@wildo-ai/saas-models 1.1.3 → 1.1.4

package/dist/esm/security/authentications/authentication.shared.dto.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEzF;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,0HAA0H;IAC1H,yCAAa,CAAA;IACb,sHAAsH;IACtH,uCAAW,CAAA;IACX,8TAA8T;IAC9T,yCAAa,CAAA;AACf,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE;IACvB,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,2FAA2F;IAC3F,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3D,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAEvB,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEvD,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,oCAAoC;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,4DAA4D;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,+CAA+C;QAC/E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC,wCAAwC;IACxC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;IACxE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB;IAEhD,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qCAAqC;IACxF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,mCAAmC;CAC5F,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,oBAAoB;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACjD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;QACF,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC;AAIH,kCAAkC;AAClC,gCAAgC;AAChC,kCAAkC;AAElC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH,kCAAkC;AAClC,wCAAwC;AACxC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACpD,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACpC,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,yBAAyB;IACzB,iCAAiC;IACjC,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEzC,sEAAsE;IACtE,oEAAoE;IACpE,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEnC,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9E,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,uBAAuB;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,kCAAkC;AAClC,2BAA2B;AAC3B,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAG9D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,oBAAoB;IACpB,iDAAmB,CAAA;IACnB,uDAAyB,CAAA;IACzB,mFAAqD,CAAA;IACrD,+EAAiD,CAAA;IACjD,2DAA6B,CAAA;IAC7B,qFAAuD,CAAA;IACvD,qDAAuB,CAAA;IACvB,mEAAqC,CAAA;IAErC,mCAAmC;IACnC,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,iFAAmD,CAAA;IACnD,2EAA6C,CAAA;IAC7C,uEAAyC,CAAA;IAEzC,kBAAkB;IAClB,+CAAiB,CAAA;IACjB,iDAAmB,CAAA;IACnB,+CAAiB,CAAA,CAA8B,0CAA0C;AAC3F,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAEzC,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,gJAAgJ;IAChJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,kFAAkF;IAClF,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE5C,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAEzC,gGAAgG;IAChG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,wHAAwH;IACxH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEnE,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAEjD,oBAAoB;IACpB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAExE,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,0IAA0I;IAC1I,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE5C,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IAEtB,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,mDAAmD;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAClC,6DAA6D;AAC7D,gEAAgE;AAChE,yEAAyE;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;CACH,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,gBAAgB,EAAE;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAA+B,MAAe;IAChF,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,aAAa,EAAE;KAClE,CAAY,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAA+B,MAAe;IACxE,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,GAAG,EAAE;KACxD,CAAY,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAKH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC1D,CAAC,CAAC,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACH,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,cAAc,6CAA6C,CAAC","sourcesContent":["/**\n * Authentication Shared Schemas\n *\n * Core authentication schemas shared between frontend and backend\n */\n\nimport { z } from 'zod';\nimport { UserContextSchema } from '../../users/users.shared.schemas';\nimport {\n  AuthMethod,\n  AuthFactorLevel,\n  AuthNextStep,\n  AuthSessionPurpose,\n  AuthScopeType,\n  AvailableMethodSchema,\n} from './authentication.shared.schemas';\nimport { AuthUtils } from './authentication.shared.utils';\nimport { SessionType } from '../../runtime/execution-context.shared.schemas';\nimport { PasswordPolicyRulesSchema } from '../../config/app-configuration-shared.shared.schemas';\nimport { AutocompleteFieldIdentifier, ZodTypeForColors } from '@wildo-ai/zod-decorators';\n\n/**\n * Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,\n * from the invitation token alone, which first-factor auth methods the target\n * organization allows and whether the org is SSO/SCIM-managed.\n *\n * Distinct from `identify()` (keyed by email→domain, requires an existing user):\n * this is token-keyed and works for a not-yet-activated invitee (INVITED\n * membership, no session). Populated by `GET /auth/invitation/info?token=…`,\n * which reads the token WITHOUT consuming it (unlike accept). See\n * `.claude/plans/invitation-multi-method-auth.md`.\n */\nexport enum InvitationManagementMode {\n  /** No enterprise identity authority — invitee may set a local credential (password/passkey) or use any allowed method. */\n  OPEN = 'open',\n  /** Org authenticates via enterprise SSO — route the invitee to the IdP (JIT consumes the invite; no local accept). */\n  SSO = 'sso',\n  /** Org is ACTIVELY directory-managed (SCIM live — DIRECTORY_PROVISIONING feature + a live SCIM token) — informational only, NO local credential: a local password/passkey/magic-link would survive IdP deprovisioning. Derived per-org (not from the org-TYPE mount flag) — see `isOrgActivelyDirectoryManaged` / AUTH-23. */\n  SCIM = 'scim',\n}\n\nexport const AuthInvitationInfoResponseSchema = z.object({\n  /** The invitee's email (from the INVITED membership's denormalized `userEmail`). */\n  inviteeEmail: z.email(),\n  /** Display name of the organization the invitee is joining. */\n  organizationName: z.string(),\n  /** First-factor methods the org allows for a joining member of the invitee's user type. */\n  availableFirstFactorMethods: z.array(AvailableMethodSchema),\n  /** Identity-management posture — drives chooser (open/sso) vs informational state (scim). */\n  managementMode: z.enum(InvitationManagementMode),\n  /**\n   * The org-join user type's ORG-MERGED password policy (the SAME policy the accept\n   * endpoint validates against). Lets the chooser's PASSWORD form show the invitee the\n   * org's REAL requirements (strength indicator + client pre-check) instead of the\n   * app-level default — so an org that strengthens `passwordPolicy` via `authOverrides`\n   * doesn't reject a client-accepted password after submit. Absent when the policy can't\n   * be resolved (unknown user type / degraded org read); the frontend then falls back to\n   * the app-level resolved policy. Structurally the frontend validation subset\n   * (`PasswordPolicyRulesSchema`); the backend's `PasswordPolicyConfig` is field-identical\n   * and parses through it losslessly.\n   */\n  passwordPolicy: PasswordPolicyRulesSchema.optional(),\n});\nexport type AuthInvitationInfoResponse = z.infer<typeof AuthInvitationInfoResponseSchema>;\n\n/**\n * Step 1: User identification by email\n * Returns available authentication methods for the user\n */\nexport const AuthIdentificationRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  organizationId: z.string().optional(),\n  deviceInfo: z.object({\n    userAgent: z.string().optional(),\n    ipAddress: z.string().optional(),\n  }).optional()\n});\n\n\n\n/**\n * Step 1 Response: Available authentication methods with factor classification\n */\nexport const AuthIdentificationResponseSchema = z.object({\n  sessionId: z.string(),\n  email: z.email(),\n  userExists: z.boolean(),\n\n  // First factor methods (primary authentication)\n  firstFactorMethods: z.array(AvailableMethodSchema),\n  defaultFirstFactorMethod: z.enum(AuthMethod).optional(),\n\n  // Second factor methods (MFA) - only shown if MFA is required\n  secondFactorMethods: z.array(AvailableMethodSchema),\n  requiresMFA: z.boolean(),\n  mfaMethodsRequired: z.number().default(1),\n\n  // Organization-specific information\n  organizationBranding: z.object({\n    // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n    // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n    // servable URL OR an app-relative path (e.g. `/favicon.png`).\n    logoUrl: z.string().optional(),\n    primaryColor: ZodTypeForColors.optional(),\n    organizationName: z.string().optional()\n  }).optional(),\n\n  // Available integrations (if any auth method supports them)\n  availableIntegrations: z.array(z.object({\n    integrationId: z.string(),\n    externalProviderId: z.string(), // Which auth provider enables this integration\n    iconUrl: z.url().optional()\n  })).default([]),\n});\n\n\n\n// ===============================\n// AUTHENTICATION REQUEST SCHEMAS\n// ===============================\n\n/**\n * Base authentication request schema with factor context\n */\nexport const BaseAuthRequestSchema = z.object({\n  sessionId: z.string().min(1),\n  method: z.enum(AuthMethod),\n  factorLevel: z.enum(AuthFactorLevel),\n  rememberMe: z.boolean().default(false),\n\n  // Integration access request (optional)\n  requestedIntegrations: z.array(z.string()).default([])\n});\n\n\n\n/**\n * Password Authentication (First factor only)\n */\nexport const PasswordAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.PASSWORD),\n  factorLevel: z.literal(AuthFactorLevel.FIRST),\n  password: z.string().min(1)\n});\n\n\n\n/**\n * Third-Party OAuth2 Authentication (First factor, extensible)\n */\nexport const External_OAuth2_AuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.EXTERNAL_OAUTH2),\n  factorLevel: z.enum(AuthFactorLevel),\n  externalProviderId: z.string().min(1), // References configured provider\n  redirectUri: z.url(),\n  state: z.string().optional(), // CSRF protection\n\n  // Integration-specific parameters\n  additionalScopes: z.array(z.string()).default([]), // Additional scopes for integrations\n  integrationPermissions: z.array(z.string()).default([]) // Specific integration permissions\n});\n\n\n\n/**\n * Organization SSO Authentication (First or second factor, organization-restricted)\n */\nexport const OrganizationSSOAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.enum([AuthMethod.ORG_SAML, AuthMethod.ORG_OPENID_CONNECT]),\n  factorLevel: z.enum(AuthFactorLevel),\n  ssoId: z.string().min(1),\n  organizationId: z.string().min(1),\n\n  // SSO-specific data\n  samlResponse: z.string().optional(), // For SAML\n  idToken: z.string().optional(), // For OpenID Connect\n  state: z.string().optional()\n});\n\n\n\n/**\n * OAuth2 Callback Schema (for both third-party and SSO)\n */\nexport const OAuth2CallbackSchema = z.object({\n  sessionId: z.string().min(1),\n  externalProviderId: z.string().optional(), // For third-party OAuth2\n  ssoId: z.string().optional(), // For organization SSO\n  code: z.string().min(1),\n  state: z.string().optional(),\n  error: z.string().optional(),\n  errorDescription: z.string().optional()\n});\n\n\n\n/**\n * TOTP Authentication (Second factor only)\n */\nexport const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.TOTP),\n  factorLevel: z.literal(AuthFactorLevel.SECOND),\n  token: z.string().regex(/^(\\d{6}|[a-f0-9]{8})$/)\n});\n\n\n\n/**\n * SMS OTP Authentication (First or second factor)\n */\nexport const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.SMS_OTP),\n  factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n  token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/**\n * Email OTP Authentication (Second factor only)\n */\nexport const EmailOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.EMAIL_OTP),\n  factorLevel: z.literal(AuthFactorLevel.SECOND),\n  token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/**\n * Passkey (WebAuthn) Authentication (First or second factor)\n */\nexport const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.PASSKEY),\n  factorLevel: z.enum(AuthFactorLevel),\n  // WebAuthn authentication response from navigator.credentials.get()\n  response: z.object({\n    id: z.string(),\n    rawId: z.string(),\n    response: z.object({\n      authenticatorData: z.string(),\n      clientDataJSON: z.string(),\n      signature: z.string(),\n      userHandle: z.string().optional(),\n    }),\n    authenticatorAttachment: z.string().optional(),\n    clientExtensionResults: z.record(z.string(), z.any()).default({}),\n    type: z.literal('public-key'),\n  }),\n});\n\n\n\n// ===============================\n// MAGIC LINK SCHEMAS (Phase G2)\n// ===============================\n\n/**\n * Magic Link Send Request — triggers a magic link email to the user.\n * Separate from the main AuthenticationRequestSchema because it doesn't\n * go through the standard authenticate() dispatch.\n */\nexport const MagicLinkSendRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  organizationId: z.string().optional(),\n});\n\n\n\n\n/**\n * Magic Link Verify Request — verifies the token from the magic link.\n * Used by POST /auth/magic-link/verify for programmatic verification.\n * Intentionally NOT added to AuthenticationRequestSchema discriminated union\n * because magic link verification follows a separate flow (GET from email click\n * → exchange code → POST verify).\n */\nexport const MagicLinkVerifyRequestSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\n\n\n\n// ===============================\n// PHONE VERIFICATION SCHEMAS (Phase G2)\n// ===============================\n\n/**\n * Phone Verification Send Request — triggers a verification code to a phone number.\n * Used for phone number ownership verification, separate from SMS OTP auth.\n */\nexport const PhoneVerifySendRequestSchema = z.object({\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n});\n\n\n\n\n/**\n * Phone Verification Confirm Request — confirms the verification code.\n */\nexport const PhoneVerifyConfirmRequestSchema = z.object({\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n  code: z.string().regex(/^\\d{4,8}$/),\n});\n\n\n\n\n/**\n * Union of all authentication request types\n */\nexport const AuthenticationRequestSchema = z.discriminatedUnion('method', [\n  PasswordAuthRequestSchema,\n  External_OAuth2_AuthRequestSchema,\n  OrganizationSSOAuthRequestSchema,\n  TOTPAuthRequestSchema,\n  SMSOTPAuthRequestSchema,\n  EmailOTPAuthRequestSchema,\n  PasskeyAuthRequestSchema\n]);\n\n\n\n/**\n * Authentication Response Schema with Factor Context and Integration Access.\n *\n * **Wire contract — refresh token is NEVER included** (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string().optional()` which was emitted in the JSON\n * body for every authentication response. The cookie migration (A-Step 2,\n * 2026-04-13) added `Set-Cookie: __wildo_refresh=…` as a parallel\n * channel; A-Step 3 (2026-04-13) made the SaaS-frontend stop reading\n * the body field; A-Step 6 (THIS step) DROPS the body field entirely\n * so the wire response physically cannot carry the refresh token.\n *\n * Backend internals: the orchestrator's\n * `_buildAuthenticationSuccessMethod` returns\n * `AuthenticationServiceResult = AuthenticationResponse & { refreshToken?: string }`\n * (a backend-only TS type — NOT a wire schema) so the controller can\n * extract the refresh-token value and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`. The wire\n * payload (this schema) STILL has no `refreshToken` field — the\n * controller's helper sets the cookie and emits the body separately.\n *\n * `integrationTokens[].refreshToken` (below) is a third-party-IdP\n * OAuth2 refresh token (Google, Microsoft, etc.) — NOT a Wildo refresh\n * token. It stays on the wire because the frontend needs it to drive\n * IdP-side API calls; it is bound to a different security model\n * (IdP-issued, IdP-rotated, never used to mint Wildo JWTs).\n */\nexport const AuthenticationResponseSchema = z.object({\n  success: z.boolean(),\n  sessionId: z.string(),\n  userExists: z.boolean(),\n  factorLevel: z.enum(AuthFactorLevel),\n  authMethod: z.enum(AuthMethod).optional(),\n\n  // Success response. NOTE: `refreshToken` deliberately ABSENT from the\n  // wire schema (Auth-hardening A-Step 6) — see the file/schema-level\n  // JSDoc above for the cookie-only contract.\n  accessToken: z.string().optional(),\n  expiresIn: z.number().optional(),\n   user: UserContextSchema.optional(),\n\n  // Integration access tokens (if requested and granted)\n  integrationTokens: z.array(z.object({\n    integrationId: z.string(),\n    accessToken: z.string(),\n    refreshToken: z.string().optional(),\n    expiresIn: z.number().optional(),\n    scopes: z.array(z.string())\n  })).default([]),\n\n  // MFA continuation\n  requiresMFA: z.boolean().default(false),\n  availableMFAMethods: z.array(AvailableMethodSchema).optional(),\n  mfaMethodsRequired: z.number().optional(),\n  completedFactors: z.array(z.enum(AuthMethod)).optional(),\n  enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n  usableSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n  // W4.5: MFA enrollment routing\n  nextStep: z.enum(AuthNextStep).optional(),\n  availableEnrollmentMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n  // Error response\n  error: z.string().optional(),\n  errorCode: z.string().optional(),\n  retryAllowed: z.boolean().default(true),\n  remainingAttempts: z.number().optional(),\n  lockoutUntil: z.date().optional(),\n\n  // Method-specific data\n  challengeData: z.record(z.string(), z.any()).optional(),\n  redirectUrl: z.url().optional()\n});\n\n\n\n// ===============================\n// MFA SETUP AND MANAGEMENT\n// ===============================\n\n/**\n * MFA Setup Request\n */\nexport const MFASetupRequestSchema = z.object({\n  method: z.enum(AuthMethod),\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n  deviceName: z.string().optional()\n}).refine((data) => AuthUtils.canBeSecondFactor(data.method));\n\n\n/**\n * MFA Setup Response\n */\nexport const MFASetupResponseSchema = z.object({\n  method: z.enum(AuthMethod),\n  setupToken: z.string(),\n  qrCodeUrl: z.url().optional(),\n  secret: z.string().optional(),\n  challenge: z.record(z.string(), z.any()).optional(),\n  recoveryCodes: z.array(z.string()).optional()\n});\n\n\n\n\n/**\n * Authentication Session State\n */\nexport enum AuthenticationSessionState {\n  // Login flow states\n  CREATED = 'CREATED',                           // Session created, waiting for identification\n  IDENTIFIED = 'IDENTIFIED',                     // User identified, methods available\n  FIRST_FACTOR_IN_PROGRESS = 'FIRST_FACTOR_IN_PROGRESS', // First factor authentication in progress\n  FIRST_FACTOR_COMPLETED = 'FIRST_FACTOR_COMPLETED',     // First factor completed\n  MFA_REQUIRED = 'MFA_REQUIRED',                 // MFA required, waiting for second factor\n  SECOND_FACTOR_IN_PROGRESS = 'SECOND_FACTOR_IN_PROGRESS', // Second factor in progress\n  COMPLETED = 'COMPLETED',                       // Authentication completed successfully\n  PASSWORD_EXPIRED = 'PASSWORD_EXPIRED',         // W2.2: Password expired, must change before token issuance\n\n  // W4: Registration pipeline states\n  REGISTERED = 'REGISTERED',                     // Account created, email verification pending/deferred\n  EMAIL_VERIFIED = 'EMAIL_VERIFIED',             // Email confirmed, checking MFA requirements\n  MFA_ENROLLMENT_REQUIRED = 'MFA_ENROLLMENT_REQUIRED', // MFA enrollment needed before tokens can be issued\n  MFA_ENROLLMENT_GRACE = 'MFA_ENROLLMENT_GRACE', // Within grace period — tokens issued with mfaGraceExpiresAt claim\n  ONBOARDING_PENDING = 'ONBOARDING_PENDING',     // Auth complete, guidance/onboarding steps remain\n\n  // Terminal states\n  FAILED = 'FAILED',                             // Authentication failed\n  EXPIRED = 'EXPIRED',                           // Session expired\n  LOCKED = 'LOCKED'                              // Account locked due to too many attempts\n}\n\n/** W4.2: Session purpose — drives UI rendering and valid state transitions. */\nexport const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);\n\n/**\n * Authentication Session Schema\n * Tracks the complete state of an authentication session\n */\nexport const AuthenticationSessionSchema = z.object({\n  sessionId: z.string(),\n  state: z.enum(AuthenticationSessionState),\n\n  // User identification\n  email: z.email().optional(),\n  userExists: z.boolean().optional(),\n  userId: z.string().optional(),\n  /** Trusted organization created transactionally by deferred registration onboarding. */\n  organizationId: z.string().optional(),\n  /**\n   * Untrusted DNS-verified email-domain ownership hint used only to tighten SSO policy.\n   * It is deliberately distinct from `organizationId`, which has trusted onboarding provenance.\n   */\n  scopeType: z.enum(AuthScopeType).optional(),\n  scopeId: z.string().optional(),\n\n  /** W3.5: Resolved user type for this session (from X-Frontend-Service-Name → frontendServices → userType). Drives per-user-type auth policy. */\n  activeUserType: z.string().optional(),\n\n  /** W4.2: Session purpose — determines valid state transitions and frontend UI. */\n  purpose: AuthSessionPurposeSchema.optional(),\n\n  /** W4: Next step hint for frontend routing after state transitions. */\n  nextStep: z.enum(AuthNextStep).optional(),\n\n  /** W4.5: ISO date when MFA grace period expires. Present when state is MFA_ENROLLMENT_GRACE. */\n  mfaGraceExpiresAt: z.string().optional(),\n\n  /** W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. */\n  pendingOrgType: z.string().optional(),\n\n  /** W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). */\n  availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),\n\n  // Authentication flow state\n  completedFactors: z.array(z.enum(AuthMethod)).default([]),\n  currentFactor: z.enum(AuthFactorLevel).optional(),\n\n  // Available methods\n  availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),\n  availableSecondFactorMethods: z.array(AvailableMethodSchema).default([]),\n\n  // MFA requirements\n  requiresMFA: z.boolean().default(false),\n  mfaMethodsRequired: z.number().default(1),\n  enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n  /** Intersection of availableSecondFactorMethods and enrolledSecondFactorMethods — methods the user can actually use for MFA challenge. */\n  usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n  /** When true, EMAIL_OTP alone is insufficient — requires TOTP, Passkey, or SMS_OTP. */\n  requireStrongMFA: z.boolean().default(false),\n\n  // Session metadata\n  createdAt: z.date(),\n  expiresAt: z.date(),\n  lastActivity: z.date(),\n\n  // Security tracking\n  attempts: z.number().default(0),\n  maxAttempts: z.number().default(5),\n  lockoutUntil: z.date().optional(),\n\n  // Device and context\n  deviceInfo: z.object({\n    userAgent: z.string().optional(),\n    ipAddress: z.string().optional(),\n  }).optional(),\n\n  // Integration requests\n  requestedIntegrations: z.array(z.string()).default([]),\n\n  // Session-specific data for ongoing flows\n  challengeData: z.record(z.string(), z.any()).optional(),\n  pendingRedirectUrl: z.url().optional(),\n\n  // Organization branding (cached for consistent UI)\n  organizationBranding: z.object({\n    // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n    // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n    // servable URL OR an app-relative path (e.g. `/favicon.png`).\n    logoUrl: z.string().optional(),\n    primaryColor: ZodTypeForColors.optional(),\n    organizationName: z.string().optional()\n  }).optional(),\n\n  // M1: Optimistic concurrency control version for atomic session updates\n  version: z.number().default(0),\n}).superRefine((session, ctx) => {\n  if ((session.scopeType === undefined) !== (session.scopeId === undefined)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['scopeType'],\n      message: 'Authentication session scopeType and scopeId must be provided together',\n    });\n  }\n});\n\n\n\n// ===============================\n// SIMPLIFIED FORM DTOs\n// ===============================\n// Used by frontend Form components and backend body parsing.\n// These are the \"what the user fills in\" schemas — services add\n// programmatic fields (sessionId, method, factorLevel) before API calls.\n\n/**\n * Identify step form DTO — user enters email to discover auth methods.\n * Used by the public auth page's first step.\n */\nexport const AuthIdentifyFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n  }),\n});\n\n\n\n\n/**\n * Login step form DTO — user enters email + password.\n * Used by the public auth page when password auth is shown.\n * The .isPassword() decorator tells FormField to render a password input.\n */\nexport const AuthLoginFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n  }),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.CURRENT_PASSWORD },\n  }),\n});\n\nfunction withOneTimeCodeAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n  return (schema as any).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ONE_TIME_CODE },\n  }) as TSchema;\n}\n\nfunction withTelAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n  return (schema as any).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.TEL },\n  }) as TSchema;\n}\n\n/**\n * MFA email OTP challenge form DTO.\n * Used by the MFA challenge screen after the email code has been sent.\n */\nexport const EmailOtpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n  ),\n});\n\n/**\n * MFA SMS OTP challenge form DTO.\n * Used by the MFA challenge screen after the SMS code has been sent.\n */\nexport const SmsOtpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n  ),\n});\n\n/**\n * MFA TOTP challenge form DTO.\n * Used by the MFA challenge screen for authenticator-app verification.\n */\nexport const TotpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n/**\n * Phone enrollment start form DTO.\n * Used by the enrollment gate before sending a phone verification code.\n */\nexport const PhoneEnrollmentStartFormDtoSchema = z.object({\n  phoneNumber: withTelAutocomplete(z.string().min(1)),\n});\n\n/**\n * Phone enrollment verification form DTO.\n * Used by the enrollment gate after a verification code has been sent.\n */\nexport const PhoneEnrollmentVerifyFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n/**\n * TOTP enrollment verification form DTO.\n * Used after the user scans the QR code and confirms setup with a first code.\n */\nexport const TotpEnrollmentVerifyFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n\n\n\n/**\n * One-off session token exchange response.\n *\n * **Wire contract — refresh token is NEVER included** (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string()` which was emitted in the JSON body. The\n * cookie migration (A-Step 2) routed the refresh token to\n * `Set-Cookie: __wildo_refresh=…`; A-Step 6 removes the body field\n * entirely so a one-off-session client receives ONLY a (short-lived)\n * access token + the cookie. The controller's\n * `_jsonSuccessWithRefreshCookie` helper sets the cookie from a\n * separately-passed argument.\n */\nexport const OneOffTokenExchangeResponseSchema = z.object({\n  accessToken: z.string(),\n  sessionType: z.enum(SessionType),\n  consumableTokenValue: z.string().optional(),\n  tokenExpiresAt: z.string().optional(),\n  context: z.object({\n    tokenId: z.string(),\n    tokenType: z.string(),\n    targeting: z.object({\n      initiatorIds: z.record(z.string(), z.string()).optional(),\n    }).optional(),\n    organizationId: z.string().optional(),\n    applicationId: z.string().optional(),\n    userId: z.string(),\n  }),\n});\n\n// Cross-frontend handoff DTO atoms (cross-app-jwt-propagation Step 2) live\n// in `./cross-frontend-handoff.shared.dto.schemas` so a browser-safe subpath\n// (`@wildo-ai/saas-models/public-runtime`) can re-export them without\n// dragging this file's full transitive web (UserContext, SessionType,\n// AuthMethod, AuthFactorLevel, AuthSessionPurpose, AuthUtils,\n// `@wildo-ai/zod-decorators`). See saas-models-public-runtime.md K-2.\nexport * from './cross-frontend-handoff.shared.dto.schemas';\n\n// ===============================\n// INFERRED TYPES\n// ===============================\n\n// Authentication method types\nexport type AuthIdentificationRequest = z.infer<typeof AuthIdentificationRequestSchema>;\nexport type AuthIdentificationResponse = z.infer<typeof AuthIdentificationResponseSchema>;\n\n\n\n// Authentication request types\nexport type AuthenticationRequest = z.infer<typeof AuthenticationRequestSchema>;\nexport type AuthenticationResponse = z.infer<typeof AuthenticationResponseSchema>;\nexport type PasswordAuthRequest = z.infer<typeof PasswordAuthRequestSchema>;\nexport type External_OAuth2_AuthRequest = z.infer<typeof External_OAuth2_AuthRequestSchema>;\nexport type OrganizationSSOAuthRequest = z.infer<typeof OrganizationSSOAuthRequestSchema>;\nexport type OAuth2Callback = z.infer<typeof OAuth2CallbackSchema>;\nexport type TOTPAuthRequest = z.infer<typeof TOTPAuthRequestSchema>;\nexport type SMSOTPAuthRequest = z.infer<typeof SMSOTPAuthRequestSchema>;\nexport type EmailOTPAuthRequest = z.infer<typeof EmailOTPAuthRequestSchema>;\nexport type PasskeyAuthRequest = z.infer<typeof PasskeyAuthRequestSchema>;\n\nexport type MagicLinkSendRequest = z.infer<typeof MagicLinkSendRequestSchema>;\nexport type MagicLinkVerifyRequest = z.infer<typeof MagicLinkVerifyRequestSchema>;\n\nexport type PhoneVerifySendRequest = z.infer<typeof PhoneVerifySendRequestSchema>;\nexport type PhoneVerifyConfirmRequest = z.infer<typeof PhoneVerifyConfirmRequestSchema>;\n\n// MFA types\nexport type MFASetupRequest = z.infer<typeof MFASetupRequestSchema>;\nexport type MFASetupResponse = z.infer<typeof MFASetupResponseSchema>;\n\nexport type AuthIdentifyFormDto = z.infer<typeof AuthIdentifyFormDtoSchema>;\nexport type AuthLoginFormDto = z.infer<typeof AuthLoginFormDtoSchema>;\nexport type EmailOtpChallengeFormDto = z.infer<typeof EmailOtpChallengeFormDtoSchema>;\nexport type SmsOtpChallengeFormDto = z.infer<typeof SmsOtpChallengeFormDtoSchema>;\nexport type TotpChallengeFormDto = z.infer<typeof TotpChallengeFormDtoSchema>;\nexport type PhoneEnrollmentStartFormDto = z.infer<typeof PhoneEnrollmentStartFormDtoSchema>;\nexport type PhoneEnrollmentVerifyFormDto = z.infer<typeof PhoneEnrollmentVerifyFormDtoSchema>;\nexport type TotpEnrollmentVerifyFormDto = z.infer<typeof TotpEnrollmentVerifyFormDtoSchema>;\n\n// Session types\nexport type AuthenticationSession = z.infer<typeof AuthenticationSessionSchema>;\nexport type OneOffTokenExchangeResponse = z.infer<typeof OneOffTokenExchangeResponseSchema>;\n"]}
+{"version":3,"file":"authentication.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEzF;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,0HAA0H;IAC1H,yCAAa,CAAA;IACb,sHAAsH;IACtH,uCAAW,CAAA;IACX,8TAA8T;IAC9T,yCAAa,CAAA;AACf,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE;IACvB,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,2FAA2F;IAC3F,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3D,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAEvB,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEvD,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,oCAAoC;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,4DAA4D;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,+CAA+C;QAC/E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC,wCAAwC;IACxC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;IACxE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB;IAEhD,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qCAAqC;IACxF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,mCAAmC;CAC5F,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,oBAAoB;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACjD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;QACF,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC;AAIH,kCAAkC;AAClC,gCAAgC;AAChC,kCAAkC;AAElC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH,kCAAkC;AAClC,wCAAwC;AACxC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACpD,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACpC,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,yBAAyB;IACzB,iCAAiC;IACjC,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEzC,sEAAsE;IACtE,oEAAoE;IACpE,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEnC,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9E,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,uBAAuB;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,kCAAkC;AAClC,2BAA2B;AAC3B,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAG9D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,oBAAoB;IACpB,iDAAmB,CAAA;IACnB,uDAAyB,CAAA;IACzB,mFAAqD,CAAA;IACrD,+EAAiD,CAAA;IACjD,2DAA6B,CAAA;IAC7B,qFAAuD,CAAA;IACvD,qDAAuB,CAAA;IACvB,mEAAqC,CAAA;IAErC,mCAAmC;IACnC,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,iFAAmD,CAAA;IACnD,2EAA6C,CAAA;IAC7C,uEAAyC,CAAA;IAEzC,kBAAkB;IAClB,+CAAiB,CAAA;IACjB,iDAAmB,CAAA;IACnB,+CAAiB,CAAA,CAA8B,0CAA0C;AAC3F,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAEzC,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,gJAAgJ;IAChJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,kFAAkF;IAClF,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE5C,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAEzC,gGAAgG;IAChG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,wHAAwH;IACxH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEnE,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAEjD,oBAAoB;IACpB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAExE,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,0IAA0I;IAC1I,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE5C,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IAEtB,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,mDAAmD;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAClC,6DAA6D;AAC7D,gEAAgE;AAChE,yEAAyE;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;CACH,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,gBAAgB,EAAE;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAA+B,MAAe;IAChF,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,aAAa,EAAE;KAClE,CAAY,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAA+B,MAAe;IACxE,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,GAAG,EAAE;KACxD,CAAY,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAKH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC1D,CAAC,CAAC,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACH,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,cAAc,6CAA6C,CAAC","sourcesContent":["/**\n * Authentication Shared Schemas\n *\n * Core authentication schemas shared between frontend and backend\n */\n\nimport { z } from 'zod';\nimport { UserContextSchema } from '../../users/users.shared.schemas';\nimport {\n  AuthMethod,\n  AuthFactorLevel,\n  AuthNextStep,\n  AuthSessionPurpose,\n  AuthScopeType,\n  AvailableMethodSchema,\n} from './authentication.shared.schemas';\nimport { AuthUtils } from './authentication.shared.utils';\nimport { SessionType } from '../../runtime/execution-context.shared.schemas';\nimport { PasswordPolicyRulesSchema } from '../../config/app-configuration-shared.shared.schemas';\nimport { AutocompleteFieldIdentifier, ZodTypeForColors } from '@wildo-ai/zod-decorators';\n\n/**\n * Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,\n * from the invitation token alone, which first-factor auth methods the target\n * organization allows and whether the org is SSO/SCIM-managed.\n *\n * Distinct from `identify()` (keyed by email→domain, requires an existing user):\n * this is token-keyed and works for a not-yet-activated invitee (INVITED\n * membership, no session). Populated by `GET /auth/invitation/info?token=…`,\n * which reads the token WITHOUT consuming it (unlike accept). See\n * `.claude/plans/invitation-multi-method-auth.md`.\n */\nexport enum InvitationManagementMode {\n  /** No enterprise identity authority — invitee may set a local credential (password/passkey) or use any allowed method. */\n  OPEN = 'open',\n  /** Org authenticates via enterprise SSO — route the invitee to the IdP (JIT consumes the invite; no local accept). */\n  SSO = 'sso',\n  /** Org is ACTIVELY directory-managed (SCIM live — DIRECTORY_PROVISIONING feature + a live SCIM token) — informational only, NO local credential: a local password/passkey/magic-link would survive IdP deprovisioning. Derived per-org (not from the org-TYPE mount flag) — see `isOrgActivelyDirectoryManaged` / AUTH-23. */\n  SCIM = 'scim',\n}\n\nexport const AuthInvitationInfoResponseSchema = z.object({\n  /** The invitee's email (from the INVITED membership's denormalized `userEmail`). */\n  inviteeEmail: z.email(),\n  /** Display name of the organization the invitee is joining. */\n  organizationName: z.string(),\n  /** First-factor methods the org allows for a joining member of the invitee's user type. */\n  availableFirstFactorMethods: z.array(AvailableMethodSchema),\n  /** Identity-management posture — drives chooser (open/sso) vs informational state (scim). */\n  managementMode: z.enum(InvitationManagementMode),\n  /**\n   * The org-join user type's ORG-MERGED password policy (the SAME policy the accept\n   * endpoint validates against). Lets the chooser's PASSWORD form show the invitee the\n   * org's REAL requirements (strength indicator + client pre-check) instead of the\n   * app-level default — so an org that strengthens `passwordPolicy` via `authOverrides`\n   * doesn't reject a client-accepted password after submit. Absent when the policy can't\n   * be resolved (unknown user type / degraded org read); the frontend then falls back to\n   * the app-level resolved policy. Structurally the frontend validation subset\n   * (`PasswordPolicyRulesSchema`); the backend's `PasswordPolicyConfig` is field-identical\n   * and parses through it losslessly.\n   */\n  passwordPolicy: PasswordPolicyRulesSchema.optional(),\n});\nexport type AuthInvitationInfoResponse = z.infer<typeof AuthInvitationInfoResponseSchema>;\n\n/**\n * Step 1: User identification by email\n * Returns available authentication methods for the user\n */\nexport const AuthIdentificationRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  organizationId: z.string().optional(),\n  deviceInfo: z.object({\n    userAgent: z.string().optional(),\n    ipAddress: z.string().optional(),\n  }).optional()\n});\n\n\n\n/**\n * Step 1 Response: Available authentication methods with factor classification\n */\nexport const AuthIdentificationResponseSchema = z.object({\n  sessionId: z.string(),\n  email: z.email(),\n  userExists: z.boolean(),\n\n  // First factor methods (primary authentication)\n  firstFactorMethods: z.array(AvailableMethodSchema),\n  defaultFirstFactorMethod: z.enum(AuthMethod).optional(),\n\n  // Second factor methods (MFA) - only shown if MFA is required\n  secondFactorMethods: z.array(AvailableMethodSchema),\n  requiresMFA: z.boolean(),\n  mfaMethodsRequired: z.number().default(1),\n\n  // Organization-specific information\n  organizationBranding: z.object({\n    // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n    // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n    // servable URL OR an app-relative path (e.g. `/favicon.png`).\n    logoUrl: z.string().optional(),\n    primaryColor: ZodTypeForColors.optional(),\n    organizationName: z.string().optional()\n  }).optional(),\n\n  // Available integrations (if any auth method supports them)\n  availableIntegrations: z.array(z.object({\n    integrationId: z.string(),\n    externalProviderId: z.string(), // Which auth provider enables this integration\n    iconUrl: z.url().optional()\n  })).default([]),\n});\n\n\n\n// ===============================\n// AUTHENTICATION REQUEST SCHEMAS\n// ===============================\n\n/**\n * Base authentication request schema with factor context\n */\nexport const BaseAuthRequestSchema = z.object({\n  sessionId: z.string().min(1),\n  method: z.enum(AuthMethod),\n  factorLevel: z.enum(AuthFactorLevel),\n  rememberMe: z.boolean().default(false),\n\n  // Integration access request (optional)\n  requestedIntegrations: z.array(z.string()).default([])\n});\n\n\n\n/**\n * Password Authentication (First factor only)\n */\nexport const PasswordAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.PASSWORD),\n  factorLevel: z.literal(AuthFactorLevel.FIRST),\n  password: z.string().min(1)\n});\n\n\n\n/**\n * Third-Party OAuth2 Authentication (First factor, extensible)\n */\nexport const External_OAuth2_AuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.EXTERNAL_OAUTH2),\n  factorLevel: z.enum(AuthFactorLevel),\n  externalProviderId: z.string().min(1), // References configured provider\n  redirectUri: z.url(),\n  state: z.string().optional(), // CSRF protection\n\n  // Integration-specific parameters\n  additionalScopes: z.array(z.string()).default([]), // Additional scopes for integrations\n  integrationPermissions: z.array(z.string()).default([]) // Specific integration permissions\n});\n\n\n\n/**\n * Organization SSO Authentication (First or second factor, organization-restricted)\n */\nexport const OrganizationSSOAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.enum([AuthMethod.ORG_SAML, AuthMethod.ORG_OPENID_CONNECT]),\n  factorLevel: z.enum(AuthFactorLevel),\n  ssoId: z.string().min(1),\n  organizationId: z.string().min(1),\n\n  // SSO-specific data\n  samlResponse: z.string().optional(), // For SAML\n  idToken: z.string().optional(), // For OpenID Connect\n  state: z.string().optional()\n});\n\n\n\n/**\n * OAuth2 Callback Schema (for both third-party and SSO)\n */\nexport const OAuth2CallbackSchema = z.object({\n  sessionId: z.string().min(1),\n  externalProviderId: z.string().optional(), // For third-party OAuth2\n  ssoId: z.string().optional(), // For organization SSO\n  code: z.string().min(1),\n  state: z.string().optional(),\n  error: z.string().optional(),\n  errorDescription: z.string().optional()\n});\n\n\n\n/**\n * TOTP Authentication (Second factor only)\n */\nexport const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.TOTP),\n  factorLevel: z.literal(AuthFactorLevel.SECOND),\n  token: z.string().regex(/^(\\d{6}|[a-f0-9]{8})$/)\n});\n\n\n\n/**\n * SMS OTP Authentication (First or second factor)\n */\nexport const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.SMS_OTP),\n  factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n  token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/**\n * Email OTP Authentication (Second factor only)\n */\nexport const EmailOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.EMAIL_OTP),\n  factorLevel: z.literal(AuthFactorLevel.SECOND),\n  token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/**\n * Passkey (WebAuthn) Authentication (First or second factor)\n */\nexport const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.PASSKEY),\n  factorLevel: z.enum(AuthFactorLevel),\n  // WebAuthn authentication response from navigator.credentials.get()\n  response: z.object({\n    id: z.string(),\n    rawId: z.string(),\n    response: z.object({\n      authenticatorData: z.string(),\n      clientDataJSON: z.string(),\n      signature: z.string(),\n      userHandle: z.string().optional(),\n    }),\n    authenticatorAttachment: z.string().optional(),\n    clientExtensionResults: z.record(z.string(), z.any()).default({}),\n    type: z.literal('public-key'),\n  }),\n});\n\n\n\n// ===============================\n// MAGIC LINK SCHEMAS (Phase G2)\n// ===============================\n\n/**\n * Magic Link Send Request — triggers a magic link email to the user.\n * Separate from the main AuthenticationRequestSchema because it doesn't\n * go through the standard authenticate() dispatch.\n */\nexport const MagicLinkSendRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  organizationId: z.string().optional(),\n});\n\n\n\n\n/**\n * Magic Link Verify Request — verifies the token from the magic link.\n * Used by POST /auth/magic-link/verify for programmatic verification.\n * Intentionally NOT added to AuthenticationRequestSchema discriminated union\n * because magic link verification follows a separate flow (GET from email click\n * → exchange code → POST verify).\n */\nexport const MagicLinkVerifyRequestSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\n\n\n\n// ===============================\n// PHONE VERIFICATION SCHEMAS (Phase G2)\n// ===============================\n\n/**\n * Phone Verification Send Request — triggers a verification code to a phone number.\n * Used for phone number ownership verification, separate from SMS OTP auth.\n */\nexport const PhoneVerifySendRequestSchema = z.object({\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n});\n\n\n\n\n/**\n * Phone Verification Confirm Request — confirms the verification code.\n */\nexport const PhoneVerifyConfirmRequestSchema = z.object({\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n  code: z.string().regex(/^\\d{4,8}$/),\n});\n\n\n\n\n/**\n * Union of all authentication request types\n */\nexport const AuthenticationRequestSchema = z.discriminatedUnion('method', [\n  PasswordAuthRequestSchema,\n  External_OAuth2_AuthRequestSchema,\n  OrganizationSSOAuthRequestSchema,\n  TOTPAuthRequestSchema,\n  SMSOTPAuthRequestSchema,\n  EmailOTPAuthRequestSchema,\n  PasskeyAuthRequestSchema\n]);\n\n\n\n/**\n * Authentication Response Schema with Factor Context and Integration Access.\n *\n * **Wire contract — refresh token is NEVER included** (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string().optional()` which was emitted in the JSON\n * body for every authentication response. The cookie migration (A-Step 2,\n * 2026-04-13) added `Set-Cookie: __wildo_refresh=…` as a parallel\n * channel; A-Step 3 (2026-04-13) made the SaaS-frontend stop reading\n * the body field; A-Step 6 (THIS step) DROPS the body field entirely\n * so the wire response physically cannot carry the refresh token.\n *\n * Backend internals: the orchestrator's\n * `_buildAuthenticationSuccessMethod` returns\n * `AuthenticationServiceResult = AuthenticationResponse & { refreshToken?: string }`\n * (a backend-only TS type — NOT a wire schema) so the controller can\n * extract the refresh-token value and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`. The wire\n * payload (this schema) STILL has no `refreshToken` field — the\n * controller's helper sets the cookie and emits the body separately.\n *\n * `integrationTokens[].refreshToken` (below) is a third-party-IdP\n * OAuth2 refresh token (Google, Microsoft, etc.) — NOT a Wildo refresh\n * token. It stays on the wire because the frontend needs it to drive\n * IdP-side API calls; it is bound to a different security model\n * (IdP-issued, IdP-rotated, never used to mint Wildo JWTs).\n */\nexport const AuthenticationResponseSchema = z.object({\n  success: z.boolean(),\n  sessionId: z.string(),\n  userExists: z.boolean(),\n  factorLevel: z.enum(AuthFactorLevel),\n  authMethod: z.enum(AuthMethod).optional(),\n\n  // Success response. NOTE: `refreshToken` deliberately ABSENT from the\n  // wire schema (Auth-hardening A-Step 6) — see the file/schema-level\n  // JSDoc above for the cookie-only contract.\n  accessToken: z.string().optional(),\n  expiresIn: z.number().optional(),\n   user: UserContextSchema.optional(),\n\n  // Integration access tokens (if requested and granted)\n  integrationTokens: z.array(z.object({\n    integrationId: z.string(),\n    accessToken: z.string(),\n    refreshToken: z.string().optional(),\n    expiresIn: z.number().optional(),\n    scopes: z.array(z.string())\n  })).default([]),\n\n  // MFA continuation\n  requiresMFA: z.boolean().default(false),\n  availableMFAMethods: z.array(AvailableMethodSchema).optional(),\n  mfaMethodsRequired: z.number().optional(),\n  completedFactors: z.array(z.enum(AuthMethod)).optional(),\n  enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n  usableSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n  // W4.5: MFA enrollment routing\n  nextStep: z.enum(AuthNextStep).optional(),\n  availableEnrollmentMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n  // Error response\n  error: z.string().optional(),\n  errorCode: z.string().optional(),\n  retryAllowed: z.boolean().default(true),\n  remainingAttempts: z.number().optional(),\n  lockoutUntil: z.date().optional(),\n\n  // Method-specific data\n  challengeData: z.record(z.string(), z.any()).optional(),\n  redirectUrl: z.url().optional()\n});\n\n\n\n// ===============================\n// MFA SETUP AND MANAGEMENT\n// ===============================\n\n/**\n * MFA Setup Request\n */\nexport const MFASetupRequestSchema = z.object({\n  method: z.enum(AuthMethod),\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n  deviceName: z.string().optional()\n}).refine((data) => AuthUtils.canBeSecondFactor(data.method));\n\n\n/**\n * MFA Setup Response\n */\nexport const MFASetupResponseSchema = z.object({\n  method: z.enum(AuthMethod),\n  setupToken: z.string(),\n  qrCodeUrl: z.url().optional(),\n  secret: z.string().optional(),\n  challenge: z.record(z.string(), z.any()).optional(),\n  recoveryCodes: z.array(z.string()).optional()\n});\n\n\n\n\n/**\n * Authentication Session State\n */\nexport enum AuthenticationSessionState {\n  // Login flow states\n  CREATED = 'CREATED',                           // Session created, waiting for identification\n  IDENTIFIED = 'IDENTIFIED',                     // User identified, methods available\n  FIRST_FACTOR_IN_PROGRESS = 'FIRST_FACTOR_IN_PROGRESS', // First factor authentication in progress\n  FIRST_FACTOR_COMPLETED = 'FIRST_FACTOR_COMPLETED',     // First factor completed\n  MFA_REQUIRED = 'MFA_REQUIRED',                 // MFA required, waiting for second factor\n  SECOND_FACTOR_IN_PROGRESS = 'SECOND_FACTOR_IN_PROGRESS', // Second factor in progress\n  COMPLETED = 'COMPLETED',                       // Authentication completed successfully\n  PASSWORD_EXPIRED = 'PASSWORD_EXPIRED',         // W2.2: Password expired, must change before token issuance\n\n  // W4: Registration pipeline states\n  REGISTERED = 'REGISTERED',                     // Account created, email verification pending/deferred\n  EMAIL_VERIFIED = 'EMAIL_VERIFIED',             // Email confirmed, checking MFA requirements\n  MFA_ENROLLMENT_REQUIRED = 'MFA_ENROLLMENT_REQUIRED', // MFA enrollment needed before tokens can be issued\n  MFA_ENROLLMENT_GRACE = 'MFA_ENROLLMENT_GRACE', // Within grace period — tokens issued with mfaGraceExpiresAt claim\n  ONBOARDING_PENDING = 'ONBOARDING_PENDING',     // Auth complete, guidance/onboarding steps remain\n\n  // Terminal states\n  FAILED = 'FAILED',                             // Authentication failed\n  EXPIRED = 'EXPIRED',                           // Session expired\n  LOCKED = 'LOCKED'                              // Account locked due to too many attempts\n}\n\n/** W4.2: Session purpose — drives UI rendering and valid state transitions. */\nexport const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);\n\n/**\n * Authentication Session Schema\n * Tracks the complete state of an authentication session\n */\nexport const AuthenticationSessionSchema = z.object({\n  sessionId: z.string(),\n  state: z.enum(AuthenticationSessionState),\n\n  // User identification\n  email: z.email().optional(),\n  userExists: z.boolean().optional(),\n  userId: z.string().optional(),\n  /** Trusted organization created transactionally by deferred registration onboarding. */\n  organizationId: z.string().optional(),\n  /**\n   * Untrusted DNS-verified email-domain ownership hint used only to tighten SSO policy.\n   * It is deliberately distinct from `organizationId`, which has trusted onboarding provenance.\n   */\n  scopeType: z.enum(AuthScopeType).optional(),\n  scopeId: z.string().optional(),\n\n  /** W3.5: Resolved user type for this session (from X-Frontend-Service-Name → frontendServices → userType). Drives per-user-type auth policy. */\n  activeUserType: z.string().optional(),\n\n  /** W4.2: Session purpose — determines valid state transitions and frontend UI. */\n  purpose: AuthSessionPurposeSchema.optional(),\n\n  /** W4: Next step hint for frontend routing after state transitions. */\n  nextStep: z.enum(AuthNextStep).optional(),\n\n  /** W4.5: ISO date when MFA grace period expires. Present when state is MFA_ENROLLMENT_GRACE. */\n  mfaGraceExpiresAt: z.string().optional(),\n\n  /** W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. */\n  pendingOrgType: z.string().optional(),\n\n  /** W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). */\n  availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),\n\n  // Authentication flow state\n  completedFactors: z.array(z.enum(AuthMethod)).default([]),\n  currentFactor: z.enum(AuthFactorLevel).optional(),\n\n  // Available methods\n  availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),\n  availableSecondFactorMethods: z.array(AvailableMethodSchema).default([]),\n\n  // MFA requirements\n  requiresMFA: z.boolean().default(false),\n  mfaMethodsRequired: z.number().default(1),\n  enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n  /** Intersection of availableSecondFactorMethods and enrolledSecondFactorMethods — methods the user can actually use for MFA challenge. */\n  usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n  /** When true, EMAIL_OTP alone is insufficient — requires TOTP, Passkey, or SMS_OTP. */\n  requireStrongMFA: z.boolean().default(false),\n\n  // Session metadata\n  createdAt: z.date(),\n  expiresAt: z.date(),\n  lastActivity: z.date(),\n\n  // Security tracking\n  attempts: z.number().default(0),\n  maxAttempts: z.number().default(5),\n  lockoutUntil: z.date().optional(),\n\n  // Device and context\n  deviceInfo: z.object({\n    userAgent: z.string().optional(),\n    ipAddress: z.string().optional(),\n  }).optional(),\n\n  // Integration requests\n  requestedIntegrations: z.array(z.string()).default([]),\n\n  // Session-specific data for ongoing flows\n  challengeData: z.record(z.string(), z.any()).optional(),\n  pendingRedirectUrl: z.url().optional(),\n\n  // Organization branding (cached for consistent UI)\n  organizationBranding: z.object({\n    // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n    // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n    // servable URL OR an app-relative path (e.g. `/favicon.png`).\n    logoUrl: z.string().optional(),\n    primaryColor: ZodTypeForColors.optional(),\n    organizationName: z.string().optional()\n  }).optional(),\n\n  // M1: Optimistic concurrency control version for atomic session updates\n  version: z.number().default(0),\n}).superRefine((session, ctx) => {\n  if ((session.scopeType === undefined) !== (session.scopeId === undefined)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['scopeType'],\n      message: 'Authentication session scopeType and scopeId must be provided together',\n    });\n  }\n});\n\n\n\n// ===============================\n// SIMPLIFIED FORM DTOs\n// ===============================\n// Used by frontend Form components and backend body parsing.\n// These are the \"what the user fills in\" schemas — services add\n// programmatic fields (sessionId, method, factorLevel) before API calls.\n\n/**\n * Identify step form DTO — user enters email to discover auth methods.\n * Used by the public auth page's first step.\n */\nexport const AuthIdentifyFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n  }),\n});\n\n\n\n\n/**\n * Login step form DTO — user enters email + password.\n * Used by the public auth page when password auth is shown.\n * The .isPassword() decorator tells FormField to render a password input.\n */\nexport const AuthLoginFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n  }),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.CURRENT_PASSWORD },\n  }),\n});\n\nfunction withOneTimeCodeAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n  return (schema as any).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ONE_TIME_CODE },\n  }) as TSchema;\n}\n\nfunction withTelAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n  return (schema as any).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.TEL },\n  }) as TSchema;\n}\n\n/**\n * MFA email OTP challenge form DTO.\n * Used by the MFA challenge screen after the email code has been sent.\n */\nexport const EmailOtpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n  ),\n});\n\n/**\n * MFA SMS OTP challenge form DTO.\n * Used by the MFA challenge screen after the SMS code has been sent.\n */\nexport const SmsOtpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n  ),\n});\n\n/**\n * MFA TOTP challenge form DTO.\n * Used by the MFA challenge screen for authenticator-app verification.\n */\nexport const TotpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n/**\n * Phone enrollment start form DTO.\n * Used by the enrollment gate before sending a phone verification code.\n */\nexport const PhoneEnrollmentStartFormDtoSchema = z.object({\n  phoneNumber: withTelAutocomplete(z.string().min(1)),\n});\n\n/**\n * Phone enrollment verification form DTO.\n * Used by the enrollment gate after a verification code has been sent.\n */\nexport const PhoneEnrollmentVerifyFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n/**\n * TOTP enrollment verification form DTO.\n * Used after the user scans the QR code and confirms setup with a first code.\n */\nexport const TotpEnrollmentVerifyFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n\n\n\n/**\n * One-off session token exchange response.\n *\n * **Wire contract — refresh token is NEVER included** (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string()` which was emitted in the JSON body. The\n * cookie migration (A-Step 2) routed the refresh token to\n * `Set-Cookie: __wildo_refresh=…`; A-Step 6 removes the body field\n * entirely so a one-off-session client receives ONLY a (short-lived)\n * access token + the cookie. The controller's\n * `_jsonSuccessWithRefreshCookie` helper sets the cookie from a\n * separately-passed argument.\n */\nexport const OneOffTokenExchangeResponseSchema = z.object({\n  accessToken: z.string(),\n  sessionType: z.enum(SessionType),\n  consumableTokenValue: z.string().optional(),\n  tokenExpiresAt: z.string().optional(),\n  context: z.object({\n    tokenId: z.string(),\n    tokenType: z.string(),\n    targeting: z.object({\n      initiatorIds: z.record(z.string(), z.string()).optional(),\n    }).optional(),\n    organizationId: z.string().optional(),\n    applicationId: z.string().optional(),\n    userId: z.string(),\n  }),\n});\n\n// Cross-frontend handoff DTO atoms (cross-app-jwt-propagation Step 2) live\n// in `./cross-frontend-handoff.shared.dto.schemas` so a browser-safe subpath\n// (`@wildo-ai/saas-models/public-runtime`) can re-export them without\n// dragging this file's full transitive web (UserContext, SessionType,\n// AuthMethod, AuthFactorLevel, AuthSessionPurpose, AuthUtils,\n// `@wildo-ai/zod-decorators`). See saas-models-public-runtime.md K-2.\nexport * from './cross-frontend-handoff.shared.dto.schemas';\n\n// ===============================\n// INFERRED TYPES\n// ===============================\n\n// Authentication method types\nexport type AuthIdentificationRequest = z.infer<typeof AuthIdentificationRequestSchema>;\nexport type AuthIdentificationResponse = z.infer<typeof AuthIdentificationResponseSchema>;\n\n\n\n// Authentication request types\nexport type AuthenticationRequest = z.infer<typeof AuthenticationRequestSchema>;\nexport type AuthenticationResponse = z.infer<typeof AuthenticationResponseSchema>;\nexport type PasswordAuthRequest = z.infer<typeof PasswordAuthRequestSchema>;\nexport type External_OAuth2_AuthRequest = z.infer<typeof External_OAuth2_AuthRequestSchema>;\nexport type OrganizationSSOAuthRequest = z.infer<typeof OrganizationSSOAuthRequestSchema>;\nexport type OAuth2Callback = z.infer<typeof OAuth2CallbackSchema>;\nexport type TOTPAuthRequest = z.infer<typeof TOTPAuthRequestSchema>;\nexport type SMSOTPAuthRequest = z.infer<typeof SMSOTPAuthRequestSchema>;\nexport type EmailOTPAuthRequest = z.infer<typeof EmailOTPAuthRequestSchema>;\nexport type PasskeyAuthRequest = z.infer<typeof PasskeyAuthRequestSchema>;\n\nexport type MagicLinkSendRequest = z.infer<typeof MagicLinkSendRequestSchema>;\nexport type MagicLinkVerifyRequest = z.infer<typeof MagicLinkVerifyRequestSchema>;\n\nexport type PhoneVerifySendRequest = z.infer<typeof PhoneVerifySendRequestSchema>;\nexport type PhoneVerifyConfirmRequest = z.infer<typeof PhoneVerifyConfirmRequestSchema>;\n\n// MFA types\nexport type MFASetupRequest = z.infer<typeof MFASetupRequestSchema>;\nexport type MFASetupResponse = z.infer<typeof MFASetupResponseSchema>;\n\nexport type AuthIdentifyFormDto = z.infer<typeof AuthIdentifyFormDtoSchema>;\nexport type AuthLoginFormDto = z.infer<typeof AuthLoginFormDtoSchema>;\nexport type EmailOtpChallengeFormDto = z.infer<typeof EmailOtpChallengeFormDtoSchema>;\nexport type SmsOtpChallengeFormDto = z.infer<typeof SmsOtpChallengeFormDtoSchema>;\nexport type TotpChallengeFormDto = z.infer<typeof TotpChallengeFormDtoSchema>;\nexport type PhoneEnrollmentStartFormDto = z.infer<typeof PhoneEnrollmentStartFormDtoSchema>;\nexport type PhoneEnrollmentVerifyFormDto = z.infer<typeof PhoneEnrollmentVerifyFormDtoSchema>;\nexport type TotpEnrollmentVerifyFormDto = z.infer<typeof TotpEnrollmentVerifyFormDtoSchema>;\n\n// Session types\nexport type AuthenticationSession = z.infer<typeof AuthenticationSessionSchema>;\nexport type OneOffTokenExchangeResponse = z.infer<typeof OneOffTokenExchangeResponseSchema>;\n"]}

package/dist/esm/security/authentications/authentication.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AAExG;;;;;;;GAOG;AAGH,eAAO,MAAM,mBAAmB,EAAE,4BAA4B,EAG7D,CAAC;AAOF;;;GAGG;AACH,oBAAY,cAAc;IACxB,UAAU,eAAe,CAAQ,kDAAkD;IACnF,WAAW,gBAAgB,CAAM,0CAA0C;IAC3E,eAAe,oBAAoB,CAAE,+CAA+C;IACpF,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,UAAU,eAAe,CAAY,6BAA6B;IAClE,eAAe,oBAAoB,CAAE,yDAAyD;IAC9F,OAAO,YAAY,CAAiB,oDAAoD;IACxF,SAAS,cAAc,CAAa,yCAAyC;IAC7E,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAG,mBAA4B,CAAC;AAEnE,oBAAY,cAAc;IACtB,wDAAwD;IACxD,4BAA4B,iCAAiC;IAC7D,sDAAsD;IACtD,0BAA0B,+BAA+B;IACzD,mCAAmC;IACnC,mBAAmB,wBAAwB;IAC3C,sCAAsC;IACtC,sBAAsB,2BAA2B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,aAAa;IACrB,qEAAqE;IACrE,qBAAqB,0BAA0B;IAE/C,0EAA0E;IAC1E,iCAAiC,sCAAsC;CAC1E;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,EAAE,WAAW,CAAC,MAAM,CAKjE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,oBAAY,UAAU;IAEpB,QAAQ,aAAa;IAGrB,eAAe,oBAAoB,CAAE,qCAAqC;IAG1E,QAAQ,aAAa,CAAsB,wBAAwB;IACnE,kBAAkB,uBAAuB,CAAE,kCAAkC;IAG7E,UAAU,eAAe,CAAO,uBAAuB;IAGvD,IAAI,SAAS,CAAqB,+BAA+B;IACjE,OAAO,YAAY,CAAc,wBAAwB;IACzD,SAAS,cAAc,CAAU,0BAA0B;IAG3D,OAAO,YAAY;CACpB;AACD,sDAAsD;AAEtD;;GAEG;AACH,oBAAY,UAAU;IACpB,MAAM,WAAW,CAAQ,+BAA+B;IACxD,KAAK,UAAU;CAChB;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,cAAc,mBAAmB,CAAE,sBAAsB;IACzD,KAAK,UAAU,CAAU,8BAA8B;IACvD,MAAM,WAAW;CAClB;AAED;;;GAGG;AACH,oBAAY,YAAY;IACtB,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,eAAe,oBAAoB;IACnC;;;;;;;;;;;;OAYG;IACH,kBAAkB,uBAAuB;CAC1C;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IACzB,MAAM,WAAW;IACjB,WAAW,gBAAgB;CAC5B;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,QAAQ,aAAa;CACtB;AAMD;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,CAmBrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAU3E,CAAC;AAEF;;;;;GAKG;AACH,oBAAY,aAAa;IACvB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;CAC5B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAStC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;iBAmBhC,CAAC;AAGH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,oBAAY,qBAAqB;IAC/B,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B;AAED;;;;;;GAMG;AACH,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,UAAU,eAAe;CAC1B;AAED;;;;;GAKG;AACH,oBAAY,sBAAsB;IAChC,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,IAAI,SAAS;CACd"}
+{"version":3,"file":"authentication.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AAExG;;;;;;;GAOG;AAGH,eAAO,MAAM,mBAAmB,EAAE,4BAA4B,EAG7D,CAAC;AAOF;;;GAGG;AACH,oBAAY,cAAc;IACxB,UAAU,eAAe,CAAQ,kDAAkD;IACnF,WAAW,gBAAgB,CAAM,0CAA0C;IAC3E,eAAe,oBAAoB,CAAE,+CAA+C;IACpF,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,UAAU,eAAe,CAAY,6BAA6B;IAClE,eAAe,oBAAoB,CAAE,yDAAyD;IAC9F,OAAO,YAAY,CAAiB,oDAAoD;IACxF,SAAS,cAAc,CAAa,yCAAyC;IAC7E,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAG,mBAA4B,CAAC;AAEnE,oBAAY,cAAc;IACtB,wDAAwD;IACxD,4BAA4B,iCAAiC;IAC7D,sDAAsD;IACtD,0BAA0B,+BAA+B;IACzD,mCAAmC;IACnC,mBAAmB,wBAAwB;IAC3C,sCAAsC;IACtC,sBAAsB,2BAA2B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,aAAa;IACrB,qEAAqE;IACrE,qBAAqB,0BAA0B;IAE/C,0EAA0E;IAC1E,iCAAiC,sCAAsC;CAC1E;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,EAAE,WAAW,CAAC,MAAM,CAKjE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,oBAAY,UAAU;IAEpB,QAAQ,aAAa;IAGrB,eAAe,oBAAoB,CAAE,qCAAqC;IAG1E,QAAQ,aAAa,CAAsB,wBAAwB;IACnE,kBAAkB,uBAAuB,CAAE,kCAAkC;IAG7E,UAAU,eAAe,CAAO,uBAAuB;IAGvD,IAAI,SAAS,CAAqB,+BAA+B;IACjE,OAAO,YAAY,CAAc,wBAAwB;IACzD,SAAS,cAAc,CAAU,0BAA0B;IAG3D,OAAO,YAAY;CACpB;AACD,sDAAsD;AAEtD;;GAEG;AACH,oBAAY,UAAU;IACpB,MAAM,WAAW,CAAQ,+BAA+B;IACxD,KAAK,UAAU;CAChB;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,cAAc,mBAAmB,CAAE,sBAAsB;IACzD,KAAK,UAAU,CAAU,8BAA8B;IACvD,MAAM,WAAW;CAClB;AAED;;;GAGG;AACH,oBAAY,YAAY;IACtB,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,eAAe,oBAAoB;IACnC;;;;;;;;;;;;OAYG;IACH,kBAAkB,uBAAuB;CAC1C;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IACzB,MAAM,WAAW;IACjB,WAAW,gBAAgB;CAC5B;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,QAAQ,aAAa;CACtB;AAMD;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,CAmBrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAU3E,CAAC;AAEF;;;;;GAKG;AACH,oBAAY,aAAa;IACvB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;CAC5B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAStC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;iBAmBhC,CAAC;AAGH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,oBAAY,qBAAqB;IAC/B,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B;AAED;;;;;;GAMG;AACH,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,UAAU,eAAe;CAC1B;AAED;;;;;GAKG;AACH,oBAAY,sBAAsB;IAChC,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,IAAI,SAAS;CACd"}

package/dist/esm/security/authentications/authentication.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAGzH;;;;;;;GAOG;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAmC;IACjE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAGF,kCAAkC;AAClC,oCAAoC;AACpC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,cAKX;AALD,WAAY,cAAc;IACxB,2CAAyB,CAAA;IACzB,6CAA2B,CAAA;IAC3B,qDAAmC,CAAA;IACnC,6BAAW,CAAA,CAAsB,4DAA4D;AAC/F,CAAC,EALW,cAAc,KAAd,cAAc,QAKzB;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,yDAAmC,CAAA;IACnC,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;IACvB,6CAAuB,CAAA,CAAa,wCAAwC;AAC9E,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAA4B,CAAC;AAEnE,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACtB,wDAAwD;IACxD,+EAA6D,CAAA;IAC7D,sDAAsD;IACtD,2EAAyD,CAAA;IACzD,mCAAmC;IACnC,6DAA2C,CAAA;IAC3C,sCAAsC;IACtC,mEAAiD,CAAA;AACrD,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qEAAqE;IACrE,gEAA+C,CAAA;IAE/C,0EAA0E;IAC1E,wFAAuE,CAAA;AAC3E,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAC;IAC7E,wGAAwG;IACxG,0GAA0G;IAC1G,mGAAmG;IACnG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACvH,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,CAAN,IAAY,UAqBX;AArBD,WAAY,UAAU;IACpB,uCAAuC;IACvC,mCAAqB,CAAA;IAErB,sEAAsE;IACtE,iDAAmC,CAAA;IAEnC,uDAAuD;IACvD,mCAAqB,CAAA;IACrB,uDAAyC,CAAA;IAEzC,mCAAmC;IACnC,uCAAyB,CAAA;IAEzB,2EAA2E;IAC3E,2BAAa,CAAA;IACb,iCAAmB,CAAA;IACnB,qCAAuB,CAAA;IAEvB,4CAA4C;IAC5C,iCAAmB,CAAA,CAAc,0BAA0B;AAC7D,CAAC,EArBW,UAAU,KAAV,UAAU,QAqBrB;AACD,sDAAsD;AAEtD;;GAEG;AACH,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,6BAAe,CAAA,CAAU,uCAAuC;AAClE,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,oDAAiC,CAAA;IACjC,kCAAe,CAAA;IACf,oCAAiB,CAAA,CAAQ,qCAAqC;AAChE,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,YA0BX;AA1BD,WAAY,YAAY;IACtB,iDAAiC,CAAA;IACjC,yCAAyB,CAAA;IACzB,qCAAqB,CAAA;IACrB,yDAAyC,CAAA;IACzC,mDAAmC,CAAA;IACnC;;;;OAIG;IACH,mDAAmC,CAAA;IACnC;;;;;;;;;;;;OAYG;IACH,yDAAyC,CAAA;AAC3C,CAAC,EA1BW,YAAY,KAAZ,YAAY,QA0BvB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mDAA6B,CAAA;IAC7B,+CAAyB,CAAA;IACzB,uCAAiB,CAAA;IACjB,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,yCAAmB,CAAA;IACnB,qCAAe,CAAA;IACf,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,kCAAkC;AAClC,uCAAuC;AACvC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,0CAA0C;IAC1C,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAEhD,6CAA6C;IAC7C,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU;IAElD,0EAA0E;IAC1E,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,UAAU;IACvD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAChD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,cAAc,CAAC,UAAU;IAE1D,gFAAgF;IAChF,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,WAAW;IAC7C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;IACpD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW;IAElD,4CAA4C;IAC5C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;CACrD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2C;IAC9E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACpD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACtD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,eAAe;IAChE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,OAAO;IACjD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,OAAO;IAC3D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAC/C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAClD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,SAAS;IACpD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;CACnD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,8CAA6B,CAAA;IAC7B,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAErB,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAC7E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IAC/D,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAElD,2BAA2B;IAC3B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,uBAAuB;IACvB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAKH,kCAAkC;AAClC,wBAAwB;AACxB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,gEAAuC,CAAA;IACvC,8DAAqC,CAAA;IACrC,4DAAmC,CAAA;IACnC,0DAAiC,CAAA;IACjC,sDAA6B,CAAA;AAC/B,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,8CAAyB,CAAA;AAC3B,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,2CAAiB,CAAA;IACjB,uCAAa,CAAA;IACb,uCAAa,CAAA;IACb,uCAAa,CAAA;AACf,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC","sourcesContent":["/**\n * Authentication Shared Schemas\n *\n * Core authentication schemas shared between frontend and backend\n */\n\nimport { z } from 'zod';\n\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport type { PolymorphicVariantDefinition } from '../../resources/utils/resource-polymorphism.schemas';\n\n/**\n * Auth Scope Variants (Shared)\n *\n * The 2 auth scope variants — shared across all auth polymorphic resources\n * (SsoConfig, SsoConnection, SiemExportConfig, SiemDeliveryDlq,\n *  ScimTokens, ScimProvisioningConfig).\n *\n */\n\n\nexport const AUTH_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n\n// ===============================\n// AUTHENTICATION METHOD DEFINITIONS\n// ===============================\n\n/**\n * Authentication Factor Classification\n * Defines when an authentication method can be used in the flow\n */\nexport enum AuthFactorType {\n  FIRST_ONLY = 'FIRST_ONLY',       // Can only be used as first factor (primary auth)\n  SECOND_ONLY = 'SECOND_ONLY',     // Can only be used as second factor (MFA)\n  FIRST_OR_SECOND = 'FIRST_OR_SECOND', // Can be used as either first or second factor\n  ANY = 'ANY'                      // Can be used in any context (first, second, or standalone)\n}\n\n/**\n * Authentication Method Categories\n * Separates different types of authentication methods by scope and configuration\n */\nexport enum AuthMethodCategory {\n  CREDENTIAL = 'CREDENTIAL',           // Password-based credentials\n  EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Extensible third-party SaaS OAuth2 (application-level)\n  ORG_SSO = 'ORG_SSO',                // Organization-restricted SSO (SAML/OpenID Connect)\n  MFA_TOKEN = 'MFA_TOKEN',            // Time-based or generated tokens for MFA\n  BIOMETRIC = 'BIOMETRIC'             // Modern biometric/passwordless methods\n}\n\n/**\n * The signing-key purposes an application holds, and the platform-service keys it verifies against.\n *\n * MOVED HERE FROM `saas-backend-lib` on 2026-09-02. These name identities that CROSS A PROCESS\n * BOUNDARY — the platform issues a token, the application verifies it; the application signs a\n * webhook, an integrator verifies it — and a name that crosses a boundary belongs in the shared\n * package rather than in the runtime on one side of it. The signing and verification MACHINERY did\n * not move; `jwt.backend.schemas.ts` re-exports both so no consumer changed.\n *\n * It also unblocked attesting `WILDO.IDENTITY.SIGNING_KEY_LIFECYCLE`: the retirement guarantee is\n * per key, and the assurance layer could not name the keys it applies to from a package it must not\n * depend on.\n *\n * Storage locations (unchanged, and stated here because the names are meaningless without them):\n * - private: `wildo_application_secrets.security.jwt.privateKey[key]`\n * - public:  `wildo_application_config.jwt.publicKey[key]`, env `PLATFORM_<SERVICE_NAME>_PUBLIC_KEY`\n */\n/**\n * `iss` claim on every JWT the application signs, whichever key kind signs it. Receivers of\n * webhooks, workers and platform services pin this value; it is application-wide, not per key.\n */\nexport const APPLICATION_JWT_ISSUER = 'wildo-application' as const;\n\nexport enum JwtPrivateKeys {\n    /** Application signing requests to platform services */\n    APPLICATION_PLATFORM_REQUEST = 'APPLICATION_PLATFORM_REQUEST',\n    /** Application signing requests to worker runtimes */\n    APPLICATION_WORKER_REQUEST = 'APPLICATION_WORKER_REQUEST',\n    /** Application signing webhooks */\n    APPLICATION_WEBHOOK = 'APPLICATION_WEBHOOK',\n    /** Application signing auth tokens */\n    APPLICATION_AUTH_TOKEN = 'APPLICATION_AUTH_TOKEN',\n}\n\n/**\n * Platform Service JWT Public Keys\n * \n * Used to verify JWTs from platform services.\n * Public keys are stored in apps-manager env config.\n * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY\n */\nexport enum JwtPublicKeys {\n    /** Platform service: apps-manager - central platform orchestrator */\n    PLATFORM_APPS_MANAGER = 'PLATFORM_APPS_MANAGER',\n\n    /** Platform service: crontabs-batches-manager - handles scheduled jobs */\n    PLATFORM_CRONTABS_BATCHES_MANAGER = 'PLATFORM_CRONTABS_BATCHES_MANAGER',\n}\n\n/**\n * The OIDC / RFC 7519 protocol + security claim names the ID-token builder OWNS. `extraClaims` (the\n * scope-gated IDENTITY claims from the userinfo/ID-token resolver) must carry ONLY identity claims — these\n * reserved names are stripped BEFORE `extraClaims` is spread, so a same-named entry can never ride into the\n * ID token uncontrolled: a smuggled `nbf` (which would later make the token fail verification), a forged\n * `nonce` / `acr` / `amr` / `at_hash`, or a spoofed `iss` / `aud` / `sub` (the last are already overridden by\n * the server-set claims below — these are the ones the builder does NOT otherwise re-set). ONE named source\n * (closed vocabulary) so the strip list can never drift from the builder's own claim set.\n * semantic-literal-boundary: OIDC Core / RFC 7519 registered claim names.\n * assurance-control: WILDO.IDENTITY.TOKEN_INTEGRITY — an ID token's protocol/security claims are server-authored only.\n */\nexport const OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES: ReadonlySet<string> = new Set([\n  // `sid` (OIDC Session Management / Front-Channel & Back-Channel Logout) is SERVER-AUTHORED here — it is\n  // the End-User's OP session id the RP-Initiated Logout endpoint keys on (revocation-C). Reserving it bars\n  // a client from smuggling its own `sid` via `extraClaims`, exactly like `nonce`/`acr`/`azp` below.\n  'iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti', 'azp', 'nonce', 'auth_time', 'at_hash', 'c_hash', 'acr', 'amr', 'sid',\n]);\n\n/**\n * @wildo_source:part:start saas.models.auth.methods facet:layer:shared facet:audience:app-developer\n *\n * Every way a person can prove who they are. An application chooses per USER TYPE which of these are\n * enabled, under `authMethodsEnabled` in the backend-authored config.\n *\n * Imported from `@wildo-ai/saas-models`.\n *\n * ## Enabling a method is necessary, and for four of them it is not sufficient\n *\n * | method | may be | also required before it works |\n * |---|---|---|\n * | `PASSWORD` | first | a `passwordPolicy` on the user type |\n * | `MAGIC_LINK` | first | — |\n * | `PASSKEY` | first or second | `auth.passkeyConfig` (`rpName`, `rpId`) — the app does not boot without it |\n * | `SMS_OTP` | first or second | a verified phone number on the account |\n * | `TOTP` | second | enrolment (authenticator app or backup codes) |\n * | `EMAIL_OTP` | second | — |\n * | `EXTERNAL_OAUTH2` | any | a `socialOAuth2Providers` entry (client id + secret reference) AND a declared provider scope |\n * | `ORG_SAML` | first or second | a connection resource on the organization, AND a Java runtime with the schema-validation helper compiled on every host that serves SAML |\n * | `ORG_OPENID_CONNECT` | first or second | a connection resource on the organization |\n *\n * ## ⚠️ The organization SSO methods are gated by the USER TYPE first\n *\n * A perfectly configured SSO connection is never offered unless the user type enables `ORG_SAML` /\n * `ORG_OPENID_CONNECT`: the connection lookup only runs when the resolved policy already has the\n * method, so the organization is never consulted. The symptom is a login screen that simply does not\n * show the option, with nothing wrong on the connection and nothing in the logs. Enable the method on\n * the user type BEFORE debugging the connection.\n *\n * ## Other refusals worth knowing before you pick one\n *\n * - **`EXTERNAL_OAUTH2` will not link or create an account from a provider that does not report the\n *   email address as VERIFIED.** That is a refusal, not a warning — a provider whose claim mapping\n *   does not surface a verified flag cannot be used for sign-up until the mapping is corrected.\n * - **A missing SAML validation helper surfaces as an invalid signature**, not as a missing\n *   dependency, which sends an operator to the certificate instead of to the host.\n * - **A person in an actively directory-managed organization loses every LOCAL first factor**, by\n *   design, so a credential minted before the directory took over cannot complete a session.\n *   `EMAIL_OTP` is deliberately exempt because it is a second factor.\n *\n * ## ⚠️ Signing IN and signing UP are two different lists\n *\n * `authMethodsEnabled` decides how an EXISTING account authenticates. It does not create accounts.\n * Public registration is gated separately by `registration.allowedMethods` on the same user type,\n * which **defaults to `[PASSWORD]`** — so enabling `MAGIC_LINK` for sign-in and expecting people to\n * sign up with it gets a password-only signup and no error.\n *\n * Only four methods have a public-signup implementation — `PASSWORD`, `EXTERNAL_OAUTH2`,\n * `MAGIC_LINK`, `PASSKEY`. Listing any other (an SSO method, an MFA factor) is refused when the\n * config is built, deliberately: a method advertised to a registrant that the runtime cannot execute\n * fails them AFTER they have committed to it. Open registration also requires the list to be\n * non-empty.\n *\n * ## Which methods count as a second factor is a separate question\n *\n * `mfaPolicy` on the user type decides whether a second factor is required and narrows which of these\n * count. The guard that stops somebody removing their last second factor counts passkeys and a\n * verified phone number — it does NOT count `EMAIL_OTP`, so the arithmetic differs from what a person\n * might expect.\n *\n * Extensible at application level for `EXTERNAL_OAUTH2` providers; the method vocabulary itself is\n * closed.\n */\nexport enum AuthMethod {\n  // Credential-based (First factor only)\n  PASSWORD = 'PASSWORD',\n\n  // Third-party SaaS OAuth2 (Application-level, extensible, any factor)\n  EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Generic extensible OAuth2 provider\n\n  // Organization-restricted SSO (First or second factor)\n  ORG_SAML = 'ORG_SAML',                     // Organization SAML SSO\n  ORG_OPENID_CONNECT = 'ORG_OPENID_CONNECT', // Organization OpenID Connect SSO\n\n  // Passwordless (First factor only)\n  MAGIC_LINK = 'MAGIC_LINK',      // Magic Link via email\n\n  // MFA tokens (Second factor only, except SMS_OTP which is FIRST_OR_SECOND)\n  TOTP = 'TOTP',                    // Time-based One-Time Password\n  SMS_OTP = 'SMS_OTP',             // SMS One-Time Password\n  EMAIL_OTP = 'EMAIL_OTP',         // Email One-Time Password\n\n  // Biometric/Modern (First or second factor)\n  PASSKEY = 'PASSKEY'              // WebAuthn/FIDO2 Passkeys\n}\n/** @wildo_source:part:end saas.models.auth.methods */\n\n/**\n * Authentication Factor Levels\n */\nexport enum AuthFactor {\n  SINGLE = 'SINGLE',       // Single factor authentication\n  MULTI = 'MULTI'          // Multi-factor authentication required\n}\n\n/**\n * Authentication Factor Level (First or Second Factor)\n */\nexport enum AuthFactorLevel {\n  IDENTIFICATION = 'IDENTIFICATION', // Identification only\n  FIRST = 'FIRST',         // First factor authentication\n  SECOND = 'SECOND'        // Second factor authentication (MFA)\n}\n\n/**\n * W4: Next step hint for frontend routing after auth state transitions.\n * Drives UI flow (MFA enrollment, onboarding, email verification, etc.).\n */\nexport enum AuthNextStep {\n  MFA_ENROLLMENT = 'mfa_enrollment',\n  ONBOARDING = 'onboarding',\n  COMPLETE = 'complete',\n  EMAIL_VERIFICATION = 'email_verification',\n  PASSWORD_CHANGE = 'password_change',\n  /**\n   * A password-less public registration completed and a magic link is on its way (#463). Clicking it\n   * proves the address and establishes the first session — there is nothing else for the registrant\n   * to do, and nothing to authenticate with until they do it.\n   */\n  MAGIC_LINK_SENT = 'magic_link_sent',\n  /**\n   * As {@link MAGIC_LINK_SENT}, and the click leads to enrolling a passkey.\n   *\n   * A separate member rather than a flag on the one above, because the client renders different copy\n   * from the first screen onward — \"check your email to finish\" versus \"check your email, then set up\n   * your passkey\" — and a registrant told the wrong one abandons at the step they were not warned\n   * about.\n   *\n   * The magic link is not incidental here: a passkey proves possession of an authenticator and says\n   * nothing about an address, so a public passkey signup must prove the address some other way, and\n   * the link is that proof. It is also, permanently, the recovery path — see the note on\n   * `registerUser`.\n   */\n  PASSKEY_ENROLLMENT = 'passkey_enrollment',\n}\n\n/**\n * W4.2: Session purpose — drives UI rendering and valid state transitions.\n */\nexport enum AuthSessionPurpose {\n  LOGIN = 'login',\n  REGISTRATION = 'registration',\n  INVITATION = 'invitation',\n  REAUTH = 'reauth',\n  DEVICE_AUTH = 'device_auth',\n}\n\n/**\n * W4.6: MFA enrollment lifecycle state on UserCredentials.\n * Computed at user creation and updated on enrollment completion.\n */\nexport enum MfaEnrollmentState {\n  NOT_REQUIRED = 'not_required',\n  PENDING = 'pending',\n  GRACE = 'grace',\n  ENROLLED = 'enrolled',\n}\n\n// ===============================\n// AUTHENTICATION METHOD CLASSIFICATION\n// ===============================\n\n/**\n * Authentication Method Factor Classification Map\n */\nexport const AUTH_METHOD_FACTOR_MAP: Record<AuthMethod, AuthFactorType> = {\n  // First factor only - Primary credentials\n  [AuthMethod.PASSWORD]: AuthFactorType.FIRST_ONLY,\n\n  // First factor only - Passwordless via email\n  [AuthMethod.MAGIC_LINK]: AuthFactorType.FIRST_ONLY,\n\n  // First factor only - SSO redirect flows are not MFA ceremonies (B-SEC-1)\n  [AuthMethod.EXTERNAL_OAUTH2]: AuthFactorType.FIRST_ONLY,\n  [AuthMethod.ORG_SAML]: AuthFactorType.FIRST_ONLY,\n  [AuthMethod.ORG_OPENID_CONNECT]: AuthFactorType.FIRST_ONLY,\n\n  // Second factor only - MFA tokens (except SMS_OTP which can be first or second)\n  [AuthMethod.TOTP]: AuthFactorType.SECOND_ONLY,\n  [AuthMethod.SMS_OTP]: AuthFactorType.FIRST_OR_SECOND,\n  [AuthMethod.EMAIL_OTP]: AuthFactorType.SECOND_ONLY,\n\n  // First or second factor - Modern biometric\n  [AuthMethod.PASSKEY]: AuthFactorType.FIRST_OR_SECOND\n};\n\n/**\n * Authentication Method Category Map\n */\nexport const AUTH_METHOD_CATEGORY_MAP: Record<AuthMethod, AuthMethodCategory> = {\n  [AuthMethod.PASSWORD]: AuthMethodCategory.CREDENTIAL,\n  [AuthMethod.MAGIC_LINK]: AuthMethodCategory.CREDENTIAL,\n  [AuthMethod.EXTERNAL_OAUTH2]: AuthMethodCategory.EXTERNAL_OAUTH2,\n  [AuthMethod.ORG_SAML]: AuthMethodCategory.ORG_SSO,\n  [AuthMethod.ORG_OPENID_CONNECT]: AuthMethodCategory.ORG_SSO,\n  [AuthMethod.TOTP]: AuthMethodCategory.MFA_TOKEN,\n  [AuthMethod.SMS_OTP]: AuthMethodCategory.MFA_TOKEN,\n  [AuthMethod.EMAIL_OTP]: AuthMethodCategory.MFA_TOKEN,\n  [AuthMethod.PASSKEY]: AuthMethodCategory.BIOMETRIC\n};\n\n/**\n * Scope type for auth policies — organization-level vs application-level.\n *\n * Declared before the browser-safe available-method schema because that schema\n * evaluates this enum at module initialization time.\n */\nexport enum AuthScopeType {\n  ORGANIZATION = 'organization',\n  APPLICATION = 'application',\n}\n\n/**\n * Public, browser-safe configuration attached to an available auth method.\n *\n * The fields span passkey and enterprise-SSO methods, but every field is named\n * and typed: this cross-layer contract must never collapse back to\n * `Record<string, any>`, which previously forced frontend assertions for the\n * tenant scope and connection identity.\n */\nexport const AvailableMethodConfigSchema = z.object({\n  rpName: z.string().optional(),\n  rpId: z.string().optional(),\n  displayName: z.string().optional(),\n  providerRef: z.string().optional(),\n  connectionId: z.string().optional(),\n  scopeType: z.enum(AuthScopeType).optional(),\n  scopeId: z.string().optional(),\n  loginUrl: z.string().optional(),\n});\n\nexport type AvailableMethodConfig = z.infer<typeof AvailableMethodConfigSchema>;\n\nexport const AvailableMethodSchema = z.object({\n  method: z.enum(AuthMethod),\n  factorType: z.enum(AuthFactorType),\n  category: z.enum(AuthMethodCategory),\n  canBeFirstFactor: z.boolean(),\n  canBeSecondFactor: z.boolean(),\n  required: z.boolean(),\n\n  // Provider-specific information\n  oauth2ProviderRefs: z.array(z.string()).optional(), // For third-party OAuth2\n  ssoIds: z.array(z.string()).optional(), // For organization SSO\n  organizationRestricted: z.boolean().default(false),\n\n  // Integration capabilities\n  supportsIntegrations: z.boolean().default(false),\n  availableIntegrations: z.array(z.string()).default([]).optional(),\n\n  // Public configuration\n  config: AvailableMethodConfigSchema.optional()\n});\n\n\nexport type AvailableMethod = z.infer<typeof AvailableMethodSchema>;\n\n// ===============================\n// CROSS-LAYER CONSTANTS\n// ===============================\n\n/**\n * Error codes used in redirect query params (backend → frontend).\n * Backend appends `?error=<code>` to redirect URLs; frontend reads and displays.\n */\nexport enum AuthRedirectErrorCode {\n  SAML_LOGIN_FAILED = 'saml_login_failed',\n  SAML_AUTH_FAILED = 'saml_auth_failed',\n  SAML_SLO_FAILED = 'saml_slo_failed',\n  MISSING_PARAMS = 'missing_params',\n  OAUTH_FAILED = 'oauth_failed',\n}\n\n/**\n * Ownership class of an external authentication connection.\n *\n * This is intentionally independent from {@link AuthScopeType}: a social\n * connection has no enterprise tenant scope, while an enterprise connection\n * must carry one.\n */\nexport enum SsoConnectionType {\n  SOCIAL = 'social',\n  ENTERPRISE = 'enterprise',\n}\n\n/**\n * Mechanism that established an external identity.\n *\n * This is wider than the SSO protocol vocabulary because SCIM establishes and\n * maintains identity links without being an interactive SSO protocol.\n */\nexport enum ExternalIdentitySource {\n  OAUTH2 = 'oauth2',\n  OIDC = 'oidc',\n  SAML = 'saml',\n  SCIM = 'scim',\n}\n"]}
+{"version":3,"file":"authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAGzH;;;;;;;GAOG;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAmC;IACjE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAGF,kCAAkC;AAClC,oCAAoC;AACpC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,cAKX;AALD,WAAY,cAAc;IACxB,2CAAyB,CAAA;IACzB,6CAA2B,CAAA;IAC3B,qDAAmC,CAAA;IACnC,6BAAW,CAAA,CAAsB,4DAA4D;AAC/F,CAAC,EALW,cAAc,KAAd,cAAc,QAKzB;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,yDAAmC,CAAA;IACnC,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;IACvB,6CAAuB,CAAA,CAAa,wCAAwC;AAC9E,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAA4B,CAAC;AAEnE,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACtB,wDAAwD;IACxD,+EAA6D,CAAA;IAC7D,sDAAsD;IACtD,2EAAyD,CAAA;IACzD,mCAAmC;IACnC,6DAA2C,CAAA;IAC3C,sCAAsC;IACtC,mEAAiD,CAAA;AACrD,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qEAAqE;IACrE,gEAA+C,CAAA;IAE/C,0EAA0E;IAC1E,wFAAuE,CAAA;AAC3E,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAC;IAC7E,wGAAwG;IACxG,0GAA0G;IAC1G,mGAAmG;IACnG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACvH,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,CAAN,IAAY,UAqBX;AArBD,WAAY,UAAU;IACpB,uCAAuC;IACvC,mCAAqB,CAAA;IAErB,sEAAsE;IACtE,iDAAmC,CAAA;IAEnC,uDAAuD;IACvD,mCAAqB,CAAA;IACrB,uDAAyC,CAAA;IAEzC,mCAAmC;IACnC,uCAAyB,CAAA;IAEzB,2EAA2E;IAC3E,2BAAa,CAAA;IACb,iCAAmB,CAAA;IACnB,qCAAuB,CAAA;IAEvB,4CAA4C;IAC5C,iCAAmB,CAAA,CAAc,0BAA0B;AAC7D,CAAC,EArBW,UAAU,KAAV,UAAU,QAqBrB;AACD,sDAAsD;AAEtD;;GAEG;AACH,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,6BAAe,CAAA,CAAU,uCAAuC;AAClE,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,oDAAiC,CAAA;IACjC,kCAAe,CAAA;IACf,oCAAiB,CAAA,CAAQ,qCAAqC;AAChE,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,YA0BX;AA1BD,WAAY,YAAY;IACtB,iDAAiC,CAAA;IACjC,yCAAyB,CAAA;IACzB,qCAAqB,CAAA;IACrB,yDAAyC,CAAA;IACzC,mDAAmC,CAAA;IACnC;;;;OAIG;IACH,mDAAmC,CAAA;IACnC;;;;;;;;;;;;OAYG;IACH,yDAAyC,CAAA;AAC3C,CAAC,EA1BW,YAAY,KAAZ,YAAY,QA0BvB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mDAA6B,CAAA;IAC7B,+CAAyB,CAAA;IACzB,uCAAiB,CAAA;IACjB,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,yCAAmB,CAAA;IACnB,qCAAe,CAAA;IACf,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,kCAAkC;AAClC,uCAAuC;AACvC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,0CAA0C;IAC1C,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAEhD,6CAA6C;IAC7C,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU;IAElD,0EAA0E;IAC1E,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,UAAU;IACvD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAChD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,cAAc,CAAC,UAAU;IAE1D,gFAAgF;IAChF,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,WAAW;IAC7C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;IACpD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW;IAElD,4CAA4C;IAC5C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;CACrD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2C;IAC9E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACpD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACtD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,eAAe;IAChE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,OAAO;IACjD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,OAAO;IAC3D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAC/C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAClD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,SAAS;IACpD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;CACnD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,8CAA6B,CAAA;IAC7B,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAErB,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAC7E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IAC/D,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAElD,2BAA2B;IAC3B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,uBAAuB;IACvB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAKH,kCAAkC;AAClC,wBAAwB;AACxB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,gEAAuC,CAAA;IACvC,8DAAqC,CAAA;IACrC,4DAAmC,CAAA;IACnC,0DAAiC,CAAA;IACjC,sDAA6B,CAAA;AAC/B,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,8CAAyB,CAAA;AAC3B,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,2CAAiB,CAAA;IACjB,uCAAa,CAAA;IACb,uCAAa,CAAA;IACb,uCAAa,CAAA;AACf,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC","sourcesContent":["/**\n * Authentication Shared Schemas\n *\n * Core authentication schemas shared between frontend and backend\n */\n\nimport { z } from 'zod';\n\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport type { PolymorphicVariantDefinition } from '../../resources/utils/resource-polymorphism.schemas';\n\n/**\n * Auth Scope Variants (Shared)\n *\n * The 2 auth scope variants — shared across all auth polymorphic resources\n * (SsoConfig, SsoConnection, SiemExportConfig, SiemDeliveryDlq,\n *  ScimTokens, ScimProvisioningConfig).\n *\n */\n\n\nexport const AUTH_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n  { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n  { parentResourceType: CoreResourceType.APPLICATION,   parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION],   isPrimaryScope: true },\n];\n\n\n// ===============================\n// AUTHENTICATION METHOD DEFINITIONS\n// ===============================\n\n/**\n * Authentication Factor Classification\n * Defines when an authentication method can be used in the flow\n */\nexport enum AuthFactorType {\n  FIRST_ONLY = 'FIRST_ONLY',       // Can only be used as first factor (primary auth)\n  SECOND_ONLY = 'SECOND_ONLY',     // Can only be used as second factor (MFA)\n  FIRST_OR_SECOND = 'FIRST_OR_SECOND', // Can be used as either first or second factor\n  ANY = 'ANY'                      // Can be used in any context (first, second, or standalone)\n}\n\n/**\n * Authentication Method Categories\n * Separates different types of authentication methods by scope and configuration\n */\nexport enum AuthMethodCategory {\n  CREDENTIAL = 'CREDENTIAL',           // Password-based credentials\n  EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Extensible third-party SaaS OAuth2 (application-level)\n  ORG_SSO = 'ORG_SSO',                // Organization-restricted SSO (SAML/OpenID Connect)\n  MFA_TOKEN = 'MFA_TOKEN',            // Time-based or generated tokens for MFA\n  BIOMETRIC = 'BIOMETRIC'             // Modern biometric/passwordless methods\n}\n\n/**\n * The signing-key purposes an application holds, and the platform-service keys it verifies against.\n *\n * MOVED HERE FROM `saas-backend-lib` on 2026-09-02. These name identities that CROSS A PROCESS\n * BOUNDARY — the platform issues a token, the application verifies it; the application signs a\n * webhook, an integrator verifies it — and a name that crosses a boundary belongs in the shared\n * package rather than in the runtime on one side of it. The signing and verification MACHINERY did\n * not move; `jwt.backend.schemas.ts` re-exports both so no consumer changed.\n *\n * It also unblocked attesting `WILDO.IDENTITY.SIGNING_KEY_LIFECYCLE`: the retirement guarantee is\n * per key, and the assurance layer could not name the keys it applies to from a package it must not\n * depend on.\n *\n * Storage locations (unchanged, and stated here because the names are meaningless without them):\n * - private: `wildo_application_secrets.security.jwt.privateKey[key]`\n * - public:  `wildo_application_config.jwt.publicKey[key]`, env `PLATFORM_<SERVICE_NAME>_PUBLIC_KEY`\n */\n/**\n * `iss` claim on every JWT the application signs, whichever key kind signs it. Receivers of\n * webhooks, workers and platform services pin this value; it is application-wide, not per key.\n */\nexport const APPLICATION_JWT_ISSUER = 'wildo-application' as const;\n\nexport enum JwtPrivateKeys {\n    /** Application signing requests to platform services */\n    APPLICATION_PLATFORM_REQUEST = 'APPLICATION_PLATFORM_REQUEST',\n    /** Application signing requests to worker runtimes */\n    APPLICATION_WORKER_REQUEST = 'APPLICATION_WORKER_REQUEST',\n    /** Application signing webhooks */\n    APPLICATION_WEBHOOK = 'APPLICATION_WEBHOOK',\n    /** Application signing auth tokens */\n    APPLICATION_AUTH_TOKEN = 'APPLICATION_AUTH_TOKEN',\n}\n\n/**\n * Platform Service JWT Public Keys\n * \n * Used to verify JWTs from platform services.\n * Public keys are stored in apps-manager env config.\n * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY\n */\nexport enum JwtPublicKeys {\n    /** Platform service: apps-manager - central platform orchestrator */\n    PLATFORM_APPS_MANAGER = 'PLATFORM_APPS_MANAGER',\n\n    /** Platform service: crontabs-batches-manager - handles scheduled jobs */\n    PLATFORM_CRONTABS_BATCHES_MANAGER = 'PLATFORM_CRONTABS_BATCHES_MANAGER',\n}\n\n/**\n * The OIDC / RFC 7519 protocol + security claim names the ID-token builder OWNS. `extraClaims` (the\n * scope-gated IDENTITY claims from the userinfo/ID-token resolver) must carry ONLY identity claims — these\n * reserved names are stripped BEFORE `extraClaims` is spread, so a same-named entry can never ride into the\n * ID token uncontrolled: a smuggled `nbf` (which would later make the token fail verification), a forged\n * `nonce` / `acr` / `amr` / `at_hash`, or a spoofed `iss` / `aud` / `sub` (the last are already overridden by\n * the server-set claims below — these are the ones the builder does NOT otherwise re-set). ONE named source\n * (closed vocabulary) so the strip list can never drift from the builder's own claim set.\n * semantic-literal-boundary: OIDC Core / RFC 7519 registered claim names.\n * assurance-control: WILDO.IDENTITY.TOKEN_INTEGRITY — an ID token's protocol/security claims are server-authored only.\n */\nexport const OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES: ReadonlySet<string> = new Set([\n  // `sid` (OIDC Session Management / Front-Channel & Back-Channel Logout) is SERVER-AUTHORED here — it is\n  // the End-User's OP session id the RP-Initiated Logout endpoint keys on (revocation-C). Reserving it bars\n  // a client from smuggling its own `sid` via `extraClaims`, exactly like `nonce`/`acr`/`azp` below.\n  'iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti', 'azp', 'nonce', 'auth_time', 'at_hash', 'c_hash', 'acr', 'amr', 'sid',\n]);\n\n/**\n * @wildo_source:part:start saas.models.auth.methods facet:layer:shared facet:audience:app-developer\n *\n * Every way a person can prove who they are. An application chooses per USER TYPE which of these are\n * enabled, under `authMethodsEnabled` in the backend-authored config.\n *\n * Imported from `@wildo-ai/saas-models`.\n *\n * ## Enabling a method is necessary, and for four of them it is not sufficient\n *\n * | method | may be | also required before it works |\n * |---|---|---|\n * | `PASSWORD` | first | a `passwordPolicy` on the user type |\n * | `MAGIC_LINK` | first | — |\n * | `PASSKEY` | first or second | `auth.passkeyConfig` (`rpName`, `rpId`) — the app does not boot without it |\n * | `SMS_OTP` | first or second | a verified phone number on the account |\n * | `TOTP` | second | enrolment (authenticator app or backup codes) |\n * | `EMAIL_OTP` | second | — |\n * | `EXTERNAL_OAUTH2` | any | a `socialOAuth2Providers` entry (client id + secret reference) AND a declared provider scope |\n * | `ORG_SAML` | first or second | a connection resource on the organization, AND a Java runtime with the schema-validation helper compiled on every host that serves SAML |\n * | `ORG_OPENID_CONNECT` | first or second | a connection resource on the organization |\n *\n * ## ⚠️ The organization SSO methods are gated by the USER TYPE first\n *\n * A perfectly configured SSO connection is never offered unless the user type enables `ORG_SAML` /\n * `ORG_OPENID_CONNECT`: the connection lookup only runs when the resolved policy already has the\n * method, so the organization is never consulted. The symptom is a login screen that simply does not\n * show the option, with nothing wrong on the connection and nothing in the logs. Enable the method on\n * the user type BEFORE debugging the connection.\n *\n * ## Other refusals worth knowing before you pick one\n *\n * - **`EXTERNAL_OAUTH2` will not link or create an account from a provider that does not report the\n *   email address as VERIFIED.** That is a refusal, not a warning — a provider whose claim mapping\n *   does not surface a verified flag cannot be used for sign-up until the mapping is corrected.\n * - **A missing SAML validation helper surfaces as an invalid signature**, not as a missing\n *   dependency, which sends an operator to the certificate instead of to the host.\n * - **A person in an actively directory-managed organization loses every LOCAL first factor**, by\n *   design, so a credential minted before the directory took over cannot complete a session.\n *   `EMAIL_OTP` is deliberately exempt because it is a second factor.\n *\n * ## ⚠️ Signing IN and signing UP are two different lists\n *\n * `authMethodsEnabled` decides how an EXISTING account authenticates. It does not create accounts.\n * Public registration is gated separately by `registration.allowedMethods` on the same user type,\n * which **defaults to `[PASSWORD]`** — so enabling `MAGIC_LINK` for sign-in and expecting people to\n * sign up with it gets a password-only signup and no error.\n *\n * Only four methods have a public-signup implementation — `PASSWORD`, `EXTERNAL_OAUTH2`,\n * `MAGIC_LINK`, `PASSKEY`. Listing any other (an SSO method, an MFA factor) is refused when the\n * config is built, deliberately: a method advertised to a registrant that the runtime cannot execute\n * fails them AFTER they have committed to it. Open registration also requires the list to be\n * non-empty.\n *\n * ## Which methods count as a second factor is a separate question\n *\n * `mfaPolicy` on the user type decides whether a second factor is required and narrows which of these\n * count. The guard that stops somebody removing their last second factor counts passkeys and a\n * verified phone number — it does NOT count `EMAIL_OTP`, so the arithmetic differs from what a person\n * might expect.\n *\n * Extensible at application level for `EXTERNAL_OAUTH2` providers; the method vocabulary itself is\n * closed.\n */\nexport enum AuthMethod {\n  // Credential-based (First factor only)\n  PASSWORD = 'PASSWORD',\n\n  // Third-party SaaS OAuth2 (Application-level, extensible, any factor)\n  EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Generic extensible OAuth2 provider\n\n  // Organization-restricted SSO (First or second factor)\n  ORG_SAML = 'ORG_SAML',                     // Organization SAML SSO\n  ORG_OPENID_CONNECT = 'ORG_OPENID_CONNECT', // Organization OpenID Connect SSO\n\n  // Passwordless (First factor only)\n  MAGIC_LINK = 'MAGIC_LINK',      // Magic Link via email\n\n  // MFA tokens (Second factor only, except SMS_OTP which is FIRST_OR_SECOND)\n  TOTP = 'TOTP',                    // Time-based One-Time Password\n  SMS_OTP = 'SMS_OTP',             // SMS One-Time Password\n  EMAIL_OTP = 'EMAIL_OTP',         // Email One-Time Password\n\n  // Biometric/Modern (First or second factor)\n  PASSKEY = 'PASSKEY'              // WebAuthn/FIDO2 Passkeys\n}\n/** @wildo_source:part:end saas.models.auth.methods */\n\n/**\n * Authentication Factor Levels\n */\nexport enum AuthFactor {\n  SINGLE = 'SINGLE',       // Single factor authentication\n  MULTI = 'MULTI'          // Multi-factor authentication required\n}\n\n/**\n * Authentication Factor Level (First or Second Factor)\n */\nexport enum AuthFactorLevel {\n  IDENTIFICATION = 'IDENTIFICATION', // Identification only\n  FIRST = 'FIRST',         // First factor authentication\n  SECOND = 'SECOND'        // Second factor authentication (MFA)\n}\n\n/**\n * W4: Next step hint for frontend routing after auth state transitions.\n * Drives UI flow (MFA enrollment, onboarding, email verification, etc.).\n */\nexport enum AuthNextStep {\n  MFA_ENROLLMENT = 'mfa_enrollment',\n  ONBOARDING = 'onboarding',\n  COMPLETE = 'complete',\n  EMAIL_VERIFICATION = 'email_verification',\n  PASSWORD_CHANGE = 'password_change',\n  /**\n   * A password-less public registration completed and a magic link is on its way (#463). Clicking it\n   * proves the address and establishes the first session — there is nothing else for the registrant\n   * to do, and nothing to authenticate with until they do it.\n   */\n  MAGIC_LINK_SENT = 'magic_link_sent',\n  /**\n   * As {@link MAGIC_LINK_SENT}, and the click leads to enrolling a passkey.\n   *\n   * A separate member rather than a flag on the one above, because the client renders different copy\n   * from the first screen onward — \"check your email to finish\" versus \"check your email, then set up\n   * your passkey\" — and a registrant told the wrong one abandons at the step they were not warned\n   * about.\n   *\n   * The magic link is not incidental here: a passkey proves possession of an authenticator and says\n   * nothing about an address, so a public passkey signup must prove the address some other way, and\n   * the link is that proof. It is also, permanently, the recovery path — see the note on\n   * `registerUser`.\n   */\n  PASSKEY_ENROLLMENT = 'passkey_enrollment',\n}\n\n/**\n * W4.2: Session purpose — drives UI rendering and valid state transitions.\n */\nexport enum AuthSessionPurpose {\n  LOGIN = 'login',\n  REGISTRATION = 'registration',\n  INVITATION = 'invitation',\n  REAUTH = 'reauth',\n  DEVICE_AUTH = 'device_auth',\n}\n\n/**\n * W4.6: MFA enrollment lifecycle state on UserCredentials.\n * Computed at user creation and updated on enrollment completion.\n */\nexport enum MfaEnrollmentState {\n  NOT_REQUIRED = 'not_required',\n  PENDING = 'pending',\n  GRACE = 'grace',\n  ENROLLED = 'enrolled',\n}\n\n// ===============================\n// AUTHENTICATION METHOD CLASSIFICATION\n// ===============================\n\n/**\n * Authentication Method Factor Classification Map\n */\nexport const AUTH_METHOD_FACTOR_MAP: Record<AuthMethod, AuthFactorType> = {\n  // First factor only - Primary credentials\n  [AuthMethod.PASSWORD]: AuthFactorType.FIRST_ONLY,\n\n  // First factor only - Passwordless via email\n  [AuthMethod.MAGIC_LINK]: AuthFactorType.FIRST_ONLY,\n\n  // First factor only - SSO redirect flows are not MFA ceremonies (B-SEC-1)\n  [AuthMethod.EXTERNAL_OAUTH2]: AuthFactorType.FIRST_ONLY,\n  [AuthMethod.ORG_SAML]: AuthFactorType.FIRST_ONLY,\n  [AuthMethod.ORG_OPENID_CONNECT]: AuthFactorType.FIRST_ONLY,\n\n  // Second factor only - MFA tokens (except SMS_OTP which can be first or second)\n  [AuthMethod.TOTP]: AuthFactorType.SECOND_ONLY,\n  [AuthMethod.SMS_OTP]: AuthFactorType.FIRST_OR_SECOND,\n  [AuthMethod.EMAIL_OTP]: AuthFactorType.SECOND_ONLY,\n\n  // First or second factor - Modern biometric\n  [AuthMethod.PASSKEY]: AuthFactorType.FIRST_OR_SECOND\n};\n\n/**\n * Authentication Method Category Map\n */\nexport const AUTH_METHOD_CATEGORY_MAP: Record<AuthMethod, AuthMethodCategory> = {\n  [AuthMethod.PASSWORD]: AuthMethodCategory.CREDENTIAL,\n  [AuthMethod.MAGIC_LINK]: AuthMethodCategory.CREDENTIAL,\n  [AuthMethod.EXTERNAL_OAUTH2]: AuthMethodCategory.EXTERNAL_OAUTH2,\n  [AuthMethod.ORG_SAML]: AuthMethodCategory.ORG_SSO,\n  [AuthMethod.ORG_OPENID_CONNECT]: AuthMethodCategory.ORG_SSO,\n  [AuthMethod.TOTP]: AuthMethodCategory.MFA_TOKEN,\n  [AuthMethod.SMS_OTP]: AuthMethodCategory.MFA_TOKEN,\n  [AuthMethod.EMAIL_OTP]: AuthMethodCategory.MFA_TOKEN,\n  [AuthMethod.PASSKEY]: AuthMethodCategory.BIOMETRIC\n};\n\n/**\n * Scope type for auth policies — organization-level vs application-level.\n *\n * Declared before the browser-safe available-method schema because that schema\n * evaluates this enum at module initialization time.\n */\nexport enum AuthScopeType {\n  ORGANIZATION = 'organization',\n  APPLICATION = 'application',\n}\n\n/**\n * Public, browser-safe configuration attached to an available auth method.\n *\n * The fields span passkey and enterprise-SSO methods, but every field is named\n * and typed: this cross-layer contract must never collapse back to\n * `Record<string, any>`, which previously forced frontend assertions for the\n * tenant scope and connection identity.\n */\nexport const AvailableMethodConfigSchema = z.object({\n  rpName: z.string().optional(),\n  rpId: z.string().optional(),\n  displayName: z.string().optional(),\n  providerRef: z.string().optional(),\n  connectionId: z.string().optional(),\n  scopeType: z.enum(AuthScopeType).optional(),\n  scopeId: z.string().optional(),\n  loginUrl: z.string().optional(),\n});\n\nexport type AvailableMethodConfig = z.infer<typeof AvailableMethodConfigSchema>;\n\nexport const AvailableMethodSchema = z.object({\n  method: z.enum(AuthMethod),\n  factorType: z.enum(AuthFactorType),\n  category: z.enum(AuthMethodCategory),\n  canBeFirstFactor: z.boolean(),\n  canBeSecondFactor: z.boolean(),\n  required: z.boolean(),\n\n  // Provider-specific information\n  oauth2ProviderRefs: z.array(z.string()).optional(), // For third-party OAuth2\n  ssoIds: z.array(z.string()).optional(), // For organization SSO\n  organizationRestricted: z.boolean().default(false),\n\n  // Integration capabilities\n  supportsIntegrations: z.boolean().default(false),\n  availableIntegrations: z.array(z.string()).default([]).optional(),\n\n  // Public configuration\n  config: AvailableMethodConfigSchema.optional()\n});\n\n\nexport type AvailableMethod = z.infer<typeof AvailableMethodSchema>;\n\n// ===============================\n// CROSS-LAYER CONSTANTS\n// ===============================\n\n/**\n * Error codes used in redirect query params (backend → frontend).\n * Backend appends `?error=<code>` to redirect URLs; frontend reads and displays.\n */\nexport enum AuthRedirectErrorCode {\n  SAML_LOGIN_FAILED = 'saml_login_failed',\n  SAML_AUTH_FAILED = 'saml_auth_failed',\n  SAML_SLO_FAILED = 'saml_slo_failed',\n  MISSING_PARAMS = 'missing_params',\n  OAUTH_FAILED = 'oauth_failed',\n}\n\n/**\n * Ownership class of an external authentication connection.\n *\n * This is intentionally independent from {@link AuthScopeType}: a social\n * connection has no enterprise tenant scope, while an enterprise connection\n * must carry one.\n */\nexport enum SsoConnectionType {\n  SOCIAL = 'social',\n  ENTERPRISE = 'enterprise',\n}\n\n/**\n * Mechanism that established an external identity.\n *\n * This is wider than the SSO protocol vocabulary because SCIM establishes and\n * maintains identity links without being an interactive SSO protocol.\n */\nexport enum ExternalIdentitySource {\n  OAUTH2 = 'oauth2',\n  OIDC = 'oidc',\n  SAML = 'saml',\n  SCIM = 'scim',\n}\n"]}

package/dist/esm/security/authentications/authentication.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAoD,MAAM,iCAAiC,CAAC;AAC/H,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAA+B,MAAM,sDAAsD,CAAC;AAGxH;;GAEG;AACH,qBAAa,SAAS;IACpB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOpD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOrD;;OAEG;IACH,MAAM,CAAC,qBAAqB,IAAI,UAAU,EAAE;IAU5C;;OAEG;IACH,MAAM,CAAC,sBAAsB,IAAI,UAAU,EAAE;IAU7C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc;IAIxD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB;IAIhE;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAI5D;;OAEG;IACH,MAAM,CAAC,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAK7D;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO;IAOnF;;;;OAIG;IACH,MAAM,CAAC,8BAA8B,CAAC,IAAI,EAAE;QAC1C,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE;IAUnC;;;;;;;OAOG;IACH,MAAM,CAAC,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;CAyB9H"}
+{"version":3,"file":"authentication.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAoD,MAAM,iCAAiC,CAAC;AAC/H,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAA+B,MAAM,sDAAsD,CAAC;AAGxH;;GAEG;AACH,qBAAa,SAAS;IACpB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOpD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOrD;;OAEG;IACH,MAAM,CAAC,qBAAqB,IAAI,UAAU,EAAE;IAU5C;;OAEG;IACH,MAAM,CAAC,sBAAsB,IAAI,UAAU,EAAE;IAU7C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc;IAIxD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB;IAIhE;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAI5D;;OAEG;IACH,MAAM,CAAC,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAK7D;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO;IAOnF;;;;OAIG;IACH,MAAM,CAAC,8BAA8B,CAAC,IAAI,EAAE;QAC1C,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE;IAUnC;;;;;;;OAOG;IACH,MAAM,CAAC,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;CAyB9H"}

package/dist/esm/security/authentications/consumable-token.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-token.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAOhG,oBAAY,wBAAwB;IAChC,8BAA8B,mCAAmC;IACjE,cAAc,mBAAmC;IACjD,kBAAkB,uBAAmC;IACrD,kBAAkB,uBAAmC;IACrD,YAAY,iBAAmC;IAC/C,uBAAuB,4BAAmC;IAC1D,oBAAoB,yBAAmC;IACvD,wFAAwF;IACxF,kBAAkB,uBAAmC;IACrD,kEAAkE;IAClE,SAAS,cAAmC;IAC5C,+EAA+E;IAC/E,UAAU,eAAmC;IAC7C,qEAAqE;IACrE,OAAO,YAAmC;IAC1C,sFAAsF;IACtF,kBAAkB,uBAAmC;IACrD,yEAAyE;IACzE,eAAe,oBAAmC;IAClD,kEAAkE;IAClE,MAAM,WAAmC;IACzC;;;;;OAKG;IACH,uBAAuB,4BAAmC;IAC1D;;;;;;;;OAQG;IACH,oBAAoB,yBAAmC;IACvD;;;;;;;;;;;OAWG;IACH,wBAAwB,6BAAmC;IAC3D;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAmC;CACvD;AAED,eAAO,MAAM,0BAA0B,gFAGrC,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E;;;;;;GAMG;AACH,oBAAY,+BAA+B;IACvC,UAAU,eAAoB;IAC9B,aAAa,kBAAoB;IACjC,eAAe,oBAAoB;CACtC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAOjF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC;AACnG,0EAA0E;AAE1E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+EAA+E;IAC/E,SAAS,EAAE,oBAAoB,CAAC;IAEhC,sCAAsC;IACtC,eAAe,EAAE,+BAA+B,CAAC;IAEjD;;;;;OAKG;IACH,SAAS,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAE9C;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAErC;;;;OAIG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAE5D,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,oGAAoG;IACpG,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAE5C;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEzC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AACF,0EAA0E;AAE1E;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+DAA+D;IAC/D,UAAU,EAAE,oBAAoB,EAAE,CAAC;IAEnC,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,oBAAY,yBAAyB;IACjC,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,kEAAkE;IAClE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,MAAM,EAAE,yBAAyB,CAAC;CACrC,CAAC"}
+{"version":3,"file":"consumable-token.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAOhG,oBAAY,wBAAwB;IAChC,8BAA8B,mCAAmC;IACjE,cAAc,mBAAmC;IACjD,kBAAkB,uBAAmC;IACrD,kBAAkB,uBAAmC;IACrD,YAAY,iBAAmC;IAC/C,uBAAuB,4BAAmC;IAC1D,oBAAoB,yBAAmC;IACvD,wFAAwF;IACxF,kBAAkB,uBAAmC;IACrD,kEAAkE;IAClE,SAAS,cAAmC;IAC5C,+EAA+E;IAC/E,UAAU,eAAmC;IAC7C,qEAAqE;IACrE,OAAO,YAAmC;IAC1C,sFAAsF;IACtF,kBAAkB,uBAAmC;IACrD,yEAAyE;IACzE,eAAe,oBAAmC;IAClD,kEAAkE;IAClE,MAAM,WAAmC;IACzC;;;;;OAKG;IACH,uBAAuB,4BAAmC;IAC1D;;;;;;;;OAQG;IACH,oBAAoB,yBAAmC;IACvD;;;;;;;;;;;OAWG;IACH,wBAAwB,6BAAmC;IAC3D;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAmC;CACvD;AAED,eAAO,MAAM,0BAA0B,gFAGrC,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E;;;;;;GAMG;AACH,oBAAY,+BAA+B;IACvC,UAAU,eAAoB;IAC9B,aAAa,kBAAoB;IACjC,eAAe,oBAAoB;CACtC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAOjF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC;AACnG,0EAA0E;AAE1E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+EAA+E;IAC/E,SAAS,EAAE,oBAAoB,CAAC;IAEhC,sCAAsC;IACtC,eAAe,EAAE,+BAA+B,CAAC;IAEjD;;;;;OAKG;IACH,SAAS,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAE9C;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAErC;;;;OAIG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAE5D,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,oGAAoG;IACpG,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAE5C;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEzC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AACF,0EAA0E;AAE1E;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+DAA+D;IAC/D,UAAU,EAAE,oBAAoB,EAAE,CAAC;IAEnC,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,oBAAY,yBAAyB;IACjC,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,kEAAkE;IAClE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,MAAM,EAAE,yBAAyB,CAAC;CACrC,CAAC"}

package/dist/esm/security/authentications/consumable-token.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"consumable-token.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,+EAA+E;AAC/E,uEAAuE;AACvE,+EAA+E;AAE/E,MAAM,CAAN,IAAY,wBAoEX;AApED,WAAY,wBAAwB;IAChC,6FAAiE,CAAA;IACjE,6DAAiD,CAAA;IACjD,qEAAqD,CAAA;IACrD,qEAAqD,CAAA;IACrD,yDAA+C,CAAA;IAC/C,+EAA0D,CAAA;IAC1D,yEAAuD,CAAA;IACvD,wFAAwF;IACxF,qEAAqD,CAAA;IACrD,kEAAkE;IAClE,mDAA4C,CAAA;IAC5C,+EAA+E;IAC/E,qDAA6C,CAAA;IAC7C,qEAAqE;IACrE,+CAA0C,CAAA;IAC1C,sFAAsF;IACtF,qEAAqD,CAAA;IACrD,yEAAyE;IACzE,+DAAkD,CAAA;IAClD,kEAAkE;IAClE,6CAAyC,CAAA;IACzC;;;;;OAKG;IACH,+EAA0D,CAAA;IAC1D;;;;;;;;OAQG;IACH,yEAAuD,CAAA;IACvD;;;;;;;;;;;OAWG;IACH,iFAA2D,CAAA;IAC3D;;;;;;;;;;;;;;OAcG;IACH,mEAAoD,CAAA;AACxD,CAAC,EApEW,wBAAwB,KAAxB,wBAAwB,QAoEnC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpB,CAAC,CAAC;AAMH,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,+BAIX;AAJD,WAAY,+BAA+B;IACvC,4DAA8B,CAAA;IAC9B,kEAAiC,CAAA;IACjC,sEAAmC,CAAA;AACvC,CAAC,EAJW,+BAA+B,KAA/B,+BAA+B,QAI1C;AAkLD;;;;GAIG;AACH,MAAM,CAAN,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACjC,wDAA2B,CAAA;IAC3B,kDAAqB,CAAA;AACzB,CAAC,EAHW,yBAAyB,KAAzB,yBAAyB,QAGpC","sourcesContent":["import { z } from \"zod\";\nimport type { ExpiresInDuration } from \"@wildo-ai/zod-decorators\";\nimport type { ExecutionContext_RoleInfo } from \"../../runtime/execution-context.shared.schemas\";\n\n\n// ============================================================================\n// CONSUMABLE TOKEN TYPES — Extensible enum of engine-level token types\n// ============================================================================\n\nexport enum CoreConsumableTokenTypes {\n    ORGANIZATION_MEMBER_INVITATION = 'organization_member_invitation',\n    PASSWORD_RESET                 = 'password_reset',\n    EMAIL_VERIFICATION             = 'email_verification',\n    FILE_PUBLIC_ACCESS             = 'file_public_access',\n    OAUTH2_STATE                   = 'oauth2_state',\n    EXTERNAL_CALLBACK_STATE        = 'external_callback_state',\n    WEBHOOK_VERIFICATION           = 'webhook_verification',\n    /** Delivers JWT tokens to the frontend after OAuth2 callback processing (Decision 7) */\n    AUTH_CODE_EXCHANGE             = 'auth_code_exchange',\n    /** Email OTP code for MFA second factor verification (Step 10) */\n    EMAIL_OTP                      = 'email_otp',\n    /** Magic link token for passwordless first-factor authentication (Phase G2) */\n    MAGIC_LINK                     = 'magic_link',\n    /** SMS OTP code for first/second factor authentication (Phase G2) */\n    SMS_OTP                        = 'sms_otp',\n    /** Phone number verification code — not an auth flow, just verification (Phase G2) */\n    PHONE_VERIFICATION             = 'phone_verification',\n    /** SAML AuthnRequest correlation state (AUTH-2: SAML Protocol Engine) */\n    SAML_AUTH_STATE                = 'saml_auth_state',\n    /** Re-authentication token for sensitive method changes (#13f) */\n    REAUTH                         = 'reauth',\n    /**\n     * OIDC authorization code (Wildo-as-provider authorization_code flow). Single-use,\n     * short-TTL; its metadata binds the code to the authenticated `userId`, the requesting\n     * `clientId`, the granted `scope`, the `redirectUri`, the PKCE `codeChallenge`, and the\n     * optional `nonce`. Redeemed at the token endpoint for an ID token + access + refresh.\n     */\n    OIDC_AUTHORIZATION_CODE        = 'oidc_authorization_code',\n    /**\n     * OIDC interactive-consent request (Wildo-as-provider authorization_code consent gate). Minted at\n     * `/oauth/authorize` for a client whose `requiresConsent` is true, INSTEAD of auto-issuing the\n     * code. Single-use, short-TTL; its metadata carries the SAME authorization request the code would\n     * bind (`clientId`, `scope`, `redirectUri`, `codeChallenge`, `nonce?`, `resource?`, `state?`)\n     * plus the authenticated `userId`. Consumed at `/oauth/authorize/decision`: on APPROVE it mints\n     * the authorization code from the stored request; on DENY the flow ends with `access_denied`.\n     * Storing the request server-side means the consent decision cannot tamper with the parameters.\n     */\n    OIDC_CONSENT_REQUEST           = 'oidc_consent_request',\n    /**\n     * OIDC RP-Initiated Logout confirmation (revocation-C §6 — the logout-confirmation prompt that\n     * mitigates BROWSER-based logout CSRF; a cross-origin page cannot read this token from the victim's\n     * URL to complete the confirm). Minted at `GET /oauth/end-session` for any request that is NOT a\n     * trusted RP logout (no/forged `id_token_hint`, or a valid hint whose `post_logout_redirect_uri`\n     * is absent / unregistered / mismatched), INSTEAD of terminating the session inline. Single-use,\n     * short-TTL; its metadata carries the already-validated `{ userId?, sessionId? }` the confirm step\n     * acts on (storing it server-side means the confirmation cannot tamper with WHICH session ends).\n     * Consumed at `POST /oauth/end-session/confirm`: on confirm it terminates that session (if any) and\n     * lands on `/oauth/logged-out`. A trusted RP logout (valid hint + exact-match registered redirect)\n     * skips this entirely and terminates + redirects to the RP directly — the Keycloak-style posture.\n     */\n    OIDC_LOGOUT_CONFIRMATION       = 'oidc_logout_confirmation',\n    /**\n     * A single-use grant to upload ONE file into ONE resource file field, minted by a principal who\n     * could perform the target CREATE/UPDATE and redeemed by whoever holds it — an AI agent's `curl`,\n     * or a human on the drop page — without the minter's own credential ever leaving the server.\n     *\n     * Exists because MCP tool arguments are model-generated JSON and cannot carry bytes; see #312.\n     * `SINGLE_USE` only (a reusable upload credential is the presigned-URL defect rebuilt inside\n     * the API). Typed fields carry identity — `userId`/`organizationId`/`roles` snapshot of the\n     * minter, `resourceIdentifier` = target resource, `relatedId` = target row for UPDATE — and\n     * `metadata` carries the ROUTE binding (`fieldName`, `operation`, `minter`, `producedFileId`),\n     * which the upload middleware checks and the identity layer deliberately ignores. Lifetime is\n     * bounded at the mint by `FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES`, rejecting rather than\n     * clamping: this credential is designed to leave the trust boundary (a transcript, a shell\n     * history), so the engine owns the bound.\n     */\n    FILE_UPLOAD_GRANT              = 'file_upload_grant',\n}\n\nexport const ConsumableTokenTypesSchema = z.union([\n    z.enum(CoreConsumableTokenTypes),\n    z.string().min(1),\n]);\n\n\nexport type ConsumableTokenTypes = z.infer<typeof ConsumableTokenTypesSchema>;\n\n\n// ============================================================================\n// CONSUMPTION MODE — Three behavioral categories for token lifecycle\n// ============================================================================\n\n/**\n * Defines how a token behaves when used.\n *\n * - `SINGLE_USE`: Consumed after first successful use (password reset, invitation acceptance)\n * - `BOUNDED_REUSE`: Can be used N times or until expiry (file sharing link, meeting join link)\n * - `EPHEMERAL_STATE`: Carries state through a redirect, consumed on callback (OAuth state, payment callback)\n */\nexport enum ConsumableToken_ConsumptionMode {\n    SINGLE_USE      = 'SINGLE_USE',\n    BOUNDED_REUSE   = 'BOUNDED_REUSE',\n    EPHEMERAL_STATE = 'EPHEMERAL_STATE',\n}\n\n\n// ============================================================================\n// UTILITY TYPE — StaticOrDerived<T>\n// ============================================================================\n\n/**\n * A value that can either be provided statically or derived from the operation result at runtime.\n *\n * Static:  `{ value: 7, unit: 'days' }`\n * Derived: `(currentObject) => ({ value: currentObject.shareDurationDays, unit: 'days' })`\n *\n * NOTE: This is intentionally NOT `ResourceConfiguration_FunctionWithContextNeeds` (R5).\n * `FunctionWithContextNeeds` wraps functions with metadata flags (`needsObjectContext`, `needsUserContext`)\n * for factory introspection. `StaticOrDerived<T>` is simpler — it's just \"literal value OR function from\n * currentObject\" with no metadata flags. The factory marks dynamic values as `_isDynamic` during\n * processing, which is a different mechanism entirely.\n */\nexport type StaticOrDerived<T> = T | ((currentObject: Record<string, any>) => T);\n\n\n// ============================================================================\n// DECLARATIVE CONFIG TYPES — For operation variant configuration\n// ============================================================================\n\n/** @wildo_source:part:start saas.models.resource-config.token-generation facet:layer:shared facet:family:resource-config\n *\n * Config-declared gate deciding whether a `tokenGeneration` side-effect actually\n * mints a token, evaluated against the POST-operation row (`currentObject`).\n *\n * WHY the destructured params-object shape `({ currentObject }) => boolean` and NOT\n * the positional `StaticOrDerived` shape used by `expiresIn`/`grantedRoles` above (R5):\n * this deliberately mirrors the operation-variant `enabledCondition` predicate (see the\n * org-members REVOKE/RESEND configs) so an app author writes ONE predicate form for every\n * \"config-declared gate over currentObject\". The trade-off is worth it — cross-surface\n * authoring consistency beats intra-type consistency with the positional derivers.\n *\n * WHY the params object carries ONLY `currentObject` (unlike the notification `condition`,\n * which also gets `inputDto`/`objectContext`/`initiatorIds`): a token is a PERSISTED\n * side-effect keyed on the resulting row, so its gate must depend only on the persisted\n * result — never on raw request input. Narrowing the params to `currentObject` makes that\n * guarantee structural. (It also keeps this type free of the `resources-config` params type,\n * which would be a circular import — `resources-config.shared.schemas` imports FROM here.)\n */\nexport type TokenGenerationCondition = (params: { currentObject: Record<string, any> }) => boolean;\n/** @wildo_source:part:end saas.models.resource-config.token-generation */\n\n/** @wildo_source:part:start saas.models.resource-config.token-generation facet:layer:shared facet:family:resource-config\n *\n * Declarative config for automatic token generation on an operation variant.\n * Placed on CREATE/RESEND-like operations to generate a token as a side-effect.\n *\n * Import from `@wildo-ai/saas-models`; application authors normally provide\n * this shape through an API-call variant in\n * `createResourceConfiguration_Initialization(...)`.\n *\n * The operation pipeline creates the token in the same persistence transaction\n * as the resource mutation, then injects `additionalContext.tokenValue` into\n * post-commit notification dispatch.\n *\n * The contract requires one canonical persisted resource state. It cannot be\n * authored on a collection/aggregate operation, a core bulk mutation, or a\n * variant with `haveBulkOperation: true`; those operations do not expose one\n * unambiguous related resource identity for the generated token.\n *\n * @example\n * `tokenGeneration: { tokenType: MyTokenType.INVITATION, consumptionMode:\n * ConsumableToken_ConsumptionMode.SINGLE_USE, expiresIn: { value: 7, unit:\n * DurationUnit.DAYS }, relatedIdField: '_id' }`\n */\nexport type TokenGenerationConfig = {\n    /** Token type identifier (from CoreConsumableTokenTypes or custom app enum) */\n    tokenType: ConsumableTokenTypes;\n\n    /** How the token behaves when used */\n    consumptionMode: ConsumableToken_ConsumptionMode;\n\n    /**\n     * Expiration duration — static or derived from currentObject.\n     * Units: minutes, hours, or days only. Value must be ≥ 1.\n     * Static: `{ value: 7, unit: DurationUnit.DAYS }`\n     * Derived: `(currentObject) => ({ value: currentObject.shareDurationDays, unit: 'days' })`\n     */\n    expiresIn: StaticOrDerived<ExpiresInDuration>;\n\n    /**\n     * Optional gate — mint this token ONLY when the predicate returns truthy against the\n     * post-operation row. Absent = always mint.\n     *\n     * Canonical use: a POLYMORPHIC CREATE (org-member INVITE vs DIRECT-ADD) mints the\n     * single-use accept token ONLY for the INVITED branch. A direct-add (founder / SSO-JIT /\n     * SCIM) persists `ACTIVE` with nothing to accept, so minting a token there would leave a\n     * live single-use accept token dangling on an already-ACTIVE row (a hygiene/security\n     * hole). Keying on the resulting `status` — the semantic driver, uniformly present on\n     * every branch's `currentObject` — auto-covers any future non-INVITED direct-add path.\n     *\n     * @example `({ currentObject }) => currentObject.status === OrganizationMemberStatus.INVITED`\n     */\n    condition?: TokenGenerationCondition;\n\n    /**\n     * Roles granted when the token is used for authentication.\n     * Static: `[{ roles: ['ORG_MEMBER'], relatedPrimaryScope: 'ORGANIZATIONS' }]`\n     * Derived: `(currentObject) => [{ roles: [currentObject.assignedRole], relatedPrimaryScope: 'ORGANIZATIONS' }]`\n     */\n    grantedRoles?: StaticOrDerived<ExecutionContext_RoleInfo[]>;\n\n    /** Max uses for BOUNDED_REUSE mode. Required when consumptionMode is BOUNDED_REUSE. */\n    maxUses?: number;\n\n    /** Revoke existing tokens of same type for same relatedId before creating new one (e.g., RESEND) */\n    revokeExistingForSameRelated?: boolean;\n\n    /** Field in currentState to use as relatedId. Defaults to '_id' (the resource's own ID). */\n    relatedIdField?: string;\n\n    /**\n     * Field in currentState to capture as the token's userId (user_self pattern).\n     * e.g., 'invitedUserId' — if not set, no userId stored on token.\n     */\n    userIdField?: string;\n\n    /**\n     * W7.3b: Marks the generated token as exchangeable for a one-off session JWT.\n     * When true, the token can be used via POST /auth/one-off-session/exchange.\n     */\n    createsOneOffSession?: boolean;\n\n    /**\n     * W7.3b: When the token is consumed — at exchange time or at target operation time.\n     * Required when `createsOneOffSession` is true.\n     * - `EXCHANGE`: consumed immediately when exchanged for a JWT (no token carried into session)\n     * - `TARGET_OPERATION`: carried through the session, consumed when the target operation executes\n     */\n    consumeAt?: 'EXCHANGE' | 'TARGET_OPERATION';\n\n    /**\n     * W7.3b: Builds targeting.initiatorIds for frontend URL resolution.\n     * Maps field identifier names to field paths in currentState.\n     * organizationId is auto-included from execution context if not specified.\n     *\n     * Example: `{ taskId: '_id' }` → on a Tasks resource, reads `currentState._id` as the taskId.\n     * The frontend uses these to resolve the target URL after session exchange.\n     */\n    targetingFields?: Record<string, string>;\n\n    /**\n     * Public path of the frontend page that consumes this token (e.g. `/invitation`).\n     * When set, the notification dispatcher builds\n     * `additionalContext.acceptUrl = <frontendPublicUrl><emailLinkPath>?token=<tokenValue>`\n     * for the token-bearing notification email, so the recipient can act on the\n     * token straight from the email. Without it, only the raw `tokenValue` is\n     * exposed and the email falls back to its generic (sign-in) CTA. Use a stable\n     * framework route — the backend cannot import frontend route constants.\n     */\n    emailLinkPath?: string;\n};\n/** @wildo_source:part:end saas.models.resource-config.token-generation */\n\n/**\n * Declarative config for automatic token revocation on an operation variant.\n * Placed on DELETE-like operations to revoke associated tokens before the resource is removed.\n *\n * Pipeline placement: BEFORE the core operation (pre-operation step).\n * Like token generation, revocation requires one canonical current resource\n * state and cannot be combined with collection/aggregate or authored/generated\n * bulk mutation semantics. It also cannot run on CREATE because no current\n * resource exists before persistence.\n */\nexport type TokenRevocationConfig = {\n    /** Which token types to revoke when this operation executes */\n    tokenTypes: ConsumableTokenTypes[];\n\n    /** Field in currentState to use as relatedId for revocation lookup. Defaults to '_id'. */\n    relatedIdField?: string;\n};\n\n/**\n * How a consumable token interacts with JWT/API-key authentication on an operation.\n * ALTERNATIVE: token alone is sufficient (replaces JWT). Used by PASSWORD_RESET, MAGIC_LINK, etc.\n * ADDITIVE: token is required ON TOP of JWT auth. Used by one-off session target operations.\n */\nexport enum TokenAuthenticationPolicy {\n    ALTERNATIVE = 'ALTERNATIVE',\n    ADDITIVE = 'ADDITIVE',\n}\n\n/**\n * Declarative config declaring that an operation accepts consumable tokens for authentication.\n * Replaces the old `ResourceConfiguration_OperationVariant_ApiCall_ConsumableToken`.\n *\n * NOTE: No `isConsumed` field — consumption is controlled by the token user's `consumptionMode`\n * (set at creation time), not by the operation config. This avoids contradictions between config\n * and entity state (Trap 5).\n */\nexport type TokenAuthenticationConfig = {\n    /** Which token types this operation accepts for authentication */\n    types: ConsumableTokenTypes[];\n    policy: TokenAuthenticationPolicy;\n};\n"]}
+{"version":3,"file":"consumable-token.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,+EAA+E;AAC/E,uEAAuE;AACvE,+EAA+E;AAE/E,MAAM,CAAN,IAAY,wBAoEX;AApED,WAAY,wBAAwB;IAChC,6FAAiE,CAAA;IACjE,6DAAiD,CAAA;IACjD,qEAAqD,CAAA;IACrD,qEAAqD,CAAA;IACrD,yDAA+C,CAAA;IAC/C,+EAA0D,CAAA;IAC1D,yEAAuD,CAAA;IACvD,wFAAwF;IACxF,qEAAqD,CAAA;IACrD,kEAAkE;IAClE,mDAA4C,CAAA;IAC5C,+EAA+E;IAC/E,qDAA6C,CAAA;IAC7C,qEAAqE;IACrE,+CAA0C,CAAA;IAC1C,sFAAsF;IACtF,qEAAqD,CAAA;IACrD,yEAAyE;IACzE,+DAAkD,CAAA;IAClD,kEAAkE;IAClE,6CAAyC,CAAA;IACzC;;;;;OAKG;IACH,+EAA0D,CAAA;IAC1D;;;;;;;;OAQG;IACH,yEAAuD,CAAA;IACvD;;;;;;;;;;;OAWG;IACH,iFAA2D,CAAA;IAC3D;;;;;;;;;;;;;;OAcG;IACH,mEAAoD,CAAA;AACxD,CAAC,EApEW,wBAAwB,KAAxB,wBAAwB,QAoEnC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACpB,CAAC,CAAC;AAMH,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,+BAIX;AAJD,WAAY,+BAA+B;IACvC,4DAA8B,CAAA;IAC9B,kEAAiC,CAAA;IACjC,sEAAmC,CAAA;AACvC,CAAC,EAJW,+BAA+B,KAA/B,+BAA+B,QAI1C;AAkLD;;;;GAIG;AACH,MAAM,CAAN,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACjC,wDAA2B,CAAA;IAC3B,kDAAqB,CAAA;AACzB,CAAC,EAHW,yBAAyB,KAAzB,yBAAyB,QAGpC","sourcesContent":["import { z } from \"zod\";\nimport type { ExpiresInDuration } from \"@wildo-ai/zod-decorators\";\nimport type { ExecutionContext_RoleInfo } from \"../../runtime/execution-context.shared.schemas\";\n\n\n// ============================================================================\n// CONSUMABLE TOKEN TYPES — Extensible enum of engine-level token types\n// ============================================================================\n\nexport enum CoreConsumableTokenTypes {\n    ORGANIZATION_MEMBER_INVITATION = 'organization_member_invitation',\n    PASSWORD_RESET                 = 'password_reset',\n    EMAIL_VERIFICATION             = 'email_verification',\n    FILE_PUBLIC_ACCESS             = 'file_public_access',\n    OAUTH2_STATE                   = 'oauth2_state',\n    EXTERNAL_CALLBACK_STATE        = 'external_callback_state',\n    WEBHOOK_VERIFICATION           = 'webhook_verification',\n    /** Delivers JWT tokens to the frontend after OAuth2 callback processing (Decision 7) */\n    AUTH_CODE_EXCHANGE             = 'auth_code_exchange',\n    /** Email OTP code for MFA second factor verification (Step 10) */\n    EMAIL_OTP                      = 'email_otp',\n    /** Magic link token for passwordless first-factor authentication (Phase G2) */\n    MAGIC_LINK                     = 'magic_link',\n    /** SMS OTP code for first/second factor authentication (Phase G2) */\n    SMS_OTP                        = 'sms_otp',\n    /** Phone number verification code — not an auth flow, just verification (Phase G2) */\n    PHONE_VERIFICATION             = 'phone_verification',\n    /** SAML AuthnRequest correlation state (AUTH-2: SAML Protocol Engine) */\n    SAML_AUTH_STATE                = 'saml_auth_state',\n    /** Re-authentication token for sensitive method changes (#13f) */\n    REAUTH                         = 'reauth',\n    /**\n     * OIDC authorization code (Wildo-as-provider authorization_code flow). Single-use,\n     * short-TTL; its metadata binds the code to the authenticated `userId`, the requesting\n     * `clientId`, the granted `scope`, the `redirectUri`, the PKCE `codeChallenge`, and the\n     * optional `nonce`. Redeemed at the token endpoint for an ID token + access + refresh.\n     */\n    OIDC_AUTHORIZATION_CODE        = 'oidc_authorization_code',\n    /**\n     * OIDC interactive-consent request (Wildo-as-provider authorization_code consent gate). Minted at\n     * `/oauth/authorize` for a client whose `requiresConsent` is true, INSTEAD of auto-issuing the\n     * code. Single-use, short-TTL; its metadata carries the SAME authorization request the code would\n     * bind (`clientId`, `scope`, `redirectUri`, `codeChallenge`, `nonce?`, `resource?`, `state?`)\n     * plus the authenticated `userId`. Consumed at `/oauth/authorize/decision`: on APPROVE it mints\n     * the authorization code from the stored request; on DENY the flow ends with `access_denied`.\n     * Storing the request server-side means the consent decision cannot tamper with the parameters.\n     */\n    OIDC_CONSENT_REQUEST           = 'oidc_consent_request',\n    /**\n     * OIDC RP-Initiated Logout confirmation (revocation-C §6 — the logout-confirmation prompt that\n     * mitigates BROWSER-based logout CSRF; a cross-origin page cannot read this token from the victim's\n     * URL to complete the confirm). Minted at `GET /oauth/end-session` for any request that is NOT a\n     * trusted RP logout (no/forged `id_token_hint`, or a valid hint whose `post_logout_redirect_uri`\n     * is absent / unregistered / mismatched), INSTEAD of terminating the session inline. Single-use,\n     * short-TTL; its metadata carries the already-validated `{ userId?, sessionId? }` the confirm step\n     * acts on (storing it server-side means the confirmation cannot tamper with WHICH session ends).\n     * Consumed at `POST /oauth/end-session/confirm`: on confirm it terminates that session (if any) and\n     * lands on `/oauth/logged-out`. A trusted RP logout (valid hint + exact-match registered redirect)\n     * skips this entirely and terminates + redirects to the RP directly — the Keycloak-style posture.\n     */\n    OIDC_LOGOUT_CONFIRMATION       = 'oidc_logout_confirmation',\n    /**\n     * A single-use grant to upload ONE file into ONE resource file field, minted by a principal who\n     * could perform the target CREATE/UPDATE and redeemed by whoever holds it — an AI agent's `curl`,\n     * or a human on the drop page — without the minter's own credential ever leaving the server.\n     *\n     * Exists because MCP tool arguments are model-generated JSON and cannot carry bytes; see #312.\n     * `SINGLE_USE` only (a reusable upload credential is the presigned-URL defect rebuilt inside\n     * the API). Typed fields carry identity — `userId`/`organizationId`/`roles` snapshot of the\n     * minter, `resourceIdentifier` = target resource, `relatedId` = target row for UPDATE — and\n     * `metadata` carries the ROUTE binding (`fieldName`, `operation`, `minter`, `producedFileId`),\n     * which the upload middleware checks and the identity layer deliberately ignores. Lifetime is\n     * bounded at the mint by `FILE_UPLOAD_GRANT_ABSOLUTE_MAX_MINUTES`, rejecting rather than\n     * clamping: this credential is designed to leave the trust boundary (a transcript, a shell\n     * history), so the engine owns the bound.\n     */\n    FILE_UPLOAD_GRANT              = 'file_upload_grant',\n}\n\nexport const ConsumableTokenTypesSchema = z.union([\n    z.enum(CoreConsumableTokenTypes),\n    z.string().min(1),\n]);\n\n\nexport type ConsumableTokenTypes = z.infer<typeof ConsumableTokenTypesSchema>;\n\n\n// ============================================================================\n// CONSUMPTION MODE — Three behavioral categories for token lifecycle\n// ============================================================================\n\n/**\n * Defines how a token behaves when used.\n *\n * - `SINGLE_USE`: Consumed after first successful use (password reset, invitation acceptance)\n * - `BOUNDED_REUSE`: Can be used N times or until expiry (file sharing link, meeting join link)\n * - `EPHEMERAL_STATE`: Carries state through a redirect, consumed on callback (OAuth state, payment callback)\n */\nexport enum ConsumableToken_ConsumptionMode {\n    SINGLE_USE      = 'SINGLE_USE',\n    BOUNDED_REUSE   = 'BOUNDED_REUSE',\n    EPHEMERAL_STATE = 'EPHEMERAL_STATE',\n}\n\n\n// ============================================================================\n// UTILITY TYPE — StaticOrDerived<T>\n// ============================================================================\n\n/**\n * A value that can either be provided statically or derived from the operation result at runtime.\n *\n * Static:  `{ value: 7, unit: 'days' }`\n * Derived: `(currentObject) => ({ value: currentObject.shareDurationDays, unit: 'days' })`\n *\n * NOTE: This is intentionally NOT `ResourceConfiguration_FunctionWithContextNeeds` (R5).\n * `FunctionWithContextNeeds` wraps functions with metadata flags (`needsObjectContext`, `needsUserContext`)\n * for factory introspection. `StaticOrDerived<T>` is simpler — it's just \"literal value OR function from\n * currentObject\" with no metadata flags. The factory marks dynamic values as `_isDynamic` during\n * processing, which is a different mechanism entirely.\n */\nexport type StaticOrDerived<T> = T | ((currentObject: Record<string, any>) => T);\n\n\n// ============================================================================\n// DECLARATIVE CONFIG TYPES — For operation variant configuration\n// ============================================================================\n\n/** @wildo_source:part:start saas.models.resource-config.token-generation facet:layer:shared facet:family:resource-config\n *\n * Config-declared gate deciding whether a `tokenGeneration` side-effect actually\n * mints a token, evaluated against the POST-operation row (`currentObject`).\n *\n * WHY the destructured params-object shape `({ currentObject }) => boolean` and NOT\n * the positional `StaticOrDerived` shape used by `expiresIn`/`grantedRoles` above (R5):\n * this deliberately mirrors the operation-variant `enabledCondition` predicate (see the\n * org-members REVOKE/RESEND configs) so an app author writes ONE predicate form for every\n * \"config-declared gate over currentObject\". The trade-off is worth it — cross-surface\n * authoring consistency beats intra-type consistency with the positional derivers.\n *\n * WHY the params object carries ONLY `currentObject` (unlike the notification `condition`,\n * which also gets `inputDto`/`objectContext`/`initiatorIds`): a token is a PERSISTED\n * side-effect keyed on the resulting row, so its gate must depend only on the persisted\n * result — never on raw request input. Narrowing the params to `currentObject` makes that\n * guarantee structural. (It also keeps this type free of the `resources-config` params type,\n * which would be a circular import — `resources-config.shared.schemas` imports FROM here.)\n */\nexport type TokenGenerationCondition = (params: { currentObject: Record<string, any> }) => boolean;\n/** @wildo_source:part:end saas.models.resource-config.token-generation */\n\n/** @wildo_source:part:start saas.models.resource-config.token-generation facet:layer:shared facet:family:resource-config\n *\n * Declarative config for automatic token generation on an operation variant.\n * Placed on CREATE/RESEND-like operations to generate a token as a side-effect.\n *\n * Import from `@wildo-ai/saas-models`; application authors normally provide\n * this shape through an API-call variant in\n * `createResourceConfiguration_Initialization(...)`.\n *\n * The operation pipeline creates the token in the same persistence transaction\n * as the resource mutation, then injects `additionalContext.tokenValue` into\n * post-commit notification dispatch.\n *\n * The contract requires one canonical persisted resource state. It cannot be\n * authored on a collection/aggregate operation, a core bulk mutation, or a\n * variant with `haveBulkOperation: true`; those operations do not expose one\n * unambiguous related resource identity for the generated token.\n *\n * @example\n * `tokenGeneration: { tokenType: MyTokenType.INVITATION, consumptionMode:\n * ConsumableToken_ConsumptionMode.SINGLE_USE, expiresIn: { value: 7, unit:\n * DurationUnit.DAYS }, relatedIdField: '_id' }`\n */\nexport type TokenGenerationConfig = {\n    /** Token type identifier (from CoreConsumableTokenTypes or custom app enum) */\n    tokenType: ConsumableTokenTypes;\n\n    /** How the token behaves when used */\n    consumptionMode: ConsumableToken_ConsumptionMode;\n\n    /**\n     * Expiration duration — static or derived from currentObject.\n     * Units: minutes, hours, or days only. Value must be ≥ 1.\n     * Static: `{ value: 7, unit: DurationUnit.DAYS }`\n     * Derived: `(currentObject) => ({ value: currentObject.shareDurationDays, unit: 'days' })`\n     */\n    expiresIn: StaticOrDerived<ExpiresInDuration>;\n\n    /**\n     * Optional gate — mint this token ONLY when the predicate returns truthy against the\n     * post-operation row. Absent = always mint.\n     *\n     * Canonical use: a POLYMORPHIC CREATE (org-member INVITE vs DIRECT-ADD) mints the\n     * single-use accept token ONLY for the INVITED branch. A direct-add (founder / SSO-JIT /\n     * SCIM) persists `ACTIVE` with nothing to accept, so minting a token there would leave a\n     * live single-use accept token dangling on an already-ACTIVE row (a hygiene/security\n     * hole). Keying on the resulting `status` — the semantic driver, uniformly present on\n     * every branch's `currentObject` — auto-covers any future non-INVITED direct-add path.\n     *\n     * @example `({ currentObject }) => currentObject.status === OrganizationMemberStatus.INVITED`\n     */\n    condition?: TokenGenerationCondition;\n\n    /**\n     * Roles granted when the token is used for authentication.\n     * Static: `[{ roles: ['ORG_MEMBER'], relatedPrimaryScope: 'ORGANIZATIONS' }]`\n     * Derived: `(currentObject) => [{ roles: [currentObject.assignedRole], relatedPrimaryScope: 'ORGANIZATIONS' }]`\n     */\n    grantedRoles?: StaticOrDerived<ExecutionContext_RoleInfo[]>;\n\n    /** Max uses for BOUNDED_REUSE mode. Required when consumptionMode is BOUNDED_REUSE. */\n    maxUses?: number;\n\n    /** Revoke existing tokens of same type for same relatedId before creating new one (e.g., RESEND) */\n    revokeExistingForSameRelated?: boolean;\n\n    /** Field in currentState to use as relatedId. Defaults to '_id' (the resource's own ID). */\n    relatedIdField?: string;\n\n    /**\n     * Field in currentState to capture as the token's userId (user_self pattern).\n     * e.g., 'invitedUserId' — if not set, no userId stored on token.\n     */\n    userIdField?: string;\n\n    /**\n     * W7.3b: Marks the generated token as exchangeable for a one-off session JWT.\n     * When true, the token can be used via POST /auth/one-off-session/exchange.\n     */\n    createsOneOffSession?: boolean;\n\n    /**\n     * W7.3b: When the token is consumed — at exchange time or at target operation time.\n     * Required when `createsOneOffSession` is true.\n     * - `EXCHANGE`: consumed immediately when exchanged for a JWT (no token carried into session)\n     * - `TARGET_OPERATION`: carried through the session, consumed when the target operation executes\n     */\n    consumeAt?: 'EXCHANGE' | 'TARGET_OPERATION';\n\n    /**\n     * W7.3b: Builds targeting.initiatorIds for frontend URL resolution.\n     * Maps field identifier names to field paths in currentState.\n     * organizationId is auto-included from execution context if not specified.\n     *\n     * Example: `{ taskId: '_id' }` → on a Tasks resource, reads `currentState._id` as the taskId.\n     * The frontend uses these to resolve the target URL after session exchange.\n     */\n    targetingFields?: Record<string, string>;\n\n    /**\n     * Public path of the frontend page that consumes this token (e.g. `/invitation`).\n     * When set, the notification dispatcher builds\n     * `additionalContext.acceptUrl = <frontendPublicUrl><emailLinkPath>?token=<tokenValue>`\n     * for the token-bearing notification email, so the recipient can act on the\n     * token straight from the email. Without it, only the raw `tokenValue` is\n     * exposed and the email falls back to its generic (sign-in) CTA. Use a stable\n     * framework route — the backend cannot import frontend route constants.\n     */\n    emailLinkPath?: string;\n};\n/** @wildo_source:part:end saas.models.resource-config.token-generation */\n\n/**\n * Declarative config for automatic token revocation on an operation variant.\n * Placed on DELETE-like operations to revoke associated tokens before the resource is removed.\n *\n * Pipeline placement: BEFORE the core operation (pre-operation step).\n * Like token generation, revocation requires one canonical current resource\n * state and cannot be combined with collection/aggregate or authored/generated\n * bulk mutation semantics. It also cannot run on CREATE because no current\n * resource exists before persistence.\n */\nexport type TokenRevocationConfig = {\n    /** Which token types to revoke when this operation executes */\n    tokenTypes: ConsumableTokenTypes[];\n\n    /** Field in currentState to use as relatedId for revocation lookup. Defaults to '_id'. */\n    relatedIdField?: string;\n};\n\n/**\n * How a consumable token interacts with JWT/API-key authentication on an operation.\n * ALTERNATIVE: token alone is sufficient (replaces JWT). Used by PASSWORD_RESET, MAGIC_LINK, etc.\n * ADDITIVE: token is required ON TOP of JWT auth. Used by one-off session target operations.\n */\nexport enum TokenAuthenticationPolicy {\n    ALTERNATIVE = 'ALTERNATIVE',\n    ADDITIVE = 'ADDITIVE',\n}\n\n/**\n * Declarative config declaring that an operation accepts consumable tokens for authentication.\n * Replaces the old `ResourceConfiguration_OperationVariant_ApiCall_ConsumableToken`.\n *\n * NOTE: No `isConsumed` field — consumption is controlled by the token user's `consumptionMode`\n * (set at creation time), not by the operation config. This avoids contradictions between config\n * and entity state (Trap 5).\n */\nexport type TokenAuthenticationConfig = {\n    /** Which token types this operation accepts for authentication */\n    types: ConsumableTokenTypes[];\n    policy: TokenAuthenticationPolicy;\n};\n"]}

package/dist/esm/security/authentications/cross-frontend-handoff.shared.dto.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-frontend-handoff.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/cross-frontend-handoff.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;GAKG;AACH,oBAAY,6BAA6B;IACrC,yFAAyF;IACzF,uBAAuB,4BAA4B;IAEnD,8JAA8J;IAC9J,mCAAmC,wCAAwC;IAE3E,2IAA2I;IAC3I,yCAAyC,8CAA8C;CAC1F;AA+FD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,eAAO,MAAM,iCAAiC;;;kBAG5C,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kCAAkC;;;kBAG7C,CAAC;AAEH;;;GAGG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;kBAErC,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,2BAA2B;;;;;;kBAMtC,CAAC;AAEH;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}
+{"version":3,"file":"cross-frontend-handoff.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/cross-frontend-handoff.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;GAKG;AACH,oBAAY,6BAA6B;IACrC,yFAAyF;IACzF,uBAAuB,4BAA4B;IAEnD,8JAA8J;IAC9J,mCAAmC,wCAAwC;IAE3E,2IAA2I;IAC3I,yCAAyC,8CAA8C;CAC1F;AA+FD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,eAAO,MAAM,iCAAiC;;;kBAG5C,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kCAAkC;;;kBAG7C,CAAC;AAEH;;;GAGG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;kBAErC,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,2BAA2B;;;;;;kBAMtC,CAAC;AAEH;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/esm/security/authentications/password-reset.shared.dto.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/password-reset.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;iBAIxC,CAAC;AAGH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;iBAGzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC;;;iBAO7C,CAAC;AAGH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC"}
+{"version":3,"file":"password-reset.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/password-reset.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;iBAIxC,CAAC;AAGH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;iBAGzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC;;;iBAO7C,CAAC;AAGH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC"}

package/dist/esm/security/authentications/registration.shared.dto.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAM7D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAoBpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;iBAkBnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;iBAqBtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,2EAIvC,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC;AAErG;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;iBASrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"registration.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAM7D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAoBpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;iBAkBnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;iBAqBtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,2EAIvC,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC;AAErG;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;iBASrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/esm/security/authentications/registration.shared.dto.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,8FAA8F;IAC9F,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACzC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACV,CAAC;AAWX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8EAA8E;IAC9E,gFAAgF;IAChF,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC","sourcesContent":["/**\n * User Registration — Shared DTO Schemas\n *\n * Single source of truth for user registration validation.\n * Used by both frontend (AutomatedForm component) and backend (req.body parsing).\n */\n\nimport { z } from 'zod';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\nimport { AuthMethod } from './authentication.shared.schemas';\n\n// ═══════════════════════════════════════════════════════════════\n// Registration Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/register — registration form fields.\n * Used as:\n * - Frontend: AutomatedForm schema (all 5 fields rendered)\n * - Backend: req.body parsing (minus confirmPassword)\n *\n * confirmPassword is a frontend-only field for client-side match validation.\n * The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n.\n * The .isPassword() decorator tells FormField to render password inputs.\n */\nexport const UserRegisterFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n  }),\n  firstName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  /** W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. */\n  organizationName: z.string().min(1).max(200).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n  }).optional(),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\n\nexport type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;\n\n/**\n * POST /auth/register — API contract (what goes over the wire).\n * Backend uses this for req.body parsing.\n * confirmPassword is NOT sent to the backend.\n */\nexport const UserRegisterApiDtoSchema = z.object({\n  email: z.email().toLowerCase(),\n  firstName: z.string().min(1).max(50),\n  lastName: z.string().min(1).max(50),\n  password: z.string().min(1).optional(),\n  /** W6.2: Org name when orgNameSource is 'ask'. */\n  organizationName: z.string().min(1).max(200).optional(),\n  /**\n   * How the registrant will authenticate afterwards (#463). Absent ⇒ PASSWORD, so a client that\n   * predates password-less signup keeps working unchanged.\n   *\n   * Typed as the whole `AuthMethod` vocabulary rather than a narrowed subset, deliberately: the set\n   * a given application accepts is `registration.allowedMethods`, which is per user type and\n   * authored, and duplicating a narrower list here would be a second place for it to drift. A method\n   * this application does not allow is refused by the service with the allowed set in the message,\n   * which is a better answer than a schema rejection that cannot say what IS allowed.\n   */\n  method: z.enum(AuthMethod).optional(),\n});\n\n\nexport type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Invitation Acceptance DTOs\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/invitation/accept — public invitation-acceptance form fields.\n *\n * The invitation token identifies the target invitation. Name/password fields are optional\n * because an existing invited user may only need to confirm the invitation, while a new\n * invited user can provide profile/password data in the same flow.\n *\n * confirmPassword is frontend-only and excluded from the API DTO.\n */\nexport const UserInvitationFormDtoSchema = z.object({\n  // Required, mirroring registration: the invitee establishes their identity at acceptance, and\n  // the profile seed keys on non-empty first+last (UserProfileSchema requires both).\n  // `.regex(/\\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS\n  // (\"  \" has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`\n  // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,\n  // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the\n  // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is\n  // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).\n  firstName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  password: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\nexport type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;\n\n/**\n * The first-factor credential the invitee chooses to establish at acceptance.\n *\n * The invitation-accept endpoint supports exactly three establishment paths (SSO-managed\n * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):\n * - `PASSWORD` — set a password now. When both `credentialMethod` and\n *   `password` are omitted, intentionally activate with no local credential;\n *   another configured authentication method can establish later sessions.\n * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the\n *   session is established when the invitee clicks it.\n * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps\n *   the session and the passkey is registered as the go-forward credential.\n */\nexport const INVITATION_ACCEPT_CREDENTIAL_METHODS = [\n  AuthMethod.PASSWORD,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.PASSKEY,\n] as const;\n\n/**\n * The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-\n * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are\n * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and\n * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift\n * wider than the wire contract it is fed from.\n */\nexport type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];\n\n/**\n * POST /auth/invitation/accept — API contract.\n *\n * `credentialMethod` is optional by design. When absent, a provided `password`\n * establishes a password credential; without one, acceptance activates the\n * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are\n * explicit because they initiate method-specific work.\n */\nexport const UserInvitationApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.\n  // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary\n  // (a direct API caller can't seed a blank profile name).\n  firstName: z.string().trim().min(1).max(50),\n  lastName: z.string().trim().min(1).max(50),\n  password: z.string().optional(),\n  credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),\n});\n\nexport type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;\n\n/**\n * POST /auth/invitation/reject — API contract.\n */\nexport const UserInvitationRejectApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  rejectionReason: z.string().max(500).optional(),\n});\n\nexport type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Email Verification API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/verify-email — API contract.\n * Token and email are extracted from URL query parameters on the frontend.\n * Email is required for defense-in-depth constant-time comparison against token metadata.\n */\nexport const EmailVerifyDtoSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\nexport type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;\n"]}
+{"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,8FAA8F;IAC9F,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACzC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACV,CAAC;AAWX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8EAA8E;IAC9E,gFAAgF;IAChF,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC","sourcesContent":["/**\n * User Registration — Shared DTO Schemas\n *\n * Single source of truth for user registration validation.\n * Used by both frontend (AutomatedForm component) and backend (req.body parsing).\n */\n\nimport { z } from 'zod';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\nimport { AuthMethod } from './authentication.shared.schemas';\n\n// ═══════════════════════════════════════════════════════════════\n// Registration Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/register — registration form fields.\n * Used as:\n * - Frontend: AutomatedForm schema (all 5 fields rendered)\n * - Backend: req.body parsing (minus confirmPassword)\n *\n * confirmPassword is a frontend-only field for client-side match validation.\n * The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n.\n * The .isPassword() decorator tells FormField to render password inputs.\n */\nexport const UserRegisterFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n  }),\n  firstName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  /** W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. */\n  organizationName: z.string().min(1).max(200).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n  }).optional(),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\n\nexport type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;\n\n/**\n * POST /auth/register — API contract (what goes over the wire).\n * Backend uses this for req.body parsing.\n * confirmPassword is NOT sent to the backend.\n */\nexport const UserRegisterApiDtoSchema = z.object({\n  email: z.email().toLowerCase(),\n  firstName: z.string().min(1).max(50),\n  lastName: z.string().min(1).max(50),\n  password: z.string().min(1).optional(),\n  /** W6.2: Org name when orgNameSource is 'ask'. */\n  organizationName: z.string().min(1).max(200).optional(),\n  /**\n   * How the registrant will authenticate afterwards (#463). Absent ⇒ PASSWORD, so a client that\n   * predates password-less signup keeps working unchanged.\n   *\n   * Typed as the whole `AuthMethod` vocabulary rather than a narrowed subset, deliberately: the set\n   * a given application accepts is `registration.allowedMethods`, which is per user type and\n   * authored, and duplicating a narrower list here would be a second place for it to drift. A method\n   * this application does not allow is refused by the service with the allowed set in the message,\n   * which is a better answer than a schema rejection that cannot say what IS allowed.\n   */\n  method: z.enum(AuthMethod).optional(),\n});\n\n\nexport type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Invitation Acceptance DTOs\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/invitation/accept — public invitation-acceptance form fields.\n *\n * The invitation token identifies the target invitation. Name/password fields are optional\n * because an existing invited user may only need to confirm the invitation, while a new\n * invited user can provide profile/password data in the same flow.\n *\n * confirmPassword is frontend-only and excluded from the API DTO.\n */\nexport const UserInvitationFormDtoSchema = z.object({\n  // Required, mirroring registration: the invitee establishes their identity at acceptance, and\n  // the profile seed keys on non-empty first+last (UserProfileSchema requires both).\n  // `.regex(/\\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS\n  // (\"  \" has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`\n  // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,\n  // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the\n  // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is\n  // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).\n  firstName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  password: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\nexport type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;\n\n/**\n * The first-factor credential the invitee chooses to establish at acceptance.\n *\n * The invitation-accept endpoint supports exactly three establishment paths (SSO-managed\n * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):\n * - `PASSWORD` — set a password now. When both `credentialMethod` and\n *   `password` are omitted, intentionally activate with no local credential;\n *   another configured authentication method can establish later sessions.\n * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the\n *   session is established when the invitee clicks it.\n * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps\n *   the session and the passkey is registered as the go-forward credential.\n */\nexport const INVITATION_ACCEPT_CREDENTIAL_METHODS = [\n  AuthMethod.PASSWORD,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.PASSKEY,\n] as const;\n\n/**\n * The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-\n * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are\n * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and\n * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift\n * wider than the wire contract it is fed from.\n */\nexport type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];\n\n/**\n * POST /auth/invitation/accept — API contract.\n *\n * `credentialMethod` is optional by design. When absent, a provided `password`\n * establishes a password credential; without one, acceptance activates the\n * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are\n * explicit because they initiate method-specific work.\n */\nexport const UserInvitationApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.\n  // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary\n  // (a direct API caller can't seed a blank profile name).\n  firstName: z.string().trim().min(1).max(50),\n  lastName: z.string().trim().min(1).max(50),\n  password: z.string().optional(),\n  credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),\n});\n\nexport type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;\n\n/**\n * POST /auth/invitation/reject — API contract.\n */\nexport const UserInvitationRejectApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  rejectionReason: z.string().max(500).optional(),\n});\n\nexport type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Email Verification API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/verify-email — API contract.\n * Token and email are extracted from URL query parameters on the frontend.\n * Email is required for defense-in-depth constant-time comparison against token metadata.\n */\nexport const EmailVerifyDtoSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\nexport type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;\n"]}

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-organization-unit-mapping.shared.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;iBAKjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0GAA0G;AAC1G,MAAM,MAAM,oCAAoC,GAAG;IACjD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,gCAAgC,EAAE,GAAG,IAAI,CAAC;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEhI;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACzC,OAAO,EAAE,SAAS,gCAAgC,EAAE,GAAG,SAAS,GAAG,IAAI,GACtE,MAAM,GAAG,SAAS,CAKpB;AAED,qDAAqD;AACrD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAM,kCAAkC,GAAG;IAC/C,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,yCAAyC,CACvD,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,GAC5D,kCAAkC,CAUpC"}
+{"version":3,"file":"scim-organization-unit-mapping.shared.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;iBAKjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0GAA0G;AAC1G,MAAM,MAAM,oCAAoC,GAAG;IACjD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,gCAAgC,EAAE,GAAG,IAAI,CAAC;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEhI;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACzC,OAAO,EAAE,SAAS,gCAAgC,EAAE,GAAG,SAAS,GAAG,IAAI,GACtE,MAAM,GAAG,SAAS,CAKpB;AAED,qDAAqD;AACrD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAM,kCAAkC,GAAG;IAC/C,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,yCAAyC,CACvD,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,GAC5D,kCAAkC,CAUpC"}