@wildo-ai/saas-frontend-lib 1.1.3 → 1.1.5

package/dist/esm/core/security/consent-gate.frontend.utils.js

@@ -0,0 +1,112 @@
+import { applicationAskedConsentPurposes, missingConsentPurposes, normalizeConsentPurposes, } from '@wildo-ai/saas-models';
+/**
+ * What the application-tier consent gate must do for the signed-in person, right now (#534 / #453).
+ *
+ * A closed vocabulary rather than two booleans, because the four states differ in what they do to the
+ * application, and a pair of flags admits a fifth ("blocking AND a prompt") that means nothing.
+ */
+export var ConsentGateStatus;
+(function (ConsentGateStatus) {
+    /** The application declares no required purpose and does no consent-based processing. Renders nothing. */
+    ConsentGateStatus["NOT_APPLICABLE"] = "notApplicable";
+    /**
+     * A purpose the application REQUIRES (`compliance.serviceConsentRequirement`) is not granted. The
+     * gate replaces every signed-in route until it is — this is the enforced half of
+     * `operatorComplianceIdentity.serviceConsentRequirement`.
+     */
+    ConsentGateStatus["REQUIRED"] = "required";
+    /**
+     * Nothing is required, but the application does consent-based processing and the person has never
+     * made a decision. A NON-blocking prompt: the application renders beneath it, and the processing
+     * stays off (the analytics provider reads the empty set) until the person grants it.
+     */
+    ConsentGateStatus["PROMPT"] = "prompt";
+    /** Every required purpose is granted, and any optional purpose was decided on. Renders nothing. */
+    ConsentGateStatus["SATISFIED"] = "satisfied";
+})(ConsentGateStatus || (ConsentGateStatus = {}));
+/**
+ * Derive the gate's state from configuration and the stored decision. Pure, so every branch is
+ * pinned without rendering.
+ *
+ * ## Fail closed on an absent record
+ *
+ * A person with no preferences record has granted nothing. When the application requires a purpose,
+ * that is REQUIRED, never "not loaded yet, let them through" — the route already waits for session
+ * restore, so an absent record here is a real absence.
+ *
+ * ## Which purposes a prompt offers
+ *
+ * Total over the configuration that states a use, and deliberately not over the enum: ANALYTICS when
+ * analytics is enabled and consent-based; a `consentGate` purpose when at least one resource operation
+ * declared one (#1462) — no configuration states a consent-based MARKETING use today, so no
+ * application-tier surface asks for it; the inbound-contact form asks for it where it is used.
+ */
+export function deriveConsentGateState(input) {
+    const requiredPurposes = normalizeConsentPurposes(input.serviceConsentRequirement?.requiredPurposes);
+    const grantedPurposes = normalizeConsentPurposes(input.privacy?.consentedPurposes);
+    const missingRequiredPurposes = missingConsentPurposes(grantedPurposes, requiredPurposes);
+    // ONE derivation of "what does this application ask", shared with the anonymous-consent carry that
+    // decides whether a visitor was shown enough for their decision to count as complete (#1258). Two
+    // copies would drift invisibly: the gate would prompt for a purpose the carry had recorded as
+    // already decided, or the reverse.
+    const askedPurposes = applicationAskedConsentPurposes({
+        requiredPurposes,
+        analyticsEnabled: input.analyticsEnabled,
+        analyticsRequiresConsent: input.analyticsRequiresConsent,
+        capabilityDeclaredPurposes: input.capabilityDeclaredConsentPurposes,
+    });
+    const optionalPurposes = askedPurposes.filter((purpose) => !requiredPurposes.includes(purpose));
+    const base = {
+        requiredPurposes,
+        missingRequiredPurposes,
+        optionalPurposes,
+        grantedPurposes,
+        gatedProcessing: requiredPurposes.length > 0 ? input.serviceConsentRequirement?.gatedProcessing : undefined,
+    };
+    if (missingRequiredPurposes.length > 0) {
+        return { ...base, status: ConsentGateStatus.REQUIRED };
+    }
+    // No preferences record and nothing required: there is no row a prompt could record a decision on, so
+    // prompting would leave an undismissable panel stuck on "could not save". Nothing optional runs either
+    // way — the analytics provider reads the empty set.
+    if (input.privacy === null || input.privacy === undefined) {
+        return { ...base, status: ConsentGateStatus.NOT_APPLICABLE };
+    }
+    if (requiredPurposes.length === 0 && optionalPurposes.length === 0) {
+        return { ...base, status: ConsentGateStatus.NOT_APPLICABLE };
+    }
+    if (optionalPurposes.length > 0 && input.privacy?.consentDecidedAt === undefined) {
+        return { ...base, status: ConsentGateStatus.PROMPT };
+    }
+    return { ...base, status: ConsentGateStatus.SATISFIED };
+}
+/**
+ * The purpose set to store when the person chooses `selected` on a surface that offered `offered`.
+ *
+ * Purposes the surface did not offer keep their stored grant — a prompt about analytics must never
+ * withdraw a purpose it did not show — and an offered purpose is granted exactly when selected.
+ */
+export function composeConsentDecision(granted, offered, selected) {
+    const kept = granted.filter((purpose) => !offered.includes(purpose));
+    const chosen = offered.filter((purpose) => selected.includes(purpose));
+    return normalizeConsentPurposes([...kept, ...chosen]);
+}
+/**
+ * The required purposes a `decide(offered, selected)` call would leave UNMET, were it saved as-is
+ * (R9, #1258 Step 3).
+ *
+ * No shipped surface can trigger a non-empty result today — the REQUIRED panel always keeps every
+ * required purpose in `selected`, and the PROMPT panel's `offered` never includes one (`optionalPurposes`
+ * excludes `requiredPurposes` by construction in {@link deriveConsentGateState}). This exists so a
+ * withdrawal surface neither of those two is — an application's own settings page, a future preset —
+ * can compute the cost of a withdrawal BEFORE it saves.
+ *
+ * "Refusing the withdrawal is not available" (Step 3's own edge-case table): consent must be as easy to
+ * withdraw as to give. So this never blocks anything by itself — it only lets the caller warn, or
+ * require the person to acknowledge the cost, before calling `decide`.
+ */
+export function consentWithdrawalCost(state, offered, selected) {
+    const next = composeConsentDecision(state.grantedPurposes, offered, selected);
+    return missingConsentPurposes(next, state.requiredPurposes);
+}
+//# sourceMappingURL=consent-gate.frontend.utils.js.map

package/dist/esm/core/security/consent-gate.frontend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-gate.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/consent-gate.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAG/B,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iBAiBX;AAjBD,WAAY,iBAAiB;IAC3B,0GAA0G;IAC1G,qDAAgC,CAAA;IAChC;;;;OAIG;IACH,0CAAqB,CAAA;IACrB;;;;OAIG;IACH,sCAAiB,CAAA;IACjB,mGAAmG;IACnG,4CAAuB,CAAA;AACzB,CAAC,EAjBW,iBAAiB,KAAjB,iBAAiB,QAiB5B;AAqCD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAuB;IAC5D,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,KAAK,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;IACrG,MAAM,eAAe,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACnF,MAAM,uBAAuB,GAAG,sBAAsB,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;IAE1F,mGAAmG;IACnG,kGAAkG;IAClG,8FAA8F;IAC9F,mCAAmC;IACnC,MAAM,aAAa,GAAG,+BAA+B,CAAC;QACpD,gBAAgB;QAChB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,iCAAiC;KACpE,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhG,MAAM,IAAI,GAAG;QACX,gBAAgB;QAChB,uBAAuB;QACvB,gBAAgB;QAChB,eAAe;QACf,eAAe,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC,CAAC,SAAS;KAC5G,CAAC;IAEF,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC;IACD,sGAAsG;IACtG,uGAAuG;IACvG,oDAAoD;IACpD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,cAAc,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,cAAc,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,iBAAiB,CAAC,SAAS,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAkC,EAClC,OAAkC,EAClC,QAAmC;IAEnC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,OAAO,wBAAwB,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAqE,EACrE,OAAkC,EAClC,QAAmC;IAEnC,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9E,OAAO,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["import {\n  applicationAskedConsentPurposes,\n  CONSENT_PURPOSES,\n  ConsentPurpose,\n  missingConsentPurposes,\n  normalizeConsentPurposes,\n  type ServiceConsentRequirement,\n} from '@wildo-ai/saas-models';\n\n/**\n * What the application-tier consent gate must do for the signed-in person, right now (#534 / #453).\n *\n * A closed vocabulary rather than two booleans, because the four states differ in what they do to the\n * application, and a pair of flags admits a fifth (\"blocking AND a prompt\") that means nothing.\n */\nexport enum ConsentGateStatus {\n  /** The application declares no required purpose and does no consent-based processing. Renders nothing. */\n  NOT_APPLICABLE = 'notApplicable',\n  /**\n   * A purpose the application REQUIRES (`compliance.serviceConsentRequirement`) is not granted. The\n   * gate replaces every signed-in route until it is — this is the enforced half of\n   * `operatorComplianceIdentity.serviceConsentRequirement`.\n   */\n  REQUIRED = 'required',\n  /**\n   * Nothing is required, but the application does consent-based processing and the person has never\n   * made a decision. A NON-blocking prompt: the application renders beneath it, and the processing\n   * stays off (the analytics provider reads the empty set) until the person grants it.\n   */\n  PROMPT = 'prompt',\n  /** Every required purpose is granted, and any optional purpose was decided on. Renders nothing. */\n  SATISFIED = 'satisfied',\n}\n\nexport interface ConsentGateInput {\n  /** `compliance.serviceConsentRequirement` — absent means nothing is required. */\n  serviceConsentRequirement: ServiceConsentRequirement | undefined;\n  /** Whether the application runs analytics at all (`analytics.enabled`). */\n  analyticsEnabled: boolean;\n  /** `analytics.requiresConsent` — `false` is a claim analytics here is not consent-based. */\n  analyticsRequiresConsent: boolean;\n  /**\n   * `compliance.capabilityDeclaredConsentPurposes` (#1462) — every purpose declared by at least one\n   * resource operation's `consentGate`, derived by the engine at boot. Absent (an app config resolved\n   * before this field existed) behaves exactly like an empty array.\n   */\n  capabilityDeclaredConsentPurposes?: readonly string[];\n  /** The person's stored consent, or null when they have no preferences record. */\n  privacy: { consentedPurposes?: readonly string[]; consentDecidedAt?: Date | string } | null | undefined;\n}\n\nexport interface ConsentGateState {\n  status: ConsentGateStatus;\n  /** Purposes the application requires, in vocabulary order. */\n  requiredPurposes: ConsentPurpose[];\n  /** The required purposes the person has not granted. Non-empty exactly when `status` is REQUIRED. */\n  missingRequiredPurposes: ConsentPurpose[];\n  /**\n   * Purposes the application actually USES on consent and does not require — the only ones a prompt\n   * may offer. Never the whole vocabulary: asking for a purpose nothing processes collects a consent\n   * that means nothing.\n   */\n  optionalPurposes: ConsentPurpose[];\n  /** What the person has granted, normalized. */\n  grantedPurposes: ConsentPurpose[];\n  /** The operator's own words for what the requirement gates, when it gates anything. */\n  gatedProcessing: string | undefined;\n}\n\n/**\n * Derive the gate's state from configuration and the stored decision. Pure, so every branch is\n * pinned without rendering.\n *\n * ## Fail closed on an absent record\n *\n * A person with no preferences record has granted nothing. When the application requires a purpose,\n * that is REQUIRED, never \"not loaded yet, let them through\" — the route already waits for session\n * restore, so an absent record here is a real absence.\n *\n * ## Which purposes a prompt offers\n *\n * Total over the configuration that states a use, and deliberately not over the enum: ANALYTICS when\n * analytics is enabled and consent-based; a `consentGate` purpose when at least one resource operation\n * declared one (#1462) — no configuration states a consent-based MARKETING use today, so no\n * application-tier surface asks for it; the inbound-contact form asks for it where it is used.\n */\nexport function deriveConsentGateState(input: ConsentGateInput): ConsentGateState {\n  const requiredPurposes = normalizeConsentPurposes(input.serviceConsentRequirement?.requiredPurposes);\n  const grantedPurposes = normalizeConsentPurposes(input.privacy?.consentedPurposes);\n  const missingRequiredPurposes = missingConsentPurposes(grantedPurposes, requiredPurposes);\n\n  // ONE derivation of \"what does this application ask\", shared with the anonymous-consent carry that\n  // decides whether a visitor was shown enough for their decision to count as complete (#1258). Two\n  // copies would drift invisibly: the gate would prompt for a purpose the carry had recorded as\n  // already decided, or the reverse.\n  const askedPurposes = applicationAskedConsentPurposes({\n    requiredPurposes,\n    analyticsEnabled: input.analyticsEnabled,\n    analyticsRequiresConsent: input.analyticsRequiresConsent,\n    capabilityDeclaredPurposes: input.capabilityDeclaredConsentPurposes,\n  });\n  const optionalPurposes = askedPurposes.filter((purpose) => !requiredPurposes.includes(purpose));\n\n  const base = {\n    requiredPurposes,\n    missingRequiredPurposes,\n    optionalPurposes,\n    grantedPurposes,\n    gatedProcessing: requiredPurposes.length > 0 ? input.serviceConsentRequirement?.gatedProcessing : undefined,\n  };\n\n  if (missingRequiredPurposes.length > 0) {\n    return { ...base, status: ConsentGateStatus.REQUIRED };\n  }\n  // No preferences record and nothing required: there is no row a prompt could record a decision on, so\n  // prompting would leave an undismissable panel stuck on \"could not save\". Nothing optional runs either\n  // way — the analytics provider reads the empty set.\n  if (input.privacy === null || input.privacy === undefined) {\n    return { ...base, status: ConsentGateStatus.NOT_APPLICABLE };\n  }\n  if (requiredPurposes.length === 0 && optionalPurposes.length === 0) {\n    return { ...base, status: ConsentGateStatus.NOT_APPLICABLE };\n  }\n  if (optionalPurposes.length > 0 && input.privacy?.consentDecidedAt === undefined) {\n    return { ...base, status: ConsentGateStatus.PROMPT };\n  }\n  return { ...base, status: ConsentGateStatus.SATISFIED };\n}\n\n/**\n * The purpose set to store when the person chooses `selected` on a surface that offered `offered`.\n *\n * Purposes the surface did not offer keep their stored grant — a prompt about analytics must never\n * withdraw a purpose it did not show — and an offered purpose is granted exactly when selected.\n */\nexport function composeConsentDecision(\n  granted: readonly ConsentPurpose[],\n  offered: readonly ConsentPurpose[],\n  selected: readonly ConsentPurpose[],\n): ConsentPurpose[] {\n  const kept = granted.filter((purpose) => !offered.includes(purpose));\n  const chosen = offered.filter((purpose) => selected.includes(purpose));\n  return normalizeConsentPurposes([...kept, ...chosen]);\n}\n\n/**\n * The required purposes a `decide(offered, selected)` call would leave UNMET, were it saved as-is\n * (R9, #1258 Step 3).\n *\n * No shipped surface can trigger a non-empty result today — the REQUIRED panel always keeps every\n * required purpose in `selected`, and the PROMPT panel's `offered` never includes one (`optionalPurposes`\n * excludes `requiredPurposes` by construction in {@link deriveConsentGateState}). This exists so a\n * withdrawal surface neither of those two is — an application's own settings page, a future preset —\n * can compute the cost of a withdrawal BEFORE it saves.\n *\n * \"Refusing the withdrawal is not available\" (Step 3's own edge-case table): consent must be as easy to\n * withdraw as to give. So this never blocks anything by itself — it only lets the caller warn, or\n * require the person to acknowledge the cost, before calling `decide`.\n */\nexport function consentWithdrawalCost(\n  state: Pick<ConsentGateState, 'requiredPurposes' | 'grantedPurposes'>,\n  offered: readonly ConsentPurpose[],\n  selected: readonly ConsentPurpose[],\n): ConsentPurpose[] {\n  const next = composeConsentDecision(state.grantedPurposes, offered, selected);\n  return missingConsentPurposes(next, state.requiredPurposes);\n}\n"]}

package/dist/esm/core/security/cross-frontend-handoff.frontend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-frontend-handoff.frontend.service.d.ts","sourceRoot":"","sources":["../../../../src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EACL,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sEAAsE,CAAC;AAE3G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mCAAmC,GAC3C,6BAA6B,GAC7B,iBAAiB,GACjB,SAAS,GACT,oBAAoB,CAAC;AAEzB;;;;;;;;GAQG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAE,mCAAmC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEvB,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;CAMlG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,4BAA4B,CAAC,CAoBvC;AAiED,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,0BAA0B,CAAC;IACnC,IAAI,EAAE,4BAA4B,GAAG,IAAI,CAAC;IAC1C,KAAK,EAAE,+BAA+B,GAAG,IAAI,CAAC;IAC9C,cAAc,EAAE,CACd,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,KACrB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,IAAI,6BAA6B,CAyDvE"}
+{"version":3,"file":"cross-frontend-handoff.frontend.service.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EACL,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sEAAsE,CAAC;AAE3G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mCAAmC,GAC3C,6BAA6B,GAC7B,iBAAiB,GACjB,SAAS,GACT,oBAAoB,CAAC;AAEzB;;;;;;;;GAQG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAE,mCAAmC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEvB,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;CAMlG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,4BAA4B,CAAC,CAoBvC;AAiED,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,0BAA0B,CAAC;IACnC,IAAI,EAAE,4BAA4B,GAAG,IAAI,CAAC;IAC1C,KAAK,EAAE,+BAA+B,GAAG,IAAI,CAAC;IAC9C,cAAc,EAAE,CACd,KAAK,EAAE,2BAA2B,EAClC,OAAO,CAAC,EAAE,cAAc,KACrB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,IAAI,6BAA6B,CAyDvE"}

package/dist/esm/core/security/cross-frontend-handoff.frontend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"cross-frontend-handoff.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EACL,6BAA6B,GAG9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AA2B7H;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,IAAI,CAAsC;IAC1C,UAAU,CAAgB;IAEnC,YAAY,IAAyC,EAAE,OAAe,EAAE,UAAyB;QAC/F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAkC,EAClC,OAAwB;IAExB,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,QAAiB,EAAE,CAAC;QAC3B,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;QACvC,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,oBAAoB,EACpB,yDAAyD,EACzD,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC;AAE1F;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAiB;IACxC,IAAI,QAAQ,YAAY,+BAA+B;QAAE,OAAO,QAAQ,CAAC;IAEzE,MAAM,SAAS,GAAG,QAKV,CAAC;IAET,MAAM,UAAU,GACd,OAAO,SAAS,EAAE,QAAQ,EAAE,MAAM,KAAK,QAAQ;QAC7C,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;QAC3B,CAAC,CAAC,OAAO,SAAS,EAAE,UAAU,KAAK,QAAQ;YACzC,CAAC,CAAC,SAAS,CAAC,UAAU;YACtB,CAAC,CAAC,IAAI,CAAC;IAEb,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,+BAA+B,CACxC,SAAS,EACT,SAAS,EAAE,OAAO,IAAI,qDAAqD,EAC3E,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,+BAA+B,CACxC,iBAAiB,EACjB,0DAA0D,EAC1D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;QAC/C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;IAE3B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,+BAA+B,CACxC,OAAwC,EACxC,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,+BAA+B,CACxC,oBAAoB,EACpB,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA6B,MAAM,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAyC,IAAI,CAAC,CAAC;IAEjF,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAE5B,SAAS,CAAC,GAAG,EAAE;QACb,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;QAC9B,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,cAAc,GAAG,WAAW,CAChC,KAAK,EACH,KAAkC,EAClC,OAAwB,EACe,EAAE;QACzC,MAAM,MAAM,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC;QACnC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnE,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAClB,SAAS,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,QAAiB,EAAE,CAAC;YAC3B,MAAM,UAAU,GACd,QAAQ,YAAY,+BAA+B;gBACjD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,+BAA+B,CACjC,oBAAoB,EACpB,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,EAC9E,IAAI,CACL,CAAC;YACR,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * Cross-Frontend Handoff helper — first-party SaaS-app wrapper around\n * `POST /api/v1/auth/cross-frontend-handoff` (cross-app-jwt-propagation Step 3).\n *\n * Two surfaces:\n *\n *   1. `requestCrossFrontendHandoff(input)` — vanilla TS / no React. Wraps the\n *      manual-calls HTTP client, maps backend `CrossFrontendHandoffErrorCode`\n *      values onto a typed `CrossFrontendHandoffClientError`, and returns the\n *      `{ handoffUrl, expiresAt }` payload unchanged. The caller decides how\n *      to use the URL (`location.assign` for replace, `window.open` for new\n *      tab) — the helper deliberately does NOT navigate.\n *\n *   2. `useCrossFrontendHandoff()` — thin React hook wrapper for first-party\n *      app components that want `{ status, data, error, requestHandoff, reset }`\n *      ergonomics without bringing React Query in for a one-shot mutation.\n *\n * DTO atoms come from `@wildo-ai/saas-models/public-runtime`\n * (saas-models-public-runtime.md K-7) so the same symbol identity used by the\n * docs-site `docs-auth-client.ts` flows through here. The runtime call delegates\n * to `getManualCallsHttpClient()`, which inherits the auth + frontend-service\n * header injection performed by the base `WildoBackendHttpClient` interceptors.\n *\n * The bearer + `X-Frontend-Service-Name` header are injected automatically by\n * the base client; callers do NOT need to thread them through.\n */\n\nimport { useCallback, useEffect, useRef, useState } from 'react';\nimport {\n  CrossFrontendHandoffErrorCode,\n  type CrossFrontendHandoffRequest,\n  type CrossFrontendHandoffResponse,\n} from '@wildo-ai/saas-models/public-runtime';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport type { RequestOptions } from '~wildo-frontend-lib/core/requests/wildo-http-client.frontend.service';\n\n/**\n * Stable, finite set of error codes a SaaS-app caller may encounter when\n * invoking `requestCrossFrontendHandoff()`.\n *\n * Mirrors the backend enum 1:1 PLUS three runtime-only codes that never reach\n * the wire:\n *\n *   - `unauthenticated` — the caller's bearer is missing/expired/rejected\n *     (HTTP 401). Surfaced WITHOUT trying to parse a backend `code` so the\n *     caller can deep-link to login instead of branching on UNKNOWN_TARGET_*.\n *   - `network`        — no HTTP response was received (offline, DNS, CORS\n *     pre-flight rejection, etc.). The base client retried per its policy\n *     before this code is surfaced.\n *   - `malformed_response` — the request returned 2xx but the body did not\n *     match `CrossFrontendHandoffResponse`, OR the request returned an error\n *     body without a recognizable `error.details.code` field. Treat as a\n *     transient backend incident.\n */\nexport type CrossFrontendHandoffClientErrorCode =\n  | CrossFrontendHandoffErrorCode\n  | 'unauthenticated'\n  | 'network'\n  | 'malformed_response';\n\n/**\n * Typed error thrown by `requestCrossFrontendHandoff()` and stored in the\n * `error` field of `useCrossFrontendHandoff()`.\n *\n * Subclasses native `Error` so `instanceof CrossFrontendHandoffClientError` is\n * the safe way to distinguish from generic axios / network errors at a call\n * site. The `code` discriminator is the contract surface that callers branch\n * on; `httpStatus` is provided for telemetry / Sentry breadcrumbs only.\n */\nexport class CrossFrontendHandoffClientError extends Error {\n  readonly code: CrossFrontendHandoffClientErrorCode;\n  readonly httpStatus: number | null;\n\n  constructor(code: CrossFrontendHandoffClientErrorCode, message: string, httpStatus: number | null) {\n    super(message);\n    this.name = 'CrossFrontendHandoffClientError';\n    this.code = code;\n    this.httpStatus = httpStatus;\n  }\n}\n\n/**\n * Vanilla TS handoff request — no React.\n *\n * Behavior:\n *   - On 2xx with a well-formed body, returns the response unchanged.\n *   - On 2xx with a malformed body, throws `code: 'malformed_response'`.\n *   - On 401, throws `code: 'unauthenticated'` regardless of the backend's\n *     specific code (the base client may already have triggered a refresh-loop\n *     before this branch is reached).\n *   - On other 4xx with a recognized `error.details.code`, throws with that\n *     `CrossFrontendHandoffErrorCode` code so the caller can branch on\n *     `UNKNOWN_TARGET_FRONTEND` vs `TARGET_FRONTEND_HOST_NOT_CONFIGURED`.\n *   - On 4xx/5xx without a recognized code, throws `code: 'malformed_response'`.\n *   - On network failure (no response), throws `code: 'network'`.\n *\n * Pass-through `options` are forwarded to the underlying HTTP client; useful\n * fields: `signal` (AbortController), `silent` (suppress global error toast).\n */\nexport async function requestCrossFrontendHandoff(\n  input: CrossFrontendHandoffRequest,\n  options?: RequestOptions,\n): Promise<CrossFrontendHandoffResponse> {\n  let response: CrossFrontendHandoffResponse;\n  try {\n    response = await getManualCallsHttpClient().crossFrontendHandoff(input, options);\n  } catch (rawError: unknown) {\n    throw mapHandoffError(rawError);\n  }\n\n  if (\n    !response ||\n    typeof response.handoffUrl !== 'string' ||\n    typeof response.expiresAt !== 'string'\n  ) {\n    throw new CrossFrontendHandoffClientError(\n      'malformed_response',\n      'Cross-frontend handoff response missing required fields',\n      null,\n    );\n  }\n  return { handoffUrl: response.handoffUrl, expiresAt: response.expiresAt };\n}\n\nconst HANDOFF_ERROR_CODES = new Set<string>(Object.values(CrossFrontendHandoffErrorCode));\n\n/**\n * Internal — translate any thrown value (axios error, native Error, string,\n * unknown) into a `CrossFrontendHandoffClientError`.\n *\n * The base client's `responseErrorInterceptor` mutates the axios error in\n * place: it sets `error.httpStatus`, `error.context = nested.details`, and\n * preserves the raw envelope on `error.response.data`. We read the raw\n * envelope first (most reliable) and fall back to `error.context` second.\n */\nfunction mapHandoffError(rawError: unknown): CrossFrontendHandoffClientError {\n  if (rawError instanceof CrossFrontendHandoffClientError) return rawError;\n\n  const errorLike = rawError as {\n    response?: { status?: number; data?: { error?: { details?: { code?: unknown } } } };\n    httpStatus?: number;\n    context?: { code?: unknown };\n    message?: string;\n  } | null;\n\n  const httpStatus =\n    typeof errorLike?.response?.status === 'number'\n      ? errorLike.response.status\n      : typeof errorLike?.httpStatus === 'number'\n        ? errorLike.httpStatus\n        : null;\n\n  if (httpStatus === null) {\n    return new CrossFrontendHandoffClientError(\n      'network',\n      errorLike?.message ?? 'Cross-frontend handoff request failed (no response)',\n      null,\n    );\n  }\n\n  if (httpStatus === 401) {\n    return new CrossFrontendHandoffClientError(\n      'unauthenticated',\n      'Cross-frontend handoff requires an authenticated session',\n      401,\n    );\n  }\n\n  const rawCode =\n    errorLike?.response?.data?.error?.details?.code ??\n    errorLike?.context?.code;\n\n  if (typeof rawCode === 'string' && HANDOFF_ERROR_CODES.has(rawCode)) {\n    return new CrossFrontendHandoffClientError(\n      rawCode as CrossFrontendHandoffErrorCode,\n      errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n      httpStatus,\n    );\n  }\n\n  return new CrossFrontendHandoffClientError(\n    'malformed_response',\n    errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n    httpStatus,\n  );\n}\n\nexport type CrossFrontendHandoffStatus = 'idle' | 'pending' | 'success' | 'error';\n\n/**\n * State + action surface returned by `useCrossFrontendHandoff()`.\n *\n * `requestHandoff` returns the resolved `CrossFrontendHandoffResponse` on\n * success and re-throws the typed `CrossFrontendHandoffClientError` on failure\n * — so callers that need to redirect immediately can `await` it without also\n * subscribing to `status`. Hook state (`status` / `data` / `error`) is updated\n * regardless, which is convenient for components that render status without\n * holding a ref to the promise.\n */\nexport interface UseCrossFrontendHandoffResult {\n  status: CrossFrontendHandoffStatus;\n  data: CrossFrontendHandoffResponse | null;\n  error: CrossFrontendHandoffClientError | null;\n  requestHandoff: (\n    input: CrossFrontendHandoffRequest,\n    options?: RequestOptions,\n  ) => Promise<CrossFrontendHandoffResponse>;\n  reset: () => void;\n}\n\n/**\n * React hook wrapper around `requestCrossFrontendHandoff()` for first-party\n * SaaS-app components.\n *\n * Why not `useMutation` / `useReducer`: this is a one-shot, fire-and-forget\n * mutation with no caching / invalidation needs; pulling React Query in for\n * three lines of state would inflate the bundle and force a peer dep that\n * `saas-frontend-lib` does not currently take. `useState` + `useCallback` +\n * an `unmounted` guard cover the use case.\n */\nexport function useCrossFrontendHandoff(): UseCrossFrontendHandoffResult {\n  const [status, setStatus] = useState<CrossFrontendHandoffStatus>('idle');\n  const [data, setData] = useState<CrossFrontendHandoffResponse | null>(null);\n  const [error, setError] = useState<CrossFrontendHandoffClientError | null>(null);\n\n  const unmountedRef = useRef(false);\n  const callIdRef = useRef(0);\n\n  useEffect(() => {\n    unmountedRef.current = false;\n    return () => {\n      unmountedRef.current = true;\n    };\n  }, []);\n\n  const requestHandoff = useCallback(\n    async (\n      input: CrossFrontendHandoffRequest,\n      options?: RequestOptions,\n    ): Promise<CrossFrontendHandoffResponse> => {\n      const callId = ++callIdRef.current;\n      setStatus('pending');\n      setError(null);\n      try {\n        const response = await requestCrossFrontendHandoff(input, options);\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setData(response);\n          setStatus('success');\n        }\n        return response;\n      } catch (rawError: unknown) {\n        const typedError =\n          rawError instanceof CrossFrontendHandoffClientError\n            ? rawError\n            : new CrossFrontendHandoffClientError(\n                'malformed_response',\n                rawError instanceof Error ? rawError.message : 'Cross-frontend handoff failed',\n                null,\n              );\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setError(typedError);\n          setStatus('error');\n        }\n        throw typedError;\n      }\n    },\n    [],\n  );\n\n  const reset = useCallback(() => {\n    callIdRef.current++;\n    setStatus('idle');\n    setData(null);\n    setError(null);\n  }, []);\n\n  return { status, data, error, requestHandoff, reset };\n}\n"]}
+{"version":3,"file":"cross-frontend-handoff.frontend.service.js","sourceRoot":"","sources":["../../../../../src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EACL,6BAA6B,GAG9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AA2B7H;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,IAAI,CAAsC;IAC1C,UAAU,CAAgB;IAEnC,YAAY,IAAyC,EAAE,OAAe,EAAE,UAAyB;QAC/F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAkC,EAClC,OAAwB;IAExB,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,QAAiB,EAAE,CAAC;QAC3B,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;QACvC,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,oBAAoB,EACpB,yDAAyD,EACzD,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC;AAE1F;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAiB;IACxC,IAAI,QAAQ,YAAY,+BAA+B;QAAE,OAAO,QAAQ,CAAC;IAEzE,MAAM,SAAS,GAAG,QAKV,CAAC;IAET,MAAM,UAAU,GACd,OAAO,SAAS,EAAE,QAAQ,EAAE,MAAM,KAAK,QAAQ;QAC7C,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;QAC3B,CAAC,CAAC,OAAO,SAAS,EAAE,UAAU,KAAK,QAAQ;YACzC,CAAC,CAAC,SAAS,CAAC,UAAU;YACtB,CAAC,CAAC,IAAI,CAAC;IAEb,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,+BAA+B,CACxC,SAAS,EACT,SAAS,EAAE,OAAO,IAAI,qDAAqD,EAC3E,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,+BAA+B,CACxC,iBAAiB,EACjB,0DAA0D,EAC1D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;QAC/C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;IAE3B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,+BAA+B,CACxC,OAAwC,EACxC,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,+BAA+B,CACxC,oBAAoB,EACpB,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA6B,MAAM,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAyC,IAAI,CAAC,CAAC;IAEjF,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAE5B,SAAS,CAAC,GAAG,EAAE;QACb,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;QAC9B,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,cAAc,GAAG,WAAW,CAChC,KAAK,EACH,KAAkC,EAClC,OAAwB,EACe,EAAE;QACzC,MAAM,MAAM,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC;QACnC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnE,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAClB,SAAS,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,QAAiB,EAAE,CAAC;YAC3B,MAAM,UAAU,GACd,QAAQ,YAAY,+BAA+B;gBACjD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,+BAA+B,CACjC,oBAAoB,EACpB,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,EAC9E,IAAI,CACL,CAAC;YACR,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * Cross-Frontend Handoff helper — first-party SaaS-app wrapper around\n * `POST /api/v1/auth/cross-frontend-handoff` (cross-app-jwt-propagation Step 3).\n *\n * Two surfaces:\n *\n *   1. `requestCrossFrontendHandoff(input)` — vanilla TS / no React. Wraps the\n *      manual-calls HTTP client, maps backend `CrossFrontendHandoffErrorCode`\n *      values onto a typed `CrossFrontendHandoffClientError`, and returns the\n *      `{ handoffUrl, expiresAt }` payload unchanged. The caller decides how\n *      to use the URL (`location.assign` for replace, `window.open` for new\n *      tab) — the helper deliberately does NOT navigate.\n *\n *   2. `useCrossFrontendHandoff()` — thin React hook wrapper for first-party\n *      app components that want `{ status, data, error, requestHandoff, reset }`\n *      ergonomics without bringing React Query in for a one-shot mutation.\n *\n * DTO atoms come from `@wildo-ai/saas-models/public-runtime`\n * (saas-models-public-runtime.md K-7) so the same symbol identity used by the\n * docs-site `docs-auth-client.ts` flows through here. The runtime call delegates\n * to `getManualCallsHttpClient()`, which inherits the auth + frontend-service\n * header injection performed by the base `WildoBackendHttpClient` interceptors.\n *\n * The bearer + `X-Frontend-Service-Name` header are injected automatically by\n * the base client; callers do NOT need to thread them through.\n */\n\nimport { useCallback, useEffect, useRef, useState } from 'react';\nimport {\n  CrossFrontendHandoffErrorCode,\n  type CrossFrontendHandoffRequest,\n  type CrossFrontendHandoffResponse,\n} from '@wildo-ai/saas-models/public-runtime';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport type { RequestOptions } from '~wildo-frontend-lib/core/requests/wildo-http-client.frontend.service';\n\n/**\n * Stable, finite set of error codes a SaaS-app caller may encounter when\n * invoking `requestCrossFrontendHandoff()`.\n *\n * Mirrors the backend enum 1:1 PLUS three runtime-only codes that never reach\n * the wire:\n *\n *   - `unauthenticated` — the caller's bearer is missing/expired/rejected\n *     (HTTP 401). Surfaced WITHOUT trying to parse a backend `code` so the\n *     caller can deep-link to login instead of branching on UNKNOWN_TARGET_*.\n *   - `network`        — no HTTP response was received (offline, DNS, CORS\n *     pre-flight rejection, etc.). The base client retried per its policy\n *     before this code is surfaced.\n *   - `malformed_response` — the request returned 2xx but the body did not\n *     match `CrossFrontendHandoffResponse`, OR the request returned an error\n *     body without a recognizable `error.details.code` field. Treat as a\n *     transient backend incident.\n */\nexport type CrossFrontendHandoffClientErrorCode =\n  | CrossFrontendHandoffErrorCode\n  | 'unauthenticated'\n  | 'network'\n  | 'malformed_response';\n\n/**\n * Typed error thrown by `requestCrossFrontendHandoff()` and stored in the\n * `error` field of `useCrossFrontendHandoff()`.\n *\n * Subclasses native `Error` so `instanceof CrossFrontendHandoffClientError` is\n * the safe way to distinguish from generic axios / network errors at a call\n * site. The `code` discriminator is the contract surface that callers branch\n * on; `httpStatus` is provided for telemetry / Sentry breadcrumbs only.\n */\nexport class CrossFrontendHandoffClientError extends Error {\n  readonly code: CrossFrontendHandoffClientErrorCode;\n  readonly httpStatus: number | null;\n\n  constructor(code: CrossFrontendHandoffClientErrorCode, message: string, httpStatus: number | null) {\n    super(message);\n    this.name = 'CrossFrontendHandoffClientError';\n    this.code = code;\n    this.httpStatus = httpStatus;\n  }\n}\n\n/**\n * Vanilla TS handoff request — no React.\n *\n * Behavior:\n *   - On 2xx with a well-formed body, returns the response unchanged.\n *   - On 2xx with a malformed body, throws `code: 'malformed_response'`.\n *   - On 401, throws `code: 'unauthenticated'` regardless of the backend's\n *     specific code (the base client may already have triggered a refresh-loop\n *     before this branch is reached).\n *   - On other 4xx with a recognized `error.details.code`, throws with that\n *     `CrossFrontendHandoffErrorCode` code so the caller can branch on\n *     `UNKNOWN_TARGET_FRONTEND` vs `TARGET_FRONTEND_HOST_NOT_CONFIGURED`.\n *   - On 4xx/5xx without a recognized code, throws `code: 'malformed_response'`.\n *   - On network failure (no response), throws `code: 'network'`.\n *\n * Pass-through `options` are forwarded to the underlying HTTP client; useful\n * fields: `signal` (AbortController), `silent` (suppress global error toast).\n */\nexport async function requestCrossFrontendHandoff(\n  input: CrossFrontendHandoffRequest,\n  options?: RequestOptions,\n): Promise<CrossFrontendHandoffResponse> {\n  let response: CrossFrontendHandoffResponse;\n  try {\n    response = await getManualCallsHttpClient().crossFrontendHandoff(input, options);\n  } catch (rawError: unknown) {\n    throw mapHandoffError(rawError);\n  }\n\n  if (\n    !response ||\n    typeof response.handoffUrl !== 'string' ||\n    typeof response.expiresAt !== 'string'\n  ) {\n    throw new CrossFrontendHandoffClientError(\n      'malformed_response',\n      'Cross-frontend handoff response missing required fields',\n      null,\n    );\n  }\n  return { handoffUrl: response.handoffUrl, expiresAt: response.expiresAt };\n}\n\nconst HANDOFF_ERROR_CODES = new Set<string>(Object.values(CrossFrontendHandoffErrorCode));\n\n/**\n * Internal — translate any thrown value (axios error, native Error, string,\n * unknown) into a `CrossFrontendHandoffClientError`.\n *\n * The base client's `responseErrorInterceptor` mutates the axios error in\n * place: it sets `error.httpStatus`, `error.context = nested.details`, and\n * preserves the raw envelope on `error.response.data`. We read the raw\n * envelope first (most reliable) and fall back to `error.context` second.\n */\nfunction mapHandoffError(rawError: unknown): CrossFrontendHandoffClientError {\n  if (rawError instanceof CrossFrontendHandoffClientError) return rawError;\n\n  const errorLike = rawError as {\n    response?: { status?: number; data?: { error?: { details?: { code?: unknown } } } };\n    httpStatus?: number;\n    context?: { code?: unknown };\n    message?: string;\n  } | null;\n\n  const httpStatus =\n    typeof errorLike?.response?.status === 'number'\n      ? errorLike.response.status\n      : typeof errorLike?.httpStatus === 'number'\n        ? errorLike.httpStatus\n        : null;\n\n  if (httpStatus === null) {\n    return new CrossFrontendHandoffClientError(\n      'network',\n      errorLike?.message ?? 'Cross-frontend handoff request failed (no response)',\n      null,\n    );\n  }\n\n  if (httpStatus === 401) {\n    return new CrossFrontendHandoffClientError(\n      'unauthenticated',\n      'Cross-frontend handoff requires an authenticated session',\n      401,\n    );\n  }\n\n  const rawCode =\n    errorLike?.response?.data?.error?.details?.code ??\n    errorLike?.context?.code;\n\n  if (typeof rawCode === 'string' && HANDOFF_ERROR_CODES.has(rawCode)) {\n    return new CrossFrontendHandoffClientError(\n      rawCode as CrossFrontendHandoffErrorCode,\n      errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n      httpStatus,\n    );\n  }\n\n  return new CrossFrontendHandoffClientError(\n    'malformed_response',\n    errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n    httpStatus,\n  );\n}\n\nexport type CrossFrontendHandoffStatus = 'idle' | 'pending' | 'success' | 'error';\n\n/**\n * State + action surface returned by `useCrossFrontendHandoff()`.\n *\n * `requestHandoff` returns the resolved `CrossFrontendHandoffResponse` on\n * success and re-throws the typed `CrossFrontendHandoffClientError` on failure\n * — so callers that need to redirect immediately can `await` it without also\n * subscribing to `status`. Hook state (`status` / `data` / `error`) is updated\n * regardless, which is convenient for components that render status without\n * holding a ref to the promise.\n */\nexport interface UseCrossFrontendHandoffResult {\n  status: CrossFrontendHandoffStatus;\n  data: CrossFrontendHandoffResponse | null;\n  error: CrossFrontendHandoffClientError | null;\n  requestHandoff: (\n    input: CrossFrontendHandoffRequest,\n    options?: RequestOptions,\n  ) => Promise<CrossFrontendHandoffResponse>;\n  reset: () => void;\n}\n\n/**\n * React hook wrapper around `requestCrossFrontendHandoff()` for first-party\n * SaaS-app components.\n *\n * Why not `useMutation` / `useReducer`: this is a one-shot, fire-and-forget\n * mutation with no caching / invalidation needs; pulling React Query in for\n * three lines of state would inflate the bundle and force a peer dep that\n * `saas-frontend-lib` does not currently take. `useState` + `useCallback` +\n * an `unmounted` guard cover the use case.\n */\nexport function useCrossFrontendHandoff(): UseCrossFrontendHandoffResult {\n  const [status, setStatus] = useState<CrossFrontendHandoffStatus>('idle');\n  const [data, setData] = useState<CrossFrontendHandoffResponse | null>(null);\n  const [error, setError] = useState<CrossFrontendHandoffClientError | null>(null);\n\n  const unmountedRef = useRef(false);\n  const callIdRef = useRef(0);\n\n  useEffect(() => {\n    unmountedRef.current = false;\n    return () => {\n      unmountedRef.current = true;\n    };\n  }, []);\n\n  const requestHandoff = useCallback(\n    async (\n      input: CrossFrontendHandoffRequest,\n      options?: RequestOptions,\n    ): Promise<CrossFrontendHandoffResponse> => {\n      const callId = ++callIdRef.current;\n      setStatus('pending');\n      setError(null);\n      try {\n        const response = await requestCrossFrontendHandoff(input, options);\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setData(response);\n          setStatus('success');\n        }\n        return response;\n      } catch (rawError: unknown) {\n        const typedError =\n          rawError instanceof CrossFrontendHandoffClientError\n            ? rawError\n            : new CrossFrontendHandoffClientError(\n                'malformed_response',\n                rawError instanceof Error ? rawError.message : 'Cross-frontend handoff failed',\n                null,\n              );\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setError(typedError);\n          setStatus('error');\n        }\n        throw typedError;\n      }\n    },\n    [],\n  );\n\n  const reset = useCallback(() => {\n    callIdRef.current++;\n    setStatus('idle');\n    setData(null);\n    setError(null);\n  }, []);\n\n  return { status, data, error, requestHandoff, reset };\n}\n"]}

package/dist/esm/core/security/federated-reauthentication.frontend.d.ts

@@ -0,0 +1,74 @@
+import type { ReAuthenticationPurpose } from '@wildo-ai/saas-models';
+/**
+ * Federated re-authentication in the browser (#1441): confirming it is still the account holder by
+ * signing in again at a linked identity provider.
+ *
+ * WHY A POPUP. A step-up refusal holds the request that was refused, pending, and replays it once a
+ * proof arrives (the http client's step-up contract). A full-page redirect to the provider would
+ * unload the page and drop that request. So the dialog opens a window, the provider runs inside it,
+ * and the backend sends the window back to `REAUTHENTICATION_CALLBACK_PAGE_PATH` on THIS frontend's
+ * origin, where `AuthPage_ReAuthenticationCallback` hands the result to this window and closes.
+ *
+ * WHY THE WINDOW IS OPENED EMPTY FIRST. Browsers allow a popup only inside the click that asked for it.
+ * The provider URL comes from a request, which finishes after the click has ended, so the dialog opens
+ * a blank window synchronously in its click handler and this module navigates it afterwards.
+ *
+ * WHAT CROSSES THE WINDOWS, AND WHY NOT THROUGH `window.opener`. Only a one-time code, over a
+ * `BroadcastChannel`, which only this origin can join. The obvious channel, `postMessage` to the opener,
+ * is unreliable here: identity providers commonly serve `Cross-Origin-Opener-Policy`, and once the
+ * popup has visited such a page the browser severs it from this window. The callback page then has no
+ * `window.opener`, and `popup.closed` reads `true` here while the window is still open, so neither can
+ * be relied on. That is also why cancelling is an explicit abort from the dialog rather than a check
+ * for a closed window.
+ *
+ * The code is redeemed with this window's own bearer at `POST /auth/reauth/federated/exchange`, so a code
+ * read from the popup's URL is worth nothing to anyone else, and the re-authentication token itself never
+ * appears in a URL.
+ */
+/** The channel and message type the callback page reports on. One constant each, so sender and receiver cannot disagree. */
+export declare const REAUTHENTICATION_CALLBACK_CHANNEL = "wildo:reauthentication";
+export declare const REAUTHENTICATION_CALLBACK_MESSAGE_TYPE = "wildo:reauthentication-callback";
+export interface ReAuthenticationCallbackMessage {
+    type: typeof REAUTHENTICATION_CALLBACK_MESSAGE_TYPE;
+    code?: string;
+    error?: string;
+}
+/** Why a federated re-authentication produced no proof. Each has its own words in the dialog. */
+export declare enum FederatedReAuthenticationFailureReason {
+    /** The browser refused to open the window. */
+    POPUP_BLOCKED = "popup_blocked",
+    /** The person cancelled in the dialog. Never shown: the dialog is already closed. */
+    CANCELLED = "cancelled",
+    /** The provider did not answer in time: the person left the window unfinished, or closed it (which this window cannot see). */
+    TIMED_OUT = "timed_out",
+    /** The provider answered, and the answer did not confirm the person. */
+    FAILED = "failed"
+}
+export declare class FederatedReAuthenticationFailure extends Error {
+    readonly reason: FederatedReAuthenticationFailureReason;
+    constructor(reason: FederatedReAuthenticationFailureReason);
+}
+/**
+ * Open the (blank) window the provider will run in. MUST be called synchronously inside the click
+ * that chose the provider; anything later is blocked. Returns `null` when the browser refused.
+ */
+export declare function openReAuthenticationWindow(): Window | null;
+/** What the callback page sends, to every window of this origin listening. */
+export declare function reportReAuthenticationCallback(message: Omit<ReAuthenticationCallbackMessage, 'type'>): void;
+/**
+ * Wait for the callback page to report, and resolve with its one-time code.
+ *
+ * Rejects with `FAILED` when the page reports an error, `CANCELLED` when `signal` aborts (the person
+ * cancelled in the dialog), and `TIMED_OUT` when the time runs out first.
+ */
+export declare function awaitReAuthenticationCallback(signal?: AbortSignal, timeoutMs?: number): Promise<string>;
+/**
+ * Run a federated re-authentication in `popup` and return the single-use proof it earned.
+ *
+ * `popup` is the window {@link openReAuthenticationWindow} opened in the click; `null` means the browser
+ * blocked it. `signal` is the dialog's cancel. The window is closed on every failure path it can still reach.
+ */
+export declare function obtainFederatedReAuthenticationToken(identityLinkId: string, purpose: ReAuthenticationPurpose, popup: Window | null, signal?: AbortSignal): Promise<{
+    reAuthToken: string;
+}>;
+//# sourceMappingURL=federated-reauthentication.frontend.d.ts.map

package/dist/esm/core/security/federated-reauthentication.frontend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federated-reauthentication.frontend.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/federated-reauthentication.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,4HAA4H;AAC5H,eAAO,MAAM,iCAAiC,2BAA2B,CAAC;AAC1E,eAAO,MAAM,sCAAsC,oCAAoC,CAAC;AAExF,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,OAAO,sCAAsC,CAAC;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iGAAiG;AACjG,oBAAY,sCAAsC;IAChD,8CAA8C;IAC9C,aAAa,kBAAkB;IAC/B,qFAAqF;IACrF,SAAS,cAAc;IACvB,+HAA+H;IAC/H,SAAS,cAAc;IACvB,wEAAwE;IACxE,MAAM,WAAW;CAClB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;aAC7B,MAAM,EAAE,sCAAsC;gBAA9C,MAAM,EAAE,sCAAsC;CAI3E;AAOD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAE1D;AAED,8EAA8E;AAC9E,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,IAAI,CAAC,+BAA+B,EAAE,MAAM,CAAC,GAAG,IAAI,CAI3G;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,GAAE,MAA2C,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B3I;AAED;;;;;GAKG;AACH,wBAAsB,oCAAoC,CACxD,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAclC"}

package/dist/esm/core/security/federated-reauthentication.frontend.js

@@ -0,0 +1,135 @@
+import { getManualCallsHttpClient } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
+/**
+ * Federated re-authentication in the browser (#1441): confirming it is still the account holder by
+ * signing in again at a linked identity provider.
+ *
+ * WHY A POPUP. A step-up refusal holds the request that was refused, pending, and replays it once a
+ * proof arrives (the http client's step-up contract). A full-page redirect to the provider would
+ * unload the page and drop that request. So the dialog opens a window, the provider runs inside it,
+ * and the backend sends the window back to `REAUTHENTICATION_CALLBACK_PAGE_PATH` on THIS frontend's
+ * origin, where `AuthPage_ReAuthenticationCallback` hands the result to this window and closes.
+ *
+ * WHY THE WINDOW IS OPENED EMPTY FIRST. Browsers allow a popup only inside the click that asked for it.
+ * The provider URL comes from a request, which finishes after the click has ended, so the dialog opens
+ * a blank window synchronously in its click handler and this module navigates it afterwards.
+ *
+ * WHAT CROSSES THE WINDOWS, AND WHY NOT THROUGH `window.opener`. Only a one-time code, over a
+ * `BroadcastChannel`, which only this origin can join. The obvious channel, `postMessage` to the opener,
+ * is unreliable here: identity providers commonly serve `Cross-Origin-Opener-Policy`, and once the
+ * popup has visited such a page the browser severs it from this window. The callback page then has no
+ * `window.opener`, and `popup.closed` reads `true` here while the window is still open, so neither can
+ * be relied on. That is also why cancelling is an explicit abort from the dialog rather than a check
+ * for a closed window.
+ *
+ * The code is redeemed with this window's own bearer at `POST /auth/reauth/federated/exchange`, so a code
+ * read from the popup's URL is worth nothing to anyone else, and the re-authentication token itself never
+ * appears in a URL.
+ */
+/** The channel and message type the callback page reports on. One constant each, so sender and receiver cannot disagree. */
+export const REAUTHENTICATION_CALLBACK_CHANNEL = 'wildo:reauthentication';
+export const REAUTHENTICATION_CALLBACK_MESSAGE_TYPE = 'wildo:reauthentication-callback';
+/** Why a federated re-authentication produced no proof. Each has its own words in the dialog. */
+export var FederatedReAuthenticationFailureReason;
+(function (FederatedReAuthenticationFailureReason) {
+    /** The browser refused to open the window. */
+    FederatedReAuthenticationFailureReason["POPUP_BLOCKED"] = "popup_blocked";
+    /** The person cancelled in the dialog. Never shown: the dialog is already closed. */
+    FederatedReAuthenticationFailureReason["CANCELLED"] = "cancelled";
+    /** The provider did not answer in time: the person left the window unfinished, or closed it (which this window cannot see). */
+    FederatedReAuthenticationFailureReason["TIMED_OUT"] = "timed_out";
+    /** The provider answered, and the answer did not confirm the person. */
+    FederatedReAuthenticationFailureReason["FAILED"] = "failed";
+})(FederatedReAuthenticationFailureReason || (FederatedReAuthenticationFailureReason = {}));
+export class FederatedReAuthenticationFailure extends Error {
+    reason;
+    constructor(reason) {
+        super(`Federated re-authentication did not complete: ${reason}`);
+        this.reason = reason;
+        this.name = 'FederatedReAuthenticationFailure';
+    }
+}
+/** How long the window may stay open. The provider's own sign-in, plus MFA, fits well inside it. */
+const REAUTHENTICATION_WINDOW_TIMEOUT_MS = 10 * 60 * 1000;
+const POPUP_NAME = 'wildo-reauthentication';
+const POPUP_FEATURES = 'popup=yes,width=520,height=680';
+/**
+ * Open the (blank) window the provider will run in. MUST be called synchronously inside the click
+ * that chose the provider; anything later is blocked. Returns `null` when the browser refused.
+ */
+export function openReAuthenticationWindow() {
+    return window.open('about:blank', POPUP_NAME, POPUP_FEATURES);
+}
+/** What the callback page sends, to every window of this origin listening. */
+export function reportReAuthenticationCallback(message) {
+    const channel = new BroadcastChannel(REAUTHENTICATION_CALLBACK_CHANNEL);
+    channel.postMessage({ type: REAUTHENTICATION_CALLBACK_MESSAGE_TYPE, ...message });
+    channel.close();
+}
+/**
+ * Wait for the callback page to report, and resolve with its one-time code.
+ *
+ * Rejects with `FAILED` when the page reports an error, `CANCELLED` when `signal` aborts (the person
+ * cancelled in the dialog), and `TIMED_OUT` when the time runs out first.
+ */
+export function awaitReAuthenticationCallback(signal, timeoutMs = REAUTHENTICATION_WINDOW_TIMEOUT_MS) {
+    return new Promise((resolve, reject) => {
+        const channel = new BroadcastChannel(REAUTHENTICATION_CALLBACK_CHANNEL);
+        let settled = false;
+        const finish = (outcome) => {
+            if (settled)
+                return;
+            settled = true;
+            channel.close();
+            clearTimeout(deadline);
+            signal?.removeEventListener('abort', onAbort);
+            outcome();
+        };
+        const cancelled = () => finish(() => reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.CANCELLED)));
+        const onAbort = () => cancelled();
+        // Any window of this origin may answer, and the first answer settles the wait. Accepted deliberately:
+        // two tabs re-authenticating at once can take each other's code, and the loser then reports FAILED —
+        // never a proof for the wrong account, because the exchange is bound to the bearer that minted it.
+        // Correlating each attempt with a nonce echoed through the provider round trip would remove the race.
+        channel.onmessage = (event) => {
+            const data = event.data;
+            if (!data || data.type !== REAUTHENTICATION_CALLBACK_MESSAGE_TYPE)
+                return;
+            finish(() => (typeof data.code === 'string' && data.code
+                ? resolve(data.code)
+                : reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.FAILED))));
+        };
+        const deadline = setTimeout(() => finish(() => reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.TIMED_OUT))), timeoutMs);
+        if (signal?.aborted)
+            cancelled();
+        else
+            signal?.addEventListener('abort', onAbort);
+    });
+}
+/**
+ * Run a federated re-authentication in `popup` and return the single-use proof it earned.
+ *
+ * `popup` is the window {@link openReAuthenticationWindow} opened in the click; `null` means the browser
+ * blocked it. `signal` is the dialog's cancel. The window is closed on every failure path it can still reach.
+ */
+export async function obtainFederatedReAuthenticationToken(identityLinkId, purpose, popup, signal) {
+    if (!popup)
+        throw new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.POPUP_BLOCKED);
+    const client = getManualCallsHttpClient();
+    try {
+        const { authorizationUrl } = await client.startFederatedReAuthentication(identityLinkId, purpose);
+        popup.location.href = authorizationUrl;
+        const code = await awaitReAuthenticationCallback(signal);
+        return await client.exchangeFederatedReAuthentication(code);
+    }
+    catch (error) {
+        // May be a no-op once the provider's opener policy has severed the window; the callback page closes itself.
+        try {
+            popup.close();
+        }
+        catch { /* already gone */ }
+        if (error instanceof FederatedReAuthenticationFailure)
+            throw error;
+        throw new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.FAILED);
+    }
+}
+//# sourceMappingURL=federated-reauthentication.frontend.js.map

package/dist/esm/core/security/federated-reauthentication.frontend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federated-reauthentication.frontend.js","sourceRoot":"","sources":["../../../../../src/core/security/federated-reauthentication.frontend.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,4HAA4H;AAC5H,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAC1E,MAAM,CAAC,MAAM,sCAAsC,GAAG,iCAAiC,CAAC;AAQxF,iGAAiG;AACjG,MAAM,CAAN,IAAY,sCASX;AATD,WAAY,sCAAsC;IAChD,8CAA8C;IAC9C,yEAA+B,CAAA;IAC/B,qFAAqF;IACrF,iEAAuB,CAAA;IACvB,+HAA+H;IAC/H,iEAAuB,CAAA;IACvB,wEAAwE;IACxE,2DAAiB,CAAA;AACnB,CAAC,EATW,sCAAsC,KAAtC,sCAAsC,QASjD;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAC7B;IAA5B,YAA4B,MAA8C;QACxE,KAAK,CAAC,iDAAiD,MAAM,EAAE,CAAC,CAAC;QADvC,WAAM,GAAN,MAAM,CAAwC;QAExE,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAED,oGAAoG;AACpG,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1D,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,8BAA8B,CAAC,OAAsD;IACnG,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAC;IACxE,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,GAAG,OAAO,EAA4C,CAAC,CAAC;IAC5H,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAoB,EAAE,YAAoB,kCAAkC;IACxH,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAC;QACxE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,OAAmB,EAAE,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrI,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;QAClC,sGAAsG;QACtG,qGAAqG;QACrG,mGAAmG;QACnG,sGAAsG;QACtG,OAAO,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAuD,CAAC;YAC3E,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,sCAAsC;gBAAE,OAAO;YAC1E,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI;gBACtD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBACpB,CAAC,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3J,IAAI,MAAM,EAAE,OAAO;YAAE,SAAS,EAAE,CAAC;;YAC5B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,cAAsB,EACtB,OAAgC,EAChC,KAAoB,EACpB,MAAoB;IAEpB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,aAAa,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAClG,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,gBAAgB,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,MAAM,MAAM,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4GAA4G;QAC5G,IAAI,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,KAAK,YAAY,gCAAgC;YAAE,MAAM,KAAK,CAAC;QACnE,MAAM,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,MAAM,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC","sourcesContent":["import type { ReAuthenticationPurpose } from '@wildo-ai/saas-models';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\n\n/**\n * Federated re-authentication in the browser (#1441): confirming it is still the account holder by\n * signing in again at a linked identity provider.\n *\n * WHY A POPUP. A step-up refusal holds the request that was refused, pending, and replays it once a\n * proof arrives (the http client's step-up contract). A full-page redirect to the provider would\n * unload the page and drop that request. So the dialog opens a window, the provider runs inside it,\n * and the backend sends the window back to `REAUTHENTICATION_CALLBACK_PAGE_PATH` on THIS frontend's\n * origin, where `AuthPage_ReAuthenticationCallback` hands the result to this window and closes.\n *\n * WHY THE WINDOW IS OPENED EMPTY FIRST. Browsers allow a popup only inside the click that asked for it.\n * The provider URL comes from a request, which finishes after the click has ended, so the dialog opens\n * a blank window synchronously in its click handler and this module navigates it afterwards.\n *\n * WHAT CROSSES THE WINDOWS, AND WHY NOT THROUGH `window.opener`. Only a one-time code, over a\n * `BroadcastChannel`, which only this origin can join. The obvious channel, `postMessage` to the opener,\n * is unreliable here: identity providers commonly serve `Cross-Origin-Opener-Policy`, and once the\n * popup has visited such a page the browser severs it from this window. The callback page then has no\n * `window.opener`, and `popup.closed` reads `true` here while the window is still open, so neither can\n * be relied on. That is also why cancelling is an explicit abort from the dialog rather than a check\n * for a closed window.\n *\n * The code is redeemed with this window's own bearer at `POST /auth/reauth/federated/exchange`, so a code\n * read from the popup's URL is worth nothing to anyone else, and the re-authentication token itself never\n * appears in a URL.\n */\n\n/** The channel and message type the callback page reports on. One constant each, so sender and receiver cannot disagree. */\nexport const REAUTHENTICATION_CALLBACK_CHANNEL = 'wildo:reauthentication';\nexport const REAUTHENTICATION_CALLBACK_MESSAGE_TYPE = 'wildo:reauthentication-callback';\n\nexport interface ReAuthenticationCallbackMessage {\n  type: typeof REAUTHENTICATION_CALLBACK_MESSAGE_TYPE;\n  code?: string;\n  error?: string;\n}\n\n/** Why a federated re-authentication produced no proof. Each has its own words in the dialog. */\nexport enum FederatedReAuthenticationFailureReason {\n  /** The browser refused to open the window. */\n  POPUP_BLOCKED = 'popup_blocked',\n  /** The person cancelled in the dialog. Never shown: the dialog is already closed. */\n  CANCELLED = 'cancelled',\n  /** The provider did not answer in time: the person left the window unfinished, or closed it (which this window cannot see). */\n  TIMED_OUT = 'timed_out',\n  /** The provider answered, and the answer did not confirm the person. */\n  FAILED = 'failed',\n}\n\nexport class FederatedReAuthenticationFailure extends Error {\n  constructor(public readonly reason: FederatedReAuthenticationFailureReason) {\n    super(`Federated re-authentication did not complete: ${reason}`);\n    this.name = 'FederatedReAuthenticationFailure';\n  }\n}\n\n/** How long the window may stay open. The provider's own sign-in, plus MFA, fits well inside it. */\nconst REAUTHENTICATION_WINDOW_TIMEOUT_MS = 10 * 60 * 1000;\nconst POPUP_NAME = 'wildo-reauthentication';\nconst POPUP_FEATURES = 'popup=yes,width=520,height=680';\n\n/**\n * Open the (blank) window the provider will run in. MUST be called synchronously inside the click\n * that chose the provider; anything later is blocked. Returns `null` when the browser refused.\n */\nexport function openReAuthenticationWindow(): Window | null {\n  return window.open('about:blank', POPUP_NAME, POPUP_FEATURES);\n}\n\n/** What the callback page sends, to every window of this origin listening. */\nexport function reportReAuthenticationCallback(message: Omit<ReAuthenticationCallbackMessage, 'type'>): void {\n  const channel = new BroadcastChannel(REAUTHENTICATION_CALLBACK_CHANNEL);\n  channel.postMessage({ type: REAUTHENTICATION_CALLBACK_MESSAGE_TYPE, ...message } satisfies ReAuthenticationCallbackMessage);\n  channel.close();\n}\n\n/**\n * Wait for the callback page to report, and resolve with its one-time code.\n *\n * Rejects with `FAILED` when the page reports an error, `CANCELLED` when `signal` aborts (the person\n * cancelled in the dialog), and `TIMED_OUT` when the time runs out first.\n */\nexport function awaitReAuthenticationCallback(signal?: AbortSignal, timeoutMs: number = REAUTHENTICATION_WINDOW_TIMEOUT_MS): Promise<string> {\n  return new Promise<string>((resolve, reject) => {\n    const channel = new BroadcastChannel(REAUTHENTICATION_CALLBACK_CHANNEL);\n    let settled = false;\n    const finish = (outcome: () => void) => {\n      if (settled) return;\n      settled = true;\n      channel.close();\n      clearTimeout(deadline);\n      signal?.removeEventListener('abort', onAbort);\n      outcome();\n    };\n    const cancelled = () => finish(() => reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.CANCELLED)));\n    const onAbort = () => cancelled();\n    // Any window of this origin may answer, and the first answer settles the wait. Accepted deliberately:\n    // two tabs re-authenticating at once can take each other's code, and the loser then reports FAILED —\n    // never a proof for the wrong account, because the exchange is bound to the bearer that minted it.\n    // Correlating each attempt with a nonce echoed through the provider round trip would remove the race.\n    channel.onmessage = (event: MessageEvent) => {\n      const data = event.data as Partial<ReAuthenticationCallbackMessage> | null;\n      if (!data || data.type !== REAUTHENTICATION_CALLBACK_MESSAGE_TYPE) return;\n      finish(() => (typeof data.code === 'string' && data.code\n        ? resolve(data.code)\n        : reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.FAILED))));\n    };\n    const deadline = setTimeout(() => finish(() => reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.TIMED_OUT))), timeoutMs);\n    if (signal?.aborted) cancelled();\n    else signal?.addEventListener('abort', onAbort);\n  });\n}\n\n/**\n * Run a federated re-authentication in `popup` and return the single-use proof it earned.\n *\n * `popup` is the window {@link openReAuthenticationWindow} opened in the click; `null` means the browser\n * blocked it. `signal` is the dialog's cancel. The window is closed on every failure path it can still reach.\n */\nexport async function obtainFederatedReAuthenticationToken(\n  identityLinkId: string,\n  purpose: ReAuthenticationPurpose,\n  popup: Window | null,\n  signal?: AbortSignal,\n): Promise<{ reAuthToken: string }> {\n  if (!popup) throw new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.POPUP_BLOCKED);\n  const client = getManualCallsHttpClient();\n  try {\n    const { authorizationUrl } = await client.startFederatedReAuthentication(identityLinkId, purpose);\n    popup.location.href = authorizationUrl;\n    const code = await awaitReAuthenticationCallback(signal);\n    return await client.exchangeFederatedReAuthentication(code);\n  } catch (error) {\n    // May be a no-op once the provider's opener policy has severed the window; the callback page closes itself.\n    try { popup.close(); } catch { /* already gone */ }\n    if (error instanceof FederatedReAuthenticationFailure) throw error;\n    throw new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.FAILED);\n  }\n}\n"]}

package/dist/esm/core/security/jwt.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,CAAC,CAO1F"}
+{"version":3,"file":"jwt.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,CAAC,CAO1F"}

package/dist/esm/core/security/jwt.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.frontend.utils.js","sourceRoot":"","sources":["../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAoC,WAAmB;IACrF,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;AAC/D,CAAC","sourcesContent":["/**\n * Frontend JWT utilities.\n *\n * JWT payload segments use base64url, not plain base64. Consumers that decode\n * payload claims must normalize `-` / `_` and padding before parsing.\n */\n\nfunction decodeBase64UrlToUtf8(segment: string): string {\n  const normalized = segment.replace(/-/g, '+').replace(/_/g, '/');\n  const paddingLength = (4 - (normalized.length % 4)) % 4;\n  const padded = `${normalized}${'='.repeat(paddingLength)}`;\n  const binary = atob(padded);\n  const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));\n\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * Decode and parse the payload segment of a JWT access token.\n *\n * Throws when the token is malformed or when the payload is not valid JSON so\n * callers can apply context-specific logging/error handling policy.\n */\nexport function decodeJwtPayload<T extends Record<string, unknown>>(accessToken: string): T {\n  const tokenParts = accessToken.split('.');\n  if (tokenParts.length !== 3) {\n    throw new Error('JWT must contain exactly three segments');\n  }\n\n  return JSON.parse(decodeBase64UrlToUtf8(tokenParts[1])) as T;\n}\n"]}
+{"version":3,"file":"jwt.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAoC,WAAmB;IACrF,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;AAC/D,CAAC","sourcesContent":["/**\n * Frontend JWT utilities.\n *\n * JWT payload segments use base64url, not plain base64. Consumers that decode\n * payload claims must normalize `-` / `_` and padding before parsing.\n */\n\nfunction decodeBase64UrlToUtf8(segment: string): string {\n  const normalized = segment.replace(/-/g, '+').replace(/_/g, '/');\n  const paddingLength = (4 - (normalized.length % 4)) % 4;\n  const padded = `${normalized}${'='.repeat(paddingLength)}`;\n  const binary = atob(padded);\n  const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));\n\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * Decode and parse the payload segment of a JWT access token.\n *\n * Throws when the token is malformed or when the payload is not valid JSON so\n * callers can apply context-specific logging/error handling policy.\n */\nexport function decodeJwtPayload<T extends Record<string, unknown>>(accessToken: string): T {\n  const tokenParts = accessToken.split('.');\n  if (tokenParts.length !== 3) {\n    throw new Error('JWT must contain exactly three segments');\n  }\n\n  return JSON.parse(decodeBase64UrlToUtf8(tokenParts[1])) as T;\n}\n"]}

package/dist/esm/core/security/organization-onboarding.frontend.utils.d.ts

@@ -0,0 +1,50 @@
+/** The members of an auth answer that say whether it parked the account at organization onboarding. */
+export interface OrganizationOnboardingAnswerShape {
+    readonly accessToken?: string | null;
+    readonly sessionId?: string | null;
+    readonly state?: string;
+    readonly nextStep?: string;
+}
+/**
+ * The session an auth answer parked at organization onboarding, or `null` (#1090).
+ *
+ * Several answers can park an account there, and each reached the client with no screen to finish it:
+ * - a registration under deferred verification, or an email verification (`state: ONBOARDING_PENDING`,
+ *   `nextStep: ONBOARDING`) when the user type names its organization at onboarding (#1011);
+ * - a second-factor enrollment that settles a registration session there (`state: ONBOARDING_PENDING`);
+ * - a SIGN-IN — password, passkey, OTP, a second factor, a magic link — by an account that still owes its
+ *   organization (`success: false`, `nextStep: ONBOARDING`, #1091);
+ * - a FEDERATED sign-in's code exchange (OAuth2 / OIDC callback, SAML ACS) for such an account
+ *   (`{ nextStep: ONBOARDING, sessionId }`, #1103).
+ *
+ * This is the ONE reading of that condition, so every adoption site in `AuthSessionContext` and the registration
+ * outcome agree. It requires a session, because completion is performed ON the parked session, and no token,
+ * because an answer that carries one has already signed the account in and is not asking for anything.
+ * Either member (`state` or `nextStep`) is enough: the enrollment settlement names the state and the sign-in
+ * names the step.
+ */
+export declare function parkedOrganizationOnboardingSessionId(answer: OrganizationOnboardingAnswerShape | null | undefined): string | null;
+/**
+ * Where an auth screen must send the person right now because the account is parked at organization
+ * onboarding, or `null` when it is not (#1090).
+ *
+ * A RENDER-time answer rather than a navigation effect, on purpose: every auth screen already decides at render
+ * time to bounce away — the challenge and the enrollment gate send a person with no pending second factor to
+ * sign-in — and adopting a parked session clears exactly that state. An effect would lose that race and the
+ * person would land on sign-in instead of onboarding. Each screen asks this BEFORE its own bounces.
+ *
+ * The deep-link target rides the detour, as it rides the second-factor detours. A signed-in context is never
+ * parked: an answer that carried a token is not asking for onboarding.
+ */
+export declare function organizationOnboardingNavigationTarget(auth: {
+    readonly onboardingSessionId: string | null;
+    readonly accessToken: string | null;
+}, authRedirectTarget: string | null | undefined): string | null;
+/**
+ * Whether a refused onboarding completion means the parked session is gone for good (#1090) — completed in
+ * another tab, consumed by a concurrent completion, or expired. Such a session can never complete, so the auth
+ * context forgets it; every other refusal (a policy that changed, a transient failure) leaves it parked so the
+ * person can try again.
+ */
+export declare function isSpentOrganizationOnboardingSession(error: unknown): boolean;
+//# sourceMappingURL=organization-onboarding.frontend.utils.d.ts.map

package/dist/esm/core/security/organization-onboarding.frontend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-onboarding.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/organization-onboarding.frontend.utils.ts"],"names":[],"mappings":"AAIA,uGAAuG;AACvG,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,iCAAiC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIjI;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE;IAAE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC1F,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC5C,MAAM,GAAG,IAAI,CAGf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG5E"}

package/dist/esm/core/security/organization-onboarding.frontend.utils.js

@@ -0,0 +1,55 @@
+import { AuthenticationSessionState, AuthNextStep, ErrorCustomMessageReference } from '@wildo-ai/saas-models';
+import { CommonRoutePaths } from '../../core/runtime/routes.frontend.definitions.js';
+import { appendAuthRedirectToPath } from '../../core/security/auth-redirect.frontend.utils.js';
+/**
+ * The session an auth answer parked at organization onboarding, or `null` (#1090).
+ *
+ * Several answers can park an account there, and each reached the client with no screen to finish it:
+ * - a registration under deferred verification, or an email verification (`state: ONBOARDING_PENDING`,
+ *   `nextStep: ONBOARDING`) when the user type names its organization at onboarding (#1011);
+ * - a second-factor enrollment that settles a registration session there (`state: ONBOARDING_PENDING`);
+ * - a SIGN-IN — password, passkey, OTP, a second factor, a magic link — by an account that still owes its
+ *   organization (`success: false`, `nextStep: ONBOARDING`, #1091);
+ * - a FEDERATED sign-in's code exchange (OAuth2 / OIDC callback, SAML ACS) for such an account
+ *   (`{ nextStep: ONBOARDING, sessionId }`, #1103).
+ *
+ * This is the ONE reading of that condition, so every adoption site in `AuthSessionContext` and the registration
+ * outcome agree. It requires a session, because completion is performed ON the parked session, and no token,
+ * because an answer that carries one has already signed the account in and is not asking for anything.
+ * Either member (`state` or `nextStep`) is enough: the enrollment settlement names the state and the sign-in
+ * names the step.
+ */
+export function parkedOrganizationOnboardingSessionId(answer) {
+    if (!answer || answer.accessToken || !answer.sessionId)
+        return null;
+    const parked = answer.nextStep === AuthNextStep.ONBOARDING || answer.state === AuthenticationSessionState.ONBOARDING_PENDING;
+    return parked ? answer.sessionId : null;
+}
+/**
+ * Where an auth screen must send the person right now because the account is parked at organization
+ * onboarding, or `null` when it is not (#1090).
+ *
+ * A RENDER-time answer rather than a navigation effect, on purpose: every auth screen already decides at render
+ * time to bounce away — the challenge and the enrollment gate send a person with no pending second factor to
+ * sign-in — and adopting a parked session clears exactly that state. An effect would lose that race and the
+ * person would land on sign-in instead of onboarding. Each screen asks this BEFORE its own bounces.
+ *
+ * The deep-link target rides the detour, as it rides the second-factor detours. A signed-in context is never
+ * parked: an answer that carried a token is not asking for onboarding.
+ */
+export function organizationOnboardingNavigationTarget(auth, authRedirectTarget) {
+    if (!auth.onboardingSessionId || auth.accessToken)
+        return null;
+    return appendAuthRedirectToPath(CommonRoutePaths.organizationOnboarding, authRedirectTarget);
+}
+/**
+ * Whether a refused onboarding completion means the parked session is gone for good (#1090) — completed in
+ * another tab, consumed by a concurrent completion, or expired. Such a session can never complete, so the auth
+ * context forgets it; every other refusal (a policy that changed, a transient failure) leaves it parked so the
+ * person can try again.
+ */
+export function isSpentOrganizationOnboardingSession(error) {
+    const reference = error?.wildoError?.customMessageReference;
+    return reference === ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED;
+}
+//# sourceMappingURL=organization-onboarding.frontend.utils.js.map

package/dist/esm/core/security/organization-onboarding.frontend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-onboarding.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/organization-onboarding.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,gEAAgE,CAAC;AAU1G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAA4D;IAChH,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,0BAA0B,CAAC,kBAAkB,CAAC;IAC7H,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sCAAsC,CACpD,IAA0F,EAC1F,kBAA6C;IAE7C,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,wBAAwB,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAAc;IACjE,MAAM,SAAS,GAAI,KAAiF,EAAE,UAAU,EAAE,sBAAsB,CAAC;IACzI,OAAO,SAAS,KAAK,2BAA2B,CAAC,8BAA8B,CAAC;AAClF,CAAC","sourcesContent":["import { AuthenticationSessionState, AuthNextStep, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { appendAuthRedirectToPath } from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\n\n/** The members of an auth answer that say whether it parked the account at organization onboarding. */\nexport interface OrganizationOnboardingAnswerShape {\n  readonly accessToken?: string | null;\n  readonly sessionId?: string | null;\n  readonly state?: string;\n  readonly nextStep?: string;\n}\n\n/**\n * The session an auth answer parked at organization onboarding, or `null` (#1090).\n *\n * Several answers can park an account there, and each reached the client with no screen to finish it:\n * - a registration under deferred verification, or an email verification (`state: ONBOARDING_PENDING`,\n *   `nextStep: ONBOARDING`) when the user type names its organization at onboarding (#1011);\n * - a second-factor enrollment that settles a registration session there (`state: ONBOARDING_PENDING`);\n * - a SIGN-IN — password, passkey, OTP, a second factor, a magic link — by an account that still owes its\n *   organization (`success: false`, `nextStep: ONBOARDING`, #1091);\n * - a FEDERATED sign-in's code exchange (OAuth2 / OIDC callback, SAML ACS) for such an account\n *   (`{ nextStep: ONBOARDING, sessionId }`, #1103).\n *\n * This is the ONE reading of that condition, so every adoption site in `AuthSessionContext` and the registration\n * outcome agree. It requires a session, because completion is performed ON the parked session, and no token,\n * because an answer that carries one has already signed the account in and is not asking for anything.\n * Either member (`state` or `nextStep`) is enough: the enrollment settlement names the state and the sign-in\n * names the step.\n */\nexport function parkedOrganizationOnboardingSessionId(answer: OrganizationOnboardingAnswerShape | null | undefined): string | null {\n  if (!answer || answer.accessToken || !answer.sessionId) return null;\n  const parked = answer.nextStep === AuthNextStep.ONBOARDING || answer.state === AuthenticationSessionState.ONBOARDING_PENDING;\n  return parked ? answer.sessionId : null;\n}\n\n/**\n * Where an auth screen must send the person right now because the account is parked at organization\n * onboarding, or `null` when it is not (#1090).\n *\n * A RENDER-time answer rather than a navigation effect, on purpose: every auth screen already decides at render\n * time to bounce away — the challenge and the enrollment gate send a person with no pending second factor to\n * sign-in — and adopting a parked session clears exactly that state. An effect would lose that race and the\n * person would land on sign-in instead of onboarding. Each screen asks this BEFORE its own bounces.\n *\n * The deep-link target rides the detour, as it rides the second-factor detours. A signed-in context is never\n * parked: an answer that carried a token is not asking for onboarding.\n */\nexport function organizationOnboardingNavigationTarget(\n  auth: { readonly onboardingSessionId: string | null; readonly accessToken: string | null },\n  authRedirectTarget: string | null | undefined,\n): string | null {\n  if (!auth.onboardingSessionId || auth.accessToken) return null;\n  return appendAuthRedirectToPath(CommonRoutePaths.organizationOnboarding, authRedirectTarget);\n}\n\n/**\n * Whether a refused onboarding completion means the parked session is gone for good (#1090) — completed in\n * another tab, consumed by a concurrent completion, or expired. Such a session can never complete, so the auth\n * context forgets it; every other refusal (a policy that changed, a transient failure) leaves it parked so the\n * person can try again.\n */\nexport function isSpentOrganizationOnboardingSession(error: unknown): boolean {\n  const reference = (error as { wildoError?: { customMessageReference?: string } } | null | undefined)?.wildoError?.customMessageReference;\n  return reference === ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED;\n}\n"]}