@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/core/security/route-organization-access.frontend.utils.d.ts

@@ -31,7 +31,11 @@ export declare enum RouteOrganizationAccess {
      * context from the previous account). The route renders as it would without this check.
      */
     UNDECIDABLE = "UNDECIDABLE",
-    /** The loaded user context carries an ACTIVE membership in the addressed organization. No request is made. */
+    /**
+     * The loaded user context carries an ACTIVE membership in the addressed organization. No request is made. Given as
+     * soon as the token subject's context has loaded, before the restore concludes (#2247), because the session
+     * follows this organization and must do so before the restore commits the stored one.
+     */
     ACTIVE_MEMBERSHIP = "ACTIVE_MEMBERSHIP",
     /** No active membership is known, and the server is being asked. The page must not load meanwhile. */
     VERIFYING = "VERIFYING",
@@ -56,9 +60,9 @@ export declare enum RouteOrganizationAccess {
 export interface RouteOrganizationMembershipFacts {
     organizationId?: string | null;
     status?: OrganizationMemberStatus | string | null;
-    /** Present on a service-provider membership (#1597). */
-    serviceProviderRelationshipId?: string | null;
-    providerOrganizationId?: string | null;
+    /** Present on a representative membership (#1597). */
+    organizationRelationshipId?: string | null;
+    representingOrganizationId?: string | null;
 }
 /**
  * True when the memberships carry an ACTIVE membership in `organizationId`.
@@ -67,7 +71,7 @@ export interface RouteOrganizationMembershipFacts {
  * treating it as a pass would let exactly the refused reads through. Such a membership falls through to
  * the server probe instead, which answers correctly either way.
  *
- * A SERVICE-PROVIDER membership never counts (#1597, review 6): its status is a mirror of the relationship, which
+ * A REPRESENTATIVE membership never counts (#1597, review 6): its status is a mirror of the relationship, which
  * the server re-checks on every request — a suspended relationship, or one past its term, still shows an ACTIVE row
  * here. It falls through to the server probe like any other membership the client cannot vouch for.
  */
@@ -79,4 +83,170 @@ export declare function hasActiveMembershipInOrganization(memberships: ReadonlyA
  * operation: if they disagreed, the probe could admit an organization the session cannot load.
  */
 export declare function findDefaultApiReadOperation(resourceConfiguration: AnyFrontendResourceConfiguration | undefined): FrontendResourceConfiguration_Operation | undefined;
+/**
+ * Whether the session's current organization follows the organization the route names (#2247).
+ *
+ * ## The decision: the route is the authority, and the session follows it
+ *
+ * Workspace products that name the tenant in the URL (GitHub organizations, Linear workspaces, Vercel teams,
+ * Slack workspaces) all answer the same way: opening a link into another workspace switches to it. The URL is
+ * the page the person asked for, and the session's "current" workspace is the one they are looking at. Here
+ * the two used to disagree. The session kept whatever organization it had settled on (the stored one, else the
+ * first membership), and only the organization switcher moved it. On `/organizations/A/…` with B current, every
+ * request that did not name its own `organizationId` went to B, and every reader of the current organization
+ * (feature-policy roles, resolved features, billing, the settings hub, guidance, the single-operation enabled
+ * check) judged A's page with B's answers. #2198 and #1461 were two such pages, each fixed at its own site.
+ *
+ * So the current organization FOLLOWS the route: when the route names an organization the session can be IN,
+ * `AppLayout_AuthenticatedRoute` commits it as current (and the stored value follows, so a new session started
+ * on a page that names no organization begins in the one the person was last in, as those products do). Every
+ * reader keeps reading the one source, `AppScope.currentOrganizationId`, and agrees with the page.
+ *
+ * "Can be IN" means the person holds standing in the organization: an ACTIVE membership this frontend vouches for
+ * (`ACTIVE_MEMBERSHIP`), or an organization the server ADMITTED that is the session's own — loaded as one of its
+ * organizations, or one the backend's access profile confers entries in. The loaded case is a representative (#1597)
+ * in a granting organization: this frontend never vouches for that membership (its status mirrors a relationship only
+ * the server re-checks), so the route asks the server, while the switcher offers the organization all the same. The
+ * conferred case is a membership past the user context's cap (#2275): the context embeds only the newest 20
+ * memberships, so the 21st is neither vouched for nor loaded, while the access profile, which the backend builds from
+ * every membership, carries its roles. The session loads such an organization when it follows it
+ * (`UserOrgsContext.followRouteOrganization`), so the switcher shows the organization the person is in.
+ *
+ * ## What it does NOT follow, on purpose
+ *
+ * - **An organization the session cannot be in** (`VERIFYING`, `REFUSED`, `INCONCLUSIVE`, `UNDECIDABLE`, and an
+ *   `ADMITTED` organization the session neither loaded nor holds access-profile entries in). A link to an organization the account is not a member
+ *   of never switches the session: `REFUSED` is already answered by leaving the route with a notice. A platform
+ *   operator's `ADMITTED` crossing has no membership here, so no roles, and its stored value would not survive a
+ *   reload. Such pages address their organization through their own identifiers, and the ambient readers stay on
+ *   the session's organization. Without an access profile (its read failed) a membership past the context's cap
+ *   is in this position too: nothing the client holds says the person has standing there, so it fails closed.
+ * - **An arrival already settled.** Once the session has been in the route's organization (already, or by
+ *   following it), a move away is the person's own: the switcher resets navigation and takes them home, and the
+ *   route must not pull the session back in the meantime. A route is followed at most once per arrival; leaving
+ *   it, or arriving at another organization's route, makes the next arrival followable again.
+ * - **A route with no organization** (`NOT_ADDRESSED`, application-scope pages): the session's own choice stands.
+ *
+ * ## Rejected alternatives
+ *
+ * - **Fix each reader at its own site** (what #2198 and #1461 did): reading the addressed organization locally is
+ *   still correct where a surface knows it, but it leaves every reader that does not — and every request built
+ *   without an explicit `organizationId` — on the wrong tenant. Ten readers fixed one by one is ten chances to
+ *   miss the eleventh.
+ * - **Derive the current organization from the URL inside AppScope** instead of committing it: AppScope sits above
+ *   the routes (the data router has one `/*` route, so no params are visible there) and above `UserOrgsContext`
+ *   (so no membership is visible there either). Parsing the pathname there would duplicate the route table and
+ *   could not apply the membership check that keeps a foreign link from switching the session.
+ * - **Leave the session alone and make the page refuse**: that treats a correct deep link as an error.
+ *
+ * ## In-session navigation: the zone entries are held too (#2276)
+ *
+ * The outlet gate covers every path that renders a route from its URL: a deep link, a reload, sign-in's redirect,
+ * and back/forward to a URL no zone holds (the back/forward reconciler clears the zones and the outlet remounts).
+ * In session, though, page content is rendered from the navigation zone stacks, and the controller emits a zone
+ * entry BEFORE it writes the URL (`navigation-commit.ts`); the router's location then commits in a transition. So a
+ * link into another organization's page mounted that page while every route-derived value still named the previous
+ * organization: its effects ran before the layout's follow effect, and its requests without their own
+ * `organizationId`, and every reader of the current organization, answered for the organization the page does not
+ * show. That is why the hold is ALSO applied per zone entry, by {@link decideZoneEntryOrganizationHold}, from the
+ * organization the entry itself addresses, which is known the moment it is pushed.
+ *
+ * And a followed change does not reset the navigation (that would undo the link), so entries of the previous
+ * organization left in other zones, an overlay or a backstack would be judged by the new organization's roles.
+ * `useRouteOrganizationFollow` therefore emits `NAVIGATION_ORGANIZATION_FOLLOWED` in the same effect that commits the
+ * organization, and `NavigationProvider` drops every entry addressing another organization in that same render. Not
+ * on `PRIMARY_SCOPE_CHANGED`: AppScope announces that from an effect one commit later, and an overlay (which no hold
+ * covers, see below) would render once under the new organization in between.
+ *
+ * Rejected: making the controller follow the organization at its commit. It would make the controller a second
+ * authority beside the route (and decide before the access verdict), and a raw router navigation or a
+ * back/forward POP would still need the route path. Holding the entry until the route has decided keeps one
+ * decision, this one.
+ */
+export declare enum RouteOrganizationFollow {
+    /** The route names no organization. The session's own current organization stands. */
+    NOT_ADDRESSED = "NOT_ADDRESSED",
+    /** The session's current organization already is the route's. Nothing to do. */
+    IN_STEP = "IN_STEP",
+    /**
+     * The route names an organization the session can be in, and the session is elsewhere. It is
+     * being made current; the route's content must wait, so its reads do not start in the previous organization.
+     */
+    FOLLOWING = "FOLLOWING",
+    /** The route names an organization the session does not follow (see the decision above). The route renders as it would. */
+    NOT_FOLLOWED = "NOT_FOLLOWED"
+}
+export interface RouteOrganizationFollowFacts {
+    /** The organization the route names, if any. */
+    routeOrganizationId: string | null | undefined;
+    /** The route's access verdict, from `useRouteOrganizationAccess`. */
+    access: RouteOrganizationAccess;
+    /**
+     * Whether the session has loaded the route's organization as one of its own (`UserOrgsContext.organizations`,
+     * what the switcher offers). Decides only the `ADMITTED` case; see the decision above.
+     */
+    routeOrganizationLoaded: boolean;
+    /**
+     * Whether the backend's access profile confers entries in the route's organization (`accessProfileConfersOrganization`):
+     * a membership the user context's capped projection does not carry (#2275). Decides only the `ADMITTED` case.
+     */
+    routeOrganizationConferred: boolean;
+    /** The session's current organization (`AppScope.currentOrganizationId`). */
+    currentOrganizationId: string | null | undefined;
+    /**
+     * True once this arrival at the route is SETTLED: the session was in the route's organization, already or by
+     * following it. A settled arrival is never followed again, so a later move away is the person's own.
+     */
+    arrivalSettled: boolean;
+}
+/** The one decision for {@link RouteOrganizationFollow}; pure, so it is pinned without a router. */
+export declare function decideRouteOrganizationFollow(facts: RouteOrganizationFollowFacts): RouteOrganizationFollow;
+/**
+ * What the authenticated layout has decided about the route's organization, published to the navigation zones so
+ * they can hold their entries with the same decision the outlet is held by (#2276). `null` where no authenticated
+ * layout is mounted: nothing is held there.
+ */
+export interface RouteOrganizationDecision {
+    /** The organization the COMMITTED route names (`useRouteOrganizationId`), or `null` when it names none. */
+    routeOrganizationId: string | null;
+    /**
+     * True while the layout withholds the route's content: the server is being asked (`VERIFYING`), the session is
+     * being moved into the route's organization (`FOLLOWING`), or the organization was refused (`REFUSED`).
+     */
+    routeContentHeld: boolean;
+}
+export interface ZoneEntryOrganizationHoldFacts {
+    /** The organization the entry's content addresses (`navigationContentOrganizationId`), or `null`. */
+    entryOrganizationId: string | null;
+    /**
+     * Whether the entry is what the browser URL names, or is about to name: a structural-zone entry carrying a
+     * `urlPath` that is not a hosted pane (whose address rides on the host's URL). Only such an entry makes the route
+     * change, so only such an entry can be waiting for the route's decision.
+     */
+    entryOwnsBrowserUrl: boolean;
+    /** The session's current organization (`AppScope.currentOrganizationId`). */
+    currentOrganizationId: string | null | undefined;
+    /** The layout's decision, or `null` outside an authenticated layout. */
+    routeDecision: RouteOrganizationDecision | null;
+}
+/**
+ * Whether a zone entry must be held (render a placeholder, mount nothing) until the session is in the organization it
+ * addresses (#2276). The entry's content mounts only once nothing it reads can answer for another organization.
+ *
+ * - **The entry addresses the route's organization**: it is held exactly when the layout holds the route's content.
+ *   That is the same decision as the outlet's, so a route that is being followed or verified holds its page however
+ *   the page was rendered, and a route the session deliberately does not follow (a platform operator's crossing, an
+ *   arrival already settled, an inconclusive probe) renders its page as the outlet would.
+ * - **The entry addresses an organization the route does not name, and the session is not in it either**: it is
+ *   held. The entry LEADS the route: the controller pushed it and wrote the URL, but the router's location has not
+ *   committed yet, so the route still names the previous organization. Rendering it would read the session's
+ *   organization for a page of another one. (An entry LEFT BEHIND by a follow fits the same case, and is held too;
+ *   the follow drops such entries in its own commit, so this is a guard rather than the mechanism.)
+ * - **Anything else renders**: an entry addressing no organization, or the session's own; an entry that does not own
+ *   the URL (an overlay, a hosted pane), which the route never follows and must therefore never wait for; and every
+ *   entry outside an authenticated layout.
+ *
+ * Pure, so it is pinned without a router.
+ */
+export declare function decideZoneEntryOrganizationHold(facts: ZoneEntryOrganizationHoldFacts): boolean;
 //# sourceMappingURL=route-organization-access.frontend.utils.d.ts.map

package/dist/esm/core/security/route-organization-access.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-organization-access.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/route-organization-access.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,gCAAgC,EAChC,uCAAuC,EACxC,MAAM,+DAA+D,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,uBAAuB;IACjC,qFAAqF;IACrF,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B,8GAA8G;IAC9G,iBAAiB,sBAAsB;IACvC,sGAAsG;IACtG,SAAS,cAAc;IACvB,uIAAuI;IACvI,QAAQ,aAAa;IACrB;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AAED,+HAA+H;AAC/H,MAAM,WAAW,gCAAgC;IAC/C,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,wBAAwB,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD,wDAAwD;IACxD,6BAA6B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,aAAa,CAAC,gCAAgC,CAAC,GAAG,IAAI,GAAG,SAAS,EAC/E,cAAc,EAAE,MAAM,GACrB,OAAO,CAMT;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,qBAAqB,EAAE,gCAAgC,GAAG,SAAS,GAClE,uCAAuC,GAAG,SAAS,CAWrD"}
+{"version":3,"file":"route-organization-access.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/route-organization-access.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,gCAAgC,EAChC,uCAAuC,EACxC,MAAM,+DAA+D,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,uBAAuB;IACjC,qFAAqF;IACrF,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,iBAAiB,sBAAsB;IACvC,sGAAsG;IACtG,SAAS,cAAc;IACvB,uIAAuI;IACvI,QAAQ,aAAa;IACrB;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AAED,+HAA+H;AAC/H,MAAM,WAAW,gCAAgC;IAC/C,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,wBAAwB,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD,sDAAsD;IACtD,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,aAAa,CAAC,gCAAgC,CAAC,GAAG,IAAI,GAAG,SAAS,EAC/E,cAAc,EAAE,MAAM,GACrB,OAAO,CAMT;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,qBAAqB,EAAE,gCAAgC,GAAG,SAAS,GAClE,uCAAuC,GAAG,SAAS,CAUrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,oBAAY,uBAAuB;IACjC,sFAAsF;IACtF,aAAa,kBAAkB;IAC/B,gFAAgF;IAChF,OAAO,YAAY;IACnB;;;OAGG;IACH,SAAS,cAAc;IACvB,2HAA2H;IAC3H,YAAY,iBAAiB;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,gDAAgD;IAChD,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,qEAAqE;IACrE,MAAM,EAAE,uBAAuB,CAAC;IAChC;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,0BAA0B,EAAE,OAAO,CAAC;IACpC,6EAA6E;IAC7E,qBAAqB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,oGAAoG;AACpG,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,4BAA4B,GAAG,uBAAuB,CAa1G;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,2GAA2G;IAC3G,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,8BAA8B;IAC7C,qGAAqG;IACrG,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,6EAA6E;IAC7E,qBAAqB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD,wEAAwE;IACxE,aAAa,EAAE,yBAAyB,GAAG,IAAI,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAS9F"}

package/dist/esm/core/security/route-organization-access.frontend.utils.js

@@ -1,4 +1,4 @@
-import { CoreResourceOperation, OrganizationMemberStatus, isServiceProviderMembership, ResourceOperationVariantType, } from '@wildo-ai/saas-models';
+import { CoreResourceOperation, OrganizationMemberStatus, isRelationshipMembership, ResourceOperationVariantType, } from '@wildo-ai/saas-models';
 /**
  * Whether the signed-in account may open the organization a route addresses (`/organizations/:id/…`).
  *
@@ -31,7 +31,11 @@ export var RouteOrganizationAccess;
      * context from the previous account). The route renders as it would without this check.
      */
     RouteOrganizationAccess["UNDECIDABLE"] = "UNDECIDABLE";
-    /** The loaded user context carries an ACTIVE membership in the addressed organization. No request is made. */
+    /**
+     * The loaded user context carries an ACTIVE membership in the addressed organization. No request is made. Given as
+     * soon as the token subject's context has loaded, before the restore concludes (#2247), because the session
+     * follows this organization and must do so before the restore commits the stored one.
+     */
     RouteOrganizationAccess["ACTIVE_MEMBERSHIP"] = "ACTIVE_MEMBERSHIP";
     /** No active membership is known, and the server is being asked. The page must not load meanwhile. */
     RouteOrganizationAccess["VERIFYING"] = "VERIFYING";
@@ -59,14 +63,14 @@ export var RouteOrganizationAccess;
  * treating it as a pass would let exactly the refused reads through. Such a membership falls through to
  * the server probe instead, which answers correctly either way.
  *
- * A SERVICE-PROVIDER membership never counts (#1597, review 6): its status is a mirror of the relationship, which
+ * A REPRESENTATIVE membership never counts (#1597, review 6): its status is a mirror of the relationship, which
  * the server re-checks on every request — a suspended relationship, or one past its term, still shows an ACTIVE row
  * here. It falls through to the server probe like any other membership the client cannot vouch for.
  */
 export function hasActiveMembershipInOrganization(memberships, organizationId) {
     return (memberships ?? []).some((membership) => membership.organizationId === organizationId
         && membership.status === OrganizationMemberStatus.ACTIVE
-        && !isServiceProviderMembership(membership));
+        && !isRelationshipMembership(membership));
 }
 /**
  * The default, non-bulk API READ of a resource — the operation that fetches one row by its identifier.
@@ -78,7 +82,144 @@ export function findDefaultApiReadOperation(resourceConfiguration) {
     return resourceConfiguration?.operations?.find((operation) => operation.operationIdentifier === CoreResourceOperation.READ
         && operation.isOperationDefault === true
         && operation.isBulkOperation !== true
-        && (operation.variantType === ResourceOperationVariantType.API_CALL
-            || operation.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK));
+        && (operation.variantType === ResourceOperationVariantType.API_CALL));
+}
+/**
+ * Whether the session's current organization follows the organization the route names (#2247).
+ *
+ * ## The decision: the route is the authority, and the session follows it
+ *
+ * Workspace products that name the tenant in the URL (GitHub organizations, Linear workspaces, Vercel teams,
+ * Slack workspaces) all answer the same way: opening a link into another workspace switches to it. The URL is
+ * the page the person asked for, and the session's "current" workspace is the one they are looking at. Here
+ * the two used to disagree. The session kept whatever organization it had settled on (the stored one, else the
+ * first membership), and only the organization switcher moved it. On `/organizations/A/…` with B current, every
+ * request that did not name its own `organizationId` went to B, and every reader of the current organization
+ * (feature-policy roles, resolved features, billing, the settings hub, guidance, the single-operation enabled
+ * check) judged A's page with B's answers. #2198 and #1461 were two such pages, each fixed at its own site.
+ *
+ * So the current organization FOLLOWS the route: when the route names an organization the session can be IN,
+ * `AppLayout_AuthenticatedRoute` commits it as current (and the stored value follows, so a new session started
+ * on a page that names no organization begins in the one the person was last in, as those products do). Every
+ * reader keeps reading the one source, `AppScope.currentOrganizationId`, and agrees with the page.
+ *
+ * "Can be IN" means the person holds standing in the organization: an ACTIVE membership this frontend vouches for
+ * (`ACTIVE_MEMBERSHIP`), or an organization the server ADMITTED that is the session's own — loaded as one of its
+ * organizations, or one the backend's access profile confers entries in. The loaded case is a representative (#1597)
+ * in a granting organization: this frontend never vouches for that membership (its status mirrors a relationship only
+ * the server re-checks), so the route asks the server, while the switcher offers the organization all the same. The
+ * conferred case is a membership past the user context's cap (#2275): the context embeds only the newest 20
+ * memberships, so the 21st is neither vouched for nor loaded, while the access profile, which the backend builds from
+ * every membership, carries its roles. The session loads such an organization when it follows it
+ * (`UserOrgsContext.followRouteOrganization`), so the switcher shows the organization the person is in.
+ *
+ * ## What it does NOT follow, on purpose
+ *
+ * - **An organization the session cannot be in** (`VERIFYING`, `REFUSED`, `INCONCLUSIVE`, `UNDECIDABLE`, and an
+ *   `ADMITTED` organization the session neither loaded nor holds access-profile entries in). A link to an organization the account is not a member
+ *   of never switches the session: `REFUSED` is already answered by leaving the route with a notice. A platform
+ *   operator's `ADMITTED` crossing has no membership here, so no roles, and its stored value would not survive a
+ *   reload. Such pages address their organization through their own identifiers, and the ambient readers stay on
+ *   the session's organization. Without an access profile (its read failed) a membership past the context's cap
+ *   is in this position too: nothing the client holds says the person has standing there, so it fails closed.
+ * - **An arrival already settled.** Once the session has been in the route's organization (already, or by
+ *   following it), a move away is the person's own: the switcher resets navigation and takes them home, and the
+ *   route must not pull the session back in the meantime. A route is followed at most once per arrival; leaving
+ *   it, or arriving at another organization's route, makes the next arrival followable again.
+ * - **A route with no organization** (`NOT_ADDRESSED`, application-scope pages): the session's own choice stands.
+ *
+ * ## Rejected alternatives
+ *
+ * - **Fix each reader at its own site** (what #2198 and #1461 did): reading the addressed organization locally is
+ *   still correct where a surface knows it, but it leaves every reader that does not — and every request built
+ *   without an explicit `organizationId` — on the wrong tenant. Ten readers fixed one by one is ten chances to
+ *   miss the eleventh.
+ * - **Derive the current organization from the URL inside AppScope** instead of committing it: AppScope sits above
+ *   the routes (the data router has one `/*` route, so no params are visible there) and above `UserOrgsContext`
+ *   (so no membership is visible there either). Parsing the pathname there would duplicate the route table and
+ *   could not apply the membership check that keeps a foreign link from switching the session.
+ * - **Leave the session alone and make the page refuse**: that treats a correct deep link as an error.
+ *
+ * ## In-session navigation: the zone entries are held too (#2276)
+ *
+ * The outlet gate covers every path that renders a route from its URL: a deep link, a reload, sign-in's redirect,
+ * and back/forward to a URL no zone holds (the back/forward reconciler clears the zones and the outlet remounts).
+ * In session, though, page content is rendered from the navigation zone stacks, and the controller emits a zone
+ * entry BEFORE it writes the URL (`navigation-commit.ts`); the router's location then commits in a transition. So a
+ * link into another organization's page mounted that page while every route-derived value still named the previous
+ * organization: its effects ran before the layout's follow effect, and its requests without their own
+ * `organizationId`, and every reader of the current organization, answered for the organization the page does not
+ * show. That is why the hold is ALSO applied per zone entry, by {@link decideZoneEntryOrganizationHold}, from the
+ * organization the entry itself addresses, which is known the moment it is pushed.
+ *
+ * And a followed change does not reset the navigation (that would undo the link), so entries of the previous
+ * organization left in other zones, an overlay or a backstack would be judged by the new organization's roles.
+ * `useRouteOrganizationFollow` therefore emits `NAVIGATION_ORGANIZATION_FOLLOWED` in the same effect that commits the
+ * organization, and `NavigationProvider` drops every entry addressing another organization in that same render. Not
+ * on `PRIMARY_SCOPE_CHANGED`: AppScope announces that from an effect one commit later, and an overlay (which no hold
+ * covers, see below) would render once under the new organization in between.
+ *
+ * Rejected: making the controller follow the organization at its commit. It would make the controller a second
+ * authority beside the route (and decide before the access verdict), and a raw router navigation or a
+ * back/forward POP would still need the route path. Holding the entry until the route has decided keeps one
+ * decision, this one.
+ */
+export var RouteOrganizationFollow;
+(function (RouteOrganizationFollow) {
+    /** The route names no organization. The session's own current organization stands. */
+    RouteOrganizationFollow["NOT_ADDRESSED"] = "NOT_ADDRESSED";
+    /** The session's current organization already is the route's. Nothing to do. */
+    RouteOrganizationFollow["IN_STEP"] = "IN_STEP";
+    /**
+     * The route names an organization the session can be in, and the session is elsewhere. It is
+     * being made current; the route's content must wait, so its reads do not start in the previous organization.
+     */
+    RouteOrganizationFollow["FOLLOWING"] = "FOLLOWING";
+    /** The route names an organization the session does not follow (see the decision above). The route renders as it would. */
+    RouteOrganizationFollow["NOT_FOLLOWED"] = "NOT_FOLLOWED";
+})(RouteOrganizationFollow || (RouteOrganizationFollow = {}));
+/** The one decision for {@link RouteOrganizationFollow}; pure, so it is pinned without a router. */
+export function decideRouteOrganizationFollow(facts) {
+    if (!facts.routeOrganizationId) {
+        return RouteOrganizationFollow.NOT_ADDRESSED;
+    }
+    if (facts.currentOrganizationId === facts.routeOrganizationId) {
+        return RouteOrganizationFollow.IN_STEP;
+    }
+    const sessionCanBeIn = facts.access === RouteOrganizationAccess.ACTIVE_MEMBERSHIP
+        || (facts.access === RouteOrganizationAccess.ADMITTED && (facts.routeOrganizationLoaded || facts.routeOrganizationConferred));
+    if (!sessionCanBeIn || facts.arrivalSettled) {
+        return RouteOrganizationFollow.NOT_FOLLOWED;
+    }
+    return RouteOrganizationFollow.FOLLOWING;
+}
+/**
+ * Whether a zone entry must be held (render a placeholder, mount nothing) until the session is in the organization it
+ * addresses (#2276). The entry's content mounts only once nothing it reads can answer for another organization.
+ *
+ * - **The entry addresses the route's organization**: it is held exactly when the layout holds the route's content.
+ *   That is the same decision as the outlet's, so a route that is being followed or verified holds its page however
+ *   the page was rendered, and a route the session deliberately does not follow (a platform operator's crossing, an
+ *   arrival already settled, an inconclusive probe) renders its page as the outlet would.
+ * - **The entry addresses an organization the route does not name, and the session is not in it either**: it is
+ *   held. The entry LEADS the route: the controller pushed it and wrote the URL, but the router's location has not
+ *   committed yet, so the route still names the previous organization. Rendering it would read the session's
+ *   organization for a page of another one. (An entry LEFT BEHIND by a follow fits the same case, and is held too;
+ *   the follow drops such entries in its own commit, so this is a guard rather than the mechanism.)
+ * - **Anything else renders**: an entry addressing no organization, or the session's own; an entry that does not own
+ *   the URL (an overlay, a hosted pane), which the route never follows and must therefore never wait for; and every
+ *   entry outside an authenticated layout.
+ *
+ * Pure, so it is pinned without a router.
+ */
+export function decideZoneEntryOrganizationHold(facts) {
+    const { entryOrganizationId, routeDecision } = facts;
+    if (!entryOrganizationId || !facts.entryOwnsBrowserUrl || !routeDecision) {
+        return false;
+    }
+    if (entryOrganizationId === routeDecision.routeOrganizationId) {
+        return routeDecision.routeContentHeld;
+    }
+    return entryOrganizationId !== facts.currentOrganizationId;
 }
 //# sourceMappingURL=route-organization-access.frontend.utils.js.map

package/dist/esm/core/security/route-organization-access.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-organization-access.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/route-organization-access.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAM/B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,uBA6BX;AA7BD,WAAY,uBAAuB;IACjC,qFAAqF;IACrF,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;IAC3B,8GAA8G;IAC9G,kEAAuC,CAAA;IACvC,sGAAsG;IACtG,kDAAuB,CAAA;IACvB,uIAAuI;IACvI,gDAAqB,CAAA;IACrB;;;;;;OAMG;IACH,8CAAmB,CAAA;IACnB;;;;OAIG;IACH,wDAA6B,CAAA;AAC/B,CAAC,EA7BW,uBAAuB,KAAvB,uBAAuB,QA6BlC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAC/C,WAA+E,EAC/E,cAAsB;IAEtB,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,KAAK,cAAc;WACvD,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM;WACrD,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,qBAAmE;IAEnE,OAAO,qBAAqB,EAAE,UAAU,EAAE,IAAI,CAC5C,CAAC,SAAkD,EAAE,EAAE,CACrD,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;WACzD,SAAS,CAAC,kBAAkB,KAAK,IAAI;WACrC,SAAS,CAAC,eAAe,KAAK,IAAI;WAClC,CACD,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;eAC5D,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACjF,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CoreResourceOperation,\n  OrganizationMemberStatus,\n  isServiceProviderMembership,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport type {\n  AnyFrontendResourceConfiguration,\n  FrontendResourceConfiguration_Operation,\n} from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\n\n/**\n * Whether the signed-in account may open the organization a route addresses (`/organizations/:id/…`).\n *\n * ## Why the route needs its own answer\n *\n * The AppScope organization is membership-checked: `UserOrgsContext` only commits an organization the\n * account belongs to. A route's organization segment is not. `ScopeUtilsService.buildResourceOperationContextIdentifiers`\n * places the URL's identifiers LAST, so they override the checked scope, and the page issues its reads\n * against whatever organization the link names. The link is not always the account's own: a session\n * that expires on `/organizations/A/tasks` saves that URL as the post-login `redirect`, and a DIFFERENT\n * account signing in is sent straight to it. Every read then answered 403, and the person was left on\n * a page that could never load.\n *\n * ## Why the server decides, and the membership list only short-circuits\n *\n * The user context embeds `organizationMembers`, but that array is a context projection capped at\n * `DEFAULT_RELATIONSHIP_CONTEXT_POLICY.limit` (20, newest first) and \"cannot say it was truncated\".\n * A refusal computed from it would eject a member of a 21st organization, and it would also eject a\n * platform operator on a crossing the server admits. So an ACTIVE membership found in the list is\n * trusted (a positive answer cannot be invented by truncation), and anything else is asked of the\n * server with one silent READ of the organization. Only a refusal from that READ redirects.\n */\nexport enum RouteOrganizationAccess {\n  /** The current route carries no organization segment. There is nothing to decide. */\n  NOT_ADDRESSED = 'NOT_ADDRESSED',\n  /**\n   * The route addresses an organization, but the session cannot be judged yet or at all: restore is\n   * unresolved, no user context was loaded, or the loaded user is not the token's subject (a stale\n   * context from the previous account). The route renders as it would without this check.\n   */\n  UNDECIDABLE = 'UNDECIDABLE',\n  /** The loaded user context carries an ACTIVE membership in the addressed organization. No request is made. */\n  ACTIVE_MEMBERSHIP = 'ACTIVE_MEMBERSHIP',\n  /** No active membership is known, and the server is being asked. The page must not load meanwhile. */\n  VERIFYING = 'VERIFYING',\n  /** The server answered the organization READ. The account may open it (a membership past the context cap, or an admitted crossing). */\n  ADMITTED = 'ADMITTED',\n  /**\n   * The server refused the organization READ (403, or the deliberate 404 a non-member receives so the\n   * answer is not an existence oracle). The route must not render.\n   *\n   * A link to an organization that does not exist lands here too, and on purpose: the server answers it\n   * with the same 404, so the frontend cannot tell the two apart, and must not try to.\n   */\n  REFUSED = 'REFUSED',\n  /**\n   * The READ failed for a reason that says nothing about access (network, 5xx, no READ operation mounted).\n   * The route renders, and its own requests report whatever is wrong: a transient failure must never\n   * eject someone from a page they may open.\n   */\n  INCONCLUSIVE = 'INCONCLUSIVE',\n}\n\n/** The membership fields this decision reads, structurally, so the check does not depend on the context's population shape. */\nexport interface RouteOrganizationMembershipFacts {\n  organizationId?: string | null;\n  status?: OrganizationMemberStatus | string | null;\n  /** Present on a service-provider membership (#1597). */\n  serviceProviderRelationshipId?: string | null;\n  providerOrganizationId?: string | null;\n}\n\n/**\n * True when the memberships carry an ACTIVE membership in `organizationId`.\n *\n * Only ACTIVE counts: an INVITED, INACTIVE or SUSPENDED membership confers no access on the server, so\n * treating it as a pass would let exactly the refused reads through. Such a membership falls through to\n * the server probe instead, which answers correctly either way.\n *\n * A SERVICE-PROVIDER membership never counts (#1597, review 6): its status is a mirror of the relationship, which\n * the server re-checks on every request — a suspended relationship, or one past its term, still shows an ACTIVE row\n * here. It falls through to the server probe like any other membership the client cannot vouch for.\n */\nexport function hasActiveMembershipInOrganization(\n  memberships: ReadonlyArray<RouteOrganizationMembershipFacts> | null | undefined,\n  organizationId: string,\n): boolean {\n  return (memberships ?? []).some(\n    (membership) => membership.organizationId === organizationId\n      && membership.status === OrganizationMemberStatus.ACTIVE\n      && !isServiceProviderMembership(membership),\n  );\n}\n\n/**\n * The default, non-bulk API READ of a resource — the operation that fetches one row by its identifier.\n *\n * Shared by the session's organization loading and the route access probe, which must address the same\n * operation: if they disagreed, the probe could admit an organization the session cannot load.\n */\nexport function findDefaultApiReadOperation(\n  resourceConfiguration: AnyFrontendResourceConfiguration | undefined,\n): FrontendResourceConfiguration_Operation | undefined {\n  return resourceConfiguration?.operations?.find(\n    (operation: FrontendResourceConfiguration_Operation) =>\n      operation.operationIdentifier === CoreResourceOperation.READ\n      && operation.isOperationDefault === true\n      && operation.isBulkOperation !== true\n      && (\n        operation.variantType === ResourceOperationVariantType.API_CALL\n        || operation.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n      ),\n  );\n}\n"]}
+{"version":3,"file":"route-organization-access.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/route-organization-access.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAM/B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,uBAiCX;AAjCD,WAAY,uBAAuB;IACjC,qFAAqF;IACrF,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;IAC3B;;;;OAIG;IACH,kEAAuC,CAAA;IACvC,sGAAsG;IACtG,kDAAuB,CAAA;IACvB,uIAAuI;IACvI,gDAAqB,CAAA;IACrB;;;;;;OAMG;IACH,8CAAmB,CAAA;IACnB;;;;OAIG;IACH,wDAA6B,CAAA;AAC/B,CAAC,EAjCW,uBAAuB,KAAvB,uBAAuB,QAiClC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAC/C,WAA+E,EAC/E,cAAsB;IAEtB,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,KAAK,cAAc;WACvD,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM;WACrD,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,qBAAmE;IAEnE,OAAO,qBAAqB,EAAE,UAAU,EAAE,IAAI,CAC5C,CAAC,SAAkD,EAAE,EAAE,CACrD,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;WACzD,SAAS,CAAC,kBAAkB,KAAK,IAAI;WACrC,SAAS,CAAC,eAAe,KAAK,IAAI;WAClC,CACD,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ,CAChE,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,CAAN,IAAY,uBAYX;AAZD,WAAY,uBAAuB;IACjC,sFAAsF;IACtF,0DAA+B,CAAA;IAC/B,gFAAgF;IAChF,8CAAmB,CAAA;IACnB;;;OAGG;IACH,kDAAuB,CAAA;IACvB,2HAA2H;IAC3H,wDAA6B,CAAA;AAC/B,CAAC,EAZW,uBAAuB,KAAvB,uBAAuB,QAYlC;AA0BD,oGAAoG;AACpG,MAAM,UAAU,6BAA6B,CAAC,KAAmC;IAC/E,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC/B,OAAO,uBAAuB,CAAC,aAAa,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,qBAAqB,KAAK,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9D,OAAO,uBAAuB,CAAC,OAAO,CAAC;IACzC,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,KAAK,uBAAuB,CAAC,iBAAiB;WAC5E,CAAC,KAAK,CAAC,MAAM,KAAK,uBAAuB,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,uBAAuB,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAChI,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC5C,OAAO,uBAAuB,CAAC,YAAY,CAAC;IAC9C,CAAC;IACD,OAAO,uBAAuB,CAAC,SAAS,CAAC;AAC3C,CAAC;AAgCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAqC;IACnF,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IACrD,IAAI,CAAC,mBAAmB,IAAI,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,aAAa,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,mBAAmB,KAAK,aAAa,CAAC,mBAAmB,EAAE,CAAC;QAC9D,OAAO,aAAa,CAAC,gBAAgB,CAAC;IACxC,CAAC;IACD,OAAO,mBAAmB,KAAK,KAAK,CAAC,qBAAqB,CAAC;AAC7D,CAAC","sourcesContent":["import {\n  CoreResourceOperation,\n  OrganizationMemberStatus,\n  isRelationshipMembership,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport type {\n  AnyFrontendResourceConfiguration,\n  FrontendResourceConfiguration_Operation,\n} from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\n\n/**\n * Whether the signed-in account may open the organization a route addresses (`/organizations/:id/…`).\n *\n * ## Why the route needs its own answer\n *\n * The AppScope organization is membership-checked: `UserOrgsContext` only commits an organization the\n * account belongs to. A route's organization segment is not. `ScopeUtilsService.buildResourceOperationContextIdentifiers`\n * places the URL's identifiers LAST, so they override the checked scope, and the page issues its reads\n * against whatever organization the link names. The link is not always the account's own: a session\n * that expires on `/organizations/A/tasks` saves that URL as the post-login `redirect`, and a DIFFERENT\n * account signing in is sent straight to it. Every read then answered 403, and the person was left on\n * a page that could never load.\n *\n * ## Why the server decides, and the membership list only short-circuits\n *\n * The user context embeds `organizationMembers`, but that array is a context projection capped at\n * `DEFAULT_RELATIONSHIP_CONTEXT_POLICY.limit` (20, newest first) and \"cannot say it was truncated\".\n * A refusal computed from it would eject a member of a 21st organization, and it would also eject a\n * platform operator on a crossing the server admits. So an ACTIVE membership found in the list is\n * trusted (a positive answer cannot be invented by truncation), and anything else is asked of the\n * server with one silent READ of the organization. Only a refusal from that READ redirects.\n */\nexport enum RouteOrganizationAccess {\n  /** The current route carries no organization segment. There is nothing to decide. */\n  NOT_ADDRESSED = 'NOT_ADDRESSED',\n  /**\n   * The route addresses an organization, but the session cannot be judged yet or at all: restore is\n   * unresolved, no user context was loaded, or the loaded user is not the token's subject (a stale\n   * context from the previous account). The route renders as it would without this check.\n   */\n  UNDECIDABLE = 'UNDECIDABLE',\n  /**\n   * The loaded user context carries an ACTIVE membership in the addressed organization. No request is made. Given as\n   * soon as the token subject's context has loaded, before the restore concludes (#2247), because the session\n   * follows this organization and must do so before the restore commits the stored one.\n   */\n  ACTIVE_MEMBERSHIP = 'ACTIVE_MEMBERSHIP',\n  /** No active membership is known, and the server is being asked. The page must not load meanwhile. */\n  VERIFYING = 'VERIFYING',\n  /** The server answered the organization READ. The account may open it (a membership past the context cap, or an admitted crossing). */\n  ADMITTED = 'ADMITTED',\n  /**\n   * The server refused the organization READ (403, or the deliberate 404 a non-member receives so the\n   * answer is not an existence oracle). The route must not render.\n   *\n   * A link to an organization that does not exist lands here too, and on purpose: the server answers it\n   * with the same 404, so the frontend cannot tell the two apart, and must not try to.\n   */\n  REFUSED = 'REFUSED',\n  /**\n   * The READ failed for a reason that says nothing about access (network, 5xx, no READ operation mounted).\n   * The route renders, and its own requests report whatever is wrong: a transient failure must never\n   * eject someone from a page they may open.\n   */\n  INCONCLUSIVE = 'INCONCLUSIVE',\n}\n\n/** The membership fields this decision reads, structurally, so the check does not depend on the context's population shape. */\nexport interface RouteOrganizationMembershipFacts {\n  organizationId?: string | null;\n  status?: OrganizationMemberStatus | string | null;\n  /** Present on a representative membership (#1597). */\n  organizationRelationshipId?: string | null;\n  representingOrganizationId?: string | null;\n}\n\n/**\n * True when the memberships carry an ACTIVE membership in `organizationId`.\n *\n * Only ACTIVE counts: an INVITED, INACTIVE or SUSPENDED membership confers no access on the server, so\n * treating it as a pass would let exactly the refused reads through. Such a membership falls through to\n * the server probe instead, which answers correctly either way.\n *\n * A REPRESENTATIVE membership never counts (#1597, review 6): its status is a mirror of the relationship, which\n * the server re-checks on every request — a suspended relationship, or one past its term, still shows an ACTIVE row\n * here. It falls through to the server probe like any other membership the client cannot vouch for.\n */\nexport function hasActiveMembershipInOrganization(\n  memberships: ReadonlyArray<RouteOrganizationMembershipFacts> | null | undefined,\n  organizationId: string,\n): boolean {\n  return (memberships ?? []).some(\n    (membership) => membership.organizationId === organizationId\n      && membership.status === OrganizationMemberStatus.ACTIVE\n      && !isRelationshipMembership(membership),\n  );\n}\n\n/**\n * The default, non-bulk API READ of a resource — the operation that fetches one row by its identifier.\n *\n * Shared by the session's organization loading and the route access probe, which must address the same\n * operation: if they disagreed, the probe could admit an organization the session cannot load.\n */\nexport function findDefaultApiReadOperation(\n  resourceConfiguration: AnyFrontendResourceConfiguration | undefined,\n): FrontendResourceConfiguration_Operation | undefined {\n  return resourceConfiguration?.operations?.find(\n    (operation: FrontendResourceConfiguration_Operation) =>\n      operation.operationIdentifier === CoreResourceOperation.READ\n      && operation.isOperationDefault === true\n      && operation.isBulkOperation !== true\n      && (\n        operation.variantType === ResourceOperationVariantType.API_CALL\n      ),\n  );\n}\n\n/**\n * Whether the session's current organization follows the organization the route names (#2247).\n *\n * ## The decision: the route is the authority, and the session follows it\n *\n * Workspace products that name the tenant in the URL (GitHub organizations, Linear workspaces, Vercel teams,\n * Slack workspaces) all answer the same way: opening a link into another workspace switches to it. The URL is\n * the page the person asked for, and the session's \"current\" workspace is the one they are looking at. Here\n * the two used to disagree. The session kept whatever organization it had settled on (the stored one, else the\n * first membership), and only the organization switcher moved it. On `/organizations/A/…` with B current, every\n * request that did not name its own `organizationId` went to B, and every reader of the current organization\n * (feature-policy roles, resolved features, billing, the settings hub, guidance, the single-operation enabled\n * check) judged A's page with B's answers. #2198 and #1461 were two such pages, each fixed at its own site.\n *\n * So the current organization FOLLOWS the route: when the route names an organization the session can be IN,\n * `AppLayout_AuthenticatedRoute` commits it as current (and the stored value follows, so a new session started\n * on a page that names no organization begins in the one the person was last in, as those products do). Every\n * reader keeps reading the one source, `AppScope.currentOrganizationId`, and agrees with the page.\n *\n * \"Can be IN\" means the person holds standing in the organization: an ACTIVE membership this frontend vouches for\n * (`ACTIVE_MEMBERSHIP`), or an organization the server ADMITTED that is the session's own — loaded as one of its\n * organizations, or one the backend's access profile confers entries in. The loaded case is a representative (#1597)\n * in a granting organization: this frontend never vouches for that membership (its status mirrors a relationship only\n * the server re-checks), so the route asks the server, while the switcher offers the organization all the same. The\n * conferred case is a membership past the user context's cap (#2275): the context embeds only the newest 20\n * memberships, so the 21st is neither vouched for nor loaded, while the access profile, which the backend builds from\n * every membership, carries its roles. The session loads such an organization when it follows it\n * (`UserOrgsContext.followRouteOrganization`), so the switcher shows the organization the person is in.\n *\n * ## What it does NOT follow, on purpose\n *\n * - **An organization the session cannot be in** (`VERIFYING`, `REFUSED`, `INCONCLUSIVE`, `UNDECIDABLE`, and an\n *   `ADMITTED` organization the session neither loaded nor holds access-profile entries in). A link to an organization the account is not a member\n *   of never switches the session: `REFUSED` is already answered by leaving the route with a notice. A platform\n *   operator's `ADMITTED` crossing has no membership here, so no roles, and its stored value would not survive a\n *   reload. Such pages address their organization through their own identifiers, and the ambient readers stay on\n *   the session's organization. Without an access profile (its read failed) a membership past the context's cap\n *   is in this position too: nothing the client holds says the person has standing there, so it fails closed.\n * - **An arrival already settled.** Once the session has been in the route's organization (already, or by\n *   following it), a move away is the person's own: the switcher resets navigation and takes them home, and the\n *   route must not pull the session back in the meantime. A route is followed at most once per arrival; leaving\n *   it, or arriving at another organization's route, makes the next arrival followable again.\n * - **A route with no organization** (`NOT_ADDRESSED`, application-scope pages): the session's own choice stands.\n *\n * ## Rejected alternatives\n *\n * - **Fix each reader at its own site** (what #2198 and #1461 did): reading the addressed organization locally is\n *   still correct where a surface knows it, but it leaves every reader that does not — and every request built\n *   without an explicit `organizationId` — on the wrong tenant. Ten readers fixed one by one is ten chances to\n *   miss the eleventh.\n * - **Derive the current organization from the URL inside AppScope** instead of committing it: AppScope sits above\n *   the routes (the data router has one `/*` route, so no params are visible there) and above `UserOrgsContext`\n *   (so no membership is visible there either). Parsing the pathname there would duplicate the route table and\n *   could not apply the membership check that keeps a foreign link from switching the session.\n * - **Leave the session alone and make the page refuse**: that treats a correct deep link as an error.\n *\n * ## In-session navigation: the zone entries are held too (#2276)\n *\n * The outlet gate covers every path that renders a route from its URL: a deep link, a reload, sign-in's redirect,\n * and back/forward to a URL no zone holds (the back/forward reconciler clears the zones and the outlet remounts).\n * In session, though, page content is rendered from the navigation zone stacks, and the controller emits a zone\n * entry BEFORE it writes the URL (`navigation-commit.ts`); the router's location then commits in a transition. So a\n * link into another organization's page mounted that page while every route-derived value still named the previous\n * organization: its effects ran before the layout's follow effect, and its requests without their own\n * `organizationId`, and every reader of the current organization, answered for the organization the page does not\n * show. That is why the hold is ALSO applied per zone entry, by {@link decideZoneEntryOrganizationHold}, from the\n * organization the entry itself addresses, which is known the moment it is pushed.\n *\n * And a followed change does not reset the navigation (that would undo the link), so entries of the previous\n * organization left in other zones, an overlay or a backstack would be judged by the new organization's roles.\n * `useRouteOrganizationFollow` therefore emits `NAVIGATION_ORGANIZATION_FOLLOWED` in the same effect that commits the\n * organization, and `NavigationProvider` drops every entry addressing another organization in that same render. Not\n * on `PRIMARY_SCOPE_CHANGED`: AppScope announces that from an effect one commit later, and an overlay (which no hold\n * covers, see below) would render once under the new organization in between.\n *\n * Rejected: making the controller follow the organization at its commit. It would make the controller a second\n * authority beside the route (and decide before the access verdict), and a raw router navigation or a\n * back/forward POP would still need the route path. Holding the entry until the route has decided keeps one\n * decision, this one.\n */\nexport enum RouteOrganizationFollow {\n  /** The route names no organization. The session's own current organization stands. */\n  NOT_ADDRESSED = 'NOT_ADDRESSED',\n  /** The session's current organization already is the route's. Nothing to do. */\n  IN_STEP = 'IN_STEP',\n  /**\n   * The route names an organization the session can be in, and the session is elsewhere. It is\n   * being made current; the route's content must wait, so its reads do not start in the previous organization.\n   */\n  FOLLOWING = 'FOLLOWING',\n  /** The route names an organization the session does not follow (see the decision above). The route renders as it would. */\n  NOT_FOLLOWED = 'NOT_FOLLOWED',\n}\n\nexport interface RouteOrganizationFollowFacts {\n  /** The organization the route names, if any. */\n  routeOrganizationId: string | null | undefined;\n  /** The route's access verdict, from `useRouteOrganizationAccess`. */\n  access: RouteOrganizationAccess;\n  /**\n   * Whether the session has loaded the route's organization as one of its own (`UserOrgsContext.organizations`,\n   * what the switcher offers). Decides only the `ADMITTED` case; see the decision above.\n   */\n  routeOrganizationLoaded: boolean;\n  /**\n   * Whether the backend's access profile confers entries in the route's organization (`accessProfileConfersOrganization`):\n   * a membership the user context's capped projection does not carry (#2275). Decides only the `ADMITTED` case.\n   */\n  routeOrganizationConferred: boolean;\n  /** The session's current organization (`AppScope.currentOrganizationId`). */\n  currentOrganizationId: string | null | undefined;\n  /**\n   * True once this arrival at the route is SETTLED: the session was in the route's organization, already or by\n   * following it. A settled arrival is never followed again, so a later move away is the person's own.\n   */\n  arrivalSettled: boolean;\n}\n\n/** The one decision for {@link RouteOrganizationFollow}; pure, so it is pinned without a router. */\nexport function decideRouteOrganizationFollow(facts: RouteOrganizationFollowFacts): RouteOrganizationFollow {\n  if (!facts.routeOrganizationId) {\n    return RouteOrganizationFollow.NOT_ADDRESSED;\n  }\n  if (facts.currentOrganizationId === facts.routeOrganizationId) {\n    return RouteOrganizationFollow.IN_STEP;\n  }\n  const sessionCanBeIn = facts.access === RouteOrganizationAccess.ACTIVE_MEMBERSHIP\n    || (facts.access === RouteOrganizationAccess.ADMITTED && (facts.routeOrganizationLoaded || facts.routeOrganizationConferred));\n  if (!sessionCanBeIn || facts.arrivalSettled) {\n    return RouteOrganizationFollow.NOT_FOLLOWED;\n  }\n  return RouteOrganizationFollow.FOLLOWING;\n}\n\n/**\n * What the authenticated layout has decided about the route's organization, published to the navigation zones so\n * they can hold their entries with the same decision the outlet is held by (#2276). `null` where no authenticated\n * layout is mounted: nothing is held there.\n */\nexport interface RouteOrganizationDecision {\n  /** The organization the COMMITTED route names (`useRouteOrganizationId`), or `null` when it names none. */\n  routeOrganizationId: string | null;\n  /**\n   * True while the layout withholds the route's content: the server is being asked (`VERIFYING`), the session is\n   * being moved into the route's organization (`FOLLOWING`), or the organization was refused (`REFUSED`).\n   */\n  routeContentHeld: boolean;\n}\n\nexport interface ZoneEntryOrganizationHoldFacts {\n  /** The organization the entry's content addresses (`navigationContentOrganizationId`), or `null`. */\n  entryOrganizationId: string | null;\n  /**\n   * Whether the entry is what the browser URL names, or is about to name: a structural-zone entry carrying a\n   * `urlPath` that is not a hosted pane (whose address rides on the host's URL). Only such an entry makes the route\n   * change, so only such an entry can be waiting for the route's decision.\n   */\n  entryOwnsBrowserUrl: boolean;\n  /** The session's current organization (`AppScope.currentOrganizationId`). */\n  currentOrganizationId: string | null | undefined;\n  /** The layout's decision, or `null` outside an authenticated layout. */\n  routeDecision: RouteOrganizationDecision | null;\n}\n\n/**\n * Whether a zone entry must be held (render a placeholder, mount nothing) until the session is in the organization it\n * addresses (#2276). The entry's content mounts only once nothing it reads can answer for another organization.\n *\n * - **The entry addresses the route's organization**: it is held exactly when the layout holds the route's content.\n *   That is the same decision as the outlet's, so a route that is being followed or verified holds its page however\n *   the page was rendered, and a route the session deliberately does not follow (a platform operator's crossing, an\n *   arrival already settled, an inconclusive probe) renders its page as the outlet would.\n * - **The entry addresses an organization the route does not name, and the session is not in it either**: it is\n *   held. The entry LEADS the route: the controller pushed it and wrote the URL, but the router's location has not\n *   committed yet, so the route still names the previous organization. Rendering it would read the session's\n *   organization for a page of another one. (An entry LEFT BEHIND by a follow fits the same case, and is held too;\n *   the follow drops such entries in its own commit, so this is a guard rather than the mechanism.)\n * - **Anything else renders**: an entry addressing no organization, or the session's own; an entry that does not own\n *   the URL (an overlay, a hosted pane), which the route never follows and must therefore never wait for; and every\n *   entry outside an authenticated layout.\n *\n * Pure, so it is pinned without a router.\n */\nexport function decideZoneEntryOrganizationHold(facts: ZoneEntryOrganizationHoldFacts): boolean {\n  const { entryOrganizationId, routeDecision } = facts;\n  if (!entryOrganizationId || !facts.entryOwnsBrowserUrl || !routeDecision) {\n    return false;\n  }\n  if (entryOrganizationId === routeDecision.routeOrganizationId) {\n    return routeDecision.routeContentHeld;\n  }\n  return entryOrganizationId !== facts.currentOrganizationId;\n}\n"]}

package/dist/esm/core/security/security.frontend.schemas.d.ts

@@ -1,8 +1,4 @@
-/**
- * Security Frontend Schemas
- *
- * Core authentication and authorization types for the frontend security layer.
- */
+import type { UserSelfAccessProfile } from '@wildo-ai/saas-models';
 import { AuthIdentificationResponse, AuthFactorLevel, SessionType, type AuthMethod, type AvailableMethod, type AuthSessionPurpose } from '@wildo-ai/saas-models';
 /**
  * Authentication state — contains only authentication-related fields.
@@ -106,8 +102,24 @@ export interface AuthState {
  * Contains app-level permissions and per-organization permissions
  */
 export type EffectivePermissions = {
+    /**
+     * Application roles. From the access profile's application entry when it loaded, else the user's `appRoles`
+     * (`membershipRolesFromAccessProfile`, #2381).
+     */
     appLevel: string[];
+    /**
+     * Organization-wide roles per organization id. From the access profile when it loaded — the roles the backend confers,
+     * which a representative membership row or a capability role stored on an ordinary row does not show truthfully — else the
+     * membership rows. Unit-scoped grants are never here; `accessProfile` carries them.
+     */
     organizations: Record<string, string[]>;
+    /**
+     * The backend's own account of this person's access (`user-self | access_profile`, #2381): the role entries their
+     * requests carry in each organization — organization-unit and relationship grants included, which the memberships above cannot show —
+     * and which resources narrow by unit. `null` when it could not be loaded; the shell then decides on the membership
+     * roles above alone, so a unit-granted entry stays hidden (fail closed).
+     */
+    accessProfile: UserSelfAccessProfile | null;
 };
 /**
  * Empty/initial authentication state

package/dist/esm/core/security/security.frontend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.frontend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAClD,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,eAAe,EAAE,CAAC;IACvC,0BAA0B,EAAE,UAAU,EAAE,CAAC;IACzC,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;OAUG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,oEAAoE;IACpE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,wGAAwG;IACxG,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,2BAA2B,CAAC,EAAE;QAC5B;;;;;WAKG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;;;WASG;QACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,mGAAmG;QACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAoB9B,CAAC;AAIF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAE/E;AAED;;;;;;;;;;;;;GAaG;AACH,oBAAY,sBAAsB;IAChC,WAAW,gBAAgB;IAC3B,KAAK,UAAU;CAChB;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;;CAKxD"}
+{"version":3,"file":"security.frontend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAQnE,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAClD,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,eAAe,EAAE,CAAC;IACvC,0BAA0B,EAAE,UAAU,EAAE,CAAC;IACzC,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC;;;;;;;;;;OAUG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,oEAAoE;IACpE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,wGAAwG;IACxG,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,2BAA2B,CAAC,EAAE;QAC5B;;;;;WAKG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;;;WASG;QACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,mGAAmG;QACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC7C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAoB9B,CAAC;AAIF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAE/E;AAED;;;;;;;;;;;;;GAaG;AACH,oBAAY,sBAAsB;IAChC,WAAW,gBAAgB;IAC3B,KAAK,UAAU;CAChB;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;;CAKxD"}

package/dist/esm/core/security/security.frontend.schemas.js

@@ -1,8 +1,3 @@
-/**
- * Security Frontend Schemas
- *
- * Core authentication and authorization types for the frontend security layer.
- */
 import { AuthFactorLevel, } from '@wildo-ai/saas-models';
 /**
  * Empty/initial authentication state

package/dist/esm/core/security/security.frontend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,eAAe,GAKhB,MAAM,uBAAuB,CAAC;AA6G/B;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,mBAAmB,EAAE,IAAI;IACzB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;IACxB,2BAA2B,EAAE,SAAS;CACvC,CAAC;AAUF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAoB;IAC5D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,qDAA2B,CAAA;IAC3B,yCAAe,CAAA;AACjB,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD;QACE,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD;QACE,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF","sourcesContent":["/**\n * Security Frontend Schemas\n * \n * Core authentication and authorization types for the frontend security layer.\n */\n\nimport { z } from 'zod';\nimport { \n  AuthIdentificationResponse,\n  AuthFactorLevel,\n  SessionType,\n  type AuthMethod,\n  type AvailableMethod,\n  type AuthSessionPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Authentication state — contains only authentication-related fields.\n *\n * **No `refreshToken` field** (Auth-hardening Slice A Step 6,\n * 2026-04-13). Pre-Slice-A this carried `refreshToken: string | null`\n * mirroring the legacy body-channel rotation contract. A-Step 2\n * (cookie migration) made the cookie the sole owner of the refresh\n * token, A-Step 3 stopped this state from being read by any consumer,\n * and A-Step 6 dropped the field entirely. The refresh token now lives\n * EXCLUSIVELY in the `__wildo_refresh` `HttpOnly` cookie — JS-invisible\n * by design (XSS exfiltration surface closed). Consumers that want to\n * \"check if the user has a valid session\" should look at `accessToken`\n * (or `sessionRestored`) — never at the cookie, which is opaque to JS.\n */\nexport interface AuthState {\n  isLoading: boolean;\n  error: string | null;\n  sessionId: string | null;\n  accessToken: string | null;\n  identification: AuthIdentificationResponse | null;\n  sessionState: any | null;\n  isRestoringSession: boolean;\n  sessionRestored: boolean;\n  mfaRequired: boolean;\n  mfaSessionId: string | null;\n  availableMfaMethods: AvailableMethod[];\n  availableEnrollmentMethods: AuthMethod[];\n  enrolledSecondFactorMethods: string[];\n  usableSecondFactorMethods: string[];\n  /**\n   * The authentication session an answer parked at organization onboarding (#1090), or `null`.\n   *\n   * Set by an answer that parked the account — a registration, an email verification, an enrollment settlement,\n   * a sign-in (#1091) or a federated sign-in's code exchange (#1103) — and read together with `accessToken`: while it is set and no token is held, the one\n   * step left is naming the organization the account's user type owes. The sign-in, registration, verification,\n   * magic-link, challenge, enrollment and federated-callback screens send the person to the organization-onboarding step in that\n   * state (`organizationOnboardingNavigationTarget`). Cleared by completing onboarding, by abandoning it, by a\n   * spent session, by a new identification and by sign-out. Memory only, deliberately: the obligation is durable\n   * on the server, so a lost tab signs in again and is parked again.\n   */\n  onboardingSessionId: string | null;\n  purpose: AuthSessionPurpose | null;\n  /** W7.3b: Session type — null before authentication is resolved. */\n  sessionType: SessionType | null;\n  /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */\n  oneOffContext?: {\n    originTokenId: string;\n    tokenType: string;\n    consumableTokenValue?: string;\n    tokenExpiresAt?: string;\n    scopedInitiatorIds?: Record<string, string>;\n    applicationId?: string;\n  };\n  /**\n   * cross-app-jwt-propagation.md Step 5: Context data populated when an\n   * AUTH_CODE_EXCHANGE token was minted by the cross-frontend-handoff issuer.\n   * `AuthSessionContext.handleAuthCodeExchange()` populates this field only\n   * when the token-exchange response carries a top-level `returnPath`; OAuth2\n   * callback codes omit that field and therefore leave this context undefined.\n   *\n   * Distinct from `oneOffContext` on purpose (semantic distinction over\n   * convenience — see `design-philosophy.mdc`):\n   *   - `oneOffContext` describes a W7.3b ephemeral one-off session\n   *     (resource-scoped targeting, applicationId, consumable replay).\n   *   - `crossFrontendHandoffContext` describes a session-transfer landing\n   *     (returnPath, source/target frontend telemetry). The session itself\n   *     is a regular persistent session driven by the receiver's storage\n   *     adapter (cross-app-jwt-propagation.md K-7).\n   *\n   * Consumed by `Auth_OneOffSession` in cross-frontend-handoff mode to drive\n   * post-exchange navigation (`returnPath`); also available to app-level\n   * telemetry hooks that want to know \"this user just landed via a handoff\n   * from $sourceFrontendServiceName\".\n   */\n  crossFrontendHandoffContext?: {\n    /**\n     * Path to navigate to after the exchange completes. Already passed\n     * `CrossFrontendHandoff_ReturnPathSchema` refines at issuance, but\n     * receivers MUST sanitize defense-in-depth (a malicious caller could\n     * hand-craft an exchange URL bypassing the issuer).\n     */\n    returnPath: string;\n    /**\n     * The frontend that initiated the handoff (e.g., `'admin-console'`).\n     * Optional because the source frontend identifies itself only via the\n     * `X-Frontend-Service-Name` request header (set by the shared HTTP\n     * client interceptor). Non-browser callers — server-to-server\n     * invocations, hand-crafted curl sessions — may legitimately omit\n     * the header (the issuer falls back to \"unknown\" source for audit\n     * purposes), in which case the receiver simply has no source\n     * identity to display in telemetry / breadcrumbs.\n     */\n    sourceFrontendServiceName?: string;\n    /** The target frontend the handoff was minted for. Useful for telemetry / breadcrumb rendering. */\n    targetServiceKey?: string;\n  };\n}\n\n/**\n * Effective permissions for the current user\n * Contains app-level permissions and per-organization permissions\n */\nexport type EffectivePermissions = {\n  appLevel: string[];\n  organizations: Record<string, string[]>;\n};\n\n/**\n * Empty/initial authentication state\n */\nexport const EMPTY_AUTH_STATE: AuthState = {\n  isLoading: false,\n  error: null,\n  sessionId: null,\n  accessToken: null,\n  identification: null,\n  sessionState: null,\n  isRestoringSession: false,\n  sessionRestored: false,\n  mfaRequired: false,\n  mfaSessionId: null,\n  availableMfaMethods: [],\n  availableEnrollmentMethods: [],\n  enrolledSecondFactorMethods: [],\n  usableSecondFactorMethods: [],\n  onboardingSessionId: null,\n  purpose: null,\n  sessionType: null,\n  oneOffContext: undefined,\n  crossFrontendHandoffContext: undefined,\n};\n\n// ─── Auth UI State Types ─────────────────────────────────────────────\n\nexport type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';\n\nexport type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';\n\nexport type UIFactorLevel = 'first' | 'second';\n\n/**\n * The ONE translation between the UI's factor vocabulary (`'first' | 'second'`, which selects the\n * page, its labels and its layout) and the wire vocabulary `AuthFactorLevel`, which every\n * authenticate-shaped request carries. They are different vocabularies on purpose — the UI has no\n * `IDENTIFICATION` page — so a UI level must be translated at the seam, never forwarded.\n *\n * Measured 2026-09-15: the passkey sign-in forwarded `'first'` verbatim into\n * `POST /auth/passkey/authenticate/verify`. The orchestrator's `=== FIRST` branch did not match it,\n * treated the attempt as a second factor, and the response it built failed the wire enum — `400\n * validation` on every passkey sign-in, and the same for passkey as an MFA second factor, which\n * forwarded `'second'`. The password and OTP paths never hit it because they write\n * `AuthFactorLevel.FIRST` / `.SECOND` by hand at their own sites; this function is where that\n * translation now lives once.\n */\nexport function authFactorLevelForUiLevel(level: UIFactorLevel): AuthFactorLevel {\n  return level === 'second' ? AuthFactorLevel.SECOND : AuthFactorLevel.FIRST;\n}\n\n/**\n * How a username-less passkey sign-in asks the browser for a credential.\n *\n * The distinction is about who starts the prompt, and it decides how a failure is shown:\n *\n * - `CONDITIONAL` — passkey AUTOFILL. Started silently when the sign-in page renders; the browser offers\n *   the person's passkeys in the email field's autofill list and the call waits until one is picked. It\n *   may never resolve, is aborted when the page moves on, and a failure before a passkey is picked is\n *   NOT an error the person caused — so nothing is shown for it.\n * - `MODAL` — the person pressed \"Sign in with a passkey\". The browser shows its account picker at once,\n *   and every failure, cancellation included, is reported on the page.\n *\n * spec-cite: https://web.dev/articles/passkey-form-autofill — conditional UI is invoked with `mediation: 'conditional'`, \"the crucial flag that makes the WebAuthn API call conditional. It tells the browser to wait for user interaction.\"\n */\nexport enum PasskeySignInMediation {\n  CONDITIONAL = 'conditional',\n  MODAL = 'modal',\n}\n\n/**\n * A waiting passkey AUTOFILL request was stopped because its challenge was about to expire.\n *\n * Autofill waits for as long as the sign-in page stays open, but the server's challenge — and the\n * username-less session bound to it — lasts `expiresInSeconds`. Picking a passkey after that would fail\n * on a session that no longer exists, so the context stops the wait shortly before and throws THIS, and\n * the sign-in page starts a fresh request. Any other refusal of an autofill wait (the page moving on, the\n * button starting its own ceremony) is NOT this error, which is what stops the page restarting over a\n * ceremony the person began.\n */\nexport class PasskeyAutofillExpiredError extends Error {\n  constructor() {\n    super('Passkey autofill challenge expired before a passkey was picked');\n    this.name = 'PasskeyAutofillExpiredError';\n  }\n}\n\n/**\n * Thrown by a passkey AUTOFILL ceremony that stepped aside because a ceremony the person started\n * themselves (the passkey button, or a second-factor passkey step) is already open.\n *\n * Starting a WebAuthn request aborts any pending one, so an autofill whose options arrived after the\n * button opened its prompt would close the prompt the person is looking at. The autofill loop treats this\n * like any other refusal and stops; the page starts a fresh autofill once the person's ceremony ends.\n */\nexport class PasskeyAutofillSupersededError extends Error {\n  constructor() {\n    super('Passkey autofill stepped aside for a ceremony the person started');\n    this.name = 'PasskeyAutofillSupersededError';\n  }\n}\n"]}
+{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,eAAe,GAKhB,MAAM,uBAAuB,CAAC;AA6H/B;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,mBAAmB,EAAE,IAAI;IACzB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;IACxB,2BAA2B,EAAE,SAAS;CACvC,CAAC;AAUF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAoB;IAC5D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,qDAA2B,CAAA;IAC3B,yCAAe,CAAA;AACjB,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD;QACE,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD;QACE,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF","sourcesContent":["import type { UserSelfAccessProfile } from '@wildo-ai/saas-models';\n/**\n * Security Frontend Schemas\n * \n * Core authentication and authorization types for the frontend security layer.\n */\n\nimport { z } from 'zod';\nimport { \n  AuthIdentificationResponse,\n  AuthFactorLevel,\n  SessionType,\n  type AuthMethod,\n  type AvailableMethod,\n  type AuthSessionPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Authentication state — contains only authentication-related fields.\n *\n * **No `refreshToken` field** (Auth-hardening Slice A Step 6,\n * 2026-04-13). Pre-Slice-A this carried `refreshToken: string | null`\n * mirroring the legacy body-channel rotation contract. A-Step 2\n * (cookie migration) made the cookie the sole owner of the refresh\n * token, A-Step 3 stopped this state from being read by any consumer,\n * and A-Step 6 dropped the field entirely. The refresh token now lives\n * EXCLUSIVELY in the `__wildo_refresh` `HttpOnly` cookie — JS-invisible\n * by design (XSS exfiltration surface closed). Consumers that want to\n * \"check if the user has a valid session\" should look at `accessToken`\n * (or `sessionRestored`) — never at the cookie, which is opaque to JS.\n */\nexport interface AuthState {\n  isLoading: boolean;\n  error: string | null;\n  sessionId: string | null;\n  accessToken: string | null;\n  identification: AuthIdentificationResponse | null;\n  sessionState: any | null;\n  isRestoringSession: boolean;\n  sessionRestored: boolean;\n  mfaRequired: boolean;\n  mfaSessionId: string | null;\n  availableMfaMethods: AvailableMethod[];\n  availableEnrollmentMethods: AuthMethod[];\n  enrolledSecondFactorMethods: string[];\n  usableSecondFactorMethods: string[];\n  /**\n   * The authentication session an answer parked at organization onboarding (#1090), or `null`.\n   *\n   * Set by an answer that parked the account — a registration, an email verification, an enrollment settlement,\n   * a sign-in (#1091) or a federated sign-in's code exchange (#1103) — and read together with `accessToken`: while it is set and no token is held, the one\n   * step left is naming the organization the account's user type owes. The sign-in, registration, verification,\n   * magic-link, challenge, enrollment and federated-callback screens send the person to the organization-onboarding step in that\n   * state (`organizationOnboardingNavigationTarget`). Cleared by completing onboarding, by abandoning it, by a\n   * spent session, by a new identification and by sign-out. Memory only, deliberately: the obligation is durable\n   * on the server, so a lost tab signs in again and is parked again.\n   */\n  onboardingSessionId: string | null;\n  purpose: AuthSessionPurpose | null;\n  /** W7.3b: Session type — null before authentication is resolved. */\n  sessionType: SessionType | null;\n  /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */\n  oneOffContext?: {\n    originTokenId: string;\n    tokenType: string;\n    consumableTokenValue?: string;\n    tokenExpiresAt?: string;\n    scopedInitiatorIds?: Record<string, string>;\n    applicationId?: string;\n  };\n  /**\n   * cross-app-jwt-propagation.md Step 5: Context data populated when an\n   * AUTH_CODE_EXCHANGE token was minted by the cross-frontend-handoff issuer.\n   * `AuthSessionContext.handleAuthCodeExchange()` populates this field only\n   * when the token-exchange response carries a top-level `returnPath`; OAuth2\n   * callback codes omit that field and therefore leave this context undefined.\n   *\n   * Distinct from `oneOffContext` on purpose (semantic distinction over\n   * convenience — see `design-philosophy.mdc`):\n   *   - `oneOffContext` describes a W7.3b ephemeral one-off session\n   *     (resource-scoped targeting, applicationId, consumable replay).\n   *   - `crossFrontendHandoffContext` describes a session-transfer landing\n   *     (returnPath, source/target frontend telemetry). The session itself\n   *     is a regular persistent session driven by the receiver's storage\n   *     adapter (cross-app-jwt-propagation.md K-7).\n   *\n   * Consumed by `Auth_OneOffSession` in cross-frontend-handoff mode to drive\n   * post-exchange navigation (`returnPath`); also available to app-level\n   * telemetry hooks that want to know \"this user just landed via a handoff\n   * from $sourceFrontendServiceName\".\n   */\n  crossFrontendHandoffContext?: {\n    /**\n     * Path to navigate to after the exchange completes. Already passed\n     * `CrossFrontendHandoff_ReturnPathSchema` refines at issuance, but\n     * receivers MUST sanitize defense-in-depth (a malicious caller could\n     * hand-craft an exchange URL bypassing the issuer).\n     */\n    returnPath: string;\n    /**\n     * The frontend that initiated the handoff (e.g., `'admin-console'`).\n     * Optional because the source frontend identifies itself only via the\n     * `X-Frontend-Service-Name` request header (set by the shared HTTP\n     * client interceptor). Non-browser callers — server-to-server\n     * invocations, hand-crafted curl sessions — may legitimately omit\n     * the header (the issuer falls back to \"unknown\" source for audit\n     * purposes), in which case the receiver simply has no source\n     * identity to display in telemetry / breadcrumbs.\n     */\n    sourceFrontendServiceName?: string;\n    /** The target frontend the handoff was minted for. Useful for telemetry / breadcrumb rendering. */\n    targetServiceKey?: string;\n  };\n}\n\n/**\n * Effective permissions for the current user\n * Contains app-level permissions and per-organization permissions\n */\nexport type EffectivePermissions = {\n  /**\n   * Application roles. From the access profile's application entry when it loaded, else the user's `appRoles`\n   * (`membershipRolesFromAccessProfile`, #2381).\n   */\n  appLevel: string[];\n  /**\n   * Organization-wide roles per organization id. From the access profile when it loaded — the roles the backend confers,\n   * which a representative membership row or a capability role stored on an ordinary row does not show truthfully — else the\n   * membership rows. Unit-scoped grants are never here; `accessProfile` carries them.\n   */\n  organizations: Record<string, string[]>;\n  /**\n   * The backend's own account of this person's access (`user-self | access_profile`, #2381): the role entries their\n   * requests carry in each organization — organization-unit and relationship grants included, which the memberships above cannot show —\n   * and which resources narrow by unit. `null` when it could not be loaded; the shell then decides on the membership\n   * roles above alone, so a unit-granted entry stays hidden (fail closed).\n   */\n  accessProfile: UserSelfAccessProfile | null;\n};\n\n/**\n * Empty/initial authentication state\n */\nexport const EMPTY_AUTH_STATE: AuthState = {\n  isLoading: false,\n  error: null,\n  sessionId: null,\n  accessToken: null,\n  identification: null,\n  sessionState: null,\n  isRestoringSession: false,\n  sessionRestored: false,\n  mfaRequired: false,\n  mfaSessionId: null,\n  availableMfaMethods: [],\n  availableEnrollmentMethods: [],\n  enrolledSecondFactorMethods: [],\n  usableSecondFactorMethods: [],\n  onboardingSessionId: null,\n  purpose: null,\n  sessionType: null,\n  oneOffContext: undefined,\n  crossFrontendHandoffContext: undefined,\n};\n\n// ─── Auth UI State Types ─────────────────────────────────────────────\n\nexport type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';\n\nexport type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';\n\nexport type UIFactorLevel = 'first' | 'second';\n\n/**\n * The ONE translation between the UI's factor vocabulary (`'first' | 'second'`, which selects the\n * page, its labels and its layout) and the wire vocabulary `AuthFactorLevel`, which every\n * authenticate-shaped request carries. They are different vocabularies on purpose — the UI has no\n * `IDENTIFICATION` page — so a UI level must be translated at the seam, never forwarded.\n *\n * Measured 2026-09-15: the passkey sign-in forwarded `'first'` verbatim into\n * `POST /auth/passkey/authenticate/verify`. The orchestrator's `=== FIRST` branch did not match it,\n * treated the attempt as a second factor, and the response it built failed the wire enum — `400\n * validation` on every passkey sign-in, and the same for passkey as an MFA second factor, which\n * forwarded `'second'`. The password and OTP paths never hit it because they write\n * `AuthFactorLevel.FIRST` / `.SECOND` by hand at their own sites; this function is where that\n * translation now lives once.\n */\nexport function authFactorLevelForUiLevel(level: UIFactorLevel): AuthFactorLevel {\n  return level === 'second' ? AuthFactorLevel.SECOND : AuthFactorLevel.FIRST;\n}\n\n/**\n * How a username-less passkey sign-in asks the browser for a credential.\n *\n * The distinction is about who starts the prompt, and it decides how a failure is shown:\n *\n * - `CONDITIONAL` — passkey AUTOFILL. Started silently when the sign-in page renders; the browser offers\n *   the person's passkeys in the email field's autofill list and the call waits until one is picked. It\n *   may never resolve, is aborted when the page moves on, and a failure before a passkey is picked is\n *   NOT an error the person caused — so nothing is shown for it.\n * - `MODAL` — the person pressed \"Sign in with a passkey\". The browser shows its account picker at once,\n *   and every failure, cancellation included, is reported on the page.\n *\n * spec-cite: https://web.dev/articles/passkey-form-autofill — conditional UI is invoked with `mediation: 'conditional'`, \"the crucial flag that makes the WebAuthn API call conditional. It tells the browser to wait for user interaction.\"\n */\nexport enum PasskeySignInMediation {\n  CONDITIONAL = 'conditional',\n  MODAL = 'modal',\n}\n\n/**\n * A waiting passkey AUTOFILL request was stopped because its challenge was about to expire.\n *\n * Autofill waits for as long as the sign-in page stays open, but the server's challenge — and the\n * username-less session bound to it — lasts `expiresInSeconds`. Picking a passkey after that would fail\n * on a session that no longer exists, so the context stops the wait shortly before and throws THIS, and\n * the sign-in page starts a fresh request. Any other refusal of an autofill wait (the page moving on, the\n * button starting its own ceremony) is NOT this error, which is what stops the page restarting over a\n * ceremony the person began.\n */\nexport class PasskeyAutofillExpiredError extends Error {\n  constructor() {\n    super('Passkey autofill challenge expired before a passkey was picked');\n    this.name = 'PasskeyAutofillExpiredError';\n  }\n}\n\n/**\n * Thrown by a passkey AUTOFILL ceremony that stepped aside because a ceremony the person started\n * themselves (the passkey button, or a second-factor passkey step) is already open.\n *\n * Starting a WebAuthn request aborts any pending one, so an autofill whose options arrived after the\n * button opened its prompt would close the prompt the person is looking at. The autofill loop treats this\n * like any other refusal and stops; the page starts a fresh autofill once the person's ceremony ends.\n */\nexport class PasskeyAutofillSupersededError extends Error {\n  constructor() {\n    super('Passkey autofill stepped aside for a ceremony the person started');\n    this.name = 'PasskeyAutofillSupersededError';\n  }\n}\n"]}

package/dist/esm/core/security/useApplicationRoleTables.d.ts

@@ -0,0 +1,3 @@
+import type { ApplicationRoleTables } from '@wildo-ai/saas-models';
+export declare function useApplicationRoleTables(): ApplicationRoleTables;
+//# sourceMappingURL=useApplicationRoleTables.d.ts.map

package/dist/esm/core/security/useApplicationRoleTables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useApplicationRoleTables.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useApplicationRoleTables.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAGnE,wBAAgB,wBAAwB,IAAI,qBAAqB,CAEhE"}

package/dist/esm/core/security/useApplicationRoleTables.js

@@ -0,0 +1,11 @@
+/**
+ * useApplicationRoleTables — the application's role tables (see `ApplicationRoleTablesContext`).
+ *
+ * Separated from the context module for React Fast Refresh compatibility.
+ */
+import { useContext } from 'react';
+import { ApplicationRoleTablesContext } from './ApplicationRoleTablesContext.js';
+export function useApplicationRoleTables() {
+    return useContext(ApplicationRoleTablesContext);
+}
+//# sourceMappingURL=useApplicationRoleTables.js.map

package/dist/esm/core/security/useApplicationRoleTables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useApplicationRoleTables.js","sourceRoot":"","sources":["../../../../../src/core/security/useApplicationRoleTables.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEnC,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,UAAU,wBAAwB;IACtC,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAC;AAClD,CAAC","sourcesContent":["/**\n * useApplicationRoleTables — the application's role tables (see `ApplicationRoleTablesContext`).\n *\n * Separated from the context module for React Fast Refresh compatibility.\n */\nimport { useContext } from 'react';\nimport type { ApplicationRoleTables } from '@wildo-ai/saas-models';\nimport { ApplicationRoleTablesContext } from './ApplicationRoleTablesContext';\n\nexport function useApplicationRoleTables(): ApplicationRoleTables {\n  return useContext(ApplicationRoleTablesContext);\n}\n"]}