npm - @wildo-ai/saas-models - Versions diffs - 1.1.1 → 1.1.2 - Mend

@wildo-ai/saas-models 1.1.1 → 1.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (292) hide show

package/dist/esm/security/authentications/authentication.shared.schemas.d.ts CHANGED Viewed

@@ -35,6 +35,63 @@ export declare enum AuthMethodCategory {
     MFA_TOKEN = "MFA_TOKEN",// Time-based or generated tokens for MFA
     BIOMETRIC = "BIOMETRIC"
 }
+/**
+ * The signing-key purposes an application holds, and the platform-service keys it verifies against.
+ *
+ * MOVED HERE FROM `saas-backend-lib` on 2026-09-02. These name identities that CROSS A PROCESS
+ * BOUNDARY — the platform issues a token, the application verifies it; the application signs a
+ * webhook, an integrator verifies it — and a name that crosses a boundary belongs in the shared
+ * package rather than in the runtime on one side of it. The signing and verification MACHINERY did
+ * not move; `jwt.backend.schemas.ts` re-exports both so no consumer changed.
+ *
+ * It also unblocked attesting `WILDO.IDENTITY.SIGNING_KEY_LIFECYCLE`: the retirement guarantee is
+ * per key, and the assurance layer could not name the keys it applies to from a package it must not
+ * depend on.
+ *
+ * Storage locations (unchanged, and stated here because the names are meaningless without them):
+ * - private: `wildo_application_secrets.security.jwt.privateKey[key]`
+ * - public:  `wildo_application_config.jwt.publicKey[key]`, env `PLATFORM_<SERVICE_NAME>_PUBLIC_KEY`
+ */
+/**
+ * `iss` claim on every JWT the application signs, whichever key kind signs it. Receivers of
+ * webhooks, workers and platform services pin this value; it is application-wide, not per key.
+ */
+export declare const APPLICATION_JWT_ISSUER: "wildo-application";
+export declare enum JwtPrivateKeys {
+    /** Application signing requests to platform services */
+    APPLICATION_PLATFORM_REQUEST = "APPLICATION_PLATFORM_REQUEST",
+    /** Application signing requests to worker runtimes */
+    APPLICATION_WORKER_REQUEST = "APPLICATION_WORKER_REQUEST",
+    /** Application signing webhooks */
+    APPLICATION_WEBHOOK = "APPLICATION_WEBHOOK",
+    /** Application signing auth tokens */
+    APPLICATION_AUTH_TOKEN = "APPLICATION_AUTH_TOKEN"
+}
+/**
+ * Platform Service JWT Public Keys
+ *
+ * Used to verify JWTs from platform services.
+ * Public keys are stored in apps-manager env config.
+ * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY
+ */
+export declare enum JwtPublicKeys {
+    /** Platform service: apps-manager - central platform orchestrator */
+    PLATFORM_APPS_MANAGER = "PLATFORM_APPS_MANAGER",
+    /** Platform service: crontabs-batches-manager - handles scheduled jobs */
+    PLATFORM_CRONTABS_BATCHES_MANAGER = "PLATFORM_CRONTABS_BATCHES_MANAGER"
+}
+/**
+ * The OIDC / RFC 7519 protocol + security claim names the ID-token builder OWNS. `extraClaims` (the
+ * scope-gated IDENTITY claims from the userinfo/ID-token resolver) must carry ONLY identity claims — these
+ * reserved names are stripped BEFORE `extraClaims` is spread, so a same-named entry can never ride into the
+ * ID token uncontrolled: a smuggled `nbf` (which would later make the token fail verification), a forged
+ * `nonce` / `acr` / `amr` / `at_hash`, or a spoofed `iss` / `aud` / `sub` (the last are already overridden by
+ * the server-set claims below — these are the ones the builder does NOT otherwise re-set). ONE named source
+ * (closed vocabulary) so the strip list can never drift from the builder's own claim set.
+ * semantic-literal-boundary: OIDC Core / RFC 7519 registered claim names.
+ * assurance-control: WILDO.IDENTITY.TOKEN_INTEGRITY — an ID token's protocol/security claims are server-authored only.
+ */
+export declare const OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES: ReadonlySet<string>;
 /**
  * Authentication Method Types with Factor Classification and Categories
  * Core authentication methods - extensible at application level

package/dist/esm/security/authentications/authentication.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AAExG;;;;;;;GAOG;AAGH,eAAO,MAAM,mBAAmB,EAAE,4BAA4B,EAG7D,CAAC;AAOF;;;GAGG;AACH,oBAAY,cAAc;IACxB,UAAU,eAAe,CAAQ,kDAAkD;IACnF,WAAW,gBAAgB,CAAM,0CAA0C;IAC3E,eAAe,oBAAoB,CAAE,+CAA+C;IACpF,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,UAAU,eAAe,CAAY,6BAA6B;IAClE,eAAe,oBAAoB,CAAE,yDAAyD;IAC9F,OAAO,YAAY,CAAiB,oDAAoD;IACxF,SAAS,cAAc,CAAa,yCAAyC;IAC7E,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,oBAAY,UAAU;IAEpB,QAAQ,aAAa;IAGrB,eAAe,oBAAoB,CAAE,qCAAqC;IAG1E,QAAQ,aAAa,CAAsB,wBAAwB;IACnE,kBAAkB,uBAAuB,CAAE,kCAAkC;IAG7E,UAAU,eAAe,CAAO,uBAAuB;IAGvD,IAAI,SAAS,CAAqB,+BAA+B;IACjE,OAAO,YAAY,CAAc,wBAAwB;IACzD,SAAS,cAAc,CAAU,0BAA0B;IAG3D,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,UAAU;IACpB,MAAM,WAAW,CAAQ,+BAA+B;IACxD,KAAK,UAAU;CAChB;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,cAAc,mBAAmB,CAAE,sBAAsB;IACzD,KAAK,UAAU,CAAU,8BAA8B;IACvD,MAAM,WAAW;CAClB;AAED;;;GAGG;AACH,oBAAY,YAAY;IACtB,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;CACpC;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IACzB,MAAM,WAAW;IACjB,WAAW,gBAAgB;CAC5B;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,QAAQ,aAAa;CACtB;AAMD;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,CAmBrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAU3E,CAAC;AAEF;;;;;GAKG;AACH,oBAAY,aAAa;IACvB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;CAC5B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;iBAUtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAmBhC,CAAC;AAGH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,oBAAY,qBAAqB;IAC/B,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B;AAED;;;;;;GAMG;AACH,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,UAAU,eAAe;CAC1B;AAED;;;;;GAKG;AACH,oBAAY,sBAAsB;IAChC,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,IAAI,SAAS;CACd"}
1	+ {"version":3,"file":"authentication.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AAExG;;;;;;;GAOG;AAGH,eAAO,MAAM,mBAAmB,EAAE,4BAA4B,EAG7D,CAAC;AAOF;;;GAGG;AACH,oBAAY,cAAc;IACxB,UAAU,eAAe,CAAQ,kDAAkD;IACnF,WAAW,gBAAgB,CAAM,0CAA0C;IAC3E,eAAe,oBAAoB,CAAE,+CAA+C;IACpF,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,UAAU,eAAe,CAAY,6BAA6B;IAClE,eAAe,oBAAoB,CAAE,yDAAyD;IAC9F,OAAO,YAAY,CAAiB,oDAAoD;IACxF,SAAS,cAAc,CAAa,yCAAyC;IAC7E,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAG,mBAA4B,CAAC;AAEnE,oBAAY,cAAc;IACtB,wDAAwD;IACxD,4BAA4B,iCAAiC;IAC7D,sDAAsD;IACtD,0BAA0B,+BAA+B;IACzD,mCAAmC;IACnC,mBAAmB,wBAAwB;IAC3C,sCAAsC;IACtC,sBAAsB,2BAA2B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,aAAa;IACrB,qEAAqE;IACrE,qBAAqB,0BAA0B;IAE/C,0EAA0E;IAC1E,iCAAiC,sCAAsC;CAC1E;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,EAAE,WAAW,CAAC,MAAM,CAKjE,CAAC;AAEH;;;GAGG;AACH,oBAAY,UAAU;IAEpB,QAAQ,aAAa;IAGrB,eAAe,oBAAoB,CAAE,qCAAqC;IAG1E,QAAQ,aAAa,CAAsB,wBAAwB;IACnE,kBAAkB,uBAAuB,CAAE,kCAAkC;IAG7E,UAAU,eAAe,CAAO,uBAAuB;IAGvD,IAAI,SAAS,CAAqB,+BAA+B;IACjE,OAAO,YAAY,CAAc,wBAAwB;IACzD,SAAS,cAAc,CAAU,0BAA0B;IAG3D,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,oBAAY,UAAU;IACpB,MAAM,WAAW,CAAQ,+BAA+B;IACxD,KAAK,UAAU;CAChB;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,cAAc,mBAAmB,CAAE,sBAAsB;IACzD,KAAK,UAAU,CAAU,8BAA8B;IACvD,MAAM,WAAW;CAClB;AAED;;;GAGG;AACH,oBAAY,YAAY;IACtB,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;CACpC;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IACzB,MAAM,WAAW;IACjB,WAAW,gBAAgB;CAC5B;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,QAAQ,aAAa;CACtB;AAMD;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,CAmBrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAU3E,CAAC;AAEF;;;;;GAKG;AACH,oBAAY,aAAa;IACvB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;CAC5B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;iBAUtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAmBhC,CAAC;AAGH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,oBAAY,qBAAqB;IAC/B,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B;AAED;;;;;;GAMG;AACH,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,UAAU,eAAe;CAC1B;AAED;;;;;GAKG;AACH,oBAAY,sBAAsB;IAChC,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,IAAI,SAAS;CACd"}

package/dist/esm/security/authentications/authentication.shared.schemas.js CHANGED Viewed

@@ -43,6 +43,70 @@ export var AuthMethodCategory;
     AuthMethodCategory["MFA_TOKEN"] = "MFA_TOKEN";
     AuthMethodCategory["BIOMETRIC"] = "BIOMETRIC"; // Modern biometric/passwordless methods
 })(AuthMethodCategory || (AuthMethodCategory = {}));
+/**
+ * The signing-key purposes an application holds, and the platform-service keys it verifies against.
+ *
+ * MOVED HERE FROM `saas-backend-lib` on 2026-09-02. These name identities that CROSS A PROCESS
+ * BOUNDARY — the platform issues a token, the application verifies it; the application signs a
+ * webhook, an integrator verifies it — and a name that crosses a boundary belongs in the shared
+ * package rather than in the runtime on one side of it. The signing and verification MACHINERY did
+ * not move; `jwt.backend.schemas.ts` re-exports both so no consumer changed.
+ *
+ * It also unblocked attesting `WILDO.IDENTITY.SIGNING_KEY_LIFECYCLE`: the retirement guarantee is
+ * per key, and the assurance layer could not name the keys it applies to from a package it must not
+ * depend on.
+ *
+ * Storage locations (unchanged, and stated here because the names are meaningless without them):
+ * - private: `wildo_application_secrets.security.jwt.privateKey[key]`
+ * - public:  `wildo_application_config.jwt.publicKey[key]`, env `PLATFORM_<SERVICE_NAME>_PUBLIC_KEY`
+ */
+/**
+ * `iss` claim on every JWT the application signs, whichever key kind signs it. Receivers of
+ * webhooks, workers and platform services pin this value; it is application-wide, not per key.
+ */
+export const APPLICATION_JWT_ISSUER = 'wildo-application';
+export var JwtPrivateKeys;
+(function (JwtPrivateKeys) {
+    /** Application signing requests to platform services */
+    JwtPrivateKeys["APPLICATION_PLATFORM_REQUEST"] = "APPLICATION_PLATFORM_REQUEST";
+    /** Application signing requests to worker runtimes */
+    JwtPrivateKeys["APPLICATION_WORKER_REQUEST"] = "APPLICATION_WORKER_REQUEST";
+    /** Application signing webhooks */
+    JwtPrivateKeys["APPLICATION_WEBHOOK"] = "APPLICATION_WEBHOOK";
+    /** Application signing auth tokens */
+    JwtPrivateKeys["APPLICATION_AUTH_TOKEN"] = "APPLICATION_AUTH_TOKEN";
+})(JwtPrivateKeys || (JwtPrivateKeys = {}));
+/**
+ * Platform Service JWT Public Keys
+ *
+ * Used to verify JWTs from platform services.
+ * Public keys are stored in apps-manager env config.
+ * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY
+ */
+export var JwtPublicKeys;
+(function (JwtPublicKeys) {
+    /** Platform service: apps-manager - central platform orchestrator */
+    JwtPublicKeys["PLATFORM_APPS_MANAGER"] = "PLATFORM_APPS_MANAGER";
+    /** Platform service: crontabs-batches-manager - handles scheduled jobs */
+    JwtPublicKeys["PLATFORM_CRONTABS_BATCHES_MANAGER"] = "PLATFORM_CRONTABS_BATCHES_MANAGER";
+})(JwtPublicKeys || (JwtPublicKeys = {}));
+/**
+ * The OIDC / RFC 7519 protocol + security claim names the ID-token builder OWNS. `extraClaims` (the
+ * scope-gated IDENTITY claims from the userinfo/ID-token resolver) must carry ONLY identity claims — these
+ * reserved names are stripped BEFORE `extraClaims` is spread, so a same-named entry can never ride into the
+ * ID token uncontrolled: a smuggled `nbf` (which would later make the token fail verification), a forged
+ * `nonce` / `acr` / `amr` / `at_hash`, or a spoofed `iss` / `aud` / `sub` (the last are already overridden by
+ * the server-set claims below — these are the ones the builder does NOT otherwise re-set). ONE named source
+ * (closed vocabulary) so the strip list can never drift from the builder's own claim set.
+ * semantic-literal-boundary: OIDC Core / RFC 7519 registered claim names.
+ * assurance-control: WILDO.IDENTITY.TOKEN_INTEGRITY — an ID token's protocol/security claims are server-authored only.
+ */
+export const OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES = new Set([
+    // `sid` (OIDC Session Management / Front-Channel & Back-Channel Logout) is SERVER-AUTHORED here — it is
+    // the End-User's OP session id the RP-Initiated Logout endpoint keys on (revocation-C). Reserving it bars
+    // a client from smuggling its own `sid` via `extraClaims`, exactly like `nonce`/`acr`/`azp` below.
+    'iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti', 'azp', 'nonce', 'auth_time', 'at_hash', 'c_hash', 'acr', 'amr', 'sid',
+]);
 /**
  * Authentication Method Types with Factor Classification and Categories
  * Core authentication methods - extensible at application level

package/dist/esm/security/authentications/authentication.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAGzH;;;;;;;GAOG;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAmC;IACjE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAGF,kCAAkC;AAClC,oCAAoC;AACpC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,cAKX;AALD,WAAY,cAAc;IACxB,2CAAyB,CAAA;IACzB,6CAA2B,CAAA;IAC3B,qDAAmC,CAAA;IACnC,6BAAW,CAAA,CAAsB,4DAA4D;AAC/F,CAAC,EALW,cAAc,KAAd,cAAc,QAKzB;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,yDAAmC,CAAA;IACnC,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;IACvB,6CAAuB,CAAA,CAAa,wCAAwC;AAC9E,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,UAqBX;AArBD,WAAY,UAAU;IACpB,uCAAuC;IACvC,mCAAqB,CAAA;IAErB,sEAAsE;IACtE,iDAAmC,CAAA;IAEnC,uDAAuD;IACvD,mCAAqB,CAAA;IACrB,uDAAyC,CAAA;IAEzC,mCAAmC;IACnC,uCAAyB,CAAA;IAEzB,2EAA2E;IAC3E,2BAAa,CAAA;IACb,iCAAmB,CAAA;IACnB,qCAAuB,CAAA;IAEvB,4CAA4C;IAC5C,iCAAmB,CAAA,CAAc,0BAA0B;AAC7D,CAAC,EArBW,UAAU,KAAV,UAAU,QAqBrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,6BAAe,CAAA,CAAU,uCAAuC;AAClE,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,oDAAiC,CAAA;IACjC,kCAAe,CAAA;IACf,oCAAiB,CAAA,CAAQ,qCAAqC;AAChE,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,YAMX;AAND,WAAY,YAAY;IACtB,iDAAiC,CAAA;IACjC,yCAAyB,CAAA;IACzB,qCAAqB,CAAA;IACrB,yDAAyC,CAAA;IACzC,mDAAmC,CAAA;AACrC,CAAC,EANW,YAAY,KAAZ,YAAY,QAMvB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mDAA6B,CAAA;IAC7B,+CAAyB,CAAA;IACzB,uCAAiB,CAAA;IACjB,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,yCAAmB,CAAA;IACnB,qCAAe,CAAA;IACf,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,kCAAkC;AAClC,uCAAuC;AACvC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,0CAA0C;IAC1C,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAEhD,6CAA6C;IAC7C,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU;IAElD,0EAA0E;IAC1E,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,UAAU;IACvD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAChD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,cAAc,CAAC,UAAU;IAE1D,gFAAgF;IAChF,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,WAAW;IAC7C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;IACpD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW;IAElD,4CAA4C;IAC5C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;CACrD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2C;IAC9E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACpD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACtD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,eAAe;IAChE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,OAAO;IACjD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,OAAO;IAC3D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAC/C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAClD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,SAAS;IACpD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;CACnD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,8CAA6B,CAAA;IAC7B,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACjE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAErB,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAC7E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IAC/D,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAElD,2BAA2B;IAC3B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,uBAAuB;IACvB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAKH,kCAAkC;AAClC,wBAAwB;AACxB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,gEAAuC,CAAA;IACvC,8DAAqC,CAAA;IACrC,4DAAmC,CAAA;IACnC,0DAAiC,CAAA;IACjC,sDAA6B,CAAA;AAC/B,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,8CAAyB,CAAA;AAC3B,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,2CAAiB,CAAA;IACjB,uCAAa,CAAA;IACb,uCAAa,CAAA;IACb,uCAAa,CAAA;AACf,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\n\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport type { PolymorphicVariantDefinition } from '../../resources/utils/resource-polymorphism.schemas';\n\n/\n Auth Scope Variants (Shared)\n \n The 2 auth scope variants — shared across all auth polymorphic resources\n * (SsoConfig, SsoConnection, SiemExportConfig, SiemDeliveryDlq,\n * ScimTokens, ScimProvisioningConfig).\n \n /\n\n\nexport const AUTH_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n { parentResourceType: CoreResourceType.APPLICATION, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION], isPrimaryScope: true },\n];\n\n\n// ===============================\n// AUTHENTICATION METHOD DEFINITIONS\n// ===============================\n\n/*\n Authentication Factor Classification\n * Defines when an authentication method can be used in the flow\n /\nexport enum AuthFactorType {\n FIRST_ONLY = 'FIRST_ONLY', // Can only be used as first factor (primary auth)\n SECOND_ONLY = 'SECOND_ONLY', // Can only be used as second factor (MFA)\n FIRST_OR_SECOND = 'FIRST_OR_SECOND', // Can be used as either first or second factor\n ANY = 'ANY' // Can be used in any context (first, second, or standalone)\n}\n\n/\n Authentication Method Categories\n * Separates different types of authentication methods by scope and configuration\n /\nexport enum AuthMethodCategory {\n CREDENTIAL = 'CREDENTIAL', // Password-based credentials\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Extensible third-party SaaS OAuth2 (application-level)\n ORG_SSO = 'ORG_SSO', // Organization-restricted SSO (SAML/OpenID Connect)\n MFA_TOKEN = 'MFA_TOKEN', // Time-based or generated tokens for MFA\n BIOMETRIC = 'BIOMETRIC' // Modern biometric/passwordless methods\n}\n\n/\n Authentication Method Types with Factor Classification and Categories\n * Core authentication methods - extensible at application level\n /\nexport enum AuthMethod {\n // Credential-based (First factor only)\n PASSWORD = 'PASSWORD',\n\n // Third-party SaaS OAuth2 (Application-level, extensible, any factor)\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Generic extensible OAuth2 provider\n\n // Organization-restricted SSO (First or second factor)\n ORG_SAML = 'ORG_SAML', // Organization SAML SSO\n ORG_OPENID_CONNECT = 'ORG_OPENID_CONNECT', // Organization OpenID Connect SSO\n\n // Passwordless (First factor only)\n MAGIC_LINK = 'MAGIC_LINK', // Magic Link via email\n\n // MFA tokens (Second factor only, except SMS_OTP which is FIRST_OR_SECOND)\n TOTP = 'TOTP', // Time-based One-Time Password\n SMS_OTP = 'SMS_OTP', // SMS One-Time Password\n EMAIL_OTP = 'EMAIL_OTP', // Email One-Time Password\n\n // Biometric/Modern (First or second factor)\n PASSKEY = 'PASSKEY' // WebAuthn/FIDO2 Passkeys\n}\n\n/\n Authentication Factor Levels\n /\nexport enum AuthFactor {\n SINGLE = 'SINGLE', // Single factor authentication\n MULTI = 'MULTI' // Multi-factor authentication required\n}\n\n/\n Authentication Factor Level (First or Second Factor)\n /\nexport enum AuthFactorLevel {\n IDENTIFICATION = 'IDENTIFICATION', // Identification only\n FIRST = 'FIRST', // First factor authentication\n SECOND = 'SECOND' // Second factor authentication (MFA)\n}\n\n/\n W4: Next step hint for frontend routing after auth state transitions.\n * Drives UI flow (MFA enrollment, onboarding, email verification, etc.).\n /\nexport enum AuthNextStep {\n MFA_ENROLLMENT = 'mfa_enrollment',\n ONBOARDING = 'onboarding',\n COMPLETE = 'complete',\n EMAIL_VERIFICATION = 'email_verification',\n PASSWORD_CHANGE = 'password_change',\n}\n\n/\n W4.2: Session purpose — drives UI rendering and valid state transitions.\n /\nexport enum AuthSessionPurpose {\n LOGIN = 'login',\n REGISTRATION = 'registration',\n INVITATION = 'invitation',\n REAUTH = 'reauth',\n DEVICE_AUTH = 'device_auth',\n}\n\n/\n W4.6: MFA enrollment lifecycle state on UserCredentials.\n * Computed at user creation and updated on enrollment completion.\n /\nexport enum MfaEnrollmentState {\n NOT_REQUIRED = 'not_required',\n PENDING = 'pending',\n GRACE = 'grace',\n ENROLLED = 'enrolled',\n}\n\n// ===============================\n// AUTHENTICATION METHOD CLASSIFICATION\n// ===============================\n\n/\n Authentication Method Factor Classification Map\n /\nexport const AUTH_METHOD_FACTOR_MAP: Record<AuthMethod, AuthFactorType> = {\n // First factor only - Primary credentials\n [AuthMethod.PASSWORD]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - Passwordless via email\n [AuthMethod.MAGIC_LINK]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - SSO redirect flows are not MFA ceremonies (B-SEC-1)\n [AuthMethod.EXTERNAL_OAUTH2]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_SAML]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthFactorType.FIRST_ONLY,\n\n // Second factor only - MFA tokens (except SMS_OTP which can be first or second)\n [AuthMethod.TOTP]: AuthFactorType.SECOND_ONLY,\n [AuthMethod.SMS_OTP]: AuthFactorType.FIRST_OR_SECOND,\n [AuthMethod.EMAIL_OTP]: AuthFactorType.SECOND_ONLY,\n\n // First or second factor - Modern biometric\n [AuthMethod.PASSKEY]: AuthFactorType.FIRST_OR_SECOND\n};\n\n/\n Authentication Method Category Map\n /\nexport const AUTH_METHOD_CATEGORY_MAP: Record<AuthMethod, AuthMethodCategory> = {\n [AuthMethod.PASSWORD]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.MAGIC_LINK]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.EXTERNAL_OAUTH2]: AuthMethodCategory.EXTERNAL_OAUTH2,\n [AuthMethod.ORG_SAML]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.TOTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.SMS_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.EMAIL_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.PASSKEY]: AuthMethodCategory.BIOMETRIC\n};\n\n/\n Scope type for auth policies — organization-level vs application-level.\n \n Declared before the browser-safe available-method schema because that schema\n * evaluates this enum at module initialization time.\n /\nexport enum AuthScopeType {\n ORGANIZATION = 'organization',\n APPLICATION = 'application',\n}\n\n/\n Public, browser-safe configuration attached to an available auth method.\n \n The fields span passkey and enterprise-SSO methods, but every field is named\n * and typed: this cross-layer contract must never collapse back to\n * `Record<string, any>`, which previously forced frontend assertions for the\n * tenant scope and connection identity.\n /\nexport const AvailableMethodConfigSchema = z.object({\n rpName: z.string().optional(),\n rpId: z.string().optional(),\n registeredPasskeyCount: z.number().int().nonnegative().optional(),\n displayName: z.string().optional(),\n providerRef: z.string().optional(),\n connectionId: z.string().optional(),\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n loginUrl: z.string().optional(),\n});\n\nexport type AvailableMethodConfig = z.infer<typeof AvailableMethodConfigSchema>;\n\nexport const AvailableMethodSchema = z.object({\n method: z.enum(AuthMethod),\n factorType: z.enum(AuthFactorType),\n category: z.enum(AuthMethodCategory),\n canBeFirstFactor: z.boolean(),\n canBeSecondFactor: z.boolean(),\n required: z.boolean(),\n\n // Provider-specific information\n oauth2ProviderRefs: z.array(z.string()).optional(), // For third-party OAuth2\n ssoIds: z.array(z.string()).optional(), // For organization SSO\n organizationRestricted: z.boolean().default(false),\n\n // Integration capabilities\n supportsIntegrations: z.boolean().default(false),\n availableIntegrations: z.array(z.string()).default([]).optional(),\n\n // Public configuration\n config: AvailableMethodConfigSchema.optional()\n});\n\n\nexport type AvailableMethod = z.infer<typeof AvailableMethodSchema>;\n\n// ===============================\n// CROSS-LAYER CONSTANTS\n// ===============================\n\n/\n Error codes used in redirect query params (backend → frontend).\n * Backend appends `?error=<code>` to redirect URLs; frontend reads and displays.\n /\nexport enum AuthRedirectErrorCode {\n SAML_LOGIN_FAILED = 'saml_login_failed',\n SAML_AUTH_FAILED = 'saml_auth_failed',\n SAML_SLO_FAILED = 'saml_slo_failed',\n MISSING_PARAMS = 'missing_params',\n OAUTH_FAILED = 'oauth_failed',\n}\n\n/\n Ownership class of an external authentication connection.\n \n This is intentionally independent from {@link AuthScopeType}: a social\n * connection has no enterprise tenant scope, while an enterprise connection\n * must carry one.\n /\nexport enum SsoConnectionType {\n SOCIAL = 'social',\n ENTERPRISE = 'enterprise',\n}\n\n/\n Mechanism that established an external identity.\n \n This is wider than the SSO protocol vocabulary because SCIM establishes and\n * maintains identity links without being an interactive SSO protocol.\n */\nexport enum ExternalIdentitySource {\n OAUTH2 = 'oauth2',\n OIDC = 'oidc',\n SAML = 'saml',\n SCIM = 'scim',\n}\n"]}
1	+ {"version":3,"file":"authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAGzH;;;;;;;GAOG;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAmC;IACjE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAGF,kCAAkC;AAClC,oCAAoC;AACpC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,cAKX;AALD,WAAY,cAAc;IACxB,2CAAyB,CAAA;IACzB,6CAA2B,CAAA;IAC3B,qDAAmC,CAAA;IACnC,6BAAW,CAAA,CAAsB,4DAA4D;AAC/F,CAAC,EALW,cAAc,KAAd,cAAc,QAKzB;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,yDAAmC,CAAA;IACnC,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;IACvB,6CAAuB,CAAA,CAAa,wCAAwC;AAC9E,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAA4B,CAAC;AAEnE,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACtB,wDAAwD;IACxD,+EAA6D,CAAA;IAC7D,sDAAsD;IACtD,2EAAyD,CAAA;IACzD,mCAAmC;IACnC,6DAA2C,CAAA;IAC3C,sCAAsC;IACtC,mEAAiD,CAAA;AACrD,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qEAAqE;IACrE,gEAA+C,CAAA;IAE/C,0EAA0E;IAC1E,wFAAuE,CAAA;AAC3E,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAC;IAC7E,wGAAwG;IACxG,0GAA0G;IAC1G,mGAAmG;IACnG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACvH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAN,IAAY,UAqBX;AArBD,WAAY,UAAU;IACpB,uCAAuC;IACvC,mCAAqB,CAAA;IAErB,sEAAsE;IACtE,iDAAmC,CAAA;IAEnC,uDAAuD;IACvD,mCAAqB,CAAA;IACrB,uDAAyC,CAAA;IAEzC,mCAAmC;IACnC,uCAAyB,CAAA;IAEzB,2EAA2E;IAC3E,2BAAa,CAAA;IACb,iCAAmB,CAAA;IACnB,qCAAuB,CAAA;IAEvB,4CAA4C;IAC5C,iCAAmB,CAAA,CAAc,0BAA0B;AAC7D,CAAC,EArBW,UAAU,KAAV,UAAU,QAqBrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,6BAAe,CAAA,CAAU,uCAAuC;AAClE,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,oDAAiC,CAAA;IACjC,kCAAe,CAAA;IACf,oCAAiB,CAAA,CAAQ,qCAAqC;AAChE,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,YAMX;AAND,WAAY,YAAY;IACtB,iDAAiC,CAAA;IACjC,yCAAyB,CAAA;IACzB,qCAAqB,CAAA;IACrB,yDAAyC,CAAA;IACzC,mDAAmC,CAAA;AACrC,CAAC,EANW,YAAY,KAAZ,YAAY,QAMvB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mDAA6B,CAAA;IAC7B,+CAAyB,CAAA;IACzB,uCAAiB,CAAA;IACjB,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,yCAAmB,CAAA;IACnB,qCAAe,CAAA;IACf,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,kCAAkC;AAClC,uCAAuC;AACvC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,0CAA0C;IAC1C,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAEhD,6CAA6C;IAC7C,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU;IAElD,0EAA0E;IAC1E,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,UAAU;IACvD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAChD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,cAAc,CAAC,UAAU;IAE1D,gFAAgF;IAChF,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,WAAW;IAC7C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;IACpD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW;IAElD,4CAA4C;IAC5C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;CACrD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2C;IAC9E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACpD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACtD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,eAAe;IAChE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,OAAO;IACjD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,OAAO;IAC3D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAC/C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAClD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,SAAS;IACpD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;CACnD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,8CAA6B,CAAA;IAC7B,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACjE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAErB,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAC7E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IAC/D,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAElD,2BAA2B;IAC3B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,uBAAuB;IACvB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAKH,kCAAkC;AAClC,wBAAwB;AACxB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,gEAAuC,CAAA;IACvC,8DAAqC,CAAA;IACrC,4DAAmC,CAAA;IACnC,0DAAiC,CAAA;IACjC,sDAA6B,CAAA;AAC/B,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,8CAAyB,CAAA;AAC3B,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,2CAAiB,CAAA;IACjB,uCAAa,CAAA;IACb,uCAAa,CAAA;IACb,uCAAa,CAAA;AACf,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\n\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport type { PolymorphicVariantDefinition } from '../../resources/utils/resource-polymorphism.schemas';\n\n/\n Auth Scope Variants (Shared)\n \n The 2 auth scope variants — shared across all auth polymorphic resources\n * (SsoConfig, SsoConnection, SiemExportConfig, SiemDeliveryDlq,\n * ScimTokens, ScimProvisioningConfig).\n \n /\n\n\nexport const AUTH_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n { parentResourceType: CoreResourceType.APPLICATION, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION], isPrimaryScope: true },\n];\n\n\n// ===============================\n// AUTHENTICATION METHOD DEFINITIONS\n// ===============================\n\n/*\n Authentication Factor Classification\n * Defines when an authentication method can be used in the flow\n /\nexport enum AuthFactorType {\n FIRST_ONLY = 'FIRST_ONLY', // Can only be used as first factor (primary auth)\n SECOND_ONLY = 'SECOND_ONLY', // Can only be used as second factor (MFA)\n FIRST_OR_SECOND = 'FIRST_OR_SECOND', // Can be used as either first or second factor\n ANY = 'ANY' // Can be used in any context (first, second, or standalone)\n}\n\n/\n Authentication Method Categories\n * Separates different types of authentication methods by scope and configuration\n /\nexport enum AuthMethodCategory {\n CREDENTIAL = 'CREDENTIAL', // Password-based credentials\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Extensible third-party SaaS OAuth2 (application-level)\n ORG_SSO = 'ORG_SSO', // Organization-restricted SSO (SAML/OpenID Connect)\n MFA_TOKEN = 'MFA_TOKEN', // Time-based or generated tokens for MFA\n BIOMETRIC = 'BIOMETRIC' // Modern biometric/passwordless methods\n}\n\n/\n The signing-key purposes an application holds, and the platform-service keys it verifies against.\n \n MOVED HERE FROM `saas-backend-lib` on 2026-09-02. These name identities that CROSS A PROCESS\n * BOUNDARY — the platform issues a token, the application verifies it; the application signs a\n * webhook, an integrator verifies it — and a name that crosses a boundary belongs in the shared\n * package rather than in the runtime on one side of it. The signing and verification MACHINERY did\n * not move; `jwt.backend.schemas.ts` re-exports both so no consumer changed.\n \n It also unblocked attesting `WILDO.IDENTITY.SIGNING_KEY_LIFECYCLE`: the retirement guarantee is\n * per key, and the assurance layer could not name the keys it applies to from a package it must not\n * depend on.\n \n Storage locations (unchanged, and stated here because the names are meaningless without them):\n * - private: `wildo_application_secrets.security.jwt.privateKey[key]`\n * - public: `wildo_application_config.jwt.publicKey[key]`, env `PLATFORM_<SERVICE_NAME>_PUBLIC_KEY`\n /\n/\n `iss` claim on every JWT the application signs, whichever key kind signs it. Receivers of\n * webhooks, workers and platform services pin this value; it is application-wide, not per key.\n /\nexport const APPLICATION_JWT_ISSUER = 'wildo-application' as const;\n\nexport enum JwtPrivateKeys {\n /* Application signing requests to platform services /\n APPLICATION_PLATFORM_REQUEST = 'APPLICATION_PLATFORM_REQUEST',\n /* Application signing requests to worker runtimes /\n APPLICATION_WORKER_REQUEST = 'APPLICATION_WORKER_REQUEST',\n /* Application signing webhooks /\n APPLICATION_WEBHOOK = 'APPLICATION_WEBHOOK',\n /* Application signing auth tokens /\n APPLICATION_AUTH_TOKEN = 'APPLICATION_AUTH_TOKEN',\n}\n\n/\n Platform Service JWT Public Keys\n * \n * Used to verify JWTs from platform services.\n * Public keys are stored in apps-manager env config.\n * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY\n /\nexport enum JwtPublicKeys {\n /* Platform service: apps-manager - central platform orchestrator /\n PLATFORM_APPS_MANAGER = 'PLATFORM_APPS_MANAGER',\n\n /* Platform service: crontabs-batches-manager - handles scheduled jobs /\n PLATFORM_CRONTABS_BATCHES_MANAGER = 'PLATFORM_CRONTABS_BATCHES_MANAGER',\n}\n\n/\n The OIDC / RFC 7519 protocol + security claim names the ID-token builder OWNS. `extraClaims` (the\n * scope-gated IDENTITY claims from the userinfo/ID-token resolver) must carry ONLY identity claims — these\n * reserved names are stripped BEFORE `extraClaims` is spread, so a same-named entry can never ride into the\n * ID token uncontrolled: a smuggled `nbf` (which would later make the token fail verification), a forged\n * `nonce` / `acr` / `amr` / `at_hash`, or a spoofed `iss` / `aud` / `sub` (the last are already overridden by\n * the server-set claims below — these are the ones the builder does NOT otherwise re-set). ONE named source\n * (closed vocabulary) so the strip list can never drift from the builder's own claim set.\n * semantic-literal-boundary: OIDC Core / RFC 7519 registered claim names.\n * assurance-control: WILDO.IDENTITY.TOKEN_INTEGRITY — an ID token's protocol/security claims are server-authored only.\n /\nexport const OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES: ReadonlySet<string> = new Set([\n // `sid` (OIDC Session Management / Front-Channel & Back-Channel Logout) is SERVER-AUTHORED here — it is\n // the End-User's OP session id the RP-Initiated Logout endpoint keys on (revocation-C). Reserving it bars\n // a client from smuggling its own `sid` via `extraClaims`, exactly like `nonce`/`acr`/`azp` below.\n 'iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti', 'azp', 'nonce', 'auth_time', 'at_hash', 'c_hash', 'acr', 'amr', 'sid',\n]);\n\n/\n Authentication Method Types with Factor Classification and Categories\n * Core authentication methods - extensible at application level\n /\nexport enum AuthMethod {\n // Credential-based (First factor only)\n PASSWORD = 'PASSWORD',\n\n // Third-party SaaS OAuth2 (Application-level, extensible, any factor)\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Generic extensible OAuth2 provider\n\n // Organization-restricted SSO (First or second factor)\n ORG_SAML = 'ORG_SAML', // Organization SAML SSO\n ORG_OPENID_CONNECT = 'ORG_OPENID_CONNECT', // Organization OpenID Connect SSO\n\n // Passwordless (First factor only)\n MAGIC_LINK = 'MAGIC_LINK', // Magic Link via email\n\n // MFA tokens (Second factor only, except SMS_OTP which is FIRST_OR_SECOND)\n TOTP = 'TOTP', // Time-based One-Time Password\n SMS_OTP = 'SMS_OTP', // SMS One-Time Password\n EMAIL_OTP = 'EMAIL_OTP', // Email One-Time Password\n\n // Biometric/Modern (First or second factor)\n PASSKEY = 'PASSKEY' // WebAuthn/FIDO2 Passkeys\n}\n\n/\n Authentication Factor Levels\n /\nexport enum AuthFactor {\n SINGLE = 'SINGLE', // Single factor authentication\n MULTI = 'MULTI' // Multi-factor authentication required\n}\n\n/\n Authentication Factor Level (First or Second Factor)\n /\nexport enum AuthFactorLevel {\n IDENTIFICATION = 'IDENTIFICATION', // Identification only\n FIRST = 'FIRST', // First factor authentication\n SECOND = 'SECOND' // Second factor authentication (MFA)\n}\n\n/\n W4: Next step hint for frontend routing after auth state transitions.\n * Drives UI flow (MFA enrollment, onboarding, email verification, etc.).\n /\nexport enum AuthNextStep {\n MFA_ENROLLMENT = 'mfa_enrollment',\n ONBOARDING = 'onboarding',\n COMPLETE = 'complete',\n EMAIL_VERIFICATION = 'email_verification',\n PASSWORD_CHANGE = 'password_change',\n}\n\n/\n W4.2: Session purpose — drives UI rendering and valid state transitions.\n /\nexport enum AuthSessionPurpose {\n LOGIN = 'login',\n REGISTRATION = 'registration',\n INVITATION = 'invitation',\n REAUTH = 'reauth',\n DEVICE_AUTH = 'device_auth',\n}\n\n/\n W4.6: MFA enrollment lifecycle state on UserCredentials.\n * Computed at user creation and updated on enrollment completion.\n /\nexport enum MfaEnrollmentState {\n NOT_REQUIRED = 'not_required',\n PENDING = 'pending',\n GRACE = 'grace',\n ENROLLED = 'enrolled',\n}\n\n// ===============================\n// AUTHENTICATION METHOD CLASSIFICATION\n// ===============================\n\n/\n Authentication Method Factor Classification Map\n /\nexport const AUTH_METHOD_FACTOR_MAP: Record<AuthMethod, AuthFactorType> = {\n // First factor only - Primary credentials\n [AuthMethod.PASSWORD]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - Passwordless via email\n [AuthMethod.MAGIC_LINK]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - SSO redirect flows are not MFA ceremonies (B-SEC-1)\n [AuthMethod.EXTERNAL_OAUTH2]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_SAML]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthFactorType.FIRST_ONLY,\n\n // Second factor only - MFA tokens (except SMS_OTP which can be first or second)\n [AuthMethod.TOTP]: AuthFactorType.SECOND_ONLY,\n [AuthMethod.SMS_OTP]: AuthFactorType.FIRST_OR_SECOND,\n [AuthMethod.EMAIL_OTP]: AuthFactorType.SECOND_ONLY,\n\n // First or second factor - Modern biometric\n [AuthMethod.PASSKEY]: AuthFactorType.FIRST_OR_SECOND\n};\n\n/\n Authentication Method Category Map\n /\nexport const AUTH_METHOD_CATEGORY_MAP: Record<AuthMethod, AuthMethodCategory> = {\n [AuthMethod.PASSWORD]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.MAGIC_LINK]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.EXTERNAL_OAUTH2]: AuthMethodCategory.EXTERNAL_OAUTH2,\n [AuthMethod.ORG_SAML]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.TOTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.SMS_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.EMAIL_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.PASSKEY]: AuthMethodCategory.BIOMETRIC\n};\n\n/\n Scope type for auth policies — organization-level vs application-level.\n \n Declared before the browser-safe available-method schema because that schema\n * evaluates this enum at module initialization time.\n /\nexport enum AuthScopeType {\n ORGANIZATION = 'organization',\n APPLICATION = 'application',\n}\n\n/\n Public, browser-safe configuration attached to an available auth method.\n \n The fields span passkey and enterprise-SSO methods, but every field is named\n * and typed: this cross-layer contract must never collapse back to\n * `Record<string, any>`, which previously forced frontend assertions for the\n * tenant scope and connection identity.\n /\nexport const AvailableMethodConfigSchema = z.object({\n rpName: z.string().optional(),\n rpId: z.string().optional(),\n registeredPasskeyCount: z.number().int().nonnegative().optional(),\n displayName: z.string().optional(),\n providerRef: z.string().optional(),\n connectionId: z.string().optional(),\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n loginUrl: z.string().optional(),\n});\n\nexport type AvailableMethodConfig = z.infer<typeof AvailableMethodConfigSchema>;\n\nexport const AvailableMethodSchema = z.object({\n method: z.enum(AuthMethod),\n factorType: z.enum(AuthFactorType),\n category: z.enum(AuthMethodCategory),\n canBeFirstFactor: z.boolean(),\n canBeSecondFactor: z.boolean(),\n required: z.boolean(),\n\n // Provider-specific information\n oauth2ProviderRefs: z.array(z.string()).optional(), // For third-party OAuth2\n ssoIds: z.array(z.string()).optional(), // For organization SSO\n organizationRestricted: z.boolean().default(false),\n\n // Integration capabilities\n supportsIntegrations: z.boolean().default(false),\n availableIntegrations: z.array(z.string()).default([]).optional(),\n\n // Public configuration\n config: AvailableMethodConfigSchema.optional()\n});\n\n\nexport type AvailableMethod = z.infer<typeof AvailableMethodSchema>;\n\n// ===============================\n// CROSS-LAYER CONSTANTS\n// ===============================\n\n/\n Error codes used in redirect query params (backend → frontend).\n * Backend appends `?error=<code>` to redirect URLs; frontend reads and displays.\n /\nexport enum AuthRedirectErrorCode {\n SAML_LOGIN_FAILED = 'saml_login_failed',\n SAML_AUTH_FAILED = 'saml_auth_failed',\n SAML_SLO_FAILED = 'saml_slo_failed',\n MISSING_PARAMS = 'missing_params',\n OAUTH_FAILED = 'oauth_failed',\n}\n\n/\n Ownership class of an external authentication connection.\n \n This is intentionally independent from {@link AuthScopeType}: a social\n * connection has no enterprise tenant scope, while an enterprise connection\n * must carry one.\n /\nexport enum SsoConnectionType {\n SOCIAL = 'social',\n ENTERPRISE = 'enterprise',\n}\n\n/\n Mechanism that established an external identity.\n \n This is wider than the SSO protocol vocabulary because SCIM establishes and\n * maintains identity links without being an interactive SSO protocol.\n */\nexport enum ExternalIdentitySource {\n OAUTH2 = 'oauth2',\n OIDC = 'oidc',\n SAML = 'saml',\n SCIM = 'scim',\n}\n"]}

package/dist/esm/security/authentications/consumable-token.shared.schemas.d.ts CHANGED Viewed

@@ -52,7 +52,23 @@ export declare enum CoreConsumableTokenTypes {
      * lands on `/oauth/logged-out`. A trusted RP logout (valid hint + exact-match registered redirect)
      * skips this entirely and terminates + redirects to the RP directly — the Keycloak-style posture.
      */
-    OIDC_LOGOUT_CONFIRMATION = "oidc_logout_confirmation"
+    OIDC_LOGOUT_CONFIRMATION = "oidc_logout_confirmation",
+    /**
+     * A single-use grant to upload ONE file into ONE resource file field, minted by a principal who
+     * could perform the target CREATE/UPDATE and redeemed by whoever holds it — an AI agent's `curl`,
+     * or a human on the drop page — without the minter's own credential ever leaving the server.
+     *
+     * Exists because MCP tool arguments are model-generated JSON and cannot carry bytes; see #312.
+     * `SINGLE_USE` only (a reusable upload credential is the presigned-URL defect rebuilt inside
+     * the API). Typed fields carry identity — `userId`/`organizationId`/`roles` snapshot of the
+     * minter, `resourceIdentifier` = target resource, `relatedId` = target row for UPDATE — and
+     * `metadata` carries the ROUTE binding (`fieldName`, `operation`, `minter`, `producedFileId`),
+     * which the upload middleware checks and the identity layer deliberately ignores. Lifetime is
+     * bounded at the mint by `FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES`, rejecting rather than
+     * clamping: this credential is designed to leave the trust boundary (a transcript, a shell
+     * history), so the engine owns the bound.
+     */
+    FILE_UPLOAD_GRANT = "file_upload_grant"
 }
 export declare const ConsumableTokenTypesSchema: z.ZodUnion<readonly [z.ZodEnum<typeof CoreConsumableTokenTypes>, z.ZodString]>;
 export type ConsumableTokenTypes = z.infer<typeof ConsumableTokenTypesSchema>;

package/dist/esm/security/authentications/consumable-token.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"consumable-token.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAOhG,oBAAY,wBAAwB;IAChC,8BAA8B,mCAAmC;IACjE,cAAc,mBAAmC;IACjD,kBAAkB,uBAAmC;IACrD,kBAAkB,uBAAmC;IACrD,YAAY,iBAAmC;IAC/C,uBAAuB,4BAAmC;IAC1D,oBAAoB,yBAAmC;IACvD,wFAAwF;IACxF,kBAAkB,uBAAmC;IACrD,kEAAkE;IAClE,SAAS,cAAmC;IAC5C,+EAA+E;IAC/E,UAAU,eAAmC;IAC7C,qEAAqE;IACrE,OAAO,YAAmC;IAC1C,sFAAsF;IACtF,kBAAkB,uBAAmC;IACrD,yEAAyE;IACzE,eAAe,oBAAmC;IAClD,kEAAkE;IAClE,MAAM,WAAmC;IACzC;;;;;OAKG;IACH,uBAAuB,4BAAmC;IAC1D;;;;;;;;OAQG;IACH,oBAAoB,yBAAmC;IACvD;;;;;;;;;;;OAWG;IACH,wBAAwB,6BAAmC;~~CAC9D~~;AAED,eAAO,MAAM,0BAA0B,gFAGrC,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E;;;;;;GAMG;AACH,oBAAY,+BAA+B;IACvC,UAAU,eAAoB;IAC9B,aAAa,kBAAoB;IACjC,eAAe,oBAAoB;CACtC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAOjF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC;AACnG,0EAA0E;AAE1E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+EAA+E;IAC/E,SAAS,EAAE,oBAAoB,CAAC;IAEhC,sCAAsC;IACtC,eAAe,EAAE,+BAA+B,CAAC;IAEjD;;;;;OAKG;IACH,SAAS,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAE9C;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAErC;;;;OAIG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAE5D,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,oGAAoG;IACpG,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAE5C;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEzC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AACF,0EAA0E;AAE1E;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+DAA+D;IAC/D,UAAU,EAAE,oBAAoB,EAAE,CAAC;IAEnC,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,oBAAY,yBAAyB;IACjC,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,kEAAkE;IAClE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,MAAM,EAAE,yBAAyB,CAAC;CACrC,CAAC"}
1	+ {"version":3,"file":"consumable-token.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAOhG,oBAAY,wBAAwB;IAChC,8BAA8B,mCAAmC;IACjE,cAAc,mBAAmC;IACjD,kBAAkB,uBAAmC;IACrD,kBAAkB,uBAAmC;IACrD,YAAY,iBAAmC;IAC/C,uBAAuB,4BAAmC;IAC1D,oBAAoB,yBAAmC;IACvD,wFAAwF;IACxF,kBAAkB,uBAAmC;IACrD,kEAAkE;IAClE,SAAS,cAAmC;IAC5C,+EAA+E;IAC/E,UAAU,eAAmC;IAC7C,qEAAqE;IACrE,OAAO,YAAmC;IAC1C,sFAAsF;IACtF,kBAAkB,uBAAmC;IACrD,yEAAyE;IACzE,eAAe,oBAAmC;IAClD,kEAAkE;IAClE,MAAM,WAAmC;IACzC;;;;;OAKG;IACH,uBAAuB,4BAAmC;IAC1D;;;;;;;;OAQG;IACH,oBAAoB,yBAAmC;IACvD;;;;;;;;;;;OAWG;IACH,wBAAwB,6BAAmC;IAC3D;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAmC;CACvD;AAED,eAAO,MAAM,0BAA0B,gFAGrC,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E;;;;;;GAMG;AACH,oBAAY,+BAA+B;IACvC,UAAU,eAAoB;IAC9B,aAAa,kBAAoB;IACjC,eAAe,oBAAoB;CACtC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAOjF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC;AACnG,0EAA0E;AAE1E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+EAA+E;IAC/E,SAAS,EAAE,oBAAoB,CAAC;IAEhC,sCAAsC;IACtC,eAAe,EAAE,+BAA+B,CAAC;IAEjD;;;;;OAKG;IACH,SAAS,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAE9C;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAErC;;;;OAIG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAE5D,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,oGAAoG;IACpG,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAE5C;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEzC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AACF,0EAA0E;AAE1E;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+DAA+D;IAC/D,UAAU,EAAE,oBAAoB,EAAE,CAAC;IAEnC,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,oBAAY,yBAAyB;IACjC,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,kEAAkE;IAClE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,MAAM,EAAE,yBAAyB,CAAC;CACrC,CAAC"}

package/dist/esm/security/authentications/consumable-token.shared.schemas.js CHANGED Viewed

@@ -55,6 +55,22 @@ export var CoreConsumableTokenTypes;
      * skips this entirely and terminates + redirects to the RP directly — the Keycloak-style posture.
      */
     CoreConsumableTokenTypes["OIDC_LOGOUT_CONFIRMATION"] = "oidc_logout_confirmation";
+    /**
+     * A single-use grant to upload ONE file into ONE resource file field, minted by a principal who
+     * could perform the target CREATE/UPDATE and redeemed by whoever holds it — an AI agent's `curl`,
+     * or a human on the drop page — without the minter's own credential ever leaving the server.
+     *
+     * Exists because MCP tool arguments are model-generated JSON and cannot carry bytes; see #312.
+     * `SINGLE_USE` only (a reusable upload credential is the presigned-URL defect rebuilt inside
+     * the API). Typed fields carry identity — `userId`/`organizationId`/`roles` snapshot of the
+     * minter, `resourceIdentifier` = target resource, `relatedId` = target row for UPDATE — and
+     * `metadata` carries the ROUTE binding (`fieldName`, `operation`, `minter`, `producedFileId`),
+     * which the upload middleware checks and the identity layer deliberately ignores. Lifetime is
+     * bounded at the mint by `FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES`, rejecting rather than
+     * clamping: this credential is designed to leave the trust boundary (a transcript, a shell
+     * history), so the engine owns the bound.
+     */
+    CoreConsumableTokenTypes["FILE_UPLOAD_GRANT"] = "file_upload_grant";
 })(CoreConsumableTokenTypes || (CoreConsumableTokenTypes = {}));
 export const ConsumableTokenTypesSchema = z.union([
     z.enum(CoreConsumableTokenTypes),

package/dist/esm/security/authentications/consumable-token.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"consumable-token.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,+EAA+E;AAC/E,uEAAuE;AACvE,+EAA+E;AAE/E,MAAM,CAAN,IAAY,wBAoDX;AApDD,WAAY,wBAAwB;IAChC,6FAAiE,CAAA;IACjE,6DAAiD,CAAA;IACjD,qEAAqD,CAAA;IACrD,qEAAqD,CAAA;IACrD,yDAA+C,CAAA;IAC/C,+EAA0D,CAAA;IAC1D,yEAAuD,CAAA;IACvD,wFAAwF;IACxF,qEAAqD,CAAA;IACrD,kEAAkE;IAClE,mDAA4C,CAAA;IAC5C,+EAA+E;IAC/E,qDAA6C,CAAA;IAC7C,qEAAqE;IACrE,+CAA0C,CAAA;IAC1C,sFAAsF;IACtF,qEAAqD,CAAA;IACrD,yEAAyE;IACzE,+DAAkD,CAAA;IAClD,kEAAkE;IAClE,6CAAyC,CAAA;IACzC;;;;;OAKG;IACH,+EAA0D,CAAA;IAC1D;;;;;;;;OAQG;IACH,yEAAuD,CAAA;IACvD;;;;;;;;;;;OAWG;IACH,iFAA2D,CAAA;AAC/D,CAAC,EApDW,wBAAwB,KAAxB,wBAAwB,QAoDnC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpB,CAAC,CAAC;AAMH,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,+BAIX;AAJD,WAAY,+BAA+B;IACvC,4DAA8B,CAAA;IAC9B,kEAAiC,CAAA;IACjC,sEAAmC,CAAA;AACvC,CAAC,EAJW,+BAA+B,KAA/B,+BAA+B,QAI1C;AAkLD;;;;GAIG;AACH,MAAM,CAAN,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACjC,wDAA2B,CAAA;IAC3B,kDAAqB,CAAA;AACzB,CAAC,EAHW,yBAAyB,KAAzB,yBAAyB,QAGpC","sourcesContent":["import { z } from \"zod\";\nimport type { ExpiresInDuration } from \"@wildo-ai/zod-decorators\";\nimport type { ExecutionContext_RoleInfo } from \"../../runtime/execution-context.shared.schemas\";\n\n\n// ============================================================================\n// CONSUMABLE TOKEN TYPES — Extensible enum of engine-level token types\n// ============================================================================\n\nexport enum CoreConsumableTokenTypes {\n ORGANIZATION_MEMBER_INVITATION = 'organization_member_invitation',\n PASSWORD_RESET = 'password_reset',\n EMAIL_VERIFICATION = 'email_verification',\n FILE_PUBLIC_ACCESS = 'file_public_access',\n OAUTH2_STATE = 'oauth2_state',\n EXTERNAL_CALLBACK_STATE = 'external_callback_state',\n WEBHOOK_VERIFICATION = 'webhook_verification',\n /** Delivers JWT tokens to the frontend after OAuth2 callback processing (Decision 7) /\n AUTH_CODE_EXCHANGE = 'auth_code_exchange',\n /* Email OTP code for MFA second factor verification (Step 10) /\n EMAIL_OTP = 'email_otp',\n /* Magic link token for passwordless first-factor authentication (Phase G2) /\n MAGIC_LINK = 'magic_link',\n /* SMS OTP code for first/second factor authentication (Phase G2) /\n SMS_OTP = 'sms_otp',\n /* Phone number verification code — not an auth flow, just verification (Phase G2) /\n PHONE_VERIFICATION = 'phone_verification',\n /* SAML AuthnRequest correlation state (AUTH-2: SAML Protocol Engine) /\n SAML_AUTH_STATE = 'saml_auth_state',\n /* Re-authentication token for sensitive method changes (#13f) /\n REAUTH = 'reauth',\n /\n OIDC authorization code (Wildo-as-provider authorization_code flow). Single-use,\n * short-TTL; its metadata binds the code to the authenticated `userId`, the requesting\n * `clientId`, the granted `scope`, the `redirectUri`, the PKCE `codeChallenge`, and the\n * optional `nonce`. Redeemed at the token endpoint for an ID token + access + refresh.\n /\n OIDC_AUTHORIZATION_CODE = 'oidc_authorization_code',\n /\n OIDC interactive-consent request (Wildo-as-provider authorization_code consent gate). Minted at\n * `/oauth/authorize` for a client whose `requiresConsent` is true, INSTEAD of auto-issuing the\n * code. Single-use, short-TTL; its metadata carries the SAME authorization request the code would\n * bind (`clientId`, `scope`, `redirectUri`, `codeChallenge`, `nonce?`, `resource?`, `state?`)\n * plus the authenticated `userId`. Consumed at `/oauth/authorize/decision`: on APPROVE it mints\n * the authorization code from the stored request; on DENY the flow ends with `access_denied`.\n * Storing the request server-side means the consent decision cannot tamper with the parameters.\n /\n OIDC_CONSENT_REQUEST = 'oidc_consent_request',\n /\n OIDC RP-Initiated Logout confirmation (revocation-C §6 — the logout-confirmation prompt that\n * mitigates BROWSER-based logout CSRF; a cross-origin page cannot read this token from the victim's\n * URL to complete the confirm). Minted at `GET /oauth/end-session` for any request that is NOT a\n * trusted RP logout (no/forged `id_token_hint`, or a valid hint whose `post_logout_redirect_uri`\n * is absent / unregistered / mismatched), INSTEAD of terminating the session inline. Single-use,\n * short-TTL; its metadata carries the already-validated `{ userId?, sessionId? }` the confirm step\n * acts on (storing it server-side means the confirmation cannot tamper with WHICH session ends).\n * Consumed at `POST /oauth/end-session/confirm`: on confirm it terminates that session (if any) and\n * lands on `/oauth/logged-out`. A trusted RP logout (valid hint + exact-match registered redirect)\n * skips this entirely and terminates + redirects to the RP directly — the Keycloak-style posture.\n /\n OIDC_LOGOUT_CONFIRMATION = 'oidc_logout_confirmation',\n}\n\nexport const ConsumableTokenTypesSchema = z.union([\n z.enum(CoreConsumableTokenTypes),\n z.string().min(1),\n]);\n\n\nexport type ConsumableTokenTypes = z.infer<typeof ConsumableTokenTypesSchema>;\n\n\n// ============================================================================\n// CONSUMPTION MODE — Three behavioral categories for token lifecycle\n// ============================================================================\n\n/\n Defines how a token behaves when used.\n \n - `SINGLE_USE`: Consumed after first successful use (password reset, invitation acceptance)\n * - `BOUNDED_REUSE`: Can be used N times or until expiry (file sharing link, meeting join link)\n * - `EPHEMERAL_STATE`: Carries state through a redirect, consumed on callback (OAuth state, payment callback)\n /\nexport enum ConsumableToken_ConsumptionMode {\n SINGLE_USE = 'SINGLE_USE',\n BOUNDED_REUSE = 'BOUNDED_REUSE',\n EPHEMERAL_STATE = 'EPHEMERAL_STATE',\n}\n\n\n// ============================================================================\n// UTILITY TYPE — StaticOrDerived<T>\n// ============================================================================\n\n/\n A value that can either be provided statically or derived from the operation result at runtime.\n \n Static: `{ value: 7, unit: 'days' }`\n * Derived: `(currentObject) => ({ value: currentObject.shareDurationDays, unit: 'days' })`\n \n NOTE: This is intentionally NOT `ResourceConfiguration_FunctionWithContextNeeds` (R5).\n * `FunctionWithContextNeeds` wraps functions with metadata flags (`needsObjectContext`, `needsUserContext`)\n * for factory introspection. `StaticOrDerived<T>` is simpler — it's just \"literal value OR function from\n * currentObject\" with no metadata flags. The factory marks dynamic values as `_isDynamic` during\n * processing, which is a different mechanism entirely.\n /\nexport type StaticOrDerived<T> = T \| ((currentObject: Record<string, any>) => T);\n\n\n// ============================================================================\n// DECLARATIVE CONFIG TYPES — For operation variant configuration\n// ============================================================================\n\n/* @wildo_source:part:start saas.models.resource-config.token-generation facet:layer:shared facet:family:resource-config\n \n Config-declared gate deciding whether a `tokenGeneration` side-effect actually\n * mints a token, evaluated against the POST-operation row (`currentObject`).\n \n WHY the destructured params-object shape `({ currentObject }) => boolean` and NOT\n * the positional `StaticOrDerived` shape used by `expiresIn`/`grantedRoles` above (R5):\n * this deliberately mirrors the operation-variant `enabledCondition` predicate (see the\n * org-members REVOKE/RESEND configs) so an app author writes ONE predicate form for every\n * \"config-declared gate over currentObject\". The trade-off is worth it — cross-surface\n * authoring consistency beats intra-type consistency with the positional derivers.\n \n WHY the params object carries ONLY `currentObject` (unlike the notification `condition`,\n * which also gets `inputDto`/`objectContext`/`initiatorIds`): a token is a PERSISTED\n * side-effect keyed on the resulting row, so its gate must depend only on the persisted\n * result — never on raw request input. Narrowing the params to `currentObject` makes that\n * guarantee structural. (It also keeps this type free of the `resources-config` params type,\n * which would be a circular import — `resources-config.shared.schemas` imports FROM here.)\n /\nexport type TokenGenerationCondition = (params: { currentObject: Record<string, any> }) => boolean;\n/* @wildo_source:part:end saas.models.resource-config.token-generation /\n\n/* @wildo_source:part:start saas.models.resource-config.token-generation facet:layer:shared facet:family:resource-config\n \n Declarative config for automatic token generation on an operation variant.\n * Placed on CREATE/RESEND-like operations to generate a token as a side-effect.\n \n Import from `@wildo-ai/saas-models`; application authors normally provide\n * this shape through an API-call variant in\n * `createResourceConfiguration_Initialization(...)`.\n \n The operation pipeline creates the token in the same persistence transaction\n * as the resource mutation, then injects `additionalContext.tokenValue` into\n * post-commit notification dispatch.\n \n The contract requires one canonical persisted resource state. It cannot be\n * authored on a collection/aggregate operation, a core bulk mutation, or a\n * variant with `haveBulkOperation: true`; those operations do not expose one\n * unambiguous related resource identity for the generated token.\n \n @example\n * `tokenGeneration: { tokenType: MyTokenType.INVITATION, consumptionMode:\n * ConsumableToken_ConsumptionMode.SINGLE_USE, expiresIn: { value: 7, unit:\n * DurationUnit.DAYS }, relatedIdField: '_id' }`\n /\nexport type TokenGenerationConfig = {\n /* Token type identifier (from CoreConsumableTokenTypes or custom app enum) /\n tokenType: ConsumableTokenTypes;\n\n /* How the token behaves when used /\n consumptionMode: ConsumableToken_ConsumptionMode;\n\n /\n Expiration duration — static or derived from currentObject.\n * Units: minutes, hours, or days only. Value must be ≥ 1.\n * Static: `{ value: 7, unit: DurationUnit.DAYS }`\n * Derived: `(currentObject) => ({ value: currentObject.shareDurationDays, unit: 'days' })`\n /\n expiresIn: StaticOrDerived<ExpiresInDuration>;\n\n /\n Optional gate — mint this token ONLY when the predicate returns truthy against the\n * post-operation row. Absent = always mint.\n \n Canonical use: a POLYMORPHIC CREATE (org-member INVITE vs DIRECT-ADD) mints the\n * single-use accept token ONLY for the INVITED branch. A direct-add (founder / SSO-JIT /\n * SCIM) persists `ACTIVE` with nothing to accept, so minting a token there would leave a\n * live single-use accept token dangling on an already-ACTIVE row (a hygiene/security\n * hole). Keying on the resulting `status` — the semantic driver, uniformly present on\n * every branch's `currentObject` — auto-covers any future non-INVITED direct-add path.\n \n @example `({ currentObject }) => currentObject.status === OrganizationMemberStatus.INVITED`\n /\n condition?: TokenGenerationCondition;\n\n /\n Roles granted when the token is used for authentication.\n * Static: `[{ roles: ['ORG_MEMBER'], relatedPrimaryScope: 'ORGANIZATIONS' }]`\n * Derived: `(currentObject) => [{ roles: [currentObject.assignedRole], relatedPrimaryScope: 'ORGANIZATIONS' }]`\n /\n grantedRoles?: StaticOrDerived<ExecutionContext_RoleInfo[]>;\n\n /* Max uses for BOUNDED_REUSE mode. Required when consumptionMode is BOUNDED_REUSE. /\n maxUses?: number;\n\n /* Revoke existing tokens of same type for same relatedId before creating new one (e.g., RESEND) /\n revokeExistingForSameRelated?: boolean;\n\n /* Field in currentState to use as relatedId. Defaults to '_id' (the resource's own ID). /\n relatedIdField?: string;\n\n /\n Field in currentState to capture as the token's userId (user_self pattern).\n * e.g., 'invitedUserId' — if not set, no userId stored on token.\n /\n userIdField?: string;\n\n /\n W7.3b: Marks the generated token as exchangeable for a one-off session JWT.\n * When true, the token can be used via POST /auth/one-off-session/exchange.\n /\n createsOneOffSession?: boolean;\n\n /\n W7.3b: When the token is consumed — at exchange time or at target operation time.\n * Required when `createsOneOffSession` is true.\n * - `EXCHANGE`: consumed immediately when exchanged for a JWT (no token carried into session)\n * - `TARGET_OPERATION`: carried through the session, consumed when the target operation executes\n /\n consumeAt?: 'EXCHANGE' \| 'TARGET_OPERATION';\n\n /\n W7.3b: Builds targeting.initiatorIds for frontend URL resolution.\n * Maps field identifier names to field paths in currentState.\n * organizationId is auto-included from execution context if not specified.\n \n Example: `{ taskId: '_id' }` → on a Tasks resource, reads `currentState._id` as the taskId.\n * The frontend uses these to resolve the target URL after session exchange.\n /\n targetingFields?: Record<string, string>;\n\n /\n Public path of the frontend page that consumes this token (e.g. `/invitation`).\n * When set, the notification dispatcher builds\n * `additionalContext.acceptUrl = <frontendPublicUrl><emailLinkPath>?token=<tokenValue>`\n * for the token-bearing notification email, so the recipient can act on the\n * token straight from the email. Without it, only the raw `tokenValue` is\n * exposed and the email falls back to its generic (sign-in) CTA. Use a stable\n * framework route — the backend cannot import frontend route constants.\n /\n emailLinkPath?: string;\n};\n/* @wildo_source:part:end saas.models.resource-config.token-generation /\n\n/\n Declarative config for automatic token revocation on an operation variant.\n * Placed on DELETE-like operations to revoke associated tokens before the resource is removed.\n \n Pipeline placement: BEFORE the core operation (pre-operation step).\n * Like token generation, revocation requires one canonical current resource\n * state and cannot be combined with collection/aggregate or authored/generated\n * bulk mutation semantics. It also cannot run on CREATE because no current\n * resource exists before persistence.\n /\nexport type TokenRevocationConfig = {\n /* Which token types to revoke when this operation executes /\n tokenTypes: ConsumableTokenTypes[];\n\n /* Field in currentState to use as relatedId for revocation lookup. Defaults to '_id'. /\n relatedIdField?: string;\n};\n\n/\n How a consumable token interacts with JWT/API-key authentication on an operation.\n * ALTERNATIVE: token alone is sufficient (replaces JWT). Used by PASSWORD_RESET, MAGIC_LINK, etc.\n * ADDITIVE: token is required ON TOP of JWT auth. Used by one-off session target operations.\n /\nexport enum TokenAuthenticationPolicy {\n ALTERNATIVE = 'ALTERNATIVE',\n ADDITIVE = 'ADDITIVE',\n}\n\n/\n Declarative config declaring that an operation accepts consumable tokens for authentication.\n * Replaces the old `ResourceConfiguration_OperationVariant_ApiCall_ConsumableToken`.\n \n NOTE: No `isConsumed` field — consumption is controlled by the token user's `consumptionMode`\n * (set at creation time), not by the operation config. This avoids contradictions between config\n * and entity state (Trap 5).\n /\nexport type TokenAuthenticationConfig = {\n /* Which token types this operation accepts for authentication */\n types: ConsumableTokenTypes[];\n policy: TokenAuthenticationPolicy;\n};\n"]}
1	+ {"version":3,"file":"consumable-token.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,+EAA+E;AAC/E,uEAAuE;AACvE,+EAA+E;AAE/E,MAAM,CAAN,IAAY,wBAoEX;AApED,WAAY,wBAAwB;IAChC,6FAAiE,CAAA;IACjE,6DAAiD,CAAA;IACjD,qEAAqD,CAAA;IACrD,qEAAqD,CAAA;IACrD,yDAA+C,CAAA;IAC/C,+EAA0D,CAAA;IAC1D,yEAAuD,CAAA;IACvD,wFAAwF;IACxF,qEAAqD,CAAA;IACrD,kEAAkE;IAClE,mDAA4C,CAAA;IAC5C,+EAA+E;IAC/E,qDAA6C,CAAA;IAC7C,qEAAqE;IACrE,+CAA0C,CAAA;IAC1C,sFAAsF;IACtF,qEAAqD,CAAA;IACrD,yEAAyE;IACzE,+DAAkD,CAAA;IAClD,kEAAkE;IAClE,6CAAyC,CAAA;IACzC;;;;;OAKG;IACH,+EAA0D,CAAA;IAC1D;;;;;;;;OAQG;IACH,yEAAuD,CAAA;IACvD;;;;;;;;;;;OAWG;IACH,iFAA2D,CAAA;IAC3D;;;;;;;;;;;;;;OAcG;IACH,mEAAoD,CAAA;AACxD,CAAC,EApEW,wBAAwB,KAAxB,wBAAwB,QAoEnC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpB,CAAC,CAAC;AAMH,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,+BAIX;AAJD,WAAY,+BAA+B;IACvC,4DAA8B,CAAA;IAC9B,kEAAiC,CAAA;IACjC,sEAAmC,CAAA;AACvC,CAAC,EAJW,+BAA+B,KAA/B,+BAA+B,QAI1C;AAkLD;;;;GAIG;AACH,MAAM,CAAN,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACjC,wDAA2B,CAAA;IAC3B,kDAAqB,CAAA;AACzB,CAAC,EAHW,yBAAyB,KAAzB,yBAAyB,QAGpC","sourcesContent":["import { z } from \"zod\";\nimport type { ExpiresInDuration } from \"@wildo-ai/zod-decorators\";\nimport type { ExecutionContext_RoleInfo } from \"../../runtime/execution-context.shared.schemas\";\n\n\n// ============================================================================\n// CONSUMABLE TOKEN TYPES — Extensible enum of engine-level token types\n// ============================================================================\n\nexport enum CoreConsumableTokenTypes {\n ORGANIZATION_MEMBER_INVITATION = 'organization_member_invitation',\n PASSWORD_RESET = 'password_reset',\n EMAIL_VERIFICATION = 'email_verification',\n FILE_PUBLIC_ACCESS = 'file_public_access',\n OAUTH2_STATE = 'oauth2_state',\n EXTERNAL_CALLBACK_STATE = 'external_callback_state',\n WEBHOOK_VERIFICATION = 'webhook_verification',\n /** Delivers JWT tokens to the frontend after OAuth2 callback processing (Decision 7) /\n AUTH_CODE_EXCHANGE = 'auth_code_exchange',\n /* Email OTP code for MFA second factor verification (Step 10) /\n EMAIL_OTP = 'email_otp',\n /* Magic link token for passwordless first-factor authentication (Phase G2) /\n MAGIC_LINK = 'magic_link',\n /* SMS OTP code for first/second factor authentication (Phase G2) /\n SMS_OTP = 'sms_otp',\n /* Phone number verification code — not an auth flow, just verification (Phase G2) /\n PHONE_VERIFICATION = 'phone_verification',\n /* SAML AuthnRequest correlation state (AUTH-2: SAML Protocol Engine) /\n SAML_AUTH_STATE = 'saml_auth_state',\n /* Re-authentication token for sensitive method changes (#13f) /\n REAUTH = 'reauth',\n /\n OIDC authorization code (Wildo-as-provider authorization_code flow). Single-use,\n * short-TTL; its metadata binds the code to the authenticated `userId`, the requesting\n * `clientId`, the granted `scope`, the `redirectUri`, the PKCE `codeChallenge`, and the\n * optional `nonce`. Redeemed at the token endpoint for an ID token + access + refresh.\n /\n OIDC_AUTHORIZATION_CODE = 'oidc_authorization_code',\n /\n OIDC interactive-consent request (Wildo-as-provider authorization_code consent gate). Minted at\n * `/oauth/authorize` for a client whose `requiresConsent` is true, INSTEAD of auto-issuing the\n * code. Single-use, short-TTL; its metadata carries the SAME authorization request the code would\n * bind (`clientId`, `scope`, `redirectUri`, `codeChallenge`, `nonce?`, `resource?`, `state?`)\n * plus the authenticated `userId`. Consumed at `/oauth/authorize/decision`: on APPROVE it mints\n * the authorization code from the stored request; on DENY the flow ends with `access_denied`.\n * Storing the request server-side means the consent decision cannot tamper with the parameters.\n /\n OIDC_CONSENT_REQUEST = 'oidc_consent_request',\n /\n OIDC RP-Initiated Logout confirmation (revocation-C §6 — the logout-confirmation prompt that\n * mitigates BROWSER-based logout CSRF; a cross-origin page cannot read this token from the victim's\n * URL to complete the confirm). Minted at `GET /oauth/end-session` for any request that is NOT a\n * trusted RP logout (no/forged `id_token_hint`, or a valid hint whose `post_logout_redirect_uri`\n * is absent / unregistered / mismatched), INSTEAD of terminating the session inline. Single-use,\n * short-TTL; its metadata carries the already-validated `{ userId?, sessionId? }` the confirm step\n * acts on (storing it server-side means the confirmation cannot tamper with WHICH session ends).\n * Consumed at `POST /oauth/end-session/confirm`: on confirm it terminates that session (if any) and\n * lands on `/oauth/logged-out`. A trusted RP logout (valid hint + exact-match registered redirect)\n * skips this entirely and terminates + redirects to the RP directly — the Keycloak-style posture.\n /\n OIDC_LOGOUT_CONFIRMATION = 'oidc_logout_confirmation',\n /\n A single-use grant to upload ONE file into ONE resource file field, minted by a principal who\n * could perform the target CREATE/UPDATE and redeemed by whoever holds it — an AI agent's `curl`,\n * or a human on the drop page — without the minter's own credential ever leaving the server.\n \n Exists because MCP tool arguments are model-generated JSON and cannot carry bytes; see #312.\n * `SINGLE_USE` only (a reusable upload credential is the presigned-URL defect rebuilt inside\n * the API). Typed fields carry identity — `userId`/`organizationId`/`roles` snapshot of the\n * minter, `resourceIdentifier` = target resource, `relatedId` = target row for UPDATE — and\n * `metadata` carries the ROUTE binding (`fieldName`, `operation`, `minter`, `producedFileId`),\n * which the upload middleware checks and the identity layer deliberately ignores. Lifetime is\n * bounded at the mint by `FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES`, rejecting rather than\n * clamping: this credential is designed to leave the trust boundary (a transcript, a shell\n * history), so the engine owns the bound.\n /\n FILE_UPLOAD_GRANT = 'file_upload_grant',\n}\n\nexport const ConsumableTokenTypesSchema = z.union([\n z.enum(CoreConsumableTokenTypes),\n z.string().min(1),\n]);\n\n\nexport type ConsumableTokenTypes = z.infer<typeof ConsumableTokenTypesSchema>;\n\n\n// ============================================================================\n// CONSUMPTION MODE — Three behavioral categories for token lifecycle\n// ============================================================================\n\n/\n Defines how a token behaves when used.\n \n - `SINGLE_USE`: Consumed after first successful use (password reset, invitation acceptance)\n * - `BOUNDED_REUSE`: Can be used N times or until expiry (file sharing link, meeting join link)\n * - `EPHEMERAL_STATE`: Carries state through a redirect, consumed on callback (OAuth state, payment callback)\n /\nexport enum ConsumableToken_ConsumptionMode {\n SINGLE_USE = 'SINGLE_USE',\n BOUNDED_REUSE = 'BOUNDED_REUSE',\n EPHEMERAL_STATE = 'EPHEMERAL_STATE',\n}\n\n\n// ============================================================================\n// UTILITY TYPE — StaticOrDerived<T>\n// ============================================================================\n\n/\n A value that can either be provided statically or derived from the operation result at runtime.\n \n Static: `{ value: 7, unit: 'days' }`\n * Derived: `(currentObject) => ({ value: currentObject.shareDurationDays, unit: 'days' })`\n \n NOTE: This is intentionally NOT `ResourceConfiguration_FunctionWithContextNeeds` (R5).\n * `FunctionWithContextNeeds` wraps functions with metadata flags (`needsObjectContext`, `needsUserContext`)\n * for factory introspection. `StaticOrDerived<T>` is simpler — it's just \"literal value OR function from\n * currentObject\" with no metadata flags. The factory marks dynamic values as `_isDynamic` during\n * processing, which is a different mechanism entirely.\n /\nexport type StaticOrDerived<T> = T \| ((currentObject: Record<string, any>) => T);\n\n\n// ============================================================================\n// DECLARATIVE CONFIG TYPES — For operation variant configuration\n// ============================================================================\n\n/* @wildo_source:part:start saas.models.resource-config.token-generation facet:layer:shared facet:family:resource-config\n \n Config-declared gate deciding whether a `tokenGeneration` side-effect actually\n * mints a token, evaluated against the POST-operation row (`currentObject`).\n \n WHY the destructured params-object shape `({ currentObject }) => boolean` and NOT\n * the positional `StaticOrDerived` shape used by `expiresIn`/`grantedRoles` above (R5):\n * this deliberately mirrors the operation-variant `enabledCondition` predicate (see the\n * org-members REVOKE/RESEND configs) so an app author writes ONE predicate form for every\n * \"config-declared gate over currentObject\". The trade-off is worth it — cross-surface\n * authoring consistency beats intra-type consistency with the positional derivers.\n \n WHY the params object carries ONLY `currentObject` (unlike the notification `condition`,\n * which also gets `inputDto`/`objectContext`/`initiatorIds`): a token is a PERSISTED\n * side-effect keyed on the resulting row, so its gate must depend only on the persisted\n * result — never on raw request input. Narrowing the params to `currentObject` makes that\n * guarantee structural. (It also keeps this type free of the `resources-config` params type,\n * which would be a circular import — `resources-config.shared.schemas` imports FROM here.)\n /\nexport type TokenGenerationCondition = (params: { currentObject: Record<string, any> }) => boolean;\n/* @wildo_source:part:end saas.models.resource-config.token-generation /\n\n/* @wildo_source:part:start saas.models.resource-config.token-generation facet:layer:shared facet:family:resource-config\n \n Declarative config for automatic token generation on an operation variant.\n * Placed on CREATE/RESEND-like operations to generate a token as a side-effect.\n \n Import from `@wildo-ai/saas-models`; application authors normally provide\n * this shape through an API-call variant in\n * `createResourceConfiguration_Initialization(...)`.\n \n The operation pipeline creates the token in the same persistence transaction\n * as the resource mutation, then injects `additionalContext.tokenValue` into\n * post-commit notification dispatch.\n \n The contract requires one canonical persisted resource state. It cannot be\n * authored on a collection/aggregate operation, a core bulk mutation, or a\n * variant with `haveBulkOperation: true`; those operations do not expose one\n * unambiguous related resource identity for the generated token.\n \n @example\n * `tokenGeneration: { tokenType: MyTokenType.INVITATION, consumptionMode:\n * ConsumableToken_ConsumptionMode.SINGLE_USE, expiresIn: { value: 7, unit:\n * DurationUnit.DAYS }, relatedIdField: '_id' }`\n /\nexport type TokenGenerationConfig = {\n /* Token type identifier (from CoreConsumableTokenTypes or custom app enum) /\n tokenType: ConsumableTokenTypes;\n\n /* How the token behaves when used /\n consumptionMode: ConsumableToken_ConsumptionMode;\n\n /\n Expiration duration — static or derived from currentObject.\n * Units: minutes, hours, or days only. Value must be ≥ 1.\n * Static: `{ value: 7, unit: DurationUnit.DAYS }`\n * Derived: `(currentObject) => ({ value: currentObject.shareDurationDays, unit: 'days' })`\n /\n expiresIn: StaticOrDerived<ExpiresInDuration>;\n\n /\n Optional gate — mint this token ONLY when the predicate returns truthy against the\n * post-operation row. Absent = always mint.\n \n Canonical use: a POLYMORPHIC CREATE (org-member INVITE vs DIRECT-ADD) mints the\n * single-use accept token ONLY for the INVITED branch. A direct-add (founder / SSO-JIT /\n * SCIM) persists `ACTIVE` with nothing to accept, so minting a token there would leave a\n * live single-use accept token dangling on an already-ACTIVE row (a hygiene/security\n * hole). Keying on the resulting `status` — the semantic driver, uniformly present on\n * every branch's `currentObject` — auto-covers any future non-INVITED direct-add path.\n \n @example `({ currentObject }) => currentObject.status === OrganizationMemberStatus.INVITED`\n /\n condition?: TokenGenerationCondition;\n\n /\n Roles granted when the token is used for authentication.\n * Static: `[{ roles: ['ORG_MEMBER'], relatedPrimaryScope: 'ORGANIZATIONS' }]`\n * Derived: `(currentObject) => [{ roles: [currentObject.assignedRole], relatedPrimaryScope: 'ORGANIZATIONS' }]`\n /\n grantedRoles?: StaticOrDerived<ExecutionContext_RoleInfo[]>;\n\n /* Max uses for BOUNDED_REUSE mode. Required when consumptionMode is BOUNDED_REUSE. /\n maxUses?: number;\n\n /* Revoke existing tokens of same type for same relatedId before creating new one (e.g., RESEND) /\n revokeExistingForSameRelated?: boolean;\n\n /* Field in currentState to use as relatedId. Defaults to '_id' (the resource's own ID). /\n relatedIdField?: string;\n\n /\n Field in currentState to capture as the token's userId (user_self pattern).\n * e.g., 'invitedUserId' — if not set, no userId stored on token.\n /\n userIdField?: string;\n\n /\n W7.3b: Marks the generated token as exchangeable for a one-off session JWT.\n * When true, the token can be used via POST /auth/one-off-session/exchange.\n /\n createsOneOffSession?: boolean;\n\n /\n W7.3b: When the token is consumed — at exchange time or at target operation time.\n * Required when `createsOneOffSession` is true.\n * - `EXCHANGE`: consumed immediately when exchanged for a JWT (no token carried into session)\n * - `TARGET_OPERATION`: carried through the session, consumed when the target operation executes\n /\n consumeAt?: 'EXCHANGE' \| 'TARGET_OPERATION';\n\n /\n W7.3b: Builds targeting.initiatorIds for frontend URL resolution.\n * Maps field identifier names to field paths in currentState.\n * organizationId is auto-included from execution context if not specified.\n \n Example: `{ taskId: '_id' }` → on a Tasks resource, reads `currentState._id` as the taskId.\n * The frontend uses these to resolve the target URL after session exchange.\n /\n targetingFields?: Record<string, string>;\n\n /\n Public path of the frontend page that consumes this token (e.g. `/invitation`).\n * When set, the notification dispatcher builds\n * `additionalContext.acceptUrl = <frontendPublicUrl><emailLinkPath>?token=<tokenValue>`\n * for the token-bearing notification email, so the recipient can act on the\n * token straight from the email. Without it, only the raw `tokenValue` is\n * exposed and the email falls back to its generic (sign-in) CTA. Use a stable\n * framework route — the backend cannot import frontend route constants.\n /\n emailLinkPath?: string;\n};\n/* @wildo_source:part:end saas.models.resource-config.token-generation /\n\n/\n Declarative config for automatic token revocation on an operation variant.\n * Placed on DELETE-like operations to revoke associated tokens before the resource is removed.\n \n Pipeline placement: BEFORE the core operation (pre-operation step).\n * Like token generation, revocation requires one canonical current resource\n * state and cannot be combined with collection/aggregate or authored/generated\n * bulk mutation semantics. It also cannot run on CREATE because no current\n * resource exists before persistence.\n /\nexport type TokenRevocationConfig = {\n /* Which token types to revoke when this operation executes /\n tokenTypes: ConsumableTokenTypes[];\n\n /* Field in currentState to use as relatedId for revocation lookup. Defaults to '_id'. /\n relatedIdField?: string;\n};\n\n/\n How a consumable token interacts with JWT/API-key authentication on an operation.\n * ALTERNATIVE: token alone is sufficient (replaces JWT). Used by PASSWORD_RESET, MAGIC_LINK, etc.\n * ADDITIVE: token is required ON TOP of JWT auth. Used by one-off session target operations.\n /\nexport enum TokenAuthenticationPolicy {\n ALTERNATIVE = 'ALTERNATIVE',\n ADDITIVE = 'ADDITIVE',\n}\n\n/\n Declarative config declaring that an operation accepts consumable tokens for authentication.\n * Replaces the old `ResourceConfiguration_OperationVariant_ApiCall_ConsumableToken`.\n \n NOTE: No `isConsumed` field — consumption is controlled by the token user's `consumptionMode`\n * (set at creation time), not by the operation config. This avoids contradictions between config\n * and entity state (Trap 5).\n /\nexport type TokenAuthenticationConfig = {\n /* Which token types this operation accepts for authentication */\n types: ConsumableTokenTypes[];\n policy: TokenAuthenticationPolicy;\n};\n"]}

package/dist/esm/security/authentications/mfa-backup-code-contract.shared.d.ts ADDED Viewed

@@ -0,0 +1,28 @@
+/**
+ * What a person is handed when they enrol a second factor, and what they can rely on afterwards.
+ *
+ * These values were literals inside the MFA service (`for (let i = 0; i < 10; i++)` and
+ * `randomBytes(4)`), which meant the documentation could only describe them by copying them —
+ * and the pages that should have told a reader how many codes they get, and what to do when the
+ * last one is used, said nothing at all rather than risk being wrong.
+ *
+ * The enrolment path derives from this object and the customer documentation projects it, so the
+ * count on the page is the count the person receives.
+ */
+export declare const MFA_BACKUP_CODE_CONTRACT: {
+    /** How many single-use recovery codes an enrolment issues. */
+    readonly codeCount: 10;
+    /**
+     * Bytes of randomness per code. Each byte is rendered as two hexadecimal characters, so the code
+     * a person sees is twice this many characters.
+     */
+    readonly codeRandomBytes: 4;
+    /**
+     * A code works once. Using it removes it from the person's remaining set; the application never
+     * re-issues the same code, and a fresh enrolment replaces the whole set.
+     */
+    readonly singleUse: true;
+};
+/** Characters in one backup code as the person sees it. */
+export declare const MFA_BACKUP_CODE_CHARACTER_LENGTH: number;
+//# sourceMappingURL=mfa-backup-code-contract.shared.d.ts.map

package/dist/esm/security/authentications/mfa-backup-code-contract.shared.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"mfa-backup-code-contract.shared.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/mfa-backup-code-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB;IACnC,8DAA8D;;IAE9D;;;OAGG;;IAEH;;;OAGG;;CAEK,CAAC;AAEX,2DAA2D;AAC3D,eAAO,MAAM,gCAAgC,EAAE,MAAqD,CAAC"}

package/dist/esm/security/authentications/mfa-backup-code-contract.shared.js ADDED Viewed

@@ -0,0 +1,28 @@
+/**
+ * What a person is handed when they enrol a second factor, and what they can rely on afterwards.
+ *
+ * These values were literals inside the MFA service (`for (let i = 0; i < 10; i++)` and
+ * `randomBytes(4)`), which meant the documentation could only describe them by copying them —
+ * and the pages that should have told a reader how many codes they get, and what to do when the
+ * last one is used, said nothing at all rather than risk being wrong.
+ *
+ * The enrolment path derives from this object and the customer documentation projects it, so the
+ * count on the page is the count the person receives.
+ */
+export const MFA_BACKUP_CODE_CONTRACT = {
+    /** How many single-use recovery codes an enrolment issues. */
+    codeCount: 10,
+    /**
+     * Bytes of randomness per code. Each byte is rendered as two hexadecimal characters, so the code
+     * a person sees is twice this many characters.
+     */
+    codeRandomBytes: 4,
+    /**
+     * A code works once. Using it removes it from the person's remaining set; the application never
+     * re-issues the same code, and a fresh enrolment replaces the whole set.
+     */
+    singleUse: true,
+};
+/** Characters in one backup code as the person sees it. */
+export const MFA_BACKUP_CODE_CHARACTER_LENGTH = MFA_BACKUP_CODE_CONTRACT.codeRandomBytes * 2;
+//# sourceMappingURL=mfa-backup-code-contract.shared.js.map

package/dist/esm/security/authentications/mfa-backup-code-contract.shared.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"mfa-backup-code-contract.shared.js","sourceRoot":"","sources":["../../../../../src/security/authentications/mfa-backup-code-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,8DAA8D;IAC9D,SAAS,EAAE,EAAE;IACb;;;OAGG;IACH,eAAe,EAAE,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,IAAI;CACP,CAAC;AAEX,2DAA2D;AAC3D,MAAM,CAAC,MAAM,gCAAgC,GAAW,wBAAwB,CAAC,eAAe,GAAG,CAAC,CAAC","sourcesContent":["/**\n * What a person is handed when they enrol a second factor, and what they can rely on afterwards.\n *\n * These values were literals inside the MFA service (`for (let i = 0; i < 10; i++)` and\n * `randomBytes(4)`), which meant the documentation could only describe them by copying them —\n * and the pages that should have told a reader how many codes they get, and what to do when the\n * last one is used, said nothing at all rather than risk being wrong.\n *\n * The enrolment path derives from this object and the customer documentation projects it, so the\n * count on the page is the count the person receives.\n */\nexport const MFA_BACKUP_CODE_CONTRACT = {\n /** How many single-use recovery codes an enrolment issues. */\n codeCount: 10,\n /**\n * Bytes of randomness per code. Each byte is rendered as two hexadecimal characters, so the code\n * a person sees is twice this many characters.\n */\n codeRandomBytes: 4,\n /**\n * A code works once. Using it removes it from the person's remaining set; the application never\n * re-issues the same code, and a fresh enrolment replaces the whole set.\n */\n singleUse: true,\n} as const;\n\n/** Characters in one backup code as the person sees it. */\nexport const MFA_BACKUP_CODE_CHARACTER_LENGTH: number = MFA_BACKUP_CODE_CONTRACT.codeRandomBytes * 2;\n"]}

package/dist/esm/security/authentications/siem/siem-delivery-reliability-contract.shared.d.ts ADDED Viewed

@@ -0,0 +1,21 @@
+/**
+ * What an operator can rely on when a SIEM receiver starts failing.
+ *
+ * The retry count, backoff and timeout are configurable per organization and already live on
+ * `SiemExportConfigBaseSchema`. The circuit breaker is not configurable: it is a fixed protection
+ * against a failing receiver absorbing the delivery worker, and it was two module-private constants
+ * inside the delivery service. That is why the operations page could describe the breaker's
+ * existence but never say when it opens or how long it stays open — the numbers had no name the
+ * documentation could cite.
+ *
+ * The delivery service derives from this object and the customer documentation projects it.
+ */
+export declare const SIEM_DELIVERY_RELIABILITY_CONTRACT: {
+    /** Consecutive delivery failures to one destination before deliveries to it are paused. */
+    readonly circuitBreakerFailureThreshold: 5;
+    /** How long the pause lasts before one delivery is tried again. */
+    readonly circuitBreakerCooldownMinutes: 5;
+};
+/** The cooldown in milliseconds, for the delivery worker's own timers. */
+export declare const SIEM_CIRCUIT_BREAKER_COOLDOWN_MS: number;
+//# sourceMappingURL=siem-delivery-reliability-contract.shared.d.ts.map

package/dist/esm/security/authentications/siem/siem-delivery-reliability-contract.shared.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"siem-delivery-reliability-contract.shared.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-reliability-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;IAC7C,2FAA2F;;IAE3F,mEAAmE;;CAE3D,CAAC;AAEX,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,EAAE,MAAqF,CAAC"}

package/dist/esm/security/authentications/siem/siem-delivery-reliability-contract.shared.js ADDED Viewed

@@ -0,0 +1,21 @@
+/**
+ * What an operator can rely on when a SIEM receiver starts failing.
+ *
+ * The retry count, backoff and timeout are configurable per organization and already live on
+ * `SiemExportConfigBaseSchema`. The circuit breaker is not configurable: it is a fixed protection
+ * against a failing receiver absorbing the delivery worker, and it was two module-private constants
+ * inside the delivery service. That is why the operations page could describe the breaker's
+ * existence but never say when it opens or how long it stays open — the numbers had no name the
+ * documentation could cite.
+ *
+ * The delivery service derives from this object and the customer documentation projects it.
+ */
+export const SIEM_DELIVERY_RELIABILITY_CONTRACT = {
+    /** Consecutive delivery failures to one destination before deliveries to it are paused. */
+    circuitBreakerFailureThreshold: 5,
+    /** How long the pause lasts before one delivery is tried again. */
+    circuitBreakerCooldownMinutes: 5,
+};
+/** The cooldown in milliseconds, for the delivery worker's own timers. */
+export const SIEM_CIRCUIT_BREAKER_COOLDOWN_MS = SIEM_DELIVERY_RELIABILITY_CONTRACT.circuitBreakerCooldownMinutes * 60 * 1000;
+//# sourceMappingURL=siem-delivery-reliability-contract.shared.js.map

package/dist/esm/security/authentications/siem/siem-delivery-reliability-contract.shared.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"siem-delivery-reliability-contract.shared.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-reliability-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,2FAA2F;IAC3F,8BAA8B,EAAE,CAAC;IACjC,mEAAmE;IACnE,6BAA6B,EAAE,CAAC;CACxB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAAW,kCAAkC,CAAC,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC","sourcesContent":["/**\n * What an operator can rely on when a SIEM receiver starts failing.\n *\n * The retry count, backoff and timeout are configurable per organization and already live on\n * `SiemExportConfigBaseSchema`. The circuit breaker is not configurable: it is a fixed protection\n * against a failing receiver absorbing the delivery worker, and it was two module-private constants\n * inside the delivery service. That is why the operations page could describe the breaker's\n * existence but never say when it opens or how long it stays open — the numbers had no name the\n * documentation could cite.\n *\n * The delivery service derives from this object and the customer documentation projects it.\n */\nexport const SIEM_DELIVERY_RELIABILITY_CONTRACT = {\n /** Consecutive delivery failures to one destination before deliveries to it are paused. */\n circuitBreakerFailureThreshold: 5,\n /** How long the pause lasts before one delivery is tried again. */\n circuitBreakerCooldownMinutes: 5,\n} as const;\n\n/** The cooldown in milliseconds, for the delivery worker's own timers. */\nexport const SIEM_CIRCUIT_BREAKER_COOLDOWN_MS: number = SIEM_DELIVERY_RELIABILITY_CONTRACT.circuitBreakerCooldownMinutes * 60 * 1000;\n"]}

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -16,7 +16,7 @@ import { z } from 'zod';
 import { PlatformAccessGrantStatus, PlatformAccessGrants_Operations } from './platform-access-grants.shared.schemas';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
 import { type ResourceRelationship } from '../../resources/resources.shared.schemas';
-type PlatformAccessGrantsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.COUNT | CoreResourceOperation.DELETE;
+type PlatformAccessGrantsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.COUNT | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY;
 export declare const platformAccessGrantsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<typeof PlatformAccessGrants_Operations, PlatformAccessGrantsCoreOperations, z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"platform-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;~~AAOlD~~,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,CAAC;~~AAEjC~~,eAAO,MAAM,+DAA+D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;~~kBAqP1H~~,CAAC"}
1	+ {"version":3,"file":"platform-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAQlD,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAE5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,+DAA+D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;kBA2S1H,CAAC"}

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.js CHANGED Viewed

@@ -20,6 +20,7 @@ import { createResourceConfiguration_Initialization } from '../../resources/reso
 import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from './roles.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas.js';
 export const platformAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
     mainSchema: PlatformAccessGrantSchema,
     resourceIdentifier: CoreResourceType.PLATFORM_ACCESS_GRANTS,
@@ -56,14 +57,56 @@ export const platformAccessGrantsResourceConfiguration_InitializationFactory = (
          */
         exportSubject: ResourceSystemAccessMode.FORBIDDEN,
     },
+    /**
+     * Subject erasure RETAINS this row and scrubs its free text.
+     *
+     * Note this is a DIFFERENT question from the `exportSubject: FORBIDDEN` above, and the two answers
+     * differ deliberately. That one asks whether the monitored operator may READ the monitoring trail —
+     * no. This one asks what erasure DOES to the row, and nothing here says erasure must not reach it.
+     *
+     * The grant survives because its security value is WHO reached WHICH tenant, WHEN, and under whose
+     * approval — none of which is scrubbed. What does not survive is `justification` and `decisionReason`:
+     * operator- and approver-written prose, and the surface most likely to name a third party in passing.
+     * That makes the erasure narrow rather than destructive of the record.
+     *
+     * Contrast `auditLogs`, which is exempt outright: it is the immutable ledger of what happened,
+     * including this erasure, so scrubbing it would destroy the evidence the erasure was performed.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,
+    },
+    /**
+     * Erasing one of these rows revokes NO session. The grant is a record ABOUT an operator's access, not
+     * the operator; their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
         CoreResourceOperation.COUNT,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
         // Present for the tenant-purge cascade ONLY — see the operation's configuration below.
         CoreResourceOperation.DELETE,
     ],
     operationsConfiguration: {
+        /*
+         * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be REPOSITORY_ONLY: the
+         * retention primitives resolve through `getServiceOperationPathDefault`, which matches only
+         * INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize writer uses to stamp markers.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
         [CoreResourceOperation.READ]: {
             variants: [
                 {