@wildo-ai/saas-frontend-lib 1.1.6 → 1.1.7

package/dist/esm/core/security/cross-frontend-handoff.frontend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"cross-frontend-handoff.frontend.service.js","sourceRoot":"","sources":["../../../../../src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EACL,6BAA6B,GAG9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AA2B7H;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,IAAI,CAAsC;IAC1C,UAAU,CAAgB;IAEnC,YAAY,IAAyC,EAAE,OAAe,EAAE,UAAyB;QAC/F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAkC,EAClC,OAAwB;IAExB,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,QAAiB,EAAE,CAAC;QAC3B,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;QACvC,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,oBAAoB,EACpB,yDAAyD,EACzD,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC;AAE1F;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAiB;IACxC,IAAI,QAAQ,YAAY,+BAA+B;QAAE,OAAO,QAAQ,CAAC;IAEzE,MAAM,SAAS,GAAG,QAKV,CAAC;IAET,MAAM,UAAU,GACd,OAAO,SAAS,EAAE,QAAQ,EAAE,MAAM,KAAK,QAAQ;QAC7C,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;QAC3B,CAAC,CAAC,OAAO,SAAS,EAAE,UAAU,KAAK,QAAQ;YACzC,CAAC,CAAC,SAAS,CAAC,UAAU;YACtB,CAAC,CAAC,IAAI,CAAC;IAEb,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,+BAA+B,CACxC,SAAS,EACT,SAAS,EAAE,OAAO,IAAI,qDAAqD,EAC3E,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,+BAA+B,CACxC,iBAAiB,EACjB,0DAA0D,EAC1D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;QAC/C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;IAE3B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,+BAA+B,CACxC,OAAwC,EACxC,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,+BAA+B,CACxC,oBAAoB,EACpB,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA6B,MAAM,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAyC,IAAI,CAAC,CAAC;IAEjF,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAE5B,SAAS,CAAC,GAAG,EAAE;QACb,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;QAC9B,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,cAAc,GAAG,WAAW,CAChC,KAAK,EACH,KAAkC,EAClC,OAAwB,EACe,EAAE;QACzC,MAAM,MAAM,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC;QACnC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnE,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAClB,SAAS,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,QAAiB,EAAE,CAAC;YAC3B,MAAM,UAAU,GACd,QAAQ,YAAY,+BAA+B;gBACjD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,+BAA+B,CACjC,oBAAoB,EACpB,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,EAC9E,IAAI,CACL,CAAC;YACR,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * Cross-Frontend Handoff helper — first-party SaaS-app wrapper around\n * `POST /api/v1/auth/cross-frontend-handoff` (cross-app-jwt-propagation Step 3).\n *\n * Two surfaces:\n *\n *   1. `requestCrossFrontendHandoff(input)` — vanilla TS / no React. Wraps the\n *      manual-calls HTTP client, maps backend `CrossFrontendHandoffErrorCode`\n *      values onto a typed `CrossFrontendHandoffClientError`, and returns the\n *      `{ handoffUrl, expiresAt }` payload unchanged. The caller decides how\n *      to use the URL (`location.assign` for replace, `window.open` for new\n *      tab) — the helper deliberately does NOT navigate.\n *\n *   2. `useCrossFrontendHandoff()` — thin React hook wrapper for first-party\n *      app components that want `{ status, data, error, requestHandoff, reset }`\n *      ergonomics without bringing React Query in for a one-shot mutation.\n *\n * DTO atoms come from `@wildo-ai/saas-models/public-runtime`\n * (saas-models-public-runtime.md K-7) so the same symbol identity used by the\n * docs-site `docs-auth-client.ts` flows through here. The runtime call delegates\n * to `getManualCallsHttpClient()`, which inherits the auth + frontend-service\n * header injection performed by the base `WildoBackendHttpClient` interceptors.\n *\n * The bearer + `X-Frontend-Service-Name` header are injected automatically by\n * the base client; callers do NOT need to thread them through.\n */\n\nimport { useCallback, useEffect, useRef, useState } from 'react';\nimport {\n  CrossFrontendHandoffErrorCode,\n  type CrossFrontendHandoffRequest,\n  type CrossFrontendHandoffResponse,\n} from '@wildo-ai/saas-models/public-runtime';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport type { RequestOptions } from '~wildo-frontend-lib/core/requests/wildo-http-client.frontend.service';\n\n/**\n * Stable, finite set of error codes a SaaS-app caller may encounter when\n * invoking `requestCrossFrontendHandoff()`.\n *\n * Mirrors the backend enum 1:1 PLUS three runtime-only codes that never reach\n * the wire:\n *\n *   - `unauthenticated` — the caller's bearer is missing/expired/rejected\n *     (HTTP 401). Surfaced WITHOUT trying to parse a backend `code` so the\n *     caller can deep-link to login instead of branching on UNKNOWN_TARGET_*.\n *   - `network`        — no HTTP response was received (offline, DNS, CORS\n *     pre-flight rejection, etc.). The base client retried per its policy\n *     before this code is surfaced.\n *   - `malformed_response` — the request returned 2xx but the body did not\n *     match `CrossFrontendHandoffResponse`, OR the request returned an error\n *     body without a recognizable `error.details.code` field. Treat as a\n *     transient backend incident.\n */\nexport type CrossFrontendHandoffClientErrorCode =\n  | CrossFrontendHandoffErrorCode\n  | 'unauthenticated'\n  | 'network'\n  | 'malformed_response';\n\n/**\n * Typed error thrown by `requestCrossFrontendHandoff()` and stored in the\n * `error` field of `useCrossFrontendHandoff()`.\n *\n * Subclasses native `Error` so `instanceof CrossFrontendHandoffClientError` is\n * the safe way to distinguish from generic axios / network errors at a call\n * site. The `code` discriminator is the contract surface that callers branch\n * on; `httpStatus` is provided for telemetry / Sentry breadcrumbs only.\n */\nexport class CrossFrontendHandoffClientError extends Error {\n  readonly code: CrossFrontendHandoffClientErrorCode;\n  readonly httpStatus: number | null;\n\n  constructor(code: CrossFrontendHandoffClientErrorCode, message: string, httpStatus: number | null) {\n    super(message);\n    this.name = 'CrossFrontendHandoffClientError';\n    this.code = code;\n    this.httpStatus = httpStatus;\n  }\n}\n\n/**\n * Vanilla TS handoff request — no React.\n *\n * Behavior:\n *   - On 2xx with a well-formed body, returns the response unchanged.\n *   - On 2xx with a malformed body, throws `code: 'malformed_response'`.\n *   - On 401, throws `code: 'unauthenticated'` regardless of the backend's\n *     specific code (the base client may already have triggered a refresh-loop\n *     before this branch is reached).\n *   - On other 4xx with a recognized `error.details.code`, throws with that\n *     `CrossFrontendHandoffErrorCode` code so the caller can branch on\n *     `UNKNOWN_TARGET_FRONTEND` vs `TARGET_FRONTEND_HOST_NOT_CONFIGURED`.\n *   - On 4xx/5xx without a recognized code, throws `code: 'malformed_response'`.\n *   - On network failure (no response), throws `code: 'network'`.\n *\n * Pass-through `options` are forwarded to the underlying HTTP client; useful\n * fields: `signal` (AbortController), `silent` (suppress global error toast).\n */\nexport async function requestCrossFrontendHandoff(\n  input: CrossFrontendHandoffRequest,\n  options?: RequestOptions,\n): Promise<CrossFrontendHandoffResponse> {\n  let response: CrossFrontendHandoffResponse;\n  try {\n    response = await getManualCallsHttpClient().crossFrontendHandoff(input, options);\n  } catch (rawError: unknown) {\n    throw mapHandoffError(rawError);\n  }\n\n  if (\n    !response ||\n    typeof response.handoffUrl !== 'string' ||\n    typeof response.expiresAt !== 'string'\n  ) {\n    throw new CrossFrontendHandoffClientError(\n      'malformed_response',\n      'Cross-frontend handoff response missing required fields',\n      null,\n    );\n  }\n  return { handoffUrl: response.handoffUrl, expiresAt: response.expiresAt };\n}\n\nconst HANDOFF_ERROR_CODES = new Set<string>(Object.values(CrossFrontendHandoffErrorCode));\n\n/**\n * Internal — translate any thrown value (axios error, native Error, string,\n * unknown) into a `CrossFrontendHandoffClientError`.\n *\n * The base client's `responseErrorInterceptor` mutates the axios error in\n * place: it sets `error.httpStatus`, `error.context = nested.details`, and\n * preserves the raw envelope on `error.response.data`. We read the raw\n * envelope first (most reliable) and fall back to `error.context` second.\n */\nfunction mapHandoffError(rawError: unknown): CrossFrontendHandoffClientError {\n  if (rawError instanceof CrossFrontendHandoffClientError) return rawError;\n\n  const errorLike = rawError as {\n    response?: { status?: number; data?: { error?: { details?: { code?: unknown } } } };\n    httpStatus?: number;\n    context?: { code?: unknown };\n    message?: string;\n  } | null;\n\n  const httpStatus =\n    typeof errorLike?.response?.status === 'number'\n      ? errorLike.response.status\n      : typeof errorLike?.httpStatus === 'number'\n        ? errorLike.httpStatus\n        : null;\n\n  if (httpStatus === null) {\n    return new CrossFrontendHandoffClientError(\n      'network',\n      errorLike?.message ?? 'Cross-frontend handoff request failed (no response)',\n      null,\n    );\n  }\n\n  if (httpStatus === 401) {\n    return new CrossFrontendHandoffClientError(\n      'unauthenticated',\n      'Cross-frontend handoff requires an authenticated session',\n      401,\n    );\n  }\n\n  const rawCode =\n    errorLike?.response?.data?.error?.details?.code ??\n    errorLike?.context?.code;\n\n  if (typeof rawCode === 'string' && HANDOFF_ERROR_CODES.has(rawCode)) {\n    return new CrossFrontendHandoffClientError(\n      rawCode as CrossFrontendHandoffErrorCode,\n      errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n      httpStatus,\n    );\n  }\n\n  return new CrossFrontendHandoffClientError(\n    'malformed_response',\n    errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n    httpStatus,\n  );\n}\n\nexport type CrossFrontendHandoffStatus = 'idle' | 'pending' | 'success' | 'error';\n\n/**\n * State + action surface returned by `useCrossFrontendHandoff()`.\n *\n * `requestHandoff` returns the resolved `CrossFrontendHandoffResponse` on\n * success and re-throws the typed `CrossFrontendHandoffClientError` on failure\n * — so callers that need to redirect immediately can `await` it without also\n * subscribing to `status`. Hook state (`status` / `data` / `error`) is updated\n * regardless, which is convenient for components that render status without\n * holding a ref to the promise.\n */\nexport interface UseCrossFrontendHandoffResult {\n  status: CrossFrontendHandoffStatus;\n  data: CrossFrontendHandoffResponse | null;\n  error: CrossFrontendHandoffClientError | null;\n  requestHandoff: (\n    input: CrossFrontendHandoffRequest,\n    options?: RequestOptions,\n  ) => Promise<CrossFrontendHandoffResponse>;\n  reset: () => void;\n}\n\n/**\n * React hook wrapper around `requestCrossFrontendHandoff()` for first-party\n * SaaS-app components.\n *\n * Why not `useMutation` / `useReducer`: this is a one-shot, fire-and-forget\n * mutation with no caching / invalidation needs; pulling React Query in for\n * three lines of state would inflate the bundle and force a peer dep that\n * `saas-frontend-lib` does not currently take. `useState` + `useCallback` +\n * an `unmounted` guard cover the use case.\n */\nexport function useCrossFrontendHandoff(): UseCrossFrontendHandoffResult {\n  const [status, setStatus] = useState<CrossFrontendHandoffStatus>('idle');\n  const [data, setData] = useState<CrossFrontendHandoffResponse | null>(null);\n  const [error, setError] = useState<CrossFrontendHandoffClientError | null>(null);\n\n  const unmountedRef = useRef(false);\n  const callIdRef = useRef(0);\n\n  useEffect(() => {\n    unmountedRef.current = false;\n    return () => {\n      unmountedRef.current = true;\n    };\n  }, []);\n\n  const requestHandoff = useCallback(\n    async (\n      input: CrossFrontendHandoffRequest,\n      options?: RequestOptions,\n    ): Promise<CrossFrontendHandoffResponse> => {\n      const callId = ++callIdRef.current;\n      setStatus('pending');\n      setError(null);\n      try {\n        const response = await requestCrossFrontendHandoff(input, options);\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setData(response);\n          setStatus('success');\n        }\n        return response;\n      } catch (rawError: unknown) {\n        const typedError =\n          rawError instanceof CrossFrontendHandoffClientError\n            ? rawError\n            : new CrossFrontendHandoffClientError(\n                'malformed_response',\n                rawError instanceof Error ? rawError.message : 'Cross-frontend handoff failed',\n                null,\n              );\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setError(typedError);\n          setStatus('error');\n        }\n        throw typedError;\n      }\n    },\n    [],\n  );\n\n  const reset = useCallback(() => {\n    callIdRef.current++;\n    setStatus('idle');\n    setData(null);\n    setError(null);\n  }, []);\n\n  return { status, data, error, requestHandoff, reset };\n}\n"]}
+{"version":3,"file":"cross-frontend-handoff.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/security/cross-frontend-handoff.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EACL,6BAA6B,GAG9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AA2B7H;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,IAAI,CAAsC;IAC1C,UAAU,CAAgB;IAEnC,YAAY,IAAyC,EAAE,OAAe,EAAE,UAAyB;QAC/F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAkC,EAClC,OAAwB;IAExB,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,QAAiB,EAAE,CAAC;QAC3B,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,IACE,CAAC,QAAQ;QACT,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;QACvC,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,oBAAoB,EACpB,yDAAyD,EACzD,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC;AAE1F;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAiB;IACxC,IAAI,QAAQ,YAAY,+BAA+B;QAAE,OAAO,QAAQ,CAAC;IAEzE,MAAM,SAAS,GAAG,QAKV,CAAC;IAET,MAAM,UAAU,GACd,OAAO,SAAS,EAAE,QAAQ,EAAE,MAAM,KAAK,QAAQ;QAC7C,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;QAC3B,CAAC,CAAC,OAAO,SAAS,EAAE,UAAU,KAAK,QAAQ;YACzC,CAAC,CAAC,SAAS,CAAC,UAAU;YACtB,CAAC,CAAC,IAAI,CAAC;IAEb,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,+BAA+B,CACxC,SAAS,EACT,SAAS,EAAE,OAAO,IAAI,qDAAqD,EAC3E,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,+BAA+B,CACxC,iBAAiB,EACjB,0DAA0D,EAC1D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;QAC/C,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;IAE3B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,+BAA+B,CACxC,OAAwC,EACxC,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,+BAA+B,CACxC,oBAAoB,EACpB,SAAS,EAAE,OAAO,IAAI,uCAAuC,UAAU,GAAG,EAC1E,UAAU,CACX,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA6B,MAAM,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAyC,IAAI,CAAC,CAAC;IAEjF,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAE5B,SAAS,CAAC,GAAG,EAAE;QACb,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC;QAC9B,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,cAAc,GAAG,WAAW,CAChC,KAAK,EACH,KAAkC,EAClC,OAAwB,EACe,EAAE;QACzC,MAAM,MAAM,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC;QACnC,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnE,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAClB,SAAS,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,QAAiB,EAAE,CAAC;YAC3B,MAAM,UAAU,GACd,QAAQ,YAAY,+BAA+B;gBACjD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,+BAA+B,CACjC,oBAAoB,EACpB,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,EAC9E,IAAI,CACL,CAAC;YACR,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC1D,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACrB,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,UAAU,CAAC;QACnB,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * Cross-Frontend Handoff helper — first-party SaaS-app wrapper around\n * `POST /api/v1/auth/cross-frontend-handoff` (cross-app-jwt-propagation Step 3).\n *\n * Two surfaces:\n *\n *   1. `requestCrossFrontendHandoff(input)` — vanilla TS / no React. Wraps the\n *      manual-calls HTTP client, maps backend `CrossFrontendHandoffErrorCode`\n *      values onto a typed `CrossFrontendHandoffClientError`, and returns the\n *      `{ handoffUrl, expiresAt }` payload unchanged. The caller decides how\n *      to use the URL (`location.assign` for replace, `window.open` for new\n *      tab) — the helper deliberately does NOT navigate.\n *\n *   2. `useCrossFrontendHandoff()` — thin React hook wrapper for first-party\n *      app components that want `{ status, data, error, requestHandoff, reset }`\n *      ergonomics without bringing React Query in for a one-shot mutation.\n *\n * DTO atoms come from `@wildo-ai/saas-models/public-runtime`\n * (saas-models-public-runtime.md K-7) so the same symbol identity used by the\n * docs-site `docs-auth-client.ts` flows through here. The runtime call delegates\n * to `getManualCallsHttpClient()`, which inherits the auth + frontend-service\n * header injection performed by the base `WildoBackendHttpClient` interceptors.\n *\n * The bearer + `X-Frontend-Service-Name` header are injected automatically by\n * the base client; callers do NOT need to thread them through.\n */\n\nimport { useCallback, useEffect, useRef, useState } from 'react';\nimport {\n  CrossFrontendHandoffErrorCode,\n  type CrossFrontendHandoffRequest,\n  type CrossFrontendHandoffResponse,\n} from '@wildo-ai/saas-models/public-runtime';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport type { RequestOptions } from '~wildo-frontend-lib/core/requests/wildo-http-client.frontend.service';\n\n/**\n * Stable, finite set of error codes a SaaS-app caller may encounter when\n * invoking `requestCrossFrontendHandoff()`.\n *\n * Mirrors the backend enum 1:1 PLUS three runtime-only codes that never reach\n * the wire:\n *\n *   - `unauthenticated` — the caller's bearer is missing/expired/rejected\n *     (HTTP 401). Surfaced WITHOUT trying to parse a backend `code` so the\n *     caller can deep-link to login instead of branching on UNKNOWN_TARGET_*.\n *   - `network`        — no HTTP response was received (offline, DNS, CORS\n *     pre-flight rejection, etc.). The base client retried per its policy\n *     before this code is surfaced.\n *   - `malformed_response` — the request returned 2xx but the body did not\n *     match `CrossFrontendHandoffResponse`, OR the request returned an error\n *     body without a recognizable `error.details.code` field. Treat as a\n *     transient backend incident.\n */\nexport type CrossFrontendHandoffClientErrorCode =\n  | CrossFrontendHandoffErrorCode\n  | 'unauthenticated'\n  | 'network'\n  | 'malformed_response';\n\n/**\n * Typed error thrown by `requestCrossFrontendHandoff()` and stored in the\n * `error` field of `useCrossFrontendHandoff()`.\n *\n * Subclasses native `Error` so `instanceof CrossFrontendHandoffClientError` is\n * the safe way to distinguish from generic axios / network errors at a call\n * site. The `code` discriminator is the contract surface that callers branch\n * on; `httpStatus` is provided for telemetry / Sentry breadcrumbs only.\n */\nexport class CrossFrontendHandoffClientError extends Error {\n  readonly code: CrossFrontendHandoffClientErrorCode;\n  readonly httpStatus: number | null;\n\n  constructor(code: CrossFrontendHandoffClientErrorCode, message: string, httpStatus: number | null) {\n    super(message);\n    this.name = 'CrossFrontendHandoffClientError';\n    this.code = code;\n    this.httpStatus = httpStatus;\n  }\n}\n\n/**\n * Vanilla TS handoff request — no React.\n *\n * Behavior:\n *   - On 2xx with a well-formed body, returns the response unchanged.\n *   - On 2xx with a malformed body, throws `code: 'malformed_response'`.\n *   - On 401, throws `code: 'unauthenticated'` regardless of the backend's\n *     specific code (the base client may already have triggered a refresh-loop\n *     before this branch is reached).\n *   - On other 4xx with a recognized `error.details.code`, throws with that\n *     `CrossFrontendHandoffErrorCode` code so the caller can branch on\n *     `UNKNOWN_TARGET_FRONTEND` vs `TARGET_FRONTEND_HOST_NOT_CONFIGURED`.\n *   - On 4xx/5xx without a recognized code, throws `code: 'malformed_response'`.\n *   - On network failure (no response), throws `code: 'network'`.\n *\n * Pass-through `options` are forwarded to the underlying HTTP client; useful\n * fields: `signal` (AbortController), `silent` (suppress global error toast).\n */\nexport async function requestCrossFrontendHandoff(\n  input: CrossFrontendHandoffRequest,\n  options?: RequestOptions,\n): Promise<CrossFrontendHandoffResponse> {\n  let response: CrossFrontendHandoffResponse;\n  try {\n    response = await getManualCallsHttpClient().crossFrontendHandoff(input, options);\n  } catch (rawError: unknown) {\n    throw mapHandoffError(rawError);\n  }\n\n  if (\n    !response ||\n    typeof response.handoffUrl !== 'string' ||\n    typeof response.expiresAt !== 'string'\n  ) {\n    throw new CrossFrontendHandoffClientError(\n      'malformed_response',\n      'Cross-frontend handoff response missing required fields',\n      null,\n    );\n  }\n  return { handoffUrl: response.handoffUrl, expiresAt: response.expiresAt };\n}\n\nconst HANDOFF_ERROR_CODES = new Set<string>(Object.values(CrossFrontendHandoffErrorCode));\n\n/**\n * Internal — translate any thrown value (axios error, native Error, string,\n * unknown) into a `CrossFrontendHandoffClientError`.\n *\n * The base client's `responseErrorInterceptor` mutates the axios error in\n * place: it sets `error.httpStatus`, `error.context = nested.details`, and\n * preserves the raw envelope on `error.response.data`. We read the raw\n * envelope first (most reliable) and fall back to `error.context` second.\n */\nfunction mapHandoffError(rawError: unknown): CrossFrontendHandoffClientError {\n  if (rawError instanceof CrossFrontendHandoffClientError) return rawError;\n\n  const errorLike = rawError as {\n    response?: { status?: number; data?: { error?: { details?: { code?: unknown } } } };\n    httpStatus?: number;\n    context?: { code?: unknown };\n    message?: string;\n  } | null;\n\n  const httpStatus =\n    typeof errorLike?.response?.status === 'number'\n      ? errorLike.response.status\n      : typeof errorLike?.httpStatus === 'number'\n        ? errorLike.httpStatus\n        : null;\n\n  if (httpStatus === null) {\n    return new CrossFrontendHandoffClientError(\n      'network',\n      errorLike?.message ?? 'Cross-frontend handoff request failed (no response)',\n      null,\n    );\n  }\n\n  if (httpStatus === 401) {\n    return new CrossFrontendHandoffClientError(\n      'unauthenticated',\n      'Cross-frontend handoff requires an authenticated session',\n      401,\n    );\n  }\n\n  const rawCode =\n    errorLike?.response?.data?.error?.details?.code ??\n    errorLike?.context?.code;\n\n  if (typeof rawCode === 'string' && HANDOFF_ERROR_CODES.has(rawCode)) {\n    return new CrossFrontendHandoffClientError(\n      rawCode as CrossFrontendHandoffErrorCode,\n      errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n      httpStatus,\n    );\n  }\n\n  return new CrossFrontendHandoffClientError(\n    'malformed_response',\n    errorLike?.message ?? `Cross-frontend handoff failed (HTTP ${httpStatus})`,\n    httpStatus,\n  );\n}\n\nexport type CrossFrontendHandoffStatus = 'idle' | 'pending' | 'success' | 'error';\n\n/**\n * State + action surface returned by `useCrossFrontendHandoff()`.\n *\n * `requestHandoff` returns the resolved `CrossFrontendHandoffResponse` on\n * success and re-throws the typed `CrossFrontendHandoffClientError` on failure\n * — so callers that need to redirect immediately can `await` it without also\n * subscribing to `status`. Hook state (`status` / `data` / `error`) is updated\n * regardless, which is convenient for components that render status without\n * holding a ref to the promise.\n */\nexport interface UseCrossFrontendHandoffResult {\n  status: CrossFrontendHandoffStatus;\n  data: CrossFrontendHandoffResponse | null;\n  error: CrossFrontendHandoffClientError | null;\n  requestHandoff: (\n    input: CrossFrontendHandoffRequest,\n    options?: RequestOptions,\n  ) => Promise<CrossFrontendHandoffResponse>;\n  reset: () => void;\n}\n\n/**\n * React hook wrapper around `requestCrossFrontendHandoff()` for first-party\n * SaaS-app components.\n *\n * Why not `useMutation` / `useReducer`: this is a one-shot, fire-and-forget\n * mutation with no caching / invalidation needs; pulling React Query in for\n * three lines of state would inflate the bundle and force a peer dep that\n * `saas-frontend-lib` does not currently take. `useState` + `useCallback` +\n * an `unmounted` guard cover the use case.\n */\nexport function useCrossFrontendHandoff(): UseCrossFrontendHandoffResult {\n  const [status, setStatus] = useState<CrossFrontendHandoffStatus>('idle');\n  const [data, setData] = useState<CrossFrontendHandoffResponse | null>(null);\n  const [error, setError] = useState<CrossFrontendHandoffClientError | null>(null);\n\n  const unmountedRef = useRef(false);\n  const callIdRef = useRef(0);\n\n  useEffect(() => {\n    unmountedRef.current = false;\n    return () => {\n      unmountedRef.current = true;\n    };\n  }, []);\n\n  const requestHandoff = useCallback(\n    async (\n      input: CrossFrontendHandoffRequest,\n      options?: RequestOptions,\n    ): Promise<CrossFrontendHandoffResponse> => {\n      const callId = ++callIdRef.current;\n      setStatus('pending');\n      setError(null);\n      try {\n        const response = await requestCrossFrontendHandoff(input, options);\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setData(response);\n          setStatus('success');\n        }\n        return response;\n      } catch (rawError: unknown) {\n        const typedError =\n          rawError instanceof CrossFrontendHandoffClientError\n            ? rawError\n            : new CrossFrontendHandoffClientError(\n                'malformed_response',\n                rawError instanceof Error ? rawError.message : 'Cross-frontend handoff failed',\n                null,\n              );\n        if (!unmountedRef.current && callId === callIdRef.current) {\n          setError(typedError);\n          setStatus('error');\n        }\n        throw typedError;\n      }\n    },\n    [],\n  );\n\n  const reset = useCallback(() => {\n    callIdRef.current++;\n    setStatus('idle');\n    setData(null);\n    setError(null);\n  }, []);\n\n  return { status, data, error, requestHandoff, reset };\n}\n"]}

package/dist/esm/core/security/federated-reauthentication.frontend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"federated-reauthentication.frontend.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/federated-reauthentication.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,4HAA4H;AAC5H,eAAO,MAAM,iCAAiC,2BAA2B,CAAC;AAC1E,eAAO,MAAM,sCAAsC,oCAAoC,CAAC;AAExF,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,OAAO,sCAAsC,CAAC;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iGAAiG;AACjG,oBAAY,sCAAsC;IAChD,8CAA8C;IAC9C,aAAa,kBAAkB;IAC/B,qFAAqF;IACrF,SAAS,cAAc;IACvB,+HAA+H;IAC/H,SAAS,cAAc;IACvB,wEAAwE;IACxE,MAAM,WAAW;CAClB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;aAC7B,MAAM,EAAE,sCAAsC;gBAA9C,MAAM,EAAE,sCAAsC;CAI3E;AAOD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAE1D;AAED,8EAA8E;AAC9E,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,IAAI,CAAC,+BAA+B,EAAE,MAAM,CAAC,GAAG,IAAI,CAI3G;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,GAAE,MAA2C,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B3I;AAED;;;;;GAKG;AACH,wBAAsB,oCAAoC,CACxD,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAclC"}
+{"version":3,"file":"federated-reauthentication.frontend.d.ts","sourceRoot":"","sources":["../../../../src/core/security/federated-reauthentication.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,4HAA4H;AAC5H,eAAO,MAAM,iCAAiC,2BAA2B,CAAC;AAC1E,eAAO,MAAM,sCAAsC,oCAAoC,CAAC;AAExF,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,OAAO,sCAAsC,CAAC;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iGAAiG;AACjG,oBAAY,sCAAsC;IAChD,8CAA8C;IAC9C,aAAa,kBAAkB;IAC/B,qFAAqF;IACrF,SAAS,cAAc;IACvB,+HAA+H;IAC/H,SAAS,cAAc;IACvB,wEAAwE;IACxE,MAAM,WAAW;CAClB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;aAC7B,MAAM,EAAE,sCAAsC;gBAA9C,MAAM,EAAE,sCAAsC;CAI3E;AAOD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAE1D;AAED,8EAA8E;AAC9E,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,IAAI,CAAC,+BAA+B,EAAE,MAAM,CAAC,GAAG,IAAI,CAI3G;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,GAAE,MAA2C,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B3I;AAED;;;;;GAKG;AACH,wBAAsB,oCAAoC,CACxD,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAclC"}

package/dist/esm/core/security/federated-reauthentication.frontend.js.map

@@ -1 +1 @@
-{"version":3,"file":"federated-reauthentication.frontend.js","sourceRoot":"","sources":["../../../../../src/core/security/federated-reauthentication.frontend.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,4HAA4H;AAC5H,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAC1E,MAAM,CAAC,MAAM,sCAAsC,GAAG,iCAAiC,CAAC;AAQxF,iGAAiG;AACjG,MAAM,CAAN,IAAY,sCASX;AATD,WAAY,sCAAsC;IAChD,8CAA8C;IAC9C,yEAA+B,CAAA;IAC/B,qFAAqF;IACrF,iEAAuB,CAAA;IACvB,+HAA+H;IAC/H,iEAAuB,CAAA;IACvB,wEAAwE;IACxE,2DAAiB,CAAA;AACnB,CAAC,EATW,sCAAsC,KAAtC,sCAAsC,QASjD;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAC7B;IAA5B,YAA4B,MAA8C;QACxE,KAAK,CAAC,iDAAiD,MAAM,EAAE,CAAC,CAAC;QADvC,WAAM,GAAN,MAAM,CAAwC;QAExE,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAED,oGAAoG;AACpG,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1D,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,8BAA8B,CAAC,OAAsD;IACnG,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAC;IACxE,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,GAAG,OAAO,EAA4C,CAAC,CAAC;IAC5H,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAoB,EAAE,YAAoB,kCAAkC;IACxH,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAC;QACxE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,OAAmB,EAAE,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrI,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;QAClC,sGAAsG;QACtG,qGAAqG;QACrG,mGAAmG;QACnG,sGAAsG;QACtG,OAAO,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAuD,CAAC;YAC3E,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,sCAAsC;gBAAE,OAAO;YAC1E,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI;gBACtD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBACpB,CAAC,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3J,IAAI,MAAM,EAAE,OAAO;YAAE,SAAS,EAAE,CAAC;;YAC5B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,cAAsB,EACtB,OAAgC,EAChC,KAAoB,EACpB,MAAoB;IAEpB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,aAAa,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAClG,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,gBAAgB,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,MAAM,MAAM,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4GAA4G;QAC5G,IAAI,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,KAAK,YAAY,gCAAgC;YAAE,MAAM,KAAK,CAAC;QACnE,MAAM,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,MAAM,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC","sourcesContent":["import type { ReAuthenticationPurpose } from '@wildo-ai/saas-models';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\n\n/**\n * Federated re-authentication in the browser (#1441): confirming it is still the account holder by\n * signing in again at a linked identity provider.\n *\n * WHY A POPUP. A step-up refusal holds the request that was refused, pending, and replays it once a\n * proof arrives (the http client's step-up contract). A full-page redirect to the provider would\n * unload the page and drop that request. So the dialog opens a window, the provider runs inside it,\n * and the backend sends the window back to `REAUTHENTICATION_CALLBACK_PAGE_PATH` on THIS frontend's\n * origin, where `AuthPage_ReAuthenticationCallback` hands the result to this window and closes.\n *\n * WHY THE WINDOW IS OPENED EMPTY FIRST. Browsers allow a popup only inside the click that asked for it.\n * The provider URL comes from a request, which finishes after the click has ended, so the dialog opens\n * a blank window synchronously in its click handler and this module navigates it afterwards.\n *\n * WHAT CROSSES THE WINDOWS, AND WHY NOT THROUGH `window.opener`. Only a one-time code, over a\n * `BroadcastChannel`, which only this origin can join. The obvious channel, `postMessage` to the opener,\n * is unreliable here: identity providers commonly serve `Cross-Origin-Opener-Policy`, and once the\n * popup has visited such a page the browser severs it from this window. The callback page then has no\n * `window.opener`, and `popup.closed` reads `true` here while the window is still open, so neither can\n * be relied on. That is also why cancelling is an explicit abort from the dialog rather than a check\n * for a closed window.\n *\n * The code is redeemed with this window's own bearer at `POST /auth/reauth/federated/exchange`, so a code\n * read from the popup's URL is worth nothing to anyone else, and the re-authentication token itself never\n * appears in a URL.\n */\n\n/** The channel and message type the callback page reports on. One constant each, so sender and receiver cannot disagree. */\nexport const REAUTHENTICATION_CALLBACK_CHANNEL = 'wildo:reauthentication';\nexport const REAUTHENTICATION_CALLBACK_MESSAGE_TYPE = 'wildo:reauthentication-callback';\n\nexport interface ReAuthenticationCallbackMessage {\n  type: typeof REAUTHENTICATION_CALLBACK_MESSAGE_TYPE;\n  code?: string;\n  error?: string;\n}\n\n/** Why a federated re-authentication produced no proof. Each has its own words in the dialog. */\nexport enum FederatedReAuthenticationFailureReason {\n  /** The browser refused to open the window. */\n  POPUP_BLOCKED = 'popup_blocked',\n  /** The person cancelled in the dialog. Never shown: the dialog is already closed. */\n  CANCELLED = 'cancelled',\n  /** The provider did not answer in time: the person left the window unfinished, or closed it (which this window cannot see). */\n  TIMED_OUT = 'timed_out',\n  /** The provider answered, and the answer did not confirm the person. */\n  FAILED = 'failed',\n}\n\nexport class FederatedReAuthenticationFailure extends Error {\n  constructor(public readonly reason: FederatedReAuthenticationFailureReason) {\n    super(`Federated re-authentication did not complete: ${reason}`);\n    this.name = 'FederatedReAuthenticationFailure';\n  }\n}\n\n/** How long the window may stay open. The provider's own sign-in, plus MFA, fits well inside it. */\nconst REAUTHENTICATION_WINDOW_TIMEOUT_MS = 10 * 60 * 1000;\nconst POPUP_NAME = 'wildo-reauthentication';\nconst POPUP_FEATURES = 'popup=yes,width=520,height=680';\n\n/**\n * Open the (blank) window the provider will run in. MUST be called synchronously inside the click\n * that chose the provider; anything later is blocked. Returns `null` when the browser refused.\n */\nexport function openReAuthenticationWindow(): Window | null {\n  return window.open('about:blank', POPUP_NAME, POPUP_FEATURES);\n}\n\n/** What the callback page sends, to every window of this origin listening. */\nexport function reportReAuthenticationCallback(message: Omit<ReAuthenticationCallbackMessage, 'type'>): void {\n  const channel = new BroadcastChannel(REAUTHENTICATION_CALLBACK_CHANNEL);\n  channel.postMessage({ type: REAUTHENTICATION_CALLBACK_MESSAGE_TYPE, ...message } satisfies ReAuthenticationCallbackMessage);\n  channel.close();\n}\n\n/**\n * Wait for the callback page to report, and resolve with its one-time code.\n *\n * Rejects with `FAILED` when the page reports an error, `CANCELLED` when `signal` aborts (the person\n * cancelled in the dialog), and `TIMED_OUT` when the time runs out first.\n */\nexport function awaitReAuthenticationCallback(signal?: AbortSignal, timeoutMs: number = REAUTHENTICATION_WINDOW_TIMEOUT_MS): Promise<string> {\n  return new Promise<string>((resolve, reject) => {\n    const channel = new BroadcastChannel(REAUTHENTICATION_CALLBACK_CHANNEL);\n    let settled = false;\n    const finish = (outcome: () => void) => {\n      if (settled) return;\n      settled = true;\n      channel.close();\n      clearTimeout(deadline);\n      signal?.removeEventListener('abort', onAbort);\n      outcome();\n    };\n    const cancelled = () => finish(() => reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.CANCELLED)));\n    const onAbort = () => cancelled();\n    // Any window of this origin may answer, and the first answer settles the wait. Accepted deliberately:\n    // two tabs re-authenticating at once can take each other's code, and the loser then reports FAILED —\n    // never a proof for the wrong account, because the exchange is bound to the bearer that minted it.\n    // Correlating each attempt with a nonce echoed through the provider round trip would remove the race.\n    channel.onmessage = (event: MessageEvent) => {\n      const data = event.data as Partial<ReAuthenticationCallbackMessage> | null;\n      if (!data || data.type !== REAUTHENTICATION_CALLBACK_MESSAGE_TYPE) return;\n      finish(() => (typeof data.code === 'string' && data.code\n        ? resolve(data.code)\n        : reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.FAILED))));\n    };\n    const deadline = setTimeout(() => finish(() => reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.TIMED_OUT))), timeoutMs);\n    if (signal?.aborted) cancelled();\n    else signal?.addEventListener('abort', onAbort);\n  });\n}\n\n/**\n * Run a federated re-authentication in `popup` and return the single-use proof it earned.\n *\n * `popup` is the window {@link openReAuthenticationWindow} opened in the click; `null` means the browser\n * blocked it. `signal` is the dialog's cancel. The window is closed on every failure path it can still reach.\n */\nexport async function obtainFederatedReAuthenticationToken(\n  identityLinkId: string,\n  purpose: ReAuthenticationPurpose,\n  popup: Window | null,\n  signal?: AbortSignal,\n): Promise<{ reAuthToken: string }> {\n  if (!popup) throw new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.POPUP_BLOCKED);\n  const client = getManualCallsHttpClient();\n  try {\n    const { authorizationUrl } = await client.startFederatedReAuthentication(identityLinkId, purpose);\n    popup.location.href = authorizationUrl;\n    const code = await awaitReAuthenticationCallback(signal);\n    return await client.exchangeFederatedReAuthentication(code);\n  } catch (error) {\n    // May be a no-op once the provider's opener policy has severed the window; the callback page closes itself.\n    try { popup.close(); } catch { /* already gone */ }\n    if (error instanceof FederatedReAuthenticationFailure) throw error;\n    throw new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.FAILED);\n  }\n}\n"]}
+{"version":3,"file":"federated-reauthentication.frontend.js","sourceRoot":"","sources":["../../../../src/core/security/federated-reauthentication.frontend.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAE7H;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,4HAA4H;AAC5H,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAC1E,MAAM,CAAC,MAAM,sCAAsC,GAAG,iCAAiC,CAAC;AAQxF,iGAAiG;AACjG,MAAM,CAAN,IAAY,sCASX;AATD,WAAY,sCAAsC;IAChD,8CAA8C;IAC9C,yEAA+B,CAAA;IAC/B,qFAAqF;IACrF,iEAAuB,CAAA;IACvB,+HAA+H;IAC/H,iEAAuB,CAAA;IACvB,wEAAwE;IACxE,2DAAiB,CAAA;AACnB,CAAC,EATW,sCAAsC,KAAtC,sCAAsC,QASjD;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAC7B;IAA5B,YAA4B,MAA8C;QACxE,KAAK,CAAC,iDAAiD,MAAM,EAAE,CAAC,CAAC;QADvC,WAAM,GAAN,MAAM,CAAwC;QAExE,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAED,oGAAoG;AACpG,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1D,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,8BAA8B,CAAC,OAAsD;IACnG,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAC;IACxE,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,GAAG,OAAO,EAA4C,CAAC,CAAC;IAC5H,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAoB,EAAE,YAAoB,kCAAkC;IACxH,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAC;QACxE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,OAAmB,EAAE,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrI,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;QAClC,sGAAsG;QACtG,qGAAqG;QACrG,mGAAmG;QACnG,sGAAsG;QACtG,OAAO,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAuD,CAAC;YAC3E,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,sCAAsC;gBAAE,OAAO;YAC1E,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI;gBACtD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBACpB,CAAC,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3J,IAAI,MAAM,EAAE,OAAO;YAAE,SAAS,EAAE,CAAC;;YAC5B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,cAAsB,EACtB,OAAgC,EAChC,KAAoB,EACpB,MAAoB;IAEpB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,aAAa,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAClG,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,gBAAgB,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,MAAM,MAAM,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4GAA4G;QAC5G,IAAI,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,KAAK,YAAY,gCAAgC;YAAE,MAAM,KAAK,CAAC;QACnE,MAAM,IAAI,gCAAgC,CAAC,sCAAsC,CAAC,MAAM,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC","sourcesContent":["import type { ReAuthenticationPurpose } from '@wildo-ai/saas-models';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\n\n/**\n * Federated re-authentication in the browser (#1441): confirming it is still the account holder by\n * signing in again at a linked identity provider.\n *\n * WHY A POPUP. A step-up refusal holds the request that was refused, pending, and replays it once a\n * proof arrives (the http client's step-up contract). A full-page redirect to the provider would\n * unload the page and drop that request. So the dialog opens a window, the provider runs inside it,\n * and the backend sends the window back to `REAUTHENTICATION_CALLBACK_PAGE_PATH` on THIS frontend's\n * origin, where `AuthPage_ReAuthenticationCallback` hands the result to this window and closes.\n *\n * WHY THE WINDOW IS OPENED EMPTY FIRST. Browsers allow a popup only inside the click that asked for it.\n * The provider URL comes from a request, which finishes after the click has ended, so the dialog opens\n * a blank window synchronously in its click handler and this module navigates it afterwards.\n *\n * WHAT CROSSES THE WINDOWS, AND WHY NOT THROUGH `window.opener`. Only a one-time code, over a\n * `BroadcastChannel`, which only this origin can join. The obvious channel, `postMessage` to the opener,\n * is unreliable here: identity providers commonly serve `Cross-Origin-Opener-Policy`, and once the\n * popup has visited such a page the browser severs it from this window. The callback page then has no\n * `window.opener`, and `popup.closed` reads `true` here while the window is still open, so neither can\n * be relied on. That is also why cancelling is an explicit abort from the dialog rather than a check\n * for a closed window.\n *\n * The code is redeemed with this window's own bearer at `POST /auth/reauth/federated/exchange`, so a code\n * read from the popup's URL is worth nothing to anyone else, and the re-authentication token itself never\n * appears in a URL.\n */\n\n/** The channel and message type the callback page reports on. One constant each, so sender and receiver cannot disagree. */\nexport const REAUTHENTICATION_CALLBACK_CHANNEL = 'wildo:reauthentication';\nexport const REAUTHENTICATION_CALLBACK_MESSAGE_TYPE = 'wildo:reauthentication-callback';\n\nexport interface ReAuthenticationCallbackMessage {\n  type: typeof REAUTHENTICATION_CALLBACK_MESSAGE_TYPE;\n  code?: string;\n  error?: string;\n}\n\n/** Why a federated re-authentication produced no proof. Each has its own words in the dialog. */\nexport enum FederatedReAuthenticationFailureReason {\n  /** The browser refused to open the window. */\n  POPUP_BLOCKED = 'popup_blocked',\n  /** The person cancelled in the dialog. Never shown: the dialog is already closed. */\n  CANCELLED = 'cancelled',\n  /** The provider did not answer in time: the person left the window unfinished, or closed it (which this window cannot see). */\n  TIMED_OUT = 'timed_out',\n  /** The provider answered, and the answer did not confirm the person. */\n  FAILED = 'failed',\n}\n\nexport class FederatedReAuthenticationFailure extends Error {\n  constructor(public readonly reason: FederatedReAuthenticationFailureReason) {\n    super(`Federated re-authentication did not complete: ${reason}`);\n    this.name = 'FederatedReAuthenticationFailure';\n  }\n}\n\n/** How long the window may stay open. The provider's own sign-in, plus MFA, fits well inside it. */\nconst REAUTHENTICATION_WINDOW_TIMEOUT_MS = 10 * 60 * 1000;\nconst POPUP_NAME = 'wildo-reauthentication';\nconst POPUP_FEATURES = 'popup=yes,width=520,height=680';\n\n/**\n * Open the (blank) window the provider will run in. MUST be called synchronously inside the click\n * that chose the provider; anything later is blocked. Returns `null` when the browser refused.\n */\nexport function openReAuthenticationWindow(): Window | null {\n  return window.open('about:blank', POPUP_NAME, POPUP_FEATURES);\n}\n\n/** What the callback page sends, to every window of this origin listening. */\nexport function reportReAuthenticationCallback(message: Omit<ReAuthenticationCallbackMessage, 'type'>): void {\n  const channel = new BroadcastChannel(REAUTHENTICATION_CALLBACK_CHANNEL);\n  channel.postMessage({ type: REAUTHENTICATION_CALLBACK_MESSAGE_TYPE, ...message } satisfies ReAuthenticationCallbackMessage);\n  channel.close();\n}\n\n/**\n * Wait for the callback page to report, and resolve with its one-time code.\n *\n * Rejects with `FAILED` when the page reports an error, `CANCELLED` when `signal` aborts (the person\n * cancelled in the dialog), and `TIMED_OUT` when the time runs out first.\n */\nexport function awaitReAuthenticationCallback(signal?: AbortSignal, timeoutMs: number = REAUTHENTICATION_WINDOW_TIMEOUT_MS): Promise<string> {\n  return new Promise<string>((resolve, reject) => {\n    const channel = new BroadcastChannel(REAUTHENTICATION_CALLBACK_CHANNEL);\n    let settled = false;\n    const finish = (outcome: () => void) => {\n      if (settled) return;\n      settled = true;\n      channel.close();\n      clearTimeout(deadline);\n      signal?.removeEventListener('abort', onAbort);\n      outcome();\n    };\n    const cancelled = () => finish(() => reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.CANCELLED)));\n    const onAbort = () => cancelled();\n    // Any window of this origin may answer, and the first answer settles the wait. Accepted deliberately:\n    // two tabs re-authenticating at once can take each other's code, and the loser then reports FAILED —\n    // never a proof for the wrong account, because the exchange is bound to the bearer that minted it.\n    // Correlating each attempt with a nonce echoed through the provider round trip would remove the race.\n    channel.onmessage = (event: MessageEvent) => {\n      const data = event.data as Partial<ReAuthenticationCallbackMessage> | null;\n      if (!data || data.type !== REAUTHENTICATION_CALLBACK_MESSAGE_TYPE) return;\n      finish(() => (typeof data.code === 'string' && data.code\n        ? resolve(data.code)\n        : reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.FAILED))));\n    };\n    const deadline = setTimeout(() => finish(() => reject(new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.TIMED_OUT))), timeoutMs);\n    if (signal?.aborted) cancelled();\n    else signal?.addEventListener('abort', onAbort);\n  });\n}\n\n/**\n * Run a federated re-authentication in `popup` and return the single-use proof it earned.\n *\n * `popup` is the window {@link openReAuthenticationWindow} opened in the click; `null` means the browser\n * blocked it. `signal` is the dialog's cancel. The window is closed on every failure path it can still reach.\n */\nexport async function obtainFederatedReAuthenticationToken(\n  identityLinkId: string,\n  purpose: ReAuthenticationPurpose,\n  popup: Window | null,\n  signal?: AbortSignal,\n): Promise<{ reAuthToken: string }> {\n  if (!popup) throw new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.POPUP_BLOCKED);\n  const client = getManualCallsHttpClient();\n  try {\n    const { authorizationUrl } = await client.startFederatedReAuthentication(identityLinkId, purpose);\n    popup.location.href = authorizationUrl;\n    const code = await awaitReAuthenticationCallback(signal);\n    return await client.exchangeFederatedReAuthentication(code);\n  } catch (error) {\n    // May be a no-op once the provider's opener policy has severed the window; the callback page closes itself.\n    try { popup.close(); } catch { /* already gone */ }\n    if (error instanceof FederatedReAuthenticationFailure) throw error;\n    throw new FederatedReAuthenticationFailure(FederatedReAuthenticationFailureReason.FAILED);\n  }\n}\n"]}

package/dist/esm/core/security/jwt.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,CAAC,CAO1F"}
+{"version":3,"file":"jwt.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,CAAC,CAO1F"}

package/dist/esm/core/security/jwt.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAoC,WAAmB;IACrF,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;AAC/D,CAAC","sourcesContent":["/**\n * Frontend JWT utilities.\n *\n * JWT payload segments use base64url, not plain base64. Consumers that decode\n * payload claims must normalize `-` / `_` and padding before parsing.\n */\n\nfunction decodeBase64UrlToUtf8(segment: string): string {\n  const normalized = segment.replace(/-/g, '+').replace(/_/g, '/');\n  const paddingLength = (4 - (normalized.length % 4)) % 4;\n  const padded = `${normalized}${'='.repeat(paddingLength)}`;\n  const binary = atob(padded);\n  const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));\n\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * Decode and parse the payload segment of a JWT access token.\n *\n * Throws when the token is malformed or when the payload is not valid JSON so\n * callers can apply context-specific logging/error handling policy.\n */\nexport function decodeJwtPayload<T extends Record<string, unknown>>(accessToken: string): T {\n  const tokenParts = accessToken.split('.');\n  if (tokenParts.length !== 3) {\n    throw new Error('JWT must contain exactly three segments');\n  }\n\n  return JSON.parse(decodeBase64UrlToUtf8(tokenParts[1])) as T;\n}\n"]}
+{"version":3,"file":"jwt.frontend.utils.js","sourceRoot":"","sources":["../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAoC,WAAmB;IACrF,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;AAC/D,CAAC","sourcesContent":["/**\n * Frontend JWT utilities.\n *\n * JWT payload segments use base64url, not plain base64. Consumers that decode\n * payload claims must normalize `-` / `_` and padding before parsing.\n */\n\nfunction decodeBase64UrlToUtf8(segment: string): string {\n  const normalized = segment.replace(/-/g, '+').replace(/_/g, '/');\n  const paddingLength = (4 - (normalized.length % 4)) % 4;\n  const padded = `${normalized}${'='.repeat(paddingLength)}`;\n  const binary = atob(padded);\n  const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));\n\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * Decode and parse the payload segment of a JWT access token.\n *\n * Throws when the token is malformed or when the payload is not valid JSON so\n * callers can apply context-specific logging/error handling policy.\n */\nexport function decodeJwtPayload<T extends Record<string, unknown>>(accessToken: string): T {\n  const tokenParts = accessToken.split('.');\n  if (tokenParts.length !== 3) {\n    throw new Error('JWT must contain exactly three segments');\n  }\n\n  return JSON.parse(decodeBase64UrlToUtf8(tokenParts[1])) as T;\n}\n"]}

package/dist/esm/core/security/organization-onboarding.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-onboarding.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/organization-onboarding.frontend.utils.ts"],"names":[],"mappings":"AAIA,uGAAuG;AACvG,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,iCAAiC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIjI;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE;IAAE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC1F,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC5C,MAAM,GAAG,IAAI,CAGf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG5E"}
+{"version":3,"file":"organization-onboarding.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/security/organization-onboarding.frontend.utils.ts"],"names":[],"mappings":"AAIA,uGAAuG;AACvG,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,iCAAiC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIjI;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE;IAAE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC1F,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC5C,MAAM,GAAG,IAAI,CAGf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG5E"}

package/dist/esm/core/security/organization-onboarding.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-onboarding.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/organization-onboarding.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,gEAAgE,CAAC;AAU1G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAA4D;IAChH,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,0BAA0B,CAAC,kBAAkB,CAAC;IAC7H,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sCAAsC,CACpD,IAA0F,EAC1F,kBAA6C;IAE7C,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,wBAAwB,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAAc;IACjE,MAAM,SAAS,GAAI,KAAiF,EAAE,UAAU,EAAE,sBAAsB,CAAC;IACzI,OAAO,SAAS,KAAK,2BAA2B,CAAC,8BAA8B,CAAC;AAClF,CAAC","sourcesContent":["import { AuthenticationSessionState, AuthNextStep, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { appendAuthRedirectToPath } from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\n\n/** The members of an auth answer that say whether it parked the account at organization onboarding. */\nexport interface OrganizationOnboardingAnswerShape {\n  readonly accessToken?: string | null;\n  readonly sessionId?: string | null;\n  readonly state?: string;\n  readonly nextStep?: string;\n}\n\n/**\n * The session an auth answer parked at organization onboarding, or `null` (#1090).\n *\n * Several answers can park an account there, and each reached the client with no screen to finish it:\n * - a registration under deferred verification, or an email verification (`state: ONBOARDING_PENDING`,\n *   `nextStep: ONBOARDING`) when the user type names its organization at onboarding (#1011);\n * - a second-factor enrollment that settles a registration session there (`state: ONBOARDING_PENDING`);\n * - a SIGN-IN — password, passkey, OTP, a second factor, a magic link — by an account that still owes its\n *   organization (`success: false`, `nextStep: ONBOARDING`, #1091);\n * - a FEDERATED sign-in's code exchange (OAuth2 / OIDC callback, SAML ACS) for such an account\n *   (`{ nextStep: ONBOARDING, sessionId }`, #1103).\n *\n * This is the ONE reading of that condition, so every adoption site in `AuthSessionContext` and the registration\n * outcome agree. It requires a session, because completion is performed ON the parked session, and no token,\n * because an answer that carries one has already signed the account in and is not asking for anything.\n * Either member (`state` or `nextStep`) is enough: the enrollment settlement names the state and the sign-in\n * names the step.\n */\nexport function parkedOrganizationOnboardingSessionId(answer: OrganizationOnboardingAnswerShape | null | undefined): string | null {\n  if (!answer || answer.accessToken || !answer.sessionId) return null;\n  const parked = answer.nextStep === AuthNextStep.ONBOARDING || answer.state === AuthenticationSessionState.ONBOARDING_PENDING;\n  return parked ? answer.sessionId : null;\n}\n\n/**\n * Where an auth screen must send the person right now because the account is parked at organization\n * onboarding, or `null` when it is not (#1090).\n *\n * A RENDER-time answer rather than a navigation effect, on purpose: every auth screen already decides at render\n * time to bounce away — the challenge and the enrollment gate send a person with no pending second factor to\n * sign-in — and adopting a parked session clears exactly that state. An effect would lose that race and the\n * person would land on sign-in instead of onboarding. Each screen asks this BEFORE its own bounces.\n *\n * The deep-link target rides the detour, as it rides the second-factor detours. A signed-in context is never\n * parked: an answer that carried a token is not asking for onboarding.\n */\nexport function organizationOnboardingNavigationTarget(\n  auth: { readonly onboardingSessionId: string | null; readonly accessToken: string | null },\n  authRedirectTarget: string | null | undefined,\n): string | null {\n  if (!auth.onboardingSessionId || auth.accessToken) return null;\n  return appendAuthRedirectToPath(CommonRoutePaths.organizationOnboarding, authRedirectTarget);\n}\n\n/**\n * Whether a refused onboarding completion means the parked session is gone for good (#1090) — completed in\n * another tab, consumed by a concurrent completion, or expired. Such a session can never complete, so the auth\n * context forgets it; every other refusal (a policy that changed, a transient failure) leaves it parked so the\n * person can try again.\n */\nexport function isSpentOrganizationOnboardingSession(error: unknown): boolean {\n  const reference = (error as { wildoError?: { customMessageReference?: string } } | null | undefined)?.wildoError?.customMessageReference;\n  return reference === ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED;\n}\n"]}
+{"version":3,"file":"organization-onboarding.frontend.utils.js","sourceRoot":"","sources":["../../../../src/core/security/organization-onboarding.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,gEAAgE,CAAC;AAU1G;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAA4D;IAChH,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,0BAA0B,CAAC,kBAAkB,CAAC;IAC7H,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sCAAsC,CACpD,IAA0F,EAC1F,kBAA6C;IAE7C,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,wBAAwB,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAAc;IACjE,MAAM,SAAS,GAAI,KAAiF,EAAE,UAAU,EAAE,sBAAsB,CAAC;IACzI,OAAO,SAAS,KAAK,2BAA2B,CAAC,8BAA8B,CAAC;AAClF,CAAC","sourcesContent":["import { AuthenticationSessionState, AuthNextStep, ErrorCustomMessageReference } from '@wildo-ai/saas-models';\nimport { CommonRoutePaths } from '~wildo-frontend-lib/core/runtime/routes.frontend.definitions';\nimport { appendAuthRedirectToPath } from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\n\n/** The members of an auth answer that say whether it parked the account at organization onboarding. */\nexport interface OrganizationOnboardingAnswerShape {\n  readonly accessToken?: string | null;\n  readonly sessionId?: string | null;\n  readonly state?: string;\n  readonly nextStep?: string;\n}\n\n/**\n * The session an auth answer parked at organization onboarding, or `null` (#1090).\n *\n * Several answers can park an account there, and each reached the client with no screen to finish it:\n * - a registration under deferred verification, or an email verification (`state: ONBOARDING_PENDING`,\n *   `nextStep: ONBOARDING`) when the user type names its organization at onboarding (#1011);\n * - a second-factor enrollment that settles a registration session there (`state: ONBOARDING_PENDING`);\n * - a SIGN-IN — password, passkey, OTP, a second factor, a magic link — by an account that still owes its\n *   organization (`success: false`, `nextStep: ONBOARDING`, #1091);\n * - a FEDERATED sign-in's code exchange (OAuth2 / OIDC callback, SAML ACS) for such an account\n *   (`{ nextStep: ONBOARDING, sessionId }`, #1103).\n *\n * This is the ONE reading of that condition, so every adoption site in `AuthSessionContext` and the registration\n * outcome agree. It requires a session, because completion is performed ON the parked session, and no token,\n * because an answer that carries one has already signed the account in and is not asking for anything.\n * Either member (`state` or `nextStep`) is enough: the enrollment settlement names the state and the sign-in\n * names the step.\n */\nexport function parkedOrganizationOnboardingSessionId(answer: OrganizationOnboardingAnswerShape | null | undefined): string | null {\n  if (!answer || answer.accessToken || !answer.sessionId) return null;\n  const parked = answer.nextStep === AuthNextStep.ONBOARDING || answer.state === AuthenticationSessionState.ONBOARDING_PENDING;\n  return parked ? answer.sessionId : null;\n}\n\n/**\n * Where an auth screen must send the person right now because the account is parked at organization\n * onboarding, or `null` when it is not (#1090).\n *\n * A RENDER-time answer rather than a navigation effect, on purpose: every auth screen already decides at render\n * time to bounce away — the challenge and the enrollment gate send a person with no pending second factor to\n * sign-in — and adopting a parked session clears exactly that state. An effect would lose that race and the\n * person would land on sign-in instead of onboarding. Each screen asks this BEFORE its own bounces.\n *\n * The deep-link target rides the detour, as it rides the second-factor detours. A signed-in context is never\n * parked: an answer that carried a token is not asking for onboarding.\n */\nexport function organizationOnboardingNavigationTarget(\n  auth: { readonly onboardingSessionId: string | null; readonly accessToken: string | null },\n  authRedirectTarget: string | null | undefined,\n): string | null {\n  if (!auth.onboardingSessionId || auth.accessToken) return null;\n  return appendAuthRedirectToPath(CommonRoutePaths.organizationOnboarding, authRedirectTarget);\n}\n\n/**\n * Whether a refused onboarding completion means the parked session is gone for good (#1090) — completed in\n * another tab, consumed by a concurrent completion, or expired. Such a session can never complete, so the auth\n * context forgets it; every other refusal (a policy that changed, a transient failure) leaves it parked so the\n * person can try again.\n */\nexport function isSpentOrganizationOnboardingSession(error: unknown): boolean {\n  const reference = (error as { wildoError?: { customMessageReference?: string } } | null | undefined)?.wildoError?.customMessageReference;\n  return reference === ErrorCustomMessageReference.AUTHENTICATION_SESSION_EXPIRED;\n}\n"]}

package/dist/esm/core/security/pending-mfa-session-storage.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pending-mfa-session-storage.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/pending-mfa-session-storage.frontend.utils.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,6FAA6F;AAC7F,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,0GAA0G;IAC1G,KAAK,EAAE,MAAM,CAAC;CACf;AAOD;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAuB,CAAC;AA8BrE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,0BAA0B,EAAE,GAAG,GAAE,MAAmB,GAAG,IAAI,CAiB/G;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAmB,GAAG,0BAA0B,GAAG,IAAI,CAUjG;AAED,8FAA8F;AAC9F,wBAAgB,uBAAuB,IAAI,IAAI,CAM9C"}
+{"version":3,"file":"pending-mfa-session-storage.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/security/pending-mfa-session-storage.frontend.utils.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,6FAA6F;AAC7F,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,0GAA0G;IAC1G,KAAK,EAAE,MAAM,CAAC;CACf;AAOD;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAuB,CAAC;AA8BrE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,0BAA0B,EAAE,GAAG,GAAE,MAAmB,GAAG,IAAI,CAiB/G;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAmB,GAAG,0BAA0B,GAAG,IAAI,CAUjG;AAED,8FAA8F;AAC9F,wBAAgB,uBAAuB,IAAI,IAAI,CAM9C"}

package/dist/esm/core/security/pending-mfa-session-storage.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"pending-mfa-session-storage.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/pending-mfa-session-storage.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iEAAiE,CAAC;AA2CvG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErE;;;;GAIG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,cAAc,IAAI,SAAS,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4C,CAAC;QAC1E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS;eACnE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAqC,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACvG,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,QAAQ,EAAE,SAAS,KAAK,SAAS,CAAC,SAAS,CAAC;IAChE,MAAM,MAAM,GAA4B;QACtC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAS,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG;KACzD,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,oGAAoG;IACtG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;IAC5D,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,YAAY,GAAG,8BAA8B,IAAI,MAAM,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC;QACvG,uBAAuB,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC9D,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC;QACH,UAAU,EAAE,EAAE,UAAU,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC","sourcesContent":["import { SESSION_STORAGE_KEYS } from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\n/**\n * The tab-scoped memory of an MFA session that still owes a second factor (#1068).\n *\n * The auth context holds such a session only in memory, so a reload of the enrollment gate after an\n * in-app arrival used to lose it and cost a sign-in. Three places could have carried it across the reload,\n * and this is the one chosen:\n *\n * | option | why not / why |\n * |---|---|\n * | the gate URL | rejected. A REGISTRATION or INVITATION session reaches the gate this way on the ordinary path, issues tokens when a factor is enrolled, and lives 24h — its id would sit in browser history and every frontend/CDN request log |\n * | `localStorage` | rejected. It outlives the tab and is shared by every tab of the origin, so an abandoned sign-up would be recoverable long after, from anywhere on the device |\n * | **`sessionStorage`** | chosen. It survives a reload of THIS tab, dies with the tab, and never leaves the page. Script in the page can read it, exactly as it can already read the in-memory auth context this mirrors |\n *\n * \"Dies with the tab\" has one browser-defined exception worth stating: a DUPLICATED tab, and a tab opened by\n * `window.open` without `noopener`, start with a COPY of the opener's `sessionStorage`. Such a tab can recover\n * the same pending session — bounded by the same age ceiling below and the same server-side state check.\n *\n * Three rules keep the copy from outliving the session it describes, because a stale entry is a finished\n * or abandoned session brought back:\n * - ONE writer: `AuthSessionProvider` remembers and forgets from auth-state TRANSITIONS, never per call site;\n * - explicit forgets on the terminal acts that do not pass through those transitions after a hard load —\n *   logout, starting a new identification, and a recovery the server refuses;\n * - a client-side ceiling ({@link PENDING_MFA_SESSION_MAX_AGE_MS}) measured from when the session FIRST\n *   became pending, so re-remembering it on every recovery never extends its life.\n *\n * Nothing here is an authorization input. The server re-reads the session by id and admits second-factor\n * work only on the states it allows; this module decides only whether the gate may ASK.\n */\n\n/** The identity of a pending MFA session, as the enrollment gate needs it to recover one. */\nexport interface PendingMfaSessionReference {\n  sessionId: string;\n  /** Pre-fills the challenge the gate may hand back to; empty when the session was recovered without it. */\n  email: string;\n}\n\ninterface StoredPendingMfaSession extends PendingMfaSessionReference {\n  /** Epoch milliseconds at which this session FIRST became pending in this tab. */\n  rememberedAt: number;\n}\n\n/**\n * How long a remembered pending session may be recovered, from when it first became pending.\n *\n * Deliberately far shorter than the server's session lifetime: a second factor owed and not given within\n * half an hour is an abandoned sign-in, and the cost of refusing to recover it is one sign-in. The cost of\n * recovering it is handing an unattended tab's half-finished session to whoever uses that tab next.\n */\nexport const PENDING_MFA_SESSION_MAX_AGE_MS: number = 30 * 60 * 1000;\n\n/**\n * The tab's `sessionStorage`, or `undefined` when there is none — a non-browser realm, or a browser that\n * refuses storage access. Probed through `globalThis` inside try/catch rather than by sniffing `window`, for\n * the reason `client-instance-id.frontend.service.ts` records.\n */\nfunction tabStorage(): Storage | undefined {\n  try {\n    return globalThis.sessionStorage ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction readStored(area: Storage): StoredPendingMfaSession | null {\n  try {\n    const raw = area.getItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION);\n    if (!raw) return null;\n    const parsed = JSON.parse(raw) as Partial<StoredPendingMfaSession> | null;\n    if (!parsed || typeof parsed.sessionId !== 'string' || !parsed.sessionId\n      || typeof parsed.email !== 'string' || typeof parsed.rememberedAt !== 'number') {\n      return null;\n    }\n    return { sessionId: parsed.sessionId, email: parsed.email, rememberedAt: parsed.rememberedAt };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Remember a session that owes a second factor. Re-remembering the SAME session keeps its original\n * `rememberedAt` and, when the new reference carries no email, its known email — so a session recovered\n * after a reload (which has no identification response behind it) neither loses its address nor resets\n * its age.\n */\nexport function rememberPendingMfaSession(reference: PendingMfaSessionReference, now: number = Date.now()): void {\n  const area = tabStorage();\n  if (!area) return;\n\n  const existing = readStored(area);\n  const sameSession = existing?.sessionId === reference.sessionId;\n  const stored: StoredPendingMfaSession = {\n    sessionId: reference.sessionId,\n    email: reference.email || (sameSession ? existing!.email : ''),\n    rememberedAt: sameSession ? existing!.rememberedAt : now,\n  };\n\n  try {\n    area.setItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION, JSON.stringify(stored));\n  } catch {\n    // Storage full or refused: the reload simply will not be recoverable, which is the prior behaviour.\n  }\n}\n\n/**\n * The remembered pending session, or `null`. An entry that is malformed or older than\n * {@link PENDING_MFA_SESSION_MAX_AGE_MS} is FORGOTTEN on read, so it cannot be recovered on a later attempt\n * either.\n */\nexport function readPendingMfaSession(now: number = Date.now()): PendingMfaSessionReference | null {\n  const area = tabStorage();\n  if (!area) return null;\n\n  const stored = readStored(area);\n  if (!stored || now - stored.rememberedAt > PENDING_MFA_SESSION_MAX_AGE_MS || stored.rememberedAt > now) {\n    forgetPendingMfaSession();\n    return null;\n  }\n  return { sessionId: stored.sessionId, email: stored.email };\n}\n\n/** Forget the remembered pending session, if any. Safe to call when nothing is remembered. */\nexport function forgetPendingMfaSession(): void {\n  try {\n    tabStorage()?.removeItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION);\n  } catch {\n    // Unavailable storage — nothing to forget there.\n  }\n}\n"]}
+{"version":3,"file":"pending-mfa-session-storage.frontend.utils.js","sourceRoot":"","sources":["../../../../src/core/security/pending-mfa-session-storage.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iEAAiE,CAAC;AA2CvG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErE;;;;GAIG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,cAAc,IAAI,SAAS,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4C,CAAC;QAC1E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS;eACnE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAqC,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACvG,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,QAAQ,EAAE,SAAS,KAAK,SAAS,CAAC,SAAS,CAAC;IAChE,MAAM,MAAM,GAA4B;QACtC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAS,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG;KACzD,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,oGAAoG;IACtG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;IAC5D,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,YAAY,GAAG,8BAA8B,IAAI,MAAM,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC;QACvG,uBAAuB,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC9D,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC;QACH,UAAU,EAAE,EAAE,UAAU,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC","sourcesContent":["import { SESSION_STORAGE_KEYS } from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\n/**\n * The tab-scoped memory of an MFA session that still owes a second factor (#1068).\n *\n * The auth context holds such a session only in memory, so a reload of the enrollment gate after an\n * in-app arrival used to lose it and cost a sign-in. Three places could have carried it across the reload,\n * and this is the one chosen:\n *\n * | option | why not / why |\n * |---|---|\n * | the gate URL | rejected. A REGISTRATION or INVITATION session reaches the gate this way on the ordinary path, issues tokens when a factor is enrolled, and lives 24h — its id would sit in browser history and every frontend/CDN request log |\n * | `localStorage` | rejected. It outlives the tab and is shared by every tab of the origin, so an abandoned sign-up would be recoverable long after, from anywhere on the device |\n * | **`sessionStorage`** | chosen. It survives a reload of THIS tab, dies with the tab, and never leaves the page. Script in the page can read it, exactly as it can already read the in-memory auth context this mirrors |\n *\n * \"Dies with the tab\" has one browser-defined exception worth stating: a DUPLICATED tab, and a tab opened by\n * `window.open` without `noopener`, start with a COPY of the opener's `sessionStorage`. Such a tab can recover\n * the same pending session — bounded by the same age ceiling below and the same server-side state check.\n *\n * Three rules keep the copy from outliving the session it describes, because a stale entry is a finished\n * or abandoned session brought back:\n * - ONE writer: `AuthSessionProvider` remembers and forgets from auth-state TRANSITIONS, never per call site;\n * - explicit forgets on the terminal acts that do not pass through those transitions after a hard load —\n *   logout, starting a new identification, and a recovery the server refuses;\n * - a client-side ceiling ({@link PENDING_MFA_SESSION_MAX_AGE_MS}) measured from when the session FIRST\n *   became pending, so re-remembering it on every recovery never extends its life.\n *\n * Nothing here is an authorization input. The server re-reads the session by id and admits second-factor\n * work only on the states it allows; this module decides only whether the gate may ASK.\n */\n\n/** The identity of a pending MFA session, as the enrollment gate needs it to recover one. */\nexport interface PendingMfaSessionReference {\n  sessionId: string;\n  /** Pre-fills the challenge the gate may hand back to; empty when the session was recovered without it. */\n  email: string;\n}\n\ninterface StoredPendingMfaSession extends PendingMfaSessionReference {\n  /** Epoch milliseconds at which this session FIRST became pending in this tab. */\n  rememberedAt: number;\n}\n\n/**\n * How long a remembered pending session may be recovered, from when it first became pending.\n *\n * Deliberately far shorter than the server's session lifetime: a second factor owed and not given within\n * half an hour is an abandoned sign-in, and the cost of refusing to recover it is one sign-in. The cost of\n * recovering it is handing an unattended tab's half-finished session to whoever uses that tab next.\n */\nexport const PENDING_MFA_SESSION_MAX_AGE_MS: number = 30 * 60 * 1000;\n\n/**\n * The tab's `sessionStorage`, or `undefined` when there is none — a non-browser realm, or a browser that\n * refuses storage access. Probed through `globalThis` inside try/catch rather than by sniffing `window`, for\n * the reason `client-instance-id.frontend.service.ts` records.\n */\nfunction tabStorage(): Storage | undefined {\n  try {\n    return globalThis.sessionStorage ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction readStored(area: Storage): StoredPendingMfaSession | null {\n  try {\n    const raw = area.getItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION);\n    if (!raw) return null;\n    const parsed = JSON.parse(raw) as Partial<StoredPendingMfaSession> | null;\n    if (!parsed || typeof parsed.sessionId !== 'string' || !parsed.sessionId\n      || typeof parsed.email !== 'string' || typeof parsed.rememberedAt !== 'number') {\n      return null;\n    }\n    return { sessionId: parsed.sessionId, email: parsed.email, rememberedAt: parsed.rememberedAt };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Remember a session that owes a second factor. Re-remembering the SAME session keeps its original\n * `rememberedAt` and, when the new reference carries no email, its known email — so a session recovered\n * after a reload (which has no identification response behind it) neither loses its address nor resets\n * its age.\n */\nexport function rememberPendingMfaSession(reference: PendingMfaSessionReference, now: number = Date.now()): void {\n  const area = tabStorage();\n  if (!area) return;\n\n  const existing = readStored(area);\n  const sameSession = existing?.sessionId === reference.sessionId;\n  const stored: StoredPendingMfaSession = {\n    sessionId: reference.sessionId,\n    email: reference.email || (sameSession ? existing!.email : ''),\n    rememberedAt: sameSession ? existing!.rememberedAt : now,\n  };\n\n  try {\n    area.setItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION, JSON.stringify(stored));\n  } catch {\n    // Storage full or refused: the reload simply will not be recoverable, which is the prior behaviour.\n  }\n}\n\n/**\n * The remembered pending session, or `null`. An entry that is malformed or older than\n * {@link PENDING_MFA_SESSION_MAX_AGE_MS} is FORGOTTEN on read, so it cannot be recovered on a later attempt\n * either.\n */\nexport function readPendingMfaSession(now: number = Date.now()): PendingMfaSessionReference | null {\n  const area = tabStorage();\n  if (!area) return null;\n\n  const stored = readStored(area);\n  if (!stored || now - stored.rememberedAt > PENDING_MFA_SESSION_MAX_AGE_MS || stored.rememberedAt > now) {\n    forgetPendingMfaSession();\n    return null;\n  }\n  return { sessionId: stored.sessionId, email: stored.email };\n}\n\n/** Forget the remembered pending session, if any. Safe to call when nothing is remembered. */\nexport function forgetPendingMfaSession(): void {\n  try {\n    tabStorage()?.removeItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION);\n  } catch {\n    // Unavailable storage — nothing to forget there.\n  }\n}\n"]}

package/dist/esm/core/security/registration-outcome.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration-outcome.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/registration-outcome.frontend.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mFAAmF,CAAC;AAGjI;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,mBAAmB;IAC7B;;;OAGG;IACH,SAAS,cAAc;IACvB;;;;OAIG;IACH,uBAAuB,4BAA4B;IACnD;;;;;;;;;OASG;IACH,0BAA0B,+BAA+B;IACzD,iHAAiH;IACjH,qBAAqB,0BAA0B;IAC/C;;;OAGG;IACH,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,0BAA0B,+BAA+B;IACzD;;;;OAIG;IACH,gCAAgC,qCAAqC;IACrE;;;;;OAKG;IACH,UAAU,eAAe;CAC1B;AAYD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,uBAAuB,GAAG,mBAAmB,CAgClG"}
+{"version":3,"file":"registration-outcome.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/security/registration-outcome.frontend.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mFAAmF,CAAC;AAGjI;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,mBAAmB;IAC7B;;;OAGG;IACH,SAAS,cAAc;IACvB;;;;OAIG;IACH,uBAAuB,4BAA4B;IACnD;;;;;;;;;OASG;IACH,0BAA0B,+BAA+B;IACzD,iHAAiH;IACjH,qBAAqB,0BAA0B;IAC/C;;;OAGG;IACH,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,0BAA0B,+BAA+B;IACzD;;;;OAIG;IACH,gCAAgC,qCAAqC;IACrE;;;;;OAKG;IACH,UAAU,eAAe;CAC1B;AAYD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,uBAAuB,GAAG,mBAAmB,CAgClG"}

package/dist/esm/core/security/registration-outcome.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"registration-outcome.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/registration-outcome.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,qCAAqC,EAAE,MAAM,0EAA0E,CAAC;AAEjI;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,mBAiDX;AAjDD,WAAY,mBAAmB;IAC7B;;;OAGG;IACH,8CAAuB,CAAA;IACvB;;;;OAIG;IACH,0EAAmD,CAAA;IACnD;;;;;;;;;OASG;IACH,gFAAyD,CAAA;IACzD,iHAAiH;IACjH,sEAA+C,CAAA;IAC/C;;;OAGG;IACH,0DAAmC,CAAA;IACnC;;;;OAIG;IACH,gFAAyD,CAAA;IACzD;;;;OAIG;IACH,4FAAqE,CAAA;IACrE;;;;;OAKG;IACH,gDAAyB,CAAA;AAC3B,CAAC,EAjDW,mBAAmB,KAAnB,mBAAmB,QAiD9B;AAED;;;;GAIG;AACH,MAAM,iCAAiC,GAA4C,IAAI,GAAG,CAAC;IACzF,0BAA0B,CAAC,SAAS;IACpC,0BAA0B,CAAC,oBAAoB;CAChD,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAiC;IAC3E,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,iCAAiC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClH,OAAO,mBAAmB,CAAC,SAAS,CAAC;IACvC,CAAC;IAED,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,mBAAmB,CAAC,qBAAqB,CAAC;IACnD,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,KAAK,0BAA0B,CAAC,uBAAuB,EAAE,CAAC;QAC1E,qGAAqG;QACrG,8DAA8D;QAC9D,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC;IAC3G,CAAC;IAED,IAAI,qCAAqC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,mBAAmB,CAAC,gCAAgC,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,eAAe,EAAE,CAAC;QACvD,OAAO,mBAAmB,CAAC,eAAe,CAAC;IAC7C,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,kBAAkB,EAAE,CAAC;QAC1D,OAAO,mBAAmB,CAAC,0BAA0B,CAAC;IACxD,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjI,OAAO,mBAAmB,CAAC,0BAA0B,CAAC;IACxD,CAAC;IAED,OAAO,mBAAmB,CAAC,UAAU,CAAC;AACxC,CAAC","sourcesContent":["import { AuthenticationSessionState, AuthNextStep } from '@wildo-ai/saas-models';\nimport type { RegisterAccountResponse } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { parkedOrganizationOnboardingSessionId } from '~wildo-frontend-lib/core/security/organization-onboarding.frontend.utils';\n\n/**\n * What a public registration ANSWER means for the person who just submitted the form (#972).\n *\n * `POST /auth/register` does not have one outcome. Depending on the registrant's user-type policy it\n * signs them in, parks them at a second-factor enrollment they owe, asks them to verify their address,\n * or — for an address that already has an account — answers with a bare acknowledgement. The registration\n * screen used to ignore all of that and announce \"check your\n * email\" for every answer, which sent a registrant who had to enroll a second factor away without the\n * session that enrollment completes, and told one who had just been signed in to go and verify.\n *\n * This is the ONE classification of that answer. `AuthSessionContext.registerAccount` adopts the auth\n * state from it and the registration screen renders from it, so the two cannot disagree about which\n * outcome an answer was. Separately-written predicates over the same answer are how the auth screens\n * came to disagree before: their MFA routing copies differed on whether `availableEnrollmentMethods`\n * or the usable-factor set decided enrollment.\n */\nexport enum RegistrationOutcome {\n  /**\n   * The registration pipeline COMPLETED (or entered the enrollment grace period) and an access token\n   * came back. The person is signed in; the refresh token arrived as an HttpOnly cookie.\n   */\n  SIGNED_IN = 'signed_in',\n  /**\n   * The user type requires a second factor with no grace period and nothing is enrolled. The answer\n   * carries the registration session; enrolling on the enrollment gate completes it and signs the\n   * person in (#603). Tokens are deliberately withheld until then.\n   */\n  MFA_ENROLLMENT_REQUIRED = 'mfa_enrollment_required',\n  /**\n   * The account exists and its address must be verified before it can sign in — OR the address\n   * already had an account. Both are the same answer: the bare acknowledgement.\n   *\n   * Since #1010 that sameness is the BACKEND's, not only this screen's. Under verification-required\n   * registration a new account's answer no longer carries a registration session (`sessionId`,\n   * `state: REGISTERED`) — the emailed link is the continuation — so the wire cannot tell a new address\n   * from a registered one either. Deferred verification is different by construction: it signs a new\n   * registrant in on the spot, which no acknowledgement can imitate.\n   */\n  EMAIL_VERIFICATION_PENDING = 'email_verification_pending',\n  /** The address belongs to a domain whose organization enforces single sign-on; self-registration was refused. */\n  SSO_REDIRECT_REQUIRED = 'sso_redirect_required',\n  /**\n   * A password-less registration: the account exists and a magic link is on its way. Clicking it proves\n   * the address and signs the person in, so there is no verification email to resend.\n   */\n  MAGIC_LINK_SENT = 'magic_link_sent',\n  /**\n   * A passkey registration (#1093): the account exists, a magic link is on its way, and the passkey is\n   * enrolled once the link has signed the person in — a passkey proves an authenticator, never an\n   * address, so public passkey sign-up routes through the link. Like MAGIC_LINK_SENT, nothing to resend.\n   */\n  PASSKEY_ENROLLMENT_PENDING = 'passkey_enrollment_pending',\n  /**\n   * The account's user type names its organization at onboarding and the answer parked the registration\n   * session there (`state: ONBOARDING_PENDING`, #1011). The context adopts the session and the person is sent\n   * to the organization-onboarding step, which creates the organization and signs them in (#1090).\n   */\n  ORGANIZATION_ONBOARDING_REQUIRED = 'organization_onboarding_required',\n  /**\n   * Anything else: the account was (or may have been) created, but the answer names a step this screen\n   * does not carry out — an enrollment or onboarding answer with no session to continue on, or a state\n   * added to the pipeline after this was written. Rendered as\n   * \"not finished, sign in to continue\"; never as \"complete\".\n   */\n  UNFINISHED = 'unfinished',\n}\n\n/**\n * The session states in which the registration pipeline issues tokens — the backend's own issuance\n * predicate (`registerUser`, deferred-verification branch), restated as data so a token arriving beside\n * any OTHER state is not adopted as a finished sign-in.\n */\nconst TOKEN_ISSUING_REGISTRATION_STATES: ReadonlySet<AuthenticationSessionState> = new Set([\n  AuthenticationSessionState.COMPLETED,\n  AuthenticationSessionState.MFA_ENROLLMENT_GRACE,\n]);\n\n/**\n * Classify a registration answer. Order matters and is the precedence the backend's branches imply:\n * a signed-in answer wins; the SSO refusal and the magic-link answer carry no session state; an\n * answer with no state, no next step and no session is the acknowledgement — a new account awaiting\n * address verification and an already-registered address alike (#1010).\n *\n * There is no `state: REGISTERED` branch: no registration answer carries that state any more, so an\n * answer that did would be one this was not written for, and lands in UNFINISHED like any other.\n */\nexport function classifyRegistrationOutcome(response: RegisterAccountResponse): RegistrationOutcome {\n  if (response.accessToken && response.state !== undefined && TOKEN_ISSUING_REGISTRATION_STATES.has(response.state)) {\n    return RegistrationOutcome.SIGNED_IN;\n  }\n\n  if (response.ssoRedirectHint === true) {\n    return RegistrationOutcome.SSO_REDIRECT_REQUIRED;\n  }\n\n  if (response.state === AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED) {\n    // The gate enrolls ON the session. Without one there is nothing to complete, and routing there would\n    // strand the person on a screen that bounces them to sign-in.\n    return response.sessionId ? RegistrationOutcome.MFA_ENROLLMENT_REQUIRED : RegistrationOutcome.UNFINISHED;\n  }\n\n  if (parkedOrganizationOnboardingSessionId(response)) {\n    return RegistrationOutcome.ORGANIZATION_ONBOARDING_REQUIRED;\n  }\n\n  if (response.nextStep === AuthNextStep.MAGIC_LINK_SENT) {\n    return RegistrationOutcome.MAGIC_LINK_SENT;\n  }\n\n  if (response.nextStep === AuthNextStep.PASSKEY_ENROLLMENT) {\n    return RegistrationOutcome.PASSKEY_ENROLLMENT_PENDING;\n  }\n\n  if (response.state === undefined && response.nextStep === undefined && response.sessionId === undefined && !response.accessToken) {\n    return RegistrationOutcome.EMAIL_VERIFICATION_PENDING;\n  }\n\n  return RegistrationOutcome.UNFINISHED;\n}\n"]}
+{"version":3,"file":"registration-outcome.frontend.utils.js","sourceRoot":"","sources":["../../../../src/core/security/registration-outcome.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,qCAAqC,EAAE,MAAM,0EAA0E,CAAC;AAEjI;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,mBAiDX;AAjDD,WAAY,mBAAmB;IAC7B;;;OAGG;IACH,8CAAuB,CAAA;IACvB;;;;OAIG;IACH,0EAAmD,CAAA;IACnD;;;;;;;;;OASG;IACH,gFAAyD,CAAA;IACzD,iHAAiH;IACjH,sEAA+C,CAAA;IAC/C;;;OAGG;IACH,0DAAmC,CAAA;IACnC;;;;OAIG;IACH,gFAAyD,CAAA;IACzD;;;;OAIG;IACH,4FAAqE,CAAA;IACrE;;;;;OAKG;IACH,gDAAyB,CAAA;AAC3B,CAAC,EAjDW,mBAAmB,KAAnB,mBAAmB,QAiD9B;AAED;;;;GAIG;AACH,MAAM,iCAAiC,GAA4C,IAAI,GAAG,CAAC;IACzF,0BAA0B,CAAC,SAAS;IACpC,0BAA0B,CAAC,oBAAoB;CAChD,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAiC;IAC3E,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,iCAAiC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClH,OAAO,mBAAmB,CAAC,SAAS,CAAC;IACvC,CAAC;IAED,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,mBAAmB,CAAC,qBAAqB,CAAC;IACnD,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,KAAK,0BAA0B,CAAC,uBAAuB,EAAE,CAAC;QAC1E,qGAAqG;QACrG,8DAA8D;QAC9D,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC;IAC3G,CAAC;IAED,IAAI,qCAAqC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,mBAAmB,CAAC,gCAAgC,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,eAAe,EAAE,CAAC;QACvD,OAAO,mBAAmB,CAAC,eAAe,CAAC;IAC7C,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,kBAAkB,EAAE,CAAC;QAC1D,OAAO,mBAAmB,CAAC,0BAA0B,CAAC;IACxD,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjI,OAAO,mBAAmB,CAAC,0BAA0B,CAAC;IACxD,CAAC;IAED,OAAO,mBAAmB,CAAC,UAAU,CAAC;AACxC,CAAC","sourcesContent":["import { AuthenticationSessionState, AuthNextStep } from '@wildo-ai/saas-models';\nimport type { RegisterAccountResponse } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { parkedOrganizationOnboardingSessionId } from '~wildo-frontend-lib/core/security/organization-onboarding.frontend.utils';\n\n/**\n * What a public registration ANSWER means for the person who just submitted the form (#972).\n *\n * `POST /auth/register` does not have one outcome. Depending on the registrant's user-type policy it\n * signs them in, parks them at a second-factor enrollment they owe, asks them to verify their address,\n * or — for an address that already has an account — answers with a bare acknowledgement. The registration\n * screen used to ignore all of that and announce \"check your\n * email\" for every answer, which sent a registrant who had to enroll a second factor away without the\n * session that enrollment completes, and told one who had just been signed in to go and verify.\n *\n * This is the ONE classification of that answer. `AuthSessionContext.registerAccount` adopts the auth\n * state from it and the registration screen renders from it, so the two cannot disagree about which\n * outcome an answer was. Separately-written predicates over the same answer are how the auth screens\n * came to disagree before: their MFA routing copies differed on whether `availableEnrollmentMethods`\n * or the usable-factor set decided enrollment.\n */\nexport enum RegistrationOutcome {\n  /**\n   * The registration pipeline COMPLETED (or entered the enrollment grace period) and an access token\n   * came back. The person is signed in; the refresh token arrived as an HttpOnly cookie.\n   */\n  SIGNED_IN = 'signed_in',\n  /**\n   * The user type requires a second factor with no grace period and nothing is enrolled. The answer\n   * carries the registration session; enrolling on the enrollment gate completes it and signs the\n   * person in (#603). Tokens are deliberately withheld until then.\n   */\n  MFA_ENROLLMENT_REQUIRED = 'mfa_enrollment_required',\n  /**\n   * The account exists and its address must be verified before it can sign in — OR the address\n   * already had an account. Both are the same answer: the bare acknowledgement.\n   *\n   * Since #1010 that sameness is the BACKEND's, not only this screen's. Under verification-required\n   * registration a new account's answer no longer carries a registration session (`sessionId`,\n   * `state: REGISTERED`) — the emailed link is the continuation — so the wire cannot tell a new address\n   * from a registered one either. Deferred verification is different by construction: it signs a new\n   * registrant in on the spot, which no acknowledgement can imitate.\n   */\n  EMAIL_VERIFICATION_PENDING = 'email_verification_pending',\n  /** The address belongs to a domain whose organization enforces single sign-on; self-registration was refused. */\n  SSO_REDIRECT_REQUIRED = 'sso_redirect_required',\n  /**\n   * A password-less registration: the account exists and a magic link is on its way. Clicking it proves\n   * the address and signs the person in, so there is no verification email to resend.\n   */\n  MAGIC_LINK_SENT = 'magic_link_sent',\n  /**\n   * A passkey registration (#1093): the account exists, a magic link is on its way, and the passkey is\n   * enrolled once the link has signed the person in — a passkey proves an authenticator, never an\n   * address, so public passkey sign-up routes through the link. Like MAGIC_LINK_SENT, nothing to resend.\n   */\n  PASSKEY_ENROLLMENT_PENDING = 'passkey_enrollment_pending',\n  /**\n   * The account's user type names its organization at onboarding and the answer parked the registration\n   * session there (`state: ONBOARDING_PENDING`, #1011). The context adopts the session and the person is sent\n   * to the organization-onboarding step, which creates the organization and signs them in (#1090).\n   */\n  ORGANIZATION_ONBOARDING_REQUIRED = 'organization_onboarding_required',\n  /**\n   * Anything else: the account was (or may have been) created, but the answer names a step this screen\n   * does not carry out — an enrollment or onboarding answer with no session to continue on, or a state\n   * added to the pipeline after this was written. Rendered as\n   * \"not finished, sign in to continue\"; never as \"complete\".\n   */\n  UNFINISHED = 'unfinished',\n}\n\n/**\n * The session states in which the registration pipeline issues tokens — the backend's own issuance\n * predicate (`registerUser`, deferred-verification branch), restated as data so a token arriving beside\n * any OTHER state is not adopted as a finished sign-in.\n */\nconst TOKEN_ISSUING_REGISTRATION_STATES: ReadonlySet<AuthenticationSessionState> = new Set([\n  AuthenticationSessionState.COMPLETED,\n  AuthenticationSessionState.MFA_ENROLLMENT_GRACE,\n]);\n\n/**\n * Classify a registration answer. Order matters and is the precedence the backend's branches imply:\n * a signed-in answer wins; the SSO refusal and the magic-link answer carry no session state; an\n * answer with no state, no next step and no session is the acknowledgement — a new account awaiting\n * address verification and an already-registered address alike (#1010).\n *\n * There is no `state: REGISTERED` branch: no registration answer carries that state any more, so an\n * answer that did would be one this was not written for, and lands in UNFINISHED like any other.\n */\nexport function classifyRegistrationOutcome(response: RegisterAccountResponse): RegistrationOutcome {\n  if (response.accessToken && response.state !== undefined && TOKEN_ISSUING_REGISTRATION_STATES.has(response.state)) {\n    return RegistrationOutcome.SIGNED_IN;\n  }\n\n  if (response.ssoRedirectHint === true) {\n    return RegistrationOutcome.SSO_REDIRECT_REQUIRED;\n  }\n\n  if (response.state === AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED) {\n    // The gate enrolls ON the session. Without one there is nothing to complete, and routing there would\n    // strand the person on a screen that bounces them to sign-in.\n    return response.sessionId ? RegistrationOutcome.MFA_ENROLLMENT_REQUIRED : RegistrationOutcome.UNFINISHED;\n  }\n\n  if (parkedOrganizationOnboardingSessionId(response)) {\n    return RegistrationOutcome.ORGANIZATION_ONBOARDING_REQUIRED;\n  }\n\n  if (response.nextStep === AuthNextStep.MAGIC_LINK_SENT) {\n    return RegistrationOutcome.MAGIC_LINK_SENT;\n  }\n\n  if (response.nextStep === AuthNextStep.PASSKEY_ENROLLMENT) {\n    return RegistrationOutcome.PASSKEY_ENROLLMENT_PENDING;\n  }\n\n  if (response.state === undefined && response.nextStep === undefined && response.sessionId === undefined && !response.accessToken) {\n    return RegistrationOutcome.EMAIL_VERIFICATION_PENDING;\n  }\n\n  return RegistrationOutcome.UNFINISHED;\n}\n"]}

package/dist/esm/core/security/route-organization-access.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-organization-access.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/route-organization-access.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,gCAAgC,EAChC,uCAAuC,EACxC,MAAM,+DAA+D,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,uBAAuB;IACjC,qFAAqF;IACrF,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B,8GAA8G;IAC9G,iBAAiB,sBAAsB;IACvC,sGAAsG;IACtG,SAAS,cAAc;IACvB,uIAAuI;IACvI,QAAQ,aAAa;IACrB;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AAED,+HAA+H;AAC/H,MAAM,WAAW,gCAAgC;IAC/C,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,wBAAwB,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD,wDAAwD;IACxD,6BAA6B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,aAAa,CAAC,gCAAgC,CAAC,GAAG,IAAI,GAAG,SAAS,EAC/E,cAAc,EAAE,MAAM,GACrB,OAAO,CAMT;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,qBAAqB,EAAE,gCAAgC,GAAG,SAAS,GAClE,uCAAuC,GAAG,SAAS,CAWrD"}
+{"version":3,"file":"route-organization-access.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/security/route-organization-access.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,gCAAgC,EAChC,uCAAuC,EACxC,MAAM,+DAA+D,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,uBAAuB;IACjC,qFAAqF;IACrF,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B,8GAA8G;IAC9G,iBAAiB,sBAAsB;IACvC,sGAAsG;IACtG,SAAS,cAAc;IACvB,uIAAuI;IACvI,QAAQ,aAAa;IACrB;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AAED,+HAA+H;AAC/H,MAAM,WAAW,gCAAgC;IAC/C,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,wBAAwB,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD,wDAAwD;IACxD,6BAA6B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,aAAa,CAAC,gCAAgC,CAAC,GAAG,IAAI,GAAG,SAAS,EAC/E,cAAc,EAAE,MAAM,GACrB,OAAO,CAMT;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,qBAAqB,EAAE,gCAAgC,GAAG,SAAS,GAClE,uCAAuC,GAAG,SAAS,CAWrD"}

package/dist/esm/core/security/route-organization-access.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-organization-access.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/route-organization-access.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAM/B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,uBA6BX;AA7BD,WAAY,uBAAuB;IACjC,qFAAqF;IACrF,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;IAC3B,8GAA8G;IAC9G,kEAAuC,CAAA;IACvC,sGAAsG;IACtG,kDAAuB,CAAA;IACvB,uIAAuI;IACvI,gDAAqB,CAAA;IACrB;;;;;;OAMG;IACH,8CAAmB,CAAA;IACnB;;;;OAIG;IACH,wDAA6B,CAAA;AAC/B,CAAC,EA7BW,uBAAuB,KAAvB,uBAAuB,QA6BlC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAC/C,WAA+E,EAC/E,cAAsB;IAEtB,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,KAAK,cAAc;WACvD,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM;WACrD,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,qBAAmE;IAEnE,OAAO,qBAAqB,EAAE,UAAU,EAAE,IAAI,CAC5C,CAAC,SAAkD,EAAE,EAAE,CACrD,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;WACzD,SAAS,CAAC,kBAAkB,KAAK,IAAI;WACrC,SAAS,CAAC,eAAe,KAAK,IAAI;WAClC,CACD,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;eAC5D,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACjF,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CoreResourceOperation,\n  OrganizationMemberStatus,\n  isServiceProviderMembership,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport type {\n  AnyFrontendResourceConfiguration,\n  FrontendResourceConfiguration_Operation,\n} from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\n\n/**\n * Whether the signed-in account may open the organization a route addresses (`/organizations/:id/…`).\n *\n * ## Why the route needs its own answer\n *\n * The AppScope organization is membership-checked: `UserOrgsContext` only commits an organization the\n * account belongs to. A route's organization segment is not. `ScopeUtilsService.buildResourceOperationContextIdentifiers`\n * places the URL's identifiers LAST, so they override the checked scope, and the page issues its reads\n * against whatever organization the link names. The link is not always the account's own: a session\n * that expires on `/organizations/A/tasks` saves that URL as the post-login `redirect`, and a DIFFERENT\n * account signing in is sent straight to it. Every read then answered 403, and the person was left on\n * a page that could never load.\n *\n * ## Why the server decides, and the membership list only short-circuits\n *\n * The user context embeds `organizationMembers`, but that array is a context projection capped at\n * `DEFAULT_RELATIONSHIP_CONTEXT_POLICY.limit` (20, newest first) and \"cannot say it was truncated\".\n * A refusal computed from it would eject a member of a 21st organization, and it would also eject a\n * platform operator on a crossing the server admits. So an ACTIVE membership found in the list is\n * trusted (a positive answer cannot be invented by truncation), and anything else is asked of the\n * server with one silent READ of the organization. Only a refusal from that READ redirects.\n */\nexport enum RouteOrganizationAccess {\n  /** The current route carries no organization segment. There is nothing to decide. */\n  NOT_ADDRESSED = 'NOT_ADDRESSED',\n  /**\n   * The route addresses an organization, but the session cannot be judged yet or at all: restore is\n   * unresolved, no user context was loaded, or the loaded user is not the token's subject (a stale\n   * context from the previous account). The route renders as it would without this check.\n   */\n  UNDECIDABLE = 'UNDECIDABLE',\n  /** The loaded user context carries an ACTIVE membership in the addressed organization. No request is made. */\n  ACTIVE_MEMBERSHIP = 'ACTIVE_MEMBERSHIP',\n  /** No active membership is known, and the server is being asked. The page must not load meanwhile. */\n  VERIFYING = 'VERIFYING',\n  /** The server answered the organization READ. The account may open it (a membership past the context cap, or an admitted crossing). */\n  ADMITTED = 'ADMITTED',\n  /**\n   * The server refused the organization READ (403, or the deliberate 404 a non-member receives so the\n   * answer is not an existence oracle). The route must not render.\n   *\n   * A link to an organization that does not exist lands here too, and on purpose: the server answers it\n   * with the same 404, so the frontend cannot tell the two apart, and must not try to.\n   */\n  REFUSED = 'REFUSED',\n  /**\n   * The READ failed for a reason that says nothing about access (network, 5xx, no READ operation mounted).\n   * The route renders, and its own requests report whatever is wrong: a transient failure must never\n   * eject someone from a page they may open.\n   */\n  INCONCLUSIVE = 'INCONCLUSIVE',\n}\n\n/** The membership fields this decision reads, structurally, so the check does not depend on the context's population shape. */\nexport interface RouteOrganizationMembershipFacts {\n  organizationId?: string | null;\n  status?: OrganizationMemberStatus | string | null;\n  /** Present on a service-provider membership (#1597). */\n  serviceProviderRelationshipId?: string | null;\n  providerOrganizationId?: string | null;\n}\n\n/**\n * True when the memberships carry an ACTIVE membership in `organizationId`.\n *\n * Only ACTIVE counts: an INVITED, INACTIVE or SUSPENDED membership confers no access on the server, so\n * treating it as a pass would let exactly the refused reads through. Such a membership falls through to\n * the server probe instead, which answers correctly either way.\n *\n * A SERVICE-PROVIDER membership never counts (#1597, review 6): its status is a mirror of the relationship, which\n * the server re-checks on every request — a suspended relationship, or one past its term, still shows an ACTIVE row\n * here. It falls through to the server probe like any other membership the client cannot vouch for.\n */\nexport function hasActiveMembershipInOrganization(\n  memberships: ReadonlyArray<RouteOrganizationMembershipFacts> | null | undefined,\n  organizationId: string,\n): boolean {\n  return (memberships ?? []).some(\n    (membership) => membership.organizationId === organizationId\n      && membership.status === OrganizationMemberStatus.ACTIVE\n      && !isServiceProviderMembership(membership),\n  );\n}\n\n/**\n * The default, non-bulk API READ of a resource — the operation that fetches one row by its identifier.\n *\n * Shared by the session's organization loading and the route access probe, which must address the same\n * operation: if they disagreed, the probe could admit an organization the session cannot load.\n */\nexport function findDefaultApiReadOperation(\n  resourceConfiguration: AnyFrontendResourceConfiguration | undefined,\n): FrontendResourceConfiguration_Operation | undefined {\n  return resourceConfiguration?.operations?.find(\n    (operation: FrontendResourceConfiguration_Operation) =>\n      operation.operationIdentifier === CoreResourceOperation.READ\n      && operation.isOperationDefault === true\n      && operation.isBulkOperation !== true\n      && (\n        operation.variantType === ResourceOperationVariantType.API_CALL\n        || operation.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n      ),\n  );\n}\n"]}
+{"version":3,"file":"route-organization-access.frontend.utils.js","sourceRoot":"","sources":["../../../../src/core/security/route-organization-access.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAM/B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,uBA6BX;AA7BD,WAAY,uBAAuB;IACjC,qFAAqF;IACrF,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;IAC3B,8GAA8G;IAC9G,kEAAuC,CAAA;IACvC,sGAAsG;IACtG,kDAAuB,CAAA;IACvB,uIAAuI;IACvI,gDAAqB,CAAA;IACrB;;;;;;OAMG;IACH,8CAAmB,CAAA;IACnB;;;;OAIG;IACH,wDAA6B,CAAA;AAC/B,CAAC,EA7BW,uBAAuB,KAAvB,uBAAuB,QA6BlC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAC/C,WAA+E,EAC/E,cAAsB;IAEtB,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,KAAK,cAAc;WACvD,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM;WACrD,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,qBAAmE;IAEnE,OAAO,qBAAqB,EAAE,UAAU,EAAE,IAAI,CAC5C,CAAC,SAAkD,EAAE,EAAE,CACrD,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;WACzD,SAAS,CAAC,kBAAkB,KAAK,IAAI;WACrC,SAAS,CAAC,eAAe,KAAK,IAAI;WAClC,CACD,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;eAC5D,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACjF,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CoreResourceOperation,\n  OrganizationMemberStatus,\n  isServiceProviderMembership,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport type {\n  AnyFrontendResourceConfiguration,\n  FrontendResourceConfiguration_Operation,\n} from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\n\n/**\n * Whether the signed-in account may open the organization a route addresses (`/organizations/:id/…`).\n *\n * ## Why the route needs its own answer\n *\n * The AppScope organization is membership-checked: `UserOrgsContext` only commits an organization the\n * account belongs to. A route's organization segment is not. `ScopeUtilsService.buildResourceOperationContextIdentifiers`\n * places the URL's identifiers LAST, so they override the checked scope, and the page issues its reads\n * against whatever organization the link names. The link is not always the account's own: a session\n * that expires on `/organizations/A/tasks` saves that URL as the post-login `redirect`, and a DIFFERENT\n * account signing in is sent straight to it. Every read then answered 403, and the person was left on\n * a page that could never load.\n *\n * ## Why the server decides, and the membership list only short-circuits\n *\n * The user context embeds `organizationMembers`, but that array is a context projection capped at\n * `DEFAULT_RELATIONSHIP_CONTEXT_POLICY.limit` (20, newest first) and \"cannot say it was truncated\".\n * A refusal computed from it would eject a member of a 21st organization, and it would also eject a\n * platform operator on a crossing the server admits. So an ACTIVE membership found in the list is\n * trusted (a positive answer cannot be invented by truncation), and anything else is asked of the\n * server with one silent READ of the organization. Only a refusal from that READ redirects.\n */\nexport enum RouteOrganizationAccess {\n  /** The current route carries no organization segment. There is nothing to decide. */\n  NOT_ADDRESSED = 'NOT_ADDRESSED',\n  /**\n   * The route addresses an organization, but the session cannot be judged yet or at all: restore is\n   * unresolved, no user context was loaded, or the loaded user is not the token's subject (a stale\n   * context from the previous account). The route renders as it would without this check.\n   */\n  UNDECIDABLE = 'UNDECIDABLE',\n  /** The loaded user context carries an ACTIVE membership in the addressed organization. No request is made. */\n  ACTIVE_MEMBERSHIP = 'ACTIVE_MEMBERSHIP',\n  /** No active membership is known, and the server is being asked. The page must not load meanwhile. */\n  VERIFYING = 'VERIFYING',\n  /** The server answered the organization READ. The account may open it (a membership past the context cap, or an admitted crossing). */\n  ADMITTED = 'ADMITTED',\n  /**\n   * The server refused the organization READ (403, or the deliberate 404 a non-member receives so the\n   * answer is not an existence oracle). The route must not render.\n   *\n   * A link to an organization that does not exist lands here too, and on purpose: the server answers it\n   * with the same 404, so the frontend cannot tell the two apart, and must not try to.\n   */\n  REFUSED = 'REFUSED',\n  /**\n   * The READ failed for a reason that says nothing about access (network, 5xx, no READ operation mounted).\n   * The route renders, and its own requests report whatever is wrong: a transient failure must never\n   * eject someone from a page they may open.\n   */\n  INCONCLUSIVE = 'INCONCLUSIVE',\n}\n\n/** The membership fields this decision reads, structurally, so the check does not depend on the context's population shape. */\nexport interface RouteOrganizationMembershipFacts {\n  organizationId?: string | null;\n  status?: OrganizationMemberStatus | string | null;\n  /** Present on a service-provider membership (#1597). */\n  serviceProviderRelationshipId?: string | null;\n  providerOrganizationId?: string | null;\n}\n\n/**\n * True when the memberships carry an ACTIVE membership in `organizationId`.\n *\n * Only ACTIVE counts: an INVITED, INACTIVE or SUSPENDED membership confers no access on the server, so\n * treating it as a pass would let exactly the refused reads through. Such a membership falls through to\n * the server probe instead, which answers correctly either way.\n *\n * A SERVICE-PROVIDER membership never counts (#1597, review 6): its status is a mirror of the relationship, which\n * the server re-checks on every request — a suspended relationship, or one past its term, still shows an ACTIVE row\n * here. It falls through to the server probe like any other membership the client cannot vouch for.\n */\nexport function hasActiveMembershipInOrganization(\n  memberships: ReadonlyArray<RouteOrganizationMembershipFacts> | null | undefined,\n  organizationId: string,\n): boolean {\n  return (memberships ?? []).some(\n    (membership) => membership.organizationId === organizationId\n      && membership.status === OrganizationMemberStatus.ACTIVE\n      && !isServiceProviderMembership(membership),\n  );\n}\n\n/**\n * The default, non-bulk API READ of a resource — the operation that fetches one row by its identifier.\n *\n * Shared by the session's organization loading and the route access probe, which must address the same\n * operation: if they disagreed, the probe could admit an organization the session cannot load.\n */\nexport function findDefaultApiReadOperation(\n  resourceConfiguration: AnyFrontendResourceConfiguration | undefined,\n): FrontendResourceConfiguration_Operation | undefined {\n  return resourceConfiguration?.operations?.find(\n    (operation: FrontendResourceConfiguration_Operation) =>\n      operation.operationIdentifier === CoreResourceOperation.READ\n      && operation.isOperationDefault === true\n      && operation.isBulkOperation !== true\n      && (\n        operation.variantType === ResourceOperationVariantType.API_CALL\n        || operation.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n      ),\n  );\n}\n"]}

package/dist/esm/core/security/security.frontend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.frontend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAClD,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,eAAe,EAAE,CAAC;IACvC,0BAA0B,EAAE,UAAU,EAAE,CAAC;IACzC,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;OAUG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,oEAAoE;IACpE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,wGAAwG;IACxG,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,2BAA2B,CAAC,EAAE;QAC5B;;;;;WAKG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;;;WASG;QACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,mGAAmG;QACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAoB9B,CAAC;AAIF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAE/E;AAED;;;;;;;;;;;;;GAaG;AACH,oBAAY,sBAAsB;IAChC,WAAW,gBAAgB;IAC3B,KAAK,UAAU;CAChB;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;;CAKxD"}
+{"version":3,"file":"security.frontend.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAClD,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,eAAe,EAAE,CAAC;IACvC,0BAA0B,EAAE,UAAU,EAAE,CAAC;IACzC,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;OAUG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,oEAAoE;IACpE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,wGAAwG;IACxG,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,2BAA2B,CAAC,EAAE;QAC5B;;;;;WAKG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;;;WASG;QACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,mGAAmG;QACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAoB9B,CAAC;AAIF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAE/E;AAED;;;;;;;;;;;;;GAaG;AACH,oBAAY,sBAAsB;IAChC,WAAW,gBAAgB;IAC3B,KAAK,UAAU;CAChB;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;;CAKxD"}

package/dist/esm/core/security/security.frontend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,eAAe,GAKhB,MAAM,uBAAuB,CAAC;AA6G/B;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,mBAAmB,EAAE,IAAI;IACzB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;IACxB,2BAA2B,EAAE,SAAS;CACvC,CAAC;AAUF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAoB;IAC5D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,qDAA2B,CAAA;IAC3B,yCAAe,CAAA;AACjB,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD;QACE,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD;QACE,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF","sourcesContent":["/**\n * Security Frontend Schemas\n * \n * Core authentication and authorization types for the frontend security layer.\n */\n\nimport { z } from 'zod';\nimport { \n  AuthIdentificationResponse,\n  AuthFactorLevel,\n  SessionType,\n  type AuthMethod,\n  type AvailableMethod,\n  type AuthSessionPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Authentication state — contains only authentication-related fields.\n *\n * **No `refreshToken` field** (Auth-hardening Slice A Step 6,\n * 2026-04-13). Pre-Slice-A this carried `refreshToken: string | null`\n * mirroring the legacy body-channel rotation contract. A-Step 2\n * (cookie migration) made the cookie the sole owner of the refresh\n * token, A-Step 3 stopped this state from being read by any consumer,\n * and A-Step 6 dropped the field entirely. The refresh token now lives\n * EXCLUSIVELY in the `__wildo_refresh` `HttpOnly` cookie — JS-invisible\n * by design (XSS exfiltration surface closed). Consumers that want to\n * \"check if the user has a valid session\" should look at `accessToken`\n * (or `sessionRestored`) — never at the cookie, which is opaque to JS.\n */\nexport interface AuthState {\n  isLoading: boolean;\n  error: string | null;\n  sessionId: string | null;\n  accessToken: string | null;\n  identification: AuthIdentificationResponse | null;\n  sessionState: any | null;\n  isRestoringSession: boolean;\n  sessionRestored: boolean;\n  mfaRequired: boolean;\n  mfaSessionId: string | null;\n  availableMfaMethods: AvailableMethod[];\n  availableEnrollmentMethods: AuthMethod[];\n  enrolledSecondFactorMethods: string[];\n  usableSecondFactorMethods: string[];\n  /**\n   * The authentication session an answer parked at organization onboarding (#1090), or `null`.\n   *\n   * Set by an answer that parked the account — a registration, an email verification, an enrollment settlement,\n   * a sign-in (#1091) or a federated sign-in's code exchange (#1103) — and read together with `accessToken`: while it is set and no token is held, the one\n   * step left is naming the organization the account's user type owes. The sign-in, registration, verification,\n   * magic-link, challenge, enrollment and federated-callback screens send the person to the organization-onboarding step in that\n   * state (`organizationOnboardingNavigationTarget`). Cleared by completing onboarding, by abandoning it, by a\n   * spent session, by a new identification and by sign-out. Memory only, deliberately: the obligation is durable\n   * on the server, so a lost tab signs in again and is parked again.\n   */\n  onboardingSessionId: string | null;\n  purpose: AuthSessionPurpose | null;\n  /** W7.3b: Session type — null before authentication is resolved. */\n  sessionType: SessionType | null;\n  /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */\n  oneOffContext?: {\n    originTokenId: string;\n    tokenType: string;\n    consumableTokenValue?: string;\n    tokenExpiresAt?: string;\n    scopedInitiatorIds?: Record<string, string>;\n    applicationId?: string;\n  };\n  /**\n   * cross-app-jwt-propagation.md Step 5: Context data populated when an\n   * AUTH_CODE_EXCHANGE token was minted by the cross-frontend-handoff issuer.\n   * `AuthSessionContext.handleAuthCodeExchange()` populates this field only\n   * when the token-exchange response carries a top-level `returnPath`; OAuth2\n   * callback codes omit that field and therefore leave this context undefined.\n   *\n   * Distinct from `oneOffContext` on purpose (semantic distinction over\n   * convenience — see `design-philosophy.mdc`):\n   *   - `oneOffContext` describes a W7.3b ephemeral one-off session\n   *     (resource-scoped targeting, applicationId, consumable replay).\n   *   - `crossFrontendHandoffContext` describes a session-transfer landing\n   *     (returnPath, source/target frontend telemetry). The session itself\n   *     is a regular persistent session driven by the receiver's storage\n   *     adapter (cross-app-jwt-propagation.md K-7).\n   *\n   * Consumed by `Auth_OneOffSession` in cross-frontend-handoff mode to drive\n   * post-exchange navigation (`returnPath`); also available to app-level\n   * telemetry hooks that want to know \"this user just landed via a handoff\n   * from $sourceFrontendServiceName\".\n   */\n  crossFrontendHandoffContext?: {\n    /**\n     * Path to navigate to after the exchange completes. Already passed\n     * `CrossFrontendHandoff_ReturnPathSchema` refines at issuance, but\n     * receivers MUST sanitize defense-in-depth (a malicious caller could\n     * hand-craft an exchange URL bypassing the issuer).\n     */\n    returnPath: string;\n    /**\n     * The frontend that initiated the handoff (e.g., `'admin-console'`).\n     * Optional because the source frontend identifies itself only via the\n     * `X-Frontend-Service-Name` request header (set by the shared HTTP\n     * client interceptor). Non-browser callers — server-to-server\n     * invocations, hand-crafted curl sessions — may legitimately omit\n     * the header (the issuer falls back to \"unknown\" source for audit\n     * purposes), in which case the receiver simply has no source\n     * identity to display in telemetry / breadcrumbs.\n     */\n    sourceFrontendServiceName?: string;\n    /** The target frontend the handoff was minted for. Useful for telemetry / breadcrumb rendering. */\n    targetServiceKey?: string;\n  };\n}\n\n/**\n * Effective permissions for the current user\n * Contains app-level permissions and per-organization permissions\n */\nexport type EffectivePermissions = {\n  appLevel: string[];\n  organizations: Record<string, string[]>;\n};\n\n/**\n * Empty/initial authentication state\n */\nexport const EMPTY_AUTH_STATE: AuthState = {\n  isLoading: false,\n  error: null,\n  sessionId: null,\n  accessToken: null,\n  identification: null,\n  sessionState: null,\n  isRestoringSession: false,\n  sessionRestored: false,\n  mfaRequired: false,\n  mfaSessionId: null,\n  availableMfaMethods: [],\n  availableEnrollmentMethods: [],\n  enrolledSecondFactorMethods: [],\n  usableSecondFactorMethods: [],\n  onboardingSessionId: null,\n  purpose: null,\n  sessionType: null,\n  oneOffContext: undefined,\n  crossFrontendHandoffContext: undefined,\n};\n\n// ─── Auth UI State Types ─────────────────────────────────────────────\n\nexport type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';\n\nexport type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';\n\nexport type UIFactorLevel = 'first' | 'second';\n\n/**\n * The ONE translation between the UI's factor vocabulary (`'first' | 'second'`, which selects the\n * page, its labels and its layout) and the wire vocabulary `AuthFactorLevel`, which every\n * authenticate-shaped request carries. They are different vocabularies on purpose — the UI has no\n * `IDENTIFICATION` page — so a UI level must be translated at the seam, never forwarded.\n *\n * Measured 2026-09-15: the passkey sign-in forwarded `'first'` verbatim into\n * `POST /auth/passkey/authenticate/verify`. The orchestrator's `=== FIRST` branch did not match it,\n * treated the attempt as a second factor, and the response it built failed the wire enum — `400\n * validation` on every passkey sign-in, and the same for passkey as an MFA second factor, which\n * forwarded `'second'`. The password and OTP paths never hit it because they write\n * `AuthFactorLevel.FIRST` / `.SECOND` by hand at their own sites; this function is where that\n * translation now lives once.\n */\nexport function authFactorLevelForUiLevel(level: UIFactorLevel): AuthFactorLevel {\n  return level === 'second' ? AuthFactorLevel.SECOND : AuthFactorLevel.FIRST;\n}\n\n/**\n * How a username-less passkey sign-in asks the browser for a credential.\n *\n * The distinction is about who starts the prompt, and it decides how a failure is shown:\n *\n * - `CONDITIONAL` — passkey AUTOFILL. Started silently when the sign-in page renders; the browser offers\n *   the person's passkeys in the email field's autofill list and the call waits until one is picked. It\n *   may never resolve, is aborted when the page moves on, and a failure before a passkey is picked is\n *   NOT an error the person caused — so nothing is shown for it.\n * - `MODAL` — the person pressed \"Sign in with a passkey\". The browser shows its account picker at once,\n *   and every failure, cancellation included, is reported on the page.\n *\n * spec-cite: https://web.dev/articles/passkey-form-autofill — conditional UI is invoked with `mediation: 'conditional'`, \"the crucial flag that makes the WebAuthn API call conditional. It tells the browser to wait for user interaction.\"\n */\nexport enum PasskeySignInMediation {\n  CONDITIONAL = 'conditional',\n  MODAL = 'modal',\n}\n\n/**\n * A waiting passkey AUTOFILL request was stopped because its challenge was about to expire.\n *\n * Autofill waits for as long as the sign-in page stays open, but the server's challenge — and the\n * username-less session bound to it — lasts `expiresInSeconds`. Picking a passkey after that would fail\n * on a session that no longer exists, so the context stops the wait shortly before and throws THIS, and\n * the sign-in page starts a fresh request. Any other refusal of an autofill wait (the page moving on, the\n * button starting its own ceremony) is NOT this error, which is what stops the page restarting over a\n * ceremony the person began.\n */\nexport class PasskeyAutofillExpiredError extends Error {\n  constructor() {\n    super('Passkey autofill challenge expired before a passkey was picked');\n    this.name = 'PasskeyAutofillExpiredError';\n  }\n}\n\n/**\n * Thrown by a passkey AUTOFILL ceremony that stepped aside because a ceremony the person started\n * themselves (the passkey button, or a second-factor passkey step) is already open.\n *\n * Starting a WebAuthn request aborts any pending one, so an autofill whose options arrived after the\n * button opened its prompt would close the prompt the person is looking at. The autofill loop treats this\n * like any other refusal and stops; the page starts a fresh autofill once the person's ceremony ends.\n */\nexport class PasskeyAutofillSupersededError extends Error {\n  constructor() {\n    super('Passkey autofill stepped aside for a ceremony the person started');\n    this.name = 'PasskeyAutofillSupersededError';\n  }\n}\n"]}
+{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,eAAe,GAKhB,MAAM,uBAAuB,CAAC;AA6G/B;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,mBAAmB,EAAE,IAAI;IACzB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;IACxB,2BAA2B,EAAE,SAAS;CACvC,CAAC;AAUF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAoB;IAC5D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,qDAA2B,CAAA;IAC3B,yCAAe,CAAA;AACjB,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD;QACE,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD;QACE,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF","sourcesContent":["/**\n * Security Frontend Schemas\n * \n * Core authentication and authorization types for the frontend security layer.\n */\n\nimport { z } from 'zod';\nimport { \n  AuthIdentificationResponse,\n  AuthFactorLevel,\n  SessionType,\n  type AuthMethod,\n  type AvailableMethod,\n  type AuthSessionPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Authentication state — contains only authentication-related fields.\n *\n * **No `refreshToken` field** (Auth-hardening Slice A Step 6,\n * 2026-04-13). Pre-Slice-A this carried `refreshToken: string | null`\n * mirroring the legacy body-channel rotation contract. A-Step 2\n * (cookie migration) made the cookie the sole owner of the refresh\n * token, A-Step 3 stopped this state from being read by any consumer,\n * and A-Step 6 dropped the field entirely. The refresh token now lives\n * EXCLUSIVELY in the `__wildo_refresh` `HttpOnly` cookie — JS-invisible\n * by design (XSS exfiltration surface closed). Consumers that want to\n * \"check if the user has a valid session\" should look at `accessToken`\n * (or `sessionRestored`) — never at the cookie, which is opaque to JS.\n */\nexport interface AuthState {\n  isLoading: boolean;\n  error: string | null;\n  sessionId: string | null;\n  accessToken: string | null;\n  identification: AuthIdentificationResponse | null;\n  sessionState: any | null;\n  isRestoringSession: boolean;\n  sessionRestored: boolean;\n  mfaRequired: boolean;\n  mfaSessionId: string | null;\n  availableMfaMethods: AvailableMethod[];\n  availableEnrollmentMethods: AuthMethod[];\n  enrolledSecondFactorMethods: string[];\n  usableSecondFactorMethods: string[];\n  /**\n   * The authentication session an answer parked at organization onboarding (#1090), or `null`.\n   *\n   * Set by an answer that parked the account — a registration, an email verification, an enrollment settlement,\n   * a sign-in (#1091) or a federated sign-in's code exchange (#1103) — and read together with `accessToken`: while it is set and no token is held, the one\n   * step left is naming the organization the account's user type owes. The sign-in, registration, verification,\n   * magic-link, challenge, enrollment and federated-callback screens send the person to the organization-onboarding step in that\n   * state (`organizationOnboardingNavigationTarget`). Cleared by completing onboarding, by abandoning it, by a\n   * spent session, by a new identification and by sign-out. Memory only, deliberately: the obligation is durable\n   * on the server, so a lost tab signs in again and is parked again.\n   */\n  onboardingSessionId: string | null;\n  purpose: AuthSessionPurpose | null;\n  /** W7.3b: Session type — null before authentication is resolved. */\n  sessionType: SessionType | null;\n  /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */\n  oneOffContext?: {\n    originTokenId: string;\n    tokenType: string;\n    consumableTokenValue?: string;\n    tokenExpiresAt?: string;\n    scopedInitiatorIds?: Record<string, string>;\n    applicationId?: string;\n  };\n  /**\n   * cross-app-jwt-propagation.md Step 5: Context data populated when an\n   * AUTH_CODE_EXCHANGE token was minted by the cross-frontend-handoff issuer.\n   * `AuthSessionContext.handleAuthCodeExchange()` populates this field only\n   * when the token-exchange response carries a top-level `returnPath`; OAuth2\n   * callback codes omit that field and therefore leave this context undefined.\n   *\n   * Distinct from `oneOffContext` on purpose (semantic distinction over\n   * convenience — see `design-philosophy.mdc`):\n   *   - `oneOffContext` describes a W7.3b ephemeral one-off session\n   *     (resource-scoped targeting, applicationId, consumable replay).\n   *   - `crossFrontendHandoffContext` describes a session-transfer landing\n   *     (returnPath, source/target frontend telemetry). The session itself\n   *     is a regular persistent session driven by the receiver's storage\n   *     adapter (cross-app-jwt-propagation.md K-7).\n   *\n   * Consumed by `Auth_OneOffSession` in cross-frontend-handoff mode to drive\n   * post-exchange navigation (`returnPath`); also available to app-level\n   * telemetry hooks that want to know \"this user just landed via a handoff\n   * from $sourceFrontendServiceName\".\n   */\n  crossFrontendHandoffContext?: {\n    /**\n     * Path to navigate to after the exchange completes. Already passed\n     * `CrossFrontendHandoff_ReturnPathSchema` refines at issuance, but\n     * receivers MUST sanitize defense-in-depth (a malicious caller could\n     * hand-craft an exchange URL bypassing the issuer).\n     */\n    returnPath: string;\n    /**\n     * The frontend that initiated the handoff (e.g., `'admin-console'`).\n     * Optional because the source frontend identifies itself only via the\n     * `X-Frontend-Service-Name` request header (set by the shared HTTP\n     * client interceptor). Non-browser callers — server-to-server\n     * invocations, hand-crafted curl sessions — may legitimately omit\n     * the header (the issuer falls back to \"unknown\" source for audit\n     * purposes), in which case the receiver simply has no source\n     * identity to display in telemetry / breadcrumbs.\n     */\n    sourceFrontendServiceName?: string;\n    /** The target frontend the handoff was minted for. Useful for telemetry / breadcrumb rendering. */\n    targetServiceKey?: string;\n  };\n}\n\n/**\n * Effective permissions for the current user\n * Contains app-level permissions and per-organization permissions\n */\nexport type EffectivePermissions = {\n  appLevel: string[];\n  organizations: Record<string, string[]>;\n};\n\n/**\n * Empty/initial authentication state\n */\nexport const EMPTY_AUTH_STATE: AuthState = {\n  isLoading: false,\n  error: null,\n  sessionId: null,\n  accessToken: null,\n  identification: null,\n  sessionState: null,\n  isRestoringSession: false,\n  sessionRestored: false,\n  mfaRequired: false,\n  mfaSessionId: null,\n  availableMfaMethods: [],\n  availableEnrollmentMethods: [],\n  enrolledSecondFactorMethods: [],\n  usableSecondFactorMethods: [],\n  onboardingSessionId: null,\n  purpose: null,\n  sessionType: null,\n  oneOffContext: undefined,\n  crossFrontendHandoffContext: undefined,\n};\n\n// ─── Auth UI State Types ─────────────────────────────────────────────\n\nexport type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';\n\nexport type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';\n\nexport type UIFactorLevel = 'first' | 'second';\n\n/**\n * The ONE translation between the UI's factor vocabulary (`'first' | 'second'`, which selects the\n * page, its labels and its layout) and the wire vocabulary `AuthFactorLevel`, which every\n * authenticate-shaped request carries. They are different vocabularies on purpose — the UI has no\n * `IDENTIFICATION` page — so a UI level must be translated at the seam, never forwarded.\n *\n * Measured 2026-09-15: the passkey sign-in forwarded `'first'` verbatim into\n * `POST /auth/passkey/authenticate/verify`. The orchestrator's `=== FIRST` branch did not match it,\n * treated the attempt as a second factor, and the response it built failed the wire enum — `400\n * validation` on every passkey sign-in, and the same for passkey as an MFA second factor, which\n * forwarded `'second'`. The password and OTP paths never hit it because they write\n * `AuthFactorLevel.FIRST` / `.SECOND` by hand at their own sites; this function is where that\n * translation now lives once.\n */\nexport function authFactorLevelForUiLevel(level: UIFactorLevel): AuthFactorLevel {\n  return level === 'second' ? AuthFactorLevel.SECOND : AuthFactorLevel.FIRST;\n}\n\n/**\n * How a username-less passkey sign-in asks the browser for a credential.\n *\n * The distinction is about who starts the prompt, and it decides how a failure is shown:\n *\n * - `CONDITIONAL` — passkey AUTOFILL. Started silently when the sign-in page renders; the browser offers\n *   the person's passkeys in the email field's autofill list and the call waits until one is picked. It\n *   may never resolve, is aborted when the page moves on, and a failure before a passkey is picked is\n *   NOT an error the person caused — so nothing is shown for it.\n * - `MODAL` — the person pressed \"Sign in with a passkey\". The browser shows its account picker at once,\n *   and every failure, cancellation included, is reported on the page.\n *\n * spec-cite: https://web.dev/articles/passkey-form-autofill — conditional UI is invoked with `mediation: 'conditional'`, \"the crucial flag that makes the WebAuthn API call conditional. It tells the browser to wait for user interaction.\"\n */\nexport enum PasskeySignInMediation {\n  CONDITIONAL = 'conditional',\n  MODAL = 'modal',\n}\n\n/**\n * A waiting passkey AUTOFILL request was stopped because its challenge was about to expire.\n *\n * Autofill waits for as long as the sign-in page stays open, but the server's challenge — and the\n * username-less session bound to it — lasts `expiresInSeconds`. Picking a passkey after that would fail\n * on a session that no longer exists, so the context stops the wait shortly before and throws THIS, and\n * the sign-in page starts a fresh request. Any other refusal of an autofill wait (the page moving on, the\n * button starting its own ceremony) is NOT this error, which is what stops the page restarting over a\n * ceremony the person began.\n */\nexport class PasskeyAutofillExpiredError extends Error {\n  constructor() {\n    super('Passkey autofill challenge expired before a passkey was picked');\n    this.name = 'PasskeyAutofillExpiredError';\n  }\n}\n\n/**\n * Thrown by a passkey AUTOFILL ceremony that stepped aside because a ceremony the person started\n * themselves (the passkey button, or a second-factor passkey step) is already open.\n *\n * Starting a WebAuthn request aborts any pending one, so an autofill whose options arrived after the\n * button opened its prompt would close the prompt the person is looking at. The autofill loop treats this\n * like any other refusal and stops; the page starts a fresh autofill once the person's ceremony ends.\n */\nexport class PasskeyAutofillSupersededError extends Error {\n  constructor() {\n    super('Passkey autofill stepped aside for a ceremony the person started');\n    this.name = 'PasskeyAutofillSupersededError';\n  }\n}\n"]}

package/dist/esm/core/security/session-token-storage.frontend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-storage.frontend.service.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,CAAC;CACf;AAQD,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI;IAG/B;;;;;;OAMG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI;IAGhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAY1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK7C,KAAK,IAAI,IAAI;CAKd;AAED,qBAAa,4BAA6B,YAAW,mBAAmB;IACtE,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAAuB;IAE9C,cAAc,IAAI,MAAM,GAAG,IAAI;IAC/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAChC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAC7C,KAAK,IAAI,IAAI;CAKd"}
+{"version":3,"file":"session-token-storage.frontend.service.d.ts","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,CAAC;CACf;AAQD,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI;IAG/B;;;;;;OAMG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI;IAGhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAY1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK7C,KAAK,IAAI,IAAI;CAKd;AAED,qBAAa,4BAA6B,YAAW,mBAAmB;IACtE,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAAuB;IAE9C,cAAc,IAAI,MAAM,GAAG,IAAI;IAC/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAChC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAC7C,KAAK,IAAI,IAAI;CAKd"}

package/dist/esm/core/security/session-token-storage.frontend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-storage.frontend.service.js","sourceRoot":"","sources":["../../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iEAAiE,CAAC;AAazE;;;GAGG;AACH,IAAI,8BAA8B,GAAG,KAAK,CAAC;AAE3C,MAAM,OAAO,6BAA6B;IACxC,cAAc;QACZ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD;;;;;;OAMG;IACH,eAAe;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,WAAW;YACT,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAC7D,8BAA8B,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,CACV,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,iBAAiB;QACf,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,iBAAiB,CAAC,KAAoB;QACpC,KAAK;YACH,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzD,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IACpC,eAAe,GAAkB,IAAI,CAAC;IAE9C,cAAc,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,eAAe,KAAoB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IACD,iBAAiB,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,iBAAiB,CAAC,KAAoB,IAAU,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;IAC/E,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;CACF","sourcesContent":["/**\n * W7.3b: Session Token Storage — Strategy pattern for token persistence.\n *\n * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).\n * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).\n *\n * Auth-hardening Slice A Step 3 (2026-04-13) — `PersistentSessionTokenStorage`\n * NO LONGER persists the refresh token in localStorage. The refresh token now\n * travels via the `__wildo_refresh` `HttpOnly` cookie (see\n * `auth-controller.utils.ts` and `authentication-controller.backend.service.ts`).\n * The cookie is invisible to JS, which closes the XSS exfiltration surface\n * that ANY localStorage-backed refresh token inherently has.\n *\n * The `storeTokens()` signature still accepts a `refreshToken` parameter for\n * source-compat with `EphemeralSessionTokenStorage` (which keeps the in-memory\n * field for one-off / test contexts), but `PersistentSessionTokenStorage`\n * silently ignores the argument and emits a one-line `console.warn` if a\n * non-null value is passed during the transition window. The existing\n * `removeLocalStorageItem(REFRESH_TOKEN)` is kept on every `storeTokens()`\n * AND `clear()` invocation so any leftover localStorage value from a\n * pre-migration session is wiped on the user's next interaction.\n */\n\nimport {\n  LOCAL_STORAGE_KEYS,\n  getLocalStorageItem,\n  setLocalStorageItem,\n  removeLocalStorageItem,\n} from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\nexport interface SessionTokenStorage {\n  getAccessToken(): string | null;\n  getRefreshToken(): string | null;\n  storeTokens(accessToken: string | null, refreshToken: string | null): void;\n\n  getOrganizationId(): string | null;\n  setOrganizationId(orgId: string | null): void;\n\n  clear(): void;\n}\n\n/**\n * Module-scoped flag — emit the deprecation warning ONCE per page load even if\n * `storeTokens()` is called many times during a session. Avoids log spam.\n */\nlet _refreshTokenArgWarningEmitted = false;\n\nexport class PersistentSessionTokenStorage implements SessionTokenStorage {\n  getAccessToken(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n  }\n  /**\n   * Always returns `null` — refresh tokens no longer live in localStorage\n   * (Auth-hardening Slice A Step 3). The `__wildo_refresh` `HttpOnly` cookie\n   * carries the refresh token; JS can never read it. Method kept for\n   * `SessionTokenStorage` interface conformance — `EphemeralSessionTokenStorage`\n   * still uses it for in-memory contexts.\n   */\n  getRefreshToken(): string | null {\n    return null;\n  }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    accessToken\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN, accessToken)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    if (refreshToken !== null && !_refreshTokenArgWarningEmitted) {\n      _refreshTokenArgWarningEmitted = true;\n      console.warn(\n        '[wildo-auth] PersistentSessionTokenStorage.storeTokens() received a non-null refreshToken — argument is ignored. Refresh tokens now travel via the `__wildo_refresh` HttpOnly cookie (Auth-hardening Slice A).',\n      );\n    }\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n  }\n  getOrganizationId(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  setOrganizationId(orgId: string | null): void {\n    orgId\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID, orgId)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  clear(): void {\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n}\n\nexport class EphemeralSessionTokenStorage implements SessionTokenStorage {\n  private _accessToken: string | null = null;\n  private _refreshToken: string | null = null;\n  private _organizationId: string | null = null;\n\n  getAccessToken(): string | null { return this._accessToken; }\n  getRefreshToken(): string | null { return this._refreshToken; }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    this._accessToken = accessToken;\n    this._refreshToken = refreshToken;\n  }\n  getOrganizationId(): string | null { return this._organizationId; }\n  setOrganizationId(orgId: string | null): void { this._organizationId = orgId; }\n  clear(): void {\n    this._accessToken = null;\n    this._refreshToken = null;\n    this._organizationId = null;\n  }\n}\n"]}
+{"version":3,"file":"session-token-storage.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iEAAiE,CAAC;AAazE;;;GAGG;AACH,IAAI,8BAA8B,GAAG,KAAK,CAAC;AAE3C,MAAM,OAAO,6BAA6B;IACxC,cAAc;QACZ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD;;;;;;OAMG;IACH,eAAe;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,WAAW;YACT,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAC7D,8BAA8B,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,CACV,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,iBAAiB;QACf,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,iBAAiB,CAAC,KAAoB;QACpC,KAAK;YACH,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzD,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IACpC,eAAe,GAAkB,IAAI,CAAC;IAE9C,cAAc,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,eAAe,KAAoB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IACD,iBAAiB,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,iBAAiB,CAAC,KAAoB,IAAU,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;IAC/E,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;CACF","sourcesContent":["/**\n * W7.3b: Session Token Storage — Strategy pattern for token persistence.\n *\n * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).\n * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).\n *\n * Auth-hardening Slice A Step 3 (2026-04-13) — `PersistentSessionTokenStorage`\n * NO LONGER persists the refresh token in localStorage. The refresh token now\n * travels via the `__wildo_refresh` `HttpOnly` cookie (see\n * `auth-controller.utils.ts` and `authentication-controller.backend.service.ts`).\n * The cookie is invisible to JS, which closes the XSS exfiltration surface\n * that ANY localStorage-backed refresh token inherently has.\n *\n * The `storeTokens()` signature still accepts a `refreshToken` parameter for\n * source-compat with `EphemeralSessionTokenStorage` (which keeps the in-memory\n * field for one-off / test contexts), but `PersistentSessionTokenStorage`\n * silently ignores the argument and emits a one-line `console.warn` if a\n * non-null value is passed during the transition window. The existing\n * `removeLocalStorageItem(REFRESH_TOKEN)` is kept on every `storeTokens()`\n * AND `clear()` invocation so any leftover localStorage value from a\n * pre-migration session is wiped on the user's next interaction.\n */\n\nimport {\n  LOCAL_STORAGE_KEYS,\n  getLocalStorageItem,\n  setLocalStorageItem,\n  removeLocalStorageItem,\n} from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\nexport interface SessionTokenStorage {\n  getAccessToken(): string | null;\n  getRefreshToken(): string | null;\n  storeTokens(accessToken: string | null, refreshToken: string | null): void;\n\n  getOrganizationId(): string | null;\n  setOrganizationId(orgId: string | null): void;\n\n  clear(): void;\n}\n\n/**\n * Module-scoped flag — emit the deprecation warning ONCE per page load even if\n * `storeTokens()` is called many times during a session. Avoids log spam.\n */\nlet _refreshTokenArgWarningEmitted = false;\n\nexport class PersistentSessionTokenStorage implements SessionTokenStorage {\n  getAccessToken(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n  }\n  /**\n   * Always returns `null` — refresh tokens no longer live in localStorage\n   * (Auth-hardening Slice A Step 3). The `__wildo_refresh` `HttpOnly` cookie\n   * carries the refresh token; JS can never read it. Method kept for\n   * `SessionTokenStorage` interface conformance — `EphemeralSessionTokenStorage`\n   * still uses it for in-memory contexts.\n   */\n  getRefreshToken(): string | null {\n    return null;\n  }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    accessToken\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN, accessToken)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    if (refreshToken !== null && !_refreshTokenArgWarningEmitted) {\n      _refreshTokenArgWarningEmitted = true;\n      console.warn(\n        '[wildo-auth] PersistentSessionTokenStorage.storeTokens() received a non-null refreshToken — argument is ignored. Refresh tokens now travel via the `__wildo_refresh` HttpOnly cookie (Auth-hardening Slice A).',\n      );\n    }\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n  }\n  getOrganizationId(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  setOrganizationId(orgId: string | null): void {\n    orgId\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID, orgId)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  clear(): void {\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n}\n\nexport class EphemeralSessionTokenStorage implements SessionTokenStorage {\n  private _accessToken: string | null = null;\n  private _refreshToken: string | null = null;\n  private _organizationId: string | null = null;\n\n  getAccessToken(): string | null { return this._accessToken; }\n  getRefreshToken(): string | null { return this._refreshToken; }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    this._accessToken = accessToken;\n    this._refreshToken = refreshToken;\n  }\n  getOrganizationId(): string | null { return this._organizationId; }\n  setOrganizationId(orgId: string | null): void { this._organizationId = orgId; }\n  clear(): void {\n    this._accessToken = null;\n    this._refreshToken = null;\n    this._organizationId = null;\n  }\n}\n"]}

package/dist/esm/core/security/useAuthSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,sBAMjC,CAAC"}
+{"version":3,"file":"useAuthSession.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,sBAMjC,CAAC"}

package/dist/esm/core/security/useAuthSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA+B,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA2B,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useAuthSession Hook\n * \n * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { AuthSessionContext, type AuthSessionContextType } from './AuthSessionContext';\n/**\n * Hook to access the Auth Session context\n * @returns AuthSessionContextType with auth state and authentication functions\n * @throws Error if used outside of AuthSessionProvider\n */\nexport const useAuthSession = (): AuthSessionContextType => {\n  const context = useContext(AuthSessionContext);\n  if (!context) {\n    throw new Error('useAuthSession must be used within an AuthSessionProvider');\n  }\n  return context;\n};\n"]}
+{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA+B,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA2B,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useAuthSession Hook\n * \n * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { AuthSessionContext, type AuthSessionContextType } from './AuthSessionContext';\n/**\n * Hook to access the Auth Session context\n * @returns AuthSessionContextType with auth state and authentication functions\n * @throws Error if used outside of AuthSessionProvider\n */\nexport const useAuthSession = (): AuthSessionContextType => {\n  const context = useContext(AuthSessionContext);\n  if (!context) {\n    throw new Error('useAuthSession must be used within an AuthSessionProvider');\n  }\n  return context;\n};\n"]}

package/dist/esm/core/security/useConsentGateBehavior.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useConsentGateBehavior.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useConsentGateBehavior.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,mCAAmC;IACnC,QAAQ,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,UAAU,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,qBAAqB,EAAE,SAAS,cAAc,EAAE,CAAC;IACjD;;;;;;;;OAQG;IACH,MAAM,EAAE,CACN,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,yBAAyB,CAAC,EAAE,OAAO,KAChC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,kEAAkE;IAClE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,mBAAmB,CAkD5D"}
+{"version":3,"file":"useConsentGateBehavior.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useConsentGateBehavior.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,mCAAmC;IACnC,QAAQ,EAAE,OAAO,CAAC;IAClB,mFAAmF;IACnF,UAAU,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,qBAAqB,EAAE,SAAS,cAAc,EAAE,CAAC;IACjD;;;;;;;;OAQG;IACH,MAAM,EAAE,CACN,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,yBAAyB,CAAC,EAAE,OAAO,KAChC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,kEAAkE;IAClE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,mBAAmB,CAkD5D"}

package/dist/esm/core/security/useConsentGateBehavior.js.map

@@ -1 +1 @@
-{"version":3,"file":"useConsentGateBehavior.js","sourceRoot":"","sources":["../../../../../src/core/security/useConsentGateBehavior.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AA8BxE;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAA4B,EAAE,CAAC,CAAC;IAElG,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,sBAAsB,CAAC;QAC3B,yBAAyB,EAAE,SAAS,CAAC,UAAU,EAAE,yBAAyB;QAC1E,gBAAgB,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI;QACvD,wBAAwB,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,KAAK,KAAK;QACxE,iCAAiC,EAAE,SAAS,CAAC,UAAU,EAAE,iCAAiC;QAC1F,OAAO;KACR,CAAC,EACF;QACE,SAAS,CAAC,SAAS,EAAE,OAAO;QAC5B,SAAS,CAAC,SAAS,EAAE,eAAe;QACpC,SAAS,CAAC,UAAU,EAAE,yBAAyB;QAC/C,SAAS,CAAC,UAAU,EAAE,iCAAiC;QACvD,OAAO;KACR,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAC9B,OAAkC,EAClC,QAAmC,EACnC,yBAAyB,GAAG,KAAK,EAClB,EAAE;QACjB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAClD,wFAAwF;YACxF,+CAA+C;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAC7B,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,sBAAsB,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC,CAAC;IAEnC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5F,CAAC","sourcesContent":["import { useCallback, useMemo, useState } from 'react';\nimport type { ConsentPurpose } from '@wildo-ai/saas-models';\n\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport {\n  composeConsentDecision,\n  consentWithdrawalCost,\n  deriveConsentGateState,\n  type ConsentGateState,\n} from './consent-gate.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\n\nexport interface ConsentGateBehavior extends ConsentGateState {\n  /** A decision is being written. */\n  isSaving: boolean;\n  /** The last decision could not be written; the gate stays in its current state. */\n  saveFailed: boolean;\n  /**\n   * The required purposes the LAST `decide()` call would have left unmet, held here because it was not\n   * acknowledged (R9). Cleared by any subsequent `decide()` call, whatever it decides.\n   */\n  pendingWithdrawalCost: readonly ConsentPurpose[];\n  /**\n   * Record the person's choice among `offered` purposes: each offered purpose is granted exactly when it\n   * is in `selected`, and every purpose not offered keeps its stored grant.\n   *\n   * Withdrawing a required purpose is never refused — consent must be as easy to withdraw as to give —\n   * but it is never SILENT either (R9). When the choice would leave a required purpose unmet, the first\n   * call reports the cost via `pendingWithdrawalCost` and saves NOTHING; pass\n   * `acknowledgeWithdrawalCost: true` once the surface has shown that cost to save anyway.\n   */\n  decide: (\n    offered: readonly ConsentPurpose[],\n    selected: readonly ConsentPurpose[],\n    acknowledgeWithdrawalCost?: boolean,\n  ) => Promise<void>;\n  /** Leave the application instead of granting required consent. */\n  signOut: () => void;\n}\n\n/**\n * The application-tier consent gate's behaviour (#534 / #453): reads the application's requirement and\n * analytics posture, reads the person's stored decision, and writes decisions through\n * `UserOrgsContext.recordConsentDecision` — the self-preferences UPDATE whose server-side hook owns the\n * decision instant and whose `privacy.consentedPurposes` is audit evidence.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — an affirmative, recorded choice replaces a default;\n * required purposes are enforced before any signed-in route renders.\n */\nexport function useConsentGateBehavior(): ConsentGateBehavior {\n  const { appConfig } = useApplication();\n  const { privacy, recordConsentDecision, logout } = useUserOrgs();\n  const [isSaving, setIsSaving] = useState(false);\n  const [saveFailed, setSaveFailed] = useState(false);\n  const [pendingWithdrawalCost, setPendingWithdrawalCost] = useState<readonly ConsentPurpose[]>([]);\n\n  const state = useMemo(\n    () => deriveConsentGateState({\n      serviceConsentRequirement: appConfig.compliance?.serviceConsentRequirement,\n      analyticsEnabled: appConfig.analytics?.enabled === true,\n      analyticsRequiresConsent: appConfig.analytics?.requiresConsent !== false,\n      capabilityDeclaredConsentPurposes: appConfig.compliance?.capabilityDeclaredConsentPurposes,\n      privacy,\n    }),\n    [\n      appConfig.analytics?.enabled,\n      appConfig.analytics?.requiresConsent,\n      appConfig.compliance?.serviceConsentRequirement,\n      appConfig.compliance?.capabilityDeclaredConsentPurposes,\n      privacy,\n    ],\n  );\n\n  const decide = useCallback(async (\n    offered: readonly ConsentPurpose[],\n    selected: readonly ConsentPurpose[],\n    acknowledgeWithdrawalCost = false,\n  ): Promise<void> => {\n    setSaveFailed(false);\n    const cost = consentWithdrawalCost(state, offered, selected);\n    if (cost.length > 0 && !acknowledgeWithdrawalCost) {\n      // Report and stop — do NOT save. Refusing the withdrawal is not available (R9); what is\n      // available is not letting it happen silently.\n      setPendingWithdrawalCost(cost);\n      return;\n    }\n    setPendingWithdrawalCost([]);\n    setIsSaving(true);\n    try {\n      await recordConsentDecision(composeConsentDecision(state.grantedPurposes, offered, selected));\n    } catch (error) {\n      logger.error('Consent decision could not be recorded', { error });\n      setSaveFailed(true);\n    } finally {\n      setIsSaving(false);\n    }\n  }, [recordConsentDecision, state]);\n\n  return { ...state, isSaving, saveFailed, pendingWithdrawalCost, decide, signOut: logout };\n}\n"]}
+{"version":3,"file":"useConsentGateBehavior.js","sourceRoot":"","sources":["../../../../src/core/security/useConsentGateBehavior.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AA8BxE;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,GAAG,QAAQ,CAA4B,EAAE,CAAC,CAAC;IAElG,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,sBAAsB,CAAC;QAC3B,yBAAyB,EAAE,SAAS,CAAC,UAAU,EAAE,yBAAyB;QAC1E,gBAAgB,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI;QACvD,wBAAwB,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,KAAK,KAAK;QACxE,iCAAiC,EAAE,SAAS,CAAC,UAAU,EAAE,iCAAiC;QAC1F,OAAO;KACR,CAAC,EACF;QACE,SAAS,CAAC,SAAS,EAAE,OAAO;QAC5B,SAAS,CAAC,SAAS,EAAE,eAAe;QACpC,SAAS,CAAC,UAAU,EAAE,yBAAyB;QAC/C,SAAS,CAAC,UAAU,EAAE,iCAAiC;QACvD,OAAO;KACR,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAC9B,OAAkC,EAClC,QAAmC,EACnC,yBAAyB,GAAG,KAAK,EAClB,EAAE;QACjB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAClD,wFAAwF;YACxF,+CAA+C;YAC/C,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAC7B,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,sBAAsB,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC,CAAC;IAEnC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5F,CAAC","sourcesContent":["import { useCallback, useMemo, useState } from 'react';\nimport type { ConsentPurpose } from '@wildo-ai/saas-models';\n\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport {\n  composeConsentDecision,\n  consentWithdrawalCost,\n  deriveConsentGateState,\n  type ConsentGateState,\n} from './consent-gate.frontend.utils';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\n\nexport interface ConsentGateBehavior extends ConsentGateState {\n  /** A decision is being written. */\n  isSaving: boolean;\n  /** The last decision could not be written; the gate stays in its current state. */\n  saveFailed: boolean;\n  /**\n   * The required purposes the LAST `decide()` call would have left unmet, held here because it was not\n   * acknowledged (R9). Cleared by any subsequent `decide()` call, whatever it decides.\n   */\n  pendingWithdrawalCost: readonly ConsentPurpose[];\n  /**\n   * Record the person's choice among `offered` purposes: each offered purpose is granted exactly when it\n   * is in `selected`, and every purpose not offered keeps its stored grant.\n   *\n   * Withdrawing a required purpose is never refused — consent must be as easy to withdraw as to give —\n   * but it is never SILENT either (R9). When the choice would leave a required purpose unmet, the first\n   * call reports the cost via `pendingWithdrawalCost` and saves NOTHING; pass\n   * `acknowledgeWithdrawalCost: true` once the surface has shown that cost to save anyway.\n   */\n  decide: (\n    offered: readonly ConsentPurpose[],\n    selected: readonly ConsentPurpose[],\n    acknowledgeWithdrawalCost?: boolean,\n  ) => Promise<void>;\n  /** Leave the application instead of granting required consent. */\n  signOut: () => void;\n}\n\n/**\n * The application-tier consent gate's behaviour (#534 / #453): reads the application's requirement and\n * analytics posture, reads the person's stored decision, and writes decisions through\n * `UserOrgsContext.recordConsentDecision` — the self-preferences UPDATE whose server-side hook owns the\n * decision instant and whose `privacy.consentedPurposes` is audit evidence.\n *\n * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — an affirmative, recorded choice replaces a default;\n * required purposes are enforced before any signed-in route renders.\n */\nexport function useConsentGateBehavior(): ConsentGateBehavior {\n  const { appConfig } = useApplication();\n  const { privacy, recordConsentDecision, logout } = useUserOrgs();\n  const [isSaving, setIsSaving] = useState(false);\n  const [saveFailed, setSaveFailed] = useState(false);\n  const [pendingWithdrawalCost, setPendingWithdrawalCost] = useState<readonly ConsentPurpose[]>([]);\n\n  const state = useMemo(\n    () => deriveConsentGateState({\n      serviceConsentRequirement: appConfig.compliance?.serviceConsentRequirement,\n      analyticsEnabled: appConfig.analytics?.enabled === true,\n      analyticsRequiresConsent: appConfig.analytics?.requiresConsent !== false,\n      capabilityDeclaredConsentPurposes: appConfig.compliance?.capabilityDeclaredConsentPurposes,\n      privacy,\n    }),\n    [\n      appConfig.analytics?.enabled,\n      appConfig.analytics?.requiresConsent,\n      appConfig.compliance?.serviceConsentRequirement,\n      appConfig.compliance?.capabilityDeclaredConsentPurposes,\n      privacy,\n    ],\n  );\n\n  const decide = useCallback(async (\n    offered: readonly ConsentPurpose[],\n    selected: readonly ConsentPurpose[],\n    acknowledgeWithdrawalCost = false,\n  ): Promise<void> => {\n    setSaveFailed(false);\n    const cost = consentWithdrawalCost(state, offered, selected);\n    if (cost.length > 0 && !acknowledgeWithdrawalCost) {\n      // Report and stop — do NOT save. Refusing the withdrawal is not available (R9); what is\n      // available is not letting it happen silently.\n      setPendingWithdrawalCost(cost);\n      return;\n    }\n    setPendingWithdrawalCost([]);\n    setIsSaving(true);\n    try {\n      await recordConsentDecision(composeConsentDecision(state.grantedPurposes, offered, selected));\n    } catch (error) {\n      logger.error('Consent decision could not be recorded', { error });\n      setSaveFailed(true);\n    } finally {\n      setIsSaving(false);\n    }\n  }, [recordConsentDecision, state]);\n\n  return { ...state, isSaving, saveFailed, pendingWithdrawalCost, decide, signOut: logout };\n}\n"]}

package/dist/esm/core/security/useDocumentAcceptanceGateBehavior.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useDocumentAcceptanceGateBehavior.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useDocumentAcceptanceGateBehavior.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,oCAAoC,EAQrC,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EACV,+BAA+B,EAEhC,MAAM,6EAA6E,CAAC;AAErF,iDAAiD;AACjD,oBAAY,4BAA4B;IACtC,gHAAgH;IAChH,cAAc,mBAAmB;IACjC,oGAAoG;IACpG,QAAQ,aAAa;IACrB,uBAAuB;IACvB,SAAS,cAAc;IACvB,yGAAyG;IACzG,QAAQ,aAAa;IACrB;;;;;OAKG;IACH,WAAW,gBAAgB;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;IAC9C,qHAAqH;IACrH,QAAQ,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,CAAC;IAClE,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC;IACrD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iCAAiC,IAAI,8BAA8B,CAkHlF"}
+{"version":3,"file":"useDocumentAcceptanceGateBehavior.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useDocumentAcceptanceGateBehavior.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,oCAAoC,EAQrC,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EACV,+BAA+B,EAEhC,MAAM,6EAA6E,CAAC;AAErF,iDAAiD;AACjD,oBAAY,4BAA4B;IACtC,gHAAgH;IAChH,cAAc,mBAAmB;IACjC,oGAAoG;IACpG,QAAQ,aAAa;IACrB,uBAAuB;IACvB,SAAS,cAAc;IACvB,yGAAyG;IACzG,QAAQ,aAAa;IACrB;;;;;OAKG;IACH,WAAW,gBAAgB;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC;IAC9C,qHAAqH;IACrH,QAAQ,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,CAAC;IAClE,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC;IACrD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,kDAAkD;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iCAAiC,IAAI,8BAA8B,CAkHlF"}