@wildo-ai/saas-models 1.0.1

package/dist/esm/security/authentications/authentication.shared.schemas.js

@@ -0,0 +1,195 @@
+/**
+ * Authentication Shared Schemas
+ *
+ * Core authentication schemas shared between frontend and backend
+ */
+import { z } from 'zod';
+import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
+/**
+ * Auth Scope Variants (Shared)
+ *
+ * The 2 auth scope variants — shared across all auth polymorphic resources
+ * (SsoConfig, SsoConnection, AuthPolicy, SiemExportConfig, SiemDeliveryDlq,
+ *  ScimTokens, ScimProvisioningConfig).
+ *
+ */
+export const AUTH_SCOPE_VARIANTS = [
+    { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },
+    { parentResourceType: CoreResourceType.APPLICATION, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION], isPrimaryScope: true },
+];
+// ===============================
+// AUTHENTICATION METHOD DEFINITIONS
+// ===============================
+/**
+ * Authentication Factor Classification
+ * Defines when an authentication method can be used in the flow
+ */
+export var AuthFactorType;
+(function (AuthFactorType) {
+    AuthFactorType["FIRST_ONLY"] = "FIRST_ONLY";
+    AuthFactorType["SECOND_ONLY"] = "SECOND_ONLY";
+    AuthFactorType["FIRST_OR_SECOND"] = "FIRST_OR_SECOND";
+    AuthFactorType["ANY"] = "ANY"; // Can be used in any context (first, second, or standalone)
+})(AuthFactorType || (AuthFactorType = {}));
+/**
+ * Authentication Method Categories
+ * Separates different types of authentication methods by scope and configuration
+ */
+export var AuthMethodCategory;
+(function (AuthMethodCategory) {
+    AuthMethodCategory["CREDENTIAL"] = "CREDENTIAL";
+    AuthMethodCategory["EXTERNAL_OAUTH2"] = "EXTERNAL_OAUTH2";
+    AuthMethodCategory["ORG_SSO"] = "ORG_SSO";
+    AuthMethodCategory["MFA_TOKEN"] = "MFA_TOKEN";
+    AuthMethodCategory["BIOMETRIC"] = "BIOMETRIC"; // Modern biometric/passwordless methods
+})(AuthMethodCategory || (AuthMethodCategory = {}));
+/**
+ * Authentication Method Types with Factor Classification and Categories
+ * Core authentication methods - extensible at application level
+ */
+export var AuthMethod;
+(function (AuthMethod) {
+    // Credential-based (First factor only)
+    AuthMethod["PASSWORD"] = "PASSWORD";
+    // Third-party SaaS OAuth2 (Application-level, extensible, any factor)
+    AuthMethod["EXTERNAL_OAUTH2"] = "EXTERNAL_OAUTH2";
+    // Organization-restricted SSO (First or second factor)
+    AuthMethod["ORG_SAML"] = "ORG_SAML";
+    AuthMethod["ORG_OPENID_CONNECT"] = "ORG_OPENID_CONNECT";
+    // Passwordless (First factor only)
+    AuthMethod["MAGIC_LINK"] = "MAGIC_LINK";
+    // MFA tokens (Second factor only, except SMS_OTP which is FIRST_OR_SECOND)
+    AuthMethod["TOTP"] = "TOTP";
+    AuthMethod["SMS_OTP"] = "SMS_OTP";
+    AuthMethod["EMAIL_OTP"] = "EMAIL_OTP";
+    // Biometric/Modern (First or second factor)
+    AuthMethod["PASSKEY"] = "PASSKEY"; // WebAuthn/FIDO2 Passkeys
+})(AuthMethod || (AuthMethod = {}));
+/**
+ * Authentication Factor Levels
+ */
+export var AuthFactor;
+(function (AuthFactor) {
+    AuthFactor["SINGLE"] = "SINGLE";
+    AuthFactor["MULTI"] = "MULTI"; // Multi-factor authentication required
+})(AuthFactor || (AuthFactor = {}));
+/**
+ * Authentication Factor Level (First or Second Factor)
+ */
+export var AuthFactorLevel;
+(function (AuthFactorLevel) {
+    AuthFactorLevel["IDENTIFICATION"] = "IDENTIFICATION";
+    AuthFactorLevel["FIRST"] = "FIRST";
+    AuthFactorLevel["SECOND"] = "SECOND"; // Second factor authentication (MFA)
+})(AuthFactorLevel || (AuthFactorLevel = {}));
+/**
+ * W4: Next step hint for frontend routing after auth state transitions.
+ * Drives UI flow (MFA enrollment, onboarding, email verification, etc.).
+ */
+export var AuthNextStep;
+(function (AuthNextStep) {
+    AuthNextStep["MFA_ENROLLMENT"] = "mfa_enrollment";
+    AuthNextStep["ONBOARDING"] = "onboarding";
+    AuthNextStep["COMPLETE"] = "complete";
+    AuthNextStep["EMAIL_VERIFICATION"] = "email_verification";
+    AuthNextStep["PASSWORD_CHANGE"] = "password_change";
+})(AuthNextStep || (AuthNextStep = {}));
+/**
+ * W4.2: Session purpose — drives UI rendering and valid state transitions.
+ */
+export var AuthSessionPurpose;
+(function (AuthSessionPurpose) {
+    AuthSessionPurpose["LOGIN"] = "login";
+    AuthSessionPurpose["REGISTRATION"] = "registration";
+    AuthSessionPurpose["INVITATION"] = "invitation";
+    AuthSessionPurpose["REAUTH"] = "reauth";
+    AuthSessionPurpose["DEVICE_AUTH"] = "device_auth";
+})(AuthSessionPurpose || (AuthSessionPurpose = {}));
+/**
+ * W4.6: MFA enrollment lifecycle state on UserCredentials.
+ * Computed at user creation and updated on enrollment completion.
+ */
+export var MfaEnrollmentState;
+(function (MfaEnrollmentState) {
+    MfaEnrollmentState["NOT_REQUIRED"] = "not_required";
+    MfaEnrollmentState["PENDING"] = "pending";
+    MfaEnrollmentState["GRACE"] = "grace";
+    MfaEnrollmentState["ENROLLED"] = "enrolled";
+})(MfaEnrollmentState || (MfaEnrollmentState = {}));
+// ===============================
+// AUTHENTICATION METHOD CLASSIFICATION
+// ===============================
+/**
+ * Authentication Method Factor Classification Map
+ */
+export const AUTH_METHOD_FACTOR_MAP = {
+    // First factor only - Primary credentials
+    [AuthMethod.PASSWORD]: AuthFactorType.FIRST_ONLY,
+    // First factor only - Passwordless via email
+    [AuthMethod.MAGIC_LINK]: AuthFactorType.FIRST_ONLY,
+    // First factor only - SSO redirect flows are not MFA ceremonies (B-SEC-1)
+    [AuthMethod.EXTERNAL_OAUTH2]: AuthFactorType.FIRST_ONLY,
+    [AuthMethod.ORG_SAML]: AuthFactorType.FIRST_ONLY,
+    [AuthMethod.ORG_OPENID_CONNECT]: AuthFactorType.FIRST_ONLY,
+    // Second factor only - MFA tokens (except SMS_OTP which can be first or second)
+    [AuthMethod.TOTP]: AuthFactorType.SECOND_ONLY,
+    [AuthMethod.SMS_OTP]: AuthFactorType.FIRST_OR_SECOND,
+    [AuthMethod.EMAIL_OTP]: AuthFactorType.SECOND_ONLY,
+    // First or second factor - Modern biometric
+    [AuthMethod.PASSKEY]: AuthFactorType.FIRST_OR_SECOND
+};
+/**
+ * Authentication Method Category Map
+ */
+export const AUTH_METHOD_CATEGORY_MAP = {
+    [AuthMethod.PASSWORD]: AuthMethodCategory.CREDENTIAL,
+    [AuthMethod.MAGIC_LINK]: AuthMethodCategory.CREDENTIAL,
+    [AuthMethod.EXTERNAL_OAUTH2]: AuthMethodCategory.EXTERNAL_OAUTH2,
+    [AuthMethod.ORG_SAML]: AuthMethodCategory.ORG_SSO,
+    [AuthMethod.ORG_OPENID_CONNECT]: AuthMethodCategory.ORG_SSO,
+    [AuthMethod.TOTP]: AuthMethodCategory.MFA_TOKEN,
+    [AuthMethod.SMS_OTP]: AuthMethodCategory.MFA_TOKEN,
+    [AuthMethod.EMAIL_OTP]: AuthMethodCategory.MFA_TOKEN,
+    [AuthMethod.PASSKEY]: AuthMethodCategory.BIOMETRIC
+};
+export const AvailableMethodSchema = z.object({
+    method: z.enum(AuthMethod),
+    factorType: z.enum(AuthFactorType),
+    category: z.enum(AuthMethodCategory),
+    canBeFirstFactor: z.boolean(),
+    canBeSecondFactor: z.boolean(),
+    required: z.boolean(),
+    // Provider-specific information
+    oauth2ProviderRefs: z.array(z.string()).optional(), // For third-party OAuth2
+    ssoIds: z.array(z.string()).optional(), // For organization SSO
+    organizationRestricted: z.boolean().default(false),
+    // Integration capabilities
+    supportsIntegrations: z.boolean().default(false),
+    availableIntegrations: z.array(z.string()).default([]).optional(),
+    // Public configuration
+    config: z.record(z.string(), z.any()).optional()
+});
+// ===============================
+// CROSS-LAYER CONSTANTS
+// ===============================
+/**
+ * Error codes used in redirect query params (backend → frontend).
+ * Backend appends `?error=<code>` to redirect URLs; frontend reads and displays.
+ */
+export var AuthRedirectErrorCode;
+(function (AuthRedirectErrorCode) {
+    AuthRedirectErrorCode["SAML_LOGIN_FAILED"] = "saml_login_failed";
+    AuthRedirectErrorCode["SAML_AUTH_FAILED"] = "saml_auth_failed";
+    AuthRedirectErrorCode["SAML_SLO_FAILED"] = "saml_slo_failed";
+    AuthRedirectErrorCode["MISSING_PARAMS"] = "missing_params";
+    AuthRedirectErrorCode["OAUTH_FAILED"] = "oauth_failed";
+})(AuthRedirectErrorCode || (AuthRedirectErrorCode = {}));
+/**
+ * Scope type for auth policies — organization-level vs application-level.
+ */
+export var AuthScopeType;
+(function (AuthScopeType) {
+    AuthScopeType["ORGANIZATION"] = "organization";
+    AuthScopeType["APPLICATION"] = "application";
+})(AuthScopeType || (AuthScopeType = {}));
+//# sourceMappingURL=authentication.shared.schemas.js.map

package/dist/esm/security/authentications/authentication.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAGzH;;;;;;;GAOG;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAmC;IACjE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAGF,kCAAkC;AAClC,oCAAoC;AACpC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,cAKX;AALD,WAAY,cAAc;IACxB,2CAAyB,CAAA;IACzB,6CAA2B,CAAA;IAC3B,qDAAmC,CAAA;IACnC,6BAAW,CAAA,CAAsB,4DAA4D;AAC/F,CAAC,EALW,cAAc,KAAd,cAAc,QAKzB;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,yDAAmC,CAAA;IACnC,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;IACvB,6CAAuB,CAAA,CAAa,wCAAwC;AAC9E,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,UAqBX;AArBD,WAAY,UAAU;IACpB,uCAAuC;IACvC,mCAAqB,CAAA;IAErB,sEAAsE;IACtE,iDAAmC,CAAA;IAEnC,uDAAuD;IACvD,mCAAqB,CAAA;IACrB,uDAAyC,CAAA;IAEzC,mCAAmC;IACnC,uCAAyB,CAAA;IAEzB,2EAA2E;IAC3E,2BAAa,CAAA;IACb,iCAAmB,CAAA;IACnB,qCAAuB,CAAA;IAEvB,4CAA4C;IAC5C,iCAAmB,CAAA,CAAc,0BAA0B;AAC7D,CAAC,EArBW,UAAU,KAAV,UAAU,QAqBrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,6BAAe,CAAA,CAAU,uCAAuC;AAClE,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,oDAAiC,CAAA;IACjC,kCAAe,CAAA;IACf,oCAAiB,CAAA,CAAQ,qCAAqC;AAChE,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,YAMX;AAND,WAAY,YAAY;IACtB,iDAAiC,CAAA;IACjC,yCAAyB,CAAA;IACzB,qCAAqB,CAAA;IACrB,yDAAyC,CAAA;IACzC,mDAAmC,CAAA;AACrC,CAAC,EANW,YAAY,KAAZ,YAAY,QAMvB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mDAA6B,CAAA;IAC7B,+CAAyB,CAAA;IACzB,uCAAiB,CAAA;IACjB,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,yCAAmB,CAAA;IACnB,qCAAe,CAAA;IACf,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,kCAAkC;AAClC,uCAAuC;AACvC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,0CAA0C;IAC1C,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAEhD,6CAA6C;IAC7C,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU;IAElD,0EAA0E;IAC1E,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,UAAU;IACvD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAChD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,cAAc,CAAC,UAAU;IAE1D,gFAAgF;IAChF,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,WAAW;IAC7C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;IACpD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW;IAElD,4CAA4C;IAC5C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;CACrD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2C;IAC9E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACpD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACtD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,eAAe;IAChE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,OAAO;IACjD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,OAAO;IAC3D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAC/C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAClD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,SAAS;IACpD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAErB,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAC7E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IAC/D,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAElD,2BAA2B;IAC3B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,uBAAuB;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAKH,kCAAkC;AAClC,wBAAwB;AACxB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,gEAAuC,CAAA;IACvC,8DAAqC,CAAA;IACrC,4DAAmC,CAAA;IACnC,0DAAiC,CAAA;IACjC,sDAA6B,CAAA;AAC/B,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,8CAA6B,CAAA;IAC7B,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB"}

package/dist/esm/security/authentications/authentication.shared.utils.d.ts

@@ -0,0 +1,67 @@
+import { AuthMethod, AuthFactorType } from './authentication.shared.schemas.js';
+import { AuthMethodCategory } from './authentication.shared.schemas.js';
+import { PasswordPolicyRules } from '../../config/app-configuration-shared.shared.schemas.js';
+/**
+ * Helper functions for authentication factor classification
+ */
+export declare class AuthUtils {
+    /**
+     * Check if method can be used as first factor
+     */
+    static canBeFirstFactor(method: AuthMethod): boolean;
+    /**
+     * Check if method can be used as second factor (MFA)
+     */
+    static canBeSecondFactor(method: AuthMethod): boolean;
+    /**
+     * Get all methods that can be used as first factor
+     */
+    static getFirstFactorMethods(): AuthMethod[];
+    /**
+     * Get all methods that can be used as second factor
+     */
+    static getSecondFactorMethods(): AuthMethod[];
+    /**
+     * Get factor classification for a method
+     */
+    static getFactorType(method: AuthMethod): AuthFactorType;
+    /**
+     * Get category for a method
+     */
+    static getMethodCategory(method: AuthMethod): AuthMethodCategory;
+    /**
+     * Check if method is organization-restricted
+     */
+    static isOrganizationRestricted(method: AuthMethod): boolean;
+    /**
+     * Check if method supports integration access
+     */
+    static supportsIntegrationAccess(method: AuthMethod): boolean;
+    /**
+     * Validate if a method is appropriate for the current factor level
+     */
+    static validateMethodForFactor(method: AuthMethod, isFirstFactor: boolean): boolean;
+    /**
+     * Determine which second-factor methods a user has actually enrolled,
+     * based on their credential record. Mirrors the enrollment check in
+     * AuthenticationOrchestratorBackendService._shouldRequireMFA().
+     */
+    static getEnrolledSecondFactorMethods(cred: {
+        totpVerified?: boolean;
+        passkeyCredentials?: unknown[];
+        phoneNumberVerified?: boolean;
+    } | null | undefined): AuthMethod[];
+    /**
+     * Validate a password against policy rules.
+     * Returns an object with `valid` flag and an array of `violations` (i18n label keys).
+     *
+     * Single source of truth for password policy validation — used by both frontend
+     * (real-time validation) and backend (AuthCredentialVerifierBackendService).
+     * Frontend resolves violations via t(violationCode) with {minLength}/{maxLength} replacement.
+     */
+    static validatePasswordAgainstPolicy(password: string, policy: PasswordPolicyRules): {
+        valid: boolean;
+        violations: string[];
+    };
+}
+//# sourceMappingURL=authentication.shared.utils.d.ts.map

package/dist/esm/security/authentications/authentication.shared.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAoD,MAAM,iCAAiC,CAAC;AAC/H,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAA+B,MAAM,sDAAsD,CAAC;AAGxH;;GAEG;AACH,qBAAa,SAAS;IACpB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOpD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOrD;;OAEG;IACH,MAAM,CAAC,qBAAqB,IAAI,UAAU,EAAE;IAU5C;;OAEG;IACH,MAAM,CAAC,sBAAsB,IAAI,UAAU,EAAE;IAU7C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc;IAIxD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB;IAIhE;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAI5D;;OAEG;IACH,MAAM,CAAC,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAK7D;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO;IAOnF;;;;OAIG;IACH,MAAM,CAAC,8BAA8B,CAAC,IAAI,EAAE;QAC1C,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE;IAUnC;;;;;;;OAOG;IACH,MAAM,CAAC,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;CAyB9H"}

package/dist/esm/security/authentications/authentication.shared.utils.js

@@ -0,0 +1,126 @@
+import { AuthMethod, AuthFactorType, AUTH_METHOD_FACTOR_MAP, AUTH_METHOD_CATEGORY_MAP } from './authentication.shared.schemas.js';
+import { AuthMethodCategory } from './authentication.shared.schemas.js';
+import { PasswordPolicyViolationCode } from '../../config/app-configuration-shared.shared.schemas.js';
+/**
+ * Helper functions for authentication factor classification
+ */
+export class AuthUtils {
+    /**
+     * Check if method can be used as first factor
+     */
+    static canBeFirstFactor(method) {
+        const factorType = AUTH_METHOD_FACTOR_MAP[method];
+        return factorType === AuthFactorType.FIRST_ONLY ||
+            factorType === AuthFactorType.FIRST_OR_SECOND ||
+            factorType === AuthFactorType.ANY;
+    }
+    /**
+     * Check if method can be used as second factor (MFA)
+     */
+    static canBeSecondFactor(method) {
+        const factorType = AUTH_METHOD_FACTOR_MAP[method];
+        return factorType === AuthFactorType.SECOND_ONLY ||
+            factorType === AuthFactorType.FIRST_OR_SECOND ||
+            factorType === AuthFactorType.ANY;
+    }
+    /**
+     * Get all methods that can be used as first factor
+     */
+    static getFirstFactorMethods() {
+        return Object.entries(AUTH_METHOD_FACTOR_MAP)
+            .filter(([_, factorType]) => factorType === AuthFactorType.FIRST_ONLY ||
+            factorType === AuthFactorType.FIRST_OR_SECOND ||
+            factorType === AuthFactorType.ANY)
+            .map(([method]) => method);
+    }
+    /**
+     * Get all methods that can be used as second factor
+     */
+    static getSecondFactorMethods() {
+        return Object.entries(AUTH_METHOD_FACTOR_MAP)
+            .filter(([_, factorType]) => factorType === AuthFactorType.SECOND_ONLY ||
+            factorType === AuthFactorType.FIRST_OR_SECOND ||
+            factorType === AuthFactorType.ANY)
+            .map(([method]) => method);
+    }
+    /**
+     * Get factor classification for a method
+     */
+    static getFactorType(method) {
+        return AUTH_METHOD_FACTOR_MAP[method];
+    }
+    /**
+     * Get category for a method
+     */
+    static getMethodCategory(method) {
+        return AUTH_METHOD_CATEGORY_MAP[method];
+    }
+    /**
+     * Check if method is organization-restricted
+     */
+    static isOrganizationRestricted(method) {
+        return AUTH_METHOD_CATEGORY_MAP[method] === AuthMethodCategory.ORG_SSO;
+    }
+    /**
+     * Check if method supports integration access
+     */
+    static supportsIntegrationAccess(method) {
+        return AUTH_METHOD_CATEGORY_MAP[method] === AuthMethodCategory.EXTERNAL_OAUTH2 ||
+            AUTH_METHOD_CATEGORY_MAP[method] === AuthMethodCategory.ORG_SSO;
+    }
+    /**
+     * Validate if a method is appropriate for the current factor level
+     */
+    static validateMethodForFactor(method, isFirstFactor) {
+        return isFirstFactor ? this.canBeFirstFactor(method) : this.canBeSecondFactor(method);
+    }
+    /**
+     * Determine which second-factor methods a user has actually enrolled,
+     * based on their credential record. Mirrors the enrollment check in
+     * AuthenticationOrchestratorBackendService._shouldRequireMFA().
+     */
+    static getEnrolledSecondFactorMethods(cred) {
+        const methods = [];
+        if (!cred)
+            return methods;
+        if (cred.totpVerified)
+            methods.push(AuthMethod.TOTP);
+        if (cred.passkeyCredentials && cred.passkeyCredentials.length > 0)
+            methods.push(AuthMethod.PASSKEY);
+        if (cred.phoneNumberVerified)
+            methods.push(AuthMethod.SMS_OTP);
+        methods.push(AuthMethod.EMAIL_OTP);
+        return methods;
+    }
+    /**
+     * Validate a password against policy rules.
+     * Returns an object with `valid` flag and an array of `violations` (i18n label keys).
+     *
+     * Single source of truth for password policy validation — used by both frontend
+     * (real-time validation) and backend (AuthCredentialVerifierBackendService).
+     * Frontend resolves violations via t(violationCode) with {minLength}/{maxLength} replacement.
+     */
+    static validatePasswordAgainstPolicy(password, policy) {
+        const violations = [];
+        if (password.length < policy.minLength) {
+            violations.push(PasswordPolicyViolationCode.MIN_LENGTH);
+        }
+        if (password.length > policy.maxLength) {
+            violations.push(PasswordPolicyViolationCode.MAX_LENGTH);
+        }
+        if (policy.requireUppercase && !/[A-Z]/.test(password)) {
+            violations.push(PasswordPolicyViolationCode.UPPERCASE);
+        }
+        if (policy.requireLowercase && !/[a-z]/.test(password)) {
+            violations.push(PasswordPolicyViolationCode.LOWERCASE);
+        }
+        if (policy.requireNumbers && !/\d/.test(password)) {
+            violations.push(PasswordPolicyViolationCode.NUMBER);
+        }
+        if (policy.requireSpecialChars && !/[^A-Za-z0-9]/.test(password)) {
+            violations.push(PasswordPolicyViolationCode.SPECIAL_CHAR);
+        }
+        return { valid: violations.length === 0, violations };
+    }
+}
+//# sourceMappingURL=authentication.shared.utils.js.map

package/dist/esm/security/authentications/authentication.shared.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.shared.utils.js","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC/H,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAuB,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AAGxH;;GAEG;AACH,MAAM,OAAO,SAAS;IACpB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAkB;QACxC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,UAAU,KAAK,cAAc,CAAC,UAAU;YACxC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAkB;QACzC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,UAAU,KAAK,cAAc,CAAC,WAAW;YACzC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,qBAAqB;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAC1B,UAAU,KAAK,cAAc,CAAC,UAAU;YACxC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAClC;aACA,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAoB,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,sBAAsB;QAC3B,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAC1B,UAAU,KAAK,cAAc,CAAC,WAAW;YACzC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAClC;aACA,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAoB,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,MAAkB;QACrC,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAkB;QACzC,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,MAAkB;QAChD,OAAO,wBAAwB,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,yBAAyB,CAAC,MAAkB;QACjD,OAAO,wBAAwB,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,eAAe;YACvE,wBAAwB,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAkB,EAAE,aAAsB;QACvE,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;IAKD;;;;OAIG;IACH,MAAM,CAAC,8BAA8B,CAAC,IAIlB;QAClB,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC;QAC1B,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpG,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,6BAA6B,CAAC,QAAgB,EAAE,MAA2B;QAChF,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC;CAEF"}

package/dist/esm/security/authentications/consumable-token.shared.schemas.d.ts

@@ -0,0 +1,146 @@
+import { z } from "zod";
+import type { ExpiresInDuration } from "@wildo-ai/zod-decorators";
+import type { ExecutionContext_RoleInfo } from "../../runtime/execution-context.shared.schemas.js";
+export declare enum CoreConsumableTokenTypes {
+    ORGANIZATION_MEMBER_INVITATION = "organization_member_invitation",
+    PASSWORD_RESET = "password_reset",
+    EMAIL_VERIFICATION = "email_verification",
+    FILE_PUBLIC_ACCESS = "file_public_access",
+    OAUTH2_STATE = "oauth2_state",
+    EXTERNAL_CALLBACK_STATE = "external_callback_state",
+    WEBHOOK_VERIFICATION = "webhook_verification",
+    /** Delivers JWT tokens to the frontend after OAuth2 callback processing (Decision 7) */
+    AUTH_CODE_EXCHANGE = "auth_code_exchange",
+    /** Email OTP code for MFA second factor verification (Step 10) */
+    EMAIL_OTP = "email_otp",
+    /** Magic link token for passwordless first-factor authentication (Phase G2) */
+    MAGIC_LINK = "magic_link",
+    /** SMS OTP code for first/second factor authentication (Phase G2) */
+    SMS_OTP = "sms_otp",
+    /** Phone number verification code — not an auth flow, just verification (Phase G2) */
+    PHONE_VERIFICATION = "phone_verification",
+    /** SAML AuthnRequest correlation state (AUTH-2: SAML Protocol Engine) */
+    SAML_AUTH_STATE = "saml_auth_state",
+    /** Re-authentication token for sensitive method changes (#13f) */
+    REAUTH = "reauth"
+}
+export declare const ConsumableTokenTypesSchema: z.ZodUnion<readonly [z.ZodEnum<typeof CoreConsumableTokenTypes>, z.ZodString]>;
+export type ConsumableTokenTypes = z.infer<typeof ConsumableTokenTypesSchema>;
+/**
+ * Defines how a token behaves when used.
+ *
+ * - `SINGLE_USE`: Consumed after first successful use (password reset, invitation acceptance)
+ * - `BOUNDED_REUSE`: Can be used N times or until expiry (file sharing link, meeting join link)
+ * - `EPHEMERAL_STATE`: Carries state through a redirect, consumed on callback (OAuth state, payment callback)
+ */
+export declare enum ConsumableToken_ConsumptionMode {
+    SINGLE_USE = "SINGLE_USE",
+    BOUNDED_REUSE = "BOUNDED_REUSE",
+    EPHEMERAL_STATE = "EPHEMERAL_STATE"
+}
+/**
+ * A value that can either be provided statically or derived from the operation result at runtime.
+ *
+ * Static:  `{ value: 7, unit: 'days' }`
+ * Derived: `(currentObject) => ({ value: currentObject.shareDurationDays, unit: 'days' })`
+ *
+ * NOTE: This is intentionally NOT `ResourceConfiguration_FunctionWithContextNeeds` (R5).
+ * `FunctionWithContextNeeds` wraps functions with metadata flags (`needsObjectContext`, `needsUserContext`)
+ * for factory introspection. `StaticOrDerived<T>` is simpler — it's just "literal value OR function from
+ * currentObject" with no metadata flags. The factory marks dynamic values as `_isDynamic` during
+ * processing, which is a different mechanism entirely.
+ */
+export type StaticOrDerived<T> = T | ((currentObject: Record<string, any>) => T);
+/**
+ * Declarative config for automatic token generation on an operation variant.
+ * Placed on CREATE/RESEND-like operations to generate a token as a side-effect.
+ *
+ * The pipeline creates the token AFTER the core operation succeeds, and injects
+ * `additionalContext.tokenValue` into the notification dispatch for email templates.
+ */
+export type TokenGenerationConfig = {
+    /** Token type identifier (from CoreConsumableTokenTypes or custom app enum) */
+    tokenType: ConsumableTokenTypes;
+    /** How the token behaves when used */
+    consumptionMode: ConsumableToken_ConsumptionMode;
+    /**
+     * Expiration duration — static or derived from currentObject.
+     * Units: minutes, hours, or days only. Value must be ≥ 1.
+     * Static: `{ value: 7, unit: DurationUnit.DAYS }`
+     * Derived: `(currentObject) => ({ value: currentObject.shareDurationDays, unit: 'days' })`
+     */
+    expiresIn: StaticOrDerived<ExpiresInDuration>;
+    /**
+     * Roles granted when the token is used for authentication.
+     * Static: `[{ roles: ['ORG_MEMBER'], relatedPrimaryScope: 'ORGANIZATIONS' }]`
+     * Derived: `(currentObject) => [{ roles: [currentObject.assignedRole], relatedPrimaryScope: 'ORGANIZATIONS' }]`
+     */
+    grantedRoles?: StaticOrDerived<ExecutionContext_RoleInfo[]>;
+    /** Max uses for BOUNDED_REUSE mode. Required when consumptionMode is BOUNDED_REUSE. */
+    maxUses?: number;
+    /** Revoke existing tokens of same type for same relatedId before creating new one (e.g., RESEND) */
+    revokeExistingForSameRelated?: boolean;
+    /** Field in currentState to use as relatedId. Defaults to '_id' (the resource's own ID). */
+    relatedIdField?: string;
+    /**
+     * Field in currentState to capture as the token's userId (user_self pattern).
+     * e.g., 'invitedUserId' — if not set, no userId stored on token.
+     */
+    userIdField?: string;
+    /**
+     * W7.3b: Marks the generated token as exchangeable for a one-off session JWT.
+     * When true, the token can be used via POST /auth/one-off-session/exchange.
+     */
+    createsOneOffSession?: boolean;
+    /**
+     * W7.3b: When the token is consumed — at exchange time or at target operation time.
+     * Required when `createsOneOffSession` is true.
+     * - `EXCHANGE`: consumed immediately when exchanged for a JWT (no token carried into session)
+     * - `TARGET_OPERATION`: carried through the session, consumed when the target operation executes
+     */
+    consumeAt?: 'EXCHANGE' | 'TARGET_OPERATION';
+    /**
+     * W7.3b: Builds targeting.initiatorIds for frontend URL resolution.
+     * Maps field identifier names to field paths in currentState.
+     * organizationId is auto-included from execution context if not specified.
+     *
+     * Example: `{ taskId: '_id' }` → on a Tasks resource, reads `currentState._id` as the taskId.
+     * The frontend uses these to resolve the target URL after session exchange.
+     */
+    targetingFields?: Record<string, string>;
+};
+/**
+ * Declarative config for automatic token revocation on an operation variant.
+ * Placed on DELETE-like operations to revoke associated tokens before the resource is removed.
+ *
+ * Pipeline placement: BEFORE the core operation (pre-operation step).
+ */
+export type TokenRevocationConfig = {
+    /** Which token types to revoke when this operation executes */
+    tokenTypes: ConsumableTokenTypes[];
+    /** Field in currentState to use as relatedId for revocation lookup. Defaults to '_id'. */
+    relatedIdField?: string;
+};
+/**
+ * How a consumable token interacts with JWT/API-key authentication on an operation.
+ * ALTERNATIVE: token alone is sufficient (replaces JWT). Used by PASSWORD_RESET, MAGIC_LINK, etc.
+ * ADDITIVE: token is required ON TOP of JWT auth. Used by one-off session target operations.
+ */
+export declare enum TokenAuthenticationPolicy {
+    ALTERNATIVE = "ALTERNATIVE",
+    ADDITIVE = "ADDITIVE"
+}
+/**
+ * Declarative config declaring that an operation accepts consumable tokens for authentication.
+ * Replaces the old `ResourceConfiguration_OperationVariant_ApiCall_ConsumableToken`.
+ *
+ * NOTE: No `isConsumed` field — consumption is controlled by the token user's `consumptionMode`
+ * (set at creation time), not by the operation config. This avoids contradictions between config
+ * and entity state (Trap 5).
+ */
+export type TokenAuthenticationConfig = {
+    /** Which token types this operation accepts for authentication */
+    types: ConsumableTokenTypes[];
+    policy: TokenAuthenticationPolicy;
+};
+//# sourceMappingURL=consumable-token.shared.schemas.d.ts.map

package/dist/esm/security/authentications/consumable-token.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumable-token.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAOhG,oBAAY,wBAAwB;IAChC,8BAA8B,mCAAmC;IACjE,cAAc,mBAAmC;IACjD,kBAAkB,uBAAmC;IACrD,kBAAkB,uBAAmC;IACrD,YAAY,iBAAmC;IAC/C,uBAAuB,4BAAmC;IAC1D,oBAAoB,yBAAmC;IACvD,wFAAwF;IACxF,kBAAkB,uBAAmC;IACrD,kEAAkE;IAClE,SAAS,cAAmC;IAC5C,+EAA+E;IAC/E,UAAU,eAAmC;IAC7C,qEAAqE;IACrE,OAAO,YAAmC;IAC1C,sFAAsF;IACtF,kBAAkB,uBAAmC;IACrD,yEAAyE;IACzE,eAAe,oBAAmC;IAClD,kEAAkE;IAClE,MAAM,WAAmC;CAC5C;AAED,eAAO,MAAM,0BAA0B,gFAGrC,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E;;;;;;GAMG;AACH,oBAAY,+BAA+B;IACvC,UAAU,eAAoB;IAC9B,aAAa,kBAAoB;IACjC,eAAe,oBAAoB;CACtC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAOjF;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+EAA+E;IAC/E,SAAS,EAAE,oBAAoB,CAAC;IAEhC,sCAAsC;IACtC,eAAe,EAAE,+BAA+B,CAAC;IAEjD;;;;;OAKG;IACH,SAAS,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAE9C;;;;OAIG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAE5D,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,oGAAoG;IACpG,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAE5C;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+DAA+D;IAC/D,UAAU,EAAE,oBAAoB,EAAE,CAAC;IAEnC,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,oBAAY,yBAAyB;IACjC,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,kEAAkE;IAClE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,MAAM,EAAE,yBAAyB,CAAC;CACrC,CAAC"}

package/dist/esm/security/authentications/consumable-token.shared.schemas.js

@@ -0,0 +1,59 @@
+import { z } from "zod";
+// ============================================================================
+// CONSUMABLE TOKEN TYPES — Extensible enum of engine-level token types
+// ============================================================================
+export var CoreConsumableTokenTypes;
+(function (CoreConsumableTokenTypes) {
+    CoreConsumableTokenTypes["ORGANIZATION_MEMBER_INVITATION"] = "organization_member_invitation";
+    CoreConsumableTokenTypes["PASSWORD_RESET"] = "password_reset";
+    CoreConsumableTokenTypes["EMAIL_VERIFICATION"] = "email_verification";
+    CoreConsumableTokenTypes["FILE_PUBLIC_ACCESS"] = "file_public_access";
+    CoreConsumableTokenTypes["OAUTH2_STATE"] = "oauth2_state";
+    CoreConsumableTokenTypes["EXTERNAL_CALLBACK_STATE"] = "external_callback_state";
+    CoreConsumableTokenTypes["WEBHOOK_VERIFICATION"] = "webhook_verification";
+    /** Delivers JWT tokens to the frontend after OAuth2 callback processing (Decision 7) */
+    CoreConsumableTokenTypes["AUTH_CODE_EXCHANGE"] = "auth_code_exchange";
+    /** Email OTP code for MFA second factor verification (Step 10) */
+    CoreConsumableTokenTypes["EMAIL_OTP"] = "email_otp";
+    /** Magic link token for passwordless first-factor authentication (Phase G2) */
+    CoreConsumableTokenTypes["MAGIC_LINK"] = "magic_link";
+    /** SMS OTP code for first/second factor authentication (Phase G2) */
+    CoreConsumableTokenTypes["SMS_OTP"] = "sms_otp";
+    /** Phone number verification code — not an auth flow, just verification (Phase G2) */
+    CoreConsumableTokenTypes["PHONE_VERIFICATION"] = "phone_verification";
+    /** SAML AuthnRequest correlation state (AUTH-2: SAML Protocol Engine) */
+    CoreConsumableTokenTypes["SAML_AUTH_STATE"] = "saml_auth_state";
+    /** Re-authentication token for sensitive method changes (#13f) */
+    CoreConsumableTokenTypes["REAUTH"] = "reauth";
+})(CoreConsumableTokenTypes || (CoreConsumableTokenTypes = {}));
+export const ConsumableTokenTypesSchema = z.union([
+    z.enum(CoreConsumableTokenTypes),
+    z.string().min(1),
+]);
+// ============================================================================
+// CONSUMPTION MODE — Three behavioral categories for token lifecycle
+// ============================================================================
+/**
+ * Defines how a token behaves when used.
+ *
+ * - `SINGLE_USE`: Consumed after first successful use (password reset, invitation acceptance)
+ * - `BOUNDED_REUSE`: Can be used N times or until expiry (file sharing link, meeting join link)
+ * - `EPHEMERAL_STATE`: Carries state through a redirect, consumed on callback (OAuth state, payment callback)
+ */
+export var ConsumableToken_ConsumptionMode;
+(function (ConsumableToken_ConsumptionMode) {
+    ConsumableToken_ConsumptionMode["SINGLE_USE"] = "SINGLE_USE";
+    ConsumableToken_ConsumptionMode["BOUNDED_REUSE"] = "BOUNDED_REUSE";
+    ConsumableToken_ConsumptionMode["EPHEMERAL_STATE"] = "EPHEMERAL_STATE";
+})(ConsumableToken_ConsumptionMode || (ConsumableToken_ConsumptionMode = {}));
+/**
+ * How a consumable token interacts with JWT/API-key authentication on an operation.
+ * ALTERNATIVE: token alone is sufficient (replaces JWT). Used by PASSWORD_RESET, MAGIC_LINK, etc.
+ * ADDITIVE: token is required ON TOP of JWT auth. Used by one-off session target operations.
+ */
+export var TokenAuthenticationPolicy;
+(function (TokenAuthenticationPolicy) {
+    TokenAuthenticationPolicy["ALTERNATIVE"] = "ALTERNATIVE";
+    TokenAuthenticationPolicy["ADDITIVE"] = "ADDITIVE";
+})(TokenAuthenticationPolicy || (TokenAuthenticationPolicy = {}));
+//# sourceMappingURL=consumable-token.shared.schemas.js.map

package/dist/esm/security/authentications/consumable-token.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumable-token.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,+EAA+E;AAC/E,uEAAuE;AACvE,+EAA+E;AAE/E,MAAM,CAAN,IAAY,wBAsBX;AAtBD,WAAY,wBAAwB;IAChC,6FAAiE,CAAA;IACjE,6DAAiD,CAAA;IACjD,qEAAqD,CAAA;IACrD,qEAAqD,CAAA;IACrD,yDAA+C,CAAA;IAC/C,+EAA0D,CAAA;IAC1D,yEAAuD,CAAA;IACvD,wFAAwF;IACxF,qEAAqD,CAAA;IACrD,kEAAkE;IAClE,mDAA4C,CAAA;IAC5C,+EAA+E;IAC/E,qDAA6C,CAAA;IAC7C,qEAAqE;IACrE,+CAA0C,CAAA;IAC1C,sFAAsF;IACtF,qEAAqD,CAAA;IACrD,yEAAyE;IACzE,+DAAkD,CAAA;IAClD,kEAAkE;IAClE,6CAAyC,CAAA;AAC7C,CAAC,EAtBW,wBAAwB,KAAxB,wBAAwB,QAsBnC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpB,CAAC,CAAC;AAMH,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,+BAIX;AAJD,WAAY,+BAA+B;IACvC,4DAA8B,CAAA;IAC9B,kEAAiC,CAAA;IACjC,sEAAmC,CAAA;AACvC,CAAC,EAJW,+BAA+B,KAA/B,+BAA+B,QAI1C;AA6GD;;;;GAIG;AACH,MAAM,CAAN,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACjC,wDAA2B,CAAA;IAC3B,kDAAqB,CAAA;AACzB,CAAC,EAHW,yBAAyB,KAAzB,yBAAyB,QAGpC"}