@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/security/authentications/registration.shared.dto.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAM7D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAoBpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;iBAkBnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;iBAqBtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,2EAIvC,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC;AAErG;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;iBASrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"registration.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAEhG,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAO7D;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,yFAG5C,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,uEAAuE;AACvE,MAAM,WAAW,kCAAkC;IACjD,6GAA6G;IAC7G,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IAClE,4FAA4F;IAC5F,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,qGAAqG;IACrG,QAAQ,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC;CACxD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iCAAiC,CAC/C,iBAAiB,EAAE,SAAS,wBAAwB,EAAE,GAAG,SAAS,EAClE,SAAS,EAAE,0BAA0B,GAAG,SAAS,GAChD,kCAAkC,CAsBpC;AAED,eAAO,MAAM,yBAAyB;;;;;;;iBAoBpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;iBAuDnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;iBAqBtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,2EAIvC,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC;AAErG;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAgBrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAoBlE;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC;;iBAI9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;GAGG;AACH,eAAO,MAAM,0CAA0C;;;iBAGrD,CAAC;AAEH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC;;;;iBAIhD,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;iBAAsE,CAAC;AAElH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/esm/security/authentications/registration.shared.dto.schemas.js

@@ -7,6 +7,7 @@
 import { z } from 'zod';
 import { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';
 import { AuthMethod } from './authentication.shared.schemas.js';
+import { carriedAuthRedirect } from './authentication.shared.dto.schemas.js';
 // ═══════════════════════════════════════════════════════════════
 // Registration Form + API DTO
 // ═══════════════════════════════════════════════════════════════
@@ -21,6 +22,56 @@ import { AuthMethod } from './authentication.shared.schemas.js';
  * (not here) because the error message needs i18n.
  * The .isPassword() decorator tells FormField to render password inputs.
  */
+/**
+ * Answers to the extra profile questions a user type declares for sign-up (#1371).
+ *
+ * Keyed by the question's `id`, valued by the scalar kinds a bindable question can produce. It is
+ * NOT a free-form bag: the server validates every key against the resolved user type's own
+ * `registration.additionalProfileQuestions` and refuses anything undeclared, so a client cannot use
+ * it to write a profile field the application never asked about.
+ */
+export const RegistrationProfileAnswersSchema = z.record(z.string().min(1), z.union([z.string(), z.number(), z.boolean()]));
+/**
+ * Reconcile submitted sign-up answers against the questions the user type actually declares (#1371).
+ *
+ * Shared rather than written in the controller, because the FORM builds its fields from the same
+ * declaration: one function decides what a question means, so the screen and the server cannot
+ * disagree about which answers are legitimate.
+ *
+ * ## Undeclared keys are REFUSED, not dropped
+ *
+ * Dropping would make `profileAnswers` a silent no-op for a client that names a field the
+ * application never asked about — and silence is exactly how a write reaches a place nobody
+ * intended. Refusing keeps the transport a projection of the declaration rather than a door onto
+ * the profile.
+ *
+ * ## An empty string is not an answer
+ *
+ * A required question submitted as `''` is MISSING, not answered. Without that, a required question
+ * is satisfied by a field the person tabbed through, which is the opposite of what `required` means.
+ */
+export function resolveRegistrationProfileAnswers(declaredQuestions, submitted) {
+    const questions = declaredQuestions ?? [];
+    const answers = submitted ?? {};
+    const byId = new Map(questions.map((question) => [question.id, question]));
+    const undeclaredQuestionIds = Object.keys(answers).filter((id) => !byId.has(id));
+    const profileFields = {};
+    const missingRequiredQuestionIds = [];
+    for (const question of questions) {
+        const value = answers[question.id];
+        const isAnswered = value !== undefined && value !== '';
+        if (!isAnswered) {
+            if (question.required)
+                missingRequiredQuestionIds.push(question.id);
+            continue;
+        }
+        // `bindToField` is guaranteed by the config schema, which refuses a sign-up question without
+        // one. Guarded anyway: this function is exported and a caller may hold a hand-built list.
+        if (question.bindToField)
+            profileFields[question.bindToField] = value;
+    }
+    return { profileFields, undeclaredQuestionIds, missingRequiredQuestionIds };
+}
 export const UserRegisterFormDtoSchema = z.object({
     email: z.email().toLowerCase().stringUI({
         edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },
@@ -49,8 +100,13 @@ export const UserRegisterFormDtoSchema = z.object({
  */
 export const UserRegisterApiDtoSchema = z.object({
     email: z.email().toLowerCase(),
-    firstName: z.string().min(1).max(50),
-    lastName: z.string().min(1).max(50),
+    /**
+     * Optional on the WIRE because a user type may collect the names at onboarding instead (#1374,
+     * `ProfileNamesCollectionMoment.ONBOARDING`). Whether they are required is decided per user type by the
+     * registration service — a `REGISTRATION`-moment user type is refused without them, exactly as before.
+     */
+    firstName: z.string().min(1).max(50).optional(),
+    lastName: z.string().min(1).max(50).optional(),
     password: z.string().min(1).optional(),
     /** W6.2: Org name when orgNameSource is 'ask'. */
     organizationName: z.string().min(1).max(200).optional(),
@@ -65,6 +121,38 @@ export const UserRegisterApiDtoSchema = z.object({
      * which is a better answer than a schema rejection that cannot say what IS allowed.
      */
     method: z.enum(AuthMethod).optional(),
+    /**
+     * Which governed-document releases the registrant AFFIRMATIVELY accepted (issue #54).
+     *
+     * Release IDS only, and the asymmetry is the security property: the client supplies WHETHER a box
+     * was ticked, and the SERVER supplies everything else. It resolves the in-force releases from
+     * `compliance.governedDocumentReleases`, matches these ids against them, and records the matches.
+     * An id naming nothing in force is ignored rather than refused — a stale form is a stale form, and
+     * a registration is not the place to fail on one. So a caller cannot choose which VERSION of the
+     * terms they accepted, cannot invent a release, and cannot accept a document the application does
+     * not publish.
+     *
+     * Absent ⇒ nothing was accepted, which is what a client predating this field means and also what a
+     * registrant who ticked nothing means. Those two are deliberately the same answer: the record says
+     * what was accepted, never what was refused.
+     */
+    acceptedGovernedDocumentReleaseIds: z.array(z.string().min(1)).max(20).optional(),
+    /**
+     * The deep link the registration screen was opened with, carried into the emailed sign-in link of a
+     * PASSWORD-LESS signup (#1086) — the one register outcome that signs the person in on another page.
+     * Decided by {@link carriedAuthRedirect}, the same rule as the magic-link send and the invitation accept:
+     * kept only when same-origin and within bounds, otherwise dropped, never refused.
+     */
+    redirect: z.string().optional().transform(carriedAuthRedirect),
+    /**
+     * Answers to the user type's declared sign-up profile questions (#1371), keyed by question id.
+     *
+     * Validated SERVER-SIDE against that user type's own declaration — an undeclared key is refused
+     * rather than ignored, so this cannot become a door onto arbitrary profile fields. The form half
+     * is built at render time, because the questions are runtime configuration and a module-scope Zod
+     * object cannot carry a field per application.
+     */
+    profileAnswers: RegistrationProfileAnswersSchema.optional(),
 });
 // ═══════════════════════════════════════════════════════════════
 // Invitation Acceptance DTOs
@@ -135,6 +223,13 @@ export const UserInvitationApiDtoSchema = z.object({
     lastName: z.string().trim().min(1).max(50),
     password: z.string().optional(),
     credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),
+    /**
+     * The deep link the invitation was opened with, carried into the emailed link when `credentialMethod` is
+     * `MAGIC_LINK` (#1014) — the one accept outcome that signs the invitee in on another page. Decided by
+     * {@link carriedAuthRedirect}, the same rule as the magic-link send: kept only when same-origin and within
+     * bounds, otherwise dropped, never refused.
+     */
+    redirect: z.string().optional().transform(carriedAuthRedirect),
 });
 /**
  * POST /auth/invitation/reject — API contract.
@@ -155,4 +250,56 @@ export const EmailVerifyDtoSchema = z.object({
     token: z.string().min(1),
     email: z.email().toLowerCase(),
 });
+// ═══════════════════════════════════════════════════════════════
+// Organization Onboarding Form + API DTO
+// ═══════════════════════════════════════════════════════════════
+/**
+ * The characters an organization name may not contain. Markup delimiters, quotes and code punctuation are
+ * refused so a name renders as text wherever it is shown. One definition, so the onboarding form refuses
+ * exactly what `POST /auth/onboarding/complete-org` refuses.
+ */
+const ORGANIZATION_NAME_DISALLOWED_CHARACTERS = /^[^<>"'`;{}()\\]+$/;
+/**
+ * An organization name, as onboarding accepts it: trimmed FIRST, so a whitespace-only name fails `min(1)` at
+ * the boundary rather than trimming to empty after it. The ONE definition — the form and the API contract
+ * below both use it, so the form refuses exactly what `POST /auth/onboarding/complete-org` refuses.
+ */
+const OnboardingOrganizationNameSchema = z.string().trim().min(1).max(200).regex(ORGANIZATION_NAME_DISALLOWED_CHARACTERS);
+/**
+ * POST /auth/onboarding/complete-org — the organization-name step (#1090).
+ *
+ * Shown to an account whose authentication session is parked at `ONBOARDING_PENDING`: after registration, email
+ * verification or enrollment when its user type names its organization at onboarding, or after a sign-in answered
+ * `nextStep: onboarding` because the account still owes one (#1091). The frontend AutomatedForm schema; the API
+ * contract below adds the session id.
+ */
+export const OrganizationOnboardingFormDtoSchema = z.object({
+    organizationName: OnboardingOrganizationNameSchema.stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },
+    }),
+});
+/**
+ * POST /auth/onboarding/complete-org — API contract. `sessionId` is the parked session the answer that led
+ * here carried; it is what authorizes the completion, and the completion consumes it.
+ */
+export const OrganizationOnboardingCompleteApiDtoSchema = z.object({
+    sessionId: z.string().min(1),
+    organizationName: OnboardingOrganizationNameSchema,
+});
+/**
+ * POST /auth/onboarding/complete-profile — API contract (#1374). Discharges
+ * `OnboardingObligation.PROFILE_NAMES` on the parked session: the person's first and last name, collected after
+ * the address and credential were proven. Same bounds as the sign-up form's name fields, and trimmed, so a name
+ * of spaces is refused rather than stored.
+ */
+export const ProfileOnboardingCompleteApiDtoSchema = z.object({
+    sessionId: z.string().min(1),
+    firstName: z.string().trim().min(1).max(50),
+    lastName: z.string().trim().min(1).max(50),
+});
+/**
+ * The onboarding step's names form (#1374) — the sign-up form's own two name fields, so the same bounds and the
+ * same autocomplete hints apply wherever the names are asked.
+ */
+export const ProfileOnboardingFormDtoSchema = UserRegisterFormDtoSchema.pick({ firstName: true, lastName: true });
 //# sourceMappingURL=registration.shared.dto.schemas.js.map

package/dist/esm/security/authentications/registration.shared.dto.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,8FAA8F;IAC9F,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACzC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACV,CAAC;AAWX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8EAA8E;IAC9E,gFAAgF;IAChF,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC","sourcesContent":["/**\n * User Registration — Shared DTO Schemas\n *\n * Single source of truth for user registration validation.\n * Used by both frontend (AutomatedForm component) and backend (req.body parsing).\n */\n\nimport { z } from 'zod';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\nimport { AuthMethod } from './authentication.shared.schemas';\n\n// ═══════════════════════════════════════════════════════════════\n// Registration Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/register — registration form fields.\n * Used as:\n * - Frontend: AutomatedForm schema (all 5 fields rendered)\n * - Backend: req.body parsing (minus confirmPassword)\n *\n * confirmPassword is a frontend-only field for client-side match validation.\n * The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n.\n * The .isPassword() decorator tells FormField to render password inputs.\n */\nexport const UserRegisterFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n  }),\n  firstName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  /** W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. */\n  organizationName: z.string().min(1).max(200).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n  }).optional(),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\n\nexport type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;\n\n/**\n * POST /auth/register — API contract (what goes over the wire).\n * Backend uses this for req.body parsing.\n * confirmPassword is NOT sent to the backend.\n */\nexport const UserRegisterApiDtoSchema = z.object({\n  email: z.email().toLowerCase(),\n  firstName: z.string().min(1).max(50),\n  lastName: z.string().min(1).max(50),\n  password: z.string().min(1).optional(),\n  /** W6.2: Org name when orgNameSource is 'ask'. */\n  organizationName: z.string().min(1).max(200).optional(),\n  /**\n   * How the registrant will authenticate afterwards (#463). Absent ⇒ PASSWORD, so a client that\n   * predates password-less signup keeps working unchanged.\n   *\n   * Typed as the whole `AuthMethod` vocabulary rather than a narrowed subset, deliberately: the set\n   * a given application accepts is `registration.allowedMethods`, which is per user type and\n   * authored, and duplicating a narrower list here would be a second place for it to drift. A method\n   * this application does not allow is refused by the service with the allowed set in the message,\n   * which is a better answer than a schema rejection that cannot say what IS allowed.\n   */\n  method: z.enum(AuthMethod).optional(),\n});\n\n\nexport type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Invitation Acceptance DTOs\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/invitation/accept — public invitation-acceptance form fields.\n *\n * The invitation token identifies the target invitation. Name/password fields are optional\n * because an existing invited user may only need to confirm the invitation, while a new\n * invited user can provide profile/password data in the same flow.\n *\n * confirmPassword is frontend-only and excluded from the API DTO.\n */\nexport const UserInvitationFormDtoSchema = z.object({\n  // Required, mirroring registration: the invitee establishes their identity at acceptance, and\n  // the profile seed keys on non-empty first+last (UserProfileSchema requires both).\n  // `.regex(/\\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS\n  // (\"  \" has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`\n  // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,\n  // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the\n  // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is\n  // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).\n  firstName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  password: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\nexport type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;\n\n/**\n * The first-factor credential the invitee chooses to establish at acceptance.\n *\n * The invitation-accept endpoint supports exactly three establishment paths (SSO-managed\n * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):\n * - `PASSWORD` — set a password now. When both `credentialMethod` and\n *   `password` are omitted, intentionally activate with no local credential;\n *   another configured authentication method can establish later sessions.\n * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the\n *   session is established when the invitee clicks it.\n * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps\n *   the session and the passkey is registered as the go-forward credential.\n */\nexport const INVITATION_ACCEPT_CREDENTIAL_METHODS = [\n  AuthMethod.PASSWORD,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.PASSKEY,\n] as const;\n\n/**\n * The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-\n * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are\n * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and\n * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift\n * wider than the wire contract it is fed from.\n */\nexport type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];\n\n/**\n * POST /auth/invitation/accept — API contract.\n *\n * `credentialMethod` is optional by design. When absent, a provided `password`\n * establishes a password credential; without one, acceptance activates the\n * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are\n * explicit because they initiate method-specific work.\n */\nexport const UserInvitationApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.\n  // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary\n  // (a direct API caller can't seed a blank profile name).\n  firstName: z.string().trim().min(1).max(50),\n  lastName: z.string().trim().min(1).max(50),\n  password: z.string().optional(),\n  credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),\n});\n\nexport type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;\n\n/**\n * POST /auth/invitation/reject — API contract.\n */\nexport const UserInvitationRejectApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  rejectionReason: z.string().max(500).optional(),\n});\n\nexport type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Email Verification API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/verify-email — API contract.\n * Token and email are extracted from URL query parameters on the frontend.\n * Email is required for defense-in-depth constant-time comparison against token metadata.\n */\nexport const EmailVerifyDtoSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\nexport type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;\n"]}
+{"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/C,CAAC;AAaF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,iBAAkE,EAClE,SAAiD;IAEjD,MAAM,SAAS,GAAG,iBAAiB,IAAI,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,SAAS,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,aAAa,GAA8C,EAAE,CAAC;IACpE,MAAM,0BAA0B,GAAa,EAAE,CAAC;IAEhD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;QACvD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,CAAC,QAAQ;gBAAE,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,6FAA6F;QAC7F,0FAA0F;QAC1F,IAAI,QAAQ,CAAC,WAAW;YAAE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;;;;;;;;OAcG;IACH,kCAAkC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjF;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;IAC9D;;;;;;;OAOG;IACH,cAAc,EAAE,gCAAgC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,8FAA8F;IAC9F,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACzC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACV,CAAC;AAWX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8EAA8E;IAC9E,gFAAgF;IAChF,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;IACzE;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAIH,kEAAkE;AAClE,yCAAyC;AACzC,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,uCAAuC,GAAW,oBAAoB,CAAC;AAE7E;;;;GAIG;AACH,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAE1H;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,gBAAgB,EAAE,gCAAgC,CAAC,QAAQ,CAAC;QAC1D,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC;CACH,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gBAAgB,EAAE,gCAAgC;CACnD,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC","sourcesContent":["/**\n * User Registration — Shared DTO Schemas\n *\n * Single source of truth for user registration validation.\n * Used by both frontend (AutomatedForm component) and backend (req.body parsing).\n */\n\nimport { z } from 'zod';\nimport type { OnboardingSurveyQuestion } from '../../config/frontend/onboarding.shared.schemas';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\nimport { AuthMethod } from './authentication.shared.schemas';\nimport { carriedAuthRedirect } from './authentication.shared.dto.schemas';\n\n// ═══════════════════════════════════════════════════════════════\n// Registration Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/register — registration form fields.\n * Used as:\n * - Frontend: AutomatedForm schema (all 5 fields rendered)\n * - Backend: req.body parsing (minus confirmPassword)\n *\n * confirmPassword is a frontend-only field for client-side match validation.\n * The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n.\n * The .isPassword() decorator tells FormField to render password inputs.\n */\n/**\n * Answers to the extra profile questions a user type declares for sign-up (#1371).\n *\n * Keyed by the question's `id`, valued by the scalar kinds a bindable question can produce. It is\n * NOT a free-form bag: the server validates every key against the resolved user type's own\n * `registration.additionalProfileQuestions` and refuses anything undeclared, so a client cannot use\n * it to write a profile field the application never asked about.\n */\nexport const RegistrationProfileAnswersSchema = z.record(\n  z.string().min(1),\n  z.union([z.string(), z.number(), z.boolean()]),\n);\nexport type RegistrationProfileAnswers = z.infer<typeof RegistrationProfileAnswersSchema>;\n\n/** What the declaration made of the answers a registrant submitted. */\nexport interface ResolvedRegistrationProfileAnswers {\n  /** Profile FIELD → value, ready to ride the composition seed. Keyed by `bindToField`, not by question id. */\n  readonly profileFields: Record<string, string | number | boolean>;\n  /** Submitted keys this user type never declared. Non-empty means the payload is refused. */\n  readonly undeclaredQuestionIds: readonly string[];\n  /** Declared-and-required questions with no usable answer. Non-empty means the payload is refused. */\n  readonly missingRequiredQuestionIds: readonly string[];\n}\n\n/**\n * Reconcile submitted sign-up answers against the questions the user type actually declares (#1371).\n *\n * Shared rather than written in the controller, because the FORM builds its fields from the same\n * declaration: one function decides what a question means, so the screen and the server cannot\n * disagree about which answers are legitimate.\n *\n * ## Undeclared keys are REFUSED, not dropped\n *\n * Dropping would make `profileAnswers` a silent no-op for a client that names a field the\n * application never asked about — and silence is exactly how a write reaches a place nobody\n * intended. Refusing keeps the transport a projection of the declaration rather than a door onto\n * the profile.\n *\n * ## An empty string is not an answer\n *\n * A required question submitted as `''` is MISSING, not answered. Without that, a required question\n * is satisfied by a field the person tabbed through, which is the opposite of what `required` means.\n */\nexport function resolveRegistrationProfileAnswers(\n  declaredQuestions: readonly OnboardingSurveyQuestion[] | undefined,\n  submitted: RegistrationProfileAnswers | undefined,\n): ResolvedRegistrationProfileAnswers {\n  const questions = declaredQuestions ?? [];\n  const answers = submitted ?? {};\n  const byId = new Map(questions.map((question) => [question.id, question]));\n\n  const undeclaredQuestionIds = Object.keys(answers).filter((id) => !byId.has(id));\n  const profileFields: Record<string, string | number | boolean> = {};\n  const missingRequiredQuestionIds: string[] = [];\n\n  for (const question of questions) {\n    const value = answers[question.id];\n    const isAnswered = value !== undefined && value !== '';\n    if (!isAnswered) {\n      if (question.required) missingRequiredQuestionIds.push(question.id);\n      continue;\n    }\n    // `bindToField` is guaranteed by the config schema, which refuses a sign-up question without\n    // one. Guarded anyway: this function is exported and a caller may hold a hand-built list.\n    if (question.bindToField) profileFields[question.bindToField] = value;\n  }\n\n  return { profileFields, undeclaredQuestionIds, missingRequiredQuestionIds };\n}\n\nexport const UserRegisterFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n  }),\n  firstName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  /** W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. */\n  organizationName: z.string().min(1).max(200).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n  }).optional(),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\n\nexport type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;\n\n/**\n * POST /auth/register — API contract (what goes over the wire).\n * Backend uses this for req.body parsing.\n * confirmPassword is NOT sent to the backend.\n */\nexport const UserRegisterApiDtoSchema = z.object({\n  email: z.email().toLowerCase(),\n  /**\n   * Optional on the WIRE because a user type may collect the names at onboarding instead (#1374,\n   * `ProfileNamesCollectionMoment.ONBOARDING`). Whether they are required is decided per user type by the\n   * registration service — a `REGISTRATION`-moment user type is refused without them, exactly as before.\n   */\n  firstName: z.string().min(1).max(50).optional(),\n  lastName: z.string().min(1).max(50).optional(),\n  password: z.string().min(1).optional(),\n  /** W6.2: Org name when orgNameSource is 'ask'. */\n  organizationName: z.string().min(1).max(200).optional(),\n  /**\n   * How the registrant will authenticate afterwards (#463). Absent ⇒ PASSWORD, so a client that\n   * predates password-less signup keeps working unchanged.\n   *\n   * Typed as the whole `AuthMethod` vocabulary rather than a narrowed subset, deliberately: the set\n   * a given application accepts is `registration.allowedMethods`, which is per user type and\n   * authored, and duplicating a narrower list here would be a second place for it to drift. A method\n   * this application does not allow is refused by the service with the allowed set in the message,\n   * which is a better answer than a schema rejection that cannot say what IS allowed.\n   */\n  method: z.enum(AuthMethod).optional(),\n  /**\n   * Which governed-document releases the registrant AFFIRMATIVELY accepted (issue #54).\n   *\n   * Release IDS only, and the asymmetry is the security property: the client supplies WHETHER a box\n   * was ticked, and the SERVER supplies everything else. It resolves the in-force releases from\n   * `compliance.governedDocumentReleases`, matches these ids against them, and records the matches.\n   * An id naming nothing in force is ignored rather than refused — a stale form is a stale form, and\n   * a registration is not the place to fail on one. So a caller cannot choose which VERSION of the\n   * terms they accepted, cannot invent a release, and cannot accept a document the application does\n   * not publish.\n   *\n   * Absent ⇒ nothing was accepted, which is what a client predating this field means and also what a\n   * registrant who ticked nothing means. Those two are deliberately the same answer: the record says\n   * what was accepted, never what was refused.\n   */\n  acceptedGovernedDocumentReleaseIds: z.array(z.string().min(1)).max(20).optional(),\n  /**\n   * The deep link the registration screen was opened with, carried into the emailed sign-in link of a\n   * PASSWORD-LESS signup (#1086) — the one register outcome that signs the person in on another page.\n   * Decided by {@link carriedAuthRedirect}, the same rule as the magic-link send and the invitation accept:\n   * kept only when same-origin and within bounds, otherwise dropped, never refused.\n   */\n  redirect: z.string().optional().transform(carriedAuthRedirect),\n  /**\n   * Answers to the user type's declared sign-up profile questions (#1371), keyed by question id.\n   *\n   * Validated SERVER-SIDE against that user type's own declaration — an undeclared key is refused\n   * rather than ignored, so this cannot become a door onto arbitrary profile fields. The form half\n   * is built at render time, because the questions are runtime configuration and a module-scope Zod\n   * object cannot carry a field per application.\n   */\n  profileAnswers: RegistrationProfileAnswersSchema.optional(),\n});\n\n\nexport type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Invitation Acceptance DTOs\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/invitation/accept — public invitation-acceptance form fields.\n *\n * The invitation token identifies the target invitation. Name/password fields are optional\n * because an existing invited user may only need to confirm the invitation, while a new\n * invited user can provide profile/password data in the same flow.\n *\n * confirmPassword is frontend-only and excluded from the API DTO.\n */\nexport const UserInvitationFormDtoSchema = z.object({\n  // Required, mirroring registration: the invitee establishes their identity at acceptance, and\n  // the profile seed keys on non-empty first+last (UserProfileSchema requires both).\n  // `.regex(/\\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS\n  // (\"  \" has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`\n  // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,\n  // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the\n  // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is\n  // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).\n  firstName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  password: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\nexport type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;\n\n/**\n * The first-factor credential the invitee chooses to establish at acceptance.\n *\n * The invitation-accept endpoint supports exactly three establishment paths (SSO-managed\n * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):\n * - `PASSWORD` — set a password now. When both `credentialMethod` and\n *   `password` are omitted, intentionally activate with no local credential;\n *   another configured authentication method can establish later sessions.\n * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the\n *   session is established when the invitee clicks it.\n * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps\n *   the session and the passkey is registered as the go-forward credential.\n */\nexport const INVITATION_ACCEPT_CREDENTIAL_METHODS = [\n  AuthMethod.PASSWORD,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.PASSKEY,\n] as const;\n\n/**\n * The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-\n * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are\n * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and\n * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift\n * wider than the wire contract it is fed from.\n */\nexport type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];\n\n/**\n * POST /auth/invitation/accept — API contract.\n *\n * `credentialMethod` is optional by design. When absent, a provided `password`\n * establishes a password credential; without one, acceptance activates the\n * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are\n * explicit because they initiate method-specific work.\n */\nexport const UserInvitationApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.\n  // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary\n  // (a direct API caller can't seed a blank profile name).\n  firstName: z.string().trim().min(1).max(50),\n  lastName: z.string().trim().min(1).max(50),\n  password: z.string().optional(),\n  credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),\n  /**\n   * The deep link the invitation was opened with, carried into the emailed link when `credentialMethod` is\n   * `MAGIC_LINK` (#1014) — the one accept outcome that signs the invitee in on another page. Decided by\n   * {@link carriedAuthRedirect}, the same rule as the magic-link send: kept only when same-origin and within\n   * bounds, otherwise dropped, never refused.\n   */\n  redirect: z.string().optional().transform(carriedAuthRedirect),\n});\n\nexport type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;\n\n/**\n * POST /auth/invitation/reject — API contract.\n */\nexport const UserInvitationRejectApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  rejectionReason: z.string().max(500).optional(),\n});\n\nexport type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Email Verification API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/verify-email — API contract.\n * Token and email are extracted from URL query parameters on the frontend.\n * Email is required for defense-in-depth constant-time comparison against token metadata.\n */\nexport const EmailVerifyDtoSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\nexport type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Organization Onboarding Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * The characters an organization name may not contain. Markup delimiters, quotes and code punctuation are\n * refused so a name renders as text wherever it is shown. One definition, so the onboarding form refuses\n * exactly what `POST /auth/onboarding/complete-org` refuses.\n */\nconst ORGANIZATION_NAME_DISALLOWED_CHARACTERS: RegExp = /^[^<>\"'`;{}()\\\\]+$/;\n\n/**\n * An organization name, as onboarding accepts it: trimmed FIRST, so a whitespace-only name fails `min(1)` at\n * the boundary rather than trimming to empty after it. The ONE definition — the form and the API contract\n * below both use it, so the form refuses exactly what `POST /auth/onboarding/complete-org` refuses.\n */\nconst OnboardingOrganizationNameSchema = z.string().trim().min(1).max(200).regex(ORGANIZATION_NAME_DISALLOWED_CHARACTERS);\n\n/**\n * POST /auth/onboarding/complete-org — the organization-name step (#1090).\n *\n * Shown to an account whose authentication session is parked at `ONBOARDING_PENDING`: after registration, email\n * verification or enrollment when its user type names its organization at onboarding, or after a sign-in answered\n * `nextStep: onboarding` because the account still owes one (#1091). The frontend AutomatedForm schema; the API\n * contract below adds the session id.\n */\nexport const OrganizationOnboardingFormDtoSchema = z.object({\n  organizationName: OnboardingOrganizationNameSchema.stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n  }),\n});\n\nexport type OrganizationOnboardingFormDto = z.infer<typeof OrganizationOnboardingFormDtoSchema>;\n\n/**\n * POST /auth/onboarding/complete-org — API contract. `sessionId` is the parked session the answer that led\n * here carried; it is what authorizes the completion, and the completion consumes it.\n */\nexport const OrganizationOnboardingCompleteApiDtoSchema = z.object({\n  sessionId: z.string().min(1),\n  organizationName: OnboardingOrganizationNameSchema,\n});\n\nexport type OrganizationOnboardingCompleteApiDto = z.infer<typeof OrganizationOnboardingCompleteApiDtoSchema>;\n\n/**\n * POST /auth/onboarding/complete-profile — API contract (#1374). Discharges\n * `OnboardingObligation.PROFILE_NAMES` on the parked session: the person's first and last name, collected after\n * the address and credential were proven. Same bounds as the sign-up form's name fields, and trimmed, so a name\n * of spaces is refused rather than stored.\n */\nexport const ProfileOnboardingCompleteApiDtoSchema = z.object({\n  sessionId: z.string().min(1),\n  firstName: z.string().trim().min(1).max(50),\n  lastName: z.string().trim().min(1).max(50),\n});\n\nexport type ProfileOnboardingCompleteApiDto = z.infer<typeof ProfileOnboardingCompleteApiDtoSchema>;\n\n/**\n * The onboarding step's names form (#1374) — the sign-up form's own two name fields, so the same bounds and the\n * same autocomplete hints apply wherever the names are asked.\n */\nexport const ProfileOnboardingFormDtoSchema = UserRegisterFormDtoSchema.pick({ firstName: true, lastName: true });\n\nexport type ProfileOnboardingFormDto = z.infer<typeof ProfileOnboardingFormDtoSchema>;\n"]}

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.d.ts

@@ -69,23 +69,69 @@ export declare function resolveScimOrganizationUnitId(directoryValue: string | u
 export type ScimOrganizationUnitAssignment = {
     readonly _id: string;
     readonly organizationUnitId: string;
+    /**
+     * The membership side of the edge. A real junction row ALWAYS carries it; it is optional here only
+     * because the department axis never projects it, and requiring it would make every caller and pin
+     * on that axis supply a value nothing reads. Required in practice on
+     * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} — see the contract check there.
+     */
+    readonly organizationMemberId?: string;
 };
-/** The writes a push must perform to make the member's assignments match the directory. */
+/**
+ * Which side of the (member, unit) edge the directory is currently speaking about.
+ *
+ * Both SCIM paths reconcile the SAME junction and the same way — "make the edges incident to ONE
+ * anchor match exactly what the directory says" — and differ only in which node is the anchor. That
+ * is one concept seen from two sides, not two concepts, so it is one function; the axis names the
+ * side so neither call site has to re-derive the transposition.
+ */
+export declare enum ScimOrganizationUnitReconciliationAxis {
+    /** Anchored on ONE member; the units vary. The `/Users` department push (`department` → unit). */
+    MEMBER_UNITS = "member_units",
+    /** Anchored on ONE unit; the members vary. The `/Groups` membership push (`members` → memberships). */
+    UNIT_MEMBERS = "unit_members"
+}
+/** The writes a push must perform to make the anchor's assignments match the directory. */
 export type ScimOrganizationUnitReconciliation = {
-    /** Units to assign that the member does not already hold. */
-    readonly unitIdsToCreate: string[];
-    /** Assignment rows to delete — everything the directory no longer says. */
+    /**
+     * Counterparts to assign that the anchor does not already hold — unit ids on
+     * {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, organization-member ids on
+     * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS}.
+     */
+    readonly counterpartIdsToCreate: string[];
+    /** Assignment rows to delete — everything the directory no longer says, minus what it cannot speak for. */
     readonly assignmentIdsToRemove: string[];
 };
+export type ScimOrganizationUnitReconciliationOptions = {
+    /** Defaults to {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, the department push. */
+    readonly axis?: ScimOrganizationUnitReconciliationAxis;
+    /**
+     * Counterparts this push has NO authority over: neither created nor removed, whatever the directory
+     * says about them.
+     *
+     * The department push supplies the member's units that a `/Groups` push owns
+     * (`OrganizationUnit.externalSource === SCIM`). Without it the two directory paths silently fight:
+     * department reconciliation is authoritative over the member's WHOLE set, so every `/Users` push
+     * would delete the assignments `/Groups` made — and Entra sends group membership as DELTAS
+     * (`PATCH … op: Add|Remove`), so nothing would ever restore them. The member would quietly lose the
+     * group's access on their next attribute sync, which is under-privilege nobody is told about.
+     *
+     * It is NOT a general "leave this alone" hatch: an id belongs here only when ANOTHER directory-owned
+     * path is authoritative for it. A hand-made assignment is still removed, which is the documented
+     * cost of opting an organization into `organizationUnitMapping`.
+     */
+    readonly counterpartIdsOutsideAuthority?: readonly string[];
+};
 /**
- * Compute the exact writes that make a member's unit assignments match the directory.
+ * Compute the exact writes that make one anchor's unit assignments match the directory.
  *
- * Idempotent by construction: an unchanged department produces no writes at all, so a directory that
- * re-pushes every user nightly does not churn the junction table or its audit trail.
+ * Idempotent by construction: an unchanged department — or an unchanged group membership — produces
+ * no writes at all, so a directory that re-pushes everything nightly does not churn the junction
+ * table or its audit trail.
  *
- * A `desiredUnitIds` of `[]` (the directory sent no department, or one nobody mapped) removes every
- * assignment — that is the authoritative half, and it is what makes leaving a department actually
- * revoke its access.
+ * A `desiredCounterpartIds` of `[]` removes every assignment the caller has authority over. That is
+ * the authoritative half, and it is what makes leaving a department (or a group) actually revoke its
+ * access rather than accumulate it.
  */
-export declare function resolveScimOrganizationUnitReconciliation(desiredUnitIds: readonly string[], currentAssignments: readonly ScimOrganizationUnitAssignment[]): ScimOrganizationUnitReconciliation;
+export declare function resolveScimOrganizationUnitReconciliation(desiredCounterpartIds: readonly string[], currentAssignments: readonly ScimOrganizationUnitAssignment[], options?: ScimOrganizationUnitReconciliationOptions): ScimOrganizationUnitReconciliation;
 //# sourceMappingURL=scim-organization-unit-mapping.shared.d.ts.map

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-organization-unit-mapping.shared.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;iBAKjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0GAA0G;AAC1G,MAAM,MAAM,oCAAoC,GAAG;IACjD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,gCAAgC,EAAE,GAAG,IAAI,CAAC;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEhI;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACzC,OAAO,EAAE,SAAS,gCAAgC,EAAE,GAAG,SAAS,GAAG,IAAI,GACtE,MAAM,GAAG,SAAS,CAKpB;AAED,qDAAqD;AACrD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAM,kCAAkC,GAAG;IAC/C,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,yCAAyC,CACvD,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,GAC5D,kCAAkC,CAUpC"}
+{"version":3,"file":"scim-organization-unit-mapping.shared.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;iBAKjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0GAA0G;AAC1G,MAAM,MAAM,oCAAoC,GAAG;IACjD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,gCAAgC,EAAE,GAAG,IAAI,CAAC;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEhI;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACzC,OAAO,EAAE,SAAS,gCAAgC,EAAE,GAAG,SAAS,GAAG,IAAI,GACtE,MAAM,GAAG,SAAS,CAKpB;AAED,qDAAqD;AACrD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC,CAAC;AAEF;;;;;;;GAOG;AACH,oBAAY,sCAAsC;IAChD,kGAAkG;IAClG,YAAY,iBAAiB;IAC7B,uGAAuG;IACvG,YAAY,iBAAiB;CAC9B;AAED,2FAA2F;AAC3F,MAAM,MAAM,kCAAkC,GAAG;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAC1C,2GAA2G;IAC3G,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,yCAAyC,GAAG;IACtD,oGAAoG;IACpG,QAAQ,CAAC,IAAI,CAAC,EAAE,sCAAsC,CAAC;IACvD;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,yCAAyC,CACvD,qBAAqB,EAAE,SAAS,MAAM,EAAE,EACxC,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,EAC7D,OAAO,CAAC,EAAE,yCAAyC,GAClD,kCAAkC,CA8BpC"}

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.js

@@ -69,22 +69,55 @@ export function resolveScimOrganizationUnitId(directoryValue, mapping) {
     return mapping?.find((entry) => entry.directoryValue.trim() === normalizedValue)?.organizationUnitId;
 }
 /**
- * Compute the exact writes that make a member's unit assignments match the directory.
+ * Which side of the (member, unit) edge the directory is currently speaking about.
  *
- * Idempotent by construction: an unchanged department produces no writes at all, so a directory that
- * re-pushes every user nightly does not churn the junction table or its audit trail.
+ * Both SCIM paths reconcile the SAME junction and the same way — "make the edges incident to ONE
+ * anchor match exactly what the directory says" — and differ only in which node is the anchor. That
+ * is one concept seen from two sides, not two concepts, so it is one function; the axis names the
+ * side so neither call site has to re-derive the transposition.
+ */
+export var ScimOrganizationUnitReconciliationAxis;
+(function (ScimOrganizationUnitReconciliationAxis) {
+    /** Anchored on ONE member; the units vary. The `/Users` department push (`department` → unit). */
+    ScimOrganizationUnitReconciliationAxis["MEMBER_UNITS"] = "member_units";
+    /** Anchored on ONE unit; the members vary. The `/Groups` membership push (`members` → memberships). */
+    ScimOrganizationUnitReconciliationAxis["UNIT_MEMBERS"] = "unit_members";
+})(ScimOrganizationUnitReconciliationAxis || (ScimOrganizationUnitReconciliationAxis = {}));
+/**
+ * Compute the exact writes that make one anchor's unit assignments match the directory.
  *
- * A `desiredUnitIds` of `[]` (the directory sent no department, or one nobody mapped) removes every
- * assignment — that is the authoritative half, and it is what makes leaving a department actually
- * revoke its access.
+ * Idempotent by construction: an unchanged department — or an unchanged group membership — produces
+ * no writes at all, so a directory that re-pushes everything nightly does not churn the junction
+ * table or its audit trail.
+ *
+ * A `desiredCounterpartIds` of `[]` removes every assignment the caller has authority over. That is
+ * the authoritative half, and it is what makes leaving a department (or a group) actually revoke its
+ * access rather than accumulate it.
  */
-export function resolveScimOrganizationUnitReconciliation(desiredUnitIds, currentAssignments) {
-    const desired = new Set(desiredUnitIds);
-    const held = new Set(currentAssignments.map((assignment) => assignment.organizationUnitId));
+export function resolveScimOrganizationUnitReconciliation(desiredCounterpartIds, currentAssignments, options) {
+    const axis = options?.axis ?? ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS;
+    const outsideAuthority = new Set(options?.counterpartIdsOutsideAuthority ?? []);
+    const counterpartIdOf = (assignment) => {
+        if (axis === ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS)
+            return assignment.organizationUnitId;
+        // A junction row without its membership FK cannot be placed on this axis, and GUESSING would
+        // silently withhold a revocation — the one outcome this reconciliation exists to guarantee. A
+        // contract violation by the caller, so it is loud rather than absorbed.
+        if (assignment.organizationMemberId === undefined) {
+            throw new Error(`resolveScimOrganizationUnitReconciliation: assignment ${assignment._id} has no organizationMemberId, `
+                + `which ${ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} requires.`);
+        }
+        return assignment.organizationMemberId;
+    };
+    const desired = new Set(desiredCounterpartIds);
+    const held = new Set(currentAssignments.map(counterpartIdOf));
     return {
-        unitIdsToCreate: [...desired].filter((unitId) => !held.has(unitId)),
+        counterpartIdsToCreate: [...desired].filter((id) => !held.has(id) && !outsideAuthority.has(id)),
         assignmentIdsToRemove: currentAssignments
-            .filter((assignment) => !desired.has(assignment.organizationUnitId))
+            .filter((assignment) => {
+            const counterpartId = counterpartIdOf(assignment);
+            return !desired.has(counterpartId) && !outsideAuthority.has(counterpartId);
+        })
             .map((assignment) => assignment._id),
     };
 }

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-organization-unit-mapping.shared.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtC,CAAC,CAAC;AAUH;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAA+D;IACrH,OAAO,CAAC,CAAC,MAAM,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,cAAyC,EACzC,OAAuE;IAEvE,MAAM,eAAe,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,OAAO,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,kBAAkB,CAAC;AACvG,CAAC;AAgBD;;;;;;;;;GASG;AACH,MAAM,UAAU,yCAAyC,CACvD,cAAiC,EACjC,kBAA6D;IAE7D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE5F,OAAO;QACL,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnE,qBAAqB,EAAE,kBAAkB;aACtC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;aACnE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;KACvC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * SCIM directory value → organization-unit assignment (WS-C).\n *\n * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — binds a directory-declared department to\n * an organization unit, and keeps that binding authoritative rather than accumulating.\n *\n * ## What this decides, and why it is EXPLICIT rather than inferred\n *\n * An IdP pushes a flat string (`department: \"Sales\"`). Units live in a TREE where `code` is unique\n * only among siblings and `name` is freeform, so \"Sales\" can legitimately match several nodes. Since\n * units became an authorization axis, resolving that string to the wrong node does not mislabel a\n * user — it grants them the wrong data.\n *\n * So there is no fuzzy matching, no name/code search, and no auto-creation. An organization admin\n * declares the binding explicitly, unit id by unit id, and a directory value with no declared binding\n * is IGNORED. The person who owns the org chart is the one who says what \"Sales\" means; nothing here\n * guesses on their behalf.\n *\n * ## Authoritative reconciliation\n *\n * Each push replaces the member's unit assignments with exactly what the directory currently says\n * (approved decision). A user who moves Sales → Legal LOSES Sales: keeping it would be privilege\n * accretion, where access only ever grows and an offboarded department is never actually left.\n *\n * ⚠️ The consequence, stated because it is not obvious: assignments made by hand in the application\n * are ALSO removed on the next push, because SCIM is authoritative over the whole set rather than\n * over a subset it can distinguish as its own. An organization that wants manual unit assignments\n * should not enable this mapping. This is why {@link isScimOrganizationUnitManagementEnabled}\n * requires an explicit, non-empty declaration before ANY reconciliation runs — an organization that\n * never opted in can never have its assignments deleted by a push.\n */\n\nimport { z } from 'zod';\n\n/**\n * One declared binding: the directory's own value for a department, and the unit it means.\n *\n * `directoryValue` is matched EXACTLY (after trimming) against what the IdP sends. It is deliberately\n * not normalised beyond whitespace — case and punctuation are part of what a directory actually\n * pushes, and silently folding them would make two distinct departments collide onto one unit.\n */\nexport const ScimOrganizationUnitMappingEntrySchema = z.object({\n  /** The value the directory pushes, e.g. `\"Sales\"`. Matched exactly, whitespace-trimmed. */\n  directoryValue: z.string().min(1).max(200),\n  /** The `ORGANIZATION_UNITS` row this value binds to. */\n  organizationUnitId: z.string().min(1),\n});\n\nexport type ScimOrganizationUnitMappingEntry = z.infer<typeof ScimOrganizationUnitMappingEntrySchema>;\n\n/** The provisioning-config surface this module reads, kept structural so callers pass their row as-is. */\nexport type ScimOrganizationUnitManagementSignal = {\n  readonly organizationUnitMapping?: readonly ScimOrganizationUnitMappingEntry[] | null;\n  readonly defaultUnitRole?: string | null;\n};\n\n/**\n * Is this organization managing unit assignments through SCIM at all?\n *\n * Requires BOTH a non-empty mapping and a role to grant — an assignment cannot be created without a\n * role, so a mapping without one could only ever delete. That is exactly the failure mode this gate\n * exists to prevent: a half-configured row must never make a push authoritative over assignments it\n * has no way to recreate.\n */\nexport function isScimOrganizationUnitManagementEnabled(config: ScimOrganizationUnitManagementSignal | undefined | null): boolean {\n  return !!config?.defaultUnitRole && (config.organizationUnitMapping?.length ?? 0) > 0;\n}\n\n/**\n * Resolve one directory value to the unit it was declared to mean, or `undefined` when nothing\n * declares it.\n *\n * `undefined` means UNMAPPED, not \"no unit\": the caller treats an unmapped value as \"the directory\n * says nothing about units for this user\", which under authoritative reconciliation removes their\n * directory-managed assignments rather than inventing one.\n */\nexport function resolveScimOrganizationUnitId(\n  directoryValue: string | undefined | null,\n  mapping: readonly ScimOrganizationUnitMappingEntry[] | undefined | null,\n): string | undefined {\n  const normalizedValue = typeof directoryValue === 'string' ? directoryValue.trim() : '';\n  if (normalizedValue.length === 0) return undefined;\n\n  return mapping?.find((entry) => entry.directoryValue.trim() === normalizedValue)?.organizationUnitId;\n}\n\n/** An existing assignment row, read structurally. */\nexport type ScimOrganizationUnitAssignment = {\n  readonly _id: string;\n  readonly organizationUnitId: string;\n};\n\n/** The writes a push must perform to make the member's assignments match the directory. */\nexport type ScimOrganizationUnitReconciliation = {\n  /** Units to assign that the member does not already hold. */\n  readonly unitIdsToCreate: string[];\n  /** Assignment rows to delete — everything the directory no longer says. */\n  readonly assignmentIdsToRemove: string[];\n};\n\n/**\n * Compute the exact writes that make a member's unit assignments match the directory.\n *\n * Idempotent by construction: an unchanged department produces no writes at all, so a directory that\n * re-pushes every user nightly does not churn the junction table or its audit trail.\n *\n * A `desiredUnitIds` of `[]` (the directory sent no department, or one nobody mapped) removes every\n * assignment — that is the authoritative half, and it is what makes leaving a department actually\n * revoke its access.\n */\nexport function resolveScimOrganizationUnitReconciliation(\n  desiredUnitIds: readonly string[],\n  currentAssignments: readonly ScimOrganizationUnitAssignment[],\n): ScimOrganizationUnitReconciliation {\n  const desired = new Set(desiredUnitIds);\n  const held = new Set(currentAssignments.map((assignment) => assignment.organizationUnitId));\n\n  return {\n    unitIdsToCreate: [...desired].filter((unitId) => !held.has(unitId)),\n    assignmentIdsToRemove: currentAssignments\n      .filter((assignment) => !desired.has(assignment.organizationUnitId))\n      .map((assignment) => assignment._id),\n  };\n}\n"]}
+{"version":3,"file":"scim-organization-unit-mapping.shared.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtC,CAAC,CAAC;AAUH;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAA+D;IACrH,OAAO,CAAC,CAAC,MAAM,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,cAAyC,EACzC,OAAuE;IAEvE,MAAM,eAAe,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,OAAO,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,kBAAkB,CAAC;AACvG,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,sCAKX;AALD,WAAY,sCAAsC;IAChD,kGAAkG;IAClG,uEAA6B,CAAA;IAC7B,uGAAuG;IACvG,uEAA6B,CAAA;AAC/B,CAAC,EALW,sCAAsC,KAAtC,sCAAsC,QAKjD;AAmCD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yCAAyC,CACvD,qBAAwC,EACxC,kBAA6D,EAC7D,OAAmD;IAEnD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,sCAAsC,CAAC,YAAY,CAAC;IAClF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAEhF,MAAM,eAAe,GAAG,CAAC,UAA0C,EAAU,EAAE;QAC7E,IAAI,IAAI,KAAK,sCAAsC,CAAC,YAAY;YAAE,OAAO,UAAU,CAAC,kBAAkB,CAAC;QACvG,6FAA6F;QAC7F,8FAA8F;QAC9F,wEAAwE;QACxE,IAAI,UAAU,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,yDAAyD,UAAU,CAAC,GAAG,gCAAgC;kBACrG,SAAS,sCAAsC,CAAC,YAAY,YAAY,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC,oBAAoB,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAE9D,OAAO;QACL,sBAAsB,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/F,qBAAqB,EAAE,kBAAkB;aACtC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;YACrB,MAAM,aAAa,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAClD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7E,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;KACvC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * SCIM directory value → organization-unit assignment (WS-C).\n *\n * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — binds a directory-declared department to\n * an organization unit, and keeps that binding authoritative rather than accumulating.\n *\n * ## What this decides, and why it is EXPLICIT rather than inferred\n *\n * An IdP pushes a flat string (`department: \"Sales\"`). Units live in a TREE where `code` is unique\n * only among siblings and `name` is freeform, so \"Sales\" can legitimately match several nodes. Since\n * units became an authorization axis, resolving that string to the wrong node does not mislabel a\n * user — it grants them the wrong data.\n *\n * So there is no fuzzy matching, no name/code search, and no auto-creation. An organization admin\n * declares the binding explicitly, unit id by unit id, and a directory value with no declared binding\n * is IGNORED. The person who owns the org chart is the one who says what \"Sales\" means; nothing here\n * guesses on their behalf.\n *\n * ## Authoritative reconciliation\n *\n * Each push replaces the member's unit assignments with exactly what the directory currently says\n * (approved decision). A user who moves Sales → Legal LOSES Sales: keeping it would be privilege\n * accretion, where access only ever grows and an offboarded department is never actually left.\n *\n * ⚠️ The consequence, stated because it is not obvious: assignments made by hand in the application\n * are ALSO removed on the next push, because SCIM is authoritative over the whole set rather than\n * over a subset it can distinguish as its own. An organization that wants manual unit assignments\n * should not enable this mapping. This is why {@link isScimOrganizationUnitManagementEnabled}\n * requires an explicit, non-empty declaration before ANY reconciliation runs — an organization that\n * never opted in can never have its assignments deleted by a push.\n */\n\nimport { z } from 'zod';\n\n/**\n * One declared binding: the directory's own value for a department, and the unit it means.\n *\n * `directoryValue` is matched EXACTLY (after trimming) against what the IdP sends. It is deliberately\n * not normalised beyond whitespace — case and punctuation are part of what a directory actually\n * pushes, and silently folding them would make two distinct departments collide onto one unit.\n */\nexport const ScimOrganizationUnitMappingEntrySchema = z.object({\n  /** The value the directory pushes, e.g. `\"Sales\"`. Matched exactly, whitespace-trimmed. */\n  directoryValue: z.string().min(1).max(200),\n  /** The `ORGANIZATION_UNITS` row this value binds to. */\n  organizationUnitId: z.string().min(1),\n});\n\nexport type ScimOrganizationUnitMappingEntry = z.infer<typeof ScimOrganizationUnitMappingEntrySchema>;\n\n/** The provisioning-config surface this module reads, kept structural so callers pass their row as-is. */\nexport type ScimOrganizationUnitManagementSignal = {\n  readonly organizationUnitMapping?: readonly ScimOrganizationUnitMappingEntry[] | null;\n  readonly defaultUnitRole?: string | null;\n};\n\n/**\n * Is this organization managing unit assignments through SCIM at all?\n *\n * Requires BOTH a non-empty mapping and a role to grant — an assignment cannot be created without a\n * role, so a mapping without one could only ever delete. That is exactly the failure mode this gate\n * exists to prevent: a half-configured row must never make a push authoritative over assignments it\n * has no way to recreate.\n */\nexport function isScimOrganizationUnitManagementEnabled(config: ScimOrganizationUnitManagementSignal | undefined | null): boolean {\n  return !!config?.defaultUnitRole && (config.organizationUnitMapping?.length ?? 0) > 0;\n}\n\n/**\n * Resolve one directory value to the unit it was declared to mean, or `undefined` when nothing\n * declares it.\n *\n * `undefined` means UNMAPPED, not \"no unit\": the caller treats an unmapped value as \"the directory\n * says nothing about units for this user\", which under authoritative reconciliation removes their\n * directory-managed assignments rather than inventing one.\n */\nexport function resolveScimOrganizationUnitId(\n  directoryValue: string | undefined | null,\n  mapping: readonly ScimOrganizationUnitMappingEntry[] | undefined | null,\n): string | undefined {\n  const normalizedValue = typeof directoryValue === 'string' ? directoryValue.trim() : '';\n  if (normalizedValue.length === 0) return undefined;\n\n  return mapping?.find((entry) => entry.directoryValue.trim() === normalizedValue)?.organizationUnitId;\n}\n\n/** An existing assignment row, read structurally. */\nexport type ScimOrganizationUnitAssignment = {\n  readonly _id: string;\n  readonly organizationUnitId: string;\n  /**\n   * The membership side of the edge. A real junction row ALWAYS carries it; it is optional here only\n   * because the department axis never projects it, and requiring it would make every caller and pin\n   * on that axis supply a value nothing reads. Required in practice on\n   * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} — see the contract check there.\n   */\n  readonly organizationMemberId?: string;\n};\n\n/**\n * Which side of the (member, unit) edge the directory is currently speaking about.\n *\n * Both SCIM paths reconcile the SAME junction and the same way — \"make the edges incident to ONE\n * anchor match exactly what the directory says\" — and differ only in which node is the anchor. That\n * is one concept seen from two sides, not two concepts, so it is one function; the axis names the\n * side so neither call site has to re-derive the transposition.\n */\nexport enum ScimOrganizationUnitReconciliationAxis {\n  /** Anchored on ONE member; the units vary. The `/Users` department push (`department` → unit). */\n  MEMBER_UNITS = 'member_units',\n  /** Anchored on ONE unit; the members vary. The `/Groups` membership push (`members` → memberships). */\n  UNIT_MEMBERS = 'unit_members',\n}\n\n/** The writes a push must perform to make the anchor's assignments match the directory. */\nexport type ScimOrganizationUnitReconciliation = {\n  /**\n   * Counterparts to assign that the anchor does not already hold — unit ids on\n   * {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, organization-member ids on\n   * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS}.\n   */\n  readonly counterpartIdsToCreate: string[];\n  /** Assignment rows to delete — everything the directory no longer says, minus what it cannot speak for. */\n  readonly assignmentIdsToRemove: string[];\n};\n\nexport type ScimOrganizationUnitReconciliationOptions = {\n  /** Defaults to {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, the department push. */\n  readonly axis?: ScimOrganizationUnitReconciliationAxis;\n  /**\n   * Counterparts this push has NO authority over: neither created nor removed, whatever the directory\n   * says about them.\n   *\n   * The department push supplies the member's units that a `/Groups` push owns\n   * (`OrganizationUnit.externalSource === SCIM`). Without it the two directory paths silently fight:\n   * department reconciliation is authoritative over the member's WHOLE set, so every `/Users` push\n   * would delete the assignments `/Groups` made — and Entra sends group membership as DELTAS\n   * (`PATCH … op: Add|Remove`), so nothing would ever restore them. The member would quietly lose the\n   * group's access on their next attribute sync, which is under-privilege nobody is told about.\n   *\n   * It is NOT a general \"leave this alone\" hatch: an id belongs here only when ANOTHER directory-owned\n   * path is authoritative for it. A hand-made assignment is still removed, which is the documented\n   * cost of opting an organization into `organizationUnitMapping`.\n   */\n  readonly counterpartIdsOutsideAuthority?: readonly string[];\n};\n\n/**\n * Compute the exact writes that make one anchor's unit assignments match the directory.\n *\n * Idempotent by construction: an unchanged department — or an unchanged group membership — produces\n * no writes at all, so a directory that re-pushes everything nightly does not churn the junction\n * table or its audit trail.\n *\n * A `desiredCounterpartIds` of `[]` removes every assignment the caller has authority over. That is\n * the authoritative half, and it is what makes leaving a department (or a group) actually revoke its\n * access rather than accumulate it.\n */\nexport function resolveScimOrganizationUnitReconciliation(\n  desiredCounterpartIds: readonly string[],\n  currentAssignments: readonly ScimOrganizationUnitAssignment[],\n  options?: ScimOrganizationUnitReconciliationOptions,\n): ScimOrganizationUnitReconciliation {\n  const axis = options?.axis ?? ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS;\n  const outsideAuthority = new Set(options?.counterpartIdsOutsideAuthority ?? []);\n\n  const counterpartIdOf = (assignment: ScimOrganizationUnitAssignment): string => {\n    if (axis === ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS) return assignment.organizationUnitId;\n    // A junction row without its membership FK cannot be placed on this axis, and GUESSING would\n    // silently withhold a revocation — the one outcome this reconciliation exists to guarantee. A\n    // contract violation by the caller, so it is loud rather than absorbed.\n    if (assignment.organizationMemberId === undefined) {\n      throw new Error(\n        `resolveScimOrganizationUnitReconciliation: assignment ${assignment._id} has no organizationMemberId, `\n        + `which ${ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} requires.`,\n      );\n    }\n    return assignment.organizationMemberId;\n  };\n\n  const desired = new Set(desiredCounterpartIds);\n  const held = new Set(currentAssignments.map(counterpartIdOf));\n\n  return {\n    counterpartIdsToCreate: [...desired].filter((id) => !held.has(id) && !outsideAuthority.has(id)),\n    assignmentIdsToRemove: currentAssignments\n      .filter((assignment) => {\n        const counterpartId = counterpartIdOf(assignment);\n        return !desired.has(counterpartId) && !outsideAuthority.has(counterpartId);\n      })\n      .map((assignment) => assignment._id),\n  };\n}\n"]}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,eAAO,MAAM,0CAA0C,yNA6FtD,CAAC"}
+{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,eAAO,MAAM,0CAA0C,yNA0GtD,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.js

@@ -60,10 +60,11 @@ export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResou
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                 }],
         },
-        // Internal-only (INTERNAL_CALL, NO HTTP route): SCIM provisioning edits reach this through
-        // the config service path — `AuthOrganizationConfigurationService.saveScimProvisioningConfig`
-        // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC, preserving
-        // admin audit attribution. Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via
+        // Two kinds of caller reach this write and both resolve the SAME default: an administrator
+        // editing the settings pane, over the HTTP route this variant now carries; and the config
+        // service path — `AuthOrganizationConfigurationService.saveScimProvisioningConfig` dispatching
+        // via `ServicesRegistryHandler.update` with the ADMIN's EC, preserving admin audit
+        // attribution. Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via
         // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT
         // REPOSITORY_ONLY — a repository-only UPDATE throws
         // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) whenever the save
@@ -72,11 +73,23 @@ export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResou
         // config — a latent copy of the same FATAL, armed for whoever wrote the save method next.
         // (No UPDATE custom-impl to keep in lockstep: the read-only computed fields are framework-
         // driven via `.isVirtual()` on the schema, which is variant-agnostic by construction.)
-        // No public HTTP update surface (config is admin-service-owned, never self-serve). Same
-        // fix as the CREATE above + the SSO/SIEM UPDATE precedent. Admin tier / HIGH.
+        //
+        // API_CALL — the administrator's edit door, flipped from INTERNAL_CALL alongside SSO config and
+        // following SIEM export config (#953). Route-less, this policy was something only a backend
+        // service could change, which contradicts the plainest reading of a settings pane: the four
+        // decisions on this row — create users, verify their email, deactivate on deprovision, and the
+        // role they land with — are exactly what an operator opens SCIM settings to set. The comment
+        // that stood here said the config was "admin-service-owned, never self-serve"; the door is
+        // gated on ORG_ADMIN / APP super-admin, so it is not self-serve, it is admin-served.
+        //
+        // Nothing moves in lockstep with this one: the read-only computed fields are framework-driven
+        // via `.isVirtual()` on the schema, which is variant-agnostic by construction, and this resource
+        // registers no custom implementation on any operation. Hence no shared constant here, where SSO
+        // and SIEM each need one — a named source with a single reader would be ceremony.
+        // Admin tier / HIGH.
         [CoreResourceOperation.UPDATE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],