvC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,iBAAiB;IACjB,6BAA6B;IAC7B,mBAAmB;IACnB,wBAAwB;IACxB,2BAA2B;IAC3B,4BAA4B;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,6DAA6D;IAC7D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAChD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,uFAAuF;IACvF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACnD,CAAC,CAAC"}

package/dist/schemas/recovery/schema.d.ts

@@ -0,0 +1,130 @@
+import { z } from 'zod';
+/**
+ * Ten base32 characters, shown as `XXXXX-XXXXX`. Accepted with or without the dash
+ * and in either case, because people copy them from paper.
+ */
+export declare const RecoveryCodeSchema: z.ZodString;
+export type RecoveryCode = z.infer<typeof RecoveryCodeSchema>;
+/** `GET /recovery-codes`. `createdAt` is null until the user has generated a set. */
+export declare const RecoveryCodesStatusSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    remaining: z.ZodNumber;
+    total: z.ZodNumber;
+    createdAt: z.ZodNullable<z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>>;
+}, z.core.$strip>;
+export type RecoveryCodesStatus = z.infer<typeof RecoveryCodesStatusSchema>;
+/**
+ * `POST /recovery-codes`. The only time the codes are ever returned; the server keeps
+ * them hashed. Generating a set invalidates the previous one.
+ */
+export declare const RecoveryCodesGeneratedSchema: z.ZodObject<{
+    message: z.ZodString;
+    codes: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+}, z.core.$strip>;
+export type RecoveryCodesGenerated = z.infer<typeof RecoveryCodesGeneratedSchema>;
+/** `POST /recovery-codes/redeem`, with the pre-auth token from `/login`. */
+export declare const RecoveryCodeRedeemRequestSchema: z.ZodObject<{
+    code: z.ZodString;
+}, z.core.$strip>;
+export type RecoveryCodeRedeemRequest = z.infer<typeof RecoveryCodeRedeemRequestSchema>;
+/**
+ * The session a recovery issues. `recovery: true` marks a restricted session: until
+ * the user enrolls a new passkey or TOTP, the API answers `403 enrollment_required` on
+ * everything but enrollment, recovery codes, `/users/me` and logout, and the server
+ * adapters' `requireAuth` refuse it unless told otherwise. Enrolling rotates it into a
+ * normal session.
+ */
+export declare const RecoverySessionResponseSchema: z.ZodObject<{
+    sub: z.ZodOptional<z.ZodString>;
+    message: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    phone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    token: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    ttl: z.ZodOptional<z.ZodNumber>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    refreshTtl: z.ZodOptional<z.ZodNumber>;
+    recovery: z.ZodLiteral<true>;
+    nextStep: z.ZodEnum<{
+        enroll_passkey: "enroll_passkey";
+    }>;
+}, z.core.$strip>;
+export type RecoverySessionResponse = z.infer<typeof RecoverySessionResponseSchema>;
+export declare const AccountRecoveryChannelSchema: z.ZodEnum<{
+    email: "email";
+    phone: "phone";
+}>;
+export type AccountRecoveryChannel = z.infer<typeof AccountRecoveryChannelSchema>;
+/**
+ * `POST /recovery/start`, with the pre-auth token from `/login`. Sends a code to the
+ * verified address on file for that channel. The answer is the same whether or not
+ * the account has one, so it does not say which channels an account has.
+ */
+export declare const AccountRecoveryStartRequestSchema: z.ZodObject<{
+    channel: z.ZodDefault<z.ZodEnum<{
+        email: "email";
+        phone: "phone";
+    }>>;
+}, z.core.$strip>;
+export type AccountRecoveryStartRequest = z.infer<typeof AccountRecoveryStartRequestSchema>;
+export declare const AccountRecoveryStartResponseSchema: z.ZodObject<{
+    message: z.ZodString;
+    delivery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"otp_email">;
+        to: z.ZodString;
+        token: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"otp_sms">;
+        to: z.ZodString;
+        token: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"magic_link_email">;
+        to: z.ZodString;
+        token: z.ZodOptional<z.ZodString>;
+        magicLinkUrl: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"enrollment_invite_email">;
+        to: z.ZodString;
+        signInUrl: z.ZodString;
+    }, z.core.$strip>], "kind">>;
+}, z.core.$strip>;
+export type AccountRecoveryStartResponse = z.infer<typeof AccountRecoveryStartResponseSchema>;
+/** `POST /recovery/verify`: the code from `/recovery/start` opens the request. */
+export declare const AccountRecoveryVerifyRequestSchema: z.ZodObject<{
+    code: z.ZodString;
+}, z.core.$strip>;
+export type AccountRecoveryVerifyRequest = z.infer<typeof AccountRecoveryVerifyRequestSchema>;
+export declare const AccountRecoveryStateSchema: z.ZodEnum<{
+    completed: "completed";
+    pending: "pending";
+    ready: "ready";
+    cancelled: "cancelled";
+}>;
+export type AccountRecoveryState = z.infer<typeof AccountRecoveryStateSchema>;
+/**
+ * `POST /recovery/verify` and `GET /recovery/status`. `pending` until `completesAt`,
+ * then `ready`; every other channel and active session was told when it opened, and
+ * any of them can cancel it.
+ */
+export declare const AccountRecoveryStatusSchema: z.ZodObject<{
+    state: z.ZodEnum<{
+        completed: "completed";
+        pending: "pending";
+        ready: "ready";
+        cancelled: "cancelled";
+    }>;
+    requestedAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+    completesAt: z.ZodPipe<z.ZodCoercedDate<unknown>, z.ZodTransform<string, Date>>;
+}, z.core.$strip>;
+export type AccountRecoveryStatus = z.infer<typeof AccountRecoveryStatusSchema>;
+/**
+ * `POST /recovery/cancel`. Either the token from the notice sent to the other
+ * channels, or no body with an access session for the account.
+ */
+export declare const AccountRecoveryCancelRequestSchema: z.ZodObject<{
+    cancelToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AccountRecoveryCancelRequest = z.infer<typeof AccountRecoveryCancelRequestSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schemas/recovery/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/recovery/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aAGiD,CAAC;AAEjF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,qFAAqF;AACrF,eAAO,MAAM,yBAAyB;;;;;iBAKpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,4BAA4B;;;EAA6B,CAAC;AAEvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,kFAAkF;AAClF,eAAO,MAAM,kCAAkC;;iBAE7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,0BAA0B;;;;;EAAyD,CAAC;AAEjG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAItC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAE7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC"}

package/dist/schemas/recovery/schema.js

@@ -0,0 +1,81 @@
+import { z } from 'zod';
+import { IsoDate } from '../../shared.js';
+import { NextStepSchema, RefreshSuccessResponseSchema } from '../auth/auth.schema.js';
+import { AuthDeliverySchema } from '../messaging/schema.js';
+/**
+ * Ten base32 characters, shown as `XXXXX-XXXXX`. Accepted with or without the dash
+ * and in either case, because people copy them from paper.
+ */
+export const RecoveryCodeSchema = z
+    .string()
+    .trim()
+    .regex(/^[A-Za-z2-7]{5}-?[A-Za-z2-7]{5}$/, { message: 'Not a recovery code' });
+/** `GET /recovery-codes`. `createdAt` is null until the user has generated a set. */
+export const RecoveryCodesStatusSchema = z.object({
+    enabled: z.boolean(),
+    remaining: z.number().int().nonnegative(),
+    total: z.number().int().nonnegative(),
+    createdAt: IsoDate.nullable(),
+});
+/**
+ * `POST /recovery-codes`. The only time the codes are ever returned; the server keeps
+ * them hashed. Generating a set invalidates the previous one.
+ */
+export const RecoveryCodesGeneratedSchema = z.object({
+    message: z.string(),
+    codes: z.array(RecoveryCodeSchema).min(1),
+    createdAt: IsoDate,
+});
+/** `POST /recovery-codes/redeem`, with the pre-auth token from `/login`. */
+export const RecoveryCodeRedeemRequestSchema = z.object({
+    code: RecoveryCodeSchema,
+});
+/**
+ * The session a recovery issues. `recovery: true` marks a restricted session: until
+ * the user enrolls a new passkey or TOTP, the API answers `403 enrollment_required` on
+ * everything but enrollment, recovery codes, `/users/me` and logout, and the server
+ * adapters' `requireAuth` refuse it unless told otherwise. Enrolling rotates it into a
+ * normal session.
+ */
+export const RecoverySessionResponseSchema = RefreshSuccessResponseSchema.omit({
+    sessionId: true,
+}).extend({
+    recovery: z.literal(true),
+    nextStep: NextStepSchema,
+});
+export const AccountRecoveryChannelSchema = z.enum(['email', 'phone']);
+/**
+ * `POST /recovery/start`, with the pre-auth token from `/login`. Sends a code to the
+ * verified address on file for that channel. The answer is the same whether or not
+ * the account has one, so it does not say which channels an account has.
+ */
+export const AccountRecoveryStartRequestSchema = z.object({
+    channel: AccountRecoveryChannelSchema.default('email'),
+});
+export const AccountRecoveryStartResponseSchema = z.object({
+    message: z.string(),
+    delivery: AuthDeliverySchema.optional(),
+});
+/** `POST /recovery/verify`: the code from `/recovery/start` opens the request. */
+export const AccountRecoveryVerifyRequestSchema = z.object({
+    code: z.string().trim().min(1),
+});
+export const AccountRecoveryStateSchema = z.enum(['pending', 'ready', 'cancelled', 'completed']);
+/**
+ * `POST /recovery/verify` and `GET /recovery/status`. `pending` until `completesAt`,
+ * then `ready`; every other channel and active session was told when it opened, and
+ * any of them can cancel it.
+ */
+export const AccountRecoveryStatusSchema = z.object({
+    state: AccountRecoveryStateSchema,
+    requestedAt: IsoDate,
+    completesAt: IsoDate,
+});
+/**
+ * `POST /recovery/cancel`. Either the token from the notice sent to the other
+ * channels, or no body with an access session for the account.
+ */
+export const AccountRecoveryCancelRequestSchema = z.object({
+    cancelToken: z.string().trim().min(1).optional(),
+});
+//# sourceMappingURL=schema.js.map

package/dist/schemas/recovery/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/recovery/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAIjF,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,SAAS,EAAE,OAAO;CACnB,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,kBAAkB;CACzB,CAAC,CAAC;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC,IAAI,CAAC;IAC7E,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC,MAAM,CAAC;IACR,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACzB,QAAQ,EAAE,cAAc;CACzB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAIvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC;CACvD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH,kFAAkF;AAClF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAIjG;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,OAAO;IACpB,WAAW,EAAE,OAAO;CACrB,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC"}

package/dist/schemas/systemConfig/schema.d.ts

@@ -9,6 +9,13 @@ export declare const LoginMethodSchema: z.ZodEnum<{
 export type LoginMethod = z.infer<typeof LoginMethodSchema>;
 export declare const RedirectTargetSchema: z.ZodURL;
 export type RedirectTarget = z.infer<typeof RedirectTargetSchema>;
+/**
+ * The auth server reads a provider's secret from this env var, so the name is held to
+ * the shape of an OAuth client secret: configuration cannot point the token exchange at
+ * any other secret the server holds (GHSA-qx82-28gf-w744).
+ */
+export declare const OAuthClientSecretEnvSchema: z.ZodString;
+export type OAuthClientSecretEnv = z.infer<typeof OAuthClientSecretEnvSchema>;
 export declare const OAuthProviderConfigSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;
@@ -162,6 +169,26 @@ export declare const DefaultAuthenticatorPolicy: {
     readonly aaguidAllowList: readonly [];
     readonly aaguidDenyList: readonly [];
 };
+/**
+ * Single-use recovery codes. On by default: a user only has codes after generating
+ * them, so the switch only matters once someone has. Not a login method, so no
+ * `login_methods` change can take a user's way back in away from them.
+ */
+export declare const RecoveryCodesPolicySchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type RecoveryCodesPolicy = z.infer<typeof RecoveryCodesPolicySchema>;
+/**
+ * Self-service recovery through a verified email or phone, completed only after
+ * `delay` and announced on every other channel and session so the owner can cancel.
+ * Off by default: it is a way into an account that does not need its factors.
+ */
+export declare const AccountRecoveryPolicySchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    delay: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type AccountRecoveryPolicy = z.infer<typeof AccountRecoveryPolicySchema>;
 export declare const SystemConfigSchema: z.ZodObject<{
     app_name: z.ZodString;
     default_roles: z.ZodArray<z.ZodString>;
@@ -234,6 +261,14 @@ export declare const SystemConfigSchema: z.ZodObject<{
         aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
         aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    recovery_codes: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    account_recovery: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        delay: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
     access_token_ttl: z.ZodString;
     session_idle_ttl: z.ZodDefault<z.ZodString>;
     refresh_token_ttl: z.ZodString;
@@ -333,6 +368,14 @@ export declare const SystemConfigPatchSchema: z.ZodObject<{
         aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
         aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    recovery_codes: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    account_recovery: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        delay: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
     access_token_ttl: z.ZodOptional<z.ZodString>;
     session_idle_ttl: z.ZodOptional<z.ZodString>;
     refresh_token_ttl: z.ZodOptional<z.ZodString>;
@@ -435,6 +478,14 @@ export declare function createPatchSystemConfigSchema(existing: SystemConfig): z
         aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
         aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    recovery_codes: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    account_recovery: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        delay: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
     access_token_ttl: z.ZodOptional<z.ZodString>;
     session_idle_ttl: z.ZodOptional<z.ZodString>;
     refresh_token_ttl: z.ZodOptional<z.ZodString>;
@@ -497,12 +548,12 @@ export type OAuthProviderIdParam = z.infer<typeof OAuthProviderIdParamSchema>;
 export declare const OAuthProviderUpdateSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
     scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    enabled: z.ZodOptional<z.ZodBoolean>;
-    clientId: z.ZodOptional<z.ZodString>;
     clientSecretEnv: z.ZodOptional<z.ZodString>;
     authorizationUrl: z.ZodOptional<z.ZodURL>;
     tokenUrl: z.ZodOptional<z.ZodURL>;
     userInfoUrl: z.ZodOptional<z.ZodURL>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    clientId: z.ZodOptional<z.ZodString>;
     redirectUri: z.ZodOptional<z.ZodOptional<z.ZodURL>>;
     redirectUris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
     subjectJsonPath: z.ZodOptional<z.ZodString>;
@@ -664,6 +715,14 @@ export declare const GetSystemConfigResponseSchema: z.ZodObject<{
         aaguidAllowList: z.ZodDefault<z.ZodArray<z.ZodString>>;
         aaguidDenyList: z.ZodDefault<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    recovery_codes: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        requireAtEnrollment: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    account_recovery: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        delay: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
     access_token_ttl: z.ZodString;
     session_idle_ttl: z.ZodDefault<z.ZodString>;
     refresh_token_ttl: z.ZodString;
@@ -721,6 +780,8 @@ export declare const PublicSystemConfigResponseSchema: z.ZodObject<{
         phone_otp: "phone_otp";
         oauth: "oauth";
     }>>;
+    recoveryCodes: z.ZodOptional<z.ZodBoolean>;
+    accountRecovery: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type PublicSystemConfigResponse = z.infer<typeof PublicSystemConfigResponseSchema>;
 //# sourceMappingURL=schema.d.ts.map

package/dist/schemas/systemConfig/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAqB5D,eAAO,MAAM,oBAAoB,UAShC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2CpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAIX;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAwB/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;CAKxB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;EAA6B,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;EAA6B,CAAC;AAEpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;iBAoEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;;;;;;CAQ7B,CAAC;AAIX,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmF7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwBzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAsB9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAqB5D,eAAO,MAAM,oBAAoB,UAShC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,aAKnC,CAAC;AAEL,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2CpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mBAAmB;;;;;iBAa9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC;AAIX;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAwB/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;CAKxB,CAAC;AAEX,eAAO,MAAM,mCAAmC;;;;EAAgD,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;EAA6B,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;EAA6B,CAAC;AAEpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,4BAA4B;;;;EAAmD,CAAC;AAE7F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;iBAoEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;;;;;;;CAQ7B,CAAC;AAWX;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;;;iBAIpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;iBAMtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuF7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0BzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAyBnE;AAED,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA4B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAsB9E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqB,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;iBAM3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}

package/dist/schemas/systemConfig/schema.js

@@ -35,6 +35,20 @@ export const RedirectTargetSchema = z.url().refine((value) => {
         return false;
     }
 }, { message: 'Redirect target uses a scheme that cannot be a link destination' });
+// Provider endpoints the server fetches, and the authorization URL the browser is sent
+// to. `z.url()` alone accepts any scheme, including `javascript:`.
+const ProviderUrlSchema = z.url({ protocol: /^https?$/ });
+/**
+ * The auth server reads a provider's secret from this env var, so the name is held to
+ * the shape of an OAuth client secret: configuration cannot point the token exchange at
+ * any other secret the server holds (GHSA-qx82-28gf-w744).
+ */
+export const OAuthClientSecretEnvSchema = z
+    .string()
+    .trim()
+    .regex(/^[A-Z][A-Z0-9_]{0,59}_CLIENT_SECRET$/, {
+    message: 'Must be an env var name ending in _CLIENT_SECRET, for example GOOGLE_CLIENT_SECRET',
+});
 export const OAuthProviderConfigSchema = z.object({
     id: OAuthProviderIdSchema,
     name: z.string().trim().min(1).max(80),
@@ -42,10 +56,10 @@ export const OAuthProviderConfigSchema = z.object({
     clientId: z.string().trim().min(1),
     // The secret itself never lives in config; this names the environment
     // variable the server reads it from.
-    clientSecretEnv: z.string().trim().min(1),
-    authorizationUrl: z.url(),
-    tokenUrl: z.url(),
-    userInfoUrl: z.url(),
+    clientSecretEnv: OAuthClientSecretEnvSchema,
+    authorizationUrl: ProviderUrlSchema,
+    tokenUrl: ProviderUrlSchema,
+    userInfoUrl: ProviderUrlSchema,
     scopes: z.array(z.string().trim().min(1)).default([]),
     redirectUri: z.url().optional(),
     redirectUris: z.array(z.url()).default([]),
@@ -63,7 +77,7 @@ export const OAuthProviderConfigSchema = z.object({
      * read for the profile claims instead of calling `userInfoUrl`.
      */
     issuer: z.url().optional(),
-    jwksUri: z.url().optional(),
+    jwksUri: ProviderUrlSchema.optional(),
     /**
      * Links a first sign-in to a user imported under this source (see
      * `ImportUsersRequestSchema`) whose external id equals the ID token claim at
@@ -238,6 +252,30 @@ export const DefaultAuthenticatorPolicy = {
     aaguidDenyList: [],
 };
 const DurationSchema = z.string().regex(/^\d+[smhd]$/);
+const DURATION_SECONDS = { s: 1, m: 60, h: 3600, d: 86400 };
+function durationSeconds(value) {
+    const unit = value.slice(-1);
+    return Number(value.slice(0, -1)) * DURATION_SECONDS[unit];
+}
+/**
+ * Single-use recovery codes. On by default: a user only has codes after generating
+ * them, so the switch only matters once someone has. Not a login method, so no
+ * `login_methods` change can take a user's way back in away from them.
+ */
+export const RecoveryCodesPolicySchema = z.object({
+    enabled: z.boolean().default(true),
+    /** Ask for a set of codes as part of first passkey enrollment. */
+    requireAtEnrollment: z.boolean().default(false),
+});
+/**
+ * Self-service recovery through a verified email or phone, completed only after
+ * `delay` and announced on every other channel and session so the owner can cancel.
+ * Off by default: it is a way into an account that does not need its factors.
+ */
+export const AccountRecoveryPolicySchema = z.object({
+    enabled: z.boolean().default(false),
+    delay: DurationSchema.refine((value) => durationSeconds(value) >= 3600 && durationSeconds(value) <= 30 * 86400, { message: 'delay must be between 1h and 30d' }).default('24h'),
+});
 export const SystemConfigSchema = z.object({
     app_name: z.string().min(3),
     default_roles: z.array(RoleNameSchema).min(1),
@@ -264,6 +302,8 @@ export const SystemConfigSchema = z.object({
     // Derived from the field defaults rather than restated, so the two cannot drift.
     // DefaultAuthenticatorPolicy stays exported for consumers that need the shape.
     authenticator_policy: AuthenticatorPolicySchema.default(() => AuthenticatorPolicySchema.parse({})),
+    recovery_codes: RecoveryCodesPolicySchema.default(() => RecoveryCodesPolicySchema.parse({})),
+    account_recovery: AccountRecoveryPolicySchema.default(() => AccountRecoveryPolicySchema.parse({})),
     access_token_ttl: z.string().regex(/^\d+[smhd]$/),
     /**
      * How long a session may live without being refreshed.
@@ -325,6 +365,8 @@ export const SystemConfigPatchSchema = z
     oauth_providers: z.array(OAuthProviderConfigSchema).optional(),
     lockout_policy: LockoutPolicySchema.optional(),
     authenticator_policy: AuthenticatorPolicySchema.optional(),
+    recovery_codes: RecoveryCodesPolicySchema.optional(),
+    account_recovery: AccountRecoveryPolicySchema.optional(),
     access_token_ttl: SystemConfigSchema.shape.access_token_ttl.optional(),
     session_idle_ttl: DurationSchema.optional(),
     refresh_token_ttl: SystemConfigSchema.shape.refresh_token_ttl.optional(),
@@ -417,5 +459,9 @@ export const AvailableRolesResponseSchema = z.object({
  */
 export const PublicSystemConfigResponseSchema = z.object({
     loginMethods: z.array(LoginMethodSchema).min(1),
+    // Optional so a client still parses a server from before v0.20. Lets the sign-in
+    // screens offer "use a recovery code" and "can't sign in?" only where they work.
+    recoveryCodes: z.boolean().optional(),
+    accountRecovery: z.boolean().optional(),
 });
 //# sourceMappingURL=schema.js.map

package/dist/schemas/systemConfig/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAChD,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAC/E,CAAC;AAIF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3B;;;;;OAKG;IACH,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;OAIG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAErD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;KACzC,CAAC;SACD,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACzC,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;KACzC,CAAC;SACD,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACzC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1C,CAAC;SACD,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;CAC3C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;IAClC,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;IACxC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;CAC7B,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAMpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;IAClE;;;;;;;;;OASG;IACH,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpD;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1D;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,UAAU;IAC5B,WAAW,EAAE,MAAM;IACnB,yBAAyB,EAAE,KAAK;IAChC,cAAc,EAAE,OAAO;IACvB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;CACV,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C;;;;;OAKG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;OAMG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,iFAAiF;IACjF,+EAA+E;IAC/E,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3D,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CACpC;IAED,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD;;;;;;;;;;;OAWG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,gBAAgB,EAAE,oBAAoB,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAErE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEhC;;;;;;;;OAQG;IACH,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjD,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1E,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,gBAAgB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACjD,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;IACpD,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAQH,SAAS,eAAe,CAA8B,KAAY;IAChE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC1C,GAAG;QACH,KAAK,YAAY,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK;KACvD,CAAC,CACuB,CAAC;AAC9B,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC,eAAe,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;KAC3E,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAChD,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/systemConfig/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,SAAS;IACT,YAAY;IACZ,WAAW;IACX,WAAW;IACX,OAAO;CACR,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,OAAO;IACP,WAAW;IACX,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAChD,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAC/E,CAAC;AAIF,uFAAuF;AACvF,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,sCAAsC,EAAE;IAC7C,OAAO,EAAE,oFAAoF;CAC9F,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,qCAAqC;IACrC,eAAe,EAAE,0BAA0B;IAC3C,gBAAgB,EAAE,iBAAiB;IACnC,QAAQ,EAAE,iBAAiB;IAC3B,WAAW,EAAE,iBAAiB;IAC9B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrC;;;;;OAKG;IACH,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;OAIG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,cAAc,EAAE,EAAE,GAAG,EAAE;CACf,CAAC;AAEX,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAErD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACnB,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;KACzC,CAAC;SACD,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACzC,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;KACzC,CAAC;SACD,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACzC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1C,CAAC;SACD,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;CAC3C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;IAClC,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;IACxC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;CAC7B,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAIjG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAMpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAI7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,mCAAmC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC;IAClE;;;;;;;;;OASG;IACH,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpD;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1D;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,4FAA4F;IAC5F,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,UAAU;IAC5B,WAAW,EAAE,MAAM;IACnB,yBAAyB,EAAE,KAAK;IAChC,cAAc,EAAE,OAAO;IACvB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;CACV,CAAC;AAEX,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAEvD,MAAM,gBAAgB,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAW,CAAC;AAErE,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAkC,CAAC;IAC9D,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAChD,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,KAAK,EAAE,cAAc,CAAC,MAAM,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,EACjF,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAChD,CAAC,OAAO,CAAC,KAAK,CAAC;CACjB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,8BAA8B,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3C;;;;;OAKG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD;;;;;;OAMG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACjE,iFAAiF;IACjF,+EAA+E;IAC/E,oBAAoB,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3D,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CACpC;IACD,cAAc,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5F,gBAAgB,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAAG,EAAE,CACzD,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CACtC;IAED,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAEjD;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAElD;;;;;;;;;;;OAWG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,gBAAgB,EAAE,oBAAoB,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAErE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEhC;;;;;;;;OAQG;IACH,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE;IACpE,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE;IAChE,8BAA8B,EAC5B,kBAAkB,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,EAAE;IACpE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjD,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC9C,oBAAoB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1D,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IACpD,gBAAgB,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;IACxE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1E,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;IAC1D,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;IAC5D,gBAAgB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACjD,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;IACpD,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAsB;IAClE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAEjE,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/E,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;gBACzB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAInE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAC;AAQH,SAAS,eAAe,CAA8B,KAAY;IAChE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC1C,GAAG;QACH,KAAK,YAAY,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK;KACvD,CAAC,CACuB,CAAC;AAC9B,CAAC;AAED,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC,eAAe,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;KAC3E,OAAO,EAAE;KACT,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAIhE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,iFAAiF;IACjF,iFAAiF;IACjF,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/types",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
   "author": "Fells Code, LLC",
   "license": "Apache-2.0",
@@ -60,6 +60,7 @@
     "prepublishOnly": "npm run build",
     "test": "vitest run",
     "test:watch": "vitest",
+    "test:zod-floor": "node scripts/check-zod-floor.mjs",
     "changeset": "changeset",
     "version-packages": "changeset version",
     "release:stable": "npm run build && changeset publish",
@@ -75,7 +76,7 @@
     ]
   },
   "dependencies": {
-    "zod": "^4.3.6"
+    "zod": "^4.5.0"
   },
   "devDependencies": {
     "@changesets/cli": "^3.0.2",
@@ -87,7 +88,7 @@
     "eslint-config-prettier": "^10.1.8",
     "husky": "^9.1.7",
     "lint-staged": "^17.2.0",
-    "prettier": "3.9.9",
+    "prettier": "3.9.10",
     "typescript": "^5.9.3",
     "vitest": "^5.0.3"
   },

package/src/index.ts

@@ -19,3 +19,5 @@ export * from './schemas/metrics/schema.js';
 export * from './schemas/admin/schema.js';
 export * from './schemas/userImport/schema.js';
 export * from './schemas/enrollment/schema.js';
+export * from './schemas/recovery/schema.js';
+export * from './schemas/policy/schema.js';

package/src/schemas/auth/auth.schema.ts

@@ -51,6 +51,8 @@ export const RefreshSuccessResponseSchema = z.object({
   phone: z.string().nullable().optional(),
   ttl: z.number().optional(),
   refreshTtl: z.number().optional(),
+  /** A restricted recovery session; see `RecoverySessionResponseSchema`. */
+  recovery: z.boolean().optional(),
 });
 
 export type RefreshSuccessResponse = z.infer<typeof RefreshSuccessResponseSchema>;

package/src/schemas/authEvent/schema.ts

@@ -2,17 +2,22 @@ import z from 'zod';
 import { IsoDate } from '../../shared.js';
 
 export const AUTH_EVENT_TYPES = [
+  'account_recovery_cancelled',
+  'account_recovery_completed',
+  'account_recovery_started',
+  'account_recovery_verified',
   'admin_device_replacement_recovery',
   'admin_enrollment_invite_sent',
   'admin_oauth_provider_restored',
   'admin_oauth_provider_retired',
+  'admin_session_revoked',
   'admin_user_import_completed',
   'admin_user_imported',
-  'admin_session_revoked',
   'auth_action_incremented',
   'bearer_token_failed',
   'bearer_token_success',
   'bearer_token_suspicious',
+  'break_glass_sign_in',
   'credentials_deleted',
   'informational',
   'internal_user_updated_by_owner',
@@ -40,6 +45,14 @@ export const AUTH_EVENT_TYPES = [
   'otp_failed',
   'otp_success',
   'otp_suspicious',
+  'policy_draft_discarded',
+  'policy_draft_saved',
+  'policy_dry_run',
+  'policy_published',
+  'policy_rolled_back',
+  'recovery_code_failed',
+  'recovery_code_used',
+  'recovery_codes_generated',
   'recovery_otp_failed',
   'recovery_otp_success',
   'recovery_otp_suspicious',

package/src/schemas/oauth/schema.ts

@@ -35,6 +35,12 @@ export const StartOAuthLoginResponseSchema = z.object({
   provider: PublicOAuthProviderSchema,
   state: z.string(),
   authorizationUrl: z.url(),
+  /**
+   * Binds `state` to the client that started the sign-in. The client keeps it and sends
+   * it back with the callback; it never goes to the provider. Optional only so a client
+   * can parse a response from an auth server that predates it.
+   */
+  binding: z.string().optional(),
 });
 
 export type StartOAuthLoginResponse = z.infer<typeof StartOAuthLoginResponseSchema>;
@@ -42,6 +48,8 @@ export type StartOAuthLoginResponse = z.infer<typeof StartOAuthLoginResponseSche
 export const FinishOAuthLoginRequestSchema = z.object({
   code: z.string().trim().min(1),
   state: z.string().trim().min(1),
+  /** The `binding` the start response returned to this client. */
+  binding: z.string().trim().min(1).optional(),
 });
 
 export type FinishOAuthLoginRequest = z.infer<typeof FinishOAuthLoginRequestSchema>;