@wildo-ai/saas-frontend-lib 1.0.1

package/dist/esm/core/security/auth-session.utils.js

@@ -0,0 +1,106 @@
+import { ErrorType, HttpStatusCode, } from '@wildo-ai/saas-models';
+import { ErrorCustomMessageReference } from '@wildo-ai/saas-models';
+const AUTHENTICATION_ERROR_REFERENCES = [
+    ErrorCustomMessageReference.AUTHENTICATION,
+    ErrorCustomMessageReference.JWT_TOKEN_EXPIRED,
+    ErrorCustomMessageReference.JWT_TOKEN_INVALID,
+    ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND,
+    ErrorCustomMessageReference.JWT_TOKEN_NOT_VERIFIED,
+    ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+    ErrorCustomMessageReference.AUTHENTICATION_JWT_TOKEN_FAILED,
+    ErrorCustomMessageReference.AUTHENTICATION_SESSION_INVALID,
+    ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED,
+    ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_AUTHORIZED,
+    ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID,
+    ErrorCustomMessageReference.AUTHENTICATION_API_KEY_FAILED,
+    ErrorCustomMessageReference.AUTHENTICATION_NO_AUTHENTICATION_PROVIDED,
+];
+/**
+ * Static utility class for authentication/session non-component logic.
+ */
+export class AuthSessionUtils {
+    constructor() { }
+    /**
+     * Check if an error is an authentication or authorization error using Wildo error types.
+     */
+    static isAuthenticationError(error) {
+        const wildoError = error?.wildoError;
+        if (wildoError) {
+            if (wildoError.type === ErrorType.AUTHENTICATION) {
+                return true;
+            }
+            if (wildoError.customMessageReference) {
+                if (AUTHENTICATION_ERROR_REFERENCES.includes(wildoError.customMessageReference)) {
+                    return true;
+                }
+            }
+        }
+        if (error?.response?.status) {
+            const status = error.response.status;
+            if (status === HttpStatusCode.UNAUTHORIZED) {
+                return true;
+            }
+        }
+        if (error?.response?.data?.error) {
+            const errorData = error.response.data.error;
+            if (errorData.type === ErrorType.AUTHENTICATION) {
+                return true;
+            }
+            if (errorData.code) {
+                if (AUTHENTICATION_ERROR_REFERENCES.includes(errorData.code)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    /**
+     * Check whether an error represents an authorization/scope problem rather than an
+     * invalid or expired authentication session.
+     */
+    static isAuthorizationError(error) {
+        const wildoError = error?.wildoError;
+        if (wildoError?.type === ErrorType.AUTHORIZATION) {
+            return true;
+        }
+        if (error?.response?.status === HttpStatusCode.FORBIDDEN) {
+            return true;
+        }
+        if (error?.response?.data?.error?.type === ErrorType.AUTHORIZATION) {
+            return true;
+        }
+        return false;
+    }
+    /**
+     * D7: Frontend-only computation. Evaluates whether the user has enrolled sufficient
+     * second-factor methods to satisfy the MFA policy.
+     *
+     * @param requiresMFA - Backend-computed flag incorporating app-level + org-level policy
+     * @param availableMFAMethods - Policy-filtered methods from the auth response
+     * @param enrolledSecondFactorMethods - Methods the user has already enrolled
+     * @param acceptableMFAMethods - App-config `mfaPolicy.acceptableMFAMethods` (may be empty)
+     */
+    static evaluateAccountCompleteness(requiresMFA, availableMFAMethods, enrolledSecondFactorMethods, acceptableMFAMethods) {
+        if (!requiresMFA) {
+            return {
+                isComplete: true,
+                missingMethods: [],
+                enrolledMethods: enrolledSecondFactorMethods,
+                requiresEnrollment: false,
+            };
+        }
+        const acceptableSet = acceptableMFAMethods.length > 0
+            ? acceptableMFAMethods
+            : availableMFAMethods;
+        const enrolledSet = new Set(enrolledSecondFactorMethods);
+        const hasAcceptableEnrollment = acceptableSet.some(m => enrolledSet.has(m));
+        const missingMethods = acceptableSet.filter(m => !enrolledSet.has(m));
+        return {
+            isComplete: hasAcceptableEnrollment,
+            missingMethods,
+            enrolledMethods: enrolledSecondFactorMethods,
+            requiresEnrollment: !hasAcceptableEnrollment,
+        };
+    }
+}
+//# sourceMappingURL=auth-session.utils.js.map

package/dist/esm/core/security/auth-session.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-session.utils.js","sourceRoot":"","sources":["../../../../src/core/security/auth-session.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAuB,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAUzF,MAAM,+BAA+B,GAA2C;IAC9E,2BAA2B,CAAC,cAAc;IAC1C,2BAA2B,CAAC,iBAAiB;IAC7C,2BAA2B,CAAC,iBAAiB;IAC7C,2BAA2B,CAAC,mBAAmB;IAC/C,2BAA2B,CAAC,sBAAsB;IAClD,2BAA2B,CAAC,4BAA4B;IACxD,2BAA2B,CAAC,+BAA+B;IAC3D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,kCAAkC;IAC9D,2BAA2B,CAAC,8BAA8B;IAC1D,2BAA2B,CAAC,6BAA6B;IACzD,2BAA2B,CAAC,yCAAyC;CAC7D,CAAC;AAEX;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAC3B,gBAAuB,CAAC;IAExB;;OAEG;IACH,MAAM,CAAC,qBAAqB,CAAC,KAAU;QACrC,MAAM,UAAU,GAAG,KAAK,EAAE,UAA6C,CAAC;QACxE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,UAAU,CAAC,sBAAsB,EAAE,CAAC;gBACtC,IAAI,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,sBAAqD,CAAC,EAAE,CAAC;oBAC/G,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrC,IAAI,MAAM,KAAK,cAAc,CAAC,YAAY,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAC5C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;gBACnB,IAAI,+BAA+B,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAmC,CAAC,EAAE,CAAC;oBAC5F,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAU;QACpC,MAAM,UAAU,GAAG,KAAK,EAAE,UAA6C,CAAC;QACxE,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,cAAc,CAAC,SAAS,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,2BAA2B,CAChC,WAAoB,EACpB,mBAAiC,EACjC,2BAAyC,EACzC,oBAAkC;QAElC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,cAAc,EAAE,EAAE;gBAClB,eAAe,EAAE,2BAA2B;gBAC5C,kBAAkB,EAAE,KAAK;aAC1B,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAiB,oBAAoB,CAAC,MAAM,GAAG,CAAC;YACjE,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,mBAAmB,CAAC;QAExB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzD,MAAM,uBAAuB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5E,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtE,OAAO;YACL,UAAU,EAAE,uBAAuB;YACnC,cAAc;YACd,eAAe,EAAE,2BAA2B;YAC5C,kBAAkB,EAAE,CAAC,uBAAuB;SAC7C,CAAC;IACJ,CAAC;CACF"}

package/dist/esm/core/security/jwt.frontend.utils.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Frontend JWT utilities.
+ *
+ * JWT payload segments use base64url, not plain base64. Consumers that decode
+ * payload claims must normalize `-` / `_` and padding before parsing.
+ */
+/**
+ * Decode and parse the payload segment of a JWT access token.
+ *
+ * Throws when the token is malformed or when the payload is not valid JSON so
+ * callers can apply context-specific logging/error handling policy.
+ */
+export declare function decodeJwtPayload<T extends Record<string, unknown>>(accessToken: string): T;
+//# sourceMappingURL=jwt.frontend.utils.d.ts.map

package/dist/esm/core/security/jwt.frontend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,CAAC,CAO1F"}

package/dist/esm/core/security/jwt.frontend.utils.js

@@ -0,0 +1,28 @@
+/**
+ * Frontend JWT utilities.
+ *
+ * JWT payload segments use base64url, not plain base64. Consumers that decode
+ * payload claims must normalize `-` / `_` and padding before parsing.
+ */
+function decodeBase64UrlToUtf8(segment) {
+    const normalized = segment.replace(/-/g, '+').replace(/_/g, '/');
+    const paddingLength = (4 - (normalized.length % 4)) % 4;
+    const padded = `${normalized}${'='.repeat(paddingLength)}`;
+    const binary = atob(padded);
+    const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+}
+/**
+ * Decode and parse the payload segment of a JWT access token.
+ *
+ * Throws when the token is malformed or when the payload is not valid JSON so
+ * callers can apply context-specific logging/error handling policy.
+ */
+export function decodeJwtPayload(accessToken) {
+    const tokenParts = accessToken.split('.');
+    if (tokenParts.length !== 3) {
+        throw new Error('JWT must contain exactly three segments');
+    }
+    return JSON.parse(decodeBase64UrlToUtf8(tokenParts[1]));
+}
+//# sourceMappingURL=jwt.frontend.utils.js.map

package/dist/esm/core/security/jwt.frontend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.frontend.utils.js","sourceRoot":"","sources":["../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAoC,WAAmB;IACrF,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;AAC/D,CAAC"}

package/dist/esm/core/security/security.frontend.schemas.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Security Frontend Schemas
+ *
+ * Core authentication and authorization types for the frontend security layer.
+ */
+import { AuthIdentificationResponse, SessionType, type AuthMethod, type AvailableMethod, type AuthSessionPurpose } from '@wildo-ai/saas-models';
+/**
+ * Authentication state - contains only authentication-related fields
+ */
+export interface AuthState {
+    isLoading: boolean;
+    error: string | null;
+    sessionId: string | null;
+    accessToken: string | null;
+    refreshToken: string | null;
+    identification: AuthIdentificationResponse | null;
+    sessionState: any | null;
+    isRestoringSession: boolean;
+    sessionRestored: boolean;
+    mfaRequired: boolean;
+    mfaSessionId: string | null;
+    availableMfaMethods: AvailableMethod[];
+    availableEnrollmentMethods: AuthMethod[];
+    enrolledSecondFactorMethods: string[];
+    usableSecondFactorMethods: string[];
+    purpose: AuthSessionPurpose | null;
+    /** W7.3b: Session type — null before authentication is resolved. */
+    sessionType: SessionType | null;
+    /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */
+    oneOffContext?: {
+        originTokenId: string;
+        tokenType: string;
+        consumableTokenValue?: string;
+        tokenExpiresAt?: string;
+        scopedInitiatorIds?: Record<string, string>;
+        applicationId?: string;
+    };
+}
+/**
+ * Effective permissions for the current user
+ * Contains app-level permissions and per-organization permissions
+ */
+export type EffectivePermissions = {
+    appLevel: string[];
+    organizations: Record<string, string[]>;
+};
+/**
+ * Empty/initial authentication state
+ */
+export declare const EMPTY_AUTH_STATE: AuthState;
+export type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';
+export type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';
+export type UIFactorLevel = 'first' | 'second';
+//# sourceMappingURL=security.frontend.schemas.d.ts.map

package/dist/esm/core/security/security.frontend.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.frontend.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAClD,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,eAAe,EAAE,CAAC;IACvC,0BAA0B,EAAE,UAAU,EAAE,CAAC;IACzC,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,oEAAoE;IACpE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,wGAAwG;IACxG,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAmB9B,CAAC;AAIF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC"}

package/dist/esm/core/security/security.frontend.schemas.js

@@ -0,0 +1,29 @@
+/**
+ * Security Frontend Schemas
+ *
+ * Core authentication and authorization types for the frontend security layer.
+ */
+/**
+ * Empty/initial authentication state
+ */
+export const EMPTY_AUTH_STATE = {
+    isLoading: false,
+    error: null,
+    sessionId: null,
+    accessToken: null,
+    refreshToken: null,
+    identification: null,
+    sessionState: null,
+    isRestoringSession: false,
+    sessionRestored: false,
+    mfaRequired: false,
+    mfaSessionId: null,
+    availableMfaMethods: [],
+    availableEnrollmentMethods: [],
+    enrolledSecondFactorMethods: [],
+    usableSecondFactorMethods: [],
+    purpose: null,
+    sessionType: null,
+    oneOffContext: undefined,
+};
+//# sourceMappingURL=security.frontend.schemas.js.map

package/dist/esm/core/security/security.frontend.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqDH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;CACzB,CAAC"}

package/dist/esm/core/security/session-token-storage.frontend.service.d.ts

@@ -0,0 +1,34 @@
+/**
+ * W7.3b: Session Token Storage — Strategy pattern for token persistence.
+ *
+ * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).
+ * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).
+ */
+export interface SessionTokenStorage {
+    getAccessToken(): string | null;
+    getRefreshToken(): string | null;
+    storeTokens(accessToken: string | null, refreshToken: string | null): void;
+    getOrganizationId(): string | null;
+    setOrganizationId(orgId: string | null): void;
+    clear(): void;
+}
+export declare class PersistentSessionTokenStorage implements SessionTokenStorage {
+    getAccessToken(): string | null;
+    getRefreshToken(): string | null;
+    storeTokens(accessToken: string | null, refreshToken: string | null): void;
+    getOrganizationId(): string | null;
+    setOrganizationId(orgId: string | null): void;
+    clear(): void;
+}
+export declare class EphemeralSessionTokenStorage implements SessionTokenStorage {
+    private _accessToken;
+    private _refreshToken;
+    private _organizationId;
+    getAccessToken(): string | null;
+    getRefreshToken(): string | null;
+    storeTokens(accessToken: string | null, refreshToken: string | null): void;
+    getOrganizationId(): string | null;
+    setOrganizationId(orgId: string | null): void;
+    clear(): void;
+}
+//# sourceMappingURL=session-token-storage.frontend.service.d.ts.map

package/dist/esm/core/security/session-token-storage.frontend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-token-storage.frontend.service.d.ts","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI;IAG/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAGhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAQ1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK7C,KAAK,IAAI,IAAI;CAKd;AAED,qBAAa,4BAA6B,YAAW,mBAAmB;IACtE,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAAuB;IAE9C,cAAc,IAAI,MAAM,GAAG,IAAI;IAC/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAChC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAC7C,KAAK,IAAI,IAAI;CAKd"}

package/dist/esm/core/security/session-token-storage.frontend.service.js

@@ -0,0 +1,55 @@
+/**
+ * W7.3b: Session Token Storage — Strategy pattern for token persistence.
+ *
+ * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).
+ * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).
+ */
+import { LOCAL_STORAGE_KEYS, getLocalStorageItem, setLocalStorageItem, removeLocalStorageItem, } from '../../core/commons/local-storage.frontend.schemas.js';
+export class PersistentSessionTokenStorage {
+    getAccessToken() {
+        return getLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);
+    }
+    getRefreshToken() {
+        return getLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);
+    }
+    storeTokens(accessToken, refreshToken) {
+        accessToken
+            ? setLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN, accessToken)
+            : removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);
+        refreshToken
+            ? setLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN, refreshToken)
+            : removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);
+    }
+    getOrganizationId() {
+        return getLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);
+    }
+    setOrganizationId(orgId) {
+        orgId
+            ? setLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID, orgId)
+            : removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);
+    }
+    clear() {
+        removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);
+        removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);
+        removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);
+    }
+}
+export class EphemeralSessionTokenStorage {
+    _accessToken = null;
+    _refreshToken = null;
+    _organizationId = null;
+    getAccessToken() { return this._accessToken; }
+    getRefreshToken() { return this._refreshToken; }
+    storeTokens(accessToken, refreshToken) {
+        this._accessToken = accessToken;
+        this._refreshToken = refreshToken;
+    }
+    getOrganizationId() { return this._organizationId; }
+    setOrganizationId(orgId) { this._organizationId = orgId; }
+    clear() {
+        this._accessToken = null;
+        this._refreshToken = null;
+        this._organizationId = null;
+    }
+}
+//# sourceMappingURL=session-token-storage.frontend.service.js.map

package/dist/esm/core/security/session-token-storage.frontend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-token-storage.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iEAAiE,CAAC;AAazE,MAAM,OAAO,6BAA6B;IACxC,cAAc;QACZ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD,eAAe;QACb,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC/D,CAAC;IACD,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,WAAW;YACT,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzD,YAAY;YACV,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC;YACrE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC/D,CAAC;IACD,iBAAiB;QACf,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,iBAAiB,CAAC,KAAoB;QACpC,KAAK;YACH,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzD,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IACpC,eAAe,GAAkB,IAAI,CAAC;IAE9C,cAAc,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,eAAe,KAAoB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IACD,iBAAiB,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,iBAAiB,CAAC,KAAoB,IAAU,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;IAC/E,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;CACF"}

package/dist/esm/core/security/useAuthSession.d.ts

@@ -0,0 +1,13 @@
+/**
+ * useAuthSession Hook
+ *
+ * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.
+ */
+import { type AuthSessionContextType } from './AuthSessionContext.js';
+/**
+ * Hook to access the Auth Session context
+ * @returns AuthSessionContextType with auth state and authentication functions
+ * @throws Error if used outside of AuthSessionProvider
+ */
+export declare const useAuthSession: () => AuthSessionContextType;
+//# sourceMappingURL=useAuthSession.d.ts.map

package/dist/esm/core/security/useAuthSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthSession.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,sBAMjC,CAAC"}

package/dist/esm/core/security/useAuthSession.js

@@ -0,0 +1,20 @@
+/**
+ * useAuthSession Hook
+ *
+ * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.
+ */
+import { useContext } from 'react';
+import { AuthSessionContext } from './AuthSessionContext.js';
+/**
+ * Hook to access the Auth Session context
+ * @returns AuthSessionContextType with auth state and authentication functions
+ * @throws Error if used outside of AuthSessionProvider
+ */
+export const useAuthSession = () => {
+    const context = useContext(AuthSessionContext);
+    if (!context) {
+        throw new Error('useAuthSession must be used within an AuthSessionProvider');
+    }
+    return context;
+};
+//# sourceMappingURL=useAuthSession.js.map

package/dist/esm/core/security/useAuthSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA+B,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA2B,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}

package/dist/esm/core/security/useResolvedAuthConfig.d.ts

@@ -0,0 +1,30 @@
+/**
+ * W6.5: Resolves the effective auth config for the current frontend service.
+ *
+ * Resolution chain:
+ * 1. If the user is authenticated, prefer their actual user type that is allowed on the
+ *    current frontend service
+ * 2. Otherwise use envLoader.frontendServiceName → frontendServices[frontendServiceName].usersManagement → default user type key
+ * 3. userTypes[resolvedType].auth → per-user-type auth policy (UserTypeAuthPolicy)
+ * 4. Falls back to hardcoded restrictive defaults when user type cannot be resolved
+ *
+ * SSO providers and passkeyConfig are infrastructure — always from global auth.
+ * Auth methods, MFA, registration, password policy come from the resolved user type.
+ */
+import type { AppConfiguration_Shared_Auth, UserTypeAuthPolicy, PasswordPolicyRules } from '@wildo-ai/saas-models';
+export interface ResolvedRegistrationConfig {
+    enabled: boolean;
+    invitationOnly: boolean;
+    requirePasswordOnRegister: boolean;
+    allowedMethods: string[];
+}
+export interface ResolvedAuthConfig {
+    resolvedUserType: string | null;
+    userTypeAuth: UserTypeAuthPolicy | null;
+    globalAuth: AppConfiguration_Shared_Auth;
+    passwordPolicy: PasswordPolicyRules;
+    registrationConfig: ResolvedRegistrationConfig;
+    registrationEnabled: boolean;
+}
+export declare function useResolvedAuthConfig(): ResolvedAuthConfig;
+//# sourceMappingURL=useResolvedAuthConfig.d.ts.map

package/dist/esm/core/security/useResolvedAuthConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useResolvedAuthConfig.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EACV,4BAA4B,EAC5B,kBAAkB,EAElB,mBAAmB,EAEpB,MAAM,uBAAuB,CAAC;AAsD/B,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,yBAAyB,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,4BAA4B,CAAC;IACzC,cAAc,EAAE,mBAAmB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CA2C1D"}

package/dist/esm/core/security/useResolvedAuthConfig.js

@@ -0,0 +1,94 @@
+/**
+ * W6.5: Resolves the effective auth config for the current frontend service.
+ *
+ * Resolution chain:
+ * 1. If the user is authenticated, prefer their actual user type that is allowed on the
+ *    current frontend service
+ * 2. Otherwise use envLoader.frontendServiceName → frontendServices[frontendServiceName].usersManagement → default user type key
+ * 3. userTypes[resolvedType].auth → per-user-type auth policy (UserTypeAuthPolicy)
+ * 4. Falls back to hardcoded restrictive defaults when user type cannot be resolved
+ *
+ * SSO providers and passkeyConfig are infrastructure — always from global auth.
+ * Auth methods, MFA, registration, password policy come from the resolved user type.
+ */
+import { useContext, useMemo } from 'react';
+import { useApplication } from '../../core/runtime/useApplication.js';
+import { envLoader } from '../../core/runtime/env-variable-loader.frontend.service.js';
+import { UserOrgsContext } from './UserOrgsContext.js';
+import { AuthMethod, RegistrationMode } from '@wildo-ai/saas-models';
+/**
+ * Resolves the default user type key from frontendServices config.
+ * Mirrors backend AppConfigurationBackendService.resolveUserTypeFromFrontendServiceName():
+ * isDefault entry first, then first entry.
+ */
+function resolveUserTypeFromFrontendServiceName(frontendServiceName, frontendServices) {
+    if (!frontendServices)
+        return null;
+    const frontendServiceConfig = frontendServices[frontendServiceName];
+    if (!frontendServiceConfig?.usersManagement)
+        return null;
+    const entries = Object.entries(frontendServiceConfig.usersManagement);
+    const defaultEntry = entries.find(([, v]) => v.isDefault);
+    const firstEntry = entries[0];
+    return (defaultEntry ?? firstEntry)?.[0] ?? null;
+}
+function resolveAuthenticatedUserTypeForFrontendService(frontendServiceName, authenticatedUserTypes, frontendServices) {
+    if (!authenticatedUserTypes?.length || !frontendServices) {
+        return null;
+    }
+    const allowedUserManagement = frontendServices[frontendServiceName]?.usersManagement;
+    if (!allowedUserManagement) {
+        return null;
+    }
+    for (const userType of authenticatedUserTypes) {
+        if (allowedUserManagement[userType]) {
+            return userType;
+        }
+    }
+    return null;
+}
+const DEFAULT_PASSWORD_POLICY = {
+    minLength: 8,
+    maxLength: 128,
+    requireUppercase: true,
+    requireLowercase: true,
+    requireNumbers: true,
+    requireSpecialChars: false,
+    expiryDays: 0,
+};
+export function useResolvedAuthConfig() {
+    const { auth: globalAuth, appConfig } = useApplication();
+    const userOrgs = useContext(UserOrgsContext);
+    const frontendServiceName = envLoader.loadEnvironmentConfig().frontendServiceName;
+    return useMemo(() => {
+        const defaultFrontendUserType = resolveUserTypeFromFrontendServiceName(frontendServiceName, appConfig.frontendServices);
+        const authenticatedUserType = resolveAuthenticatedUserTypeForFrontendService(frontendServiceName, userOrgs?.user?.userTypes, appConfig.frontendServices);
+        const resolvedUserType = authenticatedUserType ?? defaultFrontendUserType;
+        const userTypeDef = resolvedUserType ? appConfig.userTypes?.[resolvedUserType] : null;
+        const userTypeAuth = userTypeDef?.auth ?? null;
+        const passwordPolicy = userTypeAuth?.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;
+        const utReg = userTypeAuth?.registration;
+        const registrationConfig = utReg
+            ? {
+                enabled: utReg.mode !== RegistrationMode.DISABLED && utReg.mode !== RegistrationMode.ADMIN_ONLY,
+                invitationOnly: utReg.mode === RegistrationMode.INVITATION_ONLY,
+                requirePasswordOnRegister: utReg.requirePasswordOnRegister !== false,
+                allowedMethods: utReg.allowedMethods ?? [AuthMethod.PASSWORD],
+            }
+            : {
+                enabled: true,
+                invitationOnly: false,
+                requirePasswordOnRegister: true,
+                allowedMethods: [AuthMethod.PASSWORD],
+            };
+        return {
+            resolvedUserType,
+            userTypeAuth,
+            globalAuth,
+            passwordPolicy,
+            registrationConfig,
+            registrationEnabled: registrationConfig.enabled,
+        };
+    }, [frontendServiceName, appConfig, globalAuth, userOrgs?.user?.userTypes]);
+}
+//# sourceMappingURL=useResolvedAuthConfig.js.map

package/dist/esm/core/security/useResolvedAuthConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useResolvedAuthConfig.js","sourceRoot":"","sources":["../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAQpD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAErE;;;;GAIG;AACH,SAAS,sCAAsC,CAC7C,mBAA2B,EAC3B,gBAAoD;IAEpD,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,qBAAqB,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,8CAA8C,CACrD,mBAA2B,EAC3B,sBAAqD,EACrD,gBAAoD;IAEpD,IAAI,CAAC,sBAAsB,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC;IACrF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,uBAAuB,GAAwB;IACnD,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,IAAI;IACtB,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,mBAAmB,EAAE,KAAK;IAC1B,UAAU,EAAE,CAAC;CACd,CAAC;AAkBF,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC,mBAAmB,CAAC;IAElF,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,uBAAuB,GAAG,sCAAsC,CAAC,mBAAmB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxH,MAAM,qBAAqB,GAAG,8CAA8C,CAC1E,mBAAmB,EACnB,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,IAAI,uBAAuB,CAAC;QAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,YAAY,GAA8B,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;QAE1E,MAAM,cAAc,GAAwB,YAAY,EAAE,cAAc,IAAI,uBAAuB,CAAC;QAEpG,MAAM,KAAK,GAAmC,YAAY,EAAE,YAAY,CAAC;QAEzE,MAAM,kBAAkB,GAA+B,KAAK;YAC1D,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,UAAU;gBAC/F,cAAc,EAAE,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,eAAe;gBAC/D,yBAAyB,EAAE,KAAK,CAAC,yBAAyB,KAAK,KAAK;gBACpE,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC9D;YACH,CAAC,CAAC;gBACE,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,KAAK;gBACrB,yBAAyB,EAAE,IAAI;gBAC/B,cAAc,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;aACtC,CAAC;QAEN,OAAO;YACL,gBAAgB;YAChB,YAAY;YACZ,UAAU;YACV,cAAc;YACd,kBAAkB;YAClB,mBAAmB,EAAE,kBAAkB,CAAC,OAAO;SAChD,CAAC;IACJ,CAAC,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/esm/core/security/useStepUpAuth.d.ts

@@ -0,0 +1,8 @@
+/**
+ * useStepUpAuth Hook
+ *
+ * Separated from StepUpAuthContext.tsx for React Fast Refresh compatibility.
+ */
+import { type StepUpAuthContextType } from './StepUpAuthContext.js';
+export declare const useStepUpAuth: () => StepUpAuthContextType;
+//# sourceMappingURL=useStepUpAuth.d.ts.map

package/dist/esm/core/security/useStepUpAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useStepUpAuth.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,eAAO,MAAM,aAAa,QAAO,qBAMhC,CAAC"}

package/dist/esm/core/security/useStepUpAuth.js

@@ -0,0 +1,15 @@
+/**
+ * useStepUpAuth Hook
+ *
+ * Separated from StepUpAuthContext.tsx for React Fast Refresh compatibility.
+ */
+import { useContext } from 'react';
+import { StepUpAuthContext } from './StepUpAuthContext.js';
+export const useStepUpAuth = () => {
+    const context = useContext(StepUpAuthContext);
+    if (!context) {
+        throw new Error('useStepUpAuth must be used within a StepUpAuthProvider');
+    }
+    return context;
+};
+//# sourceMappingURL=useStepUpAuth.js.map

package/dist/esm/core/security/useStepUpAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useStepUpAuth.js","sourceRoot":"","sources":["../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAA8B,MAAM,qBAAqB,CAAC;AAEpF,MAAM,CAAC,MAAM,aAAa,GAAG,GAA0B,EAAE;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}

package/dist/esm/core/security/useUserOrgs.d.ts

@@ -0,0 +1,13 @@
+/**
+ * useUserOrgs Hook
+ *
+ * Separated from UserOrgsContext.tsx for React Fast Refresh compatibility.
+ */
+import { type UserOrgsContextType } from './UserOrgsContext.js';
+/**
+ * Hook to access the User Organizations context
+ * @returns UserOrgsContextType with auth state and authentication functions
+ * @throws Error if used outside of UserOrgsProvider
+ */
+export declare const useUserOrgs: () => UserOrgsContextType;
+//# sourceMappingURL=useUserOrgs.d.ts.map

package/dist/esm/core/security/useUserOrgs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useUserOrgs.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,mBAM9B,CAAC"}

package/dist/esm/core/security/useUserOrgs.js

@@ -0,0 +1,20 @@
+/**
+ * useUserOrgs Hook
+ *
+ * Separated from UserOrgsContext.tsx for React Fast Refresh compatibility.
+ */
+import { useContext } from 'react';
+import { UserOrgsContext } from './UserOrgsContext.js';
+/**
+ * Hook to access the User Organizations context
+ * @returns UserOrgsContextType with auth state and authentication functions
+ * @throws Error if used outside of UserOrgsProvider
+ */
+export const useUserOrgs = () => {
+    const context = useContext(UserOrgsContext);
+    if (!context) {
+        throw new Error('useUserOrgs must be used within a UserOrgsProvider');
+    }
+    return context;
+};
+//# sourceMappingURL=useUserOrgs.js.map

package/dist/esm/core/security/useUserOrgs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useUserOrgs.js","sourceRoot":"","sources":["../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,eAAe,EAA4B,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAwB,EAAE;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}