@wildo-ai/saas-frontend-lib 1.0.1 → 1.1.0

package/dist/esm/core/security/security.frontend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqDH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;CACzB,CAAC"}
+{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0GH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;IACxB,2BAA2B,EAAE,SAAS;CACvC,CAAC","sourcesContent":["/**\n * Security Frontend Schemas\n * \n * Core authentication and authorization types for the frontend security layer.\n */\n\nimport { z } from 'zod';\nimport { \n  AuthIdentificationResponse,\n  SessionType,\n  type AuthMethod,\n  type AvailableMethod,\n  type AuthSessionPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Authentication state — contains only authentication-related fields.\n *\n * **No `refreshToken` field** (Auth-hardening Slice A Step 6,\n * 2026-04-13). Pre-Slice-A this carried `refreshToken: string | null`\n * mirroring the legacy body-channel rotation contract. A-Step 2\n * (cookie migration) made the cookie the sole owner of the refresh\n * token, A-Step 3 stopped this state from being read by any consumer,\n * and A-Step 6 dropped the field entirely. The refresh token now lives\n * EXCLUSIVELY in the `__wildo_refresh` `HttpOnly` cookie — JS-invisible\n * by design (XSS exfiltration surface closed). Consumers that want to\n * \"check if the user has a valid session\" should look at `accessToken`\n * (or `sessionRestored`) — never at the cookie, which is opaque to JS.\n */\nexport interface AuthState {\n  isLoading: boolean;\n  error: string | null;\n  sessionId: string | null;\n  accessToken: string | null;\n  identification: AuthIdentificationResponse | null;\n  sessionState: any | null;\n  isRestoringSession: boolean;\n  sessionRestored: boolean;\n  mfaRequired: boolean;\n  mfaSessionId: string | null;\n  availableMfaMethods: AvailableMethod[];\n  availableEnrollmentMethods: AuthMethod[];\n  enrolledSecondFactorMethods: string[];\n  usableSecondFactorMethods: string[];\n  purpose: AuthSessionPurpose | null;\n  /** W7.3b: Session type — null before authentication is resolved. */\n  sessionType: SessionType | null;\n  /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */\n  oneOffContext?: {\n    originTokenId: string;\n    tokenType: string;\n    consumableTokenValue?: string;\n    tokenExpiresAt?: string;\n    scopedInitiatorIds?: Record<string, string>;\n    applicationId?: string;\n  };\n  /**\n   * cross-app-jwt-propagation.md Step 5: Context data populated when an\n   * AUTH_CODE_EXCHANGE token was minted by the cross-frontend-handoff issuer.\n   * `AuthSessionContext.handleAuthCodeExchange()` populates this field only\n   * when the token-exchange response carries a top-level `returnPath`; OAuth2\n   * callback codes omit that field and therefore leave this context undefined.\n   *\n   * Distinct from `oneOffContext` on purpose (semantic distinction over\n   * convenience — see `design-philosophy.mdc`):\n   *   - `oneOffContext` describes a W7.3b ephemeral one-off session\n   *     (resource-scoped targeting, applicationId, consumable replay).\n   *   - `crossFrontendHandoffContext` describes a session-transfer landing\n   *     (returnPath, source/target frontend telemetry). The session itself\n   *     is a regular persistent session driven by the receiver's storage\n   *     adapter (cross-app-jwt-propagation.md K-7).\n   *\n   * Consumed by `Auth_OneOffSession` in cross-frontend-handoff mode to drive\n   * post-exchange navigation (`returnPath`); also available to app-level\n   * telemetry hooks that want to know \"this user just landed via a handoff\n   * from $sourceFrontendServiceName\".\n   */\n  crossFrontendHandoffContext?: {\n    /**\n     * Path to navigate to after the exchange completes. Already passed\n     * `CrossFrontendHandoff_ReturnPathSchema` refines at issuance, but\n     * receivers MUST sanitize defense-in-depth (a malicious caller could\n     * hand-craft an exchange URL bypassing the issuer).\n     */\n    returnPath: string;\n    /**\n     * The frontend that initiated the handoff (e.g., `'admin-console'`).\n     * Optional because the source frontend identifies itself only via the\n     * `X-Frontend-Service-Name` request header (set by the shared HTTP\n     * client interceptor). Non-browser callers — server-to-server\n     * invocations, hand-crafted curl sessions — may legitimately omit\n     * the header (the issuer falls back to \"unknown\" source for audit\n     * purposes), in which case the receiver simply has no source\n     * identity to display in telemetry / breadcrumbs.\n     */\n    sourceFrontendServiceName?: string;\n    /** The target frontend the handoff was minted for. Useful for telemetry / breadcrumb rendering. */\n    targetServiceKey?: string;\n  };\n}\n\n/**\n * Effective permissions for the current user\n * Contains app-level permissions and per-organization permissions\n */\nexport type EffectivePermissions = {\n  appLevel: string[];\n  organizations: Record<string, string[]>;\n};\n\n/**\n * Empty/initial authentication state\n */\nexport const EMPTY_AUTH_STATE: AuthState = {\n  isLoading: false,\n  error: null,\n  sessionId: null,\n  accessToken: null,\n  identification: null,\n  sessionState: null,\n  isRestoringSession: false,\n  sessionRestored: false,\n  mfaRequired: false,\n  mfaSessionId: null,\n  availableMfaMethods: [],\n  availableEnrollmentMethods: [],\n  enrolledSecondFactorMethods: [],\n  usableSecondFactorMethods: [],\n  purpose: null,\n  sessionType: null,\n  oneOffContext: undefined,\n  crossFrontendHandoffContext: undefined,\n};\n\n// ─── Auth UI State Types ─────────────────────────────────────────────\n\nexport type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';\n\nexport type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';\n\nexport type UIFactorLevel = 'first' | 'second';\n\n\n\n"]}

package/dist/esm/core/security/session-token-storage.frontend.service.d.ts

@@ -3,6 +3,22 @@
  *
  * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).
  * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).
+ *
+ * Auth-hardening Slice A Step 3 (2026-04-13) — `PersistentSessionTokenStorage`
+ * NO LONGER persists the refresh token in localStorage. The refresh token now
+ * travels via the `__wildo_refresh` `HttpOnly` cookie (see
+ * `auth-controller.utils.ts` and `authentication-controller.backend.service.ts`).
+ * The cookie is invisible to JS, which closes the XSS exfiltration surface
+ * that ANY localStorage-backed refresh token inherently has.
+ *
+ * The `storeTokens()` signature still accepts a `refreshToken` parameter for
+ * source-compat with `EphemeralSessionTokenStorage` (which keeps the in-memory
+ * field for one-off / test contexts), but `PersistentSessionTokenStorage`
+ * silently ignores the argument and emits a one-line `console.warn` if a
+ * non-null value is passed during the transition window. The existing
+ * `removeLocalStorageItem(REFRESH_TOKEN)` is kept on every `storeTokens()`
+ * AND `clear()` invocation so any leftover localStorage value from a
+ * pre-migration session is wiped on the user's next interaction.
  */
 export interface SessionTokenStorage {
     getAccessToken(): string | null;
@@ -14,6 +30,13 @@ export interface SessionTokenStorage {
 }
 export declare class PersistentSessionTokenStorage implements SessionTokenStorage {
     getAccessToken(): string | null;
+    /**
+     * Always returns `null` — refresh tokens no longer live in localStorage
+     * (Auth-hardening Slice A Step 3). The `__wildo_refresh` `HttpOnly` cookie
+     * carries the refresh token; JS can never read it. Method kept for
+     * `SessionTokenStorage` interface conformance — `EphemeralSessionTokenStorage`
+     * still uses it for in-memory contexts.
+     */
     getRefreshToken(): string | null;
     storeTokens(accessToken: string | null, refreshToken: string | null): void;
     getOrganizationId(): string | null;

package/dist/esm/core/security/session-token-storage.frontend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-storage.frontend.service.d.ts","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI;IAG/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAGhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAQ1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK7C,KAAK,IAAI,IAAI;CAKd;AAED,qBAAa,4BAA6B,YAAW,mBAAmB;IACtE,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAAuB;IAE9C,cAAc,IAAI,MAAM,GAAG,IAAI;IAC/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAChC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAC7C,KAAK,IAAI,IAAI;CAKd"}
+{"version":3,"file":"session-token-storage.frontend.service.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,CAAC;CACf;AAQD,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI;IAG/B;;;;;;OAMG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI;IAGhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAY1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK7C,KAAK,IAAI,IAAI;CAKd;AAED,qBAAa,4BAA6B,YAAW,mBAAmB;IACtE,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAAuB;IAE9C,cAAc,IAAI,MAAM,GAAG,IAAI;IAC/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAChC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAC7C,KAAK,IAAI,IAAI;CAKd"}

package/dist/esm/core/security/session-token-storage.frontend.service.js

@@ -3,22 +3,52 @@
  *
  * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).
  * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).
+ *
+ * Auth-hardening Slice A Step 3 (2026-04-13) — `PersistentSessionTokenStorage`
+ * NO LONGER persists the refresh token in localStorage. The refresh token now
+ * travels via the `__wildo_refresh` `HttpOnly` cookie (see
+ * `auth-controller.utils.ts` and `authentication-controller.backend.service.ts`).
+ * The cookie is invisible to JS, which closes the XSS exfiltration surface
+ * that ANY localStorage-backed refresh token inherently has.
+ *
+ * The `storeTokens()` signature still accepts a `refreshToken` parameter for
+ * source-compat with `EphemeralSessionTokenStorage` (which keeps the in-memory
+ * field for one-off / test contexts), but `PersistentSessionTokenStorage`
+ * silently ignores the argument and emits a one-line `console.warn` if a
+ * non-null value is passed during the transition window. The existing
+ * `removeLocalStorageItem(REFRESH_TOKEN)` is kept on every `storeTokens()`
+ * AND `clear()` invocation so any leftover localStorage value from a
+ * pre-migration session is wiped on the user's next interaction.
  */
 import { LOCAL_STORAGE_KEYS, getLocalStorageItem, setLocalStorageItem, removeLocalStorageItem, } from '../../core/commons/local-storage.frontend.schemas.js';
+/**
+ * Module-scoped flag — emit the deprecation warning ONCE per page load even if
+ * `storeTokens()` is called many times during a session. Avoids log spam.
+ */
+let _refreshTokenArgWarningEmitted = false;
 export class PersistentSessionTokenStorage {
     getAccessToken() {
         return getLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);
     }
+    /**
+     * Always returns `null` — refresh tokens no longer live in localStorage
+     * (Auth-hardening Slice A Step 3). The `__wildo_refresh` `HttpOnly` cookie
+     * carries the refresh token; JS can never read it. Method kept for
+     * `SessionTokenStorage` interface conformance — `EphemeralSessionTokenStorage`
+     * still uses it for in-memory contexts.
+     */
     getRefreshToken() {
-        return getLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);
+        return null;
     }
     storeTokens(accessToken, refreshToken) {
         accessToken
             ? setLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN, accessToken)
             : removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);
-        refreshToken
-            ? setLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN, refreshToken)
-            : removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);
+        if (refreshToken !== null && !_refreshTokenArgWarningEmitted) {
+            _refreshTokenArgWarningEmitted = true;
+            console.warn('[wildo-auth] PersistentSessionTokenStorage.storeTokens() received a non-null refreshToken — argument is ignored. Refresh tokens now travel via the `__wildo_refresh` HttpOnly cookie (Auth-hardening Slice A).');
+        }
+        removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);
     }
     getOrganizationId() {
         return getLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);
@@ -52,4 +82,4 @@ export class EphemeralSessionTokenStorage {
         this._organizationId = null;
     }
 }
-//# sourceMappingURL=session-token-storage.frontend.service.js.map
+//# sourceMappingURL=session-token-storage.frontend.service.js.map

package/dist/esm/core/security/session-token-storage.frontend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-storage.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iEAAiE,CAAC;AAazE,MAAM,OAAO,6BAA6B;IACxC,cAAc;QACZ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD,eAAe;QACb,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC/D,CAAC;IACD,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,WAAW;YACT,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzD,YAAY;YACV,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC;YACrE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC/D,CAAC;IACD,iBAAiB;QACf,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,iBAAiB,CAAC,KAAoB;QACpC,KAAK;YACH,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzD,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IACpC,eAAe,GAAkB,IAAI,CAAC;IAE9C,cAAc,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,eAAe,KAAoB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IACD,iBAAiB,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,iBAAiB,CAAC,KAAoB,IAAU,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;IAC/E,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"session-token-storage.frontend.service.js","sourceRoot":"","sources":["../../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iEAAiE,CAAC;AAazE;;;GAGG;AACH,IAAI,8BAA8B,GAAG,KAAK,CAAC;AAE3C,MAAM,OAAO,6BAA6B;IACxC,cAAc;QACZ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD;;;;;;OAMG;IACH,eAAe;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,WAAW;YACT,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAC7D,8BAA8B,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,CACV,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,iBAAiB;QACf,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,iBAAiB,CAAC,KAAoB;QACpC,KAAK;YACH,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzD,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IACpC,eAAe,GAAkB,IAAI,CAAC;IAE9C,cAAc,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,eAAe,KAAoB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IACD,iBAAiB,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,iBAAiB,CAAC,KAAoB,IAAU,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;IAC/E,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;CACF","sourcesContent":["/**\n * W7.3b: Session Token Storage — Strategy pattern for token persistence.\n *\n * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).\n * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).\n *\n * Auth-hardening Slice A Step 3 (2026-04-13) — `PersistentSessionTokenStorage`\n * NO LONGER persists the refresh token in localStorage. The refresh token now\n * travels via the `__wildo_refresh` `HttpOnly` cookie (see\n * `auth-controller.utils.ts` and `authentication-controller.backend.service.ts`).\n * The cookie is invisible to JS, which closes the XSS exfiltration surface\n * that ANY localStorage-backed refresh token inherently has.\n *\n * The `storeTokens()` signature still accepts a `refreshToken` parameter for\n * source-compat with `EphemeralSessionTokenStorage` (which keeps the in-memory\n * field for one-off / test contexts), but `PersistentSessionTokenStorage`\n * silently ignores the argument and emits a one-line `console.warn` if a\n * non-null value is passed during the transition window. The existing\n * `removeLocalStorageItem(REFRESH_TOKEN)` is kept on every `storeTokens()`\n * AND `clear()` invocation so any leftover localStorage value from a\n * pre-migration session is wiped on the user's next interaction.\n */\n\nimport {\n  LOCAL_STORAGE_KEYS,\n  getLocalStorageItem,\n  setLocalStorageItem,\n  removeLocalStorageItem,\n} from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\nexport interface SessionTokenStorage {\n  getAccessToken(): string | null;\n  getRefreshToken(): string | null;\n  storeTokens(accessToken: string | null, refreshToken: string | null): void;\n\n  getOrganizationId(): string | null;\n  setOrganizationId(orgId: string | null): void;\n\n  clear(): void;\n}\n\n/**\n * Module-scoped flag — emit the deprecation warning ONCE per page load even if\n * `storeTokens()` is called many times during a session. Avoids log spam.\n */\nlet _refreshTokenArgWarningEmitted = false;\n\nexport class PersistentSessionTokenStorage implements SessionTokenStorage {\n  getAccessToken(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n  }\n  /**\n   * Always returns `null` — refresh tokens no longer live in localStorage\n   * (Auth-hardening Slice A Step 3). The `__wildo_refresh` `HttpOnly` cookie\n   * carries the refresh token; JS can never read it. Method kept for\n   * `SessionTokenStorage` interface conformance — `EphemeralSessionTokenStorage`\n   * still uses it for in-memory contexts.\n   */\n  getRefreshToken(): string | null {\n    return null;\n  }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    accessToken\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN, accessToken)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    if (refreshToken !== null && !_refreshTokenArgWarningEmitted) {\n      _refreshTokenArgWarningEmitted = true;\n      console.warn(\n        '[wildo-auth] PersistentSessionTokenStorage.storeTokens() received a non-null refreshToken — argument is ignored. Refresh tokens now travel via the `__wildo_refresh` HttpOnly cookie (Auth-hardening Slice A).',\n      );\n    }\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n  }\n  getOrganizationId(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  setOrganizationId(orgId: string | null): void {\n    orgId\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID, orgId)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  clear(): void {\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n}\n\nexport class EphemeralSessionTokenStorage implements SessionTokenStorage {\n  private _accessToken: string | null = null;\n  private _refreshToken: string | null = null;\n  private _organizationId: string | null = null;\n\n  getAccessToken(): string | null { return this._accessToken; }\n  getRefreshToken(): string | null { return this._refreshToken; }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    this._accessToken = accessToken;\n    this._refreshToken = refreshToken;\n  }\n  getOrganizationId(): string | null { return this._organizationId; }\n  setOrganizationId(orgId: string | null): void { this._organizationId = orgId; }\n  clear(): void {\n    this._accessToken = null;\n    this._refreshToken = null;\n    this._organizationId = null;\n  }\n}\n"]}

package/dist/esm/core/security/useAuthSession.d.ts

@@ -3,7 +3,7 @@
  *
  * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.
  */
-import { type AuthSessionContextType } from './AuthSessionContext.js';
+import { type AuthSessionContextType } from './AuthSessionContext';
 /**
  * Hook to access the Auth Session context
  * @returns AuthSessionContextType with auth state and authentication functions

package/dist/esm/core/security/useAuthSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,sBAMjC,CAAC"}
+{"version":3,"file":"useAuthSession.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,sBAMjC,CAAC"}

package/dist/esm/core/security/useAuthSession.js

@@ -17,4 +17,4 @@ export const useAuthSession = () => {
     }
     return context;
 };
-//# sourceMappingURL=useAuthSession.js.map
+//# sourceMappingURL=useAuthSession.js.map

package/dist/esm/core/security/useAuthSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA+B,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA2B,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}
+{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA+B,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA2B,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useAuthSession Hook\n * \n * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { AuthSessionContext, type AuthSessionContextType } from './AuthSessionContext';\n/**\n * Hook to access the Auth Session context\n * @returns AuthSessionContextType with auth state and authentication functions\n * @throws Error if used outside of AuthSessionProvider\n */\nexport const useAuthSession = (): AuthSessionContextType => {\n  const context = useContext(AuthSessionContext);\n  if (!context) {\n    throw new Error('useAuthSession must be used within an AuthSessionProvider');\n  }\n  return context;\n};\n"]}

package/dist/esm/core/security/useResolvedAuthConfig.d.ts

@@ -8,15 +8,17 @@
  * 3. userTypes[resolvedType].auth → per-user-type auth policy (UserTypeAuthPolicy)
  * 4. Falls back to hardcoded restrictive defaults when user type cannot be resolved
  *
- * SSO providers and passkeyConfig are infrastructure — always from global auth.
+ * Public social OAuth2 provider enumeration and passkeyConfig are global auth
+ * concerns — always resolved from the shared auth payload.
  * Auth methods, MFA, registration, password policy come from the resolved user type.
  */
 import type { AppConfiguration_Shared_Auth, UserTypeAuthPolicy, PasswordPolicyRules } from '@wildo-ai/saas-models';
+import { AuthMethod, RegistrationMode } from '@wildo-ai/saas-models';
 export interface ResolvedRegistrationConfig {
-    enabled: boolean;
-    invitationOnly: boolean;
-    requirePasswordOnRegister: boolean;
-    allowedMethods: string[];
+    mode: RegistrationMode;
+    allowedMethods: AuthMethod[];
+    frontendServiceAllowsRegistration: boolean;
+    publicRegistrationAvailable: boolean;
 }
 export interface ResolvedAuthConfig {
     resolvedUserType: string | null;
@@ -24,7 +26,6 @@ export interface ResolvedAuthConfig {
     globalAuth: AppConfiguration_Shared_Auth;
     passwordPolicy: PasswordPolicyRules;
     registrationConfig: ResolvedRegistrationConfig;
-    registrationEnabled: boolean;
 }
 export declare function useResolvedAuthConfig(): ResolvedAuthConfig;
 //# sourceMappingURL=useResolvedAuthConfig.d.ts.map

package/dist/esm/core/security/useResolvedAuthConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useResolvedAuthConfig.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EACV,4BAA4B,EAC5B,kBAAkB,EAElB,mBAAmB,EAEpB,MAAM,uBAAuB,CAAC;AAsD/B,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,yBAAyB,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,4BAA4B,CAAC;IACzC,cAAc,EAAE,mBAAmB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CA2C1D"}
+{"version":3,"file":"useResolvedAuthConfig.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EACV,4BAA4B,EAC5B,kBAAkB,EAElB,mBAAmB,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,UAAU,EAGV,gBAAgB,EAEjB,MAAM,uBAAuB,CAAC;AAqD/B,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,gBAAgB,CAAC;IACvB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,iCAAiC,EAAE,OAAO,CAAC;IAC3C,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,4BAA4B,CAAC;IACzC,cAAc,EAAE,mBAAmB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;CAChD;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CAuD1D"}

package/dist/esm/core/security/useResolvedAuthConfig.js

@@ -8,14 +8,15 @@
  * 3. userTypes[resolvedType].auth → per-user-type auth policy (UserTypeAuthPolicy)
  * 4. Falls back to hardcoded restrictive defaults when user type cannot be resolved
  *
- * SSO providers and passkeyConfig are infrastructure — always from global auth.
+ * Public social OAuth2 provider enumeration and passkeyConfig are global auth
+ * concerns — always resolved from the shared auth payload.
  * Auth methods, MFA, registration, password policy come from the resolved user type.
  */
 import { useContext, useMemo } from 'react';
 import { useApplication } from '../../core/runtime/useApplication.js';
 import { envLoader } from '../../core/runtime/env-variable-loader.frontend.service.js';
 import { UserOrgsContext } from './UserOrgsContext.js';
-import { AuthMethod, RegistrationMode } from '@wildo-ai/saas-models';
+import { RegistrationAcquisitionChannel, RegistrationConfigSchema, RegistrationMode, isRegistrationAcquisitionAllowed, } from '@wildo-ai/saas-models';
 /**
  * Resolves the default user type key from frontendServices config.
  * Mirrors backend AppConfigurationBackendService.resolveUserTypeFromFrontendServiceName():
@@ -68,18 +69,25 @@ export function useResolvedAuthConfig() {
         const userTypeAuth = userTypeDef?.auth ?? null;
         const passwordPolicy = userTypeAuth?.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;
         const utReg = userTypeAuth?.registration;
-        const registrationConfig = utReg
+        const parsedRegistration = RegistrationConfigSchema.safeParse(utReg);
+        const frontendServiceAllowsRegistration = Boolean(resolvedUserType
+            && appConfig.frontendServices?.[frontendServiceName]
+                ?.usersManagement?.[resolvedUserType]?.register === true);
+        const registrationConfig = parsedRegistration.success
             ? {
-                enabled: utReg.mode !== RegistrationMode.DISABLED && utReg.mode !== RegistrationMode.ADMIN_ONLY,
-                invitationOnly: utReg.mode === RegistrationMode.INVITATION_ONLY,
-                requirePasswordOnRegister: utReg.requirePasswordOnRegister !== false,
-                allowedMethods: utReg.allowedMethods ?? [AuthMethod.PASSWORD],
+                mode: parsedRegistration.data.mode,
+                allowedMethods: parsedRegistration.data.allowedMethods,
+                frontendServiceAllowsRegistration,
+                publicRegistrationAvailable: frontendServiceAllowsRegistration
+                    && isRegistrationAcquisitionAllowed(parsedRegistration.data.mode, RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE),
             }
             : {
-                enabled: true,
-                invitationOnly: false,
-                requirePasswordOnRegister: true,
-                allowedMethods: [AuthMethod.PASSWORD],
+                // No resolved or parseable leaf means the backend cannot authorize the same request.
+                // Mocked/stale/unparsed client boundaries fail closed without legacy interpretation.
+                mode: RegistrationMode.DISABLED,
+                allowedMethods: [],
+                frontendServiceAllowsRegistration: false,
+                publicRegistrationAvailable: false,
             };
         return {
             resolvedUserType,
@@ -87,8 +95,7 @@ export function useResolvedAuthConfig() {
             globalAuth,
             passwordPolicy,
             registrationConfig,
-            registrationEnabled: registrationConfig.enabled,
         };
     }, [frontendServiceName, appConfig, globalAuth, userOrgs?.user?.userTypes]);
 }
-//# sourceMappingURL=useResolvedAuthConfig.js.map
+//# sourceMappingURL=useResolvedAuthConfig.js.map

package/dist/esm/core/security/useResolvedAuthConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"useResolvedAuthConfig.js","sourceRoot":"","sources":["../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAQpD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAErE;;;;GAIG;AACH,SAAS,sCAAsC,CAC7C,mBAA2B,EAC3B,gBAAoD;IAEpD,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,qBAAqB,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,8CAA8C,CACrD,mBAA2B,EAC3B,sBAAqD,EACrD,gBAAoD;IAEpD,IAAI,CAAC,sBAAsB,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC;IACrF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,uBAAuB,GAAwB;IACnD,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,IAAI;IACtB,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,mBAAmB,EAAE,KAAK;IAC1B,UAAU,EAAE,CAAC;CACd,CAAC;AAkBF,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC,mBAAmB,CAAC;IAElF,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,uBAAuB,GAAG,sCAAsC,CAAC,mBAAmB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxH,MAAM,qBAAqB,GAAG,8CAA8C,CAC1E,mBAAmB,EACnB,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,IAAI,uBAAuB,CAAC;QAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,YAAY,GAA8B,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;QAE1E,MAAM,cAAc,GAAwB,YAAY,EAAE,cAAc,IAAI,uBAAuB,CAAC;QAEpG,MAAM,KAAK,GAAmC,YAAY,EAAE,YAAY,CAAC;QAEzE,MAAM,kBAAkB,GAA+B,KAAK;YAC1D,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,UAAU;gBAC/F,cAAc,EAAE,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,eAAe;gBAC/D,yBAAyB,EAAE,KAAK,CAAC,yBAAyB,KAAK,KAAK;gBACpE,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC9D;YACH,CAAC,CAAC;gBACE,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,KAAK;gBACrB,yBAAyB,EAAE,IAAI;gBAC/B,cAAc,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;aACtC,CAAC;QAEN,OAAO;YACL,gBAAgB;YAChB,YAAY;YACZ,UAAU;YACV,cAAc;YACd,kBAAkB;YAClB,mBAAmB,EAAE,kBAAkB,CAAC,OAAO;SAChD,CAAC;IACJ,CAAC,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"useResolvedAuthConfig.js","sourceRoot":"","sources":["../../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAQpD,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,EACxB,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,SAAS,sCAAsC,CAC7C,mBAA2B,EAC3B,gBAAoD;IAEpD,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,qBAAqB,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,8CAA8C,CACrD,mBAA2B,EAC3B,sBAAqD,EACrD,gBAAoD;IAEpD,IAAI,CAAC,sBAAsB,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC;IACrF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,uBAAuB,GAAwB;IACnD,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,IAAI;IACtB,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,mBAAmB,EAAE,KAAK;IAC1B,UAAU,EAAE,CAAC;CACd,CAAC;AAiBF,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC,mBAAmB,CAAC;IAElF,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,uBAAuB,GAAG,sCAAsC,CAAC,mBAAmB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxH,MAAM,qBAAqB,GAAG,8CAA8C,CAC1E,mBAAmB,EACnB,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,IAAI,uBAAuB,CAAC;QAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,YAAY,GAA8B,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;QAE1E,MAAM,cAAc,GAAwB,YAAY,EAAE,cAAc,IAAI,uBAAuB,CAAC;QAEpG,MAAM,KAAK,GAAmC,YAAY,EAAE,YAAY,CAAC;QACzE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,iCAAiC,GAAG,OAAO,CAC/C,gBAAgB;eACb,SAAS,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC;gBAClD,EAAE,eAAe,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,KAAK,IAAI,CAC3D,CAAC;QAEF,MAAM,kBAAkB,GAA+B,kBAAkB,CAAC,OAAO;YAC/E,CAAC,CAAC;gBACE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI;gBAClC,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,cAAc;gBACtD,iCAAiC;gBACjC,2BAA2B,EACzB,iCAAiC;uBAC9B,gCAAgC,CACjC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAC5B,8BAA8B,CAAC,mBAAmB,CACnD;aACJ;YACH,CAAC,CAAC;gBACE,qFAAqF;gBACrF,qFAAqF;gBACrF,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,cAAc,EAAE,EAAE;gBAClB,iCAAiC,EAAE,KAAK;gBACxC,2BAA2B,EAAE,KAAK;aACnC,CAAC;QAEN,OAAO;YACL,gBAAgB;YAChB,YAAY;YACZ,UAAU;YACV,cAAc;YACd,kBAAkB;SACnB,CAAC;IACJ,CAAC,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * W6.5: Resolves the effective auth config for the current frontend service.\n *\n * Resolution chain:\n * 1. If the user is authenticated, prefer their actual user type that is allowed on the\n *    current frontend service\n * 2. Otherwise use envLoader.frontendServiceName → frontendServices[frontendServiceName].usersManagement → default user type key\n * 3. userTypes[resolvedType].auth → per-user-type auth policy (UserTypeAuthPolicy)\n * 4. Falls back to hardcoded restrictive defaults when user type cannot be resolved\n *\n * Public social OAuth2 provider enumeration and passkeyConfig are global auth\n * concerns — always resolved from the shared auth payload.\n * Auth methods, MFA, registration, password policy come from the resolved user type.\n */\n\nimport { useContext, useMemo } from 'react';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\nimport { UserOrgsContext } from './UserOrgsContext';\nimport type {\n  AppConfiguration_Shared_Auth,\n  UserTypeAuthPolicy,\n  FrontendServicesConfig,\n  PasswordPolicyRules,\n  RegistrationConfig,\n} from '@wildo-ai/saas-models';\nimport {\n  AuthMethod,\n  RegistrationAcquisitionChannel,\n  RegistrationConfigSchema,\n  RegistrationMode,\n  isRegistrationAcquisitionAllowed,\n} from '@wildo-ai/saas-models';\n\n/**\n * Resolves the default user type key from frontendServices config.\n * Mirrors backend AppConfigurationBackendService.resolveUserTypeFromFrontendServiceName():\n * isDefault entry first, then first entry.\n */\nfunction resolveUserTypeFromFrontendServiceName(\n  frontendServiceName: string,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!frontendServices) return null;\n  const frontendServiceConfig = frontendServices[frontendServiceName];\n  if (!frontendServiceConfig?.usersManagement) return null;\n  const entries = Object.entries(frontendServiceConfig.usersManagement);\n  const defaultEntry = entries.find(([, v]) => v.isDefault);\n  const firstEntry = entries[0];\n  return (defaultEntry ?? firstEntry)?.[0] ?? null;\n}\n\nfunction resolveAuthenticatedUserTypeForFrontendService(\n  frontendServiceName: string,\n  authenticatedUserTypes: readonly string[] | undefined,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!authenticatedUserTypes?.length || !frontendServices) {\n    return null;\n  }\n\n  const allowedUserManagement = frontendServices[frontendServiceName]?.usersManagement;\n  if (!allowedUserManagement) {\n    return null;\n  }\n\n  for (const userType of authenticatedUserTypes) {\n    if (allowedUserManagement[userType]) {\n      return userType;\n    }\n  }\n\n  return null;\n}\n\nconst DEFAULT_PASSWORD_POLICY: PasswordPolicyRules = {\n  minLength: 8,\n  maxLength: 128,\n  requireUppercase: true,\n  requireLowercase: true,\n  requireNumbers: true,\n  requireSpecialChars: false,\n  expiryDays: 0,\n};\n\nexport interface ResolvedRegistrationConfig {\n  mode: RegistrationMode;\n  allowedMethods: AuthMethod[];\n  frontendServiceAllowsRegistration: boolean;\n  publicRegistrationAvailable: boolean;\n}\n\nexport interface ResolvedAuthConfig {\n  resolvedUserType: string | null;\n  userTypeAuth: UserTypeAuthPolicy | null;\n  globalAuth: AppConfiguration_Shared_Auth;\n  passwordPolicy: PasswordPolicyRules;\n  registrationConfig: ResolvedRegistrationConfig;\n}\n\nexport function useResolvedAuthConfig(): ResolvedAuthConfig {\n  const { auth: globalAuth, appConfig } = useApplication();\n  const userOrgs = useContext(UserOrgsContext);\n  const frontendServiceName = envLoader.loadEnvironmentConfig().frontendServiceName;\n\n  return useMemo(() => {\n    const defaultFrontendUserType = resolveUserTypeFromFrontendServiceName(frontendServiceName, appConfig.frontendServices);\n    const authenticatedUserType = resolveAuthenticatedUserTypeForFrontendService(\n      frontendServiceName,\n      userOrgs?.user?.userTypes,\n      appConfig.frontendServices,\n    );\n    const resolvedUserType = authenticatedUserType ?? defaultFrontendUserType;\n    const userTypeDef = resolvedUserType ? appConfig.userTypes?.[resolvedUserType] : null;\n    const userTypeAuth: UserTypeAuthPolicy | null = userTypeDef?.auth ?? null;\n\n    const passwordPolicy: PasswordPolicyRules = userTypeAuth?.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n\n    const utReg: RegistrationConfig | undefined = userTypeAuth?.registration;\n    const parsedRegistration = RegistrationConfigSchema.safeParse(utReg);\n    const frontendServiceAllowsRegistration = Boolean(\n      resolvedUserType\n      && appConfig.frontendServices?.[frontendServiceName]\n        ?.usersManagement?.[resolvedUserType]?.register === true,\n    );\n\n    const registrationConfig: ResolvedRegistrationConfig = parsedRegistration.success\n      ? {\n          mode: parsedRegistration.data.mode,\n          allowedMethods: parsedRegistration.data.allowedMethods,\n          frontendServiceAllowsRegistration,\n          publicRegistrationAvailable:\n            frontendServiceAllowsRegistration\n            && isRegistrationAcquisitionAllowed(\n              parsedRegistration.data.mode,\n              RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n            ),\n        }\n      : {\n          // No resolved or parseable leaf means the backend cannot authorize the same request.\n          // Mocked/stale/unparsed client boundaries fail closed without legacy interpretation.\n          mode: RegistrationMode.DISABLED,\n          allowedMethods: [],\n          frontendServiceAllowsRegistration: false,\n          publicRegistrationAvailable: false,\n        };\n\n    return {\n      resolvedUserType,\n      userTypeAuth,\n      globalAuth,\n      passwordPolicy,\n      registrationConfig,\n    };\n  }, [frontendServiceName, appConfig, globalAuth, userOrgs?.user?.userTypes]);\n}\n"]}

package/dist/esm/core/security/useStepUpAuth.d.ts

@@ -3,6 +3,6 @@
  *
  * Separated from StepUpAuthContext.tsx for React Fast Refresh compatibility.
  */
-import { type StepUpAuthContextType } from './StepUpAuthContext.js';
+import { type StepUpAuthContextType } from './StepUpAuthContext';
 export declare const useStepUpAuth: () => StepUpAuthContextType;
 //# sourceMappingURL=useStepUpAuth.d.ts.map

package/dist/esm/core/security/useStepUpAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useStepUpAuth.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,eAAO,MAAM,aAAa,QAAO,qBAMhC,CAAC"}
+{"version":3,"file":"useStepUpAuth.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,eAAO,MAAM,aAAa,QAAO,qBAMhC,CAAC"}

package/dist/esm/core/security/useStepUpAuth.js

@@ -12,4 +12,4 @@ export const useStepUpAuth = () => {
     }
     return context;
 };
-//# sourceMappingURL=useStepUpAuth.js.map
+//# sourceMappingURL=useStepUpAuth.js.map

package/dist/esm/core/security/useStepUpAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"useStepUpAuth.js","sourceRoot":"","sources":["../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAA8B,MAAM,qBAAqB,CAAC;AAEpF,MAAM,CAAC,MAAM,aAAa,GAAG,GAA0B,EAAE;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}
+{"version":3,"file":"useStepUpAuth.js","sourceRoot":"","sources":["../../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAA8B,MAAM,qBAAqB,CAAC;AAEpF,MAAM,CAAC,MAAM,aAAa,GAAG,GAA0B,EAAE;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useStepUpAuth Hook\n * \n * Separated from StepUpAuthContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { StepUpAuthContext, type StepUpAuthContextType } from './StepUpAuthContext';\n\nexport const useStepUpAuth = (): StepUpAuthContextType => {\n  const context = useContext(StepUpAuthContext);\n  if (!context) {\n    throw new Error('useStepUpAuth must be used within a StepUpAuthProvider');\n  }\n  return context;\n};\n"]}

package/dist/esm/core/security/useUserOrgs.d.ts

@@ -3,7 +3,7 @@
  *
  * Separated from UserOrgsContext.tsx for React Fast Refresh compatibility.
  */
-import { type UserOrgsContextType } from './UserOrgsContext.js';
+import { type UserOrgsContextType } from './UserOrgsContext';
 /**
  * Hook to access the User Organizations context
  * @returns UserOrgsContextType with auth state and authentication functions

package/dist/esm/core/security/useUserOrgs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useUserOrgs.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,mBAM9B,CAAC"}
+{"version":3,"file":"useUserOrgs.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,mBAM9B,CAAC"}

package/dist/esm/core/security/useUserOrgs.js

@@ -17,4 +17,4 @@ export const useUserOrgs = () => {
     }
     return context;
 };
-//# sourceMappingURL=useUserOrgs.js.map
+//# sourceMappingURL=useUserOrgs.js.map

package/dist/esm/core/security/useUserOrgs.js.map

@@ -1 +1 @@
-{"version":3,"file":"useUserOrgs.js","sourceRoot":"","sources":["../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,eAAe,EAA4B,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAwB,EAAE;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}
+{"version":3,"file":"useUserOrgs.js","sourceRoot":"","sources":["../../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,eAAe,EAA4B,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAwB,EAAE;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useUserOrgs Hook\n * \n * Separated from UserOrgsContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { UserOrgsContext, type UserOrgsContextType } from './UserOrgsContext';\n\n/**\n * Hook to access the User Organizations context\n * @returns UserOrgsContextType with auth state and authentication functions\n * @throws Error if used outside of UserOrgsProvider\n */\nexport const useUserOrgs = (): UserOrgsContextType => {\n  const context = useContext(UserOrgsContext);\n  if (!context) {\n    throw new Error('useUserOrgs must be used within a UserOrgsProvider');\n  }\n  return context;\n};\n\n\n\n"]}

package/dist/esm/core/ui/SurfaceErrorBoundary.d.ts

@@ -0,0 +1,25 @@
+import React from 'react';
+export interface SurfaceErrorBoundaryProps {
+    children: React.ReactNode;
+}
+interface SurfaceErrorBoundaryState {
+    error: Error | null;
+    errorInfo: React.ErrorInfo | null;
+}
+/**
+ * Surface-scoped crash isolation for `policy.interactiveState.errorBoundary`.
+ *
+ * This boundary intentionally avoids router/navigation recovery assumptions:
+ * a surface can be rendered inside dialogs, menus, sidebars, or tests where
+ * route-level recovery is not available. Route/app boundaries remain
+ * responsible for full-page recovery.
+ */
+export declare class SurfaceErrorBoundary extends React.Component<SurfaceErrorBoundaryProps, SurfaceErrorBoundaryState> {
+    state: SurfaceErrorBoundaryState;
+    static getDerivedStateFromError(error: Error): Partial<SurfaceErrorBoundaryState>;
+    componentDidCatch(error: Error, errorInfo: React.ErrorInfo): void;
+    private resetError;
+    render(): React.ReactNode;
+}
+export {};
+//# sourceMappingURL=SurfaceErrorBoundary.d.ts.map

package/dist/esm/core/ui/SurfaceErrorBoundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SurfaceErrorBoundary.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAM1B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,UAAU,yBAAyB;IACjC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAqB,SAAQ,KAAK,CAAC,SAAS,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IAC7G,KAAK,EAAE,yBAAyB,CAG9B;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjF,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI;IAKjE,OAAO,CAAC,UAAU,CAEhB;IAEF,MAAM,IAAI,KAAK,CAAC,SAAS;CA6B1B"}

package/dist/esm/core/ui/SurfaceErrorBoundary.js

@@ -0,0 +1,48 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import React from 'react';
+import { ErrorDisplay } from '../../components/feedback/error-display.js';
+import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.service.js';
+const logger = LoggerFrontendService.getLogger();
+/**
+ * Surface-scoped crash isolation for `policy.interactiveState.errorBoundary`.
+ *
+ * This boundary intentionally avoids router/navigation recovery assumptions:
+ * a surface can be rendered inside dialogs, menus, sidebars, or tests where
+ * route-level recovery is not available. Route/app boundaries remain
+ * responsible for full-page recovery.
+ */
+export class SurfaceErrorBoundary extends React.Component {
+    state = {
+        error: null,
+        errorInfo: null,
+    };
+    static getDerivedStateFromError(error) {
+        return { error };
+    }
+    componentDidCatch(error, errorInfo) {
+        logger.error('[SurfaceErrorBoundary] Surface child crashed', { error, errorInfo });
+        this.setState({ error, errorInfo });
+    }
+    resetError = () => {
+        this.setState({ error: null, errorInfo: null });
+    };
+    render() {
+        if (!this.state.error) {
+            return this.props.children;
+        }
+        return (_jsx(ErrorDisplay, { variant: "error", title: "Surface unavailable", message: this.state.error.message || 'A surface failed to render.', actions: [
+                {
+                    label: 'Try again',
+                    onClick: this.resetError,
+                    variant: 'primary',
+                },
+            ], showDevInfo: true, devInfoTitle: "Surface error", devInfoSections: this.state.errorInfo ? [
+                {
+                    label: 'Component stack',
+                    content: this.state.errorInfo.componentStack ?? '',
+                    variant: 'error',
+                },
+            ] : undefined }));
+    }
+}
+//# sourceMappingURL=SurfaceErrorBoundary.js.map

package/dist/esm/core/ui/SurfaceErrorBoundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SurfaceErrorBoundary.js","sourceRoot":"","sources":["../../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":";AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,uDAAuD,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AAEpG,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC;AAWjD;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK,CAAC,SAA+D;IAC7G,KAAK,GAA8B;QACjC,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAY;QAC1C,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,iBAAiB,CAAC,KAAY,EAAE,SAA0B;QACxD,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,UAAU,GAAG,GAAS,EAAE;QAC9B,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM;QACJ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7B,CAAC;QAED,OAAO,CACL,KAAC,YAAY,IACX,OAAO,EAAC,OAAO,EACf,KAAK,EAAC,qBAAqB,EAC3B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,6BAA6B,EAClE,OAAO,EAAE;gBACP;oBACE,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,IAAI,CAAC,UAAU;oBACxB,OAAO,EAAE,SAAS;iBACnB;aACF,EACD,WAAW,QACX,YAAY,EAAC,eAAe,EAC5B,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBACtC;oBACE,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE;oBAClD,OAAO,EAAE,OAAO;iBACjB;aACF,CAAC,CAAC,CAAC,SAAS,GACb,CACH,CAAC;IACJ,CAAC;CACF","sourcesContent":["import React from 'react';\nimport { ErrorDisplay } from '~wildo-frontend-lib/components/feedback/error-display';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\n\nconst logger = LoggerFrontendService.getLogger();\n\nexport interface SurfaceErrorBoundaryProps {\n  children: React.ReactNode;\n}\n\ninterface SurfaceErrorBoundaryState {\n  error: Error | null;\n  errorInfo: React.ErrorInfo | null;\n}\n\n/**\n * Surface-scoped crash isolation for `policy.interactiveState.errorBoundary`.\n *\n * This boundary intentionally avoids router/navigation recovery assumptions:\n * a surface can be rendered inside dialogs, menus, sidebars, or tests where\n * route-level recovery is not available. Route/app boundaries remain\n * responsible for full-page recovery.\n */\nexport class SurfaceErrorBoundary extends React.Component<SurfaceErrorBoundaryProps, SurfaceErrorBoundaryState> {\n  state: SurfaceErrorBoundaryState = {\n    error: null,\n    errorInfo: null,\n  };\n\n  static getDerivedStateFromError(error: Error): Partial<SurfaceErrorBoundaryState> {\n    return { error };\n  }\n\n  componentDidCatch(error: Error, errorInfo: React.ErrorInfo): void {\n    logger.error('[SurfaceErrorBoundary] Surface child crashed', { error, errorInfo });\n    this.setState({ error, errorInfo });\n  }\n\n  private resetError = (): void => {\n    this.setState({ error: null, errorInfo: null });\n  };\n\n  render(): React.ReactNode {\n    if (!this.state.error) {\n      return this.props.children;\n    }\n\n    return (\n      <ErrorDisplay\n        variant=\"error\"\n        title=\"Surface unavailable\"\n        message={this.state.error.message || 'A surface failed to render.'}\n        actions={[\n          {\n            label: 'Try again',\n            onClick: this.resetError,\n            variant: 'primary',\n          },\n        ]}\n        showDevInfo\n        devInfoTitle=\"Surface error\"\n        devInfoSections={this.state.errorInfo ? [\n          {\n            label: 'Component stack',\n            content: this.state.errorInfo.componentStack ?? '',\n            variant: 'error',\n          },\n        ] : undefined}\n      />\n    );\n  }\n}\n"]}

package/dist/esm/core/ui/SurfacePolicyContext.d.ts

@@ -0,0 +1,62 @@
+import { SurfaceVariant, type DeepPartialSurfacePolicy, type SurfacePolicy } from '@wildo-ai/presets-components-models';
+export interface SurfacePolicyContextValue {
+    variant: SurfaceVariant;
+    policy: SurfacePolicy;
+    /**
+     * True when the current context chain already contains a rendered frame.
+     *
+     * The value is intentionally precomputed by each `<Surface>` provider so a
+     * nested surface can decide `framingMode: 'when-orphan'` in O(1), without
+     * walking the whole React ancestor chain on every render.
+     */
+    isInFramedAncestor: boolean;
+    /** True when this exact surface resolves to rendering its own visual frame. */
+    rendersOwnFrame: boolean;
+    nearestFramedAncestorVariant: SurfaceVariant | null;
+    headerId: string | undefined;
+    registerHeaderId: ((id: string) => void) | undefined;
+    unregisterHeaderId: ((id: string) => void) | undefined;
+}
+export interface SurfacePolicyLogger {
+    warn: (message: string, context?: Record<string, unknown>) => void;
+    error: (message: string, context?: Record<string, unknown>) => void;
+}
+export interface MergeSurfacePolicyOptions {
+    variant: SurfaceVariant;
+    parentPolicy?: SurfacePolicy;
+    logger?: SurfacePolicyLogger;
+}
+export declare const SurfacePolicyContext: import("react").Context<SurfacePolicyContextValue>;
+/**
+ * Merge the four Surface Policy layers into a concrete `SurfacePolicy`.
+ *
+ * Order is fixed by KD-4: framework fallback → theme recipe policy → app
+ * configuration override → call-site override. The function is memoized by
+ * shallow identity of those inputs so repeated renders with stable config
+ * objects reuse the same policy reference.
+ */
+export declare function mergeSurfacePolicy(frameworkDefault: SurfacePolicy, themeDefault: DeepPartialSurfacePolicy | undefined, appConfigOverride: DeepPartialSurfacePolicy | undefined, callSiteOverride: DeepPartialSurfacePolicy | undefined, options: MergeSurfacePolicyOptions): SurfacePolicy;
+export declare function computeSurfacePolicyContextValue(variant: SurfaceVariant, policy: SurfacePolicy, parentContext: SurfacePolicyContextValue | null, headerRegistration?: Pick<SurfacePolicyContextValue, 'headerId' | 'registerHeaderId' | 'unregisterHeaderId'>): SurfacePolicyContextValue;
+export declare function useSurfacePolicy(hint?: SurfaceVariant): SurfacePolicy;
+export declare function useSurfaceVariant(): SurfaceVariant | null;
+/**
+ * `true` when the current React subtree is already inside a surface that paints
+ * its own visual frame (border + shadow). Section/card chrome reads this to
+ * activate the `when-orphan` framing semantic: a framed section nested inside an
+ * already-framed ancestor (card-in-card, card-in-dialog, card-in-composite)
+ * suppresses its OWN frame to avoid "border soup", because the outer frame
+ * already delineates the region.
+ *
+ * Returns `false` at the top of the tree (no surface ancestor). The value is
+ * precomputed by each `<Surface>` provider (see
+ * {@link computeSurfacePolicyContextValue}), so this read is O(1) and never
+ * walks the ancestor chain.
+ *
+ * IMPORTANT: this signal is only reliable when every surface's
+ * `nesting.framingMode` truthfully reflects whether it paints a frame. A surface
+ * that renders FLAT but declares `framingMode: 'always'` would falsely report
+ * `true` to its descendants — so flat chrome must declare `framingMode: 'never'`
+ * and `when-orphan` chrome must paint its frame iff this hook returns `false`.
+ */
+export declare function useIsInFramedAncestor(): boolean;
+//# sourceMappingURL=SurfacePolicyContext.d.ts.map

package/dist/esm/core/ui/SurfacePolicyContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SurfacePolicyContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/SurfacePolicyContext.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EACnB,MAAM,qCAAqC,CAAC;AAK7C,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,eAAe,EAAE,OAAO,CAAC;IACzB,4BAA4B,EAAE,cAAc,GAAG,IAAI,CAAC;IACpD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACrD,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACnE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED,eAAO,MAAM,oBAAoB,oDAAwD,CAAC;AAmO1F;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,aAAa,EAC/B,YAAY,EAAE,wBAAwB,GAAG,SAAS,EAClD,iBAAiB,EAAE,wBAAwB,GAAG,SAAS,EACvD,gBAAgB,EAAE,wBAAwB,GAAG,SAAS,EACtD,OAAO,EAAE,yBAAyB,GACjC,aAAa,CAwBf;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,aAAa,EAAE,yBAAyB,GAAG,IAAI,EAC/C,kBAAkB,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,UAAU,GAAG,kBAAkB,GAAG,oBAAoB,CAAC,GAC3G,yBAAyB,CAiB3B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,cAAoC,GAAG,aAAa,CAE1F;AAED,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C"}