npm - @wildo-ai/saas-models - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-models 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (645) hide show

package/dist/esm/security/api-keys/api-keys-organization.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api-keys-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAExG,oCAAoC;AACpC,MAAM,0BAA0B,GAAG;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;AAEF,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,GAAG,0BAA0B;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,GAAG,wBAAwB,EAAE,QAAQ,CAAU,CAAC;AAExF,mDAAmD;AACnD,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,oDAA2B,CAAA;AAC7B,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;IACjD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,YAAY,CAAC;IAC1F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,mDAAmD;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,sEAAsE;oBACtE,4DAA4D;oBAC5D,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;oBAClE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,sEAAsE;oBACtE,0EAA0E;oBAC1E,uEAAuE;oBACvE,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,4EAA4E;oBAC5E,+BAA+B;oBAC/B,+DAA+D;oBAC/D,2EAA2E;oBAC3E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,8BAA8B;oBAC9B,oEAAoE;oBACpE,wEAAwE;oBACxE,sEAAsE;oBACtE,2EAA2E;oBAC3E,sCAAsC;oBACtC,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,qEAAqE;oBACrE,mEAAmE;oBACnE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,2EAA2E;oBAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,oFAAoF;oBACpF,qFAAqF;oBACrF,iFAAiF;oBACjF,4EAA4E;oBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,oCAAoC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gDAAgD;oBAC/F,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,0EAA0E;oBAC1E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,wEAAwE;oBACxE,oCAAoC;oBACpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,2EAA2E;oBAC3E,4EAA4E;oBAC5E,qEAAqE;oBACrE,0DAA0D;iBAC3D;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,qEAAqE;oBACrE,yEAAyE;oBACzE,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,wEAAwE;oBACxE,4EAA4E;oBAC5E,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,0BAA0B;oBACxC,UAAU,EAAE,wBAAwB;oBACpC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC;oBAClD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization API Keys Shared Resource Configuration\n \n Resource configuration for managing organization-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within organizations.\n /\n\nimport { z } from 'zod';\nimport {\n ApiKeyOrganizationSchema,\n ApiKeyStatus\n} from './api-keys.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization API keys\nconst ORG_API_KEYS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// App users get basic filter fields\nconst ORG_API_KEYS_FILTER_FIELDS = {\n status: z.enum(ApiKeyStatus),\n name: z.string(),\n organizationId: z.string(),\n hasExpiration: z.boolean(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_API_KEYS_ADMIN_FILTER_FIELDS = {\n ...ORG_API_KEYS_FILTER_FIELDS,\n lastUsedAt: z.date(), // Admin can filter by last usage\n expiresAt: z.date(), // Admin can filter by expiration\n createdAt: z.date(), // Admin can filter by creation date\n updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_API_KEYS_ADMIN_SORT_FIELDS = [...ORG_API_KEYS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization API keys\nexport enum OrgApiKeys_Operations {\n ROTATE = 'rotate', // Generate new key and invalidate old one\n REGENERATE = 'regenerate', // Generate new key without invalidating old one\n DEACTIVATE = 'deactivate', // Deactivate key\n REACTIVATE = 'reactivate', // Reactivate key\n EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype OrgApiKeysCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.COUNT;\n\n/\nOrganization API Keys Resource Configuration Factory\n*/\nexport const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof OrgApiKeys_Operations,\n OrgApiKeysCoreOperations,\n typeof ApiKeyOrganizationSchema\n>({\n mainSchema: ApiKeyOrganizationSchema,\n resourceIdentifier: CoreResourceType.ORG_API_KEYS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_API_KEYS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Organization API keys are a core system resource\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.DELETE,\n CoreResourceOperation.COUNT,\n ],\n\n customOperation: OrgApiKeys_Operations,\n\n operationsConfiguration: {\n [CoreResourceOperation.COUNT]: {\n variants: [\n {\n // Feature usage accounting counts org API keys through the repository\n // layer. This operation does not need public HTTP exposure.\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Organization admins can view\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // requestDto auto-derived from decorators\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (it exists\n // nowhere else after this response — only its SHA-256 hash is persisted).\n // Security decision: an app-super-admin creating a key for another org\n // DOES receive the plaintext so they can relay it to the org. Mirror of\n // the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can delete keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.ROTATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n oldKeyId: z.string(),\n oldKeyInvalidationDate: z.date()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Request AND response both MIRROR the org-admin\n // default (paired spec: \"Super-admin `admin` HTTP variants mirror org-admin\n // operations across tenants\"):\n // - requestDto: an app-super-admin can choose the same future\n // `oldKeyInvalidationDate` window as an org admin. Without it the admin\n // variant would build no request DTO and the impl could only default the\n // invalidation to now — silently denying the future-window capability the\n // default variant exposes.\n // - customResponseDto: without it the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (plus the\n // rotated-out key's id + invalidation date). Security decision: an\n // app-super-admin rotating another org's key DOES receive the plaintext\n // so they can relay it to the org.\n // Keep both in sync with the default variant above.\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n oldKeyId: z.string(),\n oldKeyInvalidationDate: z.date()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REGENERATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // REGENERATE reissues the secret and nothing else — it takes no caller input\n // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n // auto-derived UPDATE contract would apply: the reissue prefix returns\n // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n // runs in the CREATE handler only) on a resource with no core UPDATE.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey`. Security\n // decision: an app-super-admin regenerating another org's key DOES\n // receive the plaintext so they can relay it to the org. Mirror of the\n // default variant's `customResponseDto` above — keep in sync.\n // `requestDto` mirrors the default variant too: no caller input, so the\n // cross-tenant variant cannot rewrite `roles` through \"regenerate\" either.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.DEACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n // selects the core path that persists; it must NOT also hand the caller UPDATE's\n // request contract. Omitting `requestDto` here would auto-derive the resource's\n // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n // implementation; see `api-keys.custom-impl.backend.service.ts`.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.ACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each variant builds\n // its own, so this cross-tenant variant needs its own narrowing or it re-derives the\n // full UPDATE contract. It also carries NO `enabledCondition`, so the transition\n // precondition is enforced solely by the prefix implementation's 409 guard.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.INACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant narrowing — see the DEACTIVATE `admin` variant note above.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.EXTEND_EXPIRY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can extend expiry\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n }),\n enabledCondition: ({ currentObject }) => {\n return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can extend expiry for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Request parity with the org-admin default (spec: \"admin variants mirror\n // org-admin operations across tenants\"). `newExpiresAt` is REQUIRED and has\n // no default, so without this requestDto the admin variant builds no request\n // DTO and an app-super-admin literally cannot pass the new expiry — the\n // operation is unusable for admins.\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n }),\n // enabledCondition deliberately OMITTED, matching the sibling DEACTIVATE /\n // REACTIVATE admin variants: it is a frontend action-affordance gate, not a\n // backend guard, and the app-super-admin cross-tenant surface is not\n // state-gated the way the in-tenant org-admin surface is.\n }\n ]\n },\n\n [OrgApiKeys_Operations.USAGE_STATS]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Any org member can view usage stats\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n customResponseDto: z.object({\n keyId: z.string(),\n totalRequests: z.number().min(0),\n requestsLastHour: z.number().min(0),\n requestsLastDay: z.number().min(0),\n requestsLastWeek: z.number().min(0),\n lastUsedAt: z.date().optional(),\n mostUsedEndpoint: z.string().optional(),\n errorRate: z.number().min(0).max(100), // Percentage\n rateLimitHits: z.number().min(0)\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can view usage stats for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` (the resource object); because the stats shape is DISJOINT\n // from it (missing name/scope/organizationId/hashedKey/keyPrefix), the\n // serializer would reject the impl's output → latent 500. Stats are not a\n // secret — the app-super-admin gets the same oversight view as the org.\n // Mirror of the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: z.object({\n keyId: z.string(),\n totalRequests: z.number().min(0),\n requestsLastHour: z.number().min(0),\n requestsLastDay: z.number().min(0),\n requestsLastWeek: z.number().min(0),\n lastUsedAt: z.date().optional(),\n mostUsedEndpoint: z.string().optional(),\n errorRate: z.number().min(0).max(100), // Percentage\n rateLimitHits: z.number().min(0)\n }),\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description', 'keyId'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_ADMIN_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_ADMIN_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"api-keys-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,YAAY,EACb,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAExG,oCAAoC;AACpC,MAAM,0BAA0B,GAAG;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;AAEF,qEAAqE;AACrE,MAAM,gCAAgC,GAAG;IACvC,GAAG,0BAA0B;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,8BAA8B,GAAG,CAAC,GAAG,wBAAwB,EAAE,QAAQ,CAAU,CAAC;AAExF,mDAAmD;AACnD,MAAM,CAAN,IAAY,qBAQX;AARD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,kDAAyB,CAAA;IACzB,wDAA+B,CAAA;IAC/B,0CAAiB,CAAA;IACjB,oDAA2B,CAAA;AAC7B,CAAC,EARW,qBAAqB,KAArB,qBAAqB,QAQhC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAIjK;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,gBAAgB,CAAC,YAAY;IACjD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,YAAY,CAAC;IAC1F,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,mDAAmD;IAE3E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,qBAAqB;IAEtC,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,sEAAsE;oBACtE,4DAA4D;oBAC5D,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;oBAClE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,mCAAmC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,sEAAsE;oBACtE,0EAA0E;oBAC1E,uEAAuE;oBACvE,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kCAAkC;oBACrE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;oBACpF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,sFAAsF;oBACtF,uFAAuF;oBACvF,0FAA0F;oBAC1F,uFAAuF;oBACvF,6EAA6E;oBAC7E,gEAAgE;oBAChE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,4EAA4E;oBAC5E,+BAA+B;oBAC/B,+DAA+D;oBAC/D,2EAA2E;oBAC3E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,8BAA8B;oBAC9B,oEAAoE;oBACpE,wEAAwE;oBACxE,sEAAsE;oBACtE,2EAA2E;oBAC3E,sCAAsC;oBACtC,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAC7H,CAAC;oBACF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;wBACpB,sBAAsB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACjC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,8EAA8E;oBAC9E,uEAAuE;oBACvE,8EAA8E;oBAC9E,6EAA6E;oBAC7E,8EAA8E;oBAC9E,sEAAsE;oBACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,qEAAqE;oBACrE,mEAAmE;oBACnE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,2EAA2E;oBAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC;wBACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC1C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iFAAiF;oBACjF,iFAAiF;oBACjF,gFAAgF;oBAChF,8EAA8E;oBAC9E,mFAAmF;oBACnF,mFAAmF;oBACnF,0EAA0E;oBAC1E,iEAAiE;oBACjE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;oBACtD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,oFAAoF;oBACpF,qFAAqF;oBACrF,iFAAiF;oBACjF,4EAA4E;oBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE;YAClC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,sCAAsC;oBACzE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,8EAA8E;oBAC9E,yFAAyF;oBACzF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,YAAY,CAAC,QAAQ,CAAC;oBACxD,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,yCAAyC;oBACxF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,yEAAyE;oBACzE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,+BAA+B;SAChC;QAED,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,oCAAoC;oBACvE,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,CAAC;oBACnF,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,gDAAgD;oBAC/F,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,0EAA0E;oBAC1E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,wEAAwE;oBACxE,oCAAoC;oBACpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,2CAA2C,CAAC;qBACpF,CAAC;oBACF,2EAA2E;oBAC3E,4EAA4E;oBAC5E,qEAAqE;oBACrE,0DAA0D;iBAC3D;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,mDAAmD;oBAClG,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,qEAAqE;oBACrE,yEAAyE;oBACzE,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,wEAAwE;oBACxE,4EAA4E;oBAC5E,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;wBACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACnC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa;wBACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;qBACjC,CAAC;iBACH;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,0BAA0B;oBACxC,UAAU,EAAE,wBAAwB;oBACpC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC;oBAClD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,gCAAgC;oBAC9C,UAAU,EAAE,8BAA8B;oBAC1C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization API Keys Shared Resource Configuration\n \n Resource configuration for managing organization-scoped API keys.\n * Handles creation, management, rotation, and monitoring of API keys within organizations.\n /\n\nimport { z } from 'zod';\nimport {\n ApiKeyOrganizationSchema,\n ApiKeyStatus\n} from './api-keys.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization API keys\nconst ORG_API_KEYS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// App users get basic filter fields\nconst ORG_API_KEYS_FILTER_FIELDS = {\n status: z.enum(ApiKeyStatus),\n name: z.string(),\n organizationId: z.string(),\n hasExpiration: z.boolean(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_API_KEYS_ADMIN_FILTER_FIELDS = {\n ...ORG_API_KEYS_FILTER_FIELDS,\n lastUsedAt: z.date(), // Admin can filter by last usage\n expiresAt: z.date(), // Admin can filter by expiration\n createdAt: z.date(), // Admin can filter by creation date\n updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_API_KEYS_ADMIN_SORT_FIELDS = [...ORG_API_KEYS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization API keys\nexport enum OrgApiKeys_Operations {\n ROTATE = 'rotate', // Generate new key and invalidate old one\n REGENERATE = 'regenerate', // Generate new key without invalidating old one\n DEACTIVATE = 'deactivate', // Deactivate key\n REACTIVATE = 'reactivate', // Reactivate key\n EXTEND_EXPIRY = 'extend_expiry', // Extend expiration date\n EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n USAGE_STATS = 'usage_stats', // Get usage statistics\n}\n\ntype OrgApiKeysCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.COUNT;\n\n/\nOrganization API Keys Resource Configuration Factory\n/\nexport const orgApiKeysResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof OrgApiKeys_Operations,\n OrgApiKeysCoreOperations,\n typeof ApiKeyOrganizationSchema\n>({\n mainSchema: ApiKeyOrganizationSchema,\n resourceIdentifier: CoreResourceType.ORG_API_KEYS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_API_KEYS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Organization API keys are a core system resource\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.DELETE,\n CoreResourceOperation.COUNT,\n ],\n\n customOperation: OrgApiKeys_Operations,\n\n operationsConfiguration: {\n [CoreResourceOperation.COUNT]: {\n variants: [\n {\n // Feature usage accounting counts org API keys through the repository\n // layer. This operation does not need public HTTP exposure.\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Organization admins can view\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // requestDto auto-derived from decorators\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (it exists\n // nowhere else after this response — only its SHA-256 hash is persisted).\n // Security decision: an app-super-admin creating a key for another org\n // DOES receive the plaintext so they can relay it to the org. Mirror of\n // the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can delete keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.ROTATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n oldKeyId: z.string(),\n oldKeyInvalidationDate: z.date()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org keys\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Irreversible reissue AND a secret handback. ROTATE schedules the prior credential's\n // invalidation at the requested boundary (default: now) and returns the replacement in\n // plaintext (`plainKey`, `.isEphemeral()`). Once that boundary passes, integrations still\n // using the prior value break and it cannot be restored. An unauthorized rotate is not\n // merely destructive: the caller WALKS AWAY WITH the replacement credential.\n // A live session alone is deliberately not sufficient for that.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Request AND response both MIRROR the org-admin\n // default (paired spec: \"Super-admin `admin` HTTP variants mirror org-admin\n // operations across tenants\"):\n // - requestDto: an app-super-admin can choose the same future\n // `oldKeyInvalidationDate` window as an org admin. Without it the admin\n // variant would build no request DTO and the impl could only default the\n // invalidation to now — silently denying the future-window capability the\n // default variant exposes.\n // - customResponseDto: without it the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey` (plus the\n // rotated-out key's id + invalidation date). Security decision: an\n // app-super-admin rotating another org's key DOES receive the plaintext\n // so they can relay it to the org.\n // Keep both in sync with the default variant above.\n requestDto: z.object({\n oldKeyInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n oldKeyId: z.string(),\n oldKeyInvalidationDate: z.date()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REGENERATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // REGENERATE reissues the secret and nothing else — it takes no caller input\n // (contrast ROTATE, which accepts `oldKeyInvalidationDate`). Without this the\n // auto-derived UPDATE contract would apply: the reissue prefix returns\n // `{ ...input, hashedKey, … }` and the dispatcher MERGES that onto the caller\n // payload, so `roles` would be writable through \"regenerate\" — bypassing the\n // ceiling gate that guards minting (`assertRequestedRolesWithinCallerCeiling`\n // runs in the CREATE handler only) on a resource with no core UPDATE.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainKey`. Security\n // decision: an app-super-admin regenerating another org's key DOES\n // receive the plaintext so they can relay it to the org. Mirror of the\n // default variant's `customResponseDto` above — keep in sync.\n // `requestDto` mirrors the default variant too: no caller input, so the\n // cross-tenant variant cannot rewrite `roles` through \"regenerate\" either.\n requestDto: z.object({}),\n customResponseDto: ApiKeyOrganizationSchema.extend({\n plainKey: z.string().min(1).isEphemeral(),\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.DEACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE\n // selects the core path that persists; it must NOT also hand the caller UPDATE's\n // request contract. Omitting `requestDto` here would auto-derive the resource's\n // FULL update DTO (`{name, description, roles, status, expiresAt}`) — letting\n // `PUT .../deactivate` carry `status: active` (the exact opposite of the verb) and\n // rewrite `roles` with no ceiling gate, on a resource that deliberately exposes no\n // core UPDATE at all. `status` is forced to INACTIVE by the paired prefix\n // implementation; see `api-keys.custom-impl.backend.service.ts`.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.ACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each variant builds\n // its own, so this cross-tenant variant needs its own narrowing or it re-derives the\n // full UPDATE contract. It also carries NO `enabledCondition`, so the transition\n // precondition is enforced solely by the prefix implementation's 409 guard.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [OrgApiKeys_Operations.REACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // No input: `status` is forced to ACTIVE by the paired prefix implementation.\n // See the DEACTIVATE note above for why the auto-derived UPDATE contract is unsafe here.\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === ApiKeyStatus.INACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org keys\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant narrowing — see the DEACTIVATE `admin` variant note above.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n /\n ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n * the sweep is the only caller.\n \n Not an operator verb, deliberately. An administrator who wants a key gone uses DEACTIVATE and\n * one who wants it to last longer uses EXTEND_EXPIRY; there is no reason for a human to declare\n * that a date has passed. Being INTERNAL_CALL also removes, rather than defends against, the\n * hazard DEACTIVATE documents at length — with no route there is no request contract to\n * auto-derive and no `PUT .../expire` that could carry `status: active`.\n \n It exists so the sweep writes through a GUARDED door rather than setting `status` directly: a\n * direct write would be a second authority over the field and would skip the ACTIVE-only\n * precondition, which lives in the paired prefix implementation\n * (`api-keys.custom-impl.backend.service.ts`) because that is the enforcement an\n * `enabledCondition` cannot be.\n */\n [OrgApiKeys_Operations.EXPIRE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n // and the paired prefix implementation forces the status transition itself, so there is no field\n // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n requestDto: z.object({}),\n }\n ],\n // No notification: expiry is the scheduled consequence of a date the administrator set, not\n // an event. The signal that would be worth sending — a key ABOUT to expire — is a different\n // feature and is not this one.\n },\n\n [OrgApiKeys_Operations.EXTEND_EXPIRY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can extend expiry\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n }),\n enabledCondition: ({ currentObject }) => {\n return currentObject.expiresAt !== null && currentObject.expiresAt !== undefined;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can extend expiry for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Request parity with the org-admin default (spec: \"admin variants mirror\n // org-admin operations across tenants\"). `newExpiresAt` is REQUIRED and has\n // no default, so without this requestDto the admin variant builds no request\n // DTO and an app-super-admin literally cannot pass the new expiry — the\n // operation is unusable for admins.\n requestDto: z.object({\n newExpiresAt: z.date().min(new Date(), 'New expiration date must be in the future')\n }),\n // enabledCondition deliberately OMITTED, matching the sibling DEACTIVATE /\n // REACTIVATE admin variants: it is a frontend action-affordance gate, not a\n // backend guard, and the app-super-admin cross-tenant surface is not\n // state-gated the way the in-tenant org-admin surface is.\n }\n ]\n },\n\n [OrgApiKeys_Operations.USAGE_STATS]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Any org member can view usage stats\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n customResponseDto: z.object({\n keyId: z.string(),\n totalRequests: z.number().min(0),\n requestsLastHour: z.number().min(0),\n requestsLastDay: z.number().min(0),\n requestsLastWeek: z.number().min(0),\n lastUsedAt: z.date().optional(),\n mostUsedEndpoint: z.string().optional(),\n errorRate: z.number().min(0).max(100), // Percentage\n rateLimitHits: z.number().min(0)\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can view usage stats for any org keys\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.READ,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` (the resource object); because the stats shape is DISJOINT\n // from it (missing name/scope/organizationId/hashedKey/keyPrefix), the\n // serializer would reject the impl's output → latent 500. Stats are not a\n // secret — the app-super-admin gets the same oversight view as the org.\n // Mirror of the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: z.object({\n keyId: z.string(),\n totalRequests: z.number().min(0),\n requestsLastHour: z.number().min(0),\n requestsLastDay: z.number().min(0),\n requestsLastWeek: z.number().min(0),\n lastUsedAt: z.date().optional(),\n mostUsedEndpoint: z.string().optional(),\n errorRate: z.number().min(0).max(100), // Percentage\n rateLimitHits: z.number().min(0)\n }),\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description', 'keyId'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_API_KEYS_ADMIN_FILTER_FIELDS,\n sortFields: ORG_API_KEYS_ADMIN_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ],\n },\n },\n});\n"]}

package/dist/esm/security/api-keys/api-keys.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api-keys.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,oBAAY,WAAW;IACrB,YAAY,iBAAkB;IAC9B,WAAW,gBAAkB;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAGnF,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uCAAuC,iBAAgC,CAAC;AAErF,+GAA+G;AAC/G,eAAO,MAAM,+BAA+B,EAAE,4BAG5C,CAAC;AAEH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;CACjE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAQD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBAyC3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;iBAenC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;iBAelC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE1C,CAAC;AAGH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
1	+ {"version":3,"file":"api-keys.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,oBAAY,WAAW;IACrB,YAAY,iBAAkB;IAC9B,WAAW,gBAAkB;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAGnF,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uCAAuC,iBAAgC,CAAC;AAErF,+GAA+G;AAC/G,eAAO,MAAM,+BAA+B,EAAE,4BAG5C,CAAC;AAEH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;CACjE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAQD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBAyC3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;iBAenC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;iBAelC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE1C,CAAC;AAGH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/esm/security/authentications/anonymous-session/anonymous-session.shared.contract.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"anonymous-session.shared.contract.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/anonymous-session/anonymous-session.shared.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oCAAoC;;;CAGvC,CAAC;AAEX,MAAM,MAAM,+BAA+B,GACzC,OAAO,oCAAoC,CAAC,MAAM,OAAO,oCAAoC,CAAC,CAAC;AAOjG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,8BAA8B;;;;CAIjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,OAAO,8BAA8B,CAAC,MAAM,OAAO,8BAA8B,CAAC,CAAC;AAOrF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B;;;CAG/B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,mCAAmC,EAAG,KAAc,CAAC;AAOlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzD,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;CAC9B,CAIC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,sCAAsC;IAChD,IAAI,SAAiB;IACrB,YAAY,iBAAiB;IAC7B,MAAM,WAAiB;IACvB,WAAW,gBAAiB;IAC5B,OAAO,YAAiB;CACzB;AAED,eAAO,MAAM,wCAAwC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,sCAAsC,CAC9D,CAAC;AAEjD,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC"}
1	+ {"version":3,"file":"anonymous-session.shared.contract.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/anonymous-session/anonymous-session.shared.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oCAAoC;;;CAGvC,CAAC;AAEX,MAAM,MAAM,+BAA+B,GACzC,OAAO,oCAAoC,CAAC,MAAM,OAAO,oCAAoC,CAAC,CAAC;AAOjG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,8BAA8B;;;;CAIjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,OAAO,8BAA8B,CAAC,MAAM,OAAO,8BAA8B,CAAC,CAAC;AAOrF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B;;;CAG/B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,mCAAmC,EAAG,KAAc,CAAC;AAOlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzD,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;CAC9B,CAIC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,sCAAsC;IAChD,IAAI,SAAiB;IACrB,YAAY,iBAAiB;IAC7B,MAAM,WAAiB;IACvB,WAAW,gBAAiB;IAC5B,OAAO,YAAiB;CACzB;AAED,eAAO,MAAM,wCAAwC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,sCAAsC,CAC9D,CAAC;AAEjD,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC"}

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts CHANGED Viewed

@@ -43,7 +43,6 @@ export declare const AuthInvitationInfoResponseSchema: z.ZodObject<{
         config: z.ZodOptional<z.ZodObject<{
             rpName: z.ZodOptional<z.ZodString>;
             rpId: z.ZodOptional<z.ZodString>;
-            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
             displayName: z.ZodOptional<z.ZodString>;
             providerRef: z.ZodOptional<z.ZodString>;
             connectionId: z.ZodOptional<z.ZodString>;
@@ -98,7 +97,6 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
         config: z.ZodOptional<z.ZodObject<{
             rpName: z.ZodOptional<z.ZodString>;
             rpId: z.ZodOptional<z.ZodString>;
-            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
             displayName: z.ZodOptional<z.ZodString>;
             providerRef: z.ZodOptional<z.ZodString>;
             connectionId: z.ZodOptional<z.ZodString>;
@@ -123,7 +121,6 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
         config: z.ZodOptional<z.ZodObject<{
             rpName: z.ZodOptional<z.ZodString>;
             rpId: z.ZodOptional<z.ZodString>;
-            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
             displayName: z.ZodOptional<z.ZodString>;
             providerRef: z.ZodOptional<z.ZodString>;
             connectionId: z.ZodOptional<z.ZodString>;
@@ -144,7 +141,6 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
         externalProviderId: z.ZodString;
         iconUrl: z.ZodOptional<z.ZodURL>;
     }, z.core.$strip>>>;
-    ssoMigrationRequired: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
  * Base authentication request schema with factor context
@@ -435,7 +431,7 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
             phoneNumber: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPhoneSchema>;
             title: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
         }, z.core.$strip>>;
-        userSelfPreference: z.ZodOptional<z.ZodObject<{
+        userSelfPreferences: z.ZodOptional<z.ZodObject<{
             _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
             userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
             notifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
@@ -452,10 +448,10 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
                 theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").UserTheme>>>;
             }, z.core.$strip>>>;
             regional: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
-                timezone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/presets-components-models").CommonTimezone>, z.ZodString]>>>;
-                dateFormat: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").DateFormat>>>;
-                timeFormat: z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").TimeFormat>>>;
-                locale: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>;
+                timezone: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/presets-components-models").CommonTimezone>, z.ZodString]>>>;
+                dateFormat: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").DateFormat>>>;
+                timeFormat: z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").TimeFormat>>>;
+                locale: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>;
             }, z.core.$strip>>>>;
             languagePreferences: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
                 primaryLanguage: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>;
@@ -503,7 +499,6 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
         config: z.ZodOptional<z.ZodObject<{
             rpName: z.ZodOptional<z.ZodString>;
             rpId: z.ZodOptional<z.ZodString>;
-            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
             displayName: z.ZodOptional<z.ZodString>;
             providerRef: z.ZodOptional<z.ZodString>;
             connectionId: z.ZodOptional<z.ZodString>;
@@ -604,7 +599,6 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
         config: z.ZodOptional<z.ZodObject<{
             rpName: z.ZodOptional<z.ZodString>;
             rpId: z.ZodOptional<z.ZodString>;
-            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
             displayName: z.ZodOptional<z.ZodString>;
             providerRef: z.ZodOptional<z.ZodString>;
             connectionId: z.ZodOptional<z.ZodString>;
@@ -628,7 +622,6 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
         config: z.ZodOptional<z.ZodObject<{
             rpName: z.ZodOptional<z.ZodString>;
             rpId: z.ZodOptional<z.ZodString>;
-            registeredPasskeyCount: z.ZodOptional<z.ZodNumber>;
             displayName: z.ZodOptional<z.ZodString>;
             providerRef: z.ZodOptional<z.ZodString>;
             connectionId: z.ZodOptional<z.ZodString>;

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EAEd,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgC3C~~,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;iBAKlC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBA6CvC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,uDAAuD;IACtG,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,kDAAkD;IAGjG,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,2BAA2B~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBA+FtC,CAAC;AAWH;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}
1	+ {"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EAEd,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8B3C,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;iBAKlC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6CvC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,uDAAuD;IACtG,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,kDAAkD;IAGjG,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+FtC,CAAC;AAWH;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/esm/security/authentications/authentication.shared.dto.schemas.js CHANGED Viewed

@@ -93,7 +93,6 @@ export const AuthIdentificationResponseSchema = z.object({
         externalProviderId: z.string(), // Which auth provider enables this integration
         iconUrl: z.url().optional()
     })).default([]),
-    ssoMigrationRequired: z.boolean().default(false),
 });
 // ===============================
 // AUTHENTICATION REQUEST SCHEMAS

package/dist/esm/security/authentications/authentication.shared.dto.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEzF;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,0HAA0H;IAC1H,yCAAa,CAAA;IACb,sHAAsH;IACtH,uCAAW,CAAA;IACX,8TAA8T;IAC9T,yCAAa,CAAA;AACf,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE;IACvB,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,2FAA2F;IAC3F,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3D,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAEvB,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEvD,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,oCAAoC;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,4DAA4D;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,+CAA+C;QAC/E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACjD,CAAC,CAAC;AAIH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC,wCAAwC;IACxC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;IACxE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB;IAEhD,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qCAAqC;IACxF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,mCAAmC;CAC5F,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,oBAAoB;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACjD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;QACF,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC;AAIH,kCAAkC;AAClC,gCAAgC;AAChC,kCAAkC;AAElC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH,kCAAkC;AAClC,wCAAwC;AACxC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACpD,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACpC,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,yBAAyB;IACzB,iCAAiC;IACjC,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEzC,sEAAsE;IACtE,oEAAoE;IACpE,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEnC,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9E,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,uBAAuB;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,kCAAkC;AAClC,2BAA2B;AAC3B,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAG9D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,oBAAoB;IACpB,iDAAmB,CAAA;IACnB,uDAAyB,CAAA;IACzB,mFAAqD,CAAA;IACrD,+EAAiD,CAAA;IACjD,2DAA6B,CAAA;IAC7B,qFAAuD,CAAA;IACvD,qDAAuB,CAAA;IACvB,mEAAqC,CAAA;IAErC,mCAAmC;IACnC,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,iFAAmD,CAAA;IACnD,2EAA6C,CAAA;IAC7C,uEAAyC,CAAA;IAEzC,kBAAkB;IAClB,+CAAiB,CAAA;IACjB,iDAAmB,CAAA;IACnB,+CAAiB,CAAA,CAA8B,0CAA0C;AAC3F,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAEzC,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,gJAAgJ;IAChJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,kFAAkF;IAClF,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE5C,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAEzC,gGAAgG;IAChG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,wHAAwH;IACxH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEnE,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAEjD,oBAAoB;IACpB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAExE,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,0IAA0I;IAC1I,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE5C,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IAEtB,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,mDAAmD;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAClC,6DAA6D;AAC7D,gEAAgE;AAChE,yEAAyE;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;CACH,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,gBAAgB,EAAE;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAA+B,MAAe;IAChF,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,aAAa,EAAE;KAClE,CAAY,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAA+B,MAAe;IACxE,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,GAAG,EAAE;KACxD,CAAY,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAKH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC1D,CAAC,CAAC,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACH,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,cAAc,6CAA6C,CAAC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\nimport { UserContextSchema } from '../../users/users.shared.schemas';\nimport {\n AuthMethod,\n AuthFactorLevel,\n AuthNextStep,\n AuthSessionPurpose,\n AuthScopeType,\n AvailableMethodSchema,\n} from './authentication.shared.schemas';\nimport { AuthUtils } from './authentication.shared.utils';\nimport { SessionType } from '../../runtime/execution-context.shared.schemas';\nimport { PasswordPolicyRulesSchema } from '../../config/app-configuration-shared.shared.schemas';\nimport { AutocompleteFieldIdentifier, ZodTypeForColors } from '@wildo-ai/zod-decorators';\n\n/\n Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,\n * from the invitation token alone, which first-factor auth methods the target\n * organization allows and whether the org is SSO/SCIM-managed.\n \n Distinct from `identify()` (keyed by email→domain, requires an existing user):\n * this is token-keyed and works for a not-yet-activated invitee (INVITED\n * membership, no session). Populated by `GET /auth/invitation/info?token=…`,\n * which reads the token WITHOUT consuming it (unlike accept). See\n * `.claude/plans/invitation-multi-method-auth.md`.\n /\nexport enum InvitationManagementMode {\n /* No enterprise identity authority — invitee may set a local credential (password/passkey) or use any allowed method. /\n OPEN = 'open',\n /* Org authenticates via enterprise SSO — route the invitee to the IdP (JIT consumes the invite; no local accept). /\n SSO = 'sso',\n /* Org is ACTIVELY directory-managed (SCIM live — DIRECTORY_PROVISIONING feature + a live SCIM token) — informational only, NO local credential: a local password/passkey/magic-link would survive IdP deprovisioning. Derived per-org (not from the org-TYPE mount flag) — see `isOrgActivelyDirectoryManaged` / AUTH-23. /\n SCIM = 'scim',\n}\n\nexport const AuthInvitationInfoResponseSchema = z.object({\n /* The invitee's email (from the INVITED membership's denormalized `userEmail`). /\n inviteeEmail: z.email(),\n /* Display name of the organization the invitee is joining. /\n organizationName: z.string(),\n /* First-factor methods the org allows for a joining member of the invitee's user type. /\n availableFirstFactorMethods: z.array(AvailableMethodSchema),\n /* Identity-management posture — drives chooser (open/sso) vs informational state (scim). /\n managementMode: z.enum(InvitationManagementMode),\n /\n The org-join user type's ORG-MERGED password policy (the SAME policy the accept\n * endpoint validates against). Lets the chooser's PASSWORD form show the invitee the\n * org's REAL requirements (strength indicator + client pre-check) instead of the\n * app-level default — so an org that strengthens `passwordPolicy` via `authOverrides`\n * doesn't reject a client-accepted password after submit. Absent when the policy can't\n * be resolved (unknown user type / degraded org read); the frontend then falls back to\n * the app-level resolved policy. Structurally the frontend validation subset\n * (`PasswordPolicyRulesSchema`); the backend's `PasswordPolicyConfig` is field-identical\n * and parses through it losslessly.\n /\n passwordPolicy: PasswordPolicyRulesSchema.optional(),\n});\nexport type AuthInvitationInfoResponse = z.infer<typeof AuthInvitationInfoResponseSchema>;\n\n/\n Step 1: User identification by email\n * Returns available authentication methods for the user\n /\nexport const AuthIdentificationRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional()\n});\n\n\n\n/\n Step 1 Response: Available authentication methods with factor classification\n /\nexport const AuthIdentificationResponseSchema = z.object({\n sessionId: z.string(),\n email: z.email(),\n userExists: z.boolean(),\n\n // First factor methods (primary authentication)\n firstFactorMethods: z.array(AvailableMethodSchema),\n defaultFirstFactorMethod: z.enum(AuthMethod).optional(),\n\n // Second factor methods (MFA) - only shown if MFA is required\n secondFactorMethods: z.array(AvailableMethodSchema),\n requiresMFA: z.boolean(),\n mfaMethodsRequired: z.number().default(1),\n\n // Organization-specific information\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // Available integrations (if any auth method supports them)\n availableIntegrations: z.array(z.object({\n integrationId: z.string(),\n externalProviderId: z.string(), // Which auth provider enables this integration\n iconUrl: z.url().optional()\n })).default([]),\n\n ssoMigrationRequired: z.boolean().default(false),\n});\n\n\n\n// ===============================\n// AUTHENTICATION REQUEST SCHEMAS\n// ===============================\n\n/\n Base authentication request schema with factor context\n /\nexport const BaseAuthRequestSchema = z.object({\n sessionId: z.string().min(1),\n method: z.enum(AuthMethod),\n factorLevel: z.enum(AuthFactorLevel),\n rememberMe: z.boolean().default(false),\n\n // Integration access request (optional)\n requestedIntegrations: z.array(z.string()).default([])\n});\n\n\n\n/\n Password Authentication (First factor only)\n /\nexport const PasswordAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSWORD),\n factorLevel: z.literal(AuthFactorLevel.FIRST),\n password: z.string().min(1)\n});\n\n\n\n/\n Third-Party OAuth2 Authentication (First factor, extensible)\n /\nexport const External_OAuth2_AuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EXTERNAL_OAUTH2),\n factorLevel: z.enum(AuthFactorLevel),\n externalProviderId: z.string().min(1), // References configured provider\n redirectUri: z.url(),\n state: z.string().optional(), // CSRF protection\n\n // Integration-specific parameters\n additionalScopes: z.array(z.string()).default([]), // Additional scopes for integrations\n integrationPermissions: z.array(z.string()).default([]) // Specific integration permissions\n});\n\n\n\n/\n Organization SSO Authentication (First or second factor, organization-restricted)\n /\nexport const OrganizationSSOAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.enum([AuthMethod.ORG_SAML, AuthMethod.ORG_OPENID_CONNECT]),\n factorLevel: z.enum(AuthFactorLevel),\n ssoId: z.string().min(1),\n organizationId: z.string().min(1),\n\n // SSO-specific data\n samlResponse: z.string().optional(), // For SAML\n idToken: z.string().optional(), // For OpenID Connect\n state: z.string().optional()\n});\n\n\n\n/\n OAuth2 Callback Schema (for both third-party and SSO)\n /\nexport const OAuth2CallbackSchema = z.object({\n sessionId: z.string().min(1),\n externalProviderId: z.string().optional(), // For third-party OAuth2\n ssoId: z.string().optional(), // For organization SSO\n code: z.string().min(1),\n state: z.string().optional(),\n error: z.string().optional(),\n errorDescription: z.string().optional()\n});\n\n\n\n/\n TOTP Authentication (Second factor only)\n /\nexport const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.TOTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^(\\d{6}\|[a-f0-9]{8})$/)\n});\n\n\n\n/\n SMS OTP Authentication (First or second factor)\n /\nexport const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.SMS_OTP),\n factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Email OTP Authentication (Second factor only)\n /\nexport const EmailOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EMAIL_OTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Passkey (WebAuthn) Authentication (First or second factor)\n /\nexport const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSKEY),\n factorLevel: z.enum(AuthFactorLevel),\n // WebAuthn authentication response from navigator.credentials.get()\n response: z.object({\n id: z.string(),\n rawId: z.string(),\n response: z.object({\n authenticatorData: z.string(),\n clientDataJSON: z.string(),\n signature: z.string(),\n userHandle: z.string().optional(),\n }),\n authenticatorAttachment: z.string().optional(),\n clientExtensionResults: z.record(z.string(), z.any()).default({}),\n type: z.literal('public-key'),\n }),\n});\n\n\n\n// ===============================\n// MAGIC LINK SCHEMAS (Phase G2)\n// ===============================\n\n/\n Magic Link Send Request — triggers a magic link email to the user.\n * Separate from the main AuthenticationRequestSchema because it doesn't\n * go through the standard authenticate() dispatch.\n /\nexport const MagicLinkSendRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n});\n\n\n\n\n/\n Magic Link Verify Request — verifies the token from the magic link.\n * Used by POST /auth/magic-link/verify for programmatic verification.\n * Intentionally NOT added to AuthenticationRequestSchema discriminated union\n * because magic link verification follows a separate flow (GET from email click\n * → exchange code → POST verify).\n /\nexport const MagicLinkVerifyRequestSchema = z.object({\n token: z.string().min(1),\n email: z.email().toLowerCase(),\n});\n\n\n\n\n// ===============================\n// PHONE VERIFICATION SCHEMAS (Phase G2)\n// ===============================\n\n/\n Phone Verification Send Request — triggers a verification code to a phone number.\n * Used for phone number ownership verification, separate from SMS OTP auth.\n /\nexport const PhoneVerifySendRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n});\n\n\n\n\n/\n Phone Verification Confirm Request — confirms the verification code.\n /\nexport const PhoneVerifyConfirmRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n code: z.string().regex(/^\\d{4,8}$/),\n});\n\n\n\n\n/\n Union of all authentication request types\n /\nexport const AuthenticationRequestSchema = z.discriminatedUnion('method', [\n PasswordAuthRequestSchema,\n External_OAuth2_AuthRequestSchema,\n OrganizationSSOAuthRequestSchema,\n TOTPAuthRequestSchema,\n SMSOTPAuthRequestSchema,\n EmailOTPAuthRequestSchema,\n PasskeyAuthRequestSchema\n]);\n\n\n\n/\n Authentication Response Schema with Factor Context and Integration Access.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string().optional()` which was emitted in the JSON\n * body for every authentication response. The cookie migration (A-Step 2,\n * 2026-04-13) added `Set-Cookie: __wildo_refresh=…` as a parallel\n * channel; A-Step 3 (2026-04-13) made the SaaS-frontend stop reading\n * the body field; A-Step 6 (THIS step) DROPS the body field entirely\n * so the wire response physically cannot carry the refresh token.\n \n Backend internals: the orchestrator's\n * `_buildAuthenticationSuccessMethod` returns\n * `AuthenticationServiceResult = AuthenticationResponse & { refreshToken?: string }`\n * (a backend-only TS type — NOT a wire schema) so the controller can\n * extract the refresh-token value and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`. The wire\n * payload (this schema) STILL has no `refreshToken` field — the\n * controller's helper sets the cookie and emits the body separately.\n \n `integrationTokens[].refreshToken` (below) is a third-party-IdP\n * OAuth2 refresh token (Google, Microsoft, etc.) — NOT a Wildo refresh\n * token. It stays on the wire because the frontend needs it to drive\n * IdP-side API calls; it is bound to a different security model\n * (IdP-issued, IdP-rotated, never used to mint Wildo JWTs).\n /\nexport const AuthenticationResponseSchema = z.object({\n success: z.boolean(),\n sessionId: z.string(),\n userExists: z.boolean(),\n factorLevel: z.enum(AuthFactorLevel),\n authMethod: z.enum(AuthMethod).optional(),\n\n // Success response. NOTE: `refreshToken` deliberately ABSENT from the\n // wire schema (Auth-hardening A-Step 6) — see the file/schema-level\n // JSDoc above for the cookie-only contract.\n accessToken: z.string().optional(),\n expiresIn: z.number().optional(),\n user: UserContextSchema.optional(),\n\n // Integration access tokens (if requested and granted)\n integrationTokens: z.array(z.object({\n integrationId: z.string(),\n accessToken: z.string(),\n refreshToken: z.string().optional(),\n expiresIn: z.number().optional(),\n scopes: z.array(z.string())\n })).default([]),\n\n // MFA continuation\n requiresMFA: z.boolean().default(false),\n availableMFAMethods: z.array(AvailableMethodSchema).optional(),\n mfaMethodsRequired: z.number().optional(),\n completedFactors: z.array(z.enum(AuthMethod)).optional(),\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // W4.5: MFA enrollment routing\n nextStep: z.enum(AuthNextStep).optional(),\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // Error response\n error: z.string().optional(),\n errorCode: z.string().optional(),\n retryAllowed: z.boolean().default(true),\n remainingAttempts: z.number().optional(),\n lockoutUntil: z.date().optional(),\n\n // Method-specific data\n challengeData: z.record(z.string(), z.any()).optional(),\n redirectUrl: z.url().optional()\n});\n\n\n\n// ===============================\n// MFA SETUP AND MANAGEMENT\n// ===============================\n\n/\n MFA Setup Request\n /\nexport const MFASetupRequestSchema = z.object({\n method: z.enum(AuthMethod),\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n deviceName: z.string().optional()\n}).refine((data) => AuthUtils.canBeSecondFactor(data.method));\n\n\n/\n MFA Setup Response\n /\nexport const MFASetupResponseSchema = z.object({\n method: z.enum(AuthMethod),\n setupToken: z.string(),\n qrCodeUrl: z.url().optional(),\n secret: z.string().optional(),\n challenge: z.record(z.string(), z.any()).optional(),\n recoveryCodes: z.array(z.string()).optional()\n});\n\n\n\n\n/\n Authentication Session State\n /\nexport enum AuthenticationSessionState {\n // Login flow states\n CREATED = 'CREATED', // Session created, waiting for identification\n IDENTIFIED = 'IDENTIFIED', // User identified, methods available\n FIRST_FACTOR_IN_PROGRESS = 'FIRST_FACTOR_IN_PROGRESS', // First factor authentication in progress\n FIRST_FACTOR_COMPLETED = 'FIRST_FACTOR_COMPLETED', // First factor completed\n MFA_REQUIRED = 'MFA_REQUIRED', // MFA required, waiting for second factor\n SECOND_FACTOR_IN_PROGRESS = 'SECOND_FACTOR_IN_PROGRESS', // Second factor in progress\n COMPLETED = 'COMPLETED', // Authentication completed successfully\n PASSWORD_EXPIRED = 'PASSWORD_EXPIRED', // W2.2: Password expired, must change before token issuance\n\n // W4: Registration pipeline states\n REGISTERED = 'REGISTERED', // Account created, email verification pending/deferred\n EMAIL_VERIFIED = 'EMAIL_VERIFIED', // Email confirmed, checking MFA requirements\n MFA_ENROLLMENT_REQUIRED = 'MFA_ENROLLMENT_REQUIRED', // MFA enrollment needed before tokens can be issued\n MFA_ENROLLMENT_GRACE = 'MFA_ENROLLMENT_GRACE', // Within grace period — tokens issued with mfaGraceExpiresAt claim\n ONBOARDING_PENDING = 'ONBOARDING_PENDING', // Auth complete, guidance/onboarding steps remain\n\n // Terminal states\n FAILED = 'FAILED', // Authentication failed\n EXPIRED = 'EXPIRED', // Session expired\n LOCKED = 'LOCKED' // Account locked due to too many attempts\n}\n\n/* W4.2: Session purpose — drives UI rendering and valid state transitions. /\nexport const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);\n\n/\n Authentication Session Schema\n * Tracks the complete state of an authentication session\n /\nexport const AuthenticationSessionSchema = z.object({\n sessionId: z.string(),\n state: z.enum(AuthenticationSessionState),\n\n // User identification\n email: z.email().optional(),\n userExists: z.boolean().optional(),\n userId: z.string().optional(),\n /* Trusted organization created transactionally by deferred registration onboarding. /\n organizationId: z.string().optional(),\n /\n Untrusted DNS-verified email-domain ownership hint used only to tighten SSO policy.\n * It is deliberately distinct from `organizationId`, which has trusted onboarding provenance.\n /\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n\n /* W3.5: Resolved user type for this session (from X-Frontend-Service-Name → frontendServices → userType). Drives per-user-type auth policy. /\n activeUserType: z.string().optional(),\n\n /* W4.2: Session purpose — determines valid state transitions and frontend UI. /\n purpose: AuthSessionPurposeSchema.optional(),\n\n /* W4: Next step hint for frontend routing after state transitions. /\n nextStep: z.enum(AuthNextStep).optional(),\n\n /* W4.5: ISO date when MFA grace period expires. Present when state is MFA_ENROLLMENT_GRACE. /\n mfaGraceExpiresAt: z.string().optional(),\n\n /* W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. /\n pendingOrgType: z.string().optional(),\n\n /* W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). /\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),\n\n // Authentication flow state\n completedFactors: z.array(z.enum(AuthMethod)).default([]),\n currentFactor: z.enum(AuthFactorLevel).optional(),\n\n // Available methods\n availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),\n availableSecondFactorMethods: z.array(AvailableMethodSchema).default([]),\n\n // MFA requirements\n requiresMFA: z.boolean().default(false),\n mfaMethodsRequired: z.number().default(1),\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /* Intersection of availableSecondFactorMethods and enrolledSecondFactorMethods — methods the user can actually use for MFA challenge. /\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /* When true, EMAIL_OTP alone is insufficient — requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n\n // Session metadata\n createdAt: z.date(),\n expiresAt: z.date(),\n lastActivity: z.date(),\n\n // Security tracking\n attempts: z.number().default(0),\n maxAttempts: z.number().default(5),\n lockoutUntil: z.date().optional(),\n\n // Device and context\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional(),\n\n // Integration requests\n requestedIntegrations: z.array(z.string()).default([]),\n\n // Session-specific data for ongoing flows\n challengeData: z.record(z.string(), z.any()).optional(),\n pendingRedirectUrl: z.url().optional(),\n\n // Organization branding (cached for consistent UI)\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // M1: Optimistic concurrency control version for atomic session updates\n version: z.number().default(0),\n}).superRefine((session, ctx) => {\n if ((session.scopeType === undefined) !== (session.scopeId === undefined)) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Authentication session scopeType and scopeId must be provided together',\n });\n }\n});\n\n\n\n// ===============================\n// SIMPLIFIED FORM DTOs\n// ===============================\n// Used by frontend Form components and backend body parsing.\n// These are the \"what the user fills in\" schemas — services add\n// programmatic fields (sessionId, method, factorLevel) before API calls.\n\n/\n Identify step form DTO — user enters email to discover auth methods.\n * Used by the public auth page's first step.\n /\nexport const AuthIdentifyFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n }),\n});\n\n\n\n\n/\n Login step form DTO — user enters email + password.\n * Used by the public auth page when password auth is shown.\n * The .isPassword() decorator tells FormField to render a password input.\n /\nexport const AuthLoginFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n }),\n password: z.string().min(1).isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.CURRENT_PASSWORD },\n }),\n});\n\nfunction withOneTimeCodeAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.ONE_TIME_CODE },\n }) as TSchema;\n}\n\nfunction withTelAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.TEL },\n }) as TSchema;\n}\n\n/\n MFA email OTP challenge form DTO.\n * Used by the MFA challenge screen after the email code has been sent.\n /\nexport const EmailOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA SMS OTP challenge form DTO.\n * Used by the MFA challenge screen after the SMS code has been sent.\n /\nexport const SmsOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA TOTP challenge form DTO.\n * Used by the MFA challenge screen for authenticator-app verification.\n /\nexport const TotpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n Phone enrollment start form DTO.\n * Used by the enrollment gate before sending a phone verification code.\n /\nexport const PhoneEnrollmentStartFormDtoSchema = z.object({\n phoneNumber: withTelAutocomplete(z.string().min(1)),\n});\n\n/\n Phone enrollment verification form DTO.\n * Used by the enrollment gate after a verification code has been sent.\n /\nexport const PhoneEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n TOTP enrollment verification form DTO.\n * Used after the user scans the QR code and confirms setup with a first code.\n /\nexport const TotpEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n\n\n\n/\n One-off session token exchange response.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string()` which was emitted in the JSON body. The\n * cookie migration (A-Step 2) routed the refresh token to\n * `Set-Cookie: __wildo_refresh=…`; A-Step 6 removes the body field\n * entirely so a one-off-session client receives ONLY a (short-lived)\n * access token + the cookie. The controller's\n * `_jsonSuccessWithRefreshCookie` helper sets the cookie from a\n * separately-passed argument.\n /\nexport const OneOffTokenExchangeResponseSchema = z.object({\n accessToken: z.string(),\n sessionType: z.enum(SessionType),\n consumableTokenValue: z.string().optional(),\n tokenExpiresAt: z.string().optional(),\n context: z.object({\n tokenId: z.string(),\n tokenType: z.string(),\n targeting: z.object({\n initiatorIds: z.record(z.string(), z.string()).optional(),\n }).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n userId: z.string(),\n }),\n});\n\n// Cross-frontend handoff DTO atoms (cross-app-jwt-propagation Step 2) live\n// in `./cross-frontend-handoff.shared.dto.schemas` so a browser-safe subpath\n// (`@wildo-ai/saas-models/public-runtime`) can re-export them without\n// dragging this file's full transitive web (UserContext, SessionType,\n// AuthMethod, AuthFactorLevel, AuthSessionPurpose, AuthUtils,\n// `@wildo-ai/zod-decorators`). See saas-models-public-runtime.md K-2.\nexport from './cross-frontend-handoff.shared.dto.schemas';\n\n// ===============================\n// INFERRED TYPES\n// ===============================\n\n// Authentication method types\nexport type AuthIdentificationRequest = z.infer<typeof AuthIdentificationRequestSchema>;\nexport type AuthIdentificationResponse = z.infer<typeof AuthIdentificationResponseSchema>;\n\n\n\n// Authentication request types\nexport type AuthenticationRequest = z.infer<typeof AuthenticationRequestSchema>;\nexport type AuthenticationResponse = z.infer<typeof AuthenticationResponseSchema>;\nexport type PasswordAuthRequest = z.infer<typeof PasswordAuthRequestSchema>;\nexport type External_OAuth2_AuthRequest = z.infer<typeof External_OAuth2_AuthRequestSchema>;\nexport type OrganizationSSOAuthRequest = z.infer<typeof OrganizationSSOAuthRequestSchema>;\nexport type OAuth2Callback = z.infer<typeof OAuth2CallbackSchema>;\nexport type TOTPAuthRequest = z.infer<typeof TOTPAuthRequestSchema>;\nexport type SMSOTPAuthRequest = z.infer<typeof SMSOTPAuthRequestSchema>;\nexport type EmailOTPAuthRequest = z.infer<typeof EmailOTPAuthRequestSchema>;\nexport type PasskeyAuthRequest = z.infer<typeof PasskeyAuthRequestSchema>;\n\nexport type MagicLinkSendRequest = z.infer<typeof MagicLinkSendRequestSchema>;\nexport type MagicLinkVerifyRequest = z.infer<typeof MagicLinkVerifyRequestSchema>;\n\nexport type PhoneVerifySendRequest = z.infer<typeof PhoneVerifySendRequestSchema>;\nexport type PhoneVerifyConfirmRequest = z.infer<typeof PhoneVerifyConfirmRequestSchema>;\n\n// MFA types\nexport type MFASetupRequest = z.infer<typeof MFASetupRequestSchema>;\nexport type MFASetupResponse = z.infer<typeof MFASetupResponseSchema>;\n\nexport type AuthIdentifyFormDto = z.infer<typeof AuthIdentifyFormDtoSchema>;\nexport type AuthLoginFormDto = z.infer<typeof AuthLoginFormDtoSchema>;\nexport type EmailOtpChallengeFormDto = z.infer<typeof EmailOtpChallengeFormDtoSchema>;\nexport type SmsOtpChallengeFormDto = z.infer<typeof SmsOtpChallengeFormDtoSchema>;\nexport type TotpChallengeFormDto = z.infer<typeof TotpChallengeFormDtoSchema>;\nexport type PhoneEnrollmentStartFormDto = z.infer<typeof PhoneEnrollmentStartFormDtoSchema>;\nexport type PhoneEnrollmentVerifyFormDto = z.infer<typeof PhoneEnrollmentVerifyFormDtoSchema>;\nexport type TotpEnrollmentVerifyFormDto = z.infer<typeof TotpEnrollmentVerifyFormDtoSchema>;\n\n// Session types\nexport type AuthenticationSession = z.infer<typeof AuthenticationSessionSchema>;\nexport type OneOffTokenExchangeResponse = z.infer<typeof OneOffTokenExchangeResponseSchema>;\n"]}
1	+ {"version":3,"file":"authentication.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEzF;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,0HAA0H;IAC1H,yCAAa,CAAA;IACb,sHAAsH;IACtH,uCAAW,CAAA;IACX,8TAA8T;IAC9T,yCAAa,CAAA;AACf,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE;IACvB,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,2FAA2F;IAC3F,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3D,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAEvB,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEvD,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,oCAAoC;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,4DAA4D;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,+CAA+C;QAC/E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC,wCAAwC;IACxC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;IACxE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB;IAEhD,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qCAAqC;IACxF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,mCAAmC;CAC5F,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,oBAAoB;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACjD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;QACF,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC;AAIH,kCAAkC;AAClC,gCAAgC;AAChC,kCAAkC;AAElC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH,kCAAkC;AAClC,wCAAwC;AACxC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACpD,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACpC,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,yBAAyB;IACzB,iCAAiC;IACjC,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEzC,sEAAsE;IACtE,oEAAoE;IACpE,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEnC,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9E,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,uBAAuB;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,kCAAkC;AAClC,2BAA2B;AAC3B,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAG9D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,oBAAoB;IACpB,iDAAmB,CAAA;IACnB,uDAAyB,CAAA;IACzB,mFAAqD,CAAA;IACrD,+EAAiD,CAAA;IACjD,2DAA6B,CAAA;IAC7B,qFAAuD,CAAA;IACvD,qDAAuB,CAAA;IACvB,mEAAqC,CAAA;IAErC,mCAAmC;IACnC,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,iFAAmD,CAAA;IACnD,2EAA6C,CAAA;IAC7C,uEAAyC,CAAA;IAEzC,kBAAkB;IAClB,+CAAiB,CAAA;IACjB,iDAAmB,CAAA;IACnB,+CAAiB,CAAA,CAA8B,0CAA0C;AAC3F,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAEzC,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,gJAAgJ;IAChJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,kFAAkF;IAClF,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE5C,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAEzC,gGAAgG;IAChG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,wHAAwH;IACxH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEnE,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAEjD,oBAAoB;IACpB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAExE,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,0IAA0I;IAC1I,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE5C,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IAEtB,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,mDAAmD;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAClC,6DAA6D;AAC7D,gEAAgE;AAChE,yEAAyE;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;CACH,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,gBAAgB,EAAE;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAA+B,MAAe;IAChF,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,aAAa,EAAE;KAClE,CAAY,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAA+B,MAAe;IACxE,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,GAAG,EAAE;KACxD,CAAY,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAKH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC1D,CAAC,CAAC,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACH,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,cAAc,6CAA6C,CAAC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\nimport { UserContextSchema } from '../../users/users.shared.schemas';\nimport {\n AuthMethod,\n AuthFactorLevel,\n AuthNextStep,\n AuthSessionPurpose,\n AuthScopeType,\n AvailableMethodSchema,\n} from './authentication.shared.schemas';\nimport { AuthUtils } from './authentication.shared.utils';\nimport { SessionType } from '../../runtime/execution-context.shared.schemas';\nimport { PasswordPolicyRulesSchema } from '../../config/app-configuration-shared.shared.schemas';\nimport { AutocompleteFieldIdentifier, ZodTypeForColors } from '@wildo-ai/zod-decorators';\n\n/\n Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,\n * from the invitation token alone, which first-factor auth methods the target\n * organization allows and whether the org is SSO/SCIM-managed.\n \n Distinct from `identify()` (keyed by email→domain, requires an existing user):\n * this is token-keyed and works for a not-yet-activated invitee (INVITED\n * membership, no session). Populated by `GET /auth/invitation/info?token=…`,\n * which reads the token WITHOUT consuming it (unlike accept). See\n * `.claude/plans/invitation-multi-method-auth.md`.\n /\nexport enum InvitationManagementMode {\n /* No enterprise identity authority — invitee may set a local credential (password/passkey) or use any allowed method. /\n OPEN = 'open',\n /* Org authenticates via enterprise SSO — route the invitee to the IdP (JIT consumes the invite; no local accept). /\n SSO = 'sso',\n /* Org is ACTIVELY directory-managed (SCIM live — DIRECTORY_PROVISIONING feature + a live SCIM token) — informational only, NO local credential: a local password/passkey/magic-link would survive IdP deprovisioning. Derived per-org (not from the org-TYPE mount flag) — see `isOrgActivelyDirectoryManaged` / AUTH-23. /\n SCIM = 'scim',\n}\n\nexport const AuthInvitationInfoResponseSchema = z.object({\n /* The invitee's email (from the INVITED membership's denormalized `userEmail`). /\n inviteeEmail: z.email(),\n /* Display name of the organization the invitee is joining. /\n organizationName: z.string(),\n /* First-factor methods the org allows for a joining member of the invitee's user type. /\n availableFirstFactorMethods: z.array(AvailableMethodSchema),\n /* Identity-management posture — drives chooser (open/sso) vs informational state (scim). /\n managementMode: z.enum(InvitationManagementMode),\n /\n The org-join user type's ORG-MERGED password policy (the SAME policy the accept\n * endpoint validates against). Lets the chooser's PASSWORD form show the invitee the\n * org's REAL requirements (strength indicator + client pre-check) instead of the\n * app-level default — so an org that strengthens `passwordPolicy` via `authOverrides`\n * doesn't reject a client-accepted password after submit. Absent when the policy can't\n * be resolved (unknown user type / degraded org read); the frontend then falls back to\n * the app-level resolved policy. Structurally the frontend validation subset\n * (`PasswordPolicyRulesSchema`); the backend's `PasswordPolicyConfig` is field-identical\n * and parses through it losslessly.\n /\n passwordPolicy: PasswordPolicyRulesSchema.optional(),\n});\nexport type AuthInvitationInfoResponse = z.infer<typeof AuthInvitationInfoResponseSchema>;\n\n/\n Step 1: User identification by email\n * Returns available authentication methods for the user\n /\nexport const AuthIdentificationRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional()\n});\n\n\n\n/\n Step 1 Response: Available authentication methods with factor classification\n /\nexport const AuthIdentificationResponseSchema = z.object({\n sessionId: z.string(),\n email: z.email(),\n userExists: z.boolean(),\n\n // First factor methods (primary authentication)\n firstFactorMethods: z.array(AvailableMethodSchema),\n defaultFirstFactorMethod: z.enum(AuthMethod).optional(),\n\n // Second factor methods (MFA) - only shown if MFA is required\n secondFactorMethods: z.array(AvailableMethodSchema),\n requiresMFA: z.boolean(),\n mfaMethodsRequired: z.number().default(1),\n\n // Organization-specific information\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // Available integrations (if any auth method supports them)\n availableIntegrations: z.array(z.object({\n integrationId: z.string(),\n externalProviderId: z.string(), // Which auth provider enables this integration\n iconUrl: z.url().optional()\n })).default([]),\n});\n\n\n\n// ===============================\n// AUTHENTICATION REQUEST SCHEMAS\n// ===============================\n\n/\n Base authentication request schema with factor context\n /\nexport const BaseAuthRequestSchema = z.object({\n sessionId: z.string().min(1),\n method: z.enum(AuthMethod),\n factorLevel: z.enum(AuthFactorLevel),\n rememberMe: z.boolean().default(false),\n\n // Integration access request (optional)\n requestedIntegrations: z.array(z.string()).default([])\n});\n\n\n\n/\n Password Authentication (First factor only)\n /\nexport const PasswordAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSWORD),\n factorLevel: z.literal(AuthFactorLevel.FIRST),\n password: z.string().min(1)\n});\n\n\n\n/\n Third-Party OAuth2 Authentication (First factor, extensible)\n /\nexport const External_OAuth2_AuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EXTERNAL_OAUTH2),\n factorLevel: z.enum(AuthFactorLevel),\n externalProviderId: z.string().min(1), // References configured provider\n redirectUri: z.url(),\n state: z.string().optional(), // CSRF protection\n\n // Integration-specific parameters\n additionalScopes: z.array(z.string()).default([]), // Additional scopes for integrations\n integrationPermissions: z.array(z.string()).default([]) // Specific integration permissions\n});\n\n\n\n/\n Organization SSO Authentication (First or second factor, organization-restricted)\n /\nexport const OrganizationSSOAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.enum([AuthMethod.ORG_SAML, AuthMethod.ORG_OPENID_CONNECT]),\n factorLevel: z.enum(AuthFactorLevel),\n ssoId: z.string().min(1),\n organizationId: z.string().min(1),\n\n // SSO-specific data\n samlResponse: z.string().optional(), // For SAML\n idToken: z.string().optional(), // For OpenID Connect\n state: z.string().optional()\n});\n\n\n\n/\n OAuth2 Callback Schema (for both third-party and SSO)\n /\nexport const OAuth2CallbackSchema = z.object({\n sessionId: z.string().min(1),\n externalProviderId: z.string().optional(), // For third-party OAuth2\n ssoId: z.string().optional(), // For organization SSO\n code: z.string().min(1),\n state: z.string().optional(),\n error: z.string().optional(),\n errorDescription: z.string().optional()\n});\n\n\n\n/\n TOTP Authentication (Second factor only)\n /\nexport const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.TOTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^(\\d{6}\|[a-f0-9]{8})$/)\n});\n\n\n\n/\n SMS OTP Authentication (First or second factor)\n /\nexport const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.SMS_OTP),\n factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Email OTP Authentication (Second factor only)\n /\nexport const EmailOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EMAIL_OTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Passkey (WebAuthn) Authentication (First or second factor)\n /\nexport const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSKEY),\n factorLevel: z.enum(AuthFactorLevel),\n // WebAuthn authentication response from navigator.credentials.get()\n response: z.object({\n id: z.string(),\n rawId: z.string(),\n response: z.object({\n authenticatorData: z.string(),\n clientDataJSON: z.string(),\n signature: z.string(),\n userHandle: z.string().optional(),\n }),\n authenticatorAttachment: z.string().optional(),\n clientExtensionResults: z.record(z.string(), z.any()).default({}),\n type: z.literal('public-key'),\n }),\n});\n\n\n\n// ===============================\n// MAGIC LINK SCHEMAS (Phase G2)\n// ===============================\n\n/\n Magic Link Send Request — triggers a magic link email to the user.\n * Separate from the main AuthenticationRequestSchema because it doesn't\n * go through the standard authenticate() dispatch.\n /\nexport const MagicLinkSendRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n});\n\n\n\n\n/\n Magic Link Verify Request — verifies the token from the magic link.\n * Used by POST /auth/magic-link/verify for programmatic verification.\n * Intentionally NOT added to AuthenticationRequestSchema discriminated union\n * because magic link verification follows a separate flow (GET from email click\n * → exchange code → POST verify).\n /\nexport const MagicLinkVerifyRequestSchema = z.object({\n token: z.string().min(1),\n email: z.email().toLowerCase(),\n});\n\n\n\n\n// ===============================\n// PHONE VERIFICATION SCHEMAS (Phase G2)\n// ===============================\n\n/\n Phone Verification Send Request — triggers a verification code to a phone number.\n * Used for phone number ownership verification, separate from SMS OTP auth.\n /\nexport const PhoneVerifySendRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n});\n\n\n\n\n/\n Phone Verification Confirm Request — confirms the verification code.\n /\nexport const PhoneVerifyConfirmRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n code: z.string().regex(/^\\d{4,8}$/),\n});\n\n\n\n\n/\n Union of all authentication request types\n /\nexport const AuthenticationRequestSchema = z.discriminatedUnion('method', [\n PasswordAuthRequestSchema,\n External_OAuth2_AuthRequestSchema,\n OrganizationSSOAuthRequestSchema,\n TOTPAuthRequestSchema,\n SMSOTPAuthRequestSchema,\n EmailOTPAuthRequestSchema,\n PasskeyAuthRequestSchema\n]);\n\n\n\n/\n Authentication Response Schema with Factor Context and Integration Access.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string().optional()` which was emitted in the JSON\n * body for every authentication response. The cookie migration (A-Step 2,\n * 2026-04-13) added `Set-Cookie: __wildo_refresh=…` as a parallel\n * channel; A-Step 3 (2026-04-13) made the SaaS-frontend stop reading\n * the body field; A-Step 6 (THIS step) DROPS the body field entirely\n * so the wire response physically cannot carry the refresh token.\n \n Backend internals: the orchestrator's\n * `_buildAuthenticationSuccessMethod` returns\n * `AuthenticationServiceResult = AuthenticationResponse & { refreshToken?: string }`\n * (a backend-only TS type — NOT a wire schema) so the controller can\n * extract the refresh-token value and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`. The wire\n * payload (this schema) STILL has no `refreshToken` field — the\n * controller's helper sets the cookie and emits the body separately.\n \n `integrationTokens[].refreshToken` (below) is a third-party-IdP\n * OAuth2 refresh token (Google, Microsoft, etc.) — NOT a Wildo refresh\n * token. It stays on the wire because the frontend needs it to drive\n * IdP-side API calls; it is bound to a different security model\n * (IdP-issued, IdP-rotated, never used to mint Wildo JWTs).\n /\nexport const AuthenticationResponseSchema = z.object({\n success: z.boolean(),\n sessionId: z.string(),\n userExists: z.boolean(),\n factorLevel: z.enum(AuthFactorLevel),\n authMethod: z.enum(AuthMethod).optional(),\n\n // Success response. NOTE: `refreshToken` deliberately ABSENT from the\n // wire schema (Auth-hardening A-Step 6) — see the file/schema-level\n // JSDoc above for the cookie-only contract.\n accessToken: z.string().optional(),\n expiresIn: z.number().optional(),\n user: UserContextSchema.optional(),\n\n // Integration access tokens (if requested and granted)\n integrationTokens: z.array(z.object({\n integrationId: z.string(),\n accessToken: z.string(),\n refreshToken: z.string().optional(),\n expiresIn: z.number().optional(),\n scopes: z.array(z.string())\n })).default([]),\n\n // MFA continuation\n requiresMFA: z.boolean().default(false),\n availableMFAMethods: z.array(AvailableMethodSchema).optional(),\n mfaMethodsRequired: z.number().optional(),\n completedFactors: z.array(z.enum(AuthMethod)).optional(),\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // W4.5: MFA enrollment routing\n nextStep: z.enum(AuthNextStep).optional(),\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // Error response\n error: z.string().optional(),\n errorCode: z.string().optional(),\n retryAllowed: z.boolean().default(true),\n remainingAttempts: z.number().optional(),\n lockoutUntil: z.date().optional(),\n\n // Method-specific data\n challengeData: z.record(z.string(), z.any()).optional(),\n redirectUrl: z.url().optional()\n});\n\n\n\n// ===============================\n// MFA SETUP AND MANAGEMENT\n// ===============================\n\n/\n MFA Setup Request\n /\nexport const MFASetupRequestSchema = z.object({\n method: z.enum(AuthMethod),\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n deviceName: z.string().optional()\n}).refine((data) => AuthUtils.canBeSecondFactor(data.method));\n\n\n/\n MFA Setup Response\n /\nexport const MFASetupResponseSchema = z.object({\n method: z.enum(AuthMethod),\n setupToken: z.string(),\n qrCodeUrl: z.url().optional(),\n secret: z.string().optional(),\n challenge: z.record(z.string(), z.any()).optional(),\n recoveryCodes: z.array(z.string()).optional()\n});\n\n\n\n\n/\n Authentication Session State\n /\nexport enum AuthenticationSessionState {\n // Login flow states\n CREATED = 'CREATED', // Session created, waiting for identification\n IDENTIFIED = 'IDENTIFIED', // User identified, methods available\n FIRST_FACTOR_IN_PROGRESS = 'FIRST_FACTOR_IN_PROGRESS', // First factor authentication in progress\n FIRST_FACTOR_COMPLETED = 'FIRST_FACTOR_COMPLETED', // First factor completed\n MFA_REQUIRED = 'MFA_REQUIRED', // MFA required, waiting for second factor\n SECOND_FACTOR_IN_PROGRESS = 'SECOND_FACTOR_IN_PROGRESS', // Second factor in progress\n COMPLETED = 'COMPLETED', // Authentication completed successfully\n PASSWORD_EXPIRED = 'PASSWORD_EXPIRED', // W2.2: Password expired, must change before token issuance\n\n // W4: Registration pipeline states\n REGISTERED = 'REGISTERED', // Account created, email verification pending/deferred\n EMAIL_VERIFIED = 'EMAIL_VERIFIED', // Email confirmed, checking MFA requirements\n MFA_ENROLLMENT_REQUIRED = 'MFA_ENROLLMENT_REQUIRED', // MFA enrollment needed before tokens can be issued\n MFA_ENROLLMENT_GRACE = 'MFA_ENROLLMENT_GRACE', // Within grace period — tokens issued with mfaGraceExpiresAt claim\n ONBOARDING_PENDING = 'ONBOARDING_PENDING', // Auth complete, guidance/onboarding steps remain\n\n // Terminal states\n FAILED = 'FAILED', // Authentication failed\n EXPIRED = 'EXPIRED', // Session expired\n LOCKED = 'LOCKED' // Account locked due to too many attempts\n}\n\n/* W4.2: Session purpose — drives UI rendering and valid state transitions. /\nexport const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);\n\n/\n Authentication Session Schema\n * Tracks the complete state of an authentication session\n /\nexport const AuthenticationSessionSchema = z.object({\n sessionId: z.string(),\n state: z.enum(AuthenticationSessionState),\n\n // User identification\n email: z.email().optional(),\n userExists: z.boolean().optional(),\n userId: z.string().optional(),\n /* Trusted organization created transactionally by deferred registration onboarding. /\n organizationId: z.string().optional(),\n /\n Untrusted DNS-verified email-domain ownership hint used only to tighten SSO policy.\n * It is deliberately distinct from `organizationId`, which has trusted onboarding provenance.\n /\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n\n /* W3.5: Resolved user type for this session (from X-Frontend-Service-Name → frontendServices → userType). Drives per-user-type auth policy. /\n activeUserType: z.string().optional(),\n\n /* W4.2: Session purpose — determines valid state transitions and frontend UI. /\n purpose: AuthSessionPurposeSchema.optional(),\n\n /* W4: Next step hint for frontend routing after state transitions. /\n nextStep: z.enum(AuthNextStep).optional(),\n\n /* W4.5: ISO date when MFA grace period expires. Present when state is MFA_ENROLLMENT_GRACE. /\n mfaGraceExpiresAt: z.string().optional(),\n\n /* W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. /\n pendingOrgType: z.string().optional(),\n\n /* W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). /\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),\n\n // Authentication flow state\n completedFactors: z.array(z.enum(AuthMethod)).default([]),\n currentFactor: z.enum(AuthFactorLevel).optional(),\n\n // Available methods\n availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),\n availableSecondFactorMethods: z.array(AvailableMethodSchema).default([]),\n\n // MFA requirements\n requiresMFA: z.boolean().default(false),\n mfaMethodsRequired: z.number().default(1),\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /* Intersection of availableSecondFactorMethods and enrolledSecondFactorMethods — methods the user can actually use for MFA challenge. /\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /* When true, EMAIL_OTP alone is insufficient — requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n\n // Session metadata\n createdAt: z.date(),\n expiresAt: z.date(),\n lastActivity: z.date(),\n\n // Security tracking\n attempts: z.number().default(0),\n maxAttempts: z.number().default(5),\n lockoutUntil: z.date().optional(),\n\n // Device and context\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional(),\n\n // Integration requests\n requestedIntegrations: z.array(z.string()).default([]),\n\n // Session-specific data for ongoing flows\n challengeData: z.record(z.string(), z.any()).optional(),\n pendingRedirectUrl: z.url().optional(),\n\n // Organization branding (cached for consistent UI)\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // M1: Optimistic concurrency control version for atomic session updates\n version: z.number().default(0),\n}).superRefine((session, ctx) => {\n if ((session.scopeType === undefined) !== (session.scopeId === undefined)) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Authentication session scopeType and scopeId must be provided together',\n });\n }\n});\n\n\n\n// ===============================\n// SIMPLIFIED FORM DTOs\n// ===============================\n// Used by frontend Form components and backend body parsing.\n// These are the \"what the user fills in\" schemas — services add\n// programmatic fields (sessionId, method, factorLevel) before API calls.\n\n/\n Identify step form DTO — user enters email to discover auth methods.\n * Used by the public auth page's first step.\n /\nexport const AuthIdentifyFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n }),\n});\n\n\n\n\n/\n Login step form DTO — user enters email + password.\n * Used by the public auth page when password auth is shown.\n * The .isPassword() decorator tells FormField to render a password input.\n /\nexport const AuthLoginFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n }),\n password: z.string().min(1).isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.CURRENT_PASSWORD },\n }),\n});\n\nfunction withOneTimeCodeAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.ONE_TIME_CODE },\n }) as TSchema;\n}\n\nfunction withTelAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.TEL },\n }) as TSchema;\n}\n\n/\n MFA email OTP challenge form DTO.\n * Used by the MFA challenge screen after the email code has been sent.\n /\nexport const EmailOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA SMS OTP challenge form DTO.\n * Used by the MFA challenge screen after the SMS code has been sent.\n /\nexport const SmsOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA TOTP challenge form DTO.\n * Used by the MFA challenge screen for authenticator-app verification.\n /\nexport const TotpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n Phone enrollment start form DTO.\n * Used by the enrollment gate before sending a phone verification code.\n /\nexport const PhoneEnrollmentStartFormDtoSchema = z.object({\n phoneNumber: withTelAutocomplete(z.string().min(1)),\n});\n\n/\n Phone enrollment verification form DTO.\n * Used by the enrollment gate after a verification code has been sent.\n /\nexport const PhoneEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n TOTP enrollment verification form DTO.\n * Used after the user scans the QR code and confirms setup with a first code.\n /\nexport const TotpEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n\n\n\n/\n One-off session token exchange response.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string()` which was emitted in the JSON body. The\n * cookie migration (A-Step 2) routed the refresh token to\n * `Set-Cookie: __wildo_refresh=…`; A-Step 6 removes the body field\n * entirely so a one-off-session client receives ONLY a (short-lived)\n * access token + the cookie. The controller's\n * `_jsonSuccessWithRefreshCookie` helper sets the cookie from a\n * separately-passed argument.\n /\nexport const OneOffTokenExchangeResponseSchema = z.object({\n accessToken: z.string(),\n sessionType: z.enum(SessionType),\n consumableTokenValue: z.string().optional(),\n tokenExpiresAt: z.string().optional(),\n context: z.object({\n tokenId: z.string(),\n tokenType: z.string(),\n targeting: z.object({\n initiatorIds: z.record(z.string(), z.string()).optional(),\n }).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n userId: z.string(),\n }),\n});\n\n// Cross-frontend handoff DTO atoms (cross-app-jwt-propagation Step 2) live\n// in `./cross-frontend-handoff.shared.dto.schemas` so a browser-safe subpath\n// (`@wildo-ai/saas-models/public-runtime`) can re-export them without\n// dragging this file's full transitive web (UserContext, SessionType,\n// AuthMethod, AuthFactorLevel, AuthSessionPurpose, AuthUtils,\n// `@wildo-ai/zod-decorators`). See saas-models-public-runtime.md K-2.\nexport from './cross-frontend-handoff.shared.dto.schemas';\n\n// ===============================\n// INFERRED TYPES\n// ===============================\n\n// Authentication method types\nexport type AuthIdentificationRequest = z.infer<typeof AuthIdentificationRequestSchema>;\nexport type AuthIdentificationResponse = z.infer<typeof AuthIdentificationResponseSchema>;\n\n\n\n// Authentication request types\nexport type AuthenticationRequest = z.infer<typeof AuthenticationRequestSchema>;\nexport type AuthenticationResponse = z.infer<typeof AuthenticationResponseSchema>;\nexport type PasswordAuthRequest = z.infer<typeof PasswordAuthRequestSchema>;\nexport type External_OAuth2_AuthRequest = z.infer<typeof External_OAuth2_AuthRequestSchema>;\nexport type OrganizationSSOAuthRequest = z.infer<typeof OrganizationSSOAuthRequestSchema>;\nexport type OAuth2Callback = z.infer<typeof OAuth2CallbackSchema>;\nexport type TOTPAuthRequest = z.infer<typeof TOTPAuthRequestSchema>;\nexport type SMSOTPAuthRequest = z.infer<typeof SMSOTPAuthRequestSchema>;\nexport type EmailOTPAuthRequest = z.infer<typeof EmailOTPAuthRequestSchema>;\nexport type PasskeyAuthRequest = z.infer<typeof PasskeyAuthRequestSchema>;\n\nexport type MagicLinkSendRequest = z.infer<typeof MagicLinkSendRequestSchema>;\nexport type MagicLinkVerifyRequest = z.infer<typeof MagicLinkVerifyRequestSchema>;\n\nexport type PhoneVerifySendRequest = z.infer<typeof PhoneVerifySendRequestSchema>;\nexport type PhoneVerifyConfirmRequest = z.infer<typeof PhoneVerifyConfirmRequestSchema>;\n\n// MFA types\nexport type MFASetupRequest = z.infer<typeof MFASetupRequestSchema>;\nexport type MFASetupResponse = z.infer<typeof MFASetupResponseSchema>;\n\nexport type AuthIdentifyFormDto = z.infer<typeof AuthIdentifyFormDtoSchema>;\nexport type AuthLoginFormDto = z.infer<typeof AuthLoginFormDtoSchema>;\nexport type EmailOtpChallengeFormDto = z.infer<typeof EmailOtpChallengeFormDtoSchema>;\nexport type SmsOtpChallengeFormDto = z.infer<typeof SmsOtpChallengeFormDtoSchema>;\nexport type TotpChallengeFormDto = z.infer<typeof TotpChallengeFormDtoSchema>;\nexport type PhoneEnrollmentStartFormDto = z.infer<typeof PhoneEnrollmentStartFormDtoSchema>;\nexport type PhoneEnrollmentVerifyFormDto = z.infer<typeof PhoneEnrollmentVerifyFormDtoSchema>;\nexport type TotpEnrollmentVerifyFormDto = z.infer<typeof TotpEnrollmentVerifyFormDtoSchema>;\n\n// Session types\nexport type AuthenticationSession = z.infer<typeof AuthenticationSessionSchema>;\nexport type OneOffTokenExchangeResponse = z.infer<typeof OneOffTokenExchangeResponseSchema>;\n"]}