@wildo-ai/saas-frontend-lib 1.1.5 → 1.1.7

package/dist/esm/core/security/security.frontend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,eAAe,GAKhB,MAAM,uBAAuB,CAAC;AA6G/B;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,mBAAmB,EAAE,IAAI;IACzB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;IACxB,2BAA2B,EAAE,SAAS;CACvC,CAAC;AAUF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAoB;IAC5D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,qDAA2B,CAAA;IAC3B,yCAAe,CAAA;AACjB,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD;QACE,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD;QACE,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF","sourcesContent":["/**\n * Security Frontend Schemas\n * \n * Core authentication and authorization types for the frontend security layer.\n */\n\nimport { z } from 'zod';\nimport { \n  AuthIdentificationResponse,\n  AuthFactorLevel,\n  SessionType,\n  type AuthMethod,\n  type AvailableMethod,\n  type AuthSessionPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Authentication state — contains only authentication-related fields.\n *\n * **No `refreshToken` field** (Auth-hardening Slice A Step 6,\n * 2026-04-13). Pre-Slice-A this carried `refreshToken: string | null`\n * mirroring the legacy body-channel rotation contract. A-Step 2\n * (cookie migration) made the cookie the sole owner of the refresh\n * token, A-Step 3 stopped this state from being read by any consumer,\n * and A-Step 6 dropped the field entirely. The refresh token now lives\n * EXCLUSIVELY in the `__wildo_refresh` `HttpOnly` cookie — JS-invisible\n * by design (XSS exfiltration surface closed). Consumers that want to\n * \"check if the user has a valid session\" should look at `accessToken`\n * (or `sessionRestored`) — never at the cookie, which is opaque to JS.\n */\nexport interface AuthState {\n  isLoading: boolean;\n  error: string | null;\n  sessionId: string | null;\n  accessToken: string | null;\n  identification: AuthIdentificationResponse | null;\n  sessionState: any | null;\n  isRestoringSession: boolean;\n  sessionRestored: boolean;\n  mfaRequired: boolean;\n  mfaSessionId: string | null;\n  availableMfaMethods: AvailableMethod[];\n  availableEnrollmentMethods: AuthMethod[];\n  enrolledSecondFactorMethods: string[];\n  usableSecondFactorMethods: string[];\n  /**\n   * The authentication session an answer parked at organization onboarding (#1090), or `null`.\n   *\n   * Set by an answer that parked the account — a registration, an email verification, an enrollment settlement,\n   * a sign-in (#1091) or a federated sign-in's code exchange (#1103) — and read together with `accessToken`: while it is set and no token is held, the one\n   * step left is naming the organization the account's user type owes. The sign-in, registration, verification,\n   * magic-link, challenge, enrollment and federated-callback screens send the person to the organization-onboarding step in that\n   * state (`organizationOnboardingNavigationTarget`). Cleared by completing onboarding, by abandoning it, by a\n   * spent session, by a new identification and by sign-out. Memory only, deliberately: the obligation is durable\n   * on the server, so a lost tab signs in again and is parked again.\n   */\n  onboardingSessionId: string | null;\n  purpose: AuthSessionPurpose | null;\n  /** W7.3b: Session type — null before authentication is resolved. */\n  sessionType: SessionType | null;\n  /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */\n  oneOffContext?: {\n    originTokenId: string;\n    tokenType: string;\n    consumableTokenValue?: string;\n    tokenExpiresAt?: string;\n    scopedInitiatorIds?: Record<string, string>;\n    applicationId?: string;\n  };\n  /**\n   * cross-app-jwt-propagation.md Step 5: Context data populated when an\n   * AUTH_CODE_EXCHANGE token was minted by the cross-frontend-handoff issuer.\n   * `AuthSessionContext.handleAuthCodeExchange()` populates this field only\n   * when the token-exchange response carries a top-level `returnPath`; OAuth2\n   * callback codes omit that field and therefore leave this context undefined.\n   *\n   * Distinct from `oneOffContext` on purpose (semantic distinction over\n   * convenience — see `design-philosophy.mdc`):\n   *   - `oneOffContext` describes a W7.3b ephemeral one-off session\n   *     (resource-scoped targeting, applicationId, consumable replay).\n   *   - `crossFrontendHandoffContext` describes a session-transfer landing\n   *     (returnPath, source/target frontend telemetry). The session itself\n   *     is a regular persistent session driven by the receiver's storage\n   *     adapter (cross-app-jwt-propagation.md K-7).\n   *\n   * Consumed by `Auth_OneOffSession` in cross-frontend-handoff mode to drive\n   * post-exchange navigation (`returnPath`); also available to app-level\n   * telemetry hooks that want to know \"this user just landed via a handoff\n   * from $sourceFrontendServiceName\".\n   */\n  crossFrontendHandoffContext?: {\n    /**\n     * Path to navigate to after the exchange completes. Already passed\n     * `CrossFrontendHandoff_ReturnPathSchema` refines at issuance, but\n     * receivers MUST sanitize defense-in-depth (a malicious caller could\n     * hand-craft an exchange URL bypassing the issuer).\n     */\n    returnPath: string;\n    /**\n     * The frontend that initiated the handoff (e.g., `'admin-console'`).\n     * Optional because the source frontend identifies itself only via the\n     * `X-Frontend-Service-Name` request header (set by the shared HTTP\n     * client interceptor). Non-browser callers — server-to-server\n     * invocations, hand-crafted curl sessions — may legitimately omit\n     * the header (the issuer falls back to \"unknown\" source for audit\n     * purposes), in which case the receiver simply has no source\n     * identity to display in telemetry / breadcrumbs.\n     */\n    sourceFrontendServiceName?: string;\n    /** The target frontend the handoff was minted for. Useful for telemetry / breadcrumb rendering. */\n    targetServiceKey?: string;\n  };\n}\n\n/**\n * Effective permissions for the current user\n * Contains app-level permissions and per-organization permissions\n */\nexport type EffectivePermissions = {\n  appLevel: string[];\n  organizations: Record<string, string[]>;\n};\n\n/**\n * Empty/initial authentication state\n */\nexport const EMPTY_AUTH_STATE: AuthState = {\n  isLoading: false,\n  error: null,\n  sessionId: null,\n  accessToken: null,\n  identification: null,\n  sessionState: null,\n  isRestoringSession: false,\n  sessionRestored: false,\n  mfaRequired: false,\n  mfaSessionId: null,\n  availableMfaMethods: [],\n  availableEnrollmentMethods: [],\n  enrolledSecondFactorMethods: [],\n  usableSecondFactorMethods: [],\n  onboardingSessionId: null,\n  purpose: null,\n  sessionType: null,\n  oneOffContext: undefined,\n  crossFrontendHandoffContext: undefined,\n};\n\n// ─── Auth UI State Types ─────────────────────────────────────────────\n\nexport type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';\n\nexport type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';\n\nexport type UIFactorLevel = 'first' | 'second';\n\n/**\n * The ONE translation between the UI's factor vocabulary (`'first' | 'second'`, which selects the\n * page, its labels and its layout) and the wire vocabulary `AuthFactorLevel`, which every\n * authenticate-shaped request carries. They are different vocabularies on purpose — the UI has no\n * `IDENTIFICATION` page — so a UI level must be translated at the seam, never forwarded.\n *\n * Measured 2026-09-15: the passkey sign-in forwarded `'first'` verbatim into\n * `POST /auth/passkey/authenticate/verify`. The orchestrator's `=== FIRST` branch did not match it,\n * treated the attempt as a second factor, and the response it built failed the wire enum — `400\n * validation` on every passkey sign-in, and the same for passkey as an MFA second factor, which\n * forwarded `'second'`. The password and OTP paths never hit it because they write\n * `AuthFactorLevel.FIRST` / `.SECOND` by hand at their own sites; this function is where that\n * translation now lives once.\n */\nexport function authFactorLevelForUiLevel(level: UIFactorLevel): AuthFactorLevel {\n  return level === 'second' ? AuthFactorLevel.SECOND : AuthFactorLevel.FIRST;\n}\n\n/**\n * How a username-less passkey sign-in asks the browser for a credential.\n *\n * The distinction is about who starts the prompt, and it decides how a failure is shown:\n *\n * - `CONDITIONAL` — passkey AUTOFILL. Started silently when the sign-in page renders; the browser offers\n *   the person's passkeys in the email field's autofill list and the call waits until one is picked. It\n *   may never resolve, is aborted when the page moves on, and a failure before a passkey is picked is\n *   NOT an error the person caused — so nothing is shown for it.\n * - `MODAL` — the person pressed \"Sign in with a passkey\". The browser shows its account picker at once,\n *   and every failure, cancellation included, is reported on the page.\n *\n * spec-cite: https://web.dev/articles/passkey-form-autofill — conditional UI is invoked with `mediation: 'conditional'`, \"the crucial flag that makes the WebAuthn API call conditional. It tells the browser to wait for user interaction.\"\n */\nexport enum PasskeySignInMediation {\n  CONDITIONAL = 'conditional',\n  MODAL = 'modal',\n}\n\n/**\n * A waiting passkey AUTOFILL request was stopped because its challenge was about to expire.\n *\n * Autofill waits for as long as the sign-in page stays open, but the server's challenge — and the\n * username-less session bound to it — lasts `expiresInSeconds`. Picking a passkey after that would fail\n * on a session that no longer exists, so the context stops the wait shortly before and throws THIS, and\n * the sign-in page starts a fresh request. Any other refusal of an autofill wait (the page moving on, the\n * button starting its own ceremony) is NOT this error, which is what stops the page restarting over a\n * ceremony the person began.\n */\nexport class PasskeyAutofillExpiredError extends Error {\n  constructor() {\n    super('Passkey autofill challenge expired before a passkey was picked');\n    this.name = 'PasskeyAutofillExpiredError';\n  }\n}\n\n/**\n * Thrown by a passkey AUTOFILL ceremony that stepped aside because a ceremony the person started\n * themselves (the passkey button, or a second-factor passkey step) is already open.\n *\n * Starting a WebAuthn request aborts any pending one, so an autofill whose options arrived after the\n * button opened its prompt would close the prompt the person is looking at. The autofill loop treats this\n * like any other refusal and stops; the page starts a fresh autofill once the person's ceremony ends.\n */\nexport class PasskeyAutofillSupersededError extends Error {\n  constructor() {\n    super('Passkey autofill stepped aside for a ceremony the person started');\n    this.name = 'PasskeyAutofillSupersededError';\n  }\n}\n"]}
+{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,eAAe,GAKhB,MAAM,uBAAuB,CAAC;AA6G/B;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,mBAAmB,EAAE,IAAI;IACzB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;IACxB,2BAA2B,EAAE,SAAS;CACvC,CAAC;AAUF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAoB;IAC5D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,qDAA2B,CAAA;IAC3B,yCAAe,CAAA;AACjB,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD;QACE,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD;QACE,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF","sourcesContent":["/**\n * Security Frontend Schemas\n * \n * Core authentication and authorization types for the frontend security layer.\n */\n\nimport { z } from 'zod';\nimport { \n  AuthIdentificationResponse,\n  AuthFactorLevel,\n  SessionType,\n  type AuthMethod,\n  type AvailableMethod,\n  type AuthSessionPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Authentication state — contains only authentication-related fields.\n *\n * **No `refreshToken` field** (Auth-hardening Slice A Step 6,\n * 2026-04-13). Pre-Slice-A this carried `refreshToken: string | null`\n * mirroring the legacy body-channel rotation contract. A-Step 2\n * (cookie migration) made the cookie the sole owner of the refresh\n * token, A-Step 3 stopped this state from being read by any consumer,\n * and A-Step 6 dropped the field entirely. The refresh token now lives\n * EXCLUSIVELY in the `__wildo_refresh` `HttpOnly` cookie — JS-invisible\n * by design (XSS exfiltration surface closed). Consumers that want to\n * \"check if the user has a valid session\" should look at `accessToken`\n * (or `sessionRestored`) — never at the cookie, which is opaque to JS.\n */\nexport interface AuthState {\n  isLoading: boolean;\n  error: string | null;\n  sessionId: string | null;\n  accessToken: string | null;\n  identification: AuthIdentificationResponse | null;\n  sessionState: any | null;\n  isRestoringSession: boolean;\n  sessionRestored: boolean;\n  mfaRequired: boolean;\n  mfaSessionId: string | null;\n  availableMfaMethods: AvailableMethod[];\n  availableEnrollmentMethods: AuthMethod[];\n  enrolledSecondFactorMethods: string[];\n  usableSecondFactorMethods: string[];\n  /**\n   * The authentication session an answer parked at organization onboarding (#1090), or `null`.\n   *\n   * Set by an answer that parked the account — a registration, an email verification, an enrollment settlement,\n   * a sign-in (#1091) or a federated sign-in's code exchange (#1103) — and read together with `accessToken`: while it is set and no token is held, the one\n   * step left is naming the organization the account's user type owes. The sign-in, registration, verification,\n   * magic-link, challenge, enrollment and federated-callback screens send the person to the organization-onboarding step in that\n   * state (`organizationOnboardingNavigationTarget`). Cleared by completing onboarding, by abandoning it, by a\n   * spent session, by a new identification and by sign-out. Memory only, deliberately: the obligation is durable\n   * on the server, so a lost tab signs in again and is parked again.\n   */\n  onboardingSessionId: string | null;\n  purpose: AuthSessionPurpose | null;\n  /** W7.3b: Session type — null before authentication is resolved. */\n  sessionType: SessionType | null;\n  /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */\n  oneOffContext?: {\n    originTokenId: string;\n    tokenType: string;\n    consumableTokenValue?: string;\n    tokenExpiresAt?: string;\n    scopedInitiatorIds?: Record<string, string>;\n    applicationId?: string;\n  };\n  /**\n   * cross-app-jwt-propagation.md Step 5: Context data populated when an\n   * AUTH_CODE_EXCHANGE token was minted by the cross-frontend-handoff issuer.\n   * `AuthSessionContext.handleAuthCodeExchange()` populates this field only\n   * when the token-exchange response carries a top-level `returnPath`; OAuth2\n   * callback codes omit that field and therefore leave this context undefined.\n   *\n   * Distinct from `oneOffContext` on purpose (semantic distinction over\n   * convenience — see `design-philosophy.mdc`):\n   *   - `oneOffContext` describes a W7.3b ephemeral one-off session\n   *     (resource-scoped targeting, applicationId, consumable replay).\n   *   - `crossFrontendHandoffContext` describes a session-transfer landing\n   *     (returnPath, source/target frontend telemetry). The session itself\n   *     is a regular persistent session driven by the receiver's storage\n   *     adapter (cross-app-jwt-propagation.md K-7).\n   *\n   * Consumed by `Auth_OneOffSession` in cross-frontend-handoff mode to drive\n   * post-exchange navigation (`returnPath`); also available to app-level\n   * telemetry hooks that want to know \"this user just landed via a handoff\n   * from $sourceFrontendServiceName\".\n   */\n  crossFrontendHandoffContext?: {\n    /**\n     * Path to navigate to after the exchange completes. Already passed\n     * `CrossFrontendHandoff_ReturnPathSchema` refines at issuance, but\n     * receivers MUST sanitize defense-in-depth (a malicious caller could\n     * hand-craft an exchange URL bypassing the issuer).\n     */\n    returnPath: string;\n    /**\n     * The frontend that initiated the handoff (e.g., `'admin-console'`).\n     * Optional because the source frontend identifies itself only via the\n     * `X-Frontend-Service-Name` request header (set by the shared HTTP\n     * client interceptor). Non-browser callers — server-to-server\n     * invocations, hand-crafted curl sessions — may legitimately omit\n     * the header (the issuer falls back to \"unknown\" source for audit\n     * purposes), in which case the receiver simply has no source\n     * identity to display in telemetry / breadcrumbs.\n     */\n    sourceFrontendServiceName?: string;\n    /** The target frontend the handoff was minted for. Useful for telemetry / breadcrumb rendering. */\n    targetServiceKey?: string;\n  };\n}\n\n/**\n * Effective permissions for the current user\n * Contains app-level permissions and per-organization permissions\n */\nexport type EffectivePermissions = {\n  appLevel: string[];\n  organizations: Record<string, string[]>;\n};\n\n/**\n * Empty/initial authentication state\n */\nexport const EMPTY_AUTH_STATE: AuthState = {\n  isLoading: false,\n  error: null,\n  sessionId: null,\n  accessToken: null,\n  identification: null,\n  sessionState: null,\n  isRestoringSession: false,\n  sessionRestored: false,\n  mfaRequired: false,\n  mfaSessionId: null,\n  availableMfaMethods: [],\n  availableEnrollmentMethods: [],\n  enrolledSecondFactorMethods: [],\n  usableSecondFactorMethods: [],\n  onboardingSessionId: null,\n  purpose: null,\n  sessionType: null,\n  oneOffContext: undefined,\n  crossFrontendHandoffContext: undefined,\n};\n\n// ─── Auth UI State Types ─────────────────────────────────────────────\n\nexport type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';\n\nexport type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';\n\nexport type UIFactorLevel = 'first' | 'second';\n\n/**\n * The ONE translation between the UI's factor vocabulary (`'first' | 'second'`, which selects the\n * page, its labels and its layout) and the wire vocabulary `AuthFactorLevel`, which every\n * authenticate-shaped request carries. They are different vocabularies on purpose — the UI has no\n * `IDENTIFICATION` page — so a UI level must be translated at the seam, never forwarded.\n *\n * Measured 2026-09-15: the passkey sign-in forwarded `'first'` verbatim into\n * `POST /auth/passkey/authenticate/verify`. The orchestrator's `=== FIRST` branch did not match it,\n * treated the attempt as a second factor, and the response it built failed the wire enum — `400\n * validation` on every passkey sign-in, and the same for passkey as an MFA second factor, which\n * forwarded `'second'`. The password and OTP paths never hit it because they write\n * `AuthFactorLevel.FIRST` / `.SECOND` by hand at their own sites; this function is where that\n * translation now lives once.\n */\nexport function authFactorLevelForUiLevel(level: UIFactorLevel): AuthFactorLevel {\n  return level === 'second' ? AuthFactorLevel.SECOND : AuthFactorLevel.FIRST;\n}\n\n/**\n * How a username-less passkey sign-in asks the browser for a credential.\n *\n * The distinction is about who starts the prompt, and it decides how a failure is shown:\n *\n * - `CONDITIONAL` — passkey AUTOFILL. Started silently when the sign-in page renders; the browser offers\n *   the person's passkeys in the email field's autofill list and the call waits until one is picked. It\n *   may never resolve, is aborted when the page moves on, and a failure before a passkey is picked is\n *   NOT an error the person caused — so nothing is shown for it.\n * - `MODAL` — the person pressed \"Sign in with a passkey\". The browser shows its account picker at once,\n *   and every failure, cancellation included, is reported on the page.\n *\n * spec-cite: https://web.dev/articles/passkey-form-autofill — conditional UI is invoked with `mediation: 'conditional'`, \"the crucial flag that makes the WebAuthn API call conditional. It tells the browser to wait for user interaction.\"\n */\nexport enum PasskeySignInMediation {\n  CONDITIONAL = 'conditional',\n  MODAL = 'modal',\n}\n\n/**\n * A waiting passkey AUTOFILL request was stopped because its challenge was about to expire.\n *\n * Autofill waits for as long as the sign-in page stays open, but the server's challenge — and the\n * username-less session bound to it — lasts `expiresInSeconds`. Picking a passkey after that would fail\n * on a session that no longer exists, so the context stops the wait shortly before and throws THIS, and\n * the sign-in page starts a fresh request. Any other refusal of an autofill wait (the page moving on, the\n * button starting its own ceremony) is NOT this error, which is what stops the page restarting over a\n * ceremony the person began.\n */\nexport class PasskeyAutofillExpiredError extends Error {\n  constructor() {\n    super('Passkey autofill challenge expired before a passkey was picked');\n    this.name = 'PasskeyAutofillExpiredError';\n  }\n}\n\n/**\n * Thrown by a passkey AUTOFILL ceremony that stepped aside because a ceremony the person started\n * themselves (the passkey button, or a second-factor passkey step) is already open.\n *\n * Starting a WebAuthn request aborts any pending one, so an autofill whose options arrived after the\n * button opened its prompt would close the prompt the person is looking at. The autofill loop treats this\n * like any other refusal and stops; the page starts a fresh autofill once the person's ceremony ends.\n */\nexport class PasskeyAutofillSupersededError extends Error {\n  constructor() {\n    super('Passkey autofill stepped aside for a ceremony the person started');\n    this.name = 'PasskeyAutofillSupersededError';\n  }\n}\n"]}

package/dist/esm/core/security/session-token-storage.frontend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-storage.frontend.service.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,CAAC;CACf;AAQD,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI;IAG/B;;;;;;OAMG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI;IAGhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAY1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK7C,KAAK,IAAI,IAAI;CAKd;AAED,qBAAa,4BAA6B,YAAW,mBAAmB;IACtE,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAAuB;IAE9C,cAAc,IAAI,MAAM,GAAG,IAAI;IAC/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAChC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAC7C,KAAK,IAAI,IAAI;CAKd"}
+{"version":3,"file":"session-token-storage.frontend.service.d.ts","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,CAAC;CACf;AAQD,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI;IAG/B;;;;;;OAMG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI;IAGhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAY1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK7C,KAAK,IAAI,IAAI;CAKd;AAED,qBAAa,4BAA6B,YAAW,mBAAmB;IACtE,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAAuB;IAE9C,cAAc,IAAI,MAAM,GAAG,IAAI;IAC/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAChC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAC7C,KAAK,IAAI,IAAI;CAKd"}

package/dist/esm/core/security/session-token-storage.frontend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-storage.frontend.service.js","sourceRoot":"","sources":["../../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iEAAiE,CAAC;AAazE;;;GAGG;AACH,IAAI,8BAA8B,GAAG,KAAK,CAAC;AAE3C,MAAM,OAAO,6BAA6B;IACxC,cAAc;QACZ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD;;;;;;OAMG;IACH,eAAe;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,WAAW;YACT,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAC7D,8BAA8B,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,CACV,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,iBAAiB;QACf,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,iBAAiB,CAAC,KAAoB;QACpC,KAAK;YACH,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzD,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IACpC,eAAe,GAAkB,IAAI,CAAC;IAE9C,cAAc,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,eAAe,KAAoB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IACD,iBAAiB,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,iBAAiB,CAAC,KAAoB,IAAU,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;IAC/E,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;CACF","sourcesContent":["/**\n * W7.3b: Session Token Storage — Strategy pattern for token persistence.\n *\n * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).\n * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).\n *\n * Auth-hardening Slice A Step 3 (2026-04-13) — `PersistentSessionTokenStorage`\n * NO LONGER persists the refresh token in localStorage. The refresh token now\n * travels via the `__wildo_refresh` `HttpOnly` cookie (see\n * `auth-controller.utils.ts` and `authentication-controller.backend.service.ts`).\n * The cookie is invisible to JS, which closes the XSS exfiltration surface\n * that ANY localStorage-backed refresh token inherently has.\n *\n * The `storeTokens()` signature still accepts a `refreshToken` parameter for\n * source-compat with `EphemeralSessionTokenStorage` (which keeps the in-memory\n * field for one-off / test contexts), but `PersistentSessionTokenStorage`\n * silently ignores the argument and emits a one-line `console.warn` if a\n * non-null value is passed during the transition window. The existing\n * `removeLocalStorageItem(REFRESH_TOKEN)` is kept on every `storeTokens()`\n * AND `clear()` invocation so any leftover localStorage value from a\n * pre-migration session is wiped on the user's next interaction.\n */\n\nimport {\n  LOCAL_STORAGE_KEYS,\n  getLocalStorageItem,\n  setLocalStorageItem,\n  removeLocalStorageItem,\n} from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\nexport interface SessionTokenStorage {\n  getAccessToken(): string | null;\n  getRefreshToken(): string | null;\n  storeTokens(accessToken: string | null, refreshToken: string | null): void;\n\n  getOrganizationId(): string | null;\n  setOrganizationId(orgId: string | null): void;\n\n  clear(): void;\n}\n\n/**\n * Module-scoped flag — emit the deprecation warning ONCE per page load even if\n * `storeTokens()` is called many times during a session. Avoids log spam.\n */\nlet _refreshTokenArgWarningEmitted = false;\n\nexport class PersistentSessionTokenStorage implements SessionTokenStorage {\n  getAccessToken(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n  }\n  /**\n   * Always returns `null` — refresh tokens no longer live in localStorage\n   * (Auth-hardening Slice A Step 3). The `__wildo_refresh` `HttpOnly` cookie\n   * carries the refresh token; JS can never read it. Method kept for\n   * `SessionTokenStorage` interface conformance — `EphemeralSessionTokenStorage`\n   * still uses it for in-memory contexts.\n   */\n  getRefreshToken(): string | null {\n    return null;\n  }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    accessToken\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN, accessToken)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    if (refreshToken !== null && !_refreshTokenArgWarningEmitted) {\n      _refreshTokenArgWarningEmitted = true;\n      console.warn(\n        '[wildo-auth] PersistentSessionTokenStorage.storeTokens() received a non-null refreshToken — argument is ignored. Refresh tokens now travel via the `__wildo_refresh` HttpOnly cookie (Auth-hardening Slice A).',\n      );\n    }\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n  }\n  getOrganizationId(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  setOrganizationId(orgId: string | null): void {\n    orgId\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID, orgId)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  clear(): void {\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n}\n\nexport class EphemeralSessionTokenStorage implements SessionTokenStorage {\n  private _accessToken: string | null = null;\n  private _refreshToken: string | null = null;\n  private _organizationId: string | null = null;\n\n  getAccessToken(): string | null { return this._accessToken; }\n  getRefreshToken(): string | null { return this._refreshToken; }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    this._accessToken = accessToken;\n    this._refreshToken = refreshToken;\n  }\n  getOrganizationId(): string | null { return this._organizationId; }\n  setOrganizationId(orgId: string | null): void { this._organizationId = orgId; }\n  clear(): void {\n    this._accessToken = null;\n    this._refreshToken = null;\n    this._organizationId = null;\n  }\n}\n"]}
+{"version":3,"file":"session-token-storage.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iEAAiE,CAAC;AAazE;;;GAGG;AACH,IAAI,8BAA8B,GAAG,KAAK,CAAC;AAE3C,MAAM,OAAO,6BAA6B;IACxC,cAAc;QACZ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD;;;;;;OAMG;IACH,eAAe;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,WAAW;YACT,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAC7D,8BAA8B,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,CACV,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,iBAAiB;QACf,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,iBAAiB,CAAC,KAAoB;QACpC,KAAK;YACH,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzD,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IACpC,eAAe,GAAkB,IAAI,CAAC;IAE9C,cAAc,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,eAAe,KAAoB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IACD,iBAAiB,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,iBAAiB,CAAC,KAAoB,IAAU,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;IAC/E,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;CACF","sourcesContent":["/**\n * W7.3b: Session Token Storage — Strategy pattern for token persistence.\n *\n * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).\n * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).\n *\n * Auth-hardening Slice A Step 3 (2026-04-13) — `PersistentSessionTokenStorage`\n * NO LONGER persists the refresh token in localStorage. The refresh token now\n * travels via the `__wildo_refresh` `HttpOnly` cookie (see\n * `auth-controller.utils.ts` and `authentication-controller.backend.service.ts`).\n * The cookie is invisible to JS, which closes the XSS exfiltration surface\n * that ANY localStorage-backed refresh token inherently has.\n *\n * The `storeTokens()` signature still accepts a `refreshToken` parameter for\n * source-compat with `EphemeralSessionTokenStorage` (which keeps the in-memory\n * field for one-off / test contexts), but `PersistentSessionTokenStorage`\n * silently ignores the argument and emits a one-line `console.warn` if a\n * non-null value is passed during the transition window. The existing\n * `removeLocalStorageItem(REFRESH_TOKEN)` is kept on every `storeTokens()`\n * AND `clear()` invocation so any leftover localStorage value from a\n * pre-migration session is wiped on the user's next interaction.\n */\n\nimport {\n  LOCAL_STORAGE_KEYS,\n  getLocalStorageItem,\n  setLocalStorageItem,\n  removeLocalStorageItem,\n} from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\nexport interface SessionTokenStorage {\n  getAccessToken(): string | null;\n  getRefreshToken(): string | null;\n  storeTokens(accessToken: string | null, refreshToken: string | null): void;\n\n  getOrganizationId(): string | null;\n  setOrganizationId(orgId: string | null): void;\n\n  clear(): void;\n}\n\n/**\n * Module-scoped flag — emit the deprecation warning ONCE per page load even if\n * `storeTokens()` is called many times during a session. Avoids log spam.\n */\nlet _refreshTokenArgWarningEmitted = false;\n\nexport class PersistentSessionTokenStorage implements SessionTokenStorage {\n  getAccessToken(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n  }\n  /**\n   * Always returns `null` — refresh tokens no longer live in localStorage\n   * (Auth-hardening Slice A Step 3). The `__wildo_refresh` `HttpOnly` cookie\n   * carries the refresh token; JS can never read it. Method kept for\n   * `SessionTokenStorage` interface conformance — `EphemeralSessionTokenStorage`\n   * still uses it for in-memory contexts.\n   */\n  getRefreshToken(): string | null {\n    return null;\n  }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    accessToken\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN, accessToken)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    if (refreshToken !== null && !_refreshTokenArgWarningEmitted) {\n      _refreshTokenArgWarningEmitted = true;\n      console.warn(\n        '[wildo-auth] PersistentSessionTokenStorage.storeTokens() received a non-null refreshToken — argument is ignored. Refresh tokens now travel via the `__wildo_refresh` HttpOnly cookie (Auth-hardening Slice A).',\n      );\n    }\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n  }\n  getOrganizationId(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  setOrganizationId(orgId: string | null): void {\n    orgId\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID, orgId)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  clear(): void {\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n}\n\nexport class EphemeralSessionTokenStorage implements SessionTokenStorage {\n  private _accessToken: string | null = null;\n  private _refreshToken: string | null = null;\n  private _organizationId: string | null = null;\n\n  getAccessToken(): string | null { return this._accessToken; }\n  getRefreshToken(): string | null { return this._refreshToken; }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    this._accessToken = accessToken;\n    this._refreshToken = refreshToken;\n  }\n  getOrganizationId(): string | null { return this._organizationId; }\n  setOrganizationId(orgId: string | null): void { this._organizationId = orgId; }\n  clear(): void {\n    this._accessToken = null;\n    this._refreshToken = null;\n    this._organizationId = null;\n  }\n}\n"]}

package/dist/esm/core/security/useAuthSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,sBAMjC,CAAC"}
+{"version":3,"file":"useAuthSession.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,sBAMjC,CAAC"}

package/dist/esm/core/security/useAuthSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA+B,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA2B,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useAuthSession Hook\n * \n * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { AuthSessionContext, type AuthSessionContextType } from './AuthSessionContext';\n/**\n * Hook to access the Auth Session context\n * @returns AuthSessionContextType with auth state and authentication functions\n * @throws Error if used outside of AuthSessionProvider\n */\nexport const useAuthSession = (): AuthSessionContextType => {\n  const context = useContext(AuthSessionContext);\n  if (!context) {\n    throw new Error('useAuthSession must be used within an AuthSessionProvider');\n  }\n  return context;\n};\n"]}
+{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA+B,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA2B,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useAuthSession Hook\n * \n * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { AuthSessionContext, type AuthSessionContextType } from './AuthSessionContext';\n/**\n * Hook to access the Auth Session context\n * @returns AuthSessionContextType with auth state and authentication functions\n * @throws Error if used outside of AuthSessionProvider\n */\nexport const useAuthSession = (): AuthSessionContextType => {\n  const context = useContext(AuthSessionContext);\n  if (!context) {\n    throw new Error('useAuthSession must be used within an AuthSessionProvider');\n  }\n  return context;\n};\n"]}

package/dist/esm/core/security/useConsentGateBehavior.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useConsentGateBehavior.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useConsentGateBehavior.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,mCAAmC;IACnC,QAAQ,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,UAAU,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,qBAAqB,EAAE,SAAS,cAAc,EAAE,CAAC;IACjD;;;;;;;;OAQG;IACH,MAAM,EAAE,CACN,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,yBAAyB,CAAC,EAAE,OAAO,KAChC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,kEAAkE;IAClE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,mBAAmB,CAkD5D"}
+{"version":3,"file":"useConsentGateBehavior.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useConsentGateBehavior.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,mCAAmC;IACnC,QAAQ,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,UAAU,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,qBAAqB,EAAE,SAAS,cAAc,EAAE,CAAC;IACjD;;;;;;;;OAQG;IACH,MAAM,EAAE,CACN,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,yBAAyB,CAAC,EAAE,OAAO,KAChC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,kEAAkE;IAClE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,mBAAmB,CAkD5D"}

package/dist/esm/core/security/useConsentGateBehavior.js.map

@@ -1 +1 @@
-{"version":3,"file":"useConsentGateBehavior.js","sourceRoot":"","sources":["../../../../../src/core/security/useConsentGateBehavior.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AA8BxE;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAA4B,EAAE,CAAC,CAAC;IAElG,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,sBAAsB,CAAC;QAC3B,yBAAyB,EAAE,SAAS,CAAC,UAAU,EAAE,yBAAyB;QAC1E,gBAAgB,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI;QACvD,wBAAwB,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,KAAK,KAAK;QACxE,iCAAiC,EAAE,SAAS,CAAC,UAAU,EAAE,iCAAiC;QAC1F,OAAO;KACR,CAAC,EACF;QACE,SAAS,CAAC,SAAS,EAAE,OAAO;QAC5B,SAAS,CAAC,SAAS,EAAE,eAAe;QACpC,SAAS,CAAC,UAAU,EAAE,yBAAyB;QAC/C,SAAS,CAAC,UAAU,EAAE,iCAAiC;QACvD,OAAO;KACR,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAC9B,OAAkC,EAClC,QAAmC,EACnC,yBAAyB,GAAG,KAAK,EAClB,EAAE;QACjB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAClD,wFAAwF;YACxF,+CAA+C;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAC7B,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,sBAAsB,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC,CAAC;IAEnC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5F,CAAC","sourcesContent":["import { useCallback, useMemo, useState } from 'react';\nimport type { ConsentPurpose } from '@wildo-ai/saas-models';\n\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport {\n  composeConsentDecision,\n  consentWithdrawalCost,\n  deriveConsentGateState,\n  type ConsentGateState,\n} from './consent-gate.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\n\nexport interface ConsentGateBehavior extends ConsentGateState {\n  /** A decision is being written. */\n  isSaving: boolean;\n  /** The last decision could not be written; the gate stays in its current state. */\n  saveFailed: boolean;\n  /**\n   * The required purposes the LAST `decide()` call would have left unmet, held here because it was not\n   * acknowledged (R9). Cleared by any subsequent `decide()` call, whatever it decides.\n   */\n  pendingWithdrawalCost: readonly ConsentPurpose[];\n  /**\n   * Record the person's choice among `offered` purposes: each offered purpose is granted exactly when it\n   * is in `selected`, and every purpose not offered keeps its stored grant.\n   *\n   * Withdrawing a required purpose is never refused — consent must be as easy to withdraw as to give —\n   * but it is never SILENT either (R9). When the choice would leave a required purpose unmet, the first\n   * call reports the cost via `pendingWithdrawalCost` and saves NOTHING; pass\n   * `acknowledgeWithdrawalCost: true` once the surface has shown that cost to save anyway.\n   */\n  decide: (\n    offered: readonly ConsentPurpose[],\n    selected: readonly ConsentPurpose[],\n    acknowledgeWithdrawalCost?: boolean,\n  ) => Promise<void>;\n  /** Leave the application instead of granting required consent. */\n  signOut: () => void;\n}\n\n/**\n * The application-tier consent gate's behaviour (#534 / #453): reads the application's requirement and\n * analytics posture, reads the person's stored decision, and writes decisions through\n * `UserOrgsContext.recordConsentDecision` — the self-preferences UPDATE whose server-side hook owns the\n * decision instant and whose `privacy.consentedPurposes` is audit evidence.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — an affirmative, recorded choice replaces a default;\n * required purposes are enforced before any signed-in route renders.\n */\nexport function useConsentGateBehavior(): ConsentGateBehavior {\n  const { appConfig } = useApplication();\n  const { privacy, recordConsentDecision, logout } = useUserOrgs();\n  const [isSaving, setIsSaving] = useState(false);\n  const [saveFailed, setSaveFailed] = useState(false);\n  const [pendingWithdrawalCost, setPendingWithdrawalCost] = useState<readonly ConsentPurpose[]>([]);\n\n  const state = useMemo(\n    () => deriveConsentGateState({\n      serviceConsentRequirement: appConfig.compliance?.serviceConsentRequirement,\n      analyticsEnabled: appConfig.analytics?.enabled === true,\n      analyticsRequiresConsent: appConfig.analytics?.requiresConsent !== false,\n      capabilityDeclaredConsentPurposes: appConfig.compliance?.capabilityDeclaredConsentPurposes,\n      privacy,\n    }),\n    [\n      appConfig.analytics?.enabled,\n      appConfig.analytics?.requiresConsent,\n      appConfig.compliance?.serviceConsentRequirement,\n      appConfig.compliance?.capabilityDeclaredConsentPurposes,\n      privacy,\n    ],\n  );\n\n  const decide = useCallback(async (\n    offered: readonly ConsentPurpose[],\n    selected: readonly ConsentPurpose[],\n    acknowledgeWithdrawalCost = false,\n  ): Promise<void> => {\n    setSaveFailed(false);\n    const cost = consentWithdrawalCost(state, offered, selected);\n    if (cost.length > 0 && !acknowledgeWithdrawalCost) {\n      // Report and stop — do NOT save. Refusing the withdrawal is not available (R9); what is\n      // available is not letting it happen silently.\n      setPendingWithdrawalCost(cost);\n      return;\n    }\n    setPendingWithdrawalCost([]);\n    setIsSaving(true);\n    try {\n      await recordConsentDecision(composeConsentDecision(state.grantedPurposes, offered, selected));\n    } catch (error) {\n      logger.error('Consent decision could not be recorded', { error });\n      setSaveFailed(true);\n    } finally {\n      setIsSaving(false);\n    }\n  }, [recordConsentDecision, state]);\n\n  return { ...state, isSaving, saveFailed, pendingWithdrawalCost, decide, signOut: logout };\n}\n"]}
+{"version":3,"file":"useConsentGateBehavior.js","sourceRoot":"","sources":["../../../../src/core/security/useConsentGateBehavior.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AA8BxE;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAA4B,EAAE,CAAC,CAAC;IAElG,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,sBAAsB,CAAC;QAC3B,yBAAyB,EAAE,SAAS,CAAC,UAAU,EAAE,yBAAyB;QAC1E,gBAAgB,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI;QACvD,wBAAwB,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,KAAK,KAAK;QACxE,iCAAiC,EAAE,SAAS,CAAC,UAAU,EAAE,iCAAiC;QAC1F,OAAO;KACR,CAAC,EACF;QACE,SAAS,CAAC,SAAS,EAAE,OAAO;QAC5B,SAAS,CAAC,SAAS,EAAE,eAAe;QACpC,SAAS,CAAC,UAAU,EAAE,yBAAyB;QAC/C,SAAS,CAAC,UAAU,EAAE,iCAAiC;QACvD,OAAO;KACR,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAC9B,OAAkC,EAClC,QAAmC,EACnC,yBAAyB,GAAG,KAAK,EAClB,EAAE;QACjB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAClD,wFAAwF;YACxF,+CAA+C;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAC7B,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,sBAAsB,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC,CAAC;IAEnC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5F,CAAC","sourcesContent":["import { useCallback, useMemo, useState } from 'react';\nimport type { ConsentPurpose } from '@wildo-ai/saas-models';\n\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport {\n  composeConsentDecision,\n  consentWithdrawalCost,\n  deriveConsentGateState,\n  type ConsentGateState,\n} from './consent-gate.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\n\nexport interface ConsentGateBehavior extends ConsentGateState {\n  /** A decision is being written. */\n  isSaving: boolean;\n  /** The last decision could not be written; the gate stays in its current state. */\n  saveFailed: boolean;\n  /**\n   * The required purposes the LAST `decide()` call would have left unmet, held here because it was not\n   * acknowledged (R9). Cleared by any subsequent `decide()` call, whatever it decides.\n   */\n  pendingWithdrawalCost: readonly ConsentPurpose[];\n  /**\n   * Record the person's choice among `offered` purposes: each offered purpose is granted exactly when it\n   * is in `selected`, and every purpose not offered keeps its stored grant.\n   *\n   * Withdrawing a required purpose is never refused — consent must be as easy to withdraw as to give —\n   * but it is never SILENT either (R9). When the choice would leave a required purpose unmet, the first\n   * call reports the cost via `pendingWithdrawalCost` and saves NOTHING; pass\n   * `acknowledgeWithdrawalCost: true` once the surface has shown that cost to save anyway.\n   */\n  decide: (\n    offered: readonly ConsentPurpose[],\n    selected: readonly ConsentPurpose[],\n    acknowledgeWithdrawalCost?: boolean,\n  ) => Promise<void>;\n  /** Leave the application instead of granting required consent. */\n  signOut: () => void;\n}\n\n/**\n * The application-tier consent gate's behaviour (#534 / #453): reads the application's requirement and\n * analytics posture, reads the person's stored decision, and writes decisions through\n * `UserOrgsContext.recordConsentDecision` — the self-preferences UPDATE whose server-side hook owns the\n * decision instant and whose `privacy.consentedPurposes` is audit evidence.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — an affirmative, recorded choice replaces a default;\n * required purposes are enforced before any signed-in route renders.\n */\nexport function useConsentGateBehavior(): ConsentGateBehavior {\n  const { appConfig } = useApplication();\n  const { privacy, recordConsentDecision, logout } = useUserOrgs();\n  const [isSaving, setIsSaving] = useState(false);\n  const [saveFailed, setSaveFailed] = useState(false);\n  const [pendingWithdrawalCost, setPendingWithdrawalCost] = useState<readonly ConsentPurpose[]>([]);\n\n  const state = useMemo(\n    () => deriveConsentGateState({\n      serviceConsentRequirement: appConfig.compliance?.serviceConsentRequirement,\n      analyticsEnabled: appConfig.analytics?.enabled === true,\n      analyticsRequiresConsent: appConfig.analytics?.requiresConsent !== false,\n      capabilityDeclaredConsentPurposes: appConfig.compliance?.capabilityDeclaredConsentPurposes,\n      privacy,\n    }),\n    [\n      appConfig.analytics?.enabled,\n      appConfig.analytics?.requiresConsent,\n      appConfig.compliance?.serviceConsentRequirement,\n      appConfig.compliance?.capabilityDeclaredConsentPurposes,\n      privacy,\n    ],\n  );\n\n  const decide = useCallback(async (\n    offered: readonly ConsentPurpose[],\n    selected: readonly ConsentPurpose[],\n    acknowledgeWithdrawalCost = false,\n  ): Promise<void> => {\n    setSaveFailed(false);\n    const cost = consentWithdrawalCost(state, offered, selected);\n    if (cost.length > 0 && !acknowledgeWithdrawalCost) {\n      // Report and stop — do NOT save. Refusing the withdrawal is not available (R9); what is\n      // available is not letting it happen silently.\n      setPendingWithdrawalCost(cost);\n      return;\n    }\n    setPendingWithdrawalCost([]);\n    setIsSaving(true);\n    try {\n      await recordConsentDecision(composeConsentDecision(state.grantedPurposes, offered, selected));\n    } catch (error) {\n      logger.error('Consent decision could not be recorded', { error });\n      setSaveFailed(true);\n    } finally {\n      setIsSaving(false);\n    }\n  }, [recordConsentDecision, state]);\n\n  return { ...state, isSaving, saveFailed, pendingWithdrawalCost, decide, signOut: logout };\n}\n"]}

package/dist/esm/core/security/useDocumentAcceptanceGateBehavior.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useDocumentAcceptanceGateBehavior.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useDocumentAcceptanceGateBehavior.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,oCAAoC,EAQrC,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EACV,+BAA+B,EAEhC,MAAM,6EAA6E,CAAC;AAErF,iDAAiD;AACjD,oBAAY,4BAA4B;IACtC,gHAAgH;IAChH,cAAc,mBAAmB;IACjC,oGAAoG;IACpG,QAAQ,aAAa;IACrB,uBAAuB;IACvB,SAAS,cAAc;IACvB,yGAAyG;IACzG,QAAQ,aAAa;IACrB;;;;;OAKG;IACH,WAAW,gBAAgB;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;IAC9C,qHAAqH;IACrH,QAAQ,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,CAAC;IAClE,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC;IACrD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iCAAiC,IAAI,8BAA8B,CAkHlF"}
+{"version":3,"file":"useDocumentAcceptanceGateBehavior.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useDocumentAcceptanceGateBehavior.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,oCAAoC,EAQrC,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EACV,+BAA+B,EAEhC,MAAM,6EAA6E,CAAC;AAErF,iDAAiD;AACjD,oBAAY,4BAA4B;IACtC,gHAAgH;IAChH,cAAc,mBAAmB;IACjC,oGAAoG;IACpG,QAAQ,aAAa;IACrB,uBAAuB;IACvB,SAAS,cAAc;IACvB,yGAAyG;IACzG,QAAQ,aAAa;IACrB;;;;;OAKG;IACH,WAAW,gBAAgB;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;IAC9C,qHAAqH;IACrH,QAAQ,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,CAAC;IAClE,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC;IACrD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iCAAiC,IAAI,8BAA8B,CAkHlF"}

package/dist/esm/core/security/useDocumentAcceptanceGateBehavior.js.map

@@ -1 +1 @@
-{"version":3,"file":"useDocumentAcceptanceGateBehavior.js","sourceRoot":"","sources":["../../../../../src/core/security/useDocumentAcceptanceGateBehavior.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAClE,OAAO,EACL,8BAA8B,EAE9B,+BAA+B,EAC/B,oCAAoC,EACpC,iCAAiC,EACjC,4BAA4B,GAI7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAMhG,iDAAiD;AACjD,MAAM,CAAN,IAAY,4BAgBX;AAhBD,WAAY,4BAA4B;IACtC,gHAAgH;IAChH,iEAAiC,CAAA;IACjC,oGAAoG;IACpG,qDAAqB,CAAA;IACrB,uBAAuB;IACvB,uDAAuB,CAAA;IACvB,yGAAyG;IACzG,qDAAqB,CAAA;IACrB;;;;;OAKG;IACH,2DAA2B,CAAA;AAC7B,CAAC,EAhBW,4BAA4B,KAA5B,4BAA4B,QAgBvC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,iCAAiC;IAC/C,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACjC,MAAM,EAAE,gBAAgB,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAErD,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,EAAE,8BAA8B,IAAI,8BAA8B,CAAC,iBAAiB,CAAC;IAChI;;;;OAIG;IACH,MAAM,wBAAwB,GAAG,iCAAiC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzF,MAAM,iBAAiB,GAAG,gBAAgB,KAAK,IAAI;WAC9C,CAAC,SAAS,CAAC,UAAU,EAAE,wBAAwB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACzE,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC,+BAA+B,CAAC,iBAAiB,CAAC;eACxF,CAAC,CAAC,wBAAwB,IAAI,OAAO,CAAC,aAAa,KAAK,oCAAoC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/G,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAwD,SAAS,CAAC,CAAC;IACnG,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAoB,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,iBAAiB;YAAE,OAAO,SAAS,CAAC;QACzC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,wBAAwB,EAAE,CAAC,kCAAkC,EAAE;aAC5D,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;aAC/D,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAExB,MAAM,gBAAgB,GAAG,OAAO,CAC9B,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EACrD,CAAC,IAAI,CAAC,CACP,CAAC;IACF,MAAM,iBAAiB,GAAG,OAAO,CAA0C,GAAG,EAAE;QAC9E,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxC,OAAO;YACP,QAAQ,EAAE,4BAA4B,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,EAAE;gBAC7H,eAAe,EAAE,wBAAwB;aAC1C,CAAC;SACH,CAAC,CAAC,CAAC;IACN,CAAC,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC,UAAU,EAAE,eAAe,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACxF,MAAM,eAAe,GAAG,OAAO,CAC7B,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,EACjD,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC,CACxC,CAAC;IAEF,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,OAAe,EAAE,EAAE;QACvD,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,MAAM,GAAG,CAAC,iBAAiB;QAC/B,CAAC,CAAC,4BAA4B,CAAC,cAAc;QAC7C,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,4BAA4B,CAAC,WAAW;YAC1C,CAAC,CAAC,IAAI,KAAK,SAAS;gBAClB,CAAC,CAAC,4BAA4B,CAAC,QAAQ;gBACvC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC;IAE3G;;;;OAIG;IACH,MAAM,SAAS,GAAG,cAAc,KAAK,8BAA8B,CAAC,sBAAsB,IAAI,QAAQ,CAAC;IAEvG,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACnD,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACxD,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,uBAAuB,CACvE,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAC;YACF;;;eAGG;YACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvB,WAAW,CAAC,KAAK,CAAC,CAAC;YACnB,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAElC,MAAM,UAAU,GAAG,OAAO,CAAkC,GAAG,EAAE,CAAC,CAAC;QACjE,gBAAgB;QAChB,cAAc;QACd,iBAAiB;QACjB,eAAe;QACf,QAAQ;QACR,WAAW;QACX,aAAa;QACb,gBAAgB;KACjB,CAAC,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEvH,OAAO;QACL,MAAM;QACN,MAAM,EAAE,MAAM,KAAK,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;QACxF,UAAU;QACV,SAAS;QACT,QAAQ;QACR,UAAU;QACV,MAAM;QACN,OAAO,EAAE,MAAM;KAChB,CAAC;AACJ,CAAC","sourcesContent":["import { useCallback, useEffect, useMemo, useState } from 'react';\nimport {\n  GovernedDocumentAcceptanceMode,\n  GovernedDocumentAcceptanceOwedReason,\n  GovernedDocumentInteractionKind,\n  GovernedDocumentReleaseApprovalState,\n  requiresApprovedGovernedDocuments,\n  resolveInForcePublicDocument,\n  type GovernedDocumentAcceptanceOwed,\n  type GovernedDocumentInteractionSurface,\n  type GovernedDocumentPublicDocument,\n} from '@wildo-ai/saas-models';\n\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\nimport type {\n  GovernedDocumentAcceptanceState,\n  RequiredDocumentPresentation,\n} from '~wildo-frontend-lib/components/compliance/GovernedDocumentAcceptanceControl';\n\n/** What the document acceptance gate must do. */\nexport enum DocumentAcceptanceGateStatus {\n  /** The application declares no release that asks for acceptance. Nothing is fetched, nothing is shown (R12). */\n  NOT_APPLICABLE = 'NOT_APPLICABLE',\n  /** The owed set is being read. The application renders meanwhile — see the hook's JSDoc for why. */\n  CHECKING = 'CHECKING',\n  /** Nothing is owed. */\n  SATISFIED = 'SATISFIED',\n  /** The person owes an acceptance: the gate stands in for the application until they give it or leave. */\n  REQUIRED = 'REQUIRED',\n  /**\n   * The owed set could not be read. The application renders, and the next session asks again.\n   *\n   * Distinct from SATISFIED on purpose: nothing was learned, so nothing is claimed. See the hook's\n   * JSDoc for why this opens rather than closes.\n   */\n  UNAVAILABLE = 'UNAVAILABLE',\n}\n\nexport interface DocumentAcceptanceGateBehavior {\n  readonly status: DocumentAcceptanceGateStatus;\n  /** Why the person is asked. Present exactly when `status` is REQUIRED; the first owed reason decides the heading. */\n  readonly reason: GovernedDocumentAcceptanceOwedReason | undefined;\n  /** The acceptance control's state — the same shape registration passes it. */\n  readonly acceptance: GovernedDocumentAcceptanceState;\n  /** Whether the person has done what the mode asks, so the accept action may run. */\n  readonly canAccept: boolean;\n  readonly isSaving: boolean;\n  readonly saveFailed: boolean;\n  /** Record the acceptance of every owed release, then re-read what is still owed. */\n  readonly accept: () => Promise<void>;\n  /** Leave the application instead of accepting. */\n  readonly signOut: () => void;\n}\n\n/**\n * The application-tier DOCUMENT ACCEPTANCE gate's behaviour (#1258, Step 2 / R7).\n *\n * A signed-in person owes an acceptance when they have never accepted a document the application\n * requires — a sign-up through a form that accepted nothing — or when a release changed it materially\n * since they last did. The server decides which (`GET /governed-documents/acceptances/owed`, over the\n * pure `governedDocumentAcceptancesOwed`), so the rule lives in one place.\n *\n * ## Four decisions this makes, each deliberately\n *\n * - **An application that asks for no acceptance never makes the request.** Decided here from the\n *   declared releases, before any network call, so a product with no terms pays nothing (R12).\n * - **A frontend service that authenticates no APPLICATION user never makes the request either.**\n *   An acceptance is owed by a user of the application — the rows the server reads are keyed on one\n *   — so a service whose `usersManagement` names no user type has nobody who could owe it. That is\n *   not hypothetical: the dev companion's workbench authors its entry EMPTY on purpose (its operator\n *   is the platform identity, never an application user), mounts a deliberate subset of the engine's\n *   controllers, and served the application's own releases in the config — so this gate asked\n *   `/governed-documents/acceptances/owed` on every session, the companion answered `404 Route not\n *   found`, and the error classifier rendered \"The companion has no record of this\" on Home\n *   (measured 2026-09-22). Decided from the same resolution `useResolvedAuthConfig` makes for the\n *   sign-in surfaces, so the two cannot disagree about whose acceptance a session can carry.\n * - **The application renders while the check is in flight.** Holding the whole shell on one request\n *   makes every sign-in wait on it, for the case — nothing owed — that is overwhelmingly the common\n *   one. The gate replaces the shell when the answer arrives.\n * - **A failed check OPENS, and says so (`UNAVAILABLE`).** Acceptance here is a rendering posture, not\n *   a server-side gate — the acceptance mode's own contract states that plainly — so failing closed\n *   would lock every signed-in person out of the product whenever one endpoint hiccups, to enforce\n *   something the server does not enforce. The next session asks again.\n *\n * ## The same acceptance control as registration\n *\n * `acceptance` is exactly the state `GovernedDocumentAcceptanceControl` takes, so this surface asks in\n * the same three modes, with the same reading gate and the same rules, as sign-up does.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a person whose agreement to a required document\n * is missing or superseded is asked again before the application renders, and their acceptance is\n * recorded against the exact release version through the same recorder as registration.\n */\nexport function useDocumentAcceptanceGateBehavior(): DocumentAcceptanceGateBehavior {\n  const { appConfig } = useApplication();\n  const { logout } = useUserOrgs();\n  const { resolvedUserType } = useResolvedAuthConfig();\n\n  const acceptanceMode = appConfig.compliance?.governedDocumentAcceptanceMode ?? GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX;\n  /*\n   * Both halves of the second decision above: somebody who can owe, and a release that asks. With the\n   * approval gate armed (#1565) only an APPROVED release asks — the backend owes nothing else, so an\n   * application whose releases are all unapproved skips the read entirely.\n   */\n  const requireApprovedDocuments = requiresApprovedGovernedDocuments(appConfig.compliance);\n  const asksForAcceptance = resolvedUserType !== null\n    && (appConfig.compliance?.governedDocumentReleases ?? []).some((release) =>\n      release.allowedInteractionKinds.includes(GovernedDocumentInteractionKind.CONTRACT_ACCEPTED)\n      && (!requireApprovedDocuments || release.approvalState === GovernedDocumentReleaseApprovalState.APPROVED));\n\n  const [owed, setOwed] = useState<readonly GovernedDocumentAcceptanceOwed[] | undefined>(undefined);\n  const [checkFailed, setCheckFailed] = useState(false);\n  const [accepted, setAccepted] = useState(false);\n  const [documentsRead, setDocumentsRead] = useState<readonly string[]>([]);\n  const [isSaving, setIsSaving] = useState(false);\n  const [saveFailed, setSaveFailed] = useState(false);\n\n  useEffect(() => {\n    if (!asksForAcceptance) return undefined;\n    let cancelled = false;\n    getManualCallsHttpClient().getOwedGovernedDocumentAcceptances()\n      .then((response) => { if (!cancelled) setOwed(response.owed); })\n      .catch(() => { if (!cancelled) setCheckFailed(true); });\n    return () => { cancelled = true; };\n  }, [asksForAcceptance]);\n\n  const requiredReleases = useMemo<readonly GovernedDocumentInteractionSurface[]>(\n    () => (owed ?? []).flatMap((entry) => entry.releases),\n    [owed],\n  );\n  const requiredDocuments = useMemo<readonly RequiredDocumentPresentation[]>(() => {\n    const at = new Date().toISOString();\n    return requiredReleases.map((release) => ({\n      release,\n      document: resolveInForcePublicDocument(appConfig.compliance?.publicDocuments ?? [], release.identity.document.documentRef, at, {\n        requireApproved: requireApprovedDocuments,\n      }),\n    }));\n  }, [requiredReleases, appConfig.compliance?.publicDocuments, requireApprovedDocuments]);\n  const servedDocuments = useMemo<readonly GovernedDocumentPublicDocument[]>(\n    () => appConfig.compliance?.publicDocuments ?? [],\n    [appConfig.compliance?.publicDocuments],\n  );\n\n  const markDocumentRead = useCallback((paneKey: string) => {\n    setDocumentsRead((current) => (current.includes(paneKey) ? current : [...current, paneKey]));\n  }, []);\n\n  const status = !asksForAcceptance\n    ? DocumentAcceptanceGateStatus.NOT_APPLICABLE\n    : checkFailed\n      ? DocumentAcceptanceGateStatus.UNAVAILABLE\n      : owed === undefined\n        ? DocumentAcceptanceGateStatus.CHECKING\n        : owed.length === 0 ? DocumentAcceptanceGateStatus.SATISFIED : DocumentAcceptanceGateStatus.REQUIRED;\n\n  /*\n   * The mode decides whether pressing the action IS the act (sign-in-wrap) or whether the box must be\n   * ticked first — the same predicate registration's submit uses, so the two cannot disagree. The\n   * reading gate is enforced by the control itself, which withholds the box until the end is reached.\n   */\n  const canAccept = acceptanceMode === GovernedDocumentAcceptanceMode.IMPLIED_BY_REGISTERING || accepted;\n\n  const accept = useCallback(async (): Promise<void> => {\n    if (!canAccept || requiredReleases.length === 0) return;\n    setIsSaving(true);\n    setSaveFailed(false);\n    try {\n      const response = await getManualCallsHttpClient().acceptGovernedDocuments(\n        requiredReleases.map((release) => release.identity.releaseId),\n      );\n      /*\n       * Let the person through on what the server says is STILL owed, never on having sent the\n       * request. A write that recorded nothing leaves the gate up, which is the only honest outcome.\n       */\n      setOwed(response.owed);\n      setAccepted(false);\n      setDocumentsRead([]);\n      if (response.owed.length > 0) setSaveFailed(true);\n    } catch {\n      setSaveFailed(true);\n    } finally {\n      setIsSaving(false);\n    }\n  }, [canAccept, requiredReleases]);\n\n  const acceptance = useMemo<GovernedDocumentAcceptanceState>(() => ({\n    requiredReleases,\n    acceptanceMode,\n    requiredDocuments,\n    servedDocuments,\n    accepted,\n    setAccepted,\n    documentsRead,\n    markDocumentRead,\n  }), [requiredReleases, acceptanceMode, requiredDocuments, servedDocuments, accepted, documentsRead, markDocumentRead]);\n\n  return {\n    status,\n    reason: status === DocumentAcceptanceGateStatus.REQUIRED ? owed?.[0]?.reason : undefined,\n    acceptance,\n    canAccept,\n    isSaving,\n    saveFailed,\n    accept,\n    signOut: logout,\n  };\n}\n"]}
+{"version":3,"file":"useDocumentAcceptanceGateBehavior.js","sourceRoot":"","sources":["../../../../src/core/security/useDocumentAcceptanceGateBehavior.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAClE,OAAO,EACL,8BAA8B,EAE9B,+BAA+B,EAC/B,oCAAoC,EACpC,iCAAiC,EACjC,4BAA4B,GAI7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAMhG,iDAAiD;AACjD,MAAM,CAAN,IAAY,4BAgBX;AAhBD,WAAY,4BAA4B;IACtC,gHAAgH;IAChH,iEAAiC,CAAA;IACjC,oGAAoG;IACpG,qDAAqB,CAAA;IACrB,uBAAuB;IACvB,uDAAuB,CAAA;IACvB,yGAAyG;IACzG,qDAAqB,CAAA;IACrB;;;;;OAKG;IACH,2DAA2B,CAAA;AAC7B,CAAC,EAhBW,4BAA4B,KAA5B,4BAA4B,QAgBvC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,iCAAiC;IAC/C,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACjC,MAAM,EAAE,gBAAgB,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAErD,MAAM,cAAc,GAAG,SAAS,CAAC,UAAU,EAAE,8BAA8B,IAAI,8BAA8B,CAAC,iBAAiB,CAAC;IAChI;;;;OAIG;IACH,MAAM,wBAAwB,GAAG,iCAAiC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzF,MAAM,iBAAiB,GAAG,gBAAgB,KAAK,IAAI;WAC9C,CAAC,SAAS,CAAC,UAAU,EAAE,wBAAwB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACzE,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC,+BAA+B,CAAC,iBAAiB,CAAC;eACxF,CAAC,CAAC,wBAAwB,IAAI,OAAO,CAAC,aAAa,KAAK,oCAAoC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/G,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAwD,SAAS,CAAC,CAAC;IACnG,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAoB,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,iBAAiB;YAAE,OAAO,SAAS,CAAC;QACzC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,wBAAwB,EAAE,CAAC,kCAAkC,EAAE;aAC5D,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;aAC/D,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAExB,MAAM,gBAAgB,GAAG,OAAO,CAC9B,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EACrD,CAAC,IAAI,CAAC,CACP,CAAC;IACF,MAAM,iBAAiB,GAAG,OAAO,CAA0C,GAAG,EAAE;QAC9E,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxC,OAAO;YACP,QAAQ,EAAE,4BAA4B,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,EAAE;gBAC7H,eAAe,EAAE,wBAAwB;aAC1C,CAAC;SACH,CAAC,CAAC,CAAC;IACN,CAAC,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC,UAAU,EAAE,eAAe,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACxF,MAAM,eAAe,GAAG,OAAO,CAC7B,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,EACjD,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,CAAC,CACxC,CAAC;IAEF,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,OAAe,EAAE,EAAE;QACvD,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,MAAM,GAAG,CAAC,iBAAiB;QAC/B,CAAC,CAAC,4BAA4B,CAAC,cAAc;QAC7C,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,4BAA4B,CAAC,WAAW;YAC1C,CAAC,CAAC,IAAI,KAAK,SAAS;gBAClB,CAAC,CAAC,4BAA4B,CAAC,QAAQ;gBACvC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC;IAE3G;;;;OAIG;IACH,MAAM,SAAS,GAAG,cAAc,KAAK,8BAA8B,CAAC,sBAAsB,IAAI,QAAQ,CAAC;IAEvG,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACnD,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACxD,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,uBAAuB,CACvE,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAC;YACF;;;eAGG;YACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvB,WAAW,CAAC,KAAK,CAAC,CAAC;YACnB,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAElC,MAAM,UAAU,GAAG,OAAO,CAAkC,GAAG,EAAE,CAAC,CAAC;QACjE,gBAAgB;QAChB,cAAc;QACd,iBAAiB;QACjB,eAAe;QACf,QAAQ;QACR,WAAW;QACX,aAAa;QACb,gBAAgB;KACjB,CAAC,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEvH,OAAO;QACL,MAAM;QACN,MAAM,EAAE,MAAM,KAAK,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;QACxF,UAAU;QACV,SAAS;QACT,QAAQ;QACR,UAAU;QACV,MAAM;QACN,OAAO,EAAE,MAAM;KAChB,CAAC;AACJ,CAAC","sourcesContent":["import { useCallback, useEffect, useMemo, useState } from 'react';\nimport {\n  GovernedDocumentAcceptanceMode,\n  GovernedDocumentAcceptanceOwedReason,\n  GovernedDocumentInteractionKind,\n  GovernedDocumentReleaseApprovalState,\n  requiresApprovedGovernedDocuments,\n  resolveInForcePublicDocument,\n  type GovernedDocumentAcceptanceOwed,\n  type GovernedDocumentInteractionSurface,\n  type GovernedDocumentPublicDocument,\n} from '@wildo-ai/saas-models';\n\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useResolvedAuthConfig } from '~wildo-frontend-lib/core/security/useResolvedAuthConfig';\nimport type {\n  GovernedDocumentAcceptanceState,\n  RequiredDocumentPresentation,\n} from '~wildo-frontend-lib/components/compliance/GovernedDocumentAcceptanceControl';\n\n/** What the document acceptance gate must do. */\nexport enum DocumentAcceptanceGateStatus {\n  /** The application declares no release that asks for acceptance. Nothing is fetched, nothing is shown (R12). */\n  NOT_APPLICABLE = 'NOT_APPLICABLE',\n  /** The owed set is being read. The application renders meanwhile — see the hook's JSDoc for why. */\n  CHECKING = 'CHECKING',\n  /** Nothing is owed. */\n  SATISFIED = 'SATISFIED',\n  /** The person owes an acceptance: the gate stands in for the application until they give it or leave. */\n  REQUIRED = 'REQUIRED',\n  /**\n   * The owed set could not be read. The application renders, and the next session asks again.\n   *\n   * Distinct from SATISFIED on purpose: nothing was learned, so nothing is claimed. See the hook's\n   * JSDoc for why this opens rather than closes.\n   */\n  UNAVAILABLE = 'UNAVAILABLE',\n}\n\nexport interface DocumentAcceptanceGateBehavior {\n  readonly status: DocumentAcceptanceGateStatus;\n  /** Why the person is asked. Present exactly when `status` is REQUIRED; the first owed reason decides the heading. */\n  readonly reason: GovernedDocumentAcceptanceOwedReason | undefined;\n  /** The acceptance control's state — the same shape registration passes it. */\n  readonly acceptance: GovernedDocumentAcceptanceState;\n  /** Whether the person has done what the mode asks, so the accept action may run. */\n  readonly canAccept: boolean;\n  readonly isSaving: boolean;\n  readonly saveFailed: boolean;\n  /** Record the acceptance of every owed release, then re-read what is still owed. */\n  readonly accept: () => Promise<void>;\n  /** Leave the application instead of accepting. */\n  readonly signOut: () => void;\n}\n\n/**\n * The application-tier DOCUMENT ACCEPTANCE gate's behaviour (#1258, Step 2 / R7).\n *\n * A signed-in person owes an acceptance when they have never accepted a document the application\n * requires — a sign-up through a form that accepted nothing — or when a release changed it materially\n * since they last did. The server decides which (`GET /governed-documents/acceptances/owed`, over the\n * pure `governedDocumentAcceptancesOwed`), so the rule lives in one place.\n *\n * ## Four decisions this makes, each deliberately\n *\n * - **An application that asks for no acceptance never makes the request.** Decided here from the\n *   declared releases, before any network call, so a product with no terms pays nothing (R12).\n * - **A frontend service that authenticates no APPLICATION user never makes the request either.**\n *   An acceptance is owed by a user of the application — the rows the server reads are keyed on one\n *   — so a service whose `usersManagement` names no user type has nobody who could owe it. That is\n *   not hypothetical: the dev companion's workbench authors its entry EMPTY on purpose (its operator\n *   is the platform identity, never an application user), mounts a deliberate subset of the engine's\n *   controllers, and served the application's own releases in the config — so this gate asked\n *   `/governed-documents/acceptances/owed` on every session, the companion answered `404 Route not\n *   found`, and the error classifier rendered \"The companion has no record of this\" on Home\n *   (measured 2026-09-22). Decided from the same resolution `useResolvedAuthConfig` makes for the\n *   sign-in surfaces, so the two cannot disagree about whose acceptance a session can carry.\n * - **The application renders while the check is in flight.** Holding the whole shell on one request\n *   makes every sign-in wait on it, for the case — nothing owed — that is overwhelmingly the common\n *   one. The gate replaces the shell when the answer arrives.\n * - **A failed check OPENS, and says so (`UNAVAILABLE`).** Acceptance here is a rendering posture, not\n *   a server-side gate — the acceptance mode's own contract states that plainly — so failing closed\n *   would lock every signed-in person out of the product whenever one endpoint hiccups, to enforce\n *   something the server does not enforce. The next session asks again.\n *\n * ## The same acceptance control as registration\n *\n * `acceptance` is exactly the state `GovernedDocumentAcceptanceControl` takes, so this surface asks in\n * the same three modes, with the same reading gate and the same rules, as sign-up does.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a person whose agreement to a required document\n * is missing or superseded is asked again before the application renders, and their acceptance is\n * recorded against the exact release version through the same recorder as registration.\n */\nexport function useDocumentAcceptanceGateBehavior(): DocumentAcceptanceGateBehavior {\n  const { appConfig } = useApplication();\n  const { logout } = useUserOrgs();\n  const { resolvedUserType } = useResolvedAuthConfig();\n\n  const acceptanceMode = appConfig.compliance?.governedDocumentAcceptanceMode ?? GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX;\n  /*\n   * Both halves of the second decision above: somebody who can owe, and a release that asks. With the\n   * approval gate armed (#1565) only an APPROVED release asks — the backend owes nothing else, so an\n   * application whose releases are all unapproved skips the read entirely.\n   */\n  const requireApprovedDocuments = requiresApprovedGovernedDocuments(appConfig.compliance);\n  const asksForAcceptance = resolvedUserType !== null\n    && (appConfig.compliance?.governedDocumentReleases ?? []).some((release) =>\n      release.allowedInteractionKinds.includes(GovernedDocumentInteractionKind.CONTRACT_ACCEPTED)\n      && (!requireApprovedDocuments || release.approvalState === GovernedDocumentReleaseApprovalState.APPROVED));\n\n  const [owed, setOwed] = useState<readonly GovernedDocumentAcceptanceOwed[] | undefined>(undefined);\n  const [checkFailed, setCheckFailed] = useState(false);\n  const [accepted, setAccepted] = useState(false);\n  const [documentsRead, setDocumentsRead] = useState<readonly string[]>([]);\n  const [isSaving, setIsSaving] = useState(false);\n  const [saveFailed, setSaveFailed] = useState(false);\n\n  useEffect(() => {\n    if (!asksForAcceptance) return undefined;\n    let cancelled = false;\n    getManualCallsHttpClient().getOwedGovernedDocumentAcceptances()\n      .then((response) => { if (!cancelled) setOwed(response.owed); })\n      .catch(() => { if (!cancelled) setCheckFailed(true); });\n    return () => { cancelled = true; };\n  }, [asksForAcceptance]);\n\n  const requiredReleases = useMemo<readonly GovernedDocumentInteractionSurface[]>(\n    () => (owed ?? []).flatMap((entry) => entry.releases),\n    [owed],\n  );\n  const requiredDocuments = useMemo<readonly RequiredDocumentPresentation[]>(() => {\n    const at = new Date().toISOString();\n    return requiredReleases.map((release) => ({\n      release,\n      document: resolveInForcePublicDocument(appConfig.compliance?.publicDocuments ?? [], release.identity.document.documentRef, at, {\n        requireApproved: requireApprovedDocuments,\n      }),\n    }));\n  }, [requiredReleases, appConfig.compliance?.publicDocuments, requireApprovedDocuments]);\n  const servedDocuments = useMemo<readonly GovernedDocumentPublicDocument[]>(\n    () => appConfig.compliance?.publicDocuments ?? [],\n    [appConfig.compliance?.publicDocuments],\n  );\n\n  const markDocumentRead = useCallback((paneKey: string) => {\n    setDocumentsRead((current) => (current.includes(paneKey) ? current : [...current, paneKey]));\n  }, []);\n\n  const status = !asksForAcceptance\n    ? DocumentAcceptanceGateStatus.NOT_APPLICABLE\n    : checkFailed\n      ? DocumentAcceptanceGateStatus.UNAVAILABLE\n      : owed === undefined\n        ? DocumentAcceptanceGateStatus.CHECKING\n        : owed.length === 0 ? DocumentAcceptanceGateStatus.SATISFIED : DocumentAcceptanceGateStatus.REQUIRED;\n\n  /*\n   * The mode decides whether pressing the action IS the act (sign-in-wrap) or whether the box must be\n   * ticked first — the same predicate registration's submit uses, so the two cannot disagree. The\n   * reading gate is enforced by the control itself, which withholds the box until the end is reached.\n   */\n  const canAccept = acceptanceMode === GovernedDocumentAcceptanceMode.IMPLIED_BY_REGISTERING || accepted;\n\n  const accept = useCallback(async (): Promise<void> => {\n    if (!canAccept || requiredReleases.length === 0) return;\n    setIsSaving(true);\n    setSaveFailed(false);\n    try {\n      const response = await getManualCallsHttpClient().acceptGovernedDocuments(\n        requiredReleases.map((release) => release.identity.releaseId),\n      );\n      /*\n       * Let the person through on what the server says is STILL owed, never on having sent the\n       * request. A write that recorded nothing leaves the gate up, which is the only honest outcome.\n       */\n      setOwed(response.owed);\n      setAccepted(false);\n      setDocumentsRead([]);\n      if (response.owed.length > 0) setSaveFailed(true);\n    } catch {\n      setSaveFailed(true);\n    } finally {\n      setIsSaving(false);\n    }\n  }, [canAccept, requiredReleases]);\n\n  const acceptance = useMemo<GovernedDocumentAcceptanceState>(() => ({\n    requiredReleases,\n    acceptanceMode,\n    requiredDocuments,\n    servedDocuments,\n    accepted,\n    setAccepted,\n    documentsRead,\n    markDocumentRead,\n  }), [requiredReleases, acceptanceMode, requiredDocuments, servedDocuments, accepted, documentsRead, markDocumentRead]);\n\n  return {\n    status,\n    reason: status === DocumentAcceptanceGateStatus.REQUIRED ? owed?.[0]?.reason : undefined,\n    acceptance,\n    canAccept,\n    isSaving,\n    saveFailed,\n    accept,\n    signOut: logout,\n  };\n}\n"]}

package/dist/esm/core/security/useGrantedConsentPurposes.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The consent purposes the signed-in person has granted, and the one door that records a new grant —
+ * for a surface that must gate provider code on consent (#1702).
+ *
+ * ## Why this reads `UserOrgsContext` WITHOUT `useUserOrgs`
+ *
+ * `useUserOrgs` throws outside its provider. A provider component can be mounted outside it — in a test, on
+ * a pre-authentication page — and there the right answer is not an exception but "nothing has been
+ * granted", because nobody is known to have granted anything. So an absent context reads as the empty set,
+ * which fails closed, and offers no way to record a grant, because there is no person to record it for.
+ *
+ * ## Why the grant source is the person's stored preferences
+ *
+ * `privacy.consentedPurposes` on the self-preferences record is the audited consent decision
+ * (`resource-operation-audit-emission` reads it). Reading the same record here means a component gate and
+ * the application's consent gate can never disagree about what was granted, and recording a grant through
+ * `recordConsentDecision` adds no second audit trail — the write IS the audit event.
+ */
+import { type ConsentPurpose } from '@wildo-ai/saas-models/public-runtime';
+export interface GrantedConsentPurposes {
+    /** What the signed-in person has granted, normalized. Empty when nobody is known. */
+    readonly granted: readonly ConsentPurpose[];
+    /**
+     * Grants exactly `purposes` IN ADDITION to what is already granted, through the audited preference
+     * write. `undefined` when there is no person to record a decision for.
+     */
+    readonly grant: ((purposes: readonly ConsentPurpose[]) => Promise<void>) | undefined;
+}
+export declare function useGrantedConsentPurposes(): GrantedConsentPurposes;
+//# sourceMappingURL=useGrantedConsentPurposes.d.ts.map

package/dist/esm/core/security/useGrantedConsentPurposes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useGrantedConsentPurposes.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useGrantedConsentPurposes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAIrG,MAAM,WAAW,sBAAsB;IACrC,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACtF;AAED,wBAAgB,yBAAyB,IAAI,sBAAsB,CAkBlE"}

package/dist/esm/core/security/useGrantedConsentPurposes.js

@@ -0,0 +1,38 @@
+/**
+ * The consent purposes the signed-in person has granted, and the one door that records a new grant —
+ * for a surface that must gate provider code on consent (#1702).
+ *
+ * ## Why this reads `UserOrgsContext` WITHOUT `useUserOrgs`
+ *
+ * `useUserOrgs` throws outside its provider. A provider component can be mounted outside it — in a test, on
+ * a pre-authentication page — and there the right answer is not an exception but "nothing has been
+ * granted", because nobody is known to have granted anything. So an absent context reads as the empty set,
+ * which fails closed, and offers no way to record a grant, because there is no person to record it for.
+ *
+ * ## Why the grant source is the person's stored preferences
+ *
+ * `privacy.consentedPurposes` on the self-preferences record is the audited consent decision
+ * (`resource-operation-audit-emission` reads it). Reading the same record here means a component gate and
+ * the application's consent gate can never disagree about what was granted, and recording a grant through
+ * `recordConsentDecision` adds no second audit trail — the write IS the audit event.
+ */
+import { useCallback, useContext, useMemo } from 'react';
+import { normalizeConsentPurposes } from '@wildo-ai/saas-models/public-runtime';
+import { UserOrgsContext } from './UserOrgsContext.js';
+import { composeConsentDecision } from './consent-gate.frontend.utils.js';
+export function useGrantedConsentPurposes() {
+    const context = useContext(UserOrgsContext);
+    const storedPurposes = context?.privacy?.consentedPurposes;
+    const granted = useMemo(() => normalizeConsentPurposes(storedPurposes), [storedPurposes]);
+    const recordConsentDecision = context?.recordConsentDecision;
+    const canRecord = context?.user !== null && context?.user !== undefined && recordConsentDecision !== undefined;
+    const grant = useCallback(async (purposes) => {
+        if (recordConsentDecision === undefined)
+            return;
+        // Offered and selected are the same set: the person agreed to exactly the purposes they were shown,
+        // and every purpose they did not see keeps its stored answer.
+        await recordConsentDecision(composeConsentDecision(granted, purposes, purposes));
+    }, [granted, recordConsentDecision]);
+    return { granted, grant: canRecord ? grant : undefined };
+}
+//# sourceMappingURL=useGrantedConsentPurposes.js.map

package/dist/esm/core/security/useGrantedConsentPurposes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useGrantedConsentPurposes.js","sourceRoot":"","sources":["../../../../src/core/security/useGrantedConsentPurposes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAuB,MAAM,sCAAsC,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAYvE,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1F,MAAM,qBAAqB,GAAG,OAAO,EAAE,qBAAqB,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,EAAE,IAAI,KAAK,IAAI,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,qBAAqB,KAAK,SAAS,CAAC;IAE/G,MAAM,KAAK,GAAG,WAAW,CACvB,KAAK,EAAE,QAAmC,EAAiB,EAAE;QAC3D,IAAI,qBAAqB,KAAK,SAAS;YAAE,OAAO;QAChD,oGAAoG;QACpG,8DAA8D;QAC9D,MAAM,qBAAqB,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnF,CAAC,EACD,CAAC,OAAO,EAAE,qBAAqB,CAAC,CACjC,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC3D,CAAC","sourcesContent":["/**\n * The consent purposes the signed-in person has granted, and the one door that records a new grant —\n * for a surface that must gate provider code on consent (#1702).\n *\n * ## Why this reads `UserOrgsContext` WITHOUT `useUserOrgs`\n *\n * `useUserOrgs` throws outside its provider. A provider component can be mounted outside it — in a test, on\n * a pre-authentication page — and there the right answer is not an exception but \"nothing has been\n * granted\", because nobody is known to have granted anything. So an absent context reads as the empty set,\n * which fails closed, and offers no way to record a grant, because there is no person to record it for.\n *\n * ## Why the grant source is the person's stored preferences\n *\n * `privacy.consentedPurposes` on the self-preferences record is the audited consent decision\n * (`resource-operation-audit-emission` reads it). Reading the same record here means a component gate and\n * the application's consent gate can never disagree about what was granted, and recording a grant through\n * `recordConsentDecision` adds no second audit trail — the write IS the audit event.\n */\n\nimport { useCallback, useContext, useMemo } from 'react';\nimport { normalizeConsentPurposes, type ConsentPurpose } from '@wildo-ai/saas-models/public-runtime';\nimport { UserOrgsContext } from './UserOrgsContext';\nimport { composeConsentDecision } from './consent-gate.frontend.utils';\n\nexport interface GrantedConsentPurposes {\n  /** What the signed-in person has granted, normalized. Empty when nobody is known. */\n  readonly granted: readonly ConsentPurpose[];\n  /**\n   * Grants exactly `purposes` IN ADDITION to what is already granted, through the audited preference\n   * write. `undefined` when there is no person to record a decision for.\n   */\n  readonly grant: ((purposes: readonly ConsentPurpose[]) => Promise<void>) | undefined;\n}\n\nexport function useGrantedConsentPurposes(): GrantedConsentPurposes {\n  const context = useContext(UserOrgsContext);\n  const storedPurposes = context?.privacy?.consentedPurposes;\n  const granted = useMemo(() => normalizeConsentPurposes(storedPurposes), [storedPurposes]);\n  const recordConsentDecision = context?.recordConsentDecision;\n  const canRecord = context?.user !== null && context?.user !== undefined && recordConsentDecision !== undefined;\n\n  const grant = useCallback(\n    async (purposes: readonly ConsentPurpose[]): Promise<void> => {\n      if (recordConsentDecision === undefined) return;\n      // Offered and selected are the same set: the person agreed to exactly the purposes they were shown,\n      // and every purpose they did not see keeps its stored answer.\n      await recordConsentDecision(composeConsentDecision(granted, purposes, purposes));\n    },\n    [granted, recordConsentDecision],\n  );\n\n  return { granted, grant: canRecord ? grant : undefined };\n}\n"]}

package/dist/esm/core/security/useResolvedAuthConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useResolvedAuthConfig.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAElB,mBAAmB,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,UAAU,EAGV,gBAAgB,EAChB,4BAA4B,EAG7B,MAAM,uBAAuB,CAAC;AAqD/B,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,gBAAgB,CAAC;IACvB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,iCAAiC,EAAE,OAAO,CAAC;IAC3C,2BAA2B,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;OAUG;IACH,0BAA0B,EAAE,wBAAwB,EAAE,CAAC;IACvD;;;;;OAKG;IACH,uBAAuB,EAAE,4BAA4B,CAAC;CACvD;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,4BAA4B,CAAC;IACzC,cAAc,EAAE,mBAAmB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;CAChD;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CA2D1D"}
+{"version":3,"file":"useResolvedAuthConfig.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,EAElB,mBAAmB,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,UAAU,EAGV,gBAAgB,EAChB,4BAA4B,EAG7B,MAAM,uBAAuB,CAAC;AAqD/B,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,gBAAgB,CAAC;IACvB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,iCAAiC,EAAE,OAAO,CAAC;IAC3C,2BAA2B,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;OAUG;IACH,0BAA0B,EAAE,wBAAwB,EAAE,CAAC;IACvD;;;;;OAKG;IACH,uBAAuB,EAAE,4BAA4B,CAAC;CACvD;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,4BAA4B,CAAC;IACzC,cAAc,EAAE,mBAAmB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;CAChD;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CA2D1D"}

package/dist/esm/core/security/useResolvedAuthConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"useResolvedAuthConfig.js","sourceRoot":"","sources":["../../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AASpD,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,EACxB,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,SAAS,sCAAsC,CAC7C,mBAA2B,EAC3B,gBAAoD;IAEpD,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,qBAAqB,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,8CAA8C,CACrD,mBAA2B,EAC3B,sBAAqD,EACrD,gBAAoD;IAEpD,IAAI,CAAC,sBAAsB,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC;IACrF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,uBAAuB,GAAwB;IACnD,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,KAAK;IACvB,gBAAgB,EAAE,KAAK;IACvB,cAAc,EAAE,KAAK;IACrB,mBAAmB,EAAE,KAAK;IAC1B,UAAU,EAAE,CAAC;CACd,CAAC;AAoCF,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC,mBAAmB,CAAC;IAElF,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,uBAAuB,GAAG,sCAAsC,CAAC,mBAAmB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxH,MAAM,qBAAqB,GAAG,8CAA8C,CAC1E,mBAAmB,EACnB,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,IAAI,uBAAuB,CAAC;QAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,YAAY,GAA8B,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;QAE1E,MAAM,cAAc,GAAwB,YAAY,EAAE,cAAc,IAAI,uBAAuB,CAAC;QAEpG,MAAM,KAAK,GAAmC,YAAY,EAAE,YAAY,CAAC;QACzE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,iCAAiC,GAAG,OAAO,CAC/C,gBAAgB;eACb,SAAS,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC;gBAClD,EAAE,eAAe,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,KAAK,IAAI,CAC3D,CAAC;QAEF,MAAM,kBAAkB,GAA+B,kBAAkB,CAAC,OAAO;YAC/E,CAAC,CAAC;gBACE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI;gBAClC,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,cAAc;gBACtD,iCAAiC;gBACjC,2BAA2B,EACzB,iCAAiC;uBAC9B,gCAAgC,CACjC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAC5B,8BAA8B,CAAC,mBAAmB,CACnD;gBACH,0BAA0B,EAAE,kBAAkB,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE;gBACpF,uBAAuB,EAAE,mCAAmC,CAAC,kBAAkB,CAAC,IAAI,CAAC;aACtF;YACH,CAAC,CAAC;gBACE,qFAAqF;gBACrF,qFAAqF;gBACrF,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,cAAc,EAAE,EAAE;gBAClB,iCAAiC,EAAE,KAAK;gBACxC,2BAA2B,EAAE,KAAK;gBAClC,0BAA0B,EAAE,EAAE;gBAC9B,uBAAuB,EAAE,4BAA4B,CAAC,YAAY;aACnE,CAAC;QAEN,OAAO;YACL,gBAAgB;YAChB,YAAY;YACZ,UAAU;YACV,cAAc;YACd,kBAAkB;SACnB,CAAC;IACJ,CAAC,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * W6.5: Resolves the effective auth config for the current frontend service.\n *\n * Resolution chain:\n * 1. If the user is authenticated, prefer their actual user type that is allowed on the\n *    current frontend service\n * 2. Otherwise use envLoader.frontendServiceName → frontendServices[frontendServiceName].usersManagement → default user type key\n * 3. userTypes[resolvedType].auth → per-user-type auth policy (UserTypeAuthPolicy)\n * 4. Falls back to hardcoded restrictive defaults when user type cannot be resolved\n *\n * Public social OAuth2 provider enumeration and passkeyConfig are global auth\n * concerns — always resolved from the shared auth payload.\n * Auth methods, MFA, registration, password policy come from the resolved user type.\n */\n\nimport { useContext, useMemo } from 'react';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\nimport { UserOrgsContext } from './UserOrgsContext';\nimport type {\n  OnboardingSurveyQuestion,\n  AppConfiguration_Shared_Auth,\n  UserTypeAuthPolicy,\n  FrontendServicesConfig,\n  PasswordPolicyRules,\n  RegistrationConfig,\n} from '@wildo-ai/saas-models';\nimport {\n  AuthMethod,\n  RegistrationAcquisitionChannel,\n  RegistrationConfigSchema,\n  RegistrationMode,\n  ProfileNamesCollectionMoment,\n  isRegistrationAcquisitionAllowed,\n  resolveProfileNamesCollectionMoment,\n} from '@wildo-ai/saas-models';\n\n/**\n * Resolves the default user type key from frontendServices config.\n * Mirrors backend AppConfigurationBackendService.resolveUserTypeFromFrontendServiceName():\n * isDefault entry first, then first entry.\n */\nfunction resolveUserTypeFromFrontendServiceName(\n  frontendServiceName: string,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!frontendServices) return null;\n  const frontendServiceConfig = frontendServices[frontendServiceName];\n  if (!frontendServiceConfig?.usersManagement) return null;\n  const entries = Object.entries(frontendServiceConfig.usersManagement);\n  const defaultEntry = entries.find(([, v]) => v.isDefault);\n  const firstEntry = entries[0];\n  return (defaultEntry ?? firstEntry)?.[0] ?? null;\n}\n\nfunction resolveAuthenticatedUserTypeForFrontendService(\n  frontendServiceName: string,\n  authenticatedUserTypes: readonly string[] | undefined,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!authenticatedUserTypes?.length || !frontendServices) {\n    return null;\n  }\n\n  const allowedUserManagement = frontendServices[frontendServiceName]?.usersManagement;\n  if (!allowedUserManagement) {\n    return null;\n  }\n\n  for (const userType of authenticatedUserTypes) {\n    if (allowedUserManagement[userType]) {\n      return userType;\n    }\n  }\n\n  return null;\n}\n\nconst DEFAULT_PASSWORD_POLICY: PasswordPolicyRules = {\n  minLength: 15,\n  maxLength: 128,\n  requireUppercase: false,\n  requireLowercase: false,\n  requireNumbers: false,\n  requireSpecialChars: false,\n  expiryDays: 0,\n};\n\nexport interface ResolvedRegistrationConfig {\n  mode: RegistrationMode;\n  allowedMethods: AuthMethod[];\n  frontendServiceAllowsRegistration: boolean;\n  publicRegistrationAvailable: boolean;\n  /**\n   * The extra profile questions this user type asks at sign-up (#1371).\n   *\n   * Exposed to the browser because the register form BUILDS ITS FIELDS from it — the one piece of\n   * registration policy the screen has to render rather than merely obey. Everything else on this\n   * projection is a yes/no the form consumes; this is a list it draws.\n   *\n   * Empty on the fail-closed branch, like `allowedMethods`: a boundary that could not be parsed\n   * must not be read as \"this user type asks nothing\", but a form that renders no extra fields is\n   * the safe shape either way — the SERVER refuses a required answer that never arrives.\n   */\n  additionalProfileQuestions: OnboardingSurveyQuestion[];\n  /**\n   * When the person's first and last name are asked (#1374). `ONBOARDING` removes them from the sign-up form —\n   * they are asked at the onboarding step once the address is proven. `REGISTRATION` on the fail-closed branch:\n   * a form that asks for names the server does not need is harmless (the server seeds them), while one that\n   * withholds names the server requires would be refused.\n   */\n  profileNamesCollectedAt: ProfileNamesCollectionMoment;\n}\n\nexport interface ResolvedAuthConfig {\n  resolvedUserType: string | null;\n  userTypeAuth: UserTypeAuthPolicy | null;\n  globalAuth: AppConfiguration_Shared_Auth;\n  passwordPolicy: PasswordPolicyRules;\n  registrationConfig: ResolvedRegistrationConfig;\n}\n\nexport function useResolvedAuthConfig(): ResolvedAuthConfig {\n  const { auth: globalAuth, appConfig } = useApplication();\n  const userOrgs = useContext(UserOrgsContext);\n  const frontendServiceName = envLoader.loadEnvironmentConfig().frontendServiceName;\n\n  return useMemo(() => {\n    const defaultFrontendUserType = resolveUserTypeFromFrontendServiceName(frontendServiceName, appConfig.frontendServices);\n    const authenticatedUserType = resolveAuthenticatedUserTypeForFrontendService(\n      frontendServiceName,\n      userOrgs?.user?.userTypes,\n      appConfig.frontendServices,\n    );\n    const resolvedUserType = authenticatedUserType ?? defaultFrontendUserType;\n    const userTypeDef = resolvedUserType ? appConfig.userTypes?.[resolvedUserType] : null;\n    const userTypeAuth: UserTypeAuthPolicy | null = userTypeDef?.auth ?? null;\n\n    const passwordPolicy: PasswordPolicyRules = userTypeAuth?.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n\n    const utReg: RegistrationConfig | undefined = userTypeAuth?.registration;\n    const parsedRegistration = RegistrationConfigSchema.safeParse(utReg);\n    const frontendServiceAllowsRegistration = Boolean(\n      resolvedUserType\n      && appConfig.frontendServices?.[frontendServiceName]\n        ?.usersManagement?.[resolvedUserType]?.register === true,\n    );\n\n    const registrationConfig: ResolvedRegistrationConfig = parsedRegistration.success\n      ? {\n          mode: parsedRegistration.data.mode,\n          allowedMethods: parsedRegistration.data.allowedMethods,\n          frontendServiceAllowsRegistration,\n          publicRegistrationAvailable:\n            frontendServiceAllowsRegistration\n            && isRegistrationAcquisitionAllowed(\n              parsedRegistration.data.mode,\n              RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n            ),\n          additionalProfileQuestions: parsedRegistration.data.additionalProfileQuestions ?? [],\n          profileNamesCollectedAt: resolveProfileNamesCollectionMoment(parsedRegistration.data),\n        }\n      : {\n          // No resolved or parseable leaf means the backend cannot authorize the same request.\n          // Mocked/stale/unparsed client boundaries fail closed without legacy interpretation.\n          mode: RegistrationMode.DISABLED,\n          allowedMethods: [],\n          frontendServiceAllowsRegistration: false,\n          publicRegistrationAvailable: false,\n          additionalProfileQuestions: [],\n          profileNamesCollectedAt: ProfileNamesCollectionMoment.REGISTRATION,\n        };\n\n    return {\n      resolvedUserType,\n      userTypeAuth,\n      globalAuth,\n      passwordPolicy,\n      registrationConfig,\n    };\n  }, [frontendServiceName, appConfig, globalAuth, userOrgs?.user?.userTypes]);\n}\n"]}
+{"version":3,"file":"useResolvedAuthConfig.js","sourceRoot":"","sources":["../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AASpD,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,EACxB,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,SAAS,sCAAsC,CAC7C,mBAA2B,EAC3B,gBAAoD;IAEpD,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,qBAAqB,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,8CAA8C,CACrD,mBAA2B,EAC3B,sBAAqD,EACrD,gBAAoD;IAEpD,IAAI,CAAC,sBAAsB,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC;IACrF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,uBAAuB,GAAwB;IACnD,SAAS,EAAE,EAAE;IACb,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,KAAK;IACvB,gBAAgB,EAAE,KAAK;IACvB,cAAc,EAAE,KAAK;IACrB,mBAAmB,EAAE,KAAK;IAC1B,UAAU,EAAE,CAAC;CACd,CAAC;AAoCF,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC,mBAAmB,CAAC;IAElF,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,uBAAuB,GAAG,sCAAsC,CAAC,mBAAmB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxH,MAAM,qBAAqB,GAAG,8CAA8C,CAC1E,mBAAmB,EACnB,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,IAAI,uBAAuB,CAAC;QAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,YAAY,GAA8B,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;QAE1E,MAAM,cAAc,GAAwB,YAAY,EAAE,cAAc,IAAI,uBAAuB,CAAC;QAEpG,MAAM,KAAK,GAAmC,YAAY,EAAE,YAAY,CAAC;QACzE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,iCAAiC,GAAG,OAAO,CAC/C,gBAAgB;eACb,SAAS,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC;gBAClD,EAAE,eAAe,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,KAAK,IAAI,CAC3D,CAAC;QAEF,MAAM,kBAAkB,GAA+B,kBAAkB,CAAC,OAAO;YAC/E,CAAC,CAAC;gBACE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI;gBAClC,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,cAAc;gBACtD,iCAAiC;gBACjC,2BAA2B,EACzB,iCAAiC;uBAC9B,gCAAgC,CACjC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAC5B,8BAA8B,CAAC,mBAAmB,CACnD;gBACH,0BAA0B,EAAE,kBAAkB,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE;gBACpF,uBAAuB,EAAE,mCAAmC,CAAC,kBAAkB,CAAC,IAAI,CAAC;aACtF;YACH,CAAC,CAAC;gBACE,qFAAqF;gBACrF,qFAAqF;gBACrF,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,cAAc,EAAE,EAAE;gBAClB,iCAAiC,EAAE,KAAK;gBACxC,2BAA2B,EAAE,KAAK;gBAClC,0BAA0B,EAAE,EAAE;gBAC9B,uBAAuB,EAAE,4BAA4B,CAAC,YAAY;aACnE,CAAC;QAEN,OAAO;YACL,gBAAgB;YAChB,YAAY;YACZ,UAAU;YACV,cAAc;YACd,kBAAkB;SACnB,CAAC;IACJ,CAAC,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * W6.5: Resolves the effective auth config for the current frontend service.\n *\n * Resolution chain:\n * 1. If the user is authenticated, prefer their actual user type that is allowed on the\n *    current frontend service\n * 2. Otherwise use envLoader.frontendServiceName → frontendServices[frontendServiceName].usersManagement → default user type key\n * 3. userTypes[resolvedType].auth → per-user-type auth policy (UserTypeAuthPolicy)\n * 4. Falls back to hardcoded restrictive defaults when user type cannot be resolved\n *\n * Public social OAuth2 provider enumeration and passkeyConfig are global auth\n * concerns — always resolved from the shared auth payload.\n * Auth methods, MFA, registration, password policy come from the resolved user type.\n */\n\nimport { useContext, useMemo } from 'react';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\nimport { UserOrgsContext } from './UserOrgsContext';\nimport type {\n  OnboardingSurveyQuestion,\n  AppConfiguration_Shared_Auth,\n  UserTypeAuthPolicy,\n  FrontendServicesConfig,\n  PasswordPolicyRules,\n  RegistrationConfig,\n} from '@wildo-ai/saas-models';\nimport {\n  AuthMethod,\n  RegistrationAcquisitionChannel,\n  RegistrationConfigSchema,\n  RegistrationMode,\n  ProfileNamesCollectionMoment,\n  isRegistrationAcquisitionAllowed,\n  resolveProfileNamesCollectionMoment,\n} from '@wildo-ai/saas-models';\n\n/**\n * Resolves the default user type key from frontendServices config.\n * Mirrors backend AppConfigurationBackendService.resolveUserTypeFromFrontendServiceName():\n * isDefault entry first, then first entry.\n */\nfunction resolveUserTypeFromFrontendServiceName(\n  frontendServiceName: string,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!frontendServices) return null;\n  const frontendServiceConfig = frontendServices[frontendServiceName];\n  if (!frontendServiceConfig?.usersManagement) return null;\n  const entries = Object.entries(frontendServiceConfig.usersManagement);\n  const defaultEntry = entries.find(([, v]) => v.isDefault);\n  const firstEntry = entries[0];\n  return (defaultEntry ?? firstEntry)?.[0] ?? null;\n}\n\nfunction resolveAuthenticatedUserTypeForFrontendService(\n  frontendServiceName: string,\n  authenticatedUserTypes: readonly string[] | undefined,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!authenticatedUserTypes?.length || !frontendServices) {\n    return null;\n  }\n\n  const allowedUserManagement = frontendServices[frontendServiceName]?.usersManagement;\n  if (!allowedUserManagement) {\n    return null;\n  }\n\n  for (const userType of authenticatedUserTypes) {\n    if (allowedUserManagement[userType]) {\n      return userType;\n    }\n  }\n\n  return null;\n}\n\nconst DEFAULT_PASSWORD_POLICY: PasswordPolicyRules = {\n  minLength: 15,\n  maxLength: 128,\n  requireUppercase: false,\n  requireLowercase: false,\n  requireNumbers: false,\n  requireSpecialChars: false,\n  expiryDays: 0,\n};\n\nexport interface ResolvedRegistrationConfig {\n  mode: RegistrationMode;\n  allowedMethods: AuthMethod[];\n  frontendServiceAllowsRegistration: boolean;\n  publicRegistrationAvailable: boolean;\n  /**\n   * The extra profile questions this user type asks at sign-up (#1371).\n   *\n   * Exposed to the browser because the register form BUILDS ITS FIELDS from it — the one piece of\n   * registration policy the screen has to render rather than merely obey. Everything else on this\n   * projection is a yes/no the form consumes; this is a list it draws.\n   *\n   * Empty on the fail-closed branch, like `allowedMethods`: a boundary that could not be parsed\n   * must not be read as \"this user type asks nothing\", but a form that renders no extra fields is\n   * the safe shape either way — the SERVER refuses a required answer that never arrives.\n   */\n  additionalProfileQuestions: OnboardingSurveyQuestion[];\n  /**\n   * When the person's first and last name are asked (#1374). `ONBOARDING` removes them from the sign-up form —\n   * they are asked at the onboarding step once the address is proven. `REGISTRATION` on the fail-closed branch:\n   * a form that asks for names the server does not need is harmless (the server seeds them), while one that\n   * withholds names the server requires would be refused.\n   */\n  profileNamesCollectedAt: ProfileNamesCollectionMoment;\n}\n\nexport interface ResolvedAuthConfig {\n  resolvedUserType: string | null;\n  userTypeAuth: UserTypeAuthPolicy | null;\n  globalAuth: AppConfiguration_Shared_Auth;\n  passwordPolicy: PasswordPolicyRules;\n  registrationConfig: ResolvedRegistrationConfig;\n}\n\nexport function useResolvedAuthConfig(): ResolvedAuthConfig {\n  const { auth: globalAuth, appConfig } = useApplication();\n  const userOrgs = useContext(UserOrgsContext);\n  const frontendServiceName = envLoader.loadEnvironmentConfig().frontendServiceName;\n\n  return useMemo(() => {\n    const defaultFrontendUserType = resolveUserTypeFromFrontendServiceName(frontendServiceName, appConfig.frontendServices);\n    const authenticatedUserType = resolveAuthenticatedUserTypeForFrontendService(\n      frontendServiceName,\n      userOrgs?.user?.userTypes,\n      appConfig.frontendServices,\n    );\n    const resolvedUserType = authenticatedUserType ?? defaultFrontendUserType;\n    const userTypeDef = resolvedUserType ? appConfig.userTypes?.[resolvedUserType] : null;\n    const userTypeAuth: UserTypeAuthPolicy | null = userTypeDef?.auth ?? null;\n\n    const passwordPolicy: PasswordPolicyRules = userTypeAuth?.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n\n    const utReg: RegistrationConfig | undefined = userTypeAuth?.registration;\n    const parsedRegistration = RegistrationConfigSchema.safeParse(utReg);\n    const frontendServiceAllowsRegistration = Boolean(\n      resolvedUserType\n      && appConfig.frontendServices?.[frontendServiceName]\n        ?.usersManagement?.[resolvedUserType]?.register === true,\n    );\n\n    const registrationConfig: ResolvedRegistrationConfig = parsedRegistration.success\n      ? {\n          mode: parsedRegistration.data.mode,\n          allowedMethods: parsedRegistration.data.allowedMethods,\n          frontendServiceAllowsRegistration,\n          publicRegistrationAvailable:\n            frontendServiceAllowsRegistration\n            && isRegistrationAcquisitionAllowed(\n              parsedRegistration.data.mode,\n              RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n            ),\n          additionalProfileQuestions: parsedRegistration.data.additionalProfileQuestions ?? [],\n          profileNamesCollectedAt: resolveProfileNamesCollectionMoment(parsedRegistration.data),\n        }\n      : {\n          // No resolved or parseable leaf means the backend cannot authorize the same request.\n          // Mocked/stale/unparsed client boundaries fail closed without legacy interpretation.\n          mode: RegistrationMode.DISABLED,\n          allowedMethods: [],\n          frontendServiceAllowsRegistration: false,\n          publicRegistrationAvailable: false,\n          additionalProfileQuestions: [],\n          profileNamesCollectedAt: ProfileNamesCollectionMoment.REGISTRATION,\n        };\n\n    return {\n      resolvedUserType,\n      userTypeAuth,\n      globalAuth,\n      passwordPolicy,\n      registrationConfig,\n    };\n  }, [frontendServiceName, appConfig, globalAuth, userOrgs?.user?.userTypes]);\n}\n"]}

package/dist/esm/core/security/useRouteOrganizationAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useRouteOrganizationAccess.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useRouteOrganizationAccess.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EACL,uBAAuB,EAGxB,MAAM,4CAA4C,CAAC;AAOpD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CA4FpE"}
+{"version":3,"file":"useRouteOrganizationAccess.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useRouteOrganizationAccess.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EACL,uBAAuB,EAGxB,MAAM,4CAA4C,CAAC;AAOpD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,uBAAuB,CA4FpE"}

package/dist/esm/core/security/useRouteOrganizationAccess.js.map

@@ -1 +1 @@
-{"version":3,"file":"useRouteOrganizationAccess.js","sourceRoot":"","sources":["../../../../../src/core/security/useRouteOrganizationAccess.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,mEAAmE,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AAKxE;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,eAAe,GAAG,SAAS,EAA0B,CAAC;IAC5D,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IAEnC,qGAAqG;IACrG,wGAAwG;IACxG,uGAAuG;IACvG,wFAAwF;IACxF,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;IAErC,uGAAuG;IACvG,sFAAsF;IACtF,MAAM,0BAA0B,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnG,MAAM,2BAA2B,GAAG,0BAA0B,EAAE,uBAAuB,CAAC;IACxF,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,CAAC,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnH,MAAM,cAAc,GAAG,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAC;IACvD,kGAAkG;IAClG,qGAAqG;IACrG,4DAA4D;IAC5D,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW;WACxC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;WACxC,CAAC,IAAI,CAAC,kBAAkB;WACxB,IAAI,CAAC,eAAe;WACpB,CAAC,CAAC,IAAI;WACN,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAEtD,MAAM,qBAAqB,GAAG,CAAC,CAAC,mBAAmB,IAAI,kBAAkB;WACpE,iCAAiC,CAAC,IAAI,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAEvF,MAAM,kBAAkB,GAAG,CAAC,CAAC,mBAAmB,IAAI,kBAAkB,IAAI,CAAC,qBAAqB,CAAC;IACjG,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAErF,wGAAwG;IACxG,wGAAwG;IACxG,uDAAuD;IACvD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAgD,EAAE,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1E,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU,IAAI,aAAa,IAAI,CAAC,mBAAmB,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,OAA4B,EAAQ,EAAE;YAC3D,iBAAiB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,2BAA2B,CAAC,0BAA0B,CAAC,CAAC;QAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,cAAc,CAAC,OAAO,CACpB,kCAAkC,CAAC,kCAAkC,CAAC,aAAa,CAAC,EACpF,EAAE,oBAAoB,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,mBAAmB,EAAE,EAAE;QAChF,2GAA2G;QAC3G,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB;aACE,IAAI,CAAC,GAAG,EAAE;YACT,IAAI,CAAC,UAAU;gBAAE,aAAa,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,UAAU;gBAAE,OAAO;YACvB,6GAA6G;YAC7G,MAAM,OAAO,GAAG,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACtG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAE9G,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,uBAAuB,CAAC,aAAa,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,uBAAuB,CAAC,WAAW,CAAC;IAC7C,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,uBAAuB,CAAC,iBAAiB,CAAC;IACnD,CAAC;IACD,OAAO,aAAa,IAAI,uBAAuB,CAAC,SAAS,CAAC;AAC5D,CAAC","sourcesContent":["/**\n * useRouteOrganizationAccess\n *\n * Decides whether the signed-in account may open the organization the current route addresses. See\n * {@link RouteOrganizationAccess} for why the route needs its own answer and why the server decides.\n */\n\nimport { useEffect, useRef, useState } from 'react';\nimport { useParams } from 'react-router-dom';\nimport { CoreResourceType, ResourcesConfig_OperationPathUtils, SessionType } from '@wildo-ai/saas-models';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { useAppScopeSafe } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { errorManagement } from '~wildo-frontend-lib/core/errors/error-management.frontend.service';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useUserOrgs } from './useUserOrgs';\nimport {\n  RouteOrganizationAccess,\n  findDefaultApiReadOperation,\n  hasActiveMembershipInOrganization,\n} from './route-organization-access.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\n\n/** The verdicts only the server can give. */\ntype ServerAccessVerdict = RouteOrganizationAccess.ADMITTED | RouteOrganizationAccess.REFUSED | RouteOrganizationAccess.INCONCLUSIVE;\n\n/**\n * Must be called inside the authenticated route: it reads the matched route's params (a layout route\n * sees its child's params), the registry, the session and AppScope.\n */\nexport function useRouteOrganizationAccess(): RouteOrganizationAccess {\n  const routeParameters = useParams<Record<string, string>>();\n  const { registry, doOperation } = useResourceRegistry();\n  const { auth, user } = useUserOrgs();\n  const appScope = useAppScopeSafe();\n\n  // The scoped `doOperation` changes identity with every AppScope change, and AppScope commits while a\n  // session settles. Depending on it would cancel the in-flight probe and send another one, so the effect\n  // reads the latest function through a ref. Explicit `contextualParameters` still win over the injected\n  // scope, so the probe addresses the route's organization whichever function is current.\n  const doOperationRef = useRef(doOperation);\n  doOperationRef.current = doOperation;\n\n  // The segment name is the ORGANIZATIONS resource's own identifier field, read from the registry rather\n  // than spelled here, so the check follows the routes the registry actually generates.\n  const organizationsConfiguration = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];\n  const organizationFieldIdentifier = organizationsConfiguration?.resourceFieldIdentifier;\n  const routeOrganizationId = organizationFieldIdentifier ? routeParameters[organizationFieldIdentifier] : undefined;\n\n  const tokenSubjectId = appScope?.currentUserId ?? null;\n  // A one-off session is not judged here. Its token is bound to one organization by the server, and\n  // `UserOrgsContext.loadOrganizations` already confines the session to it; a probe with that narrowed\n  // token could refuse the very page the link was issued for.\n  const sessionIsJudgeable = !!auth.accessToken\n    && auth.sessionType !== SessionType.ONE_OFF\n    && !auth.isRestoringSession\n    && auth.sessionRestored\n    && !!user\n    && (!tokenSubjectId || user._id === tokenSubjectId);\n\n  const knownActiveMembership = !!routeOrganizationId && sessionIsJudgeable\n    && hasActiveMembershipInOrganization(user?.organizationMembers, routeOrganizationId);\n\n  const needsServerVerdict = !!routeOrganizationId && sessionIsJudgeable && !knownActiveMembership;\n  const verdictKey = needsServerVerdict ? `${user?._id}:${routeOrganizationId}` : null;\n\n  // One verdict per (account, organization), kept for the layout's lifetime. Moving between organizations\n  // past the membership cap then asks once each, not on every visit. The account is part of the key, so a\n  // different account signing in is always asked afresh.\n  const [serverVerdicts, setServerVerdicts] = useState<Readonly<Record<string, ServerAccessVerdict>>>({});\n  const cachedVerdict = verdictKey ? serverVerdicts[verdictKey] : undefined;\n\n  useEffect(() => {\n    if (!verdictKey || cachedVerdict || !routeOrganizationId || !organizationFieldIdentifier) {\n      return;\n    }\n\n    const recordVerdict = (verdict: ServerAccessVerdict): void => {\n      setServerVerdicts((previous) => ({ ...previous, [verdictKey]: verdict }));\n    };\n\n    const readOperation = findDefaultApiReadOperation(organizationsConfiguration);\n    if (!readOperation) {\n      recordVerdict(RouteOrganizationAccess.INCONCLUSIVE);\n      return;\n    }\n\n    let superseded = false;\n    doOperationRef.current(\n      ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readOperation),\n      { contextualParameters: { [organizationFieldIdentifier]: routeOrganizationId } },\n      // Silent: the probe's refusal is answered by the redirect and its notice, never by the global error toast.\n      { silent: true },\n    )\n      .then(() => {\n        if (!superseded) recordVerdict(RouteOrganizationAccess.ADMITTED);\n      })\n      .catch((error: unknown) => {\n        if (superseded) return;\n        // A non-member's READ of another tenant's organization is a deliberate 404, not a 403, so both are refusals.\n        const refused = errorManagement.isAuthorizationError(error) || errorManagement.isNotFoundError(error);\n        if (!refused) {\n          logger.warn('Could not verify access to the organization addressed by the route', { organizationId: routeOrganizationId, error });\n        }\n        recordVerdict(refused ? RouteOrganizationAccess.REFUSED : RouteOrganizationAccess.INCONCLUSIVE);\n      });\n\n    return () => {\n      superseded = true;\n    };\n  }, [verdictKey, cachedVerdict, routeOrganizationId, organizationFieldIdentifier, organizationsConfiguration]);\n\n  if (!routeOrganizationId) {\n    return RouteOrganizationAccess.NOT_ADDRESSED;\n  }\n  if (!sessionIsJudgeable) {\n    return RouteOrganizationAccess.UNDECIDABLE;\n  }\n  if (knownActiveMembership) {\n    return RouteOrganizationAccess.ACTIVE_MEMBERSHIP;\n  }\n  return cachedVerdict ?? RouteOrganizationAccess.VERIFYING;\n}\n"]}
+{"version":3,"file":"useRouteOrganizationAccess.js","sourceRoot":"","sources":["../../../../src/core/security/useRouteOrganizationAccess.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,mEAAmE,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,4CAA4C,CAAC;AAEpD,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AAKxE;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,eAAe,GAAG,SAAS,EAA0B,CAAC;IAC5D,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IAEnC,qGAAqG;IACrG,wGAAwG;IACxG,uGAAuG;IACvG,wFAAwF;IACxF,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,GAAG,WAAW,CAAC;IAErC,uGAAuG;IACvG,sFAAsF;IACtF,MAAM,0BAA0B,GAAG,QAAQ,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnG,MAAM,2BAA2B,GAAG,0BAA0B,EAAE,uBAAuB,CAAC;IACxF,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,CAAC,CAAC,eAAe,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnH,MAAM,cAAc,GAAG,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAC;IACvD,kGAAkG;IAClG,qGAAqG;IACrG,4DAA4D;IAC5D,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW;WACxC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,OAAO;WACxC,CAAC,IAAI,CAAC,kBAAkB;WACxB,IAAI,CAAC,eAAe;WACpB,CAAC,CAAC,IAAI;WACN,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAEtD,MAAM,qBAAqB,GAAG,CAAC,CAAC,mBAAmB,IAAI,kBAAkB;WACpE,iCAAiC,CAAC,IAAI,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAEvF,MAAM,kBAAkB,GAAG,CAAC,CAAC,mBAAmB,IAAI,kBAAkB,IAAI,CAAC,qBAAqB,CAAC;IACjG,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAErF,wGAAwG;IACxG,wGAAwG;IACxG,uDAAuD;IACvD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAgD,EAAE,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1E,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU,IAAI,aAAa,IAAI,CAAC,mBAAmB,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,OAA4B,EAAQ,EAAE;YAC3D,iBAAiB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,2BAA2B,CAAC,0BAA0B,CAAC,CAAC;QAC9E,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,cAAc,CAAC,OAAO,CACpB,kCAAkC,CAAC,kCAAkC,CAAC,aAAa,CAAC,EACpF,EAAE,oBAAoB,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,mBAAmB,EAAE,EAAE;QAChF,2GAA2G;QAC3G,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB;aACE,IAAI,CAAC,GAAG,EAAE;YACT,IAAI,CAAC,UAAU;gBAAE,aAAa,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,UAAU;gBAAE,OAAO;YACvB,6GAA6G;YAC7G,MAAM,OAAO,GAAG,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACtG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;QAEL,OAAO,GAAG,EAAE;YACV,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAE9G,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,uBAAuB,CAAC,aAAa,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,uBAAuB,CAAC,WAAW,CAAC;IAC7C,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,uBAAuB,CAAC,iBAAiB,CAAC;IACnD,CAAC;IACD,OAAO,aAAa,IAAI,uBAAuB,CAAC,SAAS,CAAC;AAC5D,CAAC","sourcesContent":["/**\n * useRouteOrganizationAccess\n *\n * Decides whether the signed-in account may open the organization the current route addresses. See\n * {@link RouteOrganizationAccess} for why the route needs its own answer and why the server decides.\n */\n\nimport { useEffect, useRef, useState } from 'react';\nimport { useParams } from 'react-router-dom';\nimport { CoreResourceType, ResourcesConfig_OperationPathUtils, SessionType } from '@wildo-ai/saas-models';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { useAppScopeSafe } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { errorManagement } from '~wildo-frontend-lib/core/errors/error-management.frontend.service';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useUserOrgs } from './useUserOrgs';\nimport {\n  RouteOrganizationAccess,\n  findDefaultApiReadOperation,\n  hasActiveMembershipInOrganization,\n} from './route-organization-access.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\n\n/** The verdicts only the server can give. */\ntype ServerAccessVerdict = RouteOrganizationAccess.ADMITTED | RouteOrganizationAccess.REFUSED | RouteOrganizationAccess.INCONCLUSIVE;\n\n/**\n * Must be called inside the authenticated route: it reads the matched route's params (a layout route\n * sees its child's params), the registry, the session and AppScope.\n */\nexport function useRouteOrganizationAccess(): RouteOrganizationAccess {\n  const routeParameters = useParams<Record<string, string>>();\n  const { registry, doOperation } = useResourceRegistry();\n  const { auth, user } = useUserOrgs();\n  const appScope = useAppScopeSafe();\n\n  // The scoped `doOperation` changes identity with every AppScope change, and AppScope commits while a\n  // session settles. Depending on it would cancel the in-flight probe and send another one, so the effect\n  // reads the latest function through a ref. Explicit `contextualParameters` still win over the injected\n  // scope, so the probe addresses the route's organization whichever function is current.\n  const doOperationRef = useRef(doOperation);\n  doOperationRef.current = doOperation;\n\n  // The segment name is the ORGANIZATIONS resource's own identifier field, read from the registry rather\n  // than spelled here, so the check follows the routes the registry actually generates.\n  const organizationsConfiguration = registry.resourceConfigurations[CoreResourceType.ORGANIZATIONS];\n  const organizationFieldIdentifier = organizationsConfiguration?.resourceFieldIdentifier;\n  const routeOrganizationId = organizationFieldIdentifier ? routeParameters[organizationFieldIdentifier] : undefined;\n\n  const tokenSubjectId = appScope?.currentUserId ?? null;\n  // A one-off session is not judged here. Its token is bound to one organization by the server, and\n  // `UserOrgsContext.loadOrganizations` already confines the session to it; a probe with that narrowed\n  // token could refuse the very page the link was issued for.\n  const sessionIsJudgeable = !!auth.accessToken\n    && auth.sessionType !== SessionType.ONE_OFF\n    && !auth.isRestoringSession\n    && auth.sessionRestored\n    && !!user\n    && (!tokenSubjectId || user._id === tokenSubjectId);\n\n  const knownActiveMembership = !!routeOrganizationId && sessionIsJudgeable\n    && hasActiveMembershipInOrganization(user?.organizationMembers, routeOrganizationId);\n\n  const needsServerVerdict = !!routeOrganizationId && sessionIsJudgeable && !knownActiveMembership;\n  const verdictKey = needsServerVerdict ? `${user?._id}:${routeOrganizationId}` : null;\n\n  // One verdict per (account, organization), kept for the layout's lifetime. Moving between organizations\n  // past the membership cap then asks once each, not on every visit. The account is part of the key, so a\n  // different account signing in is always asked afresh.\n  const [serverVerdicts, setServerVerdicts] = useState<Readonly<Record<string, ServerAccessVerdict>>>({});\n  const cachedVerdict = verdictKey ? serverVerdicts[verdictKey] : undefined;\n\n  useEffect(() => {\n    if (!verdictKey || cachedVerdict || !routeOrganizationId || !organizationFieldIdentifier) {\n      return;\n    }\n\n    const recordVerdict = (verdict: ServerAccessVerdict): void => {\n      setServerVerdicts((previous) => ({ ...previous, [verdictKey]: verdict }));\n    };\n\n    const readOperation = findDefaultApiReadOperation(organizationsConfiguration);\n    if (!readOperation) {\n      recordVerdict(RouteOrganizationAccess.INCONCLUSIVE);\n      return;\n    }\n\n    let superseded = false;\n    doOperationRef.current(\n      ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(readOperation),\n      { contextualParameters: { [organizationFieldIdentifier]: routeOrganizationId } },\n      // Silent: the probe's refusal is answered by the redirect and its notice, never by the global error toast.\n      { silent: true },\n    )\n      .then(() => {\n        if (!superseded) recordVerdict(RouteOrganizationAccess.ADMITTED);\n      })\n      .catch((error: unknown) => {\n        if (superseded) return;\n        // A non-member's READ of another tenant's organization is a deliberate 404, not a 403, so both are refusals.\n        const refused = errorManagement.isAuthorizationError(error) || errorManagement.isNotFoundError(error);\n        if (!refused) {\n          logger.warn('Could not verify access to the organization addressed by the route', { organizationId: routeOrganizationId, error });\n        }\n        recordVerdict(refused ? RouteOrganizationAccess.REFUSED : RouteOrganizationAccess.INCONCLUSIVE);\n      });\n\n    return () => {\n      superseded = true;\n    };\n  }, [verdictKey, cachedVerdict, routeOrganizationId, organizationFieldIdentifier, organizationsConfiguration]);\n\n  if (!routeOrganizationId) {\n    return RouteOrganizationAccess.NOT_ADDRESSED;\n  }\n  if (!sessionIsJudgeable) {\n    return RouteOrganizationAccess.UNDECIDABLE;\n  }\n  if (knownActiveMembership) {\n    return RouteOrganizationAccess.ACTIVE_MEMBERSHIP;\n  }\n  return cachedVerdict ?? RouteOrganizationAccess.VERIFYING;\n}\n"]}

package/dist/esm/core/security/useStepUpAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useStepUpAuth.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,eAAO,MAAM,aAAa,QAAO,qBAMhC,CAAC"}
+{"version":3,"file":"useStepUpAuth.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,eAAO,MAAM,aAAa,QAAO,qBAMhC,CAAC"}

package/dist/esm/core/security/useStepUpAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"useStepUpAuth.js","sourceRoot":"","sources":["../../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAA8B,MAAM,qBAAqB,CAAC;AAEpF,MAAM,CAAC,MAAM,aAAa,GAAG,GAA0B,EAAE;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useStepUpAuth Hook\n * \n * Separated from StepUpAuthContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { StepUpAuthContext, type StepUpAuthContextType } from './StepUpAuthContext';\n\nexport const useStepUpAuth = (): StepUpAuthContextType => {\n  const context = useContext(StepUpAuthContext);\n  if (!context) {\n    throw new Error('useStepUpAuth must be used within a StepUpAuthProvider');\n  }\n  return context;\n};\n"]}
+{"version":3,"file":"useStepUpAuth.js","sourceRoot":"","sources":["../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAA8B,MAAM,qBAAqB,CAAC;AAEpF,MAAM,CAAC,MAAM,aAAa,GAAG,GAA0B,EAAE;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useStepUpAuth Hook\n * \n * Separated from StepUpAuthContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { StepUpAuthContext, type StepUpAuthContextType } from './StepUpAuthContext';\n\nexport const useStepUpAuth = (): StepUpAuthContextType => {\n  const context = useContext(StepUpAuthContext);\n  if (!context) {\n    throw new Error('useStepUpAuth must be used within a StepUpAuthProvider');\n  }\n  return context;\n};\n"]}

package/dist/esm/core/security/useUserOrgs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useUserOrgs.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,mBAM9B,CAAC"}
+{"version":3,"file":"useUserOrgs.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,mBAM9B,CAAC"}

package/dist/esm/core/security/useUserOrgs.js.map

@@ -1 +1 @@
-{"version":3,"file":"useUserOrgs.js","sourceRoot":"","sources":["../../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,eAAe,EAA4B,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAwB,EAAE;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useUserOrgs Hook\n * \n * Separated from UserOrgsContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { UserOrgsContext, type UserOrgsContextType } from './UserOrgsContext';\n\n/**\n * Hook to access the User Organizations context\n * @returns UserOrgsContextType with auth state and authentication functions\n * @throws Error if used outside of UserOrgsProvider\n */\nexport const useUserOrgs = (): UserOrgsContextType => {\n  const context = useContext(UserOrgsContext);\n  if (!context) {\n    throw new Error('useUserOrgs must be used within a UserOrgsProvider');\n  }\n  return context;\n};\n\n\n\n"]}
+{"version":3,"file":"useUserOrgs.js","sourceRoot":"","sources":["../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,eAAe,EAA4B,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAwB,EAAE;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useUserOrgs Hook\n * \n * Separated from UserOrgsContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { UserOrgsContext, type UserOrgsContextType } from './UserOrgsContext';\n\n/**\n * Hook to access the User Organizations context\n * @returns UserOrgsContextType with auth state and authentication functions\n * @throws Error if used outside of UserOrgsProvider\n */\nexport const useUserOrgs = (): UserOrgsContextType => {\n  const context = useContext(UserOrgsContext);\n  if (!context) {\n    throw new Error('useUserOrgs must be used within a UserOrgsProvider');\n  }\n  return context;\n};\n\n\n\n"]}

package/dist/esm/core/ui/SurfaceErrorBoundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SurfaceErrorBoundary.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAqB,MAAM,OAAO,CAAC;AAY1C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,UAAU,yBAAyB;IACjC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,oBAAqB,SAAQ,KAAK,CAAC,SAAS,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IAC7G,KAAK,EAAE,yBAAyB,CAG9B;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjF,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI;IAKjE,OAAO,CAAC,UAAU,CAEhB;IAEF,MAAM,IAAI,KAAK,CAAC,SAAS;CAO1B"}
+{"version":3,"file":"SurfaceErrorBoundary.d.ts","sourceRoot":"","sources":["../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAqB,MAAM,OAAO,CAAC;AAY1C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,UAAU,yBAAyB;IACjC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,oBAAqB,SAAQ,KAAK,CAAC,SAAS,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IAC7G,KAAK,EAAE,yBAAyB,CAG9B;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjF,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI;IAKjE,OAAO,CAAC,UAAU,CAEhB;IAEF,MAAM,IAAI,KAAK,CAAC,SAAS;CAO1B"}

package/dist/esm/core/ui/SurfaceErrorBoundary.js.map

@@ -1 +1 @@
-{"version":3,"file":"SurfaceErrorBoundary.js","sourceRoot":"","sources":["../../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":";AAAA,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAA4B,MAAM,uDAAuD,CAAC;AAC/G,OAAO,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAElG,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC;AAEjD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,kCAAkC,CAAC;AAWxF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK,CAAC,SAA+D;IAC7G,KAAK,GAA8B;QACjC,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAY;QAC1C,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,iBAAiB,CAAC,KAAY,EAAE,SAA0B;QACxD,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,UAAU,GAAG,GAAS,EAAE;QAC9B,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM;QACJ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7B,CAAC;QAED,OAAO,KAAC,oBAAoB,IAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,GAAI,CAAC;IACtH,CAAC;CACF;AAQD;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAC,wBAAwB,OAAK,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,sBAAsB,IAAI,GAAG,EAAE,GAAI,CAAC;IAChH,CAAC;IACD,OAAO,KAAC,6BAA6B,OAAK,KAAK,GAAI,CAAC;AACtD,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAgC;IACrE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAC,wBAAwB,OAAK,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,sBAAsB,CAAC,GAAI,CAAC;AACjG,CAAC;AAED,SAAS,wBAAwB,CAAC,EAChC,KAAK,EACL,SAAS,EACT,OAAO,EACP,KAAK,GAC0D;IAC/D,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC;IAChD,MAAM,eAAe,GAA0B,EAAE,CAAC;IAClD,IAAI,aAAa,EAAE,CAAC;QAClB,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACtG,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IAED,OAAO,CACL,KAAC,YAAY,IACX,OAAO,EAAC,OAAO,EACf,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EACrB,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EACzB,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC;gBACxB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,SAAS;aACnB;SACF,EACD,WAAW,EAAE,aAAa,EAC1B,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,EACnC,eAAe,EAAE,eAAe,GAChC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import React, { useContext } from 'react';\nimport { FrontendComponentType } from '@wildo-ai/presets-components-models';\nimport { ErrorDisplay, type ErrorDisplayDevInfo } from '~wildo-frontend-lib/components/feedback/error-display';\nimport { I18nContext } from '~wildo-frontend-lib/core/i18n/I18nContext';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\n\nconst logger = LoggerFrontendService.getLogger();\n\nconst SURFACE_ERROR_BOUNDARY = FrontendComponentType.APP_LAYOUTS_SURFACE_ERROR_BOUNDARY;\n\nexport interface SurfaceErrorBoundaryProps {\n  children: React.ReactNode;\n}\n\ninterface SurfaceErrorBoundaryState {\n  error: Error | null;\n  errorInfo: React.ErrorInfo | null;\n}\n\n/**\n * Surface-scoped crash isolation for `policy.interactiveState.errorBoundary`.\n *\n * This boundary intentionally avoids router/navigation recovery assumptions:\n * a surface can be rendered inside dialogs, menus, sidebars, or tests where\n * route-level recovery is not available. Route/app boundaries remain\n * responsible for full-page recovery.\n *\n * The fallback's words are labels of `APP_LAYOUTS_SURFACE_ERROR_BOUNDARY`. The crash's own message is\n * developer text, so it appears only in development diagnostics, never as what a person reads.\n */\nexport class SurfaceErrorBoundary extends React.Component<SurfaceErrorBoundaryProps, SurfaceErrorBoundaryState> {\n  state: SurfaceErrorBoundaryState = {\n    error: null,\n    errorInfo: null,\n  };\n\n  static getDerivedStateFromError(error: Error): Partial<SurfaceErrorBoundaryState> {\n    return { error };\n  }\n\n  componentDidCatch(error: Error, errorInfo: React.ErrorInfo): void {\n    logger.error('[SurfaceErrorBoundary] Surface child crashed', { error, errorInfo });\n    this.setState({ error, errorInfo });\n  }\n\n  private resetError = (): void => {\n    this.setState({ error: null, errorInfo: null });\n  };\n\n  render(): React.ReactNode {\n    if (!this.state.error) {\n      return this.props.children;\n    }\n\n    return <SurfaceErrorFallback error={this.state.error} errorInfo={this.state.errorInfo} onRetry={this.resetError} />;\n  }\n}\n\ninterface SurfaceErrorFallbackProps {\n  error: Error;\n  errorInfo: React.ErrorInfo | null;\n  onRetry: () => void;\n}\n\n/**\n * Words come from the i18n tree when a provider is mounted. A surface can also render where none is (an\n * isolated test, a tree mounted outside the application); there each label renders as its key, so the\n * missing words look missing instead of being replaced by invented English. Choosing a COMPONENT here,\n * rather than calling `useI18n` conditionally, keeps the hook order fixed.\n */\nfunction SurfaceErrorFallback(props: SurfaceErrorFallbackProps): React.JSX.Element | null {\n  const i18n = useContext(I18nContext);\n  if (!i18n) {\n    return <SurfaceErrorFallbackView {...props} label={(ref) => `components.${SURFACE_ERROR_BOUNDARY}.${ref}`} />;\n  }\n  return <LocalizedSurfaceErrorFallback {...props} />;\n}\n\nfunction LocalizedSurfaceErrorFallback(props: SurfaceErrorFallbackProps): React.JSX.Element | null {\n  const { makeTrComponent, isReady } = useI18n({ component: SURFACE_ERROR_BOUNDARY });\n  if (!isReady) return null;\n  return <SurfaceErrorFallbackView {...props} label={makeTrComponent(SURFACE_ERROR_BOUNDARY)} />;\n}\n\nfunction SurfaceErrorFallbackView({\n  error,\n  errorInfo,\n  onRetry,\n  label,\n}: SurfaceErrorFallbackProps & { label: (ref: string) => string }): React.JSX.Element {\n  const isDevelopment = envLoader.isDevelopment();\n  const devInfoSections: ErrorDisplayDevInfo[] = [];\n  if (isDevelopment) {\n    devInfoSections.push({ label: label('errorMessageLabel'), content: error.message, variant: 'error' });\n    if (errorInfo?.componentStack) {\n      devInfoSections.push({ label: label('componentStackLabel'), content: errorInfo.componentStack, variant: 'info' });\n    }\n  }\n\n  return (\n    <ErrorDisplay\n      variant=\"error\"\n      title={label('title')}\n      message={label('message')}\n      actions={[\n        {\n          label: label('tryAgain'),\n          onClick: onRetry,\n          variant: 'primary',\n        },\n      ]}\n      showDevInfo={isDevelopment}\n      devInfoTitle={label('devInfoTitle')}\n      devInfoSections={devInfoSections}\n    />\n  );\n}\n"]}
+{"version":3,"file":"SurfaceErrorBoundary.js","sourceRoot":"","sources":["../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":";AAAA,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAA4B,MAAM,uDAAuD,CAAC;AAC/G,OAAO,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAElG,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC;AAEjD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,kCAAkC,CAAC;AAWxF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK,CAAC,SAA+D;IAC7G,KAAK,GAA8B;QACjC,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAY;QAC1C,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,iBAAiB,CAAC,KAAY,EAAE,SAA0B;QACxD,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,UAAU,GAAG,GAAS,EAAE;QAC9B,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM;QACJ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7B,CAAC;QAED,OAAO,KAAC,oBAAoB,IAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,GAAI,CAAC;IACtH,CAAC;CACF;AAQD;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAC,wBAAwB,OAAK,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,sBAAsB,IAAI,GAAG,EAAE,GAAI,CAAC;IAChH,CAAC;IACD,OAAO,KAAC,6BAA6B,OAAK,KAAK,GAAI,CAAC;AACtD,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAgC;IACrE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAC,wBAAwB,OAAK,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,sBAAsB,CAAC,GAAI,CAAC;AACjG,CAAC;AAED,SAAS,wBAAwB,CAAC,EAChC,KAAK,EACL,SAAS,EACT,OAAO,EACP,KAAK,GAC0D;IAC/D,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC;IAChD,MAAM,eAAe,GAA0B,EAAE,CAAC;IAClD,IAAI,aAAa,EAAE,CAAC;QAClB,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACtG,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IAED,OAAO,CACL,KAAC,YAAY,IACX,OAAO,EAAC,OAAO,EACf,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EACrB,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EACzB,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC;gBACxB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,SAAS;aACnB;SACF,EACD,WAAW,EAAE,aAAa,EAC1B,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,EACnC,eAAe,EAAE,eAAe,GAChC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import React, { useContext } from 'react';\nimport { FrontendComponentType } from '@wildo-ai/presets-components-models';\nimport { ErrorDisplay, type ErrorDisplayDevInfo } from '~wildo-frontend-lib/components/feedback/error-display';\nimport { I18nContext } from '~wildo-frontend-lib/core/i18n/I18nContext';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\n\nconst logger = LoggerFrontendService.getLogger();\n\nconst SURFACE_ERROR_BOUNDARY = FrontendComponentType.APP_LAYOUTS_SURFACE_ERROR_BOUNDARY;\n\nexport interface SurfaceErrorBoundaryProps {\n  children: React.ReactNode;\n}\n\ninterface SurfaceErrorBoundaryState {\n  error: Error | null;\n  errorInfo: React.ErrorInfo | null;\n}\n\n/**\n * Surface-scoped crash isolation for `policy.interactiveState.errorBoundary`.\n *\n * This boundary intentionally avoids router/navigation recovery assumptions:\n * a surface can be rendered inside dialogs, menus, sidebars, or tests where\n * route-level recovery is not available. Route/app boundaries remain\n * responsible for full-page recovery.\n *\n * The fallback's words are labels of `APP_LAYOUTS_SURFACE_ERROR_BOUNDARY`. The crash's own message is\n * developer text, so it appears only in development diagnostics, never as what a person reads.\n */\nexport class SurfaceErrorBoundary extends React.Component<SurfaceErrorBoundaryProps, SurfaceErrorBoundaryState> {\n  state: SurfaceErrorBoundaryState = {\n    error: null,\n    errorInfo: null,\n  };\n\n  static getDerivedStateFromError(error: Error): Partial<SurfaceErrorBoundaryState> {\n    return { error };\n  }\n\n  componentDidCatch(error: Error, errorInfo: React.ErrorInfo): void {\n    logger.error('[SurfaceErrorBoundary] Surface child crashed', { error, errorInfo });\n    this.setState({ error, errorInfo });\n  }\n\n  private resetError = (): void => {\n    this.setState({ error: null, errorInfo: null });\n  };\n\n  render(): React.ReactNode {\n    if (!this.state.error) {\n      return this.props.children;\n    }\n\n    return <SurfaceErrorFallback error={this.state.error} errorInfo={this.state.errorInfo} onRetry={this.resetError} />;\n  }\n}\n\ninterface SurfaceErrorFallbackProps {\n  error: Error;\n  errorInfo: React.ErrorInfo | null;\n  onRetry: () => void;\n}\n\n/**\n * Words come from the i18n tree when a provider is mounted. A surface can also render where none is (an\n * isolated test, a tree mounted outside the application); there each label renders as its key, so the\n * missing words look missing instead of being replaced by invented English. Choosing a COMPONENT here,\n * rather than calling `useI18n` conditionally, keeps the hook order fixed.\n */\nfunction SurfaceErrorFallback(props: SurfaceErrorFallbackProps): React.JSX.Element | null {\n  const i18n = useContext(I18nContext);\n  if (!i18n) {\n    return <SurfaceErrorFallbackView {...props} label={(ref) => `components.${SURFACE_ERROR_BOUNDARY}.${ref}`} />;\n  }\n  return <LocalizedSurfaceErrorFallback {...props} />;\n}\n\nfunction LocalizedSurfaceErrorFallback(props: SurfaceErrorFallbackProps): React.JSX.Element | null {\n  const { makeTrComponent, isReady } = useI18n({ component: SURFACE_ERROR_BOUNDARY });\n  if (!isReady) return null;\n  return <SurfaceErrorFallbackView {...props} label={makeTrComponent(SURFACE_ERROR_BOUNDARY)} />;\n}\n\nfunction SurfaceErrorFallbackView({\n  error,\n  errorInfo,\n  onRetry,\n  label,\n}: SurfaceErrorFallbackProps & { label: (ref: string) => string }): React.JSX.Element {\n  const isDevelopment = envLoader.isDevelopment();\n  const devInfoSections: ErrorDisplayDevInfo[] = [];\n  if (isDevelopment) {\n    devInfoSections.push({ label: label('errorMessageLabel'), content: error.message, variant: 'error' });\n    if (errorInfo?.componentStack) {\n      devInfoSections.push({ label: label('componentStackLabel'), content: errorInfo.componentStack, variant: 'info' });\n    }\n  }\n\n  return (\n    <ErrorDisplay\n      variant=\"error\"\n      title={label('title')}\n      message={label('message')}\n      actions={[\n        {\n          label: label('tryAgain'),\n          onClick: onRetry,\n          variant: 'primary',\n        },\n      ]}\n      showDevInfo={isDevelopment}\n      devInfoTitle={label('devInfoTitle')}\n      devInfoSections={devInfoSections}\n    />\n  );\n}\n"]}

package/dist/esm/core/ui/SurfaceErrorBoundary.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SurfaceErrorBoundary.labels.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/SurfaceErrorBoundary.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA2B,MAAM,qCAAqC,CAAC;AAM1I,eAAO,MAAM,oCAAoC,EAAE,mBAAmB,EAOrE,CAAC"}
+{"version":3,"file":"SurfaceErrorBoundary.labels.d.ts","sourceRoot":"","sources":["../../../../src/core/ui/SurfaceErrorBoundary.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,mBAAmB,EAA2B,MAAM,qCAAqC,CAAC;AAM1I,eAAO,MAAM,oCAAoC,EAAE,mBAAmB,EAOrE,CAAC"}

package/dist/esm/core/ui/SurfaceErrorBoundary.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"SurfaceErrorBoundary.labels.js","sourceRoot":"","sources":["../../../../../src/core/ui/SurfaceErrorBoundary.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE1I,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAE/E,MAAM,CAAC,MAAM,oCAAoC,GAA0B;IACzE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,qIAAqI,EAAE;IACzL,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,6GAA6G,EAAE;IACnK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,kEAAkE,EAAE;IACxH,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kFAAkF,EAAE;IAC7I,EAAE,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,qEAAqE,EAAE;IACnI,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,sEAAsE,EAAE;CACvI,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,oCAAoC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, registerComponentLabels } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + (where\n// authored) per-key purpose / kind / variable meaning. Statically scanned by\n// the dev companion; NOT imported at runtime, so it never ships in the bundle.\n\nexport const AppLayoutsSurfaceErrorBoundaryLabels: LabellingUnitaryDef[] = [\n  { ref: 'title', kind: LabelKind.HEADING, purpose: 'Heading shown in place of one part of a screen (a panel, dialog or menu) that failed to display; the rest of the screen still works' },\n  { ref: 'message', kind: LabelKind.MESSAGE, purpose: 'Short reassuring text explaining that this part of the screen could not be displayed and can be tried again' },\n  { ref: 'tryAgain', kind: LabelKind.BUTTON, purpose: 'Action that tries to display the failed part of the screen again' },\n  { ref: 'devInfoTitle', kind: LabelKind.HEADING, purpose: 'Heading for the developer-only diagnostics of the part of the screen that failed' },\n  { ref: 'errorMessageLabel', kind: LabelKind.LABEL, purpose: 'Caption preceding the caught error message in developer diagnostics' },\n  { ref: 'componentStackLabel', kind: LabelKind.LABEL, purpose: 'Caption preceding the React component stack in developer diagnostics' },\n];\nregisterComponentLabels(FrontendComponentType.APP_LAYOUTS_SURFACE_ERROR_BOUNDARY, AppLayoutsSurfaceErrorBoundaryLabels);\n"]}
+{"version":3,"file":"SurfaceErrorBoundary.labels.js","sourceRoot":"","sources":["../../../../src/core/ui/SurfaceErrorBoundary.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAA4B,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE1I,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAE/E,MAAM,CAAC,MAAM,oCAAoC,GAA0B;IACzE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,qIAAqI,EAAE;IACzL,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,6GAA6G,EAAE;IACnK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,kEAAkE,EAAE;IACxH,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kFAAkF,EAAE;IAC7I,EAAE,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,qEAAqE,EAAE;IACnI,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,sEAAsE,EAAE;CACvI,CAAC;AACF,uBAAuB,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,oCAAoC,CAAC,CAAC","sourcesContent":["import { FrontendComponentType, LabelKind, type LabellingUnitaryDef, registerComponentLabels } from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for this component: keys + params + (where\n// authored) per-key purpose / kind / variable meaning. Statically scanned by\n// the dev companion; NOT imported at runtime, so it never ships in the bundle.\n\nexport const AppLayoutsSurfaceErrorBoundaryLabels: LabellingUnitaryDef[] = [\n  { ref: 'title', kind: LabelKind.HEADING, purpose: 'Heading shown in place of one part of a screen (a panel, dialog or menu) that failed to display; the rest of the screen still works' },\n  { ref: 'message', kind: LabelKind.MESSAGE, purpose: 'Short reassuring text explaining that this part of the screen could not be displayed and can be tried again' },\n  { ref: 'tryAgain', kind: LabelKind.BUTTON, purpose: 'Action that tries to display the failed part of the screen again' },\n  { ref: 'devInfoTitle', kind: LabelKind.HEADING, purpose: 'Heading for the developer-only diagnostics of the part of the screen that failed' },\n  { ref: 'errorMessageLabel', kind: LabelKind.LABEL, purpose: 'Caption preceding the caught error message in developer diagnostics' },\n  { ref: 'componentStackLabel', kind: LabelKind.LABEL, purpose: 'Caption preceding the React component stack in developer diagnostics' },\n];\nregisterComponentLabels(FrontendComponentType.APP_LAYOUTS_SURFACE_ERROR_BOUNDARY, AppLayoutsSurfaceErrorBoundaryLabels);\n"]}

package/dist/esm/core/ui/SurfacePolicyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SurfacePolicyContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/SurfacePolicyContext.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EACnB,MAAM,qCAAqC,CAAC;AAK7C,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,eAAe,EAAE,OAAO,CAAC;IACzB,4BAA4B,EAAE,cAAc,GAAG,IAAI,CAAC;IACpD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACrD,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACnE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED,eAAO,MAAM,oBAAoB,oDAAwD,CAAC;AAmO1F;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,aAAa,EAC/B,YAAY,EAAE,wBAAwB,GAAG,SAAS,EAClD,iBAAiB,EAAE,wBAAwB,GAAG,SAAS,EACvD,gBAAgB,EAAE,wBAAwB,GAAG,SAAS,EACtD,OAAO,EAAE,yBAAyB,GACjC,aAAa,CAwBf;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,aAAa,EAAE,yBAAyB,GAAG,IAAI,EAC/C,kBAAkB,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,UAAU,GAAG,kBAAkB,GAAG,oBAAoB,CAAC,GAC3G,yBAAyB,CAiB3B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,cAAoC,GAAG,aAAa,CAE1F;AAED,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C"}
+{"version":3,"file":"SurfacePolicyContext.d.ts","sourceRoot":"","sources":["../../../../src/core/ui/SurfacePolicyContext.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EACnB,MAAM,qCAAqC,CAAC;AAK7C,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,eAAe,EAAE,OAAO,CAAC;IACzB,4BAA4B,EAAE,cAAc,GAAG,IAAI,CAAC;IACpD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACrD,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACnE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED,eAAO,MAAM,oBAAoB,oDAAwD,CAAC;AAmO1F;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,aAAa,EAC/B,YAAY,EAAE,wBAAwB,GAAG,SAAS,EAClD,iBAAiB,EAAE,wBAAwB,GAAG,SAAS,EACvD,gBAAgB,EAAE,wBAAwB,GAAG,SAAS,EACtD,OAAO,EAAE,yBAAyB,GACjC,aAAa,CAwBf;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,aAAa,EAAE,yBAAyB,GAAG,IAAI,EAC/C,kBAAkB,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,UAAU,GAAG,kBAAkB,GAAG,oBAAoB,CAAC,GAC3G,yBAAyB,CAiB3B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,cAAoC,GAAG,aAAa,CAE1F;AAED,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C"}