@wildo-ai/saas-frontend-lib 1.1.3 → 1.1.5

package/dist/esm/core/security/security.frontend.schemas.d.ts

@@ -3,7 +3,7 @@
  *
  * Core authentication and authorization types for the frontend security layer.
  */
-import { AuthIdentificationResponse, SessionType, type AuthMethod, type AvailableMethod, type AuthSessionPurpose } from '@wildo-ai/saas-models';
+import { AuthIdentificationResponse, AuthFactorLevel, SessionType, type AuthMethod, type AvailableMethod, type AuthSessionPurpose } from '@wildo-ai/saas-models';
 /**
  * Authentication state — contains only authentication-related fields.
  *
@@ -33,6 +33,18 @@ export interface AuthState {
     availableEnrollmentMethods: AuthMethod[];
     enrolledSecondFactorMethods: string[];
     usableSecondFactorMethods: string[];
+    /**
+     * The authentication session an answer parked at organization onboarding (#1090), or `null`.
+     *
+     * Set by an answer that parked the account — a registration, an email verification, an enrollment settlement,
+     * a sign-in (#1091) or a federated sign-in's code exchange (#1103) — and read together with `accessToken`: while it is set and no token is held, the one
+     * step left is naming the organization the account's user type owes. The sign-in, registration, verification,
+     * magic-link, challenge, enrollment and federated-callback screens send the person to the organization-onboarding step in that
+     * state (`organizationOnboardingNavigationTarget`). Cleared by completing onboarding, by abandoning it, by a
+     * spent session, by a new identification and by sign-out. Memory only, deliberately: the obligation is durable
+     * on the server, so a lost tab signs in again and is parked again.
+     */
+    onboardingSessionId: string | null;
     purpose: AuthSessionPurpose | null;
     /** W7.3b: Session type — null before authentication is resolved. */
     sessionType: SessionType | null;
@@ -104,4 +116,61 @@ export declare const EMPTY_AUTH_STATE: AuthState;
 export type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';
 export type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';
 export type UIFactorLevel = 'first' | 'second';
+/**
+ * The ONE translation between the UI's factor vocabulary (`'first' | 'second'`, which selects the
+ * page, its labels and its layout) and the wire vocabulary `AuthFactorLevel`, which every
+ * authenticate-shaped request carries. They are different vocabularies on purpose — the UI has no
+ * `IDENTIFICATION` page — so a UI level must be translated at the seam, never forwarded.
+ *
+ * Measured 2026-09-15: the passkey sign-in forwarded `'first'` verbatim into
+ * `POST /auth/passkey/authenticate/verify`. The orchestrator's `=== FIRST` branch did not match it,
+ * treated the attempt as a second factor, and the response it built failed the wire enum — `400
+ * validation` on every passkey sign-in, and the same for passkey as an MFA second factor, which
+ * forwarded `'second'`. The password and OTP paths never hit it because they write
+ * `AuthFactorLevel.FIRST` / `.SECOND` by hand at their own sites; this function is where that
+ * translation now lives once.
+ */
+export declare function authFactorLevelForUiLevel(level: UIFactorLevel): AuthFactorLevel;
+/**
+ * How a username-less passkey sign-in asks the browser for a credential.
+ *
+ * The distinction is about who starts the prompt, and it decides how a failure is shown:
+ *
+ * - `CONDITIONAL` — passkey AUTOFILL. Started silently when the sign-in page renders; the browser offers
+ *   the person's passkeys in the email field's autofill list and the call waits until one is picked. It
+ *   may never resolve, is aborted when the page moves on, and a failure before a passkey is picked is
+ *   NOT an error the person caused — so nothing is shown for it.
+ * - `MODAL` — the person pressed "Sign in with a passkey". The browser shows its account picker at once,
+ *   and every failure, cancellation included, is reported on the page.
+ *
+ * spec-cite: https://web.dev/articles/passkey-form-autofill — conditional UI is invoked with `mediation: 'conditional'`, "the crucial flag that makes the WebAuthn API call conditional. It tells the browser to wait for user interaction."
+ */
+export declare enum PasskeySignInMediation {
+    CONDITIONAL = "conditional",
+    MODAL = "modal"
+}
+/**
+ * A waiting passkey AUTOFILL request was stopped because its challenge was about to expire.
+ *
+ * Autofill waits for as long as the sign-in page stays open, but the server's challenge — and the
+ * username-less session bound to it — lasts `expiresInSeconds`. Picking a passkey after that would fail
+ * on a session that no longer exists, so the context stops the wait shortly before and throws THIS, and
+ * the sign-in page starts a fresh request. Any other refusal of an autofill wait (the page moving on, the
+ * button starting its own ceremony) is NOT this error, which is what stops the page restarting over a
+ * ceremony the person began.
+ */
+export declare class PasskeyAutofillExpiredError extends Error {
+    constructor();
+}
+/**
+ * Thrown by a passkey AUTOFILL ceremony that stepped aside because a ceremony the person started
+ * themselves (the passkey button, or a second-factor passkey step) is already open.
+ *
+ * Starting a WebAuthn request aborts any pending one, so an autofill whose options arrived after the
+ * button opened its prompt would close the prompt the person is looking at. The autofill loop treats this
+ * like any other refusal and stops; the page starts a fresh autofill once the person's ceremony ends.
+ */
+export declare class PasskeyAutofillSupersededError extends Error {
+    constructor();
+}
 //# sourceMappingURL=security.frontend.schemas.d.ts.map

package/dist/esm/core/security/security.frontend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.frontend.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAClD,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,eAAe,EAAE,CAAC;IACvC,0BAA0B,EAAE,UAAU,EAAE,CAAC;IACzC,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,oEAAoE;IACpE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,wGAAwG;IACxG,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,2BAA2B,CAAC,EAAE;QAC5B;;;;;WAKG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;;;WASG;QACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,mGAAmG;QACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAmB9B,CAAC;AAIF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"security.frontend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAClD,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,eAAe,EAAE,CAAC;IACvC,0BAA0B,EAAE,UAAU,EAAE,CAAC;IACzC,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;OAUG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,oEAAoE;IACpE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,wGAAwG;IACxG,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,2BAA2B,CAAC,EAAE;QAC5B;;;;;WAKG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;;;WASG;QACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,mGAAmG;QACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAoB9B,CAAC;AAIF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAE/E;AAED;;;;;;;;;;;;;GAaG;AACH,oBAAY,sBAAsB;IAChC,WAAW,gBAAgB;IAC3B,KAAK,UAAU;CAChB;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;;CAKxD"}

package/dist/esm/core/security/security.frontend.schemas.js

@@ -3,6 +3,7 @@
  *
  * Core authentication and authorization types for the frontend security layer.
  */
+import { AuthFactorLevel, } from '@wildo-ai/saas-models';
 /**
  * Empty/initial authentication state
  */
@@ -21,9 +22,76 @@ export const EMPTY_AUTH_STATE = {
     availableEnrollmentMethods: [],
     enrolledSecondFactorMethods: [],
     usableSecondFactorMethods: [],
+    onboardingSessionId: null,
     purpose: null,
     sessionType: null,
     oneOffContext: undefined,
     crossFrontendHandoffContext: undefined,
 };
+/**
+ * The ONE translation between the UI's factor vocabulary (`'first' | 'second'`, which selects the
+ * page, its labels and its layout) and the wire vocabulary `AuthFactorLevel`, which every
+ * authenticate-shaped request carries. They are different vocabularies on purpose — the UI has no
+ * `IDENTIFICATION` page — so a UI level must be translated at the seam, never forwarded.
+ *
+ * Measured 2026-09-15: the passkey sign-in forwarded `'first'` verbatim into
+ * `POST /auth/passkey/authenticate/verify`. The orchestrator's `=== FIRST` branch did not match it,
+ * treated the attempt as a second factor, and the response it built failed the wire enum — `400
+ * validation` on every passkey sign-in, and the same for passkey as an MFA second factor, which
+ * forwarded `'second'`. The password and OTP paths never hit it because they write
+ * `AuthFactorLevel.FIRST` / `.SECOND` by hand at their own sites; this function is where that
+ * translation now lives once.
+ */
+export function authFactorLevelForUiLevel(level) {
+    return level === 'second' ? AuthFactorLevel.SECOND : AuthFactorLevel.FIRST;
+}
+/**
+ * How a username-less passkey sign-in asks the browser for a credential.
+ *
+ * The distinction is about who starts the prompt, and it decides how a failure is shown:
+ *
+ * - `CONDITIONAL` — passkey AUTOFILL. Started silently when the sign-in page renders; the browser offers
+ *   the person's passkeys in the email field's autofill list and the call waits until one is picked. It
+ *   may never resolve, is aborted when the page moves on, and a failure before a passkey is picked is
+ *   NOT an error the person caused — so nothing is shown for it.
+ * - `MODAL` — the person pressed "Sign in with a passkey". The browser shows its account picker at once,
+ *   and every failure, cancellation included, is reported on the page.
+ *
+ * spec-cite: https://web.dev/articles/passkey-form-autofill — conditional UI is invoked with `mediation: 'conditional'`, "the crucial flag that makes the WebAuthn API call conditional. It tells the browser to wait for user interaction."
+ */
+export var PasskeySignInMediation;
+(function (PasskeySignInMediation) {
+    PasskeySignInMediation["CONDITIONAL"] = "conditional";
+    PasskeySignInMediation["MODAL"] = "modal";
+})(PasskeySignInMediation || (PasskeySignInMediation = {}));
+/**
+ * A waiting passkey AUTOFILL request was stopped because its challenge was about to expire.
+ *
+ * Autofill waits for as long as the sign-in page stays open, but the server's challenge — and the
+ * username-less session bound to it — lasts `expiresInSeconds`. Picking a passkey after that would fail
+ * on a session that no longer exists, so the context stops the wait shortly before and throws THIS, and
+ * the sign-in page starts a fresh request. Any other refusal of an autofill wait (the page moving on, the
+ * button starting its own ceremony) is NOT this error, which is what stops the page restarting over a
+ * ceremony the person began.
+ */
+export class PasskeyAutofillExpiredError extends Error {
+    constructor() {
+        super('Passkey autofill challenge expired before a passkey was picked');
+        this.name = 'PasskeyAutofillExpiredError';
+    }
+}
+/**
+ * Thrown by a passkey AUTOFILL ceremony that stepped aside because a ceremony the person started
+ * themselves (the passkey button, or a second-factor passkey step) is already open.
+ *
+ * Starting a WebAuthn request aborts any pending one, so an autofill whose options arrived after the
+ * button opened its prompt would close the prompt the person is looking at. The autofill loop treats this
+ * like any other refusal and stops; the page starts a fresh autofill once the person's ceremony ends.
+ */
+export class PasskeyAutofillSupersededError extends Error {
+    constructor() {
+        super('Passkey autofill stepped aside for a ceremony the person started');
+        this.name = 'PasskeyAutofillSupersededError';
+    }
+}
 //# sourceMappingURL=security.frontend.schemas.js.map

package/dist/esm/core/security/security.frontend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0GH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;IACxB,2BAA2B,EAAE,SAAS;CACvC,CAAC","sourcesContent":["/**\n * Security Frontend Schemas\n * \n * Core authentication and authorization types for the frontend security layer.\n */\n\nimport { z } from 'zod';\nimport { \n  AuthIdentificationResponse,\n  SessionType,\n  type AuthMethod,\n  type AvailableMethod,\n  type AuthSessionPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Authentication state — contains only authentication-related fields.\n *\n * **No `refreshToken` field** (Auth-hardening Slice A Step 6,\n * 2026-04-13). Pre-Slice-A this carried `refreshToken: string | null`\n * mirroring the legacy body-channel rotation contract. A-Step 2\n * (cookie migration) made the cookie the sole owner of the refresh\n * token, A-Step 3 stopped this state from being read by any consumer,\n * and A-Step 6 dropped the field entirely. The refresh token now lives\n * EXCLUSIVELY in the `__wildo_refresh` `HttpOnly` cookie — JS-invisible\n * by design (XSS exfiltration surface closed). Consumers that want to\n * \"check if the user has a valid session\" should look at `accessToken`\n * (or `sessionRestored`) — never at the cookie, which is opaque to JS.\n */\nexport interface AuthState {\n  isLoading: boolean;\n  error: string | null;\n  sessionId: string | null;\n  accessToken: string | null;\n  identification: AuthIdentificationResponse | null;\n  sessionState: any | null;\n  isRestoringSession: boolean;\n  sessionRestored: boolean;\n  mfaRequired: boolean;\n  mfaSessionId: string | null;\n  availableMfaMethods: AvailableMethod[];\n  availableEnrollmentMethods: AuthMethod[];\n  enrolledSecondFactorMethods: string[];\n  usableSecondFactorMethods: string[];\n  purpose: AuthSessionPurpose | null;\n  /** W7.3b: Session type — null before authentication is resolved. */\n  sessionType: SessionType | null;\n  /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */\n  oneOffContext?: {\n    originTokenId: string;\n    tokenType: string;\n    consumableTokenValue?: string;\n    tokenExpiresAt?: string;\n    scopedInitiatorIds?: Record<string, string>;\n    applicationId?: string;\n  };\n  /**\n   * cross-app-jwt-propagation.md Step 5: Context data populated when an\n   * AUTH_CODE_EXCHANGE token was minted by the cross-frontend-handoff issuer.\n   * `AuthSessionContext.handleAuthCodeExchange()` populates this field only\n   * when the token-exchange response carries a top-level `returnPath`; OAuth2\n   * callback codes omit that field and therefore leave this context undefined.\n   *\n   * Distinct from `oneOffContext` on purpose (semantic distinction over\n   * convenience — see `design-philosophy.mdc`):\n   *   - `oneOffContext` describes a W7.3b ephemeral one-off session\n   *     (resource-scoped targeting, applicationId, consumable replay).\n   *   - `crossFrontendHandoffContext` describes a session-transfer landing\n   *     (returnPath, source/target frontend telemetry). The session itself\n   *     is a regular persistent session driven by the receiver's storage\n   *     adapter (cross-app-jwt-propagation.md K-7).\n   *\n   * Consumed by `Auth_OneOffSession` in cross-frontend-handoff mode to drive\n   * post-exchange navigation (`returnPath`); also available to app-level\n   * telemetry hooks that want to know \"this user just landed via a handoff\n   * from $sourceFrontendServiceName\".\n   */\n  crossFrontendHandoffContext?: {\n    /**\n     * Path to navigate to after the exchange completes. Already passed\n     * `CrossFrontendHandoff_ReturnPathSchema` refines at issuance, but\n     * receivers MUST sanitize defense-in-depth (a malicious caller could\n     * hand-craft an exchange URL bypassing the issuer).\n     */\n    returnPath: string;\n    /**\n     * The frontend that initiated the handoff (e.g., `'admin-console'`).\n     * Optional because the source frontend identifies itself only via the\n     * `X-Frontend-Service-Name` request header (set by the shared HTTP\n     * client interceptor). Non-browser callers — server-to-server\n     * invocations, hand-crafted curl sessions — may legitimately omit\n     * the header (the issuer falls back to \"unknown\" source for audit\n     * purposes), in which case the receiver simply has no source\n     * identity to display in telemetry / breadcrumbs.\n     */\n    sourceFrontendServiceName?: string;\n    /** The target frontend the handoff was minted for. Useful for telemetry / breadcrumb rendering. */\n    targetServiceKey?: string;\n  };\n}\n\n/**\n * Effective permissions for the current user\n * Contains app-level permissions and per-organization permissions\n */\nexport type EffectivePermissions = {\n  appLevel: string[];\n  organizations: Record<string, string[]>;\n};\n\n/**\n * Empty/initial authentication state\n */\nexport const EMPTY_AUTH_STATE: AuthState = {\n  isLoading: false,\n  error: null,\n  sessionId: null,\n  accessToken: null,\n  identification: null,\n  sessionState: null,\n  isRestoringSession: false,\n  sessionRestored: false,\n  mfaRequired: false,\n  mfaSessionId: null,\n  availableMfaMethods: [],\n  availableEnrollmentMethods: [],\n  enrolledSecondFactorMethods: [],\n  usableSecondFactorMethods: [],\n  purpose: null,\n  sessionType: null,\n  oneOffContext: undefined,\n  crossFrontendHandoffContext: undefined,\n};\n\n// ─── Auth UI State Types ─────────────────────────────────────────────\n\nexport type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';\n\nexport type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';\n\nexport type UIFactorLevel = 'first' | 'second';\n\n\n\n"]}
+{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,eAAe,GAKhB,MAAM,uBAAuB,CAAC;AA6G/B;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,mBAAmB,EAAE,IAAI;IACzB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;IACxB,2BAA2B,EAAE,SAAS;CACvC,CAAC;AAUF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAoB;IAC5D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,qDAA2B,CAAA;IAC3B,yCAAe,CAAA;AACjB,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD;QACE,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD;QACE,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF","sourcesContent":["/**\n * Security Frontend Schemas\n * \n * Core authentication and authorization types for the frontend security layer.\n */\n\nimport { z } from 'zod';\nimport { \n  AuthIdentificationResponse,\n  AuthFactorLevel,\n  SessionType,\n  type AuthMethod,\n  type AvailableMethod,\n  type AuthSessionPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Authentication state — contains only authentication-related fields.\n *\n * **No `refreshToken` field** (Auth-hardening Slice A Step 6,\n * 2026-04-13). Pre-Slice-A this carried `refreshToken: string | null`\n * mirroring the legacy body-channel rotation contract. A-Step 2\n * (cookie migration) made the cookie the sole owner of the refresh\n * token, A-Step 3 stopped this state from being read by any consumer,\n * and A-Step 6 dropped the field entirely. The refresh token now lives\n * EXCLUSIVELY in the `__wildo_refresh` `HttpOnly` cookie — JS-invisible\n * by design (XSS exfiltration surface closed). Consumers that want to\n * \"check if the user has a valid session\" should look at `accessToken`\n * (or `sessionRestored`) — never at the cookie, which is opaque to JS.\n */\nexport interface AuthState {\n  isLoading: boolean;\n  error: string | null;\n  sessionId: string | null;\n  accessToken: string | null;\n  identification: AuthIdentificationResponse | null;\n  sessionState: any | null;\n  isRestoringSession: boolean;\n  sessionRestored: boolean;\n  mfaRequired: boolean;\n  mfaSessionId: string | null;\n  availableMfaMethods: AvailableMethod[];\n  availableEnrollmentMethods: AuthMethod[];\n  enrolledSecondFactorMethods: string[];\n  usableSecondFactorMethods: string[];\n  /**\n   * The authentication session an answer parked at organization onboarding (#1090), or `null`.\n   *\n   * Set by an answer that parked the account — a registration, an email verification, an enrollment settlement,\n   * a sign-in (#1091) or a federated sign-in's code exchange (#1103) — and read together with `accessToken`: while it is set and no token is held, the one\n   * step left is naming the organization the account's user type owes. The sign-in, registration, verification,\n   * magic-link, challenge, enrollment and federated-callback screens send the person to the organization-onboarding step in that\n   * state (`organizationOnboardingNavigationTarget`). Cleared by completing onboarding, by abandoning it, by a\n   * spent session, by a new identification and by sign-out. Memory only, deliberately: the obligation is durable\n   * on the server, so a lost tab signs in again and is parked again.\n   */\n  onboardingSessionId: string | null;\n  purpose: AuthSessionPurpose | null;\n  /** W7.3b: Session type — null before authentication is resolved. */\n  sessionType: SessionType | null;\n  /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */\n  oneOffContext?: {\n    originTokenId: string;\n    tokenType: string;\n    consumableTokenValue?: string;\n    tokenExpiresAt?: string;\n    scopedInitiatorIds?: Record<string, string>;\n    applicationId?: string;\n  };\n  /**\n   * cross-app-jwt-propagation.md Step 5: Context data populated when an\n   * AUTH_CODE_EXCHANGE token was minted by the cross-frontend-handoff issuer.\n   * `AuthSessionContext.handleAuthCodeExchange()` populates this field only\n   * when the token-exchange response carries a top-level `returnPath`; OAuth2\n   * callback codes omit that field and therefore leave this context undefined.\n   *\n   * Distinct from `oneOffContext` on purpose (semantic distinction over\n   * convenience — see `design-philosophy.mdc`):\n   *   - `oneOffContext` describes a W7.3b ephemeral one-off session\n   *     (resource-scoped targeting, applicationId, consumable replay).\n   *   - `crossFrontendHandoffContext` describes a session-transfer landing\n   *     (returnPath, source/target frontend telemetry). The session itself\n   *     is a regular persistent session driven by the receiver's storage\n   *     adapter (cross-app-jwt-propagation.md K-7).\n   *\n   * Consumed by `Auth_OneOffSession` in cross-frontend-handoff mode to drive\n   * post-exchange navigation (`returnPath`); also available to app-level\n   * telemetry hooks that want to know \"this user just landed via a handoff\n   * from $sourceFrontendServiceName\".\n   */\n  crossFrontendHandoffContext?: {\n    /**\n     * Path to navigate to after the exchange completes. Already passed\n     * `CrossFrontendHandoff_ReturnPathSchema` refines at issuance, but\n     * receivers MUST sanitize defense-in-depth (a malicious caller could\n     * hand-craft an exchange URL bypassing the issuer).\n     */\n    returnPath: string;\n    /**\n     * The frontend that initiated the handoff (e.g., `'admin-console'`).\n     * Optional because the source frontend identifies itself only via the\n     * `X-Frontend-Service-Name` request header (set by the shared HTTP\n     * client interceptor). Non-browser callers — server-to-server\n     * invocations, hand-crafted curl sessions — may legitimately omit\n     * the header (the issuer falls back to \"unknown\" source for audit\n     * purposes), in which case the receiver simply has no source\n     * identity to display in telemetry / breadcrumbs.\n     */\n    sourceFrontendServiceName?: string;\n    /** The target frontend the handoff was minted for. Useful for telemetry / breadcrumb rendering. */\n    targetServiceKey?: string;\n  };\n}\n\n/**\n * Effective permissions for the current user\n * Contains app-level permissions and per-organization permissions\n */\nexport type EffectivePermissions = {\n  appLevel: string[];\n  organizations: Record<string, string[]>;\n};\n\n/**\n * Empty/initial authentication state\n */\nexport const EMPTY_AUTH_STATE: AuthState = {\n  isLoading: false,\n  error: null,\n  sessionId: null,\n  accessToken: null,\n  identification: null,\n  sessionState: null,\n  isRestoringSession: false,\n  sessionRestored: false,\n  mfaRequired: false,\n  mfaSessionId: null,\n  availableMfaMethods: [],\n  availableEnrollmentMethods: [],\n  enrolledSecondFactorMethods: [],\n  usableSecondFactorMethods: [],\n  onboardingSessionId: null,\n  purpose: null,\n  sessionType: null,\n  oneOffContext: undefined,\n  crossFrontendHandoffContext: undefined,\n};\n\n// ─── Auth UI State Types ─────────────────────────────────────────────\n\nexport type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';\n\nexport type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';\n\nexport type UIFactorLevel = 'first' | 'second';\n\n/**\n * The ONE translation between the UI's factor vocabulary (`'first' | 'second'`, which selects the\n * page, its labels and its layout) and the wire vocabulary `AuthFactorLevel`, which every\n * authenticate-shaped request carries. They are different vocabularies on purpose — the UI has no\n * `IDENTIFICATION` page — so a UI level must be translated at the seam, never forwarded.\n *\n * Measured 2026-09-15: the passkey sign-in forwarded `'first'` verbatim into\n * `POST /auth/passkey/authenticate/verify`. The orchestrator's `=== FIRST` branch did not match it,\n * treated the attempt as a second factor, and the response it built failed the wire enum — `400\n * validation` on every passkey sign-in, and the same for passkey as an MFA second factor, which\n * forwarded `'second'`. The password and OTP paths never hit it because they write\n * `AuthFactorLevel.FIRST` / `.SECOND` by hand at their own sites; this function is where that\n * translation now lives once.\n */\nexport function authFactorLevelForUiLevel(level: UIFactorLevel): AuthFactorLevel {\n  return level === 'second' ? AuthFactorLevel.SECOND : AuthFactorLevel.FIRST;\n}\n\n/**\n * How a username-less passkey sign-in asks the browser for a credential.\n *\n * The distinction is about who starts the prompt, and it decides how a failure is shown:\n *\n * - `CONDITIONAL` — passkey AUTOFILL. Started silently when the sign-in page renders; the browser offers\n *   the person's passkeys in the email field's autofill list and the call waits until one is picked. It\n *   may never resolve, is aborted when the page moves on, and a failure before a passkey is picked is\n *   NOT an error the person caused — so nothing is shown for it.\n * - `MODAL` — the person pressed \"Sign in with a passkey\". The browser shows its account picker at once,\n *   and every failure, cancellation included, is reported on the page.\n *\n * spec-cite: https://web.dev/articles/passkey-form-autofill — conditional UI is invoked with `mediation: 'conditional'`, \"the crucial flag that makes the WebAuthn API call conditional. It tells the browser to wait for user interaction.\"\n */\nexport enum PasskeySignInMediation {\n  CONDITIONAL = 'conditional',\n  MODAL = 'modal',\n}\n\n/**\n * A waiting passkey AUTOFILL request was stopped because its challenge was about to expire.\n *\n * Autofill waits for as long as the sign-in page stays open, but the server's challenge — and the\n * username-less session bound to it — lasts `expiresInSeconds`. Picking a passkey after that would fail\n * on a session that no longer exists, so the context stops the wait shortly before and throws THIS, and\n * the sign-in page starts a fresh request. Any other refusal of an autofill wait (the page moving on, the\n * button starting its own ceremony) is NOT this error, which is what stops the page restarting over a\n * ceremony the person began.\n */\nexport class PasskeyAutofillExpiredError extends Error {\n  constructor() {\n    super('Passkey autofill challenge expired before a passkey was picked');\n    this.name = 'PasskeyAutofillExpiredError';\n  }\n}\n\n/**\n * Thrown by a passkey AUTOFILL ceremony that stepped aside because a ceremony the person started\n * themselves (the passkey button, or a second-factor passkey step) is already open.\n *\n * Starting a WebAuthn request aborts any pending one, so an autofill whose options arrived after the\n * button opened its prompt would close the prompt the person is looking at. The autofill loop treats this\n * like any other refusal and stops; the page starts a fresh autofill once the person's ceremony ends.\n */\nexport class PasskeyAutofillSupersededError extends Error {\n  constructor() {\n    super('Passkey autofill stepped aside for a ceremony the person started');\n    this.name = 'PasskeyAutofillSupersededError';\n  }\n}\n"]}

package/dist/esm/core/security/session-token-storage.frontend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-storage.frontend.service.d.ts","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,CAAC;CACf;AAQD,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI;IAG/B;;;;;;OAMG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI;IAGhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAY1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK7C,KAAK,IAAI,IAAI;CAKd;AAED,qBAAa,4BAA6B,YAAW,mBAAmB;IACtE,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAAuB;IAE9C,cAAc,IAAI,MAAM,GAAG,IAAI;IAC/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAChC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAC7C,KAAK,IAAI,IAAI;CAKd"}
+{"version":3,"file":"session-token-storage.frontend.service.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,CAAC;CACf;AAQD,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI;IAG/B;;;;;;OAMG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI;IAGhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAY1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK7C,KAAK,IAAI,IAAI;CAKd;AAED,qBAAa,4BAA6B,YAAW,mBAAmB;IACtE,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAAuB;IAE9C,cAAc,IAAI,MAAM,GAAG,IAAI;IAC/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAChC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAC7C,KAAK,IAAI,IAAI;CAKd"}

package/dist/esm/core/security/session-token-storage.frontend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-storage.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iEAAiE,CAAC;AAazE;;;GAGG;AACH,IAAI,8BAA8B,GAAG,KAAK,CAAC;AAE3C,MAAM,OAAO,6BAA6B;IACxC,cAAc;QACZ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD;;;;;;OAMG;IACH,eAAe;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,WAAW;YACT,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAC7D,8BAA8B,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,CACV,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,iBAAiB;QACf,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,iBAAiB,CAAC,KAAoB;QACpC,KAAK;YACH,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzD,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IACpC,eAAe,GAAkB,IAAI,CAAC;IAE9C,cAAc,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,eAAe,KAAoB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IACD,iBAAiB,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,iBAAiB,CAAC,KAAoB,IAAU,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;IAC/E,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;CACF","sourcesContent":["/**\n * W7.3b: Session Token Storage — Strategy pattern for token persistence.\n *\n * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).\n * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).\n *\n * Auth-hardening Slice A Step 3 (2026-04-13) — `PersistentSessionTokenStorage`\n * NO LONGER persists the refresh token in localStorage. The refresh token now\n * travels via the `__wildo_refresh` `HttpOnly` cookie (see\n * `auth-controller.utils.ts` and `authentication-controller.backend.service.ts`).\n * The cookie is invisible to JS, which closes the XSS exfiltration surface\n * that ANY localStorage-backed refresh token inherently has.\n *\n * The `storeTokens()` signature still accepts a `refreshToken` parameter for\n * source-compat with `EphemeralSessionTokenStorage` (which keeps the in-memory\n * field for one-off / test contexts), but `PersistentSessionTokenStorage`\n * silently ignores the argument and emits a one-line `console.warn` if a\n * non-null value is passed during the transition window. The existing\n * `removeLocalStorageItem(REFRESH_TOKEN)` is kept on every `storeTokens()`\n * AND `clear()` invocation so any leftover localStorage value from a\n * pre-migration session is wiped on the user's next interaction.\n */\n\nimport {\n  LOCAL_STORAGE_KEYS,\n  getLocalStorageItem,\n  setLocalStorageItem,\n  removeLocalStorageItem,\n} from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\nexport interface SessionTokenStorage {\n  getAccessToken(): string | null;\n  getRefreshToken(): string | null;\n  storeTokens(accessToken: string | null, refreshToken: string | null): void;\n\n  getOrganizationId(): string | null;\n  setOrganizationId(orgId: string | null): void;\n\n  clear(): void;\n}\n\n/**\n * Module-scoped flag — emit the deprecation warning ONCE per page load even if\n * `storeTokens()` is called many times during a session. Avoids log spam.\n */\nlet _refreshTokenArgWarningEmitted = false;\n\nexport class PersistentSessionTokenStorage implements SessionTokenStorage {\n  getAccessToken(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n  }\n  /**\n   * Always returns `null` — refresh tokens no longer live in localStorage\n   * (Auth-hardening Slice A Step 3). The `__wildo_refresh` `HttpOnly` cookie\n   * carries the refresh token; JS can never read it. Method kept for\n   * `SessionTokenStorage` interface conformance — `EphemeralSessionTokenStorage`\n   * still uses it for in-memory contexts.\n   */\n  getRefreshToken(): string | null {\n    return null;\n  }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    accessToken\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN, accessToken)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    if (refreshToken !== null && !_refreshTokenArgWarningEmitted) {\n      _refreshTokenArgWarningEmitted = true;\n      console.warn(\n        '[wildo-auth] PersistentSessionTokenStorage.storeTokens() received a non-null refreshToken — argument is ignored. Refresh tokens now travel via the `__wildo_refresh` HttpOnly cookie (Auth-hardening Slice A).',\n      );\n    }\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n  }\n  getOrganizationId(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  setOrganizationId(orgId: string | null): void {\n    orgId\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID, orgId)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  clear(): void {\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n}\n\nexport class EphemeralSessionTokenStorage implements SessionTokenStorage {\n  private _accessToken: string | null = null;\n  private _refreshToken: string | null = null;\n  private _organizationId: string | null = null;\n\n  getAccessToken(): string | null { return this._accessToken; }\n  getRefreshToken(): string | null { return this._refreshToken; }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    this._accessToken = accessToken;\n    this._refreshToken = refreshToken;\n  }\n  getOrganizationId(): string | null { return this._organizationId; }\n  setOrganizationId(orgId: string | null): void { this._organizationId = orgId; }\n  clear(): void {\n    this._accessToken = null;\n    this._refreshToken = null;\n    this._organizationId = null;\n  }\n}\n"]}
+{"version":3,"file":"session-token-storage.frontend.service.js","sourceRoot":"","sources":["../../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iEAAiE,CAAC;AAazE;;;GAGG;AACH,IAAI,8BAA8B,GAAG,KAAK,CAAC;AAE3C,MAAM,OAAO,6BAA6B;IACxC,cAAc;QACZ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD;;;;;;OAMG;IACH,eAAe;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,WAAW;YACT,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAC7D,8BAA8B,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,CACV,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,iBAAiB;QACf,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,iBAAiB,CAAC,KAAoB;QACpC,KAAK;YACH,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzD,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IACpC,eAAe,GAAkB,IAAI,CAAC;IAE9C,cAAc,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,eAAe,KAAoB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IACD,iBAAiB,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,iBAAiB,CAAC,KAAoB,IAAU,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;IAC/E,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;CACF","sourcesContent":["/**\n * W7.3b: Session Token Storage — Strategy pattern for token persistence.\n *\n * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).\n * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).\n *\n * Auth-hardening Slice A Step 3 (2026-04-13) — `PersistentSessionTokenStorage`\n * NO LONGER persists the refresh token in localStorage. The refresh token now\n * travels via the `__wildo_refresh` `HttpOnly` cookie (see\n * `auth-controller.utils.ts` and `authentication-controller.backend.service.ts`).\n * The cookie is invisible to JS, which closes the XSS exfiltration surface\n * that ANY localStorage-backed refresh token inherently has.\n *\n * The `storeTokens()` signature still accepts a `refreshToken` parameter for\n * source-compat with `EphemeralSessionTokenStorage` (which keeps the in-memory\n * field for one-off / test contexts), but `PersistentSessionTokenStorage`\n * silently ignores the argument and emits a one-line `console.warn` if a\n * non-null value is passed during the transition window. The existing\n * `removeLocalStorageItem(REFRESH_TOKEN)` is kept on every `storeTokens()`\n * AND `clear()` invocation so any leftover localStorage value from a\n * pre-migration session is wiped on the user's next interaction.\n */\n\nimport {\n  LOCAL_STORAGE_KEYS,\n  getLocalStorageItem,\n  setLocalStorageItem,\n  removeLocalStorageItem,\n} from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\nexport interface SessionTokenStorage {\n  getAccessToken(): string | null;\n  getRefreshToken(): string | null;\n  storeTokens(accessToken: string | null, refreshToken: string | null): void;\n\n  getOrganizationId(): string | null;\n  setOrganizationId(orgId: string | null): void;\n\n  clear(): void;\n}\n\n/**\n * Module-scoped flag — emit the deprecation warning ONCE per page load even if\n * `storeTokens()` is called many times during a session. Avoids log spam.\n */\nlet _refreshTokenArgWarningEmitted = false;\n\nexport class PersistentSessionTokenStorage implements SessionTokenStorage {\n  getAccessToken(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n  }\n  /**\n   * Always returns `null` — refresh tokens no longer live in localStorage\n   * (Auth-hardening Slice A Step 3). The `__wildo_refresh` `HttpOnly` cookie\n   * carries the refresh token; JS can never read it. Method kept for\n   * `SessionTokenStorage` interface conformance — `EphemeralSessionTokenStorage`\n   * still uses it for in-memory contexts.\n   */\n  getRefreshToken(): string | null {\n    return null;\n  }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    accessToken\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN, accessToken)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    if (refreshToken !== null && !_refreshTokenArgWarningEmitted) {\n      _refreshTokenArgWarningEmitted = true;\n      console.warn(\n        '[wildo-auth] PersistentSessionTokenStorage.storeTokens() received a non-null refreshToken — argument is ignored. Refresh tokens now travel via the `__wildo_refresh` HttpOnly cookie (Auth-hardening Slice A).',\n      );\n    }\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n  }\n  getOrganizationId(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  setOrganizationId(orgId: string | null): void {\n    orgId\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID, orgId)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  clear(): void {\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n}\n\nexport class EphemeralSessionTokenStorage implements SessionTokenStorage {\n  private _accessToken: string | null = null;\n  private _refreshToken: string | null = null;\n  private _organizationId: string | null = null;\n\n  getAccessToken(): string | null { return this._accessToken; }\n  getRefreshToken(): string | null { return this._refreshToken; }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    this._accessToken = accessToken;\n    this._refreshToken = refreshToken;\n  }\n  getOrganizationId(): string | null { return this._organizationId; }\n  setOrganizationId(orgId: string | null): void { this._organizationId = orgId; }\n  clear(): void {\n    this._accessToken = null;\n    this._refreshToken = null;\n    this._organizationId = null;\n  }\n}\n"]}

package/dist/esm/core/security/useAuthSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,sBAMjC,CAAC"}
+{"version":3,"file":"useAuthSession.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,sBAMjC,CAAC"}

package/dist/esm/core/security/useAuthSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA+B,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA2B,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useAuthSession Hook\n * \n * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { AuthSessionContext, type AuthSessionContextType } from './AuthSessionContext';\n/**\n * Hook to access the Auth Session context\n * @returns AuthSessionContextType with auth state and authentication functions\n * @throws Error if used outside of AuthSessionProvider\n */\nexport const useAuthSession = (): AuthSessionContextType => {\n  const context = useContext(AuthSessionContext);\n  if (!context) {\n    throw new Error('useAuthSession must be used within an AuthSessionProvider');\n  }\n  return context;\n};\n"]}
+{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA+B,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA2B,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useAuthSession Hook\n * \n * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { AuthSessionContext, type AuthSessionContextType } from './AuthSessionContext';\n/**\n * Hook to access the Auth Session context\n * @returns AuthSessionContextType with auth state and authentication functions\n * @throws Error if used outside of AuthSessionProvider\n */\nexport const useAuthSession = (): AuthSessionContextType => {\n  const context = useContext(AuthSessionContext);\n  if (!context) {\n    throw new Error('useAuthSession must be used within an AuthSessionProvider');\n  }\n  return context;\n};\n"]}

package/dist/esm/core/security/useConsentGateBehavior.d.ts

@@ -0,0 +1,36 @@
+import type { ConsentPurpose } from '@wildo-ai/saas-models';
+import { type ConsentGateState } from './consent-gate.frontend.utils';
+export interface ConsentGateBehavior extends ConsentGateState {
+    /** A decision is being written. */
+    isSaving: boolean;
+    /** The last decision could not be written; the gate stays in its current state. */
+    saveFailed: boolean;
+    /**
+     * The required purposes the LAST `decide()` call would have left unmet, held here because it was not
+     * acknowledged (R9). Cleared by any subsequent `decide()` call, whatever it decides.
+     */
+    pendingWithdrawalCost: readonly ConsentPurpose[];
+    /**
+     * Record the person's choice among `offered` purposes: each offered purpose is granted exactly when it
+     * is in `selected`, and every purpose not offered keeps its stored grant.
+     *
+     * Withdrawing a required purpose is never refused — consent must be as easy to withdraw as to give —
+     * but it is never SILENT either (R9). When the choice would leave a required purpose unmet, the first
+     * call reports the cost via `pendingWithdrawalCost` and saves NOTHING; pass
+     * `acknowledgeWithdrawalCost: true` once the surface has shown that cost to save anyway.
+     */
+    decide: (offered: readonly ConsentPurpose[], selected: readonly ConsentPurpose[], acknowledgeWithdrawalCost?: boolean) => Promise<void>;
+    /** Leave the application instead of granting required consent. */
+    signOut: () => void;
+}
+/**
+ * The application-tier consent gate's behaviour (#534 / #453): reads the application's requirement and
+ * analytics posture, reads the person's stored decision, and writes decisions through
+ * `UserOrgsContext.recordConsentDecision` — the self-preferences UPDATE whose server-side hook owns the
+ * decision instant and whose `privacy.consentedPurposes` is audit evidence.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — an affirmative, recorded choice replaces a default;
+ * required purposes are enforced before any signed-in route renders.
+ */
+export declare function useConsentGateBehavior(): ConsentGateBehavior;
+//# sourceMappingURL=useConsentGateBehavior.d.ts.map

package/dist/esm/core/security/useConsentGateBehavior.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useConsentGateBehavior.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useConsentGateBehavior.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,mCAAmC;IACnC,QAAQ,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,UAAU,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,qBAAqB,EAAE,SAAS,cAAc,EAAE,CAAC;IACjD;;;;;;;;OAQG;IACH,MAAM,EAAE,CACN,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,yBAAyB,CAAC,EAAE,OAAO,KAChC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,kEAAkE;IAClE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,mBAAmB,CAkD5D"}

package/dist/esm/core/security/useConsentGateBehavior.js

@@ -0,0 +1,59 @@
+import { useCallback, useMemo, useState } from 'react';
+import { useApplication } from '../../core/runtime/useApplication.js';
+import { useUserOrgs } from '../../core/security/useUserOrgs.js';
+import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.service.js';
+import { composeConsentDecision, consentWithdrawalCost, deriveConsentGateState, } from './consent-gate.frontend.utils.js';
+const logger = LoggerFrontendService.getLogger();
+/**
+ * The application-tier consent gate's behaviour (#534 / #453): reads the application's requirement and
+ * analytics posture, reads the person's stored decision, and writes decisions through
+ * `UserOrgsContext.recordConsentDecision` — the self-preferences UPDATE whose server-side hook owns the
+ * decision instant and whose `privacy.consentedPurposes` is audit evidence.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — an affirmative, recorded choice replaces a default;
+ * required purposes are enforced before any signed-in route renders.
+ */
+export function useConsentGateBehavior() {
+    const { appConfig } = useApplication();
+    const { privacy, recordConsentDecision, logout } = useUserOrgs();
+    const [isSaving, setIsSaving] = useState(false);
+    const [saveFailed, setSaveFailed] = useState(false);
+    const [pendingWithdrawalCost, setPendingWithdrawalCost] = useState([]);
+    const state = useMemo(() => deriveConsentGateState({
+        serviceConsentRequirement: appConfig.compliance?.serviceConsentRequirement,
+        analyticsEnabled: appConfig.analytics?.enabled === true,
+        analyticsRequiresConsent: appConfig.analytics?.requiresConsent !== false,
+        capabilityDeclaredConsentPurposes: appConfig.compliance?.capabilityDeclaredConsentPurposes,
+        privacy,
+    }), [
+        appConfig.analytics?.enabled,
+        appConfig.analytics?.requiresConsent,
+        appConfig.compliance?.serviceConsentRequirement,
+        appConfig.compliance?.capabilityDeclaredConsentPurposes,
+        privacy,
+    ]);
+    const decide = useCallback(async (offered, selected, acknowledgeWithdrawalCost = false) => {
+        setSaveFailed(false);
+        const cost = consentWithdrawalCost(state, offered, selected);
+        if (cost.length > 0 && !acknowledgeWithdrawalCost) {
+            // Report and stop — do NOT save. Refusing the withdrawal is not available (R9); what is
+            // available is not letting it happen silently.
+            setPendingWithdrawalCost(cost);
+            return;
+        }
+        setPendingWithdrawalCost([]);
+        setIsSaving(true);
+        try {
+            await recordConsentDecision(composeConsentDecision(state.grantedPurposes, offered, selected));
+        }
+        catch (error) {
+            logger.error('Consent decision could not be recorded', { error });
+            setSaveFailed(true);
+        }
+        finally {
+            setIsSaving(false);
+        }
+    }, [recordConsentDecision, state]);
+    return { ...state, isSaving, saveFailed, pendingWithdrawalCost, decide, signOut: logout };
+}
+//# sourceMappingURL=useConsentGateBehavior.js.map

package/dist/esm/core/security/useConsentGateBehavior.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useConsentGateBehavior.js","sourceRoot":"","sources":["../../../../../src/core/security/useConsentGateBehavior.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AA8BxE;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAA4B,EAAE,CAAC,CAAC;IAElG,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,sBAAsB,CAAC;QAC3B,yBAAyB,EAAE,SAAS,CAAC,UAAU,EAAE,yBAAyB;QAC1E,gBAAgB,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI;QACvD,wBAAwB,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,KAAK,KAAK;QACxE,iCAAiC,EAAE,SAAS,CAAC,UAAU,EAAE,iCAAiC;QAC1F,OAAO;KACR,CAAC,EACF;QACE,SAAS,CAAC,SAAS,EAAE,OAAO;QAC5B,SAAS,CAAC,SAAS,EAAE,eAAe;QACpC,SAAS,CAAC,UAAU,EAAE,yBAAyB;QAC/C,SAAS,CAAC,UAAU,EAAE,iCAAiC;QACvD,OAAO;KACR,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAC9B,OAAkC,EAClC,QAAmC,EACnC,yBAAyB,GAAG,KAAK,EAClB,EAAE;QACjB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAClD,wFAAwF;YACxF,+CAA+C;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAC7B,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,sBAAsB,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC,CAAC;IAEnC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5F,CAAC","sourcesContent":["import { useCallback, useMemo, useState } from 'react';\nimport type { ConsentPurpose } from '@wildo-ai/saas-models';\n\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport {\n  composeConsentDecision,\n  consentWithdrawalCost,\n  deriveConsentGateState,\n  type ConsentGateState,\n} from './consent-gate.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\n\nexport interface ConsentGateBehavior extends ConsentGateState {\n  /** A decision is being written. */\n  isSaving: boolean;\n  /** The last decision could not be written; the gate stays in its current state. */\n  saveFailed: boolean;\n  /**\n   * The required purposes the LAST `decide()` call would have left unmet, held here because it was not\n   * acknowledged (R9). Cleared by any subsequent `decide()` call, whatever it decides.\n   */\n  pendingWithdrawalCost: readonly ConsentPurpose[];\n  /**\n   * Record the person's choice among `offered` purposes: each offered purpose is granted exactly when it\n   * is in `selected`, and every purpose not offered keeps its stored grant.\n   *\n   * Withdrawing a required purpose is never refused — consent must be as easy to withdraw as to give —\n   * but it is never SILENT either (R9). When the choice would leave a required purpose unmet, the first\n   * call reports the cost via `pendingWithdrawalCost` and saves NOTHING; pass\n   * `acknowledgeWithdrawalCost: true` once the surface has shown that cost to save anyway.\n   */\n  decide: (\n    offered: readonly ConsentPurpose[],\n    selected: readonly ConsentPurpose[],\n    acknowledgeWithdrawalCost?: boolean,\n  ) => Promise<void>;\n  /** Leave the application instead of granting required consent. */\n  signOut: () => void;\n}\n\n/**\n * The application-tier consent gate's behaviour (#534 / #453): reads the application's requirement and\n * analytics posture, reads the person's stored decision, and writes decisions through\n * `UserOrgsContext.recordConsentDecision` — the self-preferences UPDATE whose server-side hook owns the\n * decision instant and whose `privacy.consentedPurposes` is audit evidence.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — an affirmative, recorded choice replaces a default;\n * required purposes are enforced before any signed-in route renders.\n */\nexport function useConsentGateBehavior(): ConsentGateBehavior {\n  const { appConfig } = useApplication();\n  const { privacy, recordConsentDecision, logout } = useUserOrgs();\n  const [isSaving, setIsSaving] = useState(false);\n  const [saveFailed, setSaveFailed] = useState(false);\n  const [pendingWithdrawalCost, setPendingWithdrawalCost] = useState<readonly ConsentPurpose[]>([]);\n\n  const state = useMemo(\n    () => deriveConsentGateState({\n      serviceConsentRequirement: appConfig.compliance?.serviceConsentRequirement,\n      analyticsEnabled: appConfig.analytics?.enabled === true,\n      analyticsRequiresConsent: appConfig.analytics?.requiresConsent !== false,\n      capabilityDeclaredConsentPurposes: appConfig.compliance?.capabilityDeclaredConsentPurposes,\n      privacy,\n    }),\n    [\n      appConfig.analytics?.enabled,\n      appConfig.analytics?.requiresConsent,\n      appConfig.compliance?.serviceConsentRequirement,\n      appConfig.compliance?.capabilityDeclaredConsentPurposes,\n      privacy,\n    ],\n  );\n\n  const decide = useCallback(async (\n    offered: readonly ConsentPurpose[],\n    selected: readonly ConsentPurpose[],\n    acknowledgeWithdrawalCost = false,\n  ): Promise<void> => {\n    setSaveFailed(false);\n    const cost = consentWithdrawalCost(state, offered, selected);\n    if (cost.length > 0 && !acknowledgeWithdrawalCost) {\n      // Report and stop — do NOT save. Refusing the withdrawal is not available (R9); what is\n      // available is not letting it happen silently.\n      setPendingWithdrawalCost(cost);\n      return;\n    }\n    setPendingWithdrawalCost([]);\n    setIsSaving(true);\n    try {\n      await recordConsentDecision(composeConsentDecision(state.grantedPurposes, offered, selected));\n    } catch (error) {\n      logger.error('Consent decision could not be recorded', { error });\n      setSaveFailed(true);\n    } finally {\n      setIsSaving(false);\n    }\n  }, [recordConsentDecision, state]);\n\n  return { ...state, isSaving, saveFailed, pendingWithdrawalCost, decide, signOut: logout };\n}\n"]}

package/dist/esm/core/security/useDocumentAcceptanceGateBehavior.d.ts

@@ -0,0 +1,76 @@
+import { GovernedDocumentAcceptanceOwedReason } from '@wildo-ai/saas-models';
+import type { GovernedDocumentAcceptanceState } from '../../components/compliance/GovernedDocumentAcceptanceControl';
+/** What the document acceptance gate must do. */
+export declare enum DocumentAcceptanceGateStatus {
+    /** The application declares no release that asks for acceptance. Nothing is fetched, nothing is shown (R12). */
+    NOT_APPLICABLE = "NOT_APPLICABLE",
+    /** The owed set is being read. The application renders meanwhile — see the hook's JSDoc for why. */
+    CHECKING = "CHECKING",
+    /** Nothing is owed. */
+    SATISFIED = "SATISFIED",
+    /** The person owes an acceptance: the gate stands in for the application until they give it or leave. */
+    REQUIRED = "REQUIRED",
+    /**
+     * The owed set could not be read. The application renders, and the next session asks again.
+     *
+     * Distinct from SATISFIED on purpose: nothing was learned, so nothing is claimed. See the hook's
+     * JSDoc for why this opens rather than closes.
+     */
+    UNAVAILABLE = "UNAVAILABLE"
+}
+export interface DocumentAcceptanceGateBehavior {
+    readonly status: DocumentAcceptanceGateStatus;
+    /** Why the person is asked. Present exactly when `status` is REQUIRED; the first owed reason decides the heading. */
+    readonly reason: GovernedDocumentAcceptanceOwedReason | undefined;
+    /** The acceptance control's state — the same shape registration passes it. */
+    readonly acceptance: GovernedDocumentAcceptanceState;
+    /** Whether the person has done what the mode asks, so the accept action may run. */
+    readonly canAccept: boolean;
+    readonly isSaving: boolean;
+    readonly saveFailed: boolean;
+    /** Record the acceptance of every owed release, then re-read what is still owed. */
+    readonly accept: () => Promise<void>;
+    /** Leave the application instead of accepting. */
+    readonly signOut: () => void;
+}
+/**
+ * The application-tier DOCUMENT ACCEPTANCE gate's behaviour (#1258, Step 2 / R7).
+ *
+ * A signed-in person owes an acceptance when they have never accepted a document the application
+ * requires — a sign-up through a form that accepted nothing — or when a release changed it materially
+ * since they last did. The server decides which (`GET /governed-documents/acceptances/owed`, over the
+ * pure `governedDocumentAcceptancesOwed`), so the rule lives in one place.
+ *
+ * ## Four decisions this makes, each deliberately
+ *
+ * - **An application that asks for no acceptance never makes the request.** Decided here from the
+ *   declared releases, before any network call, so a product with no terms pays nothing (R12).
+ * - **A frontend service that authenticates no APPLICATION user never makes the request either.**
+ *   An acceptance is owed by a user of the application — the rows the server reads are keyed on one
+ *   — so a service whose `usersManagement` names no user type has nobody who could owe it. That is
+ *   not hypothetical: the dev companion's workbench authors its entry EMPTY on purpose (its operator
+ *   is the platform identity, never an application user), mounts a deliberate subset of the engine's
+ *   controllers, and served the application's own releases in the config — so this gate asked
+ *   `/governed-documents/acceptances/owed` on every session, the companion answered `404 Route not
+ *   found`, and the error classifier rendered "The companion has no record of this" on Home
+ *   (measured 2026-09-22). Decided from the same resolution `useResolvedAuthConfig` makes for the
+ *   sign-in surfaces, so the two cannot disagree about whose acceptance a session can carry.
+ * - **The application renders while the check is in flight.** Holding the whole shell on one request
+ *   makes every sign-in wait on it, for the case — nothing owed — that is overwhelmingly the common
+ *   one. The gate replaces the shell when the answer arrives.
+ * - **A failed check OPENS, and says so (`UNAVAILABLE`).** Acceptance here is a rendering posture, not
+ *   a server-side gate — the acceptance mode's own contract states that plainly — so failing closed
+ *   would lock every signed-in person out of the product whenever one endpoint hiccups, to enforce
+ *   something the server does not enforce. The next session asks again.
+ *
+ * ## The same acceptance control as registration
+ *
+ * `acceptance` is exactly the state `GovernedDocumentAcceptanceControl` takes, so this surface asks in
+ * the same three modes, with the same reading gate and the same rules, as sign-up does.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a person whose agreement to a required document
+ * is missing or superseded is asked again before the application renders, and their acceptance is
+ * recorded against the exact release version through the same recorder as registration.
+ */
+export declare function useDocumentAcceptanceGateBehavior(): DocumentAcceptanceGateBehavior;
+//# sourceMappingURL=useDocumentAcceptanceGateBehavior.d.ts.map

package/dist/esm/core/security/useDocumentAcceptanceGateBehavior.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useDocumentAcceptanceGateBehavior.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useDocumentAcceptanceGateBehavior.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,oCAAoC,EAQrC,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EACV,+BAA+B,EAEhC,MAAM,6EAA6E,CAAC;AAErF,iDAAiD;AACjD,oBAAY,4BAA4B;IACtC,gHAAgH;IAChH,cAAc,mBAAmB;IACjC,oGAAoG;IACpG,QAAQ,aAAa;IACrB,uBAAuB;IACvB,SAAS,cAAc;IACvB,yGAAyG;IACzG,QAAQ,aAAa;IACrB;;;;;OAKG;IACH,WAAW,gBAAgB;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;IAC9C,qHAAqH;IACrH,QAAQ,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,CAAC;IAClE,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC;IACrD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iCAAiC,IAAI,8BAA8B,CAkHlF"}