@wildo-ai/saas-models 1.0.1

package/dist/esm/security/authentications/password-reset.shared.dto.schemas.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Password Reset — Shared DTO Schemas
+ *
+ * Single source of truth for password reset validation.
+ * Used by both frontend (Form component) and backend (req.body parsing).
+ */
+import { z } from 'zod';
+/**
+ * POST /auth/password-reset/request
+ * Also used as the frontend form schema for the email input step.
+ */
+export declare const PasswordResetRequestDtoSchema: z.ZodObject<{
+    email: z.ZodEmail;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type PasswordResetRequestDto = z.infer<typeof PasswordResetRequestDtoSchema>;
+/**
+ * POST /auth/password-reset/complete — API contract
+ * Backend uses this for req.body parsing.
+ * token comes from URL on the frontend, so this is NOT the form schema.
+ */
+export declare const PasswordResetCompleteDtoSchema: z.ZodObject<{
+    token: z.ZodString;
+    newPassword: z.ZodString;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type PasswordResetCompleteDto = z.infer<typeof PasswordResetCompleteDtoSchema>;
+/**
+ * Frontend form schema for the password reset completion step.
+ * Includes confirmPassword for client-side match validation.
+ *
+ * NOTE: The .refine() for password match is applied at the component level
+ * (not here) because the error message needs i18n: t('passwordMismatch').
+ * The .isPassword() decorator tells FormField to render password inputs.
+ */
+export declare const PasswordResetCompleteFormDtoSchema: z.ZodObject<{
+    newPassword: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    confirmPassword: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type PasswordResetCompleteFormDto = z.infer<typeof PasswordResetCompleteFormDtoSchema>;
+//# sourceMappingURL=password-reset.shared.dto.schemas.d.ts.map

package/dist/esm/security/authentications/password-reset.shared.dto.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/password-reset.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;uCAExC,CAAC;AAGH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;uCAGzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC;;;uCAG7C,CAAC;AAGH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC"}

package/dist/esm/security/authentications/password-reset.shared.dto.schemas.js

@@ -0,0 +1,42 @@
+/**
+ * Password Reset — Shared DTO Schemas
+ *
+ * Single source of truth for password reset validation.
+ * Used by both frontend (Form component) and backend (req.body parsing).
+ */
+import { z } from 'zod';
+// ═══════════════════════════════════════════════════════════════
+// API DTOs — what goes over the wire
+// ═══════════════════════════════════════════════════════════════
+/**
+ * POST /auth/password-reset/request
+ * Also used as the frontend form schema for the email input step.
+ */
+export const PasswordResetRequestDtoSchema = z.object({
+    email: z.email().toLowerCase(),
+});
+/**
+ * POST /auth/password-reset/complete — API contract
+ * Backend uses this for req.body parsing.
+ * token comes from URL on the frontend, so this is NOT the form schema.
+ */
+export const PasswordResetCompleteDtoSchema = z.object({
+    token: z.string().min(1),
+    newPassword: z.string().min(1),
+});
+// ═══════════════════════════════════════════════════════════════
+// Form DTO — frontend form fields (token comes from URL, not form)
+// ═══════════════════════════════════════════════════════════════
+/**
+ * Frontend form schema for the password reset completion step.
+ * Includes confirmPassword for client-side match validation.
+ *
+ * NOTE: The .refine() for password match is applied at the component level
+ * (not here) because the error message needs i18n: t('passwordMismatch').
+ * The .isPassword() decorator tells FormField to render password inputs.
+ */
+export const PasswordResetCompleteFormDtoSchema = z.object({
+    newPassword: z.string().min(1).isPassword(),
+    confirmPassword: z.string().min(1).isPassword(),
+});
+//# sourceMappingURL=password-reset.shared.dto.schemas.js.map

package/dist/esm/security/authentications/password-reset.shared.dto.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/password-reset.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kEAAkE;AAClE,qCAAqC;AACrC,kEAAkE;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAKH,kEAAkE;AAClE,mEAAmE;AACnE,kEAAkE;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;CAChD,CAAC,CAAC"}

package/dist/esm/security/authentications/policy/auth-policy.shared.resources-config.schemas.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Auth Policy Resource Configuration — Polymorphic
+ *
+ * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Spread into the registry factory map:
+ *   ...authPolicyPolymorphicFactories
+ */
+import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions.js';
+export declare const authPolicyPolymorphicFactories: Record<string, import("../../../index.js").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.CREATE, any>>;
+//# sourceMappingURL=auth-policy.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/policy/auth-policy.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/policy/auth-policy.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAS/G,eAAO,MAAM,8BAA8B,0LAyC1C,CAAC"}

package/dist/esm/security/authentications/policy/auth-policy.shared.resources-config.schemas.js

@@ -0,0 +1,52 @@
+/**
+ * Auth Policy Resource Configuration — Polymorphic
+ *
+ * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Spread into the registry factory map:
+ *   ...authPolicyPolymorphicFactories
+ */
+import { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../../resources/resources.shared.schemas.js';
+import { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory.js';
+import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas.js';
+import { authPolicyPolymorphicDeclaration } from './auth-policy.shared.schemas.js';
+export const authPolicyPolymorphicFactories = createPolymorphicResourceConfigurations(authPolicyPolymorphicDeclaration, {
+    isSystemResource: true,
+    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE],
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+    },
+});
+//# sourceMappingURL=auth-policy.shared.resources-config.schemas.js.map

package/dist/esm/security/authentications/policy/auth-policy.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/policy/auth-policy.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAEhF,MAAM,CAAC,MAAM,8BAA8B,GAAG,uCAAuC,CACnF,gCAAgC,EAChC;IACE,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACxG,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC"}

package/dist/esm/security/authentications/policy/auth-policy.shared.schemas.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Auth Policy Schema (Shared) — Polymorphic
+ *
+ * @deprecated W2.10: Runtime AuthPolicyBase resources are deprecated.
+ * All MFA/auth policy is now driven by static config (mfaPolicy / passwordPolicy / lockoutPolicy).
+ * This schema remains for migration compatibility; will be removed in W5.
+ *
+ * MFA enforcement, authentication level requirements, passkey configuration.
+ * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
+ *
+ * @see auth-data-model-audit.md §2C
+ */
+import { z } from 'zod';
+export declare const MinimumAuthLevel: {
+    readonly PASSWORD: "password";
+    readonly MFA: "mfa";
+    readonly SSO: "sso";
+};
+export declare const AuthPolicyBaseSchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    requirements: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+        minimumAuthLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
+            readonly PASSWORD: "password";
+            readonly MFA: "mfa";
+            readonly SSO: "sso";
+        }>>>;
+        passwordlessAllowed: z.ZodDefault<z.ZodBoolean>;
+        passkeyEnabled: z.ZodDefault<z.ZodBoolean>;
+        passkeyRequiredForAdmins: z.ZodDefault<z.ZodBoolean>;
+        passkeyExemptFromMFA: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type AuthPolicyBase = z.infer<typeof AuthPolicyBaseSchema>;
+export declare const authPolicyPolymorphicDeclaration: import("../../../index.js").PolymorphicSchemaDeclaration<z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    requirements: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+        minimumAuthLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
+            readonly PASSWORD: "password";
+            readonly MFA: "mfa";
+            readonly SSO: "sso";
+        }>>>;
+        passwordlessAllowed: z.ZodDefault<z.ZodBoolean>;
+        passkeyEnabled: z.ZodDefault<z.ZodBoolean>;
+        passkeyRequiredForAdmins: z.ZodDefault<z.ZodBoolean>;
+        passkeyExemptFromMFA: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+}, z.core.$strip, core.$ZodObjectExtra>>;
+//# sourceMappingURL=auth-policy.shared.schemas.d.ts.map

package/dist/esm/security/authentications/policy/auth-policy.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/policy/auth-policy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,gBAAgB;;;;CAInB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;uCAa/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;wCAM3C,CAAC"}

package/dist/esm/security/authentications/policy/auth-policy.shared.schemas.js

@@ -0,0 +1,40 @@
+/**
+ * Auth Policy Schema (Shared) — Polymorphic
+ *
+ * @deprecated W2.10: Runtime AuthPolicyBase resources are deprecated.
+ * All MFA/auth policy is now driven by static config (mfaPolicy / passwordPolicy / lockoutPolicy).
+ * This schema remains for migration compatibility; will be removed in W5.
+ *
+ * MFA enforcement, authentication level requirements, passkey configuration.
+ * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
+ *
+ * @see auth-data-model-audit.md §2C
+ */
+import { z } from 'zod';
+import { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas.js';
+import { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas.js';
+export const MinimumAuthLevel = {
+    PASSWORD: 'password',
+    MFA: 'mfa',
+    SSO: 'sso',
+};
+export const AuthPolicyBaseSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    requirements: z.object({
+        minimumAuthLevel: z.enum(MinimumAuthLevel).default(MinimumAuthLevel.PASSWORD).isSummaryField(),
+        passwordlessAllowed: z.boolean().default(false),
+        passkeyEnabled: z.boolean().default(true),
+        passkeyRequiredForAdmins: z.boolean().default(false),
+        passkeyExemptFromMFA: z.boolean().default(true),
+    }).isSummaryField(),
+    createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
+    updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
+});
+export const authPolicyPolymorphicDeclaration = declarePolymorphicSchemas({
+    baseResourceType: 'authPolicy',
+    baseFieldIdentifier: 'authPolicyId',
+    baseEnumKey: 'AUTH_POLICY',
+    baseSchema: AuthPolicyBaseSchema,
+    variants: AUTH_SCOPE_VARIANTS,
+});
+//# sourceMappingURL=auth-policy.shared.schemas.js.map

package/dist/esm/security/authentications/policy/auth-policy.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/policy/auth-policy.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;CACF,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE;QAC9F,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACpD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAChD,CAAC,CAAC,cAAc,EAAE;IAEnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gCAAgC,GAAG,yBAAyB,CAAC;IACxE,gBAAgB,EAAE,YAAY;IAC9B,mBAAmB,EAAE,cAAc;IACnC,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,oBAAoB;IAChC,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC"}

package/dist/esm/security/authentications/registration.shared.dto.schemas.d.ts

@@ -0,0 +1,85 @@
+/**
+ * User Registration — Shared DTO Schemas
+ *
+ * Single source of truth for user registration validation.
+ * Used by both frontend (AutomatedForm component) and backend (req.body parsing).
+ */
+import { z } from 'zod';
+/**
+ * POST /auth/register — registration form fields.
+ * Used as:
+ * - Frontend: AutomatedForm schema (all 5 fields rendered)
+ * - Backend: req.body parsing (minus confirmPassword)
+ *
+ * confirmPassword is a frontend-only field for client-side match validation.
+ * The .refine() for password match is applied at the component level
+ * (not here) because the error message needs i18n.
+ * The .isPassword() decorator tells FormField to render password inputs.
+ */
+export declare const UserRegisterFormDtoSchema: z.ZodObject<{
+    email: z.ZodEmail;
+    firstName: z.ZodString;
+    lastName: z.ZodString;
+    organizationName: z.ZodOptional<z.ZodString>;
+    password: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    confirmPassword: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;
+/**
+ * POST /auth/register — API contract (what goes over the wire).
+ * Backend uses this for req.body parsing.
+ * confirmPassword is NOT sent to the backend.
+ */
+export declare const UserRegisterApiDtoSchema: z.ZodObject<{
+    email: z.ZodEmail;
+    firstName: z.ZodString;
+    lastName: z.ZodString;
+    password: z.ZodOptional<z.ZodString>;
+    organizationName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;
+/**
+ * POST /auth/invitation/accept — public invitation-acceptance form fields.
+ *
+ * The invitation token identifies the target invitation. Name/password fields are optional
+ * because an existing invited user may only need to confirm the invitation, while a new
+ * invited user can provide profile/password data in the same flow.
+ *
+ * confirmPassword is frontend-only and excluded from the API DTO.
+ */
+export declare const UserInvitationFormDtoSchema: z.ZodObject<{
+    firstName: z.ZodOptional<z.ZodString>;
+    lastName: z.ZodOptional<z.ZodString>;
+    password: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    confirmPassword: z.ZodOptional<z.ZodString>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;
+/**
+ * POST /auth/invitation/accept — API contract.
+ */
+export declare const UserInvitationApiDtoSchema: z.ZodObject<{
+    invitationToken: z.ZodString;
+    firstName: z.ZodOptional<z.ZodString>;
+    lastName: z.ZodOptional<z.ZodString>;
+    password: z.ZodOptional<z.ZodString>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;
+/**
+ * POST /auth/invitation/reject — API contract.
+ */
+export declare const UserInvitationRejectApiDtoSchema: z.ZodObject<{
+    invitationToken: z.ZodString;
+    rejectionReason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;
+/**
+ * POST /auth/verify-email — API contract.
+ * Token and email are extracted from URL query parameters on the frontend.
+ * Email is required for defense-in-depth constant-time comparison against token metadata.
+ */
+export declare const EmailVerifyDtoSchema: z.ZodObject<{
+    token: z.ZodString;
+    email: z.ZodEmail;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;
+//# sourceMappingURL=registration.shared.dto.schemas.d.ts.map

package/dist/esm/security/authentications/registration.shared.dto.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;uCAQpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;uCAOnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;uCAKtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;uCAKrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;uCAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;uCAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/esm/security/authentications/registration.shared.dto.schemas.js

@@ -0,0 +1,90 @@
+/**
+ * User Registration — Shared DTO Schemas
+ *
+ * Single source of truth for user registration validation.
+ * Used by both frontend (AutomatedForm component) and backend (req.body parsing).
+ */
+import { z } from 'zod';
+// ═══════════════════════════════════════════════════════════════
+// Registration Form + API DTO
+// ═══════════════════════════════════════════════════════════════
+/**
+ * POST /auth/register — registration form fields.
+ * Used as:
+ * - Frontend: AutomatedForm schema (all 5 fields rendered)
+ * - Backend: req.body parsing (minus confirmPassword)
+ *
+ * confirmPassword is a frontend-only field for client-side match validation.
+ * The .refine() for password match is applied at the component level
+ * (not here) because the error message needs i18n.
+ * The .isPassword() decorator tells FormField to render password inputs.
+ */
+export const UserRegisterFormDtoSchema = z.object({
+    email: z.email().toLowerCase(),
+    firstName: z.string().min(1).max(50),
+    lastName: z.string().min(1).max(50),
+    /** W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. */
+    organizationName: z.string().min(1).max(200).optional(),
+    password: z.string().min(1).isPassword().optional(),
+    confirmPassword: z.string().min(1).isPassword().optional(),
+});
+/**
+ * POST /auth/register — API contract (what goes over the wire).
+ * Backend uses this for req.body parsing.
+ * confirmPassword is NOT sent to the backend.
+ */
+export const UserRegisterApiDtoSchema = z.object({
+    email: z.email().toLowerCase(),
+    firstName: z.string().min(1).max(50),
+    lastName: z.string().min(1).max(50),
+    password: z.string().min(1).optional(),
+    /** W6.2: Org name when orgNameSource is 'ask'. */
+    organizationName: z.string().min(1).max(200).optional(),
+});
+// ═══════════════════════════════════════════════════════════════
+// Invitation Acceptance DTOs
+// ═══════════════════════════════════════════════════════════════
+/**
+ * POST /auth/invitation/accept — public invitation-acceptance form fields.
+ *
+ * The invitation token identifies the target invitation. Name/password fields are optional
+ * because an existing invited user may only need to confirm the invitation, while a new
+ * invited user can provide profile/password data in the same flow.
+ *
+ * confirmPassword is frontend-only and excluded from the API DTO.
+ */
+export const UserInvitationFormDtoSchema = z.object({
+    firstName: z.string().max(50).optional(),
+    lastName: z.string().max(50).optional(),
+    password: z.string().isPassword().optional(),
+    confirmPassword: z.string().optional(),
+});
+/**
+ * POST /auth/invitation/accept — API contract.
+ */
+export const UserInvitationApiDtoSchema = z.object({
+    invitationToken: z.string().min(1),
+    firstName: z.string().max(50).optional(),
+    lastName: z.string().max(50).optional(),
+    password: z.string().optional(),
+});
+/**
+ * POST /auth/invitation/reject — API contract.
+ */
+export const UserInvitationRejectApiDtoSchema = z.object({
+    invitationToken: z.string().min(1),
+    rejectionReason: z.string().max(500).optional(),
+});
+// ═══════════════════════════════════════════════════════════════
+// Email Verification API DTO
+// ═══════════════════════════════════════════════════════════════
+/**
+ * POST /auth/verify-email — API contract.
+ * Token and email are extracted from URL query parameters on the frontend.
+ * Email is required for defense-in-depth constant-time comparison against token metadata.
+ */
+export const EmailVerifyDtoSchema = z.object({
+    token: z.string().min(1),
+    email: z.email().toLowerCase(),
+});
+//# sourceMappingURL=registration.shared.dto.schemas.js.map

package/dist/esm/security/authentications/registration.shared.dto.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE;IACnD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE;IAC5C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.d.ts

@@ -0,0 +1,17 @@
+/**
+ * SCIM Provisioning Config Resource Configuration — Polymorphic
+ *
+ * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Spread into the registry factory map:
+ *   ...scimProvisioningConfigPolymorphicFactories
+ */
+import { z } from 'zod';
+import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions.js';
+export declare enum ScimProvisioningConfig_Operations {
+    TEST_SCIM_CONNECTION = "testScimConnection",
+    GET_PROVISIONING_STATS = "getProvisioningStats"
+}
+export declare const ScimProvisioningConfig_TestConnectionRequestDto: z.ZodObject<{}>;
+export declare const ScimProvisioningConfig_GetStatsRequestDto: z.ZodObject<{}>;
+export declare const scimProvisioningConfigPolymorphicFactories: Record<string, import("../../../index.js").ResourceConfiguration_InitializationFactory<typeof ScimProvisioningConfig_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.CREATE, any>>;
+//# sourceMappingURL=scim-provisioning-config.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAW/G,oBAAY,iCAAiC;IAC3C,oBAAoB,uBAAuB;IAC3C,sBAAsB,yBAAyB;CAChD;AAID,eAAO,MAAM,+CAA+C,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAgB,CAAC;AAE7F,eAAO,MAAM,yCAAyC,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAgB,CAAC;AAIvF,eAAO,MAAM,0CAA0C,yNAoEtD,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.js

@@ -0,0 +1,90 @@
+/**
+ * SCIM Provisioning Config Resource Configuration — Polymorphic
+ *
+ * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Spread into the registry factory map:
+ *   ...scimProvisioningConfigPolymorphicFactories
+ */
+import { z } from 'zod';
+import { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../../resources/resources.shared.schemas.js';
+import { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory.js';
+import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas.js';
+import { scimProvisioningConfigPolymorphicDeclaration } from './scim-provisioning-config.shared.schemas.js';
+// ── Custom Operations ────────────────────────────────────────────────
+export var ScimProvisioningConfig_Operations;
+(function (ScimProvisioningConfig_Operations) {
+    ScimProvisioningConfig_Operations["TEST_SCIM_CONNECTION"] = "testScimConnection";
+    ScimProvisioningConfig_Operations["GET_PROVISIONING_STATS"] = "getProvisioningStats";
+})(ScimProvisioningConfig_Operations || (ScimProvisioningConfig_Operations = {}));
+// ── Request DTOs ─────────────────────────────────────────────────────
+export const ScimProvisioningConfig_TestConnectionRequestDto = z.object({});
+export const ScimProvisioningConfig_GetStatsRequestDto = z.object({});
+// ── Polymorphic Factory ──────────────────────────────────────────────
+export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResourceConfigurations(scimProvisioningConfigPolymorphicDeclaration, {
+    isSystemResource: true,
+    customOperation: ScimProvisioningConfig_Operations,
+    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE],
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [ScimProvisioningConfig_Operations.TEST_SCIM_CONNECTION]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.READ,
+                    requestDto: ScimProvisioningConfig_TestConnectionRequestDto,
+                }],
+        },
+        [ScimProvisioningConfig_Operations.GET_PROVISIONING_STATS]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    resourceOperationLike: CoreResourceOperation.READ,
+                    requestDto: ScimProvisioningConfig_GetStatsRequestDto,
+                }],
+        },
+    },
+});
+//# sourceMappingURL=scim-provisioning-config.shared.resources-config.schemas.js.map

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,4CAA4C,EAAE,MAAM,2CAA2C,CAAC;AAEzG,wEAAwE;AAExE,MAAM,CAAN,IAAY,iCAGX;AAHD,WAAY,iCAAiC;IAC3C,gFAA2C,CAAA;IAC3C,oFAA+C,CAAA;AACjD,CAAC,EAHW,iCAAiC,KAAjC,iCAAiC,QAG5C;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,+CAA+C,GAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE7F,MAAM,CAAC,MAAM,yCAAyC,GAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEvF,wEAAwE;AAExE,MAAM,CAAC,MAAM,0CAA0C,GAAG,uCAAuC,CAC/F,4CAA4C,EAC5C;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,iCAAiC;IAClD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACxG,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,iCAAiC,CAAC,oBAAoB,CAAC,EAAE;YACxD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,+CAA+C;iBAC5D,CAAC;SACH;QACD,CAAC,iCAAiC,CAAC,sBAAsB,CAAC,EAAE;YAC1D,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,yCAAyC;iBACtD,CAAC;SACH;KACF;CACF,CACF,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.d.ts

@@ -0,0 +1,51 @@
+/**
+ * SCIM Provisioning Config Schema (Shared) — Polymorphic
+ *
+ * SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.
+ * Independent from SSO JIT provisioning (SsoConfig.provisioning) — SCIM is a
+ * separate provisioning channel triggered by IdP push.
+ * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
+ *
+ * @see auth-data-model-audit.md §2G
+ */
+import { z } from 'zod';
+export declare const ScimAttributeMappingSchema: z.ZodObject<{
+    email: z.ZodDefault<z.ZodString>;
+    firstName: z.ZodDefault<z.ZodString>;
+    lastName: z.ZodDefault<z.ZodString>;
+    displayName: z.ZodDefault<z.ZodString>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export declare const ScimProvisioningConfigBaseSchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    scimEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+    autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
+    autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
+    autoDeactivateUsers: z.ZodDefault<z.ZodBoolean>;
+    defaultRole: z.ZodOptional<z.ZodString>;
+    attributeMapping: z.ZodOptional<z.ZodObject<{
+        email: z.ZodDefault<z.ZodString>;
+        firstName: z.ZodDefault<z.ZodString>;
+        lastName: z.ZodDefault<z.ZodString>;
+        displayName: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type ScimProvisioningConfigBase = z.infer<typeof ScimProvisioningConfigBaseSchema>;
+export declare const scimProvisioningConfigPolymorphicDeclaration: import("../../../index.js").PolymorphicSchemaDeclaration<z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    scimEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+    autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
+    autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
+    autoDeactivateUsers: z.ZodDefault<z.ZodBoolean>;
+    defaultRole: z.ZodOptional<z.ZodString>;
+    attributeMapping: z.ZodOptional<z.ZodObject<{
+        email: z.ZodDefault<z.ZodString>;
+        firstName: z.ZodDefault<z.ZodString>;
+        lastName: z.ZodDefault<z.ZodString>;
+        displayName: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+}, z.core.$strip, core.$ZodObjectExtra>>;
+//# sourceMappingURL=scim-provisioning-config.shared.schemas.d.ts.map