@wildo-ai/saas-models 1.0.1

package/dist/esm/security/authentications/authentication.shared.dto.schemas.js

@@ -0,0 +1,421 @@
+/**
+ * Authentication Shared Schemas
+ *
+ * Core authentication schemas shared between frontend and backend
+ */
+import { z } from 'zod';
+import { UserContextSchema } from '../../users/users.shared.schemas.js';
+import { AuthMethod, AuthFactorLevel, AuthNextStep, AuthSessionPurpose, AvailableMethodSchema } from './authentication.shared.schemas.js';
+import { AuthUtils } from './authentication.shared.utils.js';
+import { SessionType } from '../../runtime/execution-context.shared.schemas.js';
+import { ZodTypeForColors } from '@wildo-ai/zod-decorators';
+/**
+ * Step 1: User identification by email
+ * Returns available authentication methods for the user
+ */
+export const AuthIdentificationRequestSchema = z.object({
+    email: z.email().toLowerCase(),
+    organizationId: z.string().optional(),
+    deviceInfo: z.object({
+        userAgent: z.string().optional(),
+        ipAddress: z.string().optional(),
+    }).optional()
+});
+/**
+ * Step 1 Response: Available authentication methods with factor classification
+ */
+export const AuthIdentificationResponseSchema = z.object({
+    sessionId: z.string(),
+    email: z.email(),
+    userExists: z.boolean(),
+    // First factor methods (primary authentication)
+    firstFactorMethods: z.array(AvailableMethodSchema),
+    defaultFirstFactorMethod: z.enum(AuthMethod).optional(),
+    // Second factor methods (MFA) - only shown if MFA is required
+    secondFactorMethods: z.array(AvailableMethodSchema),
+    requiresMFA: z.boolean(),
+    mfaMethodsRequired: z.number().default(1),
+    // Organization-specific information
+    organizationBranding: z.object({
+        logoUrl: z.url().optional(),
+        primaryColor: ZodTypeForColors.optional(),
+        organizationName: z.string().optional()
+    }).optional(),
+    // Available integrations (if any auth method supports them)
+    availableIntegrations: z.array(z.object({
+        integrationId: z.string(),
+        externalProviderId: z.string(), // Which auth provider enables this integration
+        iconUrl: z.url().optional()
+    })).default([]),
+    ssoMigrationRequired: z.boolean().default(false),
+});
+// ===============================
+// AUTHENTICATION REQUEST SCHEMAS
+// ===============================
+/**
+ * Base authentication request schema with factor context
+ */
+export const BaseAuthRequestSchema = z.object({
+    sessionId: z.string().min(1),
+    method: z.enum(AuthMethod),
+    factorLevel: z.enum(AuthFactorLevel),
+    rememberMe: z.boolean().default(false),
+    // Integration access request (optional)
+    requestedIntegrations: z.array(z.string()).default([])
+});
+/**
+ * Password Authentication (First factor only)
+ */
+export const PasswordAuthRequestSchema = BaseAuthRequestSchema.extend({
+    method: z.literal(AuthMethod.PASSWORD),
+    factorLevel: z.literal(AuthFactorLevel.FIRST),
+    password: z.string().min(1)
+});
+/**
+ * Third-Party OAuth2 Authentication (Any factor, extensible)
+ */
+export const External_OAuth2_AuthRequestSchema = BaseAuthRequestSchema.extend({
+    method: z.literal(AuthMethod.EXTERNAL_OAUTH2),
+    factorLevel: z.enum(AuthFactorLevel),
+    externalProviderId: z.string().min(1), // References configured provider
+    redirectUri: z.url(),
+    state: z.string().optional(), // CSRF protection
+    // Integration-specific parameters
+    additionalScopes: z.array(z.string()).default([]), // Additional scopes for integrations
+    integrationPermissions: z.array(z.string()).default([]) // Specific integration permissions
+});
+/**
+ * Organization SSO Authentication (First or second factor, organization-restricted)
+ */
+export const OrganizationSSOAuthRequestSchema = BaseAuthRequestSchema.extend({
+    method: z.enum([AuthMethod.ORG_SAML, AuthMethod.ORG_OPENID_CONNECT]),
+    factorLevel: z.enum(AuthFactorLevel),
+    ssoId: z.string().min(1),
+    organizationId: z.string().min(1),
+    // SSO-specific data
+    samlResponse: z.string().optional(), // For SAML
+    idToken: z.string().optional(), // For OpenID Connect
+    state: z.string().optional()
+});
+/**
+ * OAuth2 Callback Schema (for both third-party and SSO)
+ */
+export const OAuth2CallbackSchema = z.object({
+    sessionId: z.string().min(1),
+    externalProviderId: z.string().optional(), // For third-party OAuth2
+    ssoId: z.string().optional(), // For organization SSO
+    code: z.string().min(1),
+    state: z.string().optional(),
+    error: z.string().optional(),
+    errorDescription: z.string().optional()
+});
+/**
+ * TOTP Authentication (Second factor only)
+ */
+export const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({
+    method: z.literal(AuthMethod.TOTP),
+    factorLevel: z.literal(AuthFactorLevel.SECOND),
+    token: z.string().regex(/^(\d{6}|[a-f0-9]{8})$/)
+});
+/**
+ * SMS OTP Authentication (First or second factor)
+ */
+export const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({
+    method: z.literal(AuthMethod.SMS_OTP),
+    factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),
+    phoneNumber: z.string().regex(/^\+?[1-9]\d{1,14}$/).optional(),
+    token: z.string().regex(/^\d{4,8}$/).optional()
+});
+/**
+ * Email OTP Authentication (Second factor only)
+ */
+export const EmailOTPAuthRequestSchema = BaseAuthRequestSchema.extend({
+    method: z.literal(AuthMethod.EMAIL_OTP),
+    factorLevel: z.literal(AuthFactorLevel.SECOND),
+    token: z.string().regex(/^\d{4,8}$/).optional()
+});
+/**
+ * Passkey (WebAuthn) Authentication (First or second factor)
+ */
+export const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({
+    method: z.literal(AuthMethod.PASSKEY),
+    factorLevel: z.enum(AuthFactorLevel),
+    // WebAuthn authentication response from navigator.credentials.get()
+    response: z.object({
+        id: z.string(),
+        rawId: z.string(),
+        response: z.object({
+            authenticatorData: z.string(),
+            clientDataJSON: z.string(),
+            signature: z.string(),
+            userHandle: z.string().optional(),
+        }),
+        authenticatorAttachment: z.string().optional(),
+        clientExtensionResults: z.record(z.string(), z.any()).default({}),
+        type: z.literal('public-key'),
+    }),
+});
+// ===============================
+// MAGIC LINK SCHEMAS (Phase G2)
+// ===============================
+/**
+ * Magic Link Send Request — triggers a magic link email to the user.
+ * Separate from the main AuthenticationRequestSchema because it doesn't
+ * go through the standard authenticate() dispatch.
+ */
+export const MagicLinkSendRequestSchema = z.object({
+    email: z.email().toLowerCase(),
+    organizationId: z.string().optional(),
+});
+/**
+ * Magic Link Verify Request — verifies the token from the magic link.
+ * Used by POST /auth/magic-link/verify for programmatic verification.
+ * Intentionally NOT added to AuthenticationRequestSchema discriminated union
+ * because magic link verification follows a separate flow (GET from email click
+ * → exchange code → POST verify).
+ */
+export const MagicLinkVerifyRequestSchema = z.object({
+    token: z.string().min(1),
+    email: z.email().toLowerCase(),
+});
+// ===============================
+// PHONE VERIFICATION SCHEMAS (Phase G2)
+// ===============================
+/**
+ * Phone Verification Send Request — triggers a verification code to a phone number.
+ * Used for phone number ownership verification, separate from SMS OTP auth.
+ */
+export const PhoneVerifySendRequestSchema = z.object({
+    phoneNumber: z.string().regex(/^\+?[1-9]\d{1,14}$/),
+});
+/**
+ * Phone Verification Confirm Request — confirms the verification code.
+ */
+export const PhoneVerifyConfirmRequestSchema = z.object({
+    phoneNumber: z.string().regex(/^\+?[1-9]\d{1,14}$/),
+    code: z.string().regex(/^\d{4,8}$/),
+});
+/**
+ * Union of all authentication request types
+ */
+export const AuthenticationRequestSchema = z.discriminatedUnion('method', [
+    PasswordAuthRequestSchema,
+    External_OAuth2_AuthRequestSchema,
+    OrganizationSSOAuthRequestSchema,
+    TOTPAuthRequestSchema,
+    SMSOTPAuthRequestSchema,
+    EmailOTPAuthRequestSchema,
+    PasskeyAuthRequestSchema
+]);
+/**
+ * Authentication Response Schema with Factor Context and Integration Access
+ */
+export const AuthenticationResponseSchema = z.object({
+    success: z.boolean(),
+    sessionId: z.string(),
+    userExists: z.boolean(),
+    factorLevel: z.enum(AuthFactorLevel),
+    authMethod: z.enum(AuthMethod).optional(),
+    // Success response
+    accessToken: z.string().optional(),
+    refreshToken: z.string().optional(),
+    expiresIn: z.number().optional(),
+    user: UserContextSchema.optional(),
+    // Integration access tokens (if requested and granted)
+    integrationTokens: z.array(z.object({
+        integrationId: z.string(),
+        accessToken: z.string(),
+        refreshToken: z.string().optional(),
+        expiresIn: z.number().optional(),
+        scopes: z.array(z.string())
+    })).default([]),
+    // MFA continuation
+    requiresMFA: z.boolean().default(false),
+    availableMFAMethods: z.array(AvailableMethodSchema).optional(),
+    mfaMethodsRequired: z.number().optional(),
+    completedFactors: z.array(z.enum(AuthMethod)).optional(),
+    enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),
+    usableSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),
+    // W4.5: MFA enrollment routing
+    nextStep: z.enum(AuthNextStep).optional(),
+    availableEnrollmentMethods: z.array(z.enum(AuthMethod)).optional().default([]),
+    // Error response
+    error: z.string().optional(),
+    errorCode: z.string().optional(),
+    retryAllowed: z.boolean().default(true),
+    remainingAttempts: z.number().optional(),
+    lockoutUntil: z.date().optional(),
+    // Method-specific data
+    challengeData: z.record(z.string(), z.any()).optional(),
+    redirectUrl: z.url().optional()
+});
+// ===============================
+// MFA SETUP AND MANAGEMENT
+// ===============================
+/**
+ * MFA Setup Request
+ */
+export const MFASetupRequestSchema = z.object({
+    method: z.enum(AuthMethod),
+    phoneNumber: z.string().regex(/^\+?[1-9]\d{1,14}$/).optional(),
+    deviceName: z.string().optional()
+}).refine((data) => AuthUtils.canBeSecondFactor(data.method));
+/**
+ * MFA Setup Response
+ */
+export const MFASetupResponseSchema = z.object({
+    method: z.enum(AuthMethod),
+    setupToken: z.string(),
+    qrCodeUrl: z.url().optional(),
+    secret: z.string().optional(),
+    challenge: z.record(z.string(), z.any()).optional(),
+    recoveryCodes: z.array(z.string()).optional()
+});
+/**
+ * Authentication Session State
+ */
+export var AuthenticationSessionState;
+(function (AuthenticationSessionState) {
+    // Login flow states
+    AuthenticationSessionState["CREATED"] = "CREATED";
+    AuthenticationSessionState["IDENTIFIED"] = "IDENTIFIED";
+    AuthenticationSessionState["FIRST_FACTOR_IN_PROGRESS"] = "FIRST_FACTOR_IN_PROGRESS";
+    AuthenticationSessionState["FIRST_FACTOR_COMPLETED"] = "FIRST_FACTOR_COMPLETED";
+    AuthenticationSessionState["MFA_REQUIRED"] = "MFA_REQUIRED";
+    AuthenticationSessionState["SECOND_FACTOR_IN_PROGRESS"] = "SECOND_FACTOR_IN_PROGRESS";
+    AuthenticationSessionState["COMPLETED"] = "COMPLETED";
+    AuthenticationSessionState["PASSWORD_EXPIRED"] = "PASSWORD_EXPIRED";
+    // W4: Registration pipeline states
+    AuthenticationSessionState["REGISTERED"] = "REGISTERED";
+    AuthenticationSessionState["EMAIL_VERIFIED"] = "EMAIL_VERIFIED";
+    AuthenticationSessionState["MFA_ENROLLMENT_REQUIRED"] = "MFA_ENROLLMENT_REQUIRED";
+    AuthenticationSessionState["MFA_ENROLLMENT_GRACE"] = "MFA_ENROLLMENT_GRACE";
+    AuthenticationSessionState["ONBOARDING_PENDING"] = "ONBOARDING_PENDING";
+    // Terminal states
+    AuthenticationSessionState["FAILED"] = "FAILED";
+    AuthenticationSessionState["EXPIRED"] = "EXPIRED";
+    AuthenticationSessionState["LOCKED"] = "LOCKED"; // Account locked due to too many attempts
+})(AuthenticationSessionState || (AuthenticationSessionState = {}));
+/** W4.2: Session purpose — drives UI rendering and valid state transitions. */
+export const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);
+/**
+ * Authentication Session Schema
+ * Tracks the complete state of an authentication session
+ */
+export const AuthenticationSessionSchema = z.object({
+    sessionId: z.string(),
+    state: z.enum(AuthenticationSessionState),
+    // User identification
+    email: z.email().optional(),
+    userExists: z.boolean().optional(),
+    userId: z.string().optional(),
+    organizationId: z.string().optional(),
+    scopeType: z.enum(['organization', 'application']).optional(),
+    /** W3.5: Resolved user type for this session (from X-Frontend-Service-Name → frontendServices → userType). Drives per-user-type auth policy. */
+    activeUserType: z.string().optional(),
+    /** W4.2: Session purpose — determines valid state transitions and frontend UI. */
+    purpose: AuthSessionPurposeSchema.optional(),
+    /** W4: Next step hint for frontend routing after state transitions. */
+    nextStep: z.enum(AuthNextStep).optional(),
+    /** W4.5: ISO date when MFA grace period expires. Present when state is MFA_ENROLLMENT_GRACE. */
+    mfaGraceExpiresAt: z.string().optional(),
+    /** W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. */
+    pendingOrgType: z.string().optional(),
+    /** W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). */
+    availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),
+    // Authentication flow state
+    completedFactors: z.array(z.enum(AuthMethod)).default([]),
+    currentFactor: z.enum(AuthFactorLevel).optional(),
+    // Available methods
+    availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),
+    availableSecondFactorMethods: z.array(AvailableMethodSchema).default([]),
+    // MFA requirements
+    requiresMFA: z.boolean().default(false),
+    mfaMethodsRequired: z.number().default(1),
+    enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),
+    /** Intersection of availableSecondFactorMethods and enrolledSecondFactorMethods — methods the user can actually use for MFA challenge. */
+    usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),
+    /** When true, EMAIL_OTP alone is insufficient — requires TOTP, Passkey, or SMS_OTP. */
+    requireStrongMFA: z.boolean().default(false),
+    // Session metadata
+    createdAt: z.date(),
+    expiresAt: z.date(),
+    lastActivity: z.date(),
+    // Security tracking
+    attempts: z.number().default(0),
+    maxAttempts: z.number().default(5),
+    lockoutUntil: z.date().optional(),
+    // Device and context
+    deviceInfo: z.object({
+        userAgent: z.string().optional(),
+        ipAddress: z.string().optional(),
+    }).optional(),
+    // Integration requests
+    requestedIntegrations: z.array(z.string()).default([]),
+    // Session-specific data for ongoing flows
+    challengeData: z.record(z.string(), z.any()).optional(),
+    pendingRedirectUrl: z.url().optional(),
+    // Organization branding (cached for consistent UI)
+    organizationBranding: z.object({
+        logoUrl: z.url().optional(),
+        primaryColor: ZodTypeForColors.optional(),
+        organizationName: z.string().optional()
+    }).optional(),
+    // M1: Optimistic concurrency control version for atomic session updates
+    version: z.number().default(0),
+});
+// ===============================
+// SIMPLIFIED FORM DTOs
+// ===============================
+// Used by frontend Form components and backend body parsing.
+// These are the "what the user fills in" schemas — services add
+// programmatic fields (sessionId, method, factorLevel) before API calls.
+/**
+ * Identify step form DTO — user enters email to discover auth methods.
+ * Used by the public auth page's first step.
+ */
+export const AuthIdentifyFormDtoSchema = z.object({
+    email: z.email().toLowerCase(),
+});
+/**
+ * Login step form DTO — user enters email + password.
+ * Used by the public auth page when password auth is shown.
+ * The .isPassword() decorator tells FormField to render a password input.
+ */
+export const AuthLoginFormDtoSchema = z.object({
+    email: z.email().toLowerCase(),
+    password: z.string().min(1).isPassword(),
+});
+// ===============================
+// Native SDK Token Exchange (F2)
+// ===============================
+export const NativeTokenExchangeRequestSchema = z.object({
+    provider: z.enum(['apple', 'google']),
+    identityToken: z.string().min(1),
+    /** Random nonce generated by the mobile app before calling the native SDK. Enables replay protection. */
+    nonce: z.string().min(1).optional(),
+});
+export const NativeTokenExchangeResponseSchema = z.object({
+    accessToken: z.string(),
+    refreshToken: z.string().optional(),
+    expiresIn: z.number().optional(),
+    isNewUser: z.boolean(),
+});
+export const OneOffTokenExchangeResponseSchema = z.object({
+    accessToken: z.string(),
+    refreshToken: z.string(),
+    sessionType: z.enum(SessionType),
+    consumableTokenValue: z.string().optional(),
+    tokenExpiresAt: z.string().optional(),
+    context: z.object({
+        tokenId: z.string(),
+        tokenType: z.string(),
+        targeting: z.object({
+            initiatorIds: z.record(z.string(), z.string()).optional(),
+        }).optional(),
+        organizationId: z.string().optional(),
+        applicationId: z.string().optional(),
+        userId: z.string(),
+    }),
+});
+//# sourceMappingURL=authentication.shared.dto.schemas.js.map

package/dist/esm/security/authentications/authentication.shared.dto.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACvI,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAEvB,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEvD,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,oCAAoC;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,4DAA4D;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,+CAA+C;QAC/E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACjD,CAAC,CAAC;AAIH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC,wCAAwC;IACxC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;IACxE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB;IAEhD,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qCAAqC;IACxF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,mCAAmC;CAC5F,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,oBAAoB;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACjD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;QACF,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC;AAIH,kCAAkC;AAClC,gCAAgC;AAChC,kCAAkC;AAElC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH,kCAAkC;AAClC,wCAAwC;AACxC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACpD,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACpC,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,yBAAyB;IACzB,iCAAiC;IACjC,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEzC,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEnC,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9E,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,uBAAuB;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,kCAAkC;AAClC,2BAA2B;AAC3B,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAG9D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,oBAAoB;IACpB,iDAAmB,CAAA;IACnB,uDAAyB,CAAA;IACzB,mFAAqD,CAAA;IACrD,+EAAiD,CAAA;IACjD,2DAA6B,CAAA;IAC7B,qFAAuD,CAAA;IACvD,qDAAuB,CAAA;IACvB,mEAAqC,CAAA;IAErC,mCAAmC;IACnC,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,iFAAmD,CAAA;IACnD,2EAA6C,CAAA;IAC7C,uEAAyC,CAAA;IAEzC,kBAAkB;IAClB,+CAAiB,CAAA;IACjB,iDAAmB,CAAA;IACnB,+CAAiB,CAAA,CAA8B,0CAA0C;AAC3F,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAEzC,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE7D,gJAAgJ;IAChJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,kFAAkF;IAClF,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE5C,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAEzC,gGAAgG;IAChG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,wHAAwH;IACxH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEnE,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAEjD,oBAAoB;IACpB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAExE,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,0IAA0I;IAC1I,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE5C,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IAEtB,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,mDAAmD;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAClC,6DAA6D;AAC7D,gEAAgE;AAChE,yEAAyE;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;CACzC,CAAC,CAAC;AAKH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,yGAAyG;IACzG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC1D,CAAC,CAAC,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACH,CAAC,CAAC"}

package/dist/esm/security/authentications/authentication.shared.schemas.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Authentication Shared Schemas
+ *
+ * Core authentication schemas shared between frontend and backend
+ */
+import { z } from 'zod';
+import type { PolymorphicVariantDefinition } from '../../resources/utils/resource-polymorphism.schemas.js';
+/**
+ * Auth Scope Variants (Shared)
+ *
+ * The 2 auth scope variants — shared across all auth polymorphic resources
+ * (SsoConfig, SsoConnection, AuthPolicy, SiemExportConfig, SiemDeliveryDlq,
+ *  ScimTokens, ScimProvisioningConfig).
+ *
+ */
+export declare const AUTH_SCOPE_VARIANTS: PolymorphicVariantDefinition[];
+/**
+ * Authentication Factor Classification
+ * Defines when an authentication method can be used in the flow
+ */
+export declare enum AuthFactorType {
+    FIRST_ONLY = "FIRST_ONLY",// Can only be used as first factor (primary auth)
+    SECOND_ONLY = "SECOND_ONLY",// Can only be used as second factor (MFA)
+    FIRST_OR_SECOND = "FIRST_OR_SECOND",// Can be used as either first or second factor
+    ANY = "ANY"
+}
+/**
+ * Authentication Method Categories
+ * Separates different types of authentication methods by scope and configuration
+ */
+export declare enum AuthMethodCategory {
+    CREDENTIAL = "CREDENTIAL",// Password-based credentials
+    EXTERNAL_OAUTH2 = "EXTERNAL_OAUTH2",// Extensible third-party SaaS OAuth2 (application-level)
+    ORG_SSO = "ORG_SSO",// Organization-restricted SSO (SAML/OpenID Connect)
+    MFA_TOKEN = "MFA_TOKEN",// Time-based or generated tokens for MFA
+    BIOMETRIC = "BIOMETRIC"
+}
+/**
+ * Authentication Method Types with Factor Classification and Categories
+ * Core authentication methods - extensible at application level
+ */
+export declare enum AuthMethod {
+    PASSWORD = "PASSWORD",
+    EXTERNAL_OAUTH2 = "EXTERNAL_OAUTH2",// Generic extensible OAuth2 provider
+    ORG_SAML = "ORG_SAML",// Organization SAML SSO
+    ORG_OPENID_CONNECT = "ORG_OPENID_CONNECT",// Organization OpenID Connect SSO
+    MAGIC_LINK = "MAGIC_LINK",// Magic Link via email
+    TOTP = "TOTP",// Time-based One-Time Password
+    SMS_OTP = "SMS_OTP",// SMS One-Time Password
+    EMAIL_OTP = "EMAIL_OTP",// Email One-Time Password
+    PASSKEY = "PASSKEY"
+}
+/**
+ * Authentication Factor Levels
+ */
+export declare enum AuthFactor {
+    SINGLE = "SINGLE",// Single factor authentication
+    MULTI = "MULTI"
+}
+/**
+ * Authentication Factor Level (First or Second Factor)
+ */
+export declare enum AuthFactorLevel {
+    IDENTIFICATION = "IDENTIFICATION",// Identification only
+    FIRST = "FIRST",// First factor authentication
+    SECOND = "SECOND"
+}
+/**
+ * W4: Next step hint for frontend routing after auth state transitions.
+ * Drives UI flow (MFA enrollment, onboarding, email verification, etc.).
+ */
+export declare enum AuthNextStep {
+    MFA_ENROLLMENT = "mfa_enrollment",
+    ONBOARDING = "onboarding",
+    COMPLETE = "complete",
+    EMAIL_VERIFICATION = "email_verification",
+    PASSWORD_CHANGE = "password_change"
+}
+/**
+ * W4.2: Session purpose — drives UI rendering and valid state transitions.
+ */
+export declare enum AuthSessionPurpose {
+    LOGIN = "login",
+    REGISTRATION = "registration",
+    INVITATION = "invitation",
+    REAUTH = "reauth",
+    DEVICE_AUTH = "device_auth"
+}
+/**
+ * W4.6: MFA enrollment lifecycle state on UserCredentials.
+ * Computed at user creation and updated on enrollment completion.
+ */
+export declare enum MfaEnrollmentState {
+    NOT_REQUIRED = "not_required",
+    PENDING = "pending",
+    GRACE = "grace",
+    ENROLLED = "enrolled"
+}
+/**
+ * Authentication Method Factor Classification Map
+ */
+export declare const AUTH_METHOD_FACTOR_MAP: Record<AuthMethod, AuthFactorType>;
+/**
+ * Authentication Method Category Map
+ */
+export declare const AUTH_METHOD_CATEGORY_MAP: Record<AuthMethod, AuthMethodCategory>;
+export declare const AvailableMethodSchema: z.ZodObject<{
+    method: z.ZodEnum<typeof AuthMethod>;
+    factorType: z.ZodEnum<typeof AuthFactorType>;
+    category: z.ZodEnum<typeof AuthMethodCategory>;
+    canBeFirstFactor: z.ZodBoolean;
+    canBeSecondFactor: z.ZodBoolean;
+    required: z.ZodBoolean;
+    oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    organizationRestricted: z.ZodDefault<z.ZodBoolean>;
+    supportsIntegrations: z.ZodDefault<z.ZodBoolean>;
+    availableIntegrations: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type AvailableMethod = z.infer<typeof AvailableMethodSchema>;
+/**
+ * Error codes used in redirect query params (backend → frontend).
+ * Backend appends `?error=<code>` to redirect URLs; frontend reads and displays.
+ */
+export declare enum AuthRedirectErrorCode {
+    SAML_LOGIN_FAILED = "saml_login_failed",
+    SAML_AUTH_FAILED = "saml_auth_failed",
+    SAML_SLO_FAILED = "saml_slo_failed",
+    MISSING_PARAMS = "missing_params",
+    OAUTH_FAILED = "oauth_failed"
+}
+/**
+ * Scope type for auth policies — organization-level vs application-level.
+ */
+export declare enum AuthScopeType {
+    ORGANIZATION = "organization",
+    APPLICATION = "application"
+}
+//# sourceMappingURL=authentication.shared.schemas.d.ts.map

package/dist/esm/security/authentications/authentication.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AAExG;;;;;;;GAOG;AAGH,eAAO,MAAM,mBAAmB,EAAE,4BAA4B,EAG7D,CAAC;AAOF;;;GAGG;AACH,oBAAY,cAAc;IACxB,UAAU,eAAe,CAAQ,kDAAkD;IACnF,WAAW,gBAAgB,CAAM,0CAA0C;IAC3E,eAAe,oBAAoB,CAAE,+CAA+C;IACpF,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,UAAU,eAAe,CAAY,6BAA6B;IAClE,eAAe,oBAAoB,CAAE,yDAAyD;IAC9F,OAAO,YAAY,CAAiB,oDAAoD;IACxF,SAAS,cAAc,CAAa,yCAAyC;IAC7E,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,oBAAY,UAAU;IAEpB,QAAQ,aAAa;IAGrB,eAAe,oBAAoB,CAAE,qCAAqC;IAG1E,QAAQ,aAAa,CAAsB,wBAAwB;IACnE,kBAAkB,uBAAuB,CAAE,kCAAkC;IAG7E,UAAU,eAAe,CAAO,uBAAuB;IAGvD,IAAI,SAAS,CAAqB,+BAA+B;IACjE,OAAO,YAAY,CAAc,wBAAwB;IACzD,SAAS,cAAc,CAAU,0BAA0B;IAG3D,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,UAAU;IACpB,MAAM,WAAW,CAAQ,+BAA+B;IACxD,KAAK,UAAU;CAChB;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,cAAc,mBAAmB,CAAE,sBAAsB;IACzD,KAAK,UAAU,CAAU,8BAA8B;IACvD,MAAM,WAAW;CAClB;AAED;;;GAGG;AACH,oBAAY,YAAY;IACtB,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;CACpC;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IACzB,MAAM,WAAW;IACjB,WAAW,gBAAgB;CAC5B;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,QAAQ,aAAa;CACtB;AAMD;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,CAmBrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAU3E,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;uCAmBhC,CAAC;AAGH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,oBAAY,qBAAqB;IAC/B,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B;AAED;;GAEG;AACH,oBAAY,aAAa;IACvB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;CAC5B"}