@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts

@@ -4,8 +4,66 @@
  * Core authentication schemas shared between frontend and backend
  */
 import { z } from 'zod';
-import { AuthMethod, AuthFactorLevel, AuthNextStep, AuthSessionPurpose } from './authentication.shared.schemas.js';
-import { SessionType } from '../../runtime/execution-context.shared.schemas.js';
+import { AuthMethod, AuthFactorLevel, AuthNextStep, AuthSessionPurpose, AuthScopeType } from './authentication.shared.schemas';
+import { SessionType } from '../../runtime/execution-context.shared.schemas';
+/**
+ * Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,
+ * from the invitation token alone, which first-factor auth methods the target
+ * organization allows and whether the org is SSO/SCIM-managed.
+ *
+ * Distinct from `identify()` (keyed by email→domain, requires an existing user):
+ * this is token-keyed and works for a not-yet-activated invitee (INVITED
+ * membership, no session). Populated by `GET /auth/invitation/info?token=…`,
+ * which reads the token WITHOUT consuming it (unlike accept). See
+ * `.claude/plans/invitation-multi-method-auth.md`.
+ */
+export declare enum InvitationManagementMode {
+    /** No enterprise identity authority — invitee may set a local credential (password/passkey) or use any allowed method. */
+    OPEN = "open",
+    /** Org authenticates via enterprise SSO — route the invitee to the IdP (JIT consumes the invite; no local accept). */
+    SSO = "sso",
+    /** Org is ACTIVELY directory-managed (SCIM live — DIRECTORY_PROVISIONING feature + a live SCIM token) — informational only, NO local credential: a local password/passkey/magic-link would survive IdP deprovisioning. Derived per-org (not from the org-TYPE mount flag) — see `isOrgActivelyDirectoryManaged` / AUTH-23. */
+    SCIM = "scim"
+}
+export declare const AuthInvitationInfoResponseSchema: z.ZodObject<{
+    inviteeEmail: z.ZodEmail;
+    organizationName: z.ZodString;
+    availableFirstFactorMethods: z.ZodArray<z.ZodObject<{
+        method: z.ZodEnum<typeof AuthMethod>;
+        factorType: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthFactorType>;
+        category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
+        canBeFirstFactor: z.ZodBoolean;
+        canBeSecondFactor: z.ZodBoolean;
+        required: z.ZodBoolean;
+        oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        organizationRestricted: z.ZodDefault<z.ZodBoolean>;
+        supportsIntegrations: z.ZodDefault<z.ZodBoolean>;
+        availableIntegrations: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        config: z.ZodOptional<z.ZodObject<{
+            rpName: z.ZodOptional<z.ZodString>;
+            rpId: z.ZodOptional<z.ZodString>;
+            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
+            displayName: z.ZodOptional<z.ZodString>;
+            providerRef: z.ZodOptional<z.ZodString>;
+            connectionId: z.ZodOptional<z.ZodString>;
+            scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+            scopeId: z.ZodOptional<z.ZodString>;
+            loginUrl: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    managementMode: z.ZodEnum<typeof InvitationManagementMode>;
+    passwordPolicy: z.ZodOptional<z.ZodObject<{
+        minLength: z.ZodDefault<z.ZodNumber>;
+        maxLength: z.ZodDefault<z.ZodNumber>;
+        requireUppercase: z.ZodDefault<z.ZodBoolean>;
+        requireLowercase: z.ZodDefault<z.ZodBoolean>;
+        requireNumbers: z.ZodDefault<z.ZodBoolean>;
+        requireSpecialChars: z.ZodDefault<z.ZodBoolean>;
+        expiryDays: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AuthInvitationInfoResponse = z.infer<typeof AuthInvitationInfoResponseSchema>;
 /**
  * Step 1: User identification by email
  * Returns available authentication methods for the user
@@ -16,8 +74,8 @@ export declare const AuthIdentificationRequestSchema: z.ZodObject<{
     deviceInfo: z.ZodOptional<z.ZodObject<{
         userAgent: z.ZodOptional<z.ZodString>;
         ipAddress: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 /**
  * Step 1 Response: Available authentication methods with factor classification
  */
@@ -27,8 +85,8 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
     userExists: z.ZodBoolean;
     firstFactorMethods: z.ZodArray<z.ZodObject<{
         method: z.ZodEnum<typeof AuthMethod>;
-        factorType: z.ZodEnum<typeof import("./authentication.shared.schemas.js").AuthFactorType>;
-        category: z.ZodEnum<typeof import("./authentication.shared.schemas.js").AuthMethodCategory>;
+        factorType: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthFactorType>;
+        category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
         required: z.ZodBoolean;
@@ -37,13 +95,23 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
         supportsIntegrations: z.ZodDefault<z.ZodBoolean>;
         availableIntegrations: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-        config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+        config: z.ZodOptional<z.ZodObject<{
+            rpName: z.ZodOptional<z.ZodString>;
+            rpId: z.ZodOptional<z.ZodString>;
+            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
+            displayName: z.ZodOptional<z.ZodString>;
+            providerRef: z.ZodOptional<z.ZodString>;
+            connectionId: z.ZodOptional<z.ZodString>;
+            scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+            scopeId: z.ZodOptional<z.ZodString>;
+            loginUrl: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     defaultFirstFactorMethod: z.ZodOptional<z.ZodEnum<typeof AuthMethod>>;
     secondFactorMethods: z.ZodArray<z.ZodObject<{
         method: z.ZodEnum<typeof AuthMethod>;
-        factorType: z.ZodEnum<typeof import("./authentication.shared.schemas.js").AuthFactorType>;
-        category: z.ZodEnum<typeof import("./authentication.shared.schemas.js").AuthMethodCategory>;
+        factorType: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthFactorType>;
+        category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
         required: z.ZodBoolean;
@@ -52,22 +120,32 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
         supportsIntegrations: z.ZodDefault<z.ZodBoolean>;
         availableIntegrations: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-        config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+        config: z.ZodOptional<z.ZodObject<{
+            rpName: z.ZodOptional<z.ZodString>;
+            rpId: z.ZodOptional<z.ZodString>;
+            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
+            displayName: z.ZodOptional<z.ZodString>;
+            providerRef: z.ZodOptional<z.ZodString>;
+            connectionId: z.ZodOptional<z.ZodString>;
+            scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+            scopeId: z.ZodOptional<z.ZodString>;
+            loginUrl: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     requiresMFA: z.ZodBoolean;
     mfaMethodsRequired: z.ZodDefault<z.ZodNumber>;
     organizationBranding: z.ZodOptional<z.ZodObject<{
-        logoUrl: z.ZodOptional<z.ZodURL>;
+        logoUrl: z.ZodOptional<z.ZodString>;
         primaryColor: z.ZodOptional<z.ZodString>;
         organizationName: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
     availableIntegrations: z.ZodDefault<z.ZodArray<z.ZodObject<{
         integrationId: z.ZodString;
         externalProviderId: z.ZodString;
         iconUrl: z.ZodOptional<z.ZodURL>;
-    }, z.core.$strip, core.$ZodObjectExtra>>>;
+    }, z.core.$strip>>>;
     ssoMigrationRequired: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * Base authentication request schema with factor context
  */
@@ -77,7 +155,7 @@ export declare const BaseAuthRequestSchema: z.ZodObject<{
     factorLevel: z.ZodEnum<typeof AuthFactorLevel>;
     rememberMe: z.ZodDefault<z.ZodBoolean>;
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * Password Authentication (First factor only)
  */
@@ -88,9 +166,9 @@ export declare const PasswordAuthRequestSchema: z.ZodObject<{
     method: z.ZodLiteral<AuthMethod.PASSWORD>;
     factorLevel: z.ZodLiteral<AuthFactorLevel.FIRST>;
     password: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
- * Third-Party OAuth2 Authentication (Any factor, extensible)
+ * Third-Party OAuth2 Authentication (First factor, extensible)
  */
 export declare const External_OAuth2_AuthRequestSchema: z.ZodObject<{
     sessionId: z.ZodString;
@@ -103,7 +181,7 @@ export declare const External_OAuth2_AuthRequestSchema: z.ZodObject<{
     state: z.ZodOptional<z.ZodString>;
     additionalScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
     integrationPermissions: z.ZodDefault<z.ZodArray<z.ZodString>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * Organization SSO Authentication (First or second factor, organization-restricted)
  */
@@ -121,7 +199,7 @@ export declare const OrganizationSSOAuthRequestSchema: z.ZodObject<{
     samlResponse: z.ZodOptional<z.ZodString>;
     idToken: z.ZodOptional<z.ZodString>;
     state: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * OAuth2 Callback Schema (for both third-party and SSO)
  */
@@ -133,7 +211,7 @@ export declare const OAuth2CallbackSchema: z.ZodObject<{
     state: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
     errorDescription: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * TOTP Authentication (Second factor only)
  */
@@ -144,7 +222,7 @@ export declare const TOTPAuthRequestSchema: z.ZodObject<{
     method: z.ZodLiteral<AuthMethod.TOTP>;
     factorLevel: z.ZodLiteral<AuthFactorLevel.SECOND>;
     token: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * SMS OTP Authentication (First or second factor)
  */
@@ -156,7 +234,7 @@ export declare const SMSOTPAuthRequestSchema: z.ZodObject<{
     factorLevel: z.ZodUnion<readonly [z.ZodLiteral<AuthFactorLevel.FIRST>, z.ZodLiteral<AuthFactorLevel.SECOND>]>;
     phoneNumber: z.ZodOptional<z.ZodString>;
     token: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * Email OTP Authentication (Second factor only)
  */
@@ -167,7 +245,7 @@ export declare const EmailOTPAuthRequestSchema: z.ZodObject<{
     method: z.ZodLiteral<AuthMethod.EMAIL_OTP>;
     factorLevel: z.ZodLiteral<AuthFactorLevel.SECOND>;
     token: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * Passkey (WebAuthn) Authentication (First or second factor)
  */
@@ -185,12 +263,12 @@ export declare const PasskeyAuthRequestSchema: z.ZodObject<{
             clientDataJSON: z.ZodString;
             signature: z.ZodString;
             userHandle: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip, core.$ZodObjectExtra>;
+        }, z.core.$strip>;
         authenticatorAttachment: z.ZodOptional<z.ZodString>;
         clientExtensionResults: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodAny>>;
         type: z.ZodLiteral<"public-key">;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 /**
  * Magic Link Send Request — triggers a magic link email to the user.
  * Separate from the main AuthenticationRequestSchema because it doesn't
@@ -199,7 +277,7 @@ export declare const PasskeyAuthRequestSchema: z.ZodObject<{
 export declare const MagicLinkSendRequestSchema: z.ZodObject<{
     email: z.ZodEmail;
     organizationId: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * Magic Link Verify Request — verifies the token from the magic link.
  * Used by POST /auth/magic-link/verify for programmatic verification.
@@ -210,21 +288,21 @@ export declare const MagicLinkSendRequestSchema: z.ZodObject<{
 export declare const MagicLinkVerifyRequestSchema: z.ZodObject<{
     token: z.ZodString;
     email: z.ZodEmail;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * Phone Verification Send Request — triggers a verification code to a phone number.
  * Used for phone number ownership verification, separate from SMS OTP auth.
  */
 export declare const PhoneVerifySendRequestSchema: z.ZodObject<{
     phoneNumber: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * Phone Verification Confirm Request — confirms the verification code.
  */
 export declare const PhoneVerifyConfirmRequestSchema: z.ZodObject<{
     phoneNumber: z.ZodString;
     code: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * Union of all authentication request types
  */
@@ -235,7 +313,7 @@ export declare const AuthenticationRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
     method: z.ZodLiteral<AuthMethod.PASSWORD>;
     factorLevel: z.ZodLiteral<AuthFactorLevel.FIRST>;
     password: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     sessionId: z.ZodString;
     rememberMe: z.ZodDefault<z.ZodBoolean>;
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -246,7 +324,7 @@ export declare const AuthenticationRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
     state: z.ZodOptional<z.ZodString>;
     additionalScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
     integrationPermissions: z.ZodDefault<z.ZodArray<z.ZodString>>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     sessionId: z.ZodString;
     rememberMe: z.ZodDefault<z.ZodBoolean>;
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -260,14 +338,14 @@ export declare const AuthenticationRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
     samlResponse: z.ZodOptional<z.ZodString>;
     idToken: z.ZodOptional<z.ZodString>;
     state: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     sessionId: z.ZodString;
     rememberMe: z.ZodDefault<z.ZodBoolean>;
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
     method: z.ZodLiteral<AuthMethod.TOTP>;
     factorLevel: z.ZodLiteral<AuthFactorLevel.SECOND>;
     token: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     sessionId: z.ZodString;
     rememberMe: z.ZodDefault<z.ZodBoolean>;
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -275,14 +353,14 @@ export declare const AuthenticationRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
     factorLevel: z.ZodUnion<readonly [z.ZodLiteral<AuthFactorLevel.FIRST>, z.ZodLiteral<AuthFactorLevel.SECOND>]>;
     phoneNumber: z.ZodOptional<z.ZodString>;
     token: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     sessionId: z.ZodString;
     rememberMe: z.ZodDefault<z.ZodBoolean>;
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
     method: z.ZodLiteral<AuthMethod.EMAIL_OTP>;
     factorLevel: z.ZodLiteral<AuthFactorLevel.SECOND>;
     token: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     sessionId: z.ZodString;
     rememberMe: z.ZodDefault<z.ZodBoolean>;
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -296,14 +374,38 @@ export declare const AuthenticationRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
             clientDataJSON: z.ZodString;
             signature: z.ZodString;
             userHandle: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip, core.$ZodObjectExtra>;
+        }, z.core.$strip>;
         authenticatorAttachment: z.ZodOptional<z.ZodString>;
         clientExtensionResults: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodAny>>;
         type: z.ZodLiteral<"public-key">;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-}, z.core.$strip, core.$ZodObjectExtra>], "method">;
+    }, z.core.$strip>;
+}, z.core.$strip>], "method">;
 /**
- * Authentication Response Schema with Factor Context and Integration Access
+ * Authentication Response Schema with Factor Context and Integration Access.
+ *
+ * **Wire contract — refresh token is NEVER included** (Auth-hardening
+ * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried
+ * `refreshToken: z.string().optional()` which was emitted in the JSON
+ * body for every authentication response. The cookie migration (A-Step 2,
+ * 2026-04-13) added `Set-Cookie: __wildo_refresh=…` as a parallel
+ * channel; A-Step 3 (2026-04-13) made the SaaS-frontend stop reading
+ * the body field; A-Step 6 (THIS step) DROPS the body field entirely
+ * so the wire response physically cannot carry the refresh token.
+ *
+ * Backend internals: the orchestrator's
+ * `_buildAuthenticationSuccessMethod` returns
+ * `AuthenticationServiceResult = AuthenticationResponse & { refreshToken?: string }`
+ * (a backend-only TS type — NOT a wire schema) so the controller can
+ * extract the refresh-token value and pass it explicitly to
+ * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`. The wire
+ * payload (this schema) STILL has no `refreshToken` field — the
+ * controller's helper sets the cookie and emits the body separately.
+ *
+ * `integrationTokens[].refreshToken` (below) is a third-party-IdP
+ * OAuth2 refresh token (Google, Microsoft, etc.) — NOT a Wildo refresh
+ * token. It stays on the wire because the frontend needs it to drive
+ * IdP-side API calls; it is bound to a different security model
+ * (IdP-issued, IdP-rotated, never used to mint Wildo JWTs).
  */
 export declare const AuthenticationResponseSchema: z.ZodObject<{
     success: z.ZodBoolean;
@@ -312,101 +414,84 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
     factorLevel: z.ZodEnum<typeof AuthFactorLevel>;
     authMethod: z.ZodOptional<z.ZodEnum<typeof AuthMethod>>;
     accessToken: z.ZodOptional<z.ZodString>;
-    refreshToken: z.ZodOptional<z.ZodString>;
     expiresIn: z.ZodOptional<z.ZodNumber>;
     user: z.ZodOptional<z.ZodObject<{
         _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-        email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>>>;
-        status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../../index.js").UserStatus>>>>;
-        appRoles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../../index.js").CORE_APP_ROLES>, z.ZodString]>>>>;
-        userTypes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>>>>;
+        status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").UserStatus>>>>>>;
+        appRoles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_APP_ROLES>, z.ZodString]>>>>>;
+        userTypes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
+        scheduledReactivationAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
         createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
         updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
         userSelfProfile: z.ZodOptional<z.ZodObject<{
             _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-            firstName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-            lastName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-            displayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-            avatar: z.ZodOptional<z.ZodURL>;
-            bio: z.ZodOptional<z.ZodString>;
-            phoneNumber: z.ZodOptional<z.ZodString>;
-            title: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+            firstName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+            lastName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+            displayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+            avatar: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedMultipleFileSchema>> | import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedFileSchema>>;
+            bio: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+            phoneNumber: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPhoneSchema>;
+            title: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+        }, z.core.$strip>>;
         userSelfPreference: z.ZodOptional<z.ZodObject<{
             _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-            notifications: z.ZodDefault<z.ZodObject<{
+            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+            notifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
                 email: z.ZodDefault<z.ZodBoolean>;
                 push: z.ZodDefault<z.ZodBoolean>;
                 sms: z.ZodDefault<z.ZodBoolean>;
                 inApp: z.ZodDefault<z.ZodBoolean>;
-            }, z.core.$strip, core.$ZodObjectExtra>>;
-            privacy: z.ZodDefault<z.ZodObject<{
-                dataProcessingConsent: z.ZodDefault<z.ZodEnum<typeof import("../../index.js").DataProcessingConsent>>;
-                privacyLevel: z.ZodDefault<z.ZodEnum<typeof import("../../index.js").PrivacyLevel>>;
-                termsOfUseApproval: z.ZodDefault<z.ZodObject<{
-                    accepted: z.ZodDefault<z.ZodBoolean>;
-                    acceptedAt: z.ZodOptional<z.ZodISODateTime>;
-                    acceptedVersion: z.ZodOptional<z.ZodString>;
-                    ipAddress: z.ZodOptional<z.ZodIPv4>;
-                }, z.core.$strip, core.$ZodObjectExtra>>;
-                privacyPolicyApproval: z.ZodDefault<z.ZodObject<{
-                    accepted: z.ZodDefault<z.ZodBoolean>;
-                    acceptedAt: z.ZodOptional<z.ZodISODateTime>;
-                    acceptedVersion: z.ZodOptional<z.ZodString>;
-                    ipAddress: z.ZodOptional<z.ZodIPv4>;
-                }, z.core.$strip, core.$ZodObjectExtra>>;
-                dataProcessingAgreementApproval: z.ZodDefault<z.ZodObject<{
-                    accepted: z.ZodDefault<z.ZodBoolean>;
-                    acceptedAt: z.ZodOptional<z.ZodISODateTime>;
-                    acceptedVersion: z.ZodOptional<z.ZodString>;
-                    ipAddress: z.ZodOptional<z.ZodIPv4>;
-                }, z.core.$strip, core.$ZodObjectExtra>>;
-            }, z.core.$strip, core.$ZodObjectExtra>>;
+            }, z.core.$strip>>>;
+            privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
+                dataProcessingConsent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").DataProcessingConsent>>>;
+                privacyLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").PrivacyLevel>>>;
+            }, z.core.$strip>>>;
             ui: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
-                theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../../index.js").UserTheme>>>;
-            }, z.core.$strip, core.$ZodObjectExtra>>>;
-            regional: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
+                theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").UserTheme>>>;
+            }, z.core.$strip>>>;
+            regional: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
                 timezone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/presets-components-models").CommonTimezone>, z.ZodString]>>>;
                 dateFormat: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").DateFormat>>>;
                 timeFormat: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").TimeFormat>>>;
                 locale: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>;
-            }, z.core.$strip, core.$ZodObjectExtra>>>;
-            languagePreferences: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
+            }, z.core.$strip>>>>;
+            languagePreferences: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
                 primaryLanguage: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>;
-                fallbackLanguages: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>;
+                fallbackLanguages: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>>;
                 autoDetect: z.ZodDefault<z.ZodBoolean>;
                 useOrganizationDefault: z.ZodDefault<z.ZodBoolean>;
-            }, z.core.$strip, core.$ZodObjectExtra>>>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
-        organizationMembers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            }, z.core.$strip>>>>;
+        }, z.core.$strip>>;
+        organizationMembers: z.ZodOptional<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
             _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+            userEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>>>>>;
             organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
-            organizationUnitsMembership: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                organizationUnitId: z.ZodString;
-                role: z.ZodUnion<readonly [z.ZodEnum<typeof import("../../index.js").CORE_ORG_ROLES>, z.ZodString]>;
-            }, z.core.$strip, core.$ZodObjectExtra>>>;
-            roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../../index.js").CORE_ORG_ROLES>, z.ZodString]>>>>>;
-            status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../../index.js").OrganizationMemberStatus>>>>;
-            userTitle: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+            roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>>>>;
+            status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").OrganizationMemberStatus>>>>>>>;
+            scheduledReactivationAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
+            userTitle: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+            invitedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+            invitedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
+            instanceLabel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
             createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
             updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
-        }, z.core.$strip, core.$ZodObjectExtra>>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>>>;
+    }, z.core.$strip>>;
     integrationTokens: z.ZodDefault<z.ZodArray<z.ZodObject<{
         integrationId: z.ZodString;
         accessToken: z.ZodString;
         refreshToken: z.ZodOptional<z.ZodString>;
         expiresIn: z.ZodOptional<z.ZodNumber>;
         scopes: z.ZodArray<z.ZodString>;
-    }, z.core.$strip, core.$ZodObjectExtra>>>;
+    }, z.core.$strip>>>;
     requiresMFA: z.ZodDefault<z.ZodBoolean>;
     availableMFAMethods: z.ZodOptional<z.ZodArray<z.ZodObject<{
         method: z.ZodEnum<typeof AuthMethod>;
-        factorType: z.ZodEnum<typeof import("./authentication.shared.schemas.js").AuthFactorType>;
-        category: z.ZodEnum<typeof import("./authentication.shared.schemas.js").AuthMethodCategory>;
+        factorType: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthFactorType>;
+        category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
         required: z.ZodBoolean;
@@ -415,8 +500,18 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
         supportsIntegrations: z.ZodDefault<z.ZodBoolean>;
         availableIntegrations: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-        config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>>;
+        config: z.ZodOptional<z.ZodObject<{
+            rpName: z.ZodOptional<z.ZodString>;
+            rpId: z.ZodOptional<z.ZodString>;
+            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
+            displayName: z.ZodOptional<z.ZodString>;
+            providerRef: z.ZodOptional<z.ZodString>;
+            connectionId: z.ZodOptional<z.ZodString>;
+            scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+            scopeId: z.ZodOptional<z.ZodString>;
+            loginUrl: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
     mfaMethodsRequired: z.ZodOptional<z.ZodNumber>;
     completedFactors: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
     enrolledSecondFactorMethods: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
@@ -430,7 +525,7 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
     lockoutUntil: z.ZodOptional<z.ZodDate>;
     challengeData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     redirectUrl: z.ZodOptional<z.ZodURL>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * MFA Setup Request
  */
@@ -438,7 +533,7 @@ export declare const MFASetupRequestSchema: z.ZodObject<{
     method: z.ZodEnum<typeof AuthMethod>;
     phoneNumber: z.ZodOptional<z.ZodString>;
     deviceName: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * MFA Setup Response
  */
@@ -449,7 +544,7 @@ export declare const MFASetupResponseSchema: z.ZodObject<{
     secret: z.ZodOptional<z.ZodString>;
     challenge: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     recoveryCodes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * Authentication Session State
  */
@@ -484,10 +579,8 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
     userExists: z.ZodOptional<z.ZodBoolean>;
     userId: z.ZodOptional<z.ZodString>;
     organizationId: z.ZodOptional<z.ZodString>;
-    scopeType: z.ZodOptional<z.ZodEnum<{
-        organization: "organization";
-        application: "application";
-    }>>;
+    scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+    scopeId: z.ZodOptional<z.ZodString>;
     activeUserType: z.ZodOptional<z.ZodString>;
     purpose: z.ZodOptional<z.ZodEnum<typeof AuthSessionPurpose>>;
     nextStep: z.ZodOptional<z.ZodEnum<typeof AuthNextStep>>;
@@ -498,8 +591,8 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
     currentFactor: z.ZodOptional<z.ZodEnum<typeof AuthFactorLevel>>;
     availableFirstFactorMethods: z.ZodDefault<z.ZodArray<z.ZodObject<{
         method: z.ZodEnum<typeof AuthMethod>;
-        factorType: z.ZodEnum<typeof import("./authentication.shared.schemas.js").AuthFactorType>;
-        category: z.ZodEnum<typeof import("./authentication.shared.schemas.js").AuthMethodCategory>;
+        factorType: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthFactorType>;
+        category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
         required: z.ZodBoolean;
@@ -508,12 +601,22 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
         supportsIntegrations: z.ZodDefault<z.ZodBoolean>;
         availableIntegrations: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-        config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>>;
+        config: z.ZodOptional<z.ZodObject<{
+            rpName: z.ZodOptional<z.ZodString>;
+            rpId: z.ZodOptional<z.ZodString>;
+            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
+            displayName: z.ZodOptional<z.ZodString>;
+            providerRef: z.ZodOptional<z.ZodString>;
+            connectionId: z.ZodOptional<z.ZodString>;
+            scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+            scopeId: z.ZodOptional<z.ZodString>;
+            loginUrl: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
     availableSecondFactorMethods: z.ZodDefault<z.ZodArray<z.ZodObject<{
         method: z.ZodEnum<typeof AuthMethod>;
-        factorType: z.ZodEnum<typeof import("./authentication.shared.schemas.js").AuthFactorType>;
-        category: z.ZodEnum<typeof import("./authentication.shared.schemas.js").AuthMethodCategory>;
+        factorType: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthFactorType>;
+        category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
         required: z.ZodBoolean;
@@ -522,8 +625,18 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
         supportsIntegrations: z.ZodDefault<z.ZodBoolean>;
         availableIntegrations: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-        config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>>;
+        config: z.ZodOptional<z.ZodObject<{
+            rpName: z.ZodOptional<z.ZodString>;
+            rpId: z.ZodOptional<z.ZodString>;
+            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
+            displayName: z.ZodOptional<z.ZodString>;
+            providerRef: z.ZodOptional<z.ZodString>;
+            connectionId: z.ZodOptional<z.ZodString>;
+            scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+            scopeId: z.ZodOptional<z.ZodString>;
+            loginUrl: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
     requiresMFA: z.ZodDefault<z.ZodBoolean>;
     mfaMethodsRequired: z.ZodDefault<z.ZodNumber>;
     enrolledSecondFactorMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
@@ -538,50 +651,90 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
     deviceInfo: z.ZodOptional<z.ZodObject<{
         userAgent: z.ZodOptional<z.ZodString>;
         ipAddress: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
     challengeData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     pendingRedirectUrl: z.ZodOptional<z.ZodURL>;
     organizationBranding: z.ZodOptional<z.ZodObject<{
-        logoUrl: z.ZodOptional<z.ZodURL>;
+        logoUrl: z.ZodOptional<z.ZodString>;
         primaryColor: z.ZodOptional<z.ZodString>;
         organizationName: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
     version: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 /**
  * Identify step form DTO — user enters email to discover auth methods.
  * Used by the public auth page's first step.
  */
 export declare const AuthIdentifyFormDtoSchema: z.ZodObject<{
-    email: z.ZodEmail;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>;
+}, z.core.$strip>;
 /**
  * Login step form DTO — user enters email + password.
  * Used by the public auth page when password auth is shown.
  * The .isPassword() decorator tells FormField to render a password input.
  */
 export declare const AuthLoginFormDtoSchema: z.ZodObject<{
-    email: z.ZodEmail;
-    password: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export declare const NativeTokenExchangeRequestSchema: z.ZodObject<{
-    provider: z.ZodEnum<{
-        apple: "apple";
-        google: "google";
-    }>;
-    identityToken: z.ZodString;
-    nonce: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export declare const NativeTokenExchangeResponseSchema: z.ZodObject<{
-    accessToken: z.ZodString;
-    refreshToken: z.ZodOptional<z.ZodString>;
-    expiresIn: z.ZodOptional<z.ZodNumber>;
-    isNewUser: z.ZodBoolean;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>;
+    password: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * MFA email OTP challenge form DTO.
+ * Used by the MFA challenge screen after the email code has been sent.
+ */
+export declare const EmailOtpChallengeFormDtoSchema: z.ZodObject<{
+    code: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * MFA SMS OTP challenge form DTO.
+ * Used by the MFA challenge screen after the SMS code has been sent.
+ */
+export declare const SmsOtpChallengeFormDtoSchema: z.ZodObject<{
+    code: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * MFA TOTP challenge form DTO.
+ * Used by the MFA challenge screen for authenticator-app verification.
+ */
+export declare const TotpChallengeFormDtoSchema: z.ZodObject<{
+    code: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Phone enrollment start form DTO.
+ * Used by the enrollment gate before sending a phone verification code.
+ */
+export declare const PhoneEnrollmentStartFormDtoSchema: z.ZodObject<{
+    phoneNumber: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Phone enrollment verification form DTO.
+ * Used by the enrollment gate after a verification code has been sent.
+ */
+export declare const PhoneEnrollmentVerifyFormDtoSchema: z.ZodObject<{
+    code: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * TOTP enrollment verification form DTO.
+ * Used after the user scans the QR code and confirms setup with a first code.
+ */
+export declare const TotpEnrollmentVerifyFormDtoSchema: z.ZodObject<{
+    code: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * One-off session token exchange response.
+ *
+ * **Wire contract — refresh token is NEVER included** (Auth-hardening
+ * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried
+ * `refreshToken: z.string()` which was emitted in the JSON body. The
+ * cookie migration (A-Step 2) routed the refresh token to
+ * `Set-Cookie: __wildo_refresh=…`; A-Step 6 removes the body field
+ * entirely so a one-off-session client receives ONLY a (short-lived)
+ * access token + the cookie. The controller's
+ * `_jsonSuccessWithRefreshCookie` helper sets the cookie from a
+ * separately-passed argument.
+ */
 export declare const OneOffTokenExchangeResponseSchema: z.ZodObject<{
     accessToken: z.ZodString;
-    refreshToken: z.ZodString;
     sessionType: z.ZodEnum<typeof SessionType>;
     consumableTokenValue: z.ZodOptional<z.ZodString>;
     tokenExpiresAt: z.ZodOptional<z.ZodString>;
@@ -590,12 +743,13 @@ export declare const OneOffTokenExchangeResponseSchema: z.ZodObject<{
         tokenType: z.ZodString;
         targeting: z.ZodOptional<z.ZodObject<{
             initiatorIds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
         organizationId: z.ZodOptional<z.ZodString>;
         applicationId: z.ZodOptional<z.ZodString>;
         userId: z.ZodString;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export * from './cross-frontend-handoff.shared.dto.schemas';
 export type AuthIdentificationRequest = z.infer<typeof AuthIdentificationRequestSchema>;
 export type AuthIdentificationResponse = z.infer<typeof AuthIdentificationResponseSchema>;
 export type AuthenticationRequest = z.infer<typeof AuthenticationRequestSchema>;
@@ -616,8 +770,12 @@ export type MFASetupRequest = z.infer<typeof MFASetupRequestSchema>;
 export type MFASetupResponse = z.infer<typeof MFASetupResponseSchema>;
 export type AuthIdentifyFormDto = z.infer<typeof AuthIdentifyFormDtoSchema>;
 export type AuthLoginFormDto = z.infer<typeof AuthLoginFormDtoSchema>;
+export type EmailOtpChallengeFormDto = z.infer<typeof EmailOtpChallengeFormDtoSchema>;
+export type SmsOtpChallengeFormDto = z.infer<typeof SmsOtpChallengeFormDtoSchema>;
+export type TotpChallengeFormDto = z.infer<typeof TotpChallengeFormDtoSchema>;
+export type PhoneEnrollmentStartFormDto = z.infer<typeof PhoneEnrollmentStartFormDtoSchema>;
+export type PhoneEnrollmentVerifyFormDto = z.infer<typeof PhoneEnrollmentVerifyFormDtoSchema>;
+export type TotpEnrollmentVerifyFormDto = z.infer<typeof TotpEnrollmentVerifyFormDtoSchema>;
 export type AuthenticationSession = z.infer<typeof AuthenticationSessionSchema>;
-export type NativeTokenExchangeRequest = z.infer<typeof NativeTokenExchangeRequestSchema>;
-export type NativeTokenExchangeResponse = z.infer<typeof NativeTokenExchangeResponseSchema>;
 export type OneOffTokenExchangeResponse = z.infer<typeof OneOffTokenExchangeResponseSchema>;
 //# sourceMappingURL=authentication.shared.dto.schemas.d.ts.map