@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/security/authentications/cross-frontend-handoff.shared.dto.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-frontend-handoff.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/cross-frontend-handoff.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,CAAN,IAAY,6BASX;AATD,WAAY,6BAA6B;IACrC,yFAAyF;IACzF,oFAAmD,CAAA;IAEnD,8JAA8J;IAC9J,4GAA2E,CAAA;IAE3E,2IAA2I;IAC3I,wHAAuF,CAAA;AAC3F,CAAC,EATW,6BAA6B,KAA7B,6BAA6B,QASxC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,mBAAmB,GAA0E;IAC/F,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACvF,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE;IACtF;;;;;OAKG;IACH,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kFAAkF,EAAE;IAC1I;;;;;;;;;;;;;;OAcG;IACH;QACI,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC;QACjD,OAAO,EAAE,yEAAyE;KACrF;IACD,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mDAAmD,EAAE;IACzG,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,2DAA2D,EAAE;IACjH,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACnH,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE;CACxG,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAA8B,MAAS;IAClE,OAAO,mBAAmB,CAAC,MAAM,CAC7B,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAiB,EAC3E,MAAM,CACT,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,qCAAqC,GAAG,sBAAsB,CAChE,CAAC;KACI,MAAM,EAAE;KACR,OAAO,CAAC,EAAE,CAAC;KACX,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC;IACnE,UAAU,EAAE,qCAAqC;CACpD,CAAC,CAAC;AAmBH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAQH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAOH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzD,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC","sourcesContent":["/**\n * Cross-Frontend Handoff DTO atoms (cross-app-jwt-propagation Step 2).\n *\n * Self-service endpoint contract that the source frontend's authenticated user\n * invokes to obtain a one-time AUTH_CODE_EXCHANGE token bound to a target\n * frontend service. The source frontend then redirects the browser to the\n * target frontend's `/auth/exchange` page, which POSTs to the existing\n * `/auth/token/exchange` endpoint to consume the code and receive a fresh\n * JWT pair.\n *\n * Built on the existing AUTH_CODE_EXCHANGE primitive (used by OAuth2 callback\n * today). Does NOT introduce a new consumable token type, a new exchange\n * endpoint, or any cookie-based transport — the contract is bearer-only and\n * piggybacks on the mature exchange + anonymous-transposition wiring.\n *\n * CORS posture: bearer-only. The endpoint reads `Authorization: Bearer …`\n * from the source frontend's session; receivers MUST NOT set\n * `withCredentials: true` on their fetch call. Every declared frontendService\n * is automatically allowed via the existing `deriveCorsOrigins()` seam.\n *\n * Why this file is split out of `authentication.shared.dto.schemas.ts`:\n *   - The parent file is 750+ lines, depends on `UserContextSchema`,\n *     `AvailableMethodSchema`, `SessionType`, `AuthMethod`, `AuthFactorLevel`,\n *     `AuthSessionPurpose`, `AuthUtils`, AND `@wildo-ai/zod-decorators`. Any\n *     browser bundle that touches a single symbol from it pays the full\n *     transitive cost (see `saas-models-public-runtime.md` K-1).\n *   - This file is intentionally minimal: ONLY `import { z } from 'zod'`. It\n *     can be safely re-exported from `@wildo-ai/saas-models/public-runtime`\n *     (saas-models-public-runtime.md K-4) without booting `initZodDecorators`\n *     or pulling `reflect-metadata`.\n *\n * DRY contract:\n *   - `authentication.shared.dto.schemas.ts` re-exports everything in this\n *     file via `export * from './cross-frontend-handoff.shared.dto.schemas'`\n *     so existing root-barrel imports\n *     (`import { CrossFrontendHandoffRequest } from '@wildo-ai/saas-models'`)\n *     keep working unchanged.\n *   - The atoms live ONLY in this file. Do NOT duplicate any declaration\n *     into the parent file — that would defeat the purpose of the split.\n *\n * Historical note — H-3 / M-7 cross-frontend-handoff incident:\n *   An earlier iteration of `engine/saas-technical-doc`'s\n *   `<AuthExchangePage>` shipped a silently-undefined\n *   `response.metadata?.returnPath` read that compiled cleanly even\n *   though `metadata` was not a key on the inferred response type. The\n *   bad read was caught by code review (M-7) and removed by reading the\n *   correct top-level `response.returnPath` instead. The cross-package\n *   `z.infer` types ARE tight when the decorator-framework runtime is\n *   booted on the consuming bundle (the docs runtime entry calls\n *   `ensureZodDecoratorsLoaded(z)` for that reason — see\n *   `engine/saas-technical-doc/src/runtime/index.ts`). The\n *   `expectTypeOf` pins in\n *   `__tests__/authentication.shared.dto.schemas.test.ts` (executed via\n *   Vitest's `typecheck.enabled` mode) defend against future regressions\n *   on the three public-runtime DTOs declared below.\n */\n\nimport { z } from 'zod';\n\nimport { isSameOriginRedirectPath } from './same-origin-redirect-path.shared';\n\n/**\n * Stable error codes for the cross-frontend handoff endpoint, returned as\n * `{ error: { code, message, context } }` with HTTP 400. Exported as a TS enum\n * so callers (notably the docs-site `docsAuthClient.ts`) can branch on the\n * code, not on the message.\n */\nexport enum CrossFrontendHandoffErrorCode {\n    /** The `targetServiceKey` is not a key in `appConfigService.config.frontendServices`. */\n    UNKNOWN_TARGET_FRONTEND = 'UNKNOWN_TARGET_FRONTEND',\n\n    /** The target service is declared but `runtime.endPoints[targetServiceKey].publicUrl` is missing for the current env. Fail-closed (no auto-derived guess). */\n    TARGET_FRONTEND_HOST_NOT_CONFIGURED = 'TARGET_FRONTEND_HOST_NOT_CONFIGURED',\n\n    /** The target service is declared, but its frontend runtime does not mount `/auth/exchange` and therefore cannot redeem a handoff code. */\n    TARGET_FRONTEND_AUTH_EXCHANGE_UNSUPPORTED = 'TARGET_FRONTEND_AUTH_EXCHANGE_UNSUPPORTED',\n}\n\n/**\n * Single source of truth for `returnPath` defense-in-depth refines.\n *\n * Two consumers apply this exact set of rules:\n *   - Issuer side (`CrossFrontendHandoff_ReturnPathSchema`): validates the\n *     request body of `POST /auth/cross-frontend-handoff`. Adds a `.default`\n *     + `.transform` to normalise empty strings to `'/'`.\n *   - Receiver side (`TokenExchangeResponseSchema.returnPath`): validates the\n *     response body of `POST /auth/token/exchange` so a corrupted /\n *     hand-tampered metadata round-trip cannot smuggle an\n *     open-redirect / path-traversal / XSS payload past the receiver schema.\n *     The schema is `.optional()` at the response level (OAuth2-callback\n *     codes don't carry a `returnPath` at all — see `TokenExchangeResponseSchema`\n *     JSDoc) so the refines only run when the field is present.\n *\n * Kept as a list (not as a single chained schema) so we can apply the\n * exact same checks to both an `optional` schema and a `default('').transform`\n * schema without duplicating the message strings. Drift between the two\n * sides would be a security regression — collapsing them onto one source\n * is the K-1 / \"framework mindset\" contract from `design-philosophy.mdc`.\n */\nconst RETURN_PATH_REFINES: ReadonlyArray<{ check: (value: string) => boolean; message: string }> = [\n    { check: (value) => value.length <= 256, message: 'returnPath exceeds 256 characters' },\n    { check: (value) => value.startsWith('/'), message: 'returnPath must start with \"/\"' },\n    /**\n     * Scheme-relative URL: `//evil.com` is interpreted by browsers as\n     * `https://evil.com` when handed to `location.assign` / `<Navigate to>`,\n     * despite passing the `startsWith('/')` check. Classic open-redirect\n     * vector — explicitly rejected here so we cannot silently regress.\n     */\n    { check: (value) => !value.startsWith('//'), message: 'returnPath must not start with \"//\" (scheme-relative URL — open-redirect vector)' },\n    /**\n     * The AUTHORITATIVE origin check, and the reason the character rules below are now\n     * defence-in-depth rather than the guarantee.\n     *\n     * Every rule in this list is a deny-list over BYTES; a browser navigates to what its URL PARSER\n     * produces. The two diverge because the parser strips ASCII tab / LF / CR from the input before\n     * parsing, so `/<TAB>/evil.com` becomes `//evil.com` and resolves cross-origin while satisfying\n     * `startsWith('/')`, `!startsWith('//')`, `!includes('\\\\')` and `!includes('://')` — i.e. every\n     * refine that was here before. Adding three more banned characters would only postpone the next\n     * parser rule, so the question is put to the parser itself.\n     *\n     * This refine is placed AFTER the cheap prefix rules deliberately: those produce a precise,\n     * actionable message for the two shapes an honest caller actually gets wrong, and this one is the\n     * catch-all that must never be reachable by an honest caller at all.\n     */\n    {\n        check: (value) => isSameOriginRedirectPath(value),\n        message: 'returnPath must resolve to a location on this application\\'s own origin',\n    },\n    { check: (value) => !value.includes('..'), message: 'returnPath must not contain \"..\" (path traversal)' },\n    { check: (value) => !value.includes('\\\\'), message: 'returnPath must not contain \"\\\\\" (Windows path injection)' },\n    { check: (value) => !value.includes('://'), message: 'returnPath must not contain \"://\" (absolute URL injection)' },\n    { check: (value) => !/[<>\"]/.test(value), message: 'returnPath must not contain \"<\", \">\", or \"\\\\\"\"' },\n];\n\n/**\n * Apply the shared `RETURN_PATH_REFINES` to any string-producing schema.\n *\n * Generic over the input schema type so the request side (which\n * pre-transforms `''` → `'/'`) and the response side (which keeps the\n * raw string verbatim) both keep their input-type fluency. The runtime\n * effect is identical: a `.refine()` chain in `RETURN_PATH_REFINES` order.\n */\nfunction applyReturnPathRefines<T extends z.ZodType<string>>(schema: T): T {\n    return RETURN_PATH_REFINES.reduce<T>(\n        (acc, { check, message }) => acc.refine(check, { message }) as unknown as T,\n        schema,\n    );\n}\n\n/**\n * Validates a `returnPath` for the cross-frontend handoff endpoint REQUEST body.\n *\n * Defense-in-depth at the schema boundary so direct API consumers cannot\n * bypass handler-level checks. The receiving frontend's `AuthExchangePage`\n * may call `location.assign(returnPath)` after exchanging the token; an\n * unvalidated path is an open-redirect / XSS / path-traversal vector.\n *\n * Rules: see `RETURN_PATH_REFINES` above (single source of truth — also\n * applied to `TokenExchangeResponseSchema.returnPath` so issuer and receiver\n * cannot drift). Additionally:\n * - Empty string is normalised to `'/'` (root) via the schema's `transform`.\n *   Refines run AFTER transform so the post-transform `'/'` is what gets\n *   validated — `''` → `'/'` → passes `startsWith('/')` → accepted.\n */\nconst CrossFrontendHandoff_ReturnPathSchema = applyReturnPathRefines(\n    z\n        .string()\n        .default('')\n        .transform((value) => (value === '' ? '/' : value)),\n);\n\n/**\n * Request body for `POST /auth/cross-frontend-handoff`.\n *\n * The caller is the user themselves, asking the backend \"issue me a one-time\n * code so I can hand my session to frontend X (with optional return path)\".\n *\n * Field semantics:\n * - `targetServiceKey` MUST be the per-service unique identity that\n *   `appConfigService.config.frontendServices` is keyed by AND that\n *   `runtime.endPoints[*]` is keyed by. **Today that identity is the\n *   `serviceName`** declared on `wildo.saas.config.ts → services.<key>.serviceName`\n *   (e.g. `'wonder-todos-docs'`, NOT the services map key `'docs'`):\n *   apps-manager's `buildManagedFrontendServicesSeed` keys\n *   `frontendServices` by `serviceName`, wildo-cli's\n *   `AppBootstrapService.buildRuntimeEndpoints` keys\n *   `APPLICATION_RUNTIME_ENDPOINTS` by `serviceName`, the\n *   `X-Frontend-Service-Name` header carries `serviceName` (via\n *   `VITE_FRONTEND_SERVICE_NAME`), and the K8s ingress builder keys\n *   per-frontend endpoints by `Object.keys(frontendServices)` — i.e.\n *   `serviceName` again. Passing the services map key (`'docs'`)\n *   instead would fail the handler's\n *   `frontendServices[body.targetServiceKey]` membership check\n *   with `UNKNOWN_TARGET_FRONTEND`. The name `targetServiceKey` is\n *   load-bearing only as \"the runtime identity an SDK consumer\n *   passes through\" — semantically it is a `frontendServiceName`.\n *   The eventual convergence on `services.<key>` as the single\n *   canonical identity is tracked under the cross-app / apps-manager\n *   workstream (a multi-PR migration touching apps-manager seeding,\n *   wildo-cli endpoint emission, the `VITE_FRONTEND_SERVICE_NAME`\n *   build-time injection, and every consumer of `lookupFrontendPublicUrl`).\n *   Renamed from the original `targetFrontendSlug` to lock the semantics\n *   in the schema, not just JSDoc — a wrong-typed body fails at parse time.\n * - `returnPath` is the path on the target frontend the user should land on\n *   AFTER the token exchange completes. Validated via\n *   `CrossFrontendHandoff_ReturnPathSchema`.\n *\n *   **Runtime vs type guarantee**: the schema applies\n *   `.default('').transform(empty → '/')` so at RUNTIME, by the time the\n *   parsed body reaches the handler, `returnPath` is always a non-empty\n *   string (defaulted to `'/'` if the caller omitted it or sent `''`).\n *   At the TYPE level, however, `z.infer<typeof CrossFrontendHandoffRequestSchema>`\n *   keeps `returnPath?: string` — TypeScript does not propagate the\n *   post-default tightening through the `.refine()` chain on a\n *   `ZodPipe<ZodDefault<…>, ZodTransform>`. Handler code therefore has\n *   two safe options:\n *     - treat `returnPath` as `string | undefined` and fall back to `'/'`\n *       defensively, OR\n *     - rely on the runtime invariant after parsing (the body NEVER reaches\n *       the handler unparsed; the controller validates it via\n *       `CrossFrontendHandoffRequestSchema.parse()` before dispatch).\n *\n *   The exported `CrossFrontendHandoffRequest` type is `z.infer` of the\n *   schema, so it matches the OUTPUT shape (with the optional-`returnPath`\n *   caveat above). For the WIRE shape (where every other field's optional\n *   semantics may differ), use `z.input<typeof CrossFrontendHandoffRequestSchema>`.\n */\nexport const CrossFrontendHandoffRequestSchema = z.strictObject({\n    targetServiceKey: z.string().min(1, 'targetServiceKey is required'),\n    returnPath: CrossFrontendHandoff_ReturnPathSchema,\n});\n\n/**\n * Output (parsed) shape of `POST /auth/cross-frontend-handoff`'s request body.\n *\n * Consumers that need the WIRE shape (where `returnPath` is `string | undefined`)\n * should use `z.input<typeof CrossFrontendHandoffRequestSchema>` instead.\n *\n * Cross-package safety: every consuming bundle MUST boot\n * `@wildo-ai/zod-decorators` once via `ensureZodDecoratorsLoaded(z)`\n * before reading `z.infer<typeof …>` on schemas exported from this file.\n * The SaaS app + backend get this for free via the saas-models root barrel\n * (which runs `initZodDecorators()` on load); the docs runtime does it\n * explicitly in `engine/saas-technical-doc/src/runtime/index.ts`. The\n * `expectTypeOf` pins in the schemas test file enforce that the inferred\n * shape stays tight; CI runs them via Vitest `typecheck.enabled` mode.\n */\nexport type CrossFrontendHandoffRequest = z.infer<typeof CrossFrontendHandoffRequestSchema>;\n\n/**\n * Response body for `POST /auth/cross-frontend-handoff`.\n *\n * Field semantics:\n * - `handoffUrl` — the URL the source frontend should redirect to:\n *   `https://<targetPublicHost>/auth/exchange?code=<token>&return=<percent-encoded-returnPath>`.\n *   Typed as `string` (not a branded URL type) because consumers immediately\n *   hand it to `location.assign()` / `<Link to>`, neither of which expects\n *   a branded type. The runtime validator enforces `z.url()` shape.\n * - `expiresAt` — ISO-8601 timestamp; the consumable token TTL is 60 seconds\n *   (shorter than OAuth2's 5 min — the user is mid-redirect, not waiting on\n *   a third-party IdP). The strict ISO refine catches a misbehaving server /\n *   fixture that emits a non-ISO string at parse time on the receiving end\n *   (the docs-chat client validates with this schema).\n */\nexport const CrossFrontendHandoffResponseSchema = z.strictObject({\n    handoffUrl: z.url(),\n    expiresAt: z.iso.datetime(),\n});\n\n/**\n * Inferred response shape — see `CrossFrontendHandoffRequest` JSDoc on the\n * cross-package `z.infer` safety contract.\n */\nexport type CrossFrontendHandoffResponse = z.infer<typeof CrossFrontendHandoffResponseSchema>;\n\n/**\n * Request body for `POST /auth/token/exchange`.\n *\n * Kept beside `TokenExchangeResponseSchema` because every consumer that can\n * receive an AUTH_CODE_EXCHANGE code must send this body. Do not let clients\n * hand-roll `{ code }` literals: the request side is part of the same public\n * runtime contract as the response and must drift in lockstep.\n */\nexport const TokenExchangeRequestSchema = z.strictObject({\n    code: z.string().min(1),\n});\n\n/**\n * Inferred request body for `POST /auth/token/exchange`.\n */\nexport type TokenExchangeRequest = z.infer<typeof TokenExchangeRequestSchema>;\n\n/**\n * Response body for `POST /auth/token/exchange` (cross-app-jwt-propagation Step 5).\n *\n * Lives in this file (rather than `authentication.shared.dto.schemas.ts`)\n * because every receiver of an AUTH_CODE_EXCHANGE token — the SaaS app, the\n * docs site — is by construction also a client-bundle target. Keeping the\n * response schema in the public-runtime-safe atom file lets those receivers\n * import the same source of truth via `@wildo-ai/saas-models/public-runtime`\n * without paying the `initZodDecorators()` boot cost\n * (saas-models-public-runtime.md K-1, K-4).\n *\n * Field semantics:\n * - `accessToken`, `expiresIn` — the freshly minted access-token response for\n *   the consuming frontend. The consumable token's metadata also carries the\n *   refresh token internally, but the exchange handler routes it to the\n *   HttpOnly cookie channel rather than the JSON body.\n * - `returnPath` — present only for handoff-issued codes (NOT OAuth2-callback\n *   codes); the path the receiving frontend should navigate to after the\n *   exchange completes. Refined with the same `RETURN_PATH_REFINES` as the\n *   issuer-side `CrossFrontendHandoff_ReturnPathSchema` (single source of\n *   truth — issuer and receiver cannot drift on which payloads are rejected).\n *   The optional+refines composition means: when absent, the field passes\n *   silently (OAuth2-callback path); when present, it MUST clear every\n *   refine, otherwise the receiver-side `.parse()` call in `tokenExchange()`\n *   throws and the response never goes out. That is intentional — a\n *   tampered metadata round-trip is a security event, not a degraded UX.\n * - `sourceFrontendServiceName`, `targetServiceKey` — present only for\n *   handoff-issued codes. Lets the receiver render telemetry / breadcrumbs\n *   (\"you came from the admin panel\") without round-tripping another API call.\n *\n * Why optional fields rather than a discriminated union: OAuth2-callback\n * codes go through the same exchange handler with the same metadata\n * skeleton minus the handoff-specific fields, so a discriminator would\n * require a synthetic `kind` field that adds no information. The optionality\n * IS the discriminator: presence of `returnPath` (or `sourceFrontendServiceName`)\n * tells the receiver \"this came from a cross-frontend handoff, treat it\n * accordingly\". This load-bearing invariant is enforced upstream by the\n * `tokenExchange()` controller, which mints the response object via\n * `if (typeof metadata.returnPath === 'string') response.returnPath = …`\n * (omit-when-absent). If a future regression starts emitting `null` or `''`\n * for OAuth2-callback codes, the receiver-side discrimination breaks\n * silently — the contract is documented here and pinned by the integration\n * test in `cross-frontend-handoff-token-exchange.integration.test.ts`.\n *\n * **H-3 history**: an early `<AuthExchangePage>` implementation read\n * `response.metadata?.returnPath` (always undefined — `metadata` is not\n * a key on the response). The bad read was caught by code review (M-7)\n * and replaced by reading the correct top-level `response.returnPath`.\n * Cross-package `z.infer<typeof TokenExchangeResponseSchema>` IS tight\n * (the same bad access today fires `TS2339: Property 'metadata' does\n * not exist`) provided the consuming bundle has booted\n * `@wildo-ai/zod-decorators` once via `ensureZodDecoratorsLoaded(z)` —\n * which the docs runtime entry does (`engine/saas-technical-doc/src/runtime/index.ts`)\n * and the SaaS app gets implicitly via the saas-models root barrel. The\n * `expectTypeOf` pins in the schemas test file enforce that the inferred\n * shape stays tight; CI runs them via Vitest `typecheck.enabled` mode.\n */\n/**\n * Token exchange response (cross-app-jwt-propagation Step 5 + OAuth2 callback).\n *\n * **Wire contract — refresh token is NEVER included** (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string()` which was emitted in the JSON body for\n * AUTH_CODE_EXCHANGE redemptions. The cookie migration (A-Step 2)\n * routed the refresh token to `Set-Cookie: __wildo_refresh=…`;\n * A-Step 6 removes the body field entirely. The receiving frontend\n * (SaaS app via `saas-frontend-lib`, or docs site via `docsAuthClient`)\n * stores the access token in memory; the SaaS app additionally\n * receives the refresh cookie automatically (same-origin browser\n * default), while the docs site has no refresh loop and re-handshakes\n * on next gated navigation when the access token expires.\n *\n * The strict-object shape pins the H-3 invariant: `returnPath` lives at\n * the TOP LEVEL — there is intentionally NO `metadata` envelope. Adding\n * an unknown key would now ALSO fire because `refreshToken` is removed\n * (a server still emitting `refreshToken` would fail strict-parse on\n * the receiver — surfacing the misalignment loudly rather than letting\n * the field silently leak through).\n */\nexport const TokenExchangeResponseSchema = z.strictObject({\n    accessToken: z.string(),\n    expiresIn: z.number(),\n    returnPath: applyReturnPathRefines(z.string()).optional(),\n    sourceFrontendServiceName: z.string().optional(),\n    targetServiceKey: z.string().optional(),\n});\n\n/**\n * Inferred response shape — see `TokenExchangeResponseSchema` JSDoc on\n * the cross-package `z.infer` safety contract (post-H-3 fix).\n */\nexport type TokenExchangeResponse = z.infer<typeof TokenExchangeResponseSchema>;\n"]}

package/dist/esm/security/authentications/password-reset.shared.dto.schemas.d.ts

@@ -10,8 +10,8 @@ import { z } from 'zod';
  * Also used as the frontend form schema for the email input step.
  */
 export declare const PasswordResetRequestDtoSchema: z.ZodObject<{
-    email: z.ZodEmail;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>;
+}, z.core.$strip>;
 export type PasswordResetRequestDto = z.infer<typeof PasswordResetRequestDtoSchema>;
 /**
  * POST /auth/password-reset/complete — API contract
@@ -21,7 +21,7 @@ export type PasswordResetRequestDto = z.infer<typeof PasswordResetRequestDtoSche
 export declare const PasswordResetCompleteDtoSchema: z.ZodObject<{
     token: z.ZodString;
     newPassword: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type PasswordResetCompleteDto = z.infer<typeof PasswordResetCompleteDtoSchema>;
 /**
  * Frontend form schema for the password reset completion step.
@@ -32,8 +32,8 @@ export type PasswordResetCompleteDto = z.infer<typeof PasswordResetCompleteDtoSc
  * The .isPassword() decorator tells FormField to render password inputs.
  */
 export declare const PasswordResetCompleteFormDtoSchema: z.ZodObject<{
-    newPassword: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-    confirmPassword: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    newPassword: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    confirmPassword: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+}, z.core.$strip>;
 export type PasswordResetCompleteFormDto = z.infer<typeof PasswordResetCompleteFormDtoSchema>;
 //# sourceMappingURL=password-reset.shared.dto.schemas.d.ts.map

package/dist/esm/security/authentications/password-reset.shared.dto.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/password-reset.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;uCAExC,CAAC;AAGH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;uCAGzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC;;;uCAG7C,CAAC;AAGH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC"}
+{"version":3,"file":"password-reset.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/password-reset.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;iBAIxC,CAAC;AAGH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;iBAGzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC;;;iBAO7C,CAAC;AAGH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC"}

package/dist/esm/security/authentications/password-reset.shared.dto.schemas.js

@@ -5,6 +5,7 @@
  * Used by both frontend (Form component) and backend (req.body parsing).
  */
 import { z } from 'zod';
+import { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';
 // ═══════════════════════════════════════════════════════════════
 // API DTOs — what goes over the wire
 // ═══════════════════════════════════════════════════════════════
@@ -13,7 +14,9 @@ import { z } from 'zod';
  * Also used as the frontend form schema for the email input step.
  */
 export const PasswordResetRequestDtoSchema = z.object({
-    email: z.email().toLowerCase(),
+    email: z.email().toLowerCase().stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },
+    }),
 });
 /**
  * POST /auth/password-reset/complete — API contract
@@ -36,7 +39,11 @@ export const PasswordResetCompleteDtoSchema = z.object({
  * The .isPassword() decorator tells FormField to render password inputs.
  */
 export const PasswordResetCompleteFormDtoSchema = z.object({
-    newPassword: z.string().min(1).isPassword(),
-    confirmPassword: z.string().min(1).isPassword(),
+    newPassword: z.string().min(1).isPassword().stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },
+    }),
+    confirmPassword: z.string().min(1).isPassword().stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },
+    }),
 });
-//# sourceMappingURL=password-reset.shared.dto.schemas.js.map
+//# sourceMappingURL=password-reset.shared.dto.schemas.js.map

package/dist/esm/security/authentications/password-reset.shared.dto.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/password-reset.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kEAAkE;AAClE,qCAAqC;AACrC,kEAAkE;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAKH,kEAAkE;AAClE,mEAAmE;AACnE,kEAAkE;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;CAChD,CAAC,CAAC"}
+{"version":3,"file":"password-reset.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/password-reset.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAEvE,kEAAkE;AAClE,qCAAqC;AACrC,kEAAkE;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;CACH,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAKH,kEAAkE;AAClE,mEAAmE;AACnE,kEAAkE;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACnD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC;CACH,CAAC,CAAC","sourcesContent":["/**\n * Password Reset — Shared DTO Schemas\n *\n * Single source of truth for password reset validation.\n * Used by both frontend (Form component) and backend (req.body parsing).\n */\n\nimport { z } from 'zod';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\n\n// ═══════════════════════════════════════════════════════════════\n// API DTOs — what goes over the wire\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/password-reset/request\n * Also used as the frontend form schema for the email input step.\n */\nexport const PasswordResetRequestDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n  }),\n});\n\n\nexport type PasswordResetRequestDto = z.infer<typeof PasswordResetRequestDtoSchema>;\n\n/**\n * POST /auth/password-reset/complete — API contract\n * Backend uses this for req.body parsing.\n * token comes from URL on the frontend, so this is NOT the form schema.\n */\nexport const PasswordResetCompleteDtoSchema = z.object({\n  token: z.string().min(1),\n  newPassword: z.string().min(1),\n});\n\n\nexport type PasswordResetCompleteDto = z.infer<typeof PasswordResetCompleteDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Form DTO — frontend form fields (token comes from URL, not form)\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * Frontend form schema for the password reset completion step.\n * Includes confirmPassword for client-side match validation.\n *\n * NOTE: The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n: t('passwordMismatch').\n * The .isPassword() decorator tells FormField to render password inputs.\n */\nexport const PasswordResetCompleteFormDtoSchema = z.object({\n  newPassword: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }),\n  confirmPassword: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }),\n});\n\n\nexport type PasswordResetCompleteFormDto = z.infer<typeof PasswordResetCompleteFormDtoSchema>;\n"]}

package/dist/esm/security/authentications/registration.shared.dto.schemas.d.ts

@@ -5,6 +5,7 @@
  * Used by both frontend (AutomatedForm component) and backend (req.body parsing).
  */
 import { z } from 'zod';
+import { AuthMethod } from './authentication.shared.schemas';
 /**
  * POST /auth/register — registration form fields.
  * Used as:
@@ -17,13 +18,13 @@ import { z } from 'zod';
  * The .isPassword() decorator tells FormField to render password inputs.
  */
 export declare const UserRegisterFormDtoSchema: z.ZodObject<{
-    email: z.ZodEmail;
-    firstName: z.ZodString;
-    lastName: z.ZodString;
-    organizationName: z.ZodOptional<z.ZodString>;
-    password: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    confirmPassword: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>;
+    firstName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    lastName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    organizationName: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    password: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    confirmPassword: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+}, z.core.$strip>;
 export type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;
 /**
  * POST /auth/register — API contract (what goes over the wire).
@@ -36,7 +37,7 @@ export declare const UserRegisterApiDtoSchema: z.ZodObject<{
     lastName: z.ZodString;
     password: z.ZodOptional<z.ZodString>;
     organizationName: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;
 /**
  * POST /auth/invitation/accept — public invitation-acceptance form fields.
@@ -48,21 +49,53 @@ export type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;
  * confirmPassword is frontend-only and excluded from the API DTO.
  */
 export declare const UserInvitationFormDtoSchema: z.ZodObject<{
-    firstName: z.ZodOptional<z.ZodString>;
-    lastName: z.ZodOptional<z.ZodString>;
-    password: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    confirmPassword: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    firstName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    lastName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    password: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    confirmPassword: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+}, z.core.$strip>;
 export type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;
+/**
+ * The first-factor credential the invitee chooses to establish at acceptance.
+ *
+ * The invitation-accept endpoint supports exactly three establishment paths (SSO-managed
+ * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):
+ * - `PASSWORD` — set a password now. When both `credentialMethod` and
+ *   `password` are omitted, intentionally activate with no local credential;
+ *   another configured authentication method can establish later sessions.
+ * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the
+ *   session is established when the invitee clicks it.
+ * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps
+ *   the session and the passkey is registered as the go-forward credential.
+ */
+export declare const INVITATION_ACCEPT_CREDENTIAL_METHODS: readonly [AuthMethod.PASSWORD, AuthMethod.MAGIC_LINK, AuthMethod.PASSKEY];
+/**
+ * The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-
+ * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are
+ * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and
+ * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift
+ * wider than the wire contract it is fed from.
+ */
+export type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];
 /**
  * POST /auth/invitation/accept — API contract.
+ *
+ * `credentialMethod` is optional by design. When absent, a provided `password`
+ * establishes a password credential; without one, acceptance activates the
+ * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are
+ * explicit because they initiate method-specific work.
  */
 export declare const UserInvitationApiDtoSchema: z.ZodObject<{
     invitationToken: z.ZodString;
-    firstName: z.ZodOptional<z.ZodString>;
-    lastName: z.ZodOptional<z.ZodString>;
+    firstName: z.ZodString;
+    lastName: z.ZodString;
     password: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    credentialMethod: z.ZodOptional<z.ZodEnum<{
+        PASSWORD: AuthMethod.PASSWORD;
+        MAGIC_LINK: AuthMethod.MAGIC_LINK;
+        PASSKEY: AuthMethod.PASSKEY;
+    }>>;
+}, z.core.$strip>;
 export type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;
 /**
  * POST /auth/invitation/reject — API contract.
@@ -70,7 +103,7 @@ export type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;
 export declare const UserInvitationRejectApiDtoSchema: z.ZodObject<{
     invitationToken: z.ZodString;
     rejectionReason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;
 /**
  * POST /auth/verify-email — API contract.
@@ -80,6 +113,6 @@ export type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiD
 export declare const EmailVerifyDtoSchema: z.ZodObject<{
     token: z.ZodString;
     email: z.ZodEmail;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;
 //# sourceMappingURL=registration.shared.dto.schemas.d.ts.map

package/dist/esm/security/authentications/registration.shared.dto.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;uCAQpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;uCAOnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;uCAKtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;uCAKrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;uCAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;uCAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"registration.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAM7D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAoBpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAOnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;iBAqBtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,2EAIvC,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC;AAErG;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;iBASrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/esm/security/authentications/registration.shared.dto.schemas.js

@@ -5,6 +5,8 @@
  * Used by both frontend (AutomatedForm component) and backend (req.body parsing).
  */
 import { z } from 'zod';
+import { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';
+import { AuthMethod } from './authentication.shared.schemas.js';
 // ═══════════════════════════════════════════════════════════════
 // Registration Form + API DTO
 // ═══════════════════════════════════════════════════════════════
@@ -20,13 +22,25 @@ import { z } from 'zod';
  * The .isPassword() decorator tells FormField to render password inputs.
  */
 export const UserRegisterFormDtoSchema = z.object({
-    email: z.email().toLowerCase(),
-    firstName: z.string().min(1).max(50),
-    lastName: z.string().min(1).max(50),
+    email: z.email().toLowerCase().stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },
+    }),
+    firstName: z.string().min(1).max(50).stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },
+    }),
+    lastName: z.string().min(1).max(50).stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },
+    }),
     /** W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. */
-    organizationName: z.string().min(1).max(200).optional(),
-    password: z.string().min(1).isPassword().optional(),
-    confirmPassword: z.string().min(1).isPassword().optional(),
+    organizationName: z.string().min(1).max(200).stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },
+    }).optional(),
+    password: z.string().min(1).isPassword().stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },
+    }).optional(),
+    confirmPassword: z.string().min(1).isPassword().stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },
+    }).optional(),
 });
 /**
  * POST /auth/register — API contract (what goes over the wire).
@@ -54,19 +68,62 @@ export const UserRegisterApiDtoSchema = z.object({
  * confirmPassword is frontend-only and excluded from the API DTO.
  */
 export const UserInvitationFormDtoSchema = z.object({
-    firstName: z.string().max(50).optional(),
-    lastName: z.string().max(50).optional(),
-    password: z.string().isPassword().optional(),
-    confirmPassword: z.string().optional(),
+    // Required, mirroring registration: the invitee establishes their identity at acceptance, and
+    // the profile seed keys on non-empty first+last (UserProfileSchema requires both).
+    // `.regex(/\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS
+    // ("  " has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`
+    // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,
+    // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the
+    // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is
+    // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).
+    firstName: z.string().min(1).max(50).regex(/\S/).stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },
+    }),
+    lastName: z.string().min(1).max(50).regex(/\S/).stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },
+    }),
+    password: z.string().isPassword().stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },
+    }).optional(),
+    confirmPassword: z.string().isPassword().stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },
+    }).optional(),
 });
+/**
+ * The first-factor credential the invitee chooses to establish at acceptance.
+ *
+ * The invitation-accept endpoint supports exactly three establishment paths (SSO-managed
+ * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):
+ * - `PASSWORD` — set a password now. When both `credentialMethod` and
+ *   `password` are omitted, intentionally activate with no local credential;
+ *   another configured authentication method can establish later sessions.
+ * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the
+ *   session is established when the invitee clicks it.
+ * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps
+ *   the session and the passkey is registered as the go-forward credential.
+ */
+export const INVITATION_ACCEPT_CREDENTIAL_METHODS = [
+    AuthMethod.PASSWORD,
+    AuthMethod.MAGIC_LINK,
+    AuthMethod.PASSKEY,
+];
 /**
  * POST /auth/invitation/accept — API contract.
+ *
+ * `credentialMethod` is optional by design. When absent, a provided `password`
+ * establishes a password credential; without one, acceptance activates the
+ * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are
+ * explicit because they initiate method-specific work.
  */
 export const UserInvitationApiDtoSchema = z.object({
     invitationToken: z.string().min(1),
-    firstName: z.string().max(50).optional(),
-    lastName: z.string().max(50).optional(),
+    // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.
+    // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary
+    // (a direct API caller can't seed a blank profile name).
+    firstName: z.string().trim().min(1).max(50),
+    lastName: z.string().trim().min(1).max(50),
     password: z.string().optional(),
+    credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),
 });
 /**
  * POST /auth/invitation/reject — API contract.
@@ -87,4 +144,4 @@ export const EmailVerifyDtoSchema = z.object({
     token: z.string().min(1),
     email: z.email().toLowerCase(),
 });
-//# sourceMappingURL=registration.shared.dto.schemas.js.map
+//# sourceMappingURL=registration.shared.dto.schemas.js.map

package/dist/esm/security/authentications/registration.shared.dto.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE;IACnD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE;IAC5C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC"}
+{"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,8FAA8F;IAC9F,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACzC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACV,CAAC;AAWX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8EAA8E;IAC9E,gFAAgF;IAChF,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC","sourcesContent":["/**\n * User Registration — Shared DTO Schemas\n *\n * Single source of truth for user registration validation.\n * Used by both frontend (AutomatedForm component) and backend (req.body parsing).\n */\n\nimport { z } from 'zod';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\nimport { AuthMethod } from './authentication.shared.schemas';\n\n// ═══════════════════════════════════════════════════════════════\n// Registration Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/register — registration form fields.\n * Used as:\n * - Frontend: AutomatedForm schema (all 5 fields rendered)\n * - Backend: req.body parsing (minus confirmPassword)\n *\n * confirmPassword is a frontend-only field for client-side match validation.\n * The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n.\n * The .isPassword() decorator tells FormField to render password inputs.\n */\nexport const UserRegisterFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n  }),\n  firstName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  /** W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. */\n  organizationName: z.string().min(1).max(200).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n  }).optional(),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\n\nexport type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;\n\n/**\n * POST /auth/register — API contract (what goes over the wire).\n * Backend uses this for req.body parsing.\n * confirmPassword is NOT sent to the backend.\n */\nexport const UserRegisterApiDtoSchema = z.object({\n  email: z.email().toLowerCase(),\n  firstName: z.string().min(1).max(50),\n  lastName: z.string().min(1).max(50),\n  password: z.string().min(1).optional(),\n  /** W6.2: Org name when orgNameSource is 'ask'. */\n  organizationName: z.string().min(1).max(200).optional(),\n});\n\n\nexport type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Invitation Acceptance DTOs\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/invitation/accept — public invitation-acceptance form fields.\n *\n * The invitation token identifies the target invitation. Name/password fields are optional\n * because an existing invited user may only need to confirm the invitation, while a new\n * invited user can provide profile/password data in the same flow.\n *\n * confirmPassword is frontend-only and excluded from the API DTO.\n */\nexport const UserInvitationFormDtoSchema = z.object({\n  // Required, mirroring registration: the invitee establishes their identity at acceptance, and\n  // the profile seed keys on non-empty first+last (UserProfileSchema requires both).\n  // `.regex(/\\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS\n  // (\"  \" has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`\n  // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,\n  // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the\n  // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is\n  // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).\n  firstName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  password: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\nexport type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;\n\n/**\n * The first-factor credential the invitee chooses to establish at acceptance.\n *\n * The invitation-accept endpoint supports exactly three establishment paths (SSO-managed\n * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):\n * - `PASSWORD` — set a password now. When both `credentialMethod` and\n *   `password` are omitted, intentionally activate with no local credential;\n *   another configured authentication method can establish later sessions.\n * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the\n *   session is established when the invitee clicks it.\n * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps\n *   the session and the passkey is registered as the go-forward credential.\n */\nexport const INVITATION_ACCEPT_CREDENTIAL_METHODS = [\n  AuthMethod.PASSWORD,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.PASSKEY,\n] as const;\n\n/**\n * The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-\n * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are\n * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and\n * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift\n * wider than the wire contract it is fed from.\n */\nexport type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];\n\n/**\n * POST /auth/invitation/accept — API contract.\n *\n * `credentialMethod` is optional by design. When absent, a provided `password`\n * establishes a password credential; without one, acceptance activates the\n * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are\n * explicit because they initiate method-specific work.\n */\nexport const UserInvitationApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.\n  // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary\n  // (a direct API caller can't seed a blank profile name).\n  firstName: z.string().trim().min(1).max(50),\n  lastName: z.string().trim().min(1).max(50),\n  password: z.string().optional(),\n  credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),\n});\n\nexport type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;\n\n/**\n * POST /auth/invitation/reject — API contract.\n */\nexport const UserInvitationRejectApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  rejectionReason: z.string().max(500).optional(),\n});\n\nexport type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Email Verification API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/verify-email — API contract.\n * Token and email are extracted from URL query parameters on the frontend.\n * Email is required for defense-in-depth constant-time comparison against token metadata.\n */\nexport const EmailVerifyDtoSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\nexport type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;\n"]}

package/dist/esm/security/authentications/same-origin-redirect-path.shared.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The ONE answer to "may the browser be navigated to this string after authentication?".
+ *
+ * ## Why this atom exists
+ *
+ * Four independent implementations of this question shipped in this repository, each a hand-written
+ * deny-list of characters, and on 2026-08-15 **all four admitted the same family of hostile inputs**:
+ *
+ * | Site | Shape |
+ * |---|---|
+ * | `saas-frontend-lib` — `isSafeAuthRedirectTarget` | `startsWith('/') && !startsWith('//')` |
+ * | `saas-frontend-lib` — `Auth_OneOffSession.sanitizeReturnPath` | the above + `..` / `\` / `://` / `<>"` / length |
+ * | `saas-technical-doc` — `AuthExchangePage.sanitizeReturnPath` | a verbatim copy of the previous row |
+ * | `saas-models` — `RETURN_PATH_REFINES` (issuer AND receiver schema) | the same rules as Zod refines |
+ *
+ * The three deny-list copies were written to "mirror" each other and did — including the hole. That
+ * is the failure mode `.claude/rules/invariant-call-site-enumeration.md` exists for, and the reason
+ * this predicate is an importable atom rather than a fifth copy: a policy expressed as a private
+ * constant reaches exactly the file that declares it.
+ *
+ * ## Why a PARSE, not a character deny-list
+ *
+ * A deny-list tests the bytes a human reads. The browser navigates to what its URL PARSER produces,
+ * and the two disagree through two normalisation rules that no reasonable author remembers:
+ *
+ * - For a SPECIAL scheme (http/https) a backslash is treated as a slash while the authority is being
+ *   consumed, so `/\evil.com` is `//evil.com`.
+ * - ASCII **tab, LF and CR are removed from the input before parsing**, anywhere in the string — so
+ *   `/<TAB>/evil.com` is also `//evil.com`.
+ *
+ * The second rule is what defeated every deny-list here: they all banned `\` and none of them banned
+ * the whitespace that becomes a `/`. Banning three more characters would leave the next parser rule
+ * uncovered, so the check asks the parser itself instead.
+ *
+ * Measured with `new URL(target, base)` — the same algorithm a browser applies to `location.href`,
+ * `location.assign` and `<Navigate to>` — these SEVEN targets resolve to `https://evil.com/` while
+ * passing a `startsWith('/') && !startsWith('//')` test:
+ * `/\evil.com`, `/\\evil.com`, `/\/evil.com`, `/<TAB>/evil.com`, `/<TAB>\evil.com`,
+ * `/<LF>/evil.com`, `/<CR>/evil.com`.
+ *
+ * spec-cite: WHATWG URL Standard — the basic URL parser removes all ASCII tab and newline from the
+ * input, and the "special authority ignore slashes state" consumes `\` interchangeably with `/`.
+ *
+ * ## Scope boundary
+ *
+ * This atom answers the ORIGIN question only. Path traversal (`..`), markup injection (`<>"`) and
+ * length ceilings are separate concerns owned by the callers that need them — collapsing them in
+ * here would make one predicate answer four questions and give a caller no way to say which one it
+ * failed.
+ *
+ * Import-free by construction (`/public-runtime` bundle budget): no `zod`, no decorators, nothing
+ * beyond the platform `URL` global, which every browser and every supported Node version provides.
+ */
+/**
+ * Does `value` denote a location on the app's OWN origin?
+ *
+ * Accepts absolute-path references only (`/dashboard`, `/a/b?c=1#d`). Everything else is refused:
+ * absolute URLs, protocol-relative references, bare-relative paths, and every input whose parsed form
+ * escapes the base by a mechanism the caller did not anticipate.
+ *
+ * The two prefix conditions are a PRECONDITION, not a duplicate of the parse: they refuse an absolute
+ * reference before it reaches the parser, so nothing can be admitted by coincidentally resolving onto
+ * the sentinel origin itself.
+ *
+ * Returns `false` — never throws — for any input, including one the URL parser rejects outright
+ * (`/\` produces an authority-less special URL and throws).
+ */
+export declare function isSameOriginRedirectPath(value: string | null | undefined): value is string;
+//# sourceMappingURL=same-origin-redirect-path.shared.d.ts.map

package/dist/esm/security/authentications/same-origin-redirect-path.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"same-origin-redirect-path.shared.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/same-origin-redirect-path.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAcH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAc1F"}

package/dist/esm/security/authentications/same-origin-redirect-path.shared.js

@@ -0,0 +1,93 @@
+/**
+ * The ONE answer to "may the browser be navigated to this string after authentication?".
+ *
+ * ## Why this atom exists
+ *
+ * Four independent implementations of this question shipped in this repository, each a hand-written
+ * deny-list of characters, and on 2026-08-15 **all four admitted the same family of hostile inputs**:
+ *
+ * | Site | Shape |
+ * |---|---|
+ * | `saas-frontend-lib` — `isSafeAuthRedirectTarget` | `startsWith('/') && !startsWith('//')` |
+ * | `saas-frontend-lib` — `Auth_OneOffSession.sanitizeReturnPath` | the above + `..` / `\` / `://` / `<>"` / length |
+ * | `saas-technical-doc` — `AuthExchangePage.sanitizeReturnPath` | a verbatim copy of the previous row |
+ * | `saas-models` — `RETURN_PATH_REFINES` (issuer AND receiver schema) | the same rules as Zod refines |
+ *
+ * The three deny-list copies were written to "mirror" each other and did — including the hole. That
+ * is the failure mode `.claude/rules/invariant-call-site-enumeration.md` exists for, and the reason
+ * this predicate is an importable atom rather than a fifth copy: a policy expressed as a private
+ * constant reaches exactly the file that declares it.
+ *
+ * ## Why a PARSE, not a character deny-list
+ *
+ * A deny-list tests the bytes a human reads. The browser navigates to what its URL PARSER produces,
+ * and the two disagree through two normalisation rules that no reasonable author remembers:
+ *
+ * - For a SPECIAL scheme (http/https) a backslash is treated as a slash while the authority is being
+ *   consumed, so `/\evil.com` is `//evil.com`.
+ * - ASCII **tab, LF and CR are removed from the input before parsing**, anywhere in the string — so
+ *   `/<TAB>/evil.com` is also `//evil.com`.
+ *
+ * The second rule is what defeated every deny-list here: they all banned `\` and none of them banned
+ * the whitespace that becomes a `/`. Banning three more characters would leave the next parser rule
+ * uncovered, so the check asks the parser itself instead.
+ *
+ * Measured with `new URL(target, base)` — the same algorithm a browser applies to `location.href`,
+ * `location.assign` and `<Navigate to>` — these SEVEN targets resolve to `https://evil.com/` while
+ * passing a `startsWith('/') && !startsWith('//')` test:
+ * `/\evil.com`, `/\\evil.com`, `/\/evil.com`, `/<TAB>/evil.com`, `/<TAB>\evil.com`,
+ * `/<LF>/evil.com`, `/<CR>/evil.com`.
+ *
+ * spec-cite: WHATWG URL Standard — the basic URL parser removes all ASCII tab and newline from the
+ * input, and the "special authority ignore slashes state" consumes `\` interchangeably with `/`.
+ *
+ * ## Scope boundary
+ *
+ * This atom answers the ORIGIN question only. Path traversal (`..`), markup injection (`<>"`) and
+ * length ceilings are separate concerns owned by the callers that need them — collapsing them in
+ * here would make one predicate answer four questions and give a caller no way to say which one it
+ * failed.
+ *
+ * Import-free by construction (`/public-runtime` bundle budget): no `zod`, no decorators, nothing
+ * beyond the platform `URL` global, which every browser and every supported Node version provides.
+ */
+/**
+ * A synthetic origin no deployment can ever be served from, used ONLY as the resolution base.
+ *
+ * Deliberately not the live origin. The question — "does this reference stay inside the site it is
+ * resolved against?" — has the same answer for every base, so binding it to ambient browser state
+ * would make the predicate untestable as a pure function and unusable on the server, where this same
+ * atom validates the issuer's request body. `.invalid` is reserved by RFC 6761 §6.4 and guaranteed
+ * never to resolve, so the sentinel can never collide with a real origin — which matters precisely
+ * because "resolved origin EQUALS the base" is the accepting condition.
+ */
+const SAME_ORIGIN_RESOLUTION_BASE = 'https://same-origin-redirect-guard.invalid/';
+/**
+ * Does `value` denote a location on the app's OWN origin?
+ *
+ * Accepts absolute-path references only (`/dashboard`, `/a/b?c=1#d`). Everything else is refused:
+ * absolute URLs, protocol-relative references, bare-relative paths, and every input whose parsed form
+ * escapes the base by a mechanism the caller did not anticipate.
+ *
+ * The two prefix conditions are a PRECONDITION, not a duplicate of the parse: they refuse an absolute
+ * reference before it reaches the parser, so nothing can be admitted by coincidentally resolving onto
+ * the sentinel origin itself.
+ *
+ * Returns `false` — never throws — for any input, including one the URL parser rejects outright
+ * (`/\` produces an authority-less special URL and throws).
+ */
+export function isSameOriginRedirectPath(value) {
+    if (!value) {
+        return false;
+    }
+    if (!value.startsWith('/') || value.startsWith('//')) {
+        return false;
+    }
+    try {
+        return new URL(value, SAME_ORIGIN_RESOLUTION_BASE).origin === new URL(SAME_ORIGIN_RESOLUTION_BASE).origin;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=same-origin-redirect-path.shared.js.map

package/dist/esm/security/authentications/same-origin-redirect-path.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"same-origin-redirect-path.shared.js","sourceRoot":"","sources":["../../../../../src/security/authentications/same-origin-redirect-path.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH;;;;;;;;;GASG;AACH,MAAM,2BAA2B,GAAG,6CAA6C,CAAC;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAgC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC,MAAM,CAAC;IAC5G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * The ONE answer to \"may the browser be navigated to this string after authentication?\".\n *\n * ## Why this atom exists\n *\n * Four independent implementations of this question shipped in this repository, each a hand-written\n * deny-list of characters, and on 2026-08-15 **all four admitted the same family of hostile inputs**:\n *\n * | Site | Shape |\n * |---|---|\n * | `saas-frontend-lib` — `isSafeAuthRedirectTarget` | `startsWith('/') && !startsWith('//')` |\n * | `saas-frontend-lib` — `Auth_OneOffSession.sanitizeReturnPath` | the above + `..` / `\\` / `://` / `<>\"` / length |\n * | `saas-technical-doc` — `AuthExchangePage.sanitizeReturnPath` | a verbatim copy of the previous row |\n * | `saas-models` — `RETURN_PATH_REFINES` (issuer AND receiver schema) | the same rules as Zod refines |\n *\n * The three deny-list copies were written to \"mirror\" each other and did — including the hole. That\n * is the failure mode `.claude/rules/invariant-call-site-enumeration.md` exists for, and the reason\n * this predicate is an importable atom rather than a fifth copy: a policy expressed as a private\n * constant reaches exactly the file that declares it.\n *\n * ## Why a PARSE, not a character deny-list\n *\n * A deny-list tests the bytes a human reads. The browser navigates to what its URL PARSER produces,\n * and the two disagree through two normalisation rules that no reasonable author remembers:\n *\n * - For a SPECIAL scheme (http/https) a backslash is treated as a slash while the authority is being\n *   consumed, so `/\\evil.com` is `//evil.com`.\n * - ASCII **tab, LF and CR are removed from the input before parsing**, anywhere in the string — so\n *   `/<TAB>/evil.com` is also `//evil.com`.\n *\n * The second rule is what defeated every deny-list here: they all banned `\\` and none of them banned\n * the whitespace that becomes a `/`. Banning three more characters would leave the next parser rule\n * uncovered, so the check asks the parser itself instead.\n *\n * Measured with `new URL(target, base)` — the same algorithm a browser applies to `location.href`,\n * `location.assign` and `<Navigate to>` — these SEVEN targets resolve to `https://evil.com/` while\n * passing a `startsWith('/') && !startsWith('//')` test:\n * `/\\evil.com`, `/\\\\evil.com`, `/\\/evil.com`, `/<TAB>/evil.com`, `/<TAB>\\evil.com`,\n * `/<LF>/evil.com`, `/<CR>/evil.com`.\n *\n * spec-cite: WHATWG URL Standard — the basic URL parser removes all ASCII tab and newline from the\n * input, and the \"special authority ignore slashes state\" consumes `\\` interchangeably with `/`.\n *\n * ## Scope boundary\n *\n * This atom answers the ORIGIN question only. Path traversal (`..`), markup injection (`<>\"`) and\n * length ceilings are separate concerns owned by the callers that need them — collapsing them in\n * here would make one predicate answer four questions and give a caller no way to say which one it\n * failed.\n *\n * Import-free by construction (`/public-runtime` bundle budget): no `zod`, no decorators, nothing\n * beyond the platform `URL` global, which every browser and every supported Node version provides.\n */\n\n/**\n * A synthetic origin no deployment can ever be served from, used ONLY as the resolution base.\n *\n * Deliberately not the live origin. The question — \"does this reference stay inside the site it is\n * resolved against?\" — has the same answer for every base, so binding it to ambient browser state\n * would make the predicate untestable as a pure function and unusable on the server, where this same\n * atom validates the issuer's request body. `.invalid` is reserved by RFC 6761 §6.4 and guaranteed\n * never to resolve, so the sentinel can never collide with a real origin — which matters precisely\n * because \"resolved origin EQUALS the base\" is the accepting condition.\n */\nconst SAME_ORIGIN_RESOLUTION_BASE = 'https://same-origin-redirect-guard.invalid/';\n\n/**\n * Does `value` denote a location on the app's OWN origin?\n *\n * Accepts absolute-path references only (`/dashboard`, `/a/b?c=1#d`). Everything else is refused:\n * absolute URLs, protocol-relative references, bare-relative paths, and every input whose parsed form\n * escapes the base by a mechanism the caller did not anticipate.\n *\n * The two prefix conditions are a PRECONDITION, not a duplicate of the parse: they refuse an absolute\n * reference before it reaches the parser, so nothing can be admitted by coincidentally resolving onto\n * the sentinel origin itself.\n *\n * Returns `false` — never throws — for any input, including one the URL parser rejects outright\n * (`/\\` produces an authority-less special URL and throws).\n */\nexport function isSameOriginRedirectPath(value: string | null | undefined): value is string {\n  if (!value) {\n    return false;\n  }\n\n  if (!value.startsWith('/') || value.startsWith('//')) {\n    return false;\n  }\n\n  try {\n    return new URL(value, SAME_ORIGIN_RESOLUTION_BASE).origin === new URL(SAME_ORIGIN_RESOLUTION_BASE).origin;\n  } catch {\n    return false;\n  }\n}\n"]}