@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts

@@ -4,7 +4,7 @@
  * Core authentication schemas shared between frontend and backend
  */
 import { z } from 'zod';
-import { AuthMethod, AuthFactorLevel, AuthNextStep, AuthSessionPurpose, AuthScopeType } from './authentication.shared.schemas';
+import { AuthMethod, AuthFactorLevel, AuthNextStep, AuthSessionPurpose, AuthScopeType, SsoConnectionType } from './authentication.shared.schemas';
 import { SessionType } from '../../runtime/execution-context.shared.schemas';
 /**
  * Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,
@@ -34,7 +34,8 @@ export declare const AuthInvitationInfoResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -88,7 +89,8 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -112,7 +114,8 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -222,13 +225,25 @@ export declare const TOTPAuthRequestSchema: z.ZodObject<{
 /**
  * SMS OTP Authentication (First or second factor)
  */
+/**
+ * Verifying an SMS one-time code.
+ *
+ * There is deliberately NO `phoneNumber` here. One was accepted — optional, E.164-shaped — and read
+ * by nothing: the code is matched by the session's account and the session id, and the destination
+ * was always resolved from the account. Its only effect was that the value a CALLER supplied was
+ * written into both audit rows as though it were the number the code went to, so a caller could
+ * attribute their own attempts to a number that was never involved. An audit trail whose subject
+ * chooses what it says about them is not attributable.
+ *
+ * No first-party client ever sent it — the engine's own `SmsOtpAuthMethod` calls
+ * `handleMfaVerify(sessionId, method, code)` — so removing it takes nothing away from a caller.
+ */
 export declare const SMSOTPAuthRequestSchema: z.ZodObject<{
     sessionId: z.ZodString;
     rememberMe: z.ZodDefault<z.ZodBoolean>;
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
     method: z.ZodLiteral<AuthMethod.SMS_OTP>;
     factorLevel: z.ZodUnion<readonly [z.ZodLiteral<AuthFactorLevel.FIRST>, z.ZodLiteral<AuthFactorLevel.SECOND>]>;
-    phoneNumber: z.ZodOptional<z.ZodString>;
     token: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /**
@@ -265,6 +280,22 @@ export declare const PasskeyAuthRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"public-key">;
     }, z.core.$strip>;
 }, z.core.$strip>;
+/**
+ * The longest deep link an emailed sign-in link carries. A longer same-origin path is dropped, not refused.
+ */
+export declare const MAX_CARRIED_AUTH_REDIRECT_LENGTH = 2048;
+/**
+ * Decide whether a request's post-auth deep link rides an emailed sign-in link (#1014) — shared by the
+ * magic-link send, the invitation accept and password-less registration (#1086), the requests that email one.
+ *
+ * Kept only when it is a same-origin path by {@link isSameOriginRedirectPath} (the one predicate every
+ * auth redirect answers through) and no longer than {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}; otherwise
+ * `undefined`. An absolute or foreign value would turn a trusted application email into an open redirect
+ * that fires right after the person proves who they are. Dropping rather than a 400 — for the length too —
+ * keeps the request's answer identical for every redirect (the send's anti-enumeration contract), and a
+ * person whose redirect was dropped still signs in, at the application home.
+ */
+export declare function carriedAuthRedirect(value: string | undefined): string | undefined;
 /**
  * Magic Link Send Request — triggers a magic link email to the user.
  * Separate from the main AuthenticationRequestSchema because it doesn't
@@ -273,6 +304,7 @@ export declare const PasskeyAuthRequestSchema: z.ZodObject<{
 export declare const MagicLinkSendRequestSchema: z.ZodObject<{
     email: z.ZodEmail;
     organizationId: z.ZodOptional<z.ZodString>;
+    redirect: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string, string>>;
 }, z.core.$strip>;
 /**
  * Magic Link Verify Request — verifies the token from the magic link.
@@ -347,7 +379,6 @@ export declare const AuthenticationRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
     method: z.ZodLiteral<AuthMethod.SMS_OTP>;
     factorLevel: z.ZodUnion<readonly [z.ZodLiteral<AuthFactorLevel.FIRST>, z.ZodLiteral<AuthFactorLevel.SECOND>]>;
-    phoneNumber: z.ZodOptional<z.ZodString>;
     token: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     sessionId: z.ZodString;
@@ -414,6 +445,7 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
     user: z.ZodOptional<z.ZodObject<{
         _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>>>>;
+        emailVerifiedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
         status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").UserStatus>>>>>>;
         appRoles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_APP_ROLES>, z.ZodString]>>>>>;
         userTypes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
@@ -440,10 +472,10 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
                 sms: z.ZodDefault<z.ZodBoolean>;
                 inApp: z.ZodDefault<z.ZodBoolean>;
             }, z.core.$strip>>>;
-            privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
-                dataProcessingConsent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").DataProcessingConsent>>>;
-                privacyLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").PrivacyLevel>>>;
-            }, z.core.$strip>>>;
+            privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
+                consentedPurposes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("../..").ConsentPurpose>>>>>;
+                consentDecidedAt: z.ZodOptional<z.ZodDate>;
+            }, z.core.$strip>>>>;
             ui: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
                 theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").UserTheme>>>;
             }, z.core.$strip>>>;
@@ -462,7 +494,7 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
         }, z.core.$strip>>;
         organizationMembers: z.ZodOptional<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
             _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
             userEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>>>>>;
             organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
             roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>>>>;
@@ -490,7 +522,8 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -518,6 +551,7 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
     retryAllowed: z.ZodDefault<z.ZodBoolean>;
     remainingAttempts: z.ZodOptional<z.ZodNumber>;
     lockoutUntil: z.ZodOptional<z.ZodDate>;
+    passkeyCredentialUnknown: z.ZodOptional<z.ZodBoolean>;
     challengeData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     redirectUrl: z.ZodOptional<z.ZodURL>;
 }, z.core.$strip>;
@@ -543,6 +577,19 @@ export declare const MFASetupResponseSchema: z.ZodObject<{
 /**
  * Authentication Session State
  */
+/**
+ * Something an account owes before a parked sign-in may complete (#1374).
+ *
+ * `ONBOARDING_PENDING` used to mean exactly one thing — the organization named at onboarding — and could not carry
+ * a second. Each member is derived from durable state, has its own step and completion door, and has its own
+ * "can this ever finish?" answer, so one unfulfillable obligation never strands an account that owes another.
+ */
+export declare enum OnboardingObligation {
+    /** The organization the user type names at onboarding (`pendingOrgType` names its type). */
+    ORGANIZATION = "organization",
+    /** The person's first and last name, when the user type collects them at onboarding. */
+    PROFILE_NAMES = "profile_names"
+}
 export declare enum AuthenticationSessionState {
     CREATED = "CREATED",// Session created, waiting for identification
     IDENTIFIED = "IDENTIFIED",// User identified, methods available
@@ -552,17 +599,41 @@ export declare enum AuthenticationSessionState {
     SECOND_FACTOR_IN_PROGRESS = "SECOND_FACTOR_IN_PROGRESS",// Second factor in progress
     COMPLETED = "COMPLETED",// Authentication completed successfully
     PASSWORD_EXPIRED = "PASSWORD_EXPIRED",// W2.2: Password expired, must change before token issuance
-    REGISTERED = "REGISTERED",// Account created, email verification pending/deferred
+    REGISTERED = "REGISTERED",// Invitation acceptance's correlation session (audit id only); self-registration creates none since #1010
     EMAIL_VERIFIED = "EMAIL_VERIFIED",// Email confirmed, checking MFA requirements
     MFA_ENROLLMENT_REQUIRED = "MFA_ENROLLMENT_REQUIRED",// MFA enrollment needed before tokens can be issued
     MFA_ENROLLMENT_GRACE = "MFA_ENROLLMENT_GRACE",// Within grace period — tokens issued with mfaGraceExpiresAt claim
-    ONBOARDING_PENDING = "ONBOARDING_PENDING",// Auth complete, guidance/onboarding steps remain
+    ONBOARDING_PENDING = "ONBOARDING_PENDING",// Auth complete, the organization named at onboarding is still owed — reached by the registration pipeline AND, since #1091, by a login of an account that owes one
     FAILED = "FAILED",// Authentication failed
     EXPIRED = "EXPIRED",// Session expired
     LOCKED = "LOCKED"
 }
 /** W4.2: Session purpose — drives UI rendering and valid state transitions. */
 export declare const AuthSessionPurposeSchema: z.ZodEnum<typeof AuthSessionPurpose>;
+/**
+ * #1103 — what a FEDERATED sign-in (OAuth2 / OIDC callback, SAML ACS) established about itself, carried on the
+ * session it was parked on when the account still owed its organization at onboarding.
+ *
+ * A federated sign-in that completes at once records `USER_SSO_LOGIN` with this evidence on the spot. A parked
+ * one signs nobody in yet, so the record waits for the onboarding completion that does — and without this object
+ * that completion could only record a generic login, losing which provider and connection proved the identity
+ * and the provider MFA assurance verdict (a `WARNED` verdict exists nowhere else once the callback has returned).
+ * The auth source is not stored: it follows from the proved factor (`ORG_SAML` is SAML, the other federated
+ * methods are OIDC).
+ */
+export declare const FederatedSignInEvidenceSchema: z.ZodObject<{
+    providerRef: z.ZodString;
+    connectionType: z.ZodEnum<typeof SsoConnectionType>;
+    scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
+    assurance: z.ZodOptional<z.ZodObject<{
+        decision: z.ZodEnum<typeof import("../..").ExternalAssuranceDecision>;
+        reason: z.ZodEnum<typeof import("../..").ExternalAssuranceReason>;
+        enforcement: z.ZodEnum<typeof import("../..").ExternalAssuranceEnforcement>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type FederatedSignInEvidence = z.infer<typeof FederatedSignInEvidenceSchema>;
 /**
  * Authentication Session Schema
  * Tracks the complete state of an authentication session
@@ -581,8 +652,22 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
     nextStep: z.ZodOptional<z.ZodEnum<typeof AuthNextStep>>;
     mfaGraceExpiresAt: z.ZodOptional<z.ZodString>;
     pendingOrgType: z.ZodOptional<z.ZodString>;
+    pendingObligations: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof OnboardingObligation>>>;
+    federatedSignIn: z.ZodOptional<z.ZodObject<{
+        providerRef: z.ZodString;
+        connectionType: z.ZodEnum<typeof SsoConnectionType>;
+        scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+        organizationId: z.ZodOptional<z.ZodString>;
+        applicationId: z.ZodOptional<z.ZodString>;
+        assurance: z.ZodOptional<z.ZodObject<{
+            decision: z.ZodEnum<typeof import("../..").ExternalAssuranceDecision>;
+            reason: z.ZodEnum<typeof import("../..").ExternalAssuranceReason>;
+            enforcement: z.ZodEnum<typeof import("../..").ExternalAssuranceEnforcement>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     availableEnrollmentMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
     completedFactors: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+    passkeyUserVerified: z.ZodOptional<z.ZodBoolean>;
     currentFactor: z.ZodOptional<z.ZodEnum<typeof AuthFactorLevel>>;
     availableFirstFactorMethods: z.ZodDefault<z.ZodArray<z.ZodObject<{
         method: z.ZodEnum<typeof AuthMethod>;
@@ -590,7 +675,8 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -613,7 +699,8 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -659,6 +746,15 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
  * Identify step form DTO — user enters email to discover auth methods.
  * Used by the public auth page's first step.
  */
+/**
+ * The sign-in identification form.
+ *
+ * The email field renders `autocomplete="username webauthn"`: `webauthn` is what lets the browser offer
+ * the person's passkeys for this site in the field's autofill list (conditional mediation), so they can
+ * sign in by picking an account instead of typing an email and choosing a method.
+ *
+ * spec-cite: https://web.dev/articles/passkey-form-autofill — the username input requires `autocomplete="username webauthn"`: "Include both `username` and `webauthn` as space-separated values."
+ */
 export declare const AuthIdentifyFormDtoSchema: z.ZodObject<{
     email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>;
 }, z.core.$strip>;
@@ -713,6 +809,22 @@ export declare const PhoneEnrollmentVerifyFormDtoSchema: z.ZodObject<{
 export declare const TotpEnrollmentVerifyFormDtoSchema: z.ZodObject<{
     code: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * `POST /auth/token/exchange` — the answer when the one-time code parked a FEDERATED sign-in at organization
+ * onboarding instead of signing it in (#1103).
+ *
+ * An OAuth2 / OIDC callback or a SAML ACS for an account that still owes its organization (#1091) opens an
+ * authentication session at `ONBOARDING_PENDING` and puts THAT in the exchange code rather than tokens. Redeeming
+ * the code answers with the session to complete on the organization-onboarding step, and nothing else: no access
+ * token, and no refresh cookie. Deliberately a SEPARATE schema from `TokenExchangeResponseSchema`, whose strict
+ * signed-in shape the docs site also parses: a handoff code redeemed there can never be parked, and widening that
+ * shape would make every receiver narrow for a case only the SaaS frontend meets.
+ */
+export declare const TokenExchangeOrganizationOnboardingResponseSchema: z.ZodObject<{
+    nextStep: z.ZodLiteral<AuthNextStep.ONBOARDING>;
+    sessionId: z.ZodString;
+}, z.core.$strict>;
+export type TokenExchangeOrganizationOnboardingResponse = z.infer<typeof TokenExchangeOrganizationOnboardingResponseSchema>;
 /**
  * One-off session token exchange response.
  *

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EAEd,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8B3C,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;iBAKlC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6CvC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,uDAAuD;IACtG,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,kDAAkD;IAGjG,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+FtC,CAAC;AAWH;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}
+{"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8B3C,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBAIlC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIjF;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;iBAWrC,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsDvC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,oBAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,YAAY,iBAAiB;IAC7B,wFAAwF;IACxF,aAAa,kBAAkB;CAChC;AAED,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,0GAA0G;IACzJ,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,oKAAoK;IAGnN,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6ItC,CAAC;AAWH;;;GAGG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iDAAiD;;;kBAG5D,CAAC;AAEH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/esm/security/authentications/authentication.shared.dto.schemas.js

@@ -5,11 +5,13 @@
  */
 import { z } from 'zod';
 import { UserContextSchema } from '../../users/users.shared.schemas.js';
-import { AuthMethod, AuthFactorLevel, AuthNextStep, AuthSessionPurpose, AuthScopeType, AvailableMethodSchema, } from './authentication.shared.schemas.js';
+import { AuthMethod, AuthFactorLevel, AuthNextStep, AuthSessionPurpose, AuthScopeType, AvailableMethodSchema, SsoConnectionType, } from './authentication.shared.schemas.js';
+import { ExternalAssuranceAssessmentSchema } from '../../external-providers/provider-authentication-assurance.shared.schemas.js';
 import { AuthUtils } from './authentication.shared.utils.js';
+import { isSameOriginRedirectPath } from './same-origin-redirect-path.shared.js';
 import { SessionType } from '../../runtime/execution-context.shared.schemas.js';
 import { PasswordPolicyRulesSchema } from '../../config/app-configuration-shared.shared.schemas.js';
-import { AutocompleteFieldIdentifier, ZodTypeForColors } from '@wildo-ai/zod-decorators';
+import { AutocompleteFieldIdentifier, ZodTypeForColors, AutocompleteModifier } from '@wildo-ai/zod-decorators';
 /**
  * Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,
  * from the invitation token alone, which first-factor auth methods the target
@@ -165,10 +167,22 @@ export const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({
 /**
  * SMS OTP Authentication (First or second factor)
  */
+/**
+ * Verifying an SMS one-time code.
+ *
+ * There is deliberately NO `phoneNumber` here. One was accepted — optional, E.164-shaped — and read
+ * by nothing: the code is matched by the session's account and the session id, and the destination
+ * was always resolved from the account. Its only effect was that the value a CALLER supplied was
+ * written into both audit rows as though it were the number the code went to, so a caller could
+ * attribute their own attempts to a number that was never involved. An audit trail whose subject
+ * chooses what it says about them is not attributable.
+ *
+ * No first-party client ever sent it — the engine's own `SmsOtpAuthMethod` calls
+ * `handleMfaVerify(sessionId, method, code)` — so removing it takes nothing away from a caller.
+ */
 export const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({
     method: z.literal(AuthMethod.SMS_OTP),
     factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),
-    phoneNumber: z.string().regex(/^\+?[1-9]\d{1,14}$/).optional(),
     token: z.string().regex(/^\d{4,8}$/).optional()
 });
 /**
@@ -203,6 +217,26 @@ export const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({
 // ===============================
 // MAGIC LINK SCHEMAS (Phase G2)
 // ===============================
+/**
+ * The longest deep link an emailed sign-in link carries. A longer same-origin path is dropped, not refused.
+ */
+export const MAX_CARRIED_AUTH_REDIRECT_LENGTH = 2048;
+/**
+ * Decide whether a request's post-auth deep link rides an emailed sign-in link (#1014) — shared by the
+ * magic-link send, the invitation accept and password-less registration (#1086), the requests that email one.
+ *
+ * Kept only when it is a same-origin path by {@link isSameOriginRedirectPath} (the one predicate every
+ * auth redirect answers through) and no longer than {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}; otherwise
+ * `undefined`. An absolute or foreign value would turn a trusted application email into an open redirect
+ * that fires right after the person proves who they are. Dropping rather than a 400 — for the length too —
+ * keeps the request's answer identical for every redirect (the send's anti-enumeration contract), and a
+ * person whose redirect was dropped still signs in, at the application home.
+ */
+export function carriedAuthRedirect(value) {
+    return value !== undefined && value.length <= MAX_CARRIED_AUTH_REDIRECT_LENGTH && isSameOriginRedirectPath(value)
+        ? value
+        : undefined;
+}
 /**
  * Magic Link Send Request — triggers a magic link email to the user.
  * Separate from the main AuthenticationRequestSchema because it doesn't
@@ -211,6 +245,14 @@ export const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({
 export const MagicLinkSendRequestSchema = z.object({
     email: z.email().toLowerCase(),
     organizationId: z.string().optional(),
+    /**
+     * The deep link the person asked for a magic link from (`/login?redirect=/deals/42`), carried into the
+     * emailed URL so signing in lands there, including through an MFA detour (#1014).
+     *
+     * {@link carriedAuthRedirect} decides it: kept only when it is a same-origin path no longer than
+     * {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}, otherwise DROPPED — never refused.
+     */
+    redirect: z.string().optional().transform(carriedAuthRedirect),
 });
 /**
  * Magic Link Verify Request — verifies the token from the magic link.
@@ -315,6 +357,15 @@ export const AuthenticationResponseSchema = z.object({
     retryAllowed: z.boolean().default(true),
     remainingAttempts: z.number().optional(),
     lockoutUntil: z.date().optional(),
+    /**
+     * PASSKEY only: the relying party holds no credential with the presented id for the account the
+     * assertion names (also answered when that account does not exist, so it discloses nothing).
+     *
+     * The one passkey refusal a client should act on: it may call
+     * `PublicKeyCredential.signalUnknownCredential({ rpId, credentialId })` so the browser stops offering a
+     * passkey this application deleted. Never set for a signature, user-verification or counter refusal.
+     */
+    passkeyCredentialUnknown: z.boolean().optional(),
     // Method-specific data
     challengeData: z.record(z.string(), z.any()).optional(),
     redirectUrl: z.url().optional()
@@ -344,6 +395,20 @@ export const MFASetupResponseSchema = z.object({
 /**
  * Authentication Session State
  */
+/**
+ * Something an account owes before a parked sign-in may complete (#1374).
+ *
+ * `ONBOARDING_PENDING` used to mean exactly one thing — the organization named at onboarding — and could not carry
+ * a second. Each member is derived from durable state, has its own step and completion door, and has its own
+ * "can this ever finish?" answer, so one unfulfillable obligation never strands an account that owes another.
+ */
+export var OnboardingObligation;
+(function (OnboardingObligation) {
+    /** The organization the user type names at onboarding (`pendingOrgType` names its type). */
+    OnboardingObligation["ORGANIZATION"] = "organization";
+    /** The person's first and last name, when the user type collects them at onboarding. */
+    OnboardingObligation["PROFILE_NAMES"] = "profile_names";
+})(OnboardingObligation || (OnboardingObligation = {}));
 export var AuthenticationSessionState;
 (function (AuthenticationSessionState) {
     // Login flow states
@@ -368,6 +433,27 @@ export var AuthenticationSessionState;
 })(AuthenticationSessionState || (AuthenticationSessionState = {}));
 /** W4.2: Session purpose — drives UI rendering and valid state transitions. */
 export const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);
+/**
+ * #1103 — what a FEDERATED sign-in (OAuth2 / OIDC callback, SAML ACS) established about itself, carried on the
+ * session it was parked on when the account still owed its organization at onboarding.
+ *
+ * A federated sign-in that completes at once records `USER_SSO_LOGIN` with this evidence on the spot. A parked
+ * one signs nobody in yet, so the record waits for the onboarding completion that does — and without this object
+ * that completion could only record a generic login, losing which provider and connection proved the identity
+ * and the provider MFA assurance verdict (a `WARNED` verdict exists nowhere else once the callback has returned).
+ * The auth source is not stored: it follows from the proved factor (`ORG_SAML` is SAML, the other federated
+ * methods are OIDC).
+ */
+export const FederatedSignInEvidenceSchema = z.object({
+    providerRef: z.string().min(1),
+    connectionType: z.enum(SsoConnectionType),
+    /** The connection's scope, for an enterprise connection. */
+    scopeType: z.enum(AuthScopeType).optional(),
+    organizationId: z.string().optional(),
+    applicationId: z.string().optional(),
+    /** The provider MFA assurance verdict the callback assessed. Absent where no assessment runs (SAML). */
+    assurance: ExternalAssuranceAssessmentSchema.optional(),
+});
 /**
  * Authentication Session Schema
  * Tracks the complete state of an authentication session
@@ -397,10 +483,33 @@ export const AuthenticationSessionSchema = z.object({
     mfaGraceExpiresAt: z.string().optional(),
     /** W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. */
     pendingOrgType: z.string().optional(),
+    /**
+     * Every obligation still owed before this parked session may sign in (#1374). Present on an
+     * `ONBOARDING_PENDING` session; each member is discharged by its own completion door, and the session
+     * mints only once none remain. Re-derived from durable state at every parking and after every
+     * completion, so it is a projection, never the record.
+     */
+    pendingObligations: z.array(z.enum(OnboardingObligation)).optional(),
+    /** #1103: the federated sign-in this session was parked for — recorded as its USER_SSO_LOGIN when onboarding completes. */
+    federatedSignIn: FederatedSignInEvidenceSchema.optional(),
     /** W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). */
     availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),
     // Authentication flow state
     completedFactors: z.array(z.enum(AuthMethod)).default([]),
+    /**
+     * Whether the authenticator LOCALLY VERIFIED the person in this session's passkey ceremony (#1248).
+     *
+     * Persisted because it is the difference between a passkey that proved one factor and one that
+     * proved two, and nothing else on the session records it — `completedFactors` says PASSKEY either
+     * way. The MFA decision reads the flag transiently at sign-in; an ID token is minted long
+     * afterwards, from the session, so without this the token could not carry the distinction its own
+     * acceptance asks for.
+     *
+     * Absent means no passkey ceremony completed on this session, or one completed without user
+     * verification. Those are deliberately not distinguished: neither proves the activation, and a
+     * relying party reading `amr` needs to know only whether it happened.
+     */
+    passkeyUserVerified: z.boolean().optional(),
     currentFactor: z.enum(AuthFactorLevel).optional(),
     // Available methods
     availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),
@@ -408,10 +517,31 @@ export const AuthenticationSessionSchema = z.object({
     // MFA requirements
     requiresMFA: z.boolean().default(false),
     mfaMethodsRequired: z.number().default(1),
+    /**
+     * What the user has ENROLLED — factors that took a deliberate setup act. **Empty means nothing is
+     * set up**, and that is the question this field answers; ask `usableSecondFactorMethods` instead
+     * for "can a challenge run".
+     *
+     * It used to carry `AuthMethod.EMAIL_OTP` unconditionally, so it was never empty and could not
+     * answer its own question. Callers that branch on "has this user got a second factor" must read
+     * this; callers that branch on "is there a challenge to render" must not.
+     */
     enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),
-    /** Intersection of availableSecondFactorMethods and enrolledSecondFactorMethods — methods the user can actually use for MFA challenge. */
+    /**
+     * Intersection of `availableSecondFactorMethods` (what the policy accepts) with what the user can
+     * PRESENT — enrolled ∪ the factors that need no enrollment. **Not** an intersection with
+     * `enrolledSecondFactorMethods`, which this said until the two concepts were separated: a user
+     * whose only accepted factor is email OTP has enrolled nothing and can still complete a challenge.
+     *
+     * This is the field every "where do I send this user" decision reads.
+     */
     usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),
-    /** When true, EMAIL_OTP alone is insufficient — requires TOTP, Passkey, or SMS_OTP. */
+    /**
+     * When true, the factors that need no enrollment are excluded from the accepted set — see
+     * `AuthUtils.getAlwaysAvailableSecondFactorMethods()`, which is the one place that list lives.
+     * (Today that is `EMAIL_OTP`; this doc named the complement by hand and would have gone stale the
+     * day a second such factor appeared.)
+     */
     requireStrongMFA: z.boolean().default(false),
     // Session metadata
     createdAt: z.date(),
@@ -461,9 +591,18 @@ export const AuthenticationSessionSchema = z.object({
  * Identify step form DTO — user enters email to discover auth methods.
  * Used by the public auth page's first step.
  */
+/**
+ * The sign-in identification form.
+ *
+ * The email field renders `autocomplete="username webauthn"`: `webauthn` is what lets the browser offer
+ * the person's passkeys for this site in the field's autofill list (conditional mediation), so they can
+ * sign in by picking an account instead of typing an email and choosing a method.
+ *
+ * spec-cite: https://web.dev/articles/passkey-form-autofill — the username input requires `autocomplete="username webauthn"`: "Include both `username` and `webauthn` as space-separated values."
+ */
 export const AuthIdentifyFormDtoSchema = z.object({
     email: z.email().toLowerCase().stringUI({
-        edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },
+        edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME, autoCompleteModifier: AutocompleteModifier.WEBAUTHN },
     }),
 });
 /**
@@ -531,6 +670,21 @@ export const PhoneEnrollmentVerifyFormDtoSchema = z.object({
 export const TotpEnrollmentVerifyFormDtoSchema = z.object({
     code: withOneTimeCodeAutocomplete(z.string().min(6).max(6).regex(/^\d+$/).isOtp({ maxLength: 6 })),
 });
+/**
+ * `POST /auth/token/exchange` — the answer when the one-time code parked a FEDERATED sign-in at organization
+ * onboarding instead of signing it in (#1103).
+ *
+ * An OAuth2 / OIDC callback or a SAML ACS for an account that still owes its organization (#1091) opens an
+ * authentication session at `ONBOARDING_PENDING` and puts THAT in the exchange code rather than tokens. Redeeming
+ * the code answers with the session to complete on the organization-onboarding step, and nothing else: no access
+ * token, and no refresh cookie. Deliberately a SEPARATE schema from `TokenExchangeResponseSchema`, whose strict
+ * signed-in shape the docs site also parses: a handoff code redeemed there can never be parked, and widening that
+ * shape would make every receiver narrow for a case only the SaaS frontend meets.
+ */
+export const TokenExchangeOrganizationOnboardingResponseSchema = z.strictObject({
+    nextStep: z.literal(AuthNextStep.ONBOARDING),
+    sessionId: z.string().min(1),
+});
 /**
  * One-off session token exchange response.
  *