npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.5 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1032) hide show

package/dist/esm/security/authentications/authentication.shared.dto.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEzF;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,0HAA0H;IAC1H,yCAAa,CAAA;IACb,sHAAsH;IACtH,uCAAW,CAAA;IACX,8TAA8T;IAC9T,yCAAa,CAAA;AACf,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE;IACvB,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,2FAA2F;IAC3F,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3D,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAEvB,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEvD,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,oCAAoC;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,4DAA4D;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,+CAA+C;QAC/E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC,wCAAwC;IACxC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;IACxE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB;IAEhD,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qCAAqC;IACxF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,mCAAmC;CAC5F,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,oBAAoB;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACjD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;QACF,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC;AAIH,kCAAkC;AAClC,gCAAgC;AAChC,kCAAkC;AAElC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH,kCAAkC;AAClC,wCAAwC;AACxC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACpD,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACpC,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,yBAAyB;IACzB,iCAAiC;IACjC,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEzC,sEAAsE;IACtE,oEAAoE;IACpE,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEnC,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9E,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,uBAAuB;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,kCAAkC;AAClC,2BAA2B;AAC3B,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAG9D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,oBAAoB;IACpB,iDAAmB,CAAA;IACnB,uDAAyB,CAAA;IACzB,mFAAqD,CAAA;IACrD,+EAAiD,CAAA;IACjD,2DAA6B,CAAA;IAC7B,qFAAuD,CAAA;IACvD,qDAAuB,CAAA;IACvB,mEAAqC,CAAA;IAErC,mCAAmC;IACnC,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,iFAAmD,CAAA;IACnD,2EAA6C,CAAA;IAC7C,uEAAyC,CAAA;IAEzC,kBAAkB;IAClB,+CAAiB,CAAA;IACjB,iDAAmB,CAAA;IACnB,+CAAiB,CAAA,CAA8B,0CAA0C;AAC3F,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAEzC,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,gJAAgJ;IAChJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,kFAAkF;IAClF,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE5C,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAEzC,gGAAgG;IAChG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,wHAAwH;IACxH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEnE,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAEjD,oBAAoB;IACpB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAExE,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,0IAA0I;IAC1I,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE5C,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IAEtB,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,mDAAmD;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAClC,6DAA6D;AAC7D,gEAAgE;AAChE,yEAAyE;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;CACH,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,gBAAgB,EAAE;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAA+B,MAAe;IAChF,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,aAAa,EAAE;KAClE,CAAY,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAA+B,MAAe;IACxE,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,GAAG,EAAE;KACxD,CAAY,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAKH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC1D,CAAC,CAAC,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACH,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,cAAc,6CAA6C,CAAC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\nimport { UserContextSchema } from '../../users/users.shared.schemas';\nimport {\n AuthMethod,\n AuthFactorLevel,\n AuthNextStep,\n AuthSessionPurpose,\n AuthScopeType,\n AvailableMethodSchema,\n} from './authentication.shared.schemas';\nimport { AuthUtils } from './authentication.shared.utils';\nimport { SessionType } from '../../runtime/execution-context.shared.schemas';\nimport { PasswordPolicyRulesSchema } from '../../config/app-configuration-shared.shared.schemas';\nimport { AutocompleteFieldIdentifier, ZodTypeForColors } from '@wildo-ai/zod-decorators';\n\n/\n Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,\n * from the invitation token alone, which first-factor auth methods the target\n * organization allows and whether the org is SSO/SCIM-managed.\n \n Distinct from `identify()` (keyed by email→domain, requires an existing user):\n * this is token-keyed and works for a not-yet-activated invitee (INVITED\n * membership, no session). Populated by `GET /auth/invitation/info?token=…`,\n * which reads the token WITHOUT consuming it (unlike accept). See\n * `.claude/plans/invitation-multi-method-auth.md`.\n /\nexport enum InvitationManagementMode {\n /* No enterprise identity authority — invitee may set a local credential (password/passkey) or use any allowed method. /\n OPEN = 'open',\n /* Org authenticates via enterprise SSO — route the invitee to the IdP (JIT consumes the invite; no local accept). /\n SSO = 'sso',\n /* Org is ACTIVELY directory-managed (SCIM live — DIRECTORY_PROVISIONING feature + a live SCIM token) — informational only, NO local credential: a local password/passkey/magic-link would survive IdP deprovisioning. Derived per-org (not from the org-TYPE mount flag) — see `isOrgActivelyDirectoryManaged` / AUTH-23. /\n SCIM = 'scim',\n}\n\nexport const AuthInvitationInfoResponseSchema = z.object({\n /* The invitee's email (from the INVITED membership's denormalized `userEmail`). /\n inviteeEmail: z.email(),\n /* Display name of the organization the invitee is joining. /\n organizationName: z.string(),\n /* First-factor methods the org allows for a joining member of the invitee's user type. /\n availableFirstFactorMethods: z.array(AvailableMethodSchema),\n /* Identity-management posture — drives chooser (open/sso) vs informational state (scim). /\n managementMode: z.enum(InvitationManagementMode),\n /\n The org-join user type's ORG-MERGED password policy (the SAME policy the accept\n * endpoint validates against). Lets the chooser's PASSWORD form show the invitee the\n * org's REAL requirements (strength indicator + client pre-check) instead of the\n * app-level default — so an org that strengthens `passwordPolicy` via `authOverrides`\n * doesn't reject a client-accepted password after submit. Absent when the policy can't\n * be resolved (unknown user type / degraded org read); the frontend then falls back to\n * the app-level resolved policy. Structurally the frontend validation subset\n * (`PasswordPolicyRulesSchema`); the backend's `PasswordPolicyConfig` is field-identical\n * and parses through it losslessly.\n /\n passwordPolicy: PasswordPolicyRulesSchema.optional(),\n});\nexport type AuthInvitationInfoResponse = z.infer<typeof AuthInvitationInfoResponseSchema>;\n\n/\n Step 1: User identification by email\n * Returns available authentication methods for the user\n /\nexport const AuthIdentificationRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional()\n});\n\n\n\n/\n Step 1 Response: Available authentication methods with factor classification\n /\nexport const AuthIdentificationResponseSchema = z.object({\n sessionId: z.string(),\n email: z.email(),\n userExists: z.boolean(),\n\n // First factor methods (primary authentication)\n firstFactorMethods: z.array(AvailableMethodSchema),\n defaultFirstFactorMethod: z.enum(AuthMethod).optional(),\n\n // Second factor methods (MFA) - only shown if MFA is required\n secondFactorMethods: z.array(AvailableMethodSchema),\n requiresMFA: z.boolean(),\n mfaMethodsRequired: z.number().default(1),\n\n // Organization-specific information\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // Available integrations (if any auth method supports them)\n availableIntegrations: z.array(z.object({\n integrationId: z.string(),\n externalProviderId: z.string(), // Which auth provider enables this integration\n iconUrl: z.url().optional()\n })).default([]),\n});\n\n\n\n// ===============================\n// AUTHENTICATION REQUEST SCHEMAS\n// ===============================\n\n/\n Base authentication request schema with factor context\n /\nexport const BaseAuthRequestSchema = z.object({\n sessionId: z.string().min(1),\n method: z.enum(AuthMethod),\n factorLevel: z.enum(AuthFactorLevel),\n rememberMe: z.boolean().default(false),\n\n // Integration access request (optional)\n requestedIntegrations: z.array(z.string()).default([])\n});\n\n\n\n/\n Password Authentication (First factor only)\n /\nexport const PasswordAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSWORD),\n factorLevel: z.literal(AuthFactorLevel.FIRST),\n password: z.string().min(1)\n});\n\n\n\n/\n Third-Party OAuth2 Authentication (First factor, extensible)\n /\nexport const External_OAuth2_AuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EXTERNAL_OAUTH2),\n factorLevel: z.enum(AuthFactorLevel),\n externalProviderId: z.string().min(1), // References configured provider\n redirectUri: z.url(),\n state: z.string().optional(), // CSRF protection\n\n // Integration-specific parameters\n additionalScopes: z.array(z.string()).default([]), // Additional scopes for integrations\n integrationPermissions: z.array(z.string()).default([]) // Specific integration permissions\n});\n\n\n\n/\n Organization SSO Authentication (First or second factor, organization-restricted)\n /\nexport const OrganizationSSOAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.enum([AuthMethod.ORG_SAML, AuthMethod.ORG_OPENID_CONNECT]),\n factorLevel: z.enum(AuthFactorLevel),\n ssoId: z.string().min(1),\n organizationId: z.string().min(1),\n\n // SSO-specific data\n samlResponse: z.string().optional(), // For SAML\n idToken: z.string().optional(), // For OpenID Connect\n state: z.string().optional()\n});\n\n\n\n/\n OAuth2 Callback Schema (for both third-party and SSO)\n /\nexport const OAuth2CallbackSchema = z.object({\n sessionId: z.string().min(1),\n externalProviderId: z.string().optional(), // For third-party OAuth2\n ssoId: z.string().optional(), // For organization SSO\n code: z.string().min(1),\n state: z.string().optional(),\n error: z.string().optional(),\n errorDescription: z.string().optional()\n});\n\n\n\n/\n TOTP Authentication (Second factor only)\n /\nexport const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.TOTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^(\\d{6}\|[a-f0-9]{8})$/)\n});\n\n\n\n/\n SMS OTP Authentication (First or second factor)\n /\nexport const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.SMS_OTP),\n factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Email OTP Authentication (Second factor only)\n /\nexport const EmailOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EMAIL_OTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Passkey (WebAuthn) Authentication (First or second factor)\n /\nexport const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSKEY),\n factorLevel: z.enum(AuthFactorLevel),\n // WebAuthn authentication response from navigator.credentials.get()\n response: z.object({\n id: z.string(),\n rawId: z.string(),\n response: z.object({\n authenticatorData: z.string(),\n clientDataJSON: z.string(),\n signature: z.string(),\n userHandle: z.string().optional(),\n }),\n authenticatorAttachment: z.string().optional(),\n clientExtensionResults: z.record(z.string(), z.any()).default({}),\n type: z.literal('public-key'),\n }),\n});\n\n\n\n// ===============================\n// MAGIC LINK SCHEMAS (Phase G2)\n// ===============================\n\n/\n Magic Link Send Request — triggers a magic link email to the user.\n * Separate from the main AuthenticationRequestSchema because it doesn't\n * go through the standard authenticate() dispatch.\n /\nexport const MagicLinkSendRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n});\n\n\n\n\n/\n Magic Link Verify Request — verifies the token from the magic link.\n * Used by POST /auth/magic-link/verify for programmatic verification.\n * Intentionally NOT added to AuthenticationRequestSchema discriminated union\n * because magic link verification follows a separate flow (GET from email click\n * → exchange code → POST verify).\n /\nexport const MagicLinkVerifyRequestSchema = z.object({\n token: z.string().min(1),\n email: z.email().toLowerCase(),\n});\n\n\n\n\n// ===============================\n// PHONE VERIFICATION SCHEMAS (Phase G2)\n// ===============================\n\n/\n Phone Verification Send Request — triggers a verification code to a phone number.\n * Used for phone number ownership verification, separate from SMS OTP auth.\n /\nexport const PhoneVerifySendRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n});\n\n\n\n\n/\n Phone Verification Confirm Request — confirms the verification code.\n /\nexport const PhoneVerifyConfirmRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n code: z.string().regex(/^\\d{4,8}$/),\n});\n\n\n\n\n/\n Union of all authentication request types\n /\nexport const AuthenticationRequestSchema = z.discriminatedUnion('method', [\n PasswordAuthRequestSchema,\n External_OAuth2_AuthRequestSchema,\n OrganizationSSOAuthRequestSchema,\n TOTPAuthRequestSchema,\n SMSOTPAuthRequestSchema,\n EmailOTPAuthRequestSchema,\n PasskeyAuthRequestSchema\n]);\n\n\n\n/\n Authentication Response Schema with Factor Context and Integration Access.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string().optional()` which was emitted in the JSON\n * body for every authentication response. The cookie migration (A-Step 2,\n * 2026-04-13) added `Set-Cookie: __wildo_refresh=…` as a parallel\n * channel; A-Step 3 (2026-04-13) made the SaaS-frontend stop reading\n * the body field; A-Step 6 (THIS step) DROPS the body field entirely\n * so the wire response physically cannot carry the refresh token.\n \n Backend internals: the orchestrator's\n * `_buildAuthenticationSuccessMethod` returns\n * `AuthenticationServiceResult = AuthenticationResponse & { refreshToken?: string }`\n * (a backend-only TS type — NOT a wire schema) so the controller can\n * extract the refresh-token value and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`. The wire\n * payload (this schema) STILL has no `refreshToken` field — the\n * controller's helper sets the cookie and emits the body separately.\n \n `integrationTokens[].refreshToken` (below) is a third-party-IdP\n * OAuth2 refresh token (Google, Microsoft, etc.) — NOT a Wildo refresh\n * token. It stays on the wire because the frontend needs it to drive\n * IdP-side API calls; it is bound to a different security model\n * (IdP-issued, IdP-rotated, never used to mint Wildo JWTs).\n /\nexport const AuthenticationResponseSchema = z.object({\n success: z.boolean(),\n sessionId: z.string(),\n userExists: z.boolean(),\n factorLevel: z.enum(AuthFactorLevel),\n authMethod: z.enum(AuthMethod).optional(),\n\n // Success response. NOTE: `refreshToken` deliberately ABSENT from the\n // wire schema (Auth-hardening A-Step 6) — see the file/schema-level\n // JSDoc above for the cookie-only contract.\n accessToken: z.string().optional(),\n expiresIn: z.number().optional(),\n user: UserContextSchema.optional(),\n\n // Integration access tokens (if requested and granted)\n integrationTokens: z.array(z.object({\n integrationId: z.string(),\n accessToken: z.string(),\n refreshToken: z.string().optional(),\n expiresIn: z.number().optional(),\n scopes: z.array(z.string())\n })).default([]),\n\n // MFA continuation\n requiresMFA: z.boolean().default(false),\n availableMFAMethods: z.array(AvailableMethodSchema).optional(),\n mfaMethodsRequired: z.number().optional(),\n completedFactors: z.array(z.enum(AuthMethod)).optional(),\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // W4.5: MFA enrollment routing\n nextStep: z.enum(AuthNextStep).optional(),\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // Error response\n error: z.string().optional(),\n errorCode: z.string().optional(),\n retryAllowed: z.boolean().default(true),\n remainingAttempts: z.number().optional(),\n lockoutUntil: z.date().optional(),\n\n // Method-specific data\n challengeData: z.record(z.string(), z.any()).optional(),\n redirectUrl: z.url().optional()\n});\n\n\n\n// ===============================\n// MFA SETUP AND MANAGEMENT\n// ===============================\n\n/\n MFA Setup Request\n /\nexport const MFASetupRequestSchema = z.object({\n method: z.enum(AuthMethod),\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n deviceName: z.string().optional()\n}).refine((data) => AuthUtils.canBeSecondFactor(data.method));\n\n\n/\n MFA Setup Response\n /\nexport const MFASetupResponseSchema = z.object({\n method: z.enum(AuthMethod),\n setupToken: z.string(),\n qrCodeUrl: z.url().optional(),\n secret: z.string().optional(),\n challenge: z.record(z.string(), z.any()).optional(),\n recoveryCodes: z.array(z.string()).optional()\n});\n\n\n\n\n/\n Authentication Session State\n /\nexport enum AuthenticationSessionState {\n // Login flow states\n CREATED = 'CREATED', // Session created, waiting for identification\n IDENTIFIED = 'IDENTIFIED', // User identified, methods available\n FIRST_FACTOR_IN_PROGRESS = 'FIRST_FACTOR_IN_PROGRESS', // First factor authentication in progress\n FIRST_FACTOR_COMPLETED = 'FIRST_FACTOR_COMPLETED', // First factor completed\n MFA_REQUIRED = 'MFA_REQUIRED', // MFA required, waiting for second factor\n SECOND_FACTOR_IN_PROGRESS = 'SECOND_FACTOR_IN_PROGRESS', // Second factor in progress\n COMPLETED = 'COMPLETED', // Authentication completed successfully\n PASSWORD_EXPIRED = 'PASSWORD_EXPIRED', // W2.2: Password expired, must change before token issuance\n\n // W4: Registration pipeline states\n REGISTERED = 'REGISTERED', // Account created, email verification pending/deferred\n EMAIL_VERIFIED = 'EMAIL_VERIFIED', // Email confirmed, checking MFA requirements\n MFA_ENROLLMENT_REQUIRED = 'MFA_ENROLLMENT_REQUIRED', // MFA enrollment needed before tokens can be issued\n MFA_ENROLLMENT_GRACE = 'MFA_ENROLLMENT_GRACE', // Within grace period — tokens issued with mfaGraceExpiresAt claim\n ONBOARDING_PENDING = 'ONBOARDING_PENDING', // Auth complete, guidance/onboarding steps remain\n\n // Terminal states\n FAILED = 'FAILED', // Authentication failed\n EXPIRED = 'EXPIRED', // Session expired\n LOCKED = 'LOCKED' // Account locked due to too many attempts\n}\n\n/* W4.2: Session purpose — drives UI rendering and valid state transitions. /\nexport const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);\n\n/\n Authentication Session Schema\n * Tracks the complete state of an authentication session\n /\nexport const AuthenticationSessionSchema = z.object({\n sessionId: z.string(),\n state: z.enum(AuthenticationSessionState),\n\n // User identification\n email: z.email().optional(),\n userExists: z.boolean().optional(),\n userId: z.string().optional(),\n /* Trusted organization created transactionally by deferred registration onboarding. /\n organizationId: z.string().optional(),\n /\n Untrusted DNS-verified email-domain ownership hint used only to tighten SSO policy.\n * It is deliberately distinct from `organizationId`, which has trusted onboarding provenance.\n /\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n\n /* W3.5: Resolved user type for this session (from X-Frontend-Service-Name → frontendServices → userType). Drives per-user-type auth policy. /\n activeUserType: z.string().optional(),\n\n /* W4.2: Session purpose — determines valid state transitions and frontend UI. /\n purpose: AuthSessionPurposeSchema.optional(),\n\n /* W4: Next step hint for frontend routing after state transitions. /\n nextStep: z.enum(AuthNextStep).optional(),\n\n /* W4.5: ISO date when MFA grace period expires. Present when state is MFA_ENROLLMENT_GRACE. /\n mfaGraceExpiresAt: z.string().optional(),\n\n /* W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. /\n pendingOrgType: z.string().optional(),\n\n /* W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). /\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),\n\n // Authentication flow state\n completedFactors: z.array(z.enum(AuthMethod)).default([]),\n currentFactor: z.enum(AuthFactorLevel).optional(),\n\n // Available methods\n availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),\n availableSecondFactorMethods: z.array(AvailableMethodSchema).default([]),\n\n // MFA requirements\n requiresMFA: z.boolean().default(false),\n mfaMethodsRequired: z.number().default(1),\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /* Intersection of availableSecondFactorMethods and enrolledSecondFactorMethods — methods the user can actually use for MFA challenge. /\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /* When true, EMAIL_OTP alone is insufficient — requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n\n // Session metadata\n createdAt: z.date(),\n expiresAt: z.date(),\n lastActivity: z.date(),\n\n // Security tracking\n attempts: z.number().default(0),\n maxAttempts: z.number().default(5),\n lockoutUntil: z.date().optional(),\n\n // Device and context\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional(),\n\n // Integration requests\n requestedIntegrations: z.array(z.string()).default([]),\n\n // Session-specific data for ongoing flows\n challengeData: z.record(z.string(), z.any()).optional(),\n pendingRedirectUrl: z.url().optional(),\n\n // Organization branding (cached for consistent UI)\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // M1: Optimistic concurrency control version for atomic session updates\n version: z.number().default(0),\n}).superRefine((session, ctx) => {\n if ((session.scopeType === undefined) !== (session.scopeId === undefined)) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Authentication session scopeType and scopeId must be provided together',\n });\n }\n});\n\n\n\n// ===============================\n// SIMPLIFIED FORM DTOs\n// ===============================\n// Used by frontend Form components and backend body parsing.\n// These are the \"what the user fills in\" schemas — services add\n// programmatic fields (sessionId, method, factorLevel) before API calls.\n\n/\n Identify step form DTO — user enters email to discover auth methods.\n * Used by the public auth page's first step.\n /\nexport const AuthIdentifyFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n }),\n});\n\n\n\n\n/\n Login step form DTO — user enters email + password.\n * Used by the public auth page when password auth is shown.\n * The .isPassword() decorator tells FormField to render a password input.\n /\nexport const AuthLoginFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n }),\n password: z.string().min(1).isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.CURRENT_PASSWORD },\n }),\n});\n\nfunction withOneTimeCodeAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.ONE_TIME_CODE },\n }) as TSchema;\n}\n\nfunction withTelAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.TEL },\n }) as TSchema;\n}\n\n/\n MFA email OTP challenge form DTO.\n * Used by the MFA challenge screen after the email code has been sent.\n /\nexport const EmailOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA SMS OTP challenge form DTO.\n * Used by the MFA challenge screen after the SMS code has been sent.\n /\nexport const SmsOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA TOTP challenge form DTO.\n * Used by the MFA challenge screen for authenticator-app verification.\n /\nexport const TotpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n Phone enrollment start form DTO.\n * Used by the enrollment gate before sending a phone verification code.\n /\nexport const PhoneEnrollmentStartFormDtoSchema = z.object({\n phoneNumber: withTelAutocomplete(z.string().min(1)),\n});\n\n/\n Phone enrollment verification form DTO.\n * Used by the enrollment gate after a verification code has been sent.\n /\nexport const PhoneEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n TOTP enrollment verification form DTO.\n * Used after the user scans the QR code and confirms setup with a first code.\n /\nexport const TotpEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n\n\n\n/\n One-off session token exchange response.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string()` which was emitted in the JSON body. The\n * cookie migration (A-Step 2) routed the refresh token to\n * `Set-Cookie: __wildo_refresh=…`; A-Step 6 removes the body field\n * entirely so a one-off-session client receives ONLY a (short-lived)\n * access token + the cookie. The controller's\n * `_jsonSuccessWithRefreshCookie` helper sets the cookie from a\n * separately-passed argument.\n /\nexport const OneOffTokenExchangeResponseSchema = z.object({\n accessToken: z.string(),\n sessionType: z.enum(SessionType),\n consumableTokenValue: z.string().optional(),\n tokenExpiresAt: z.string().optional(),\n context: z.object({\n tokenId: z.string(),\n tokenType: z.string(),\n targeting: z.object({\n initiatorIds: z.record(z.string(), z.string()).optional(),\n }).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n userId: z.string(),\n }),\n});\n\n// Cross-frontend handoff DTO atoms (cross-app-jwt-propagation Step 2) live\n// in `./cross-frontend-handoff.shared.dto.schemas` so a browser-safe subpath\n// (`@wildo-ai/saas-models/public-runtime`) can re-export them without\n// dragging this file's full transitive web (UserContext, SessionType,\n// AuthMethod, AuthFactorLevel, AuthSessionPurpose, AuthUtils,\n// `@wildo-ai/zod-decorators`). See saas-models-public-runtime.md K-2.\nexport from './cross-frontend-handoff.shared.dto.schemas';\n\n// ===============================\n// INFERRED TYPES\n// ===============================\n\n// Authentication method types\nexport type AuthIdentificationRequest = z.infer<typeof AuthIdentificationRequestSchema>;\nexport type AuthIdentificationResponse = z.infer<typeof AuthIdentificationResponseSchema>;\n\n\n\n// Authentication request types\nexport type AuthenticationRequest = z.infer<typeof AuthenticationRequestSchema>;\nexport type AuthenticationResponse = z.infer<typeof AuthenticationResponseSchema>;\nexport type PasswordAuthRequest = z.infer<typeof PasswordAuthRequestSchema>;\nexport type External_OAuth2_AuthRequest = z.infer<typeof External_OAuth2_AuthRequestSchema>;\nexport type OrganizationSSOAuthRequest = z.infer<typeof OrganizationSSOAuthRequestSchema>;\nexport type OAuth2Callback = z.infer<typeof OAuth2CallbackSchema>;\nexport type TOTPAuthRequest = z.infer<typeof TOTPAuthRequestSchema>;\nexport type SMSOTPAuthRequest = z.infer<typeof SMSOTPAuthRequestSchema>;\nexport type EmailOTPAuthRequest = z.infer<typeof EmailOTPAuthRequestSchema>;\nexport type PasskeyAuthRequest = z.infer<typeof PasskeyAuthRequestSchema>;\n\nexport type MagicLinkSendRequest = z.infer<typeof MagicLinkSendRequestSchema>;\nexport type MagicLinkVerifyRequest = z.infer<typeof MagicLinkVerifyRequestSchema>;\n\nexport type PhoneVerifySendRequest = z.infer<typeof PhoneVerifySendRequestSchema>;\nexport type PhoneVerifyConfirmRequest = z.infer<typeof PhoneVerifyConfirmRequestSchema>;\n\n// MFA types\nexport type MFASetupRequest = z.infer<typeof MFASetupRequestSchema>;\nexport type MFASetupResponse = z.infer<typeof MFASetupResponseSchema>;\n\nexport type AuthIdentifyFormDto = z.infer<typeof AuthIdentifyFormDtoSchema>;\nexport type AuthLoginFormDto = z.infer<typeof AuthLoginFormDtoSchema>;\nexport type EmailOtpChallengeFormDto = z.infer<typeof EmailOtpChallengeFormDtoSchema>;\nexport type SmsOtpChallengeFormDto = z.infer<typeof SmsOtpChallengeFormDtoSchema>;\nexport type TotpChallengeFormDto = z.infer<typeof TotpChallengeFormDtoSchema>;\nexport type PhoneEnrollmentStartFormDto = z.infer<typeof PhoneEnrollmentStartFormDtoSchema>;\nexport type PhoneEnrollmentVerifyFormDto = z.infer<typeof PhoneEnrollmentVerifyFormDtoSchema>;\nexport type TotpEnrollmentVerifyFormDto = z.infer<typeof TotpEnrollmentVerifyFormDtoSchema>;\n\n// Session types\nexport type AuthenticationSession = z.infer<typeof AuthenticationSessionSchema>;\nexport type OneOffTokenExchangeResponse = z.infer<typeof OneOffTokenExchangeResponseSchema>;\n"]}
1	+ {"version":3,"file":"authentication.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAE/G;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,0HAA0H;IAC1H,yCAAa,CAAA;IACb,sHAAsH;IACtH,uCAAW,CAAA;IACX,8TAA8T;IAC9T,yCAAa,CAAA;AACf,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE;IACvB,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,2FAA2F;IAC3F,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3D,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAEvB,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEvD,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,oCAAoC;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,4DAA4D;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,+CAA+C;QAC/E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC,wCAAwC;IACxC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;IACxE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB;IAEhD,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qCAAqC;IACxF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,mCAAmC;CAC5F,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,oBAAoB;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACjD,CAAC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;QACF,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC;AAIH,kCAAkC;AAClC,gCAAgC;AAChC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,gCAAgC,IAAI,wBAAwB,CAAC,KAAK,CAAC;QAC/G,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH,kCAAkC;AAClC,wCAAwC;AACxC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACpD,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACpC,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,yBAAyB;IACzB,iCAAiC;IACjC,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEzC,sEAAsE;IACtE,oEAAoE;IACpE,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEnC,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9E,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;;;OAOG;IACH,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,uBAAuB;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,kCAAkC;AAClC,2BAA2B;AAC3B,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAG9D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,qDAA6B,CAAA;IAC7B,wFAAwF;IACxF,uDAA+B,CAAA;AACjC,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,oBAAoB;IACpB,iDAAmB,CAAA;IACnB,uDAAyB,CAAA;IACzB,mFAAqD,CAAA;IACrD,+EAAiD,CAAA;IACjD,2DAA6B,CAAA;IAC7B,qFAAuD,CAAA;IACvD,qDAAuB,CAAA;IACvB,mEAAqC,CAAA;IAErC,mCAAmC;IACnC,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,iFAAmD,CAAA;IACnD,2EAA6C,CAAA;IAC7C,uEAAyC,CAAA;IAEzC,kBAAkB;IAClB,+CAAiB,CAAA;IACjB,iDAAmB,CAAA;IACnB,+CAAiB,CAAA,CAA8B,0CAA0C;AAC3F,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACzC,4DAA4D;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,wGAAwG;IACxG,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAEzC,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,gJAAgJ;IAChJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,kFAAkF;IAClF,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE5C,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAEzC,gGAAgG;IAChG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEpE,2HAA2H;IAC3H,eAAe,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAEzD,wHAAwH;IACxH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEnE,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAEjD,oBAAoB;IACpB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAExE,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE5C,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IAEtB,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,mDAAmD;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAClC,6DAA6D;AAC7D,gEAAgE;AAChE,yEAAyE;AAEzE;;;GAGG;AACH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;KAClH,CAAC;CACH,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,gBAAgB,EAAE;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAA+B,MAAe;IAChF,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,aAAa,EAAE;KAClE,CAAY,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAA+B,MAAe;IACxE,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,GAAG,EAAE;KACxD,CAAY,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAKH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC1D,CAAC,CAAC,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACH,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,cAAc,6CAA6C,CAAC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\nimport { UserContextSchema } from '../../users/users.shared.schemas';\nimport {\n AuthMethod,\n AuthFactorLevel,\n AuthNextStep,\n AuthSessionPurpose,\n AuthScopeType,\n AvailableMethodSchema,\n SsoConnectionType,\n} from './authentication.shared.schemas';\nimport { ExternalAssuranceAssessmentSchema } from '../../external-providers/provider-authentication-assurance.shared.schemas';\nimport { AuthUtils } from './authentication.shared.utils';\nimport { isSameOriginRedirectPath } from './same-origin-redirect-path.shared';\nimport { SessionType } from '../../runtime/execution-context.shared.schemas';\nimport { PasswordPolicyRulesSchema } from '../../config/app-configuration-shared.shared.schemas';\nimport { AutocompleteFieldIdentifier, ZodTypeForColors, AutocompleteModifier } from '@wildo-ai/zod-decorators';\n\n/\n Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,\n * from the invitation token alone, which first-factor auth methods the target\n * organization allows and whether the org is SSO/SCIM-managed.\n \n Distinct from `identify()` (keyed by email→domain, requires an existing user):\n * this is token-keyed and works for a not-yet-activated invitee (INVITED\n * membership, no session). Populated by `GET /auth/invitation/info?token=…`,\n * which reads the token WITHOUT consuming it (unlike accept). See\n * `.claude/plans/invitation-multi-method-auth.md`.\n /\nexport enum InvitationManagementMode {\n /* No enterprise identity authority — invitee may set a local credential (password/passkey) or use any allowed method. /\n OPEN = 'open',\n /* Org authenticates via enterprise SSO — route the invitee to the IdP (JIT consumes the invite; no local accept). /\n SSO = 'sso',\n /* Org is ACTIVELY directory-managed (SCIM live — DIRECTORY_PROVISIONING feature + a live SCIM token) — informational only, NO local credential: a local password/passkey/magic-link would survive IdP deprovisioning. Derived per-org (not from the org-TYPE mount flag) — see `isOrgActivelyDirectoryManaged` / AUTH-23. /\n SCIM = 'scim',\n}\n\nexport const AuthInvitationInfoResponseSchema = z.object({\n /* The invitee's email (from the INVITED membership's denormalized `userEmail`). /\n inviteeEmail: z.email(),\n /* Display name of the organization the invitee is joining. /\n organizationName: z.string(),\n /* First-factor methods the org allows for a joining member of the invitee's user type. /\n availableFirstFactorMethods: z.array(AvailableMethodSchema),\n /* Identity-management posture — drives chooser (open/sso) vs informational state (scim). /\n managementMode: z.enum(InvitationManagementMode),\n /\n The org-join user type's ORG-MERGED password policy (the SAME policy the accept\n * endpoint validates against). Lets the chooser's PASSWORD form show the invitee the\n * org's REAL requirements (strength indicator + client pre-check) instead of the\n * app-level default — so an org that strengthens `passwordPolicy` via `authOverrides`\n * doesn't reject a client-accepted password after submit. Absent when the policy can't\n * be resolved (unknown user type / degraded org read); the frontend then falls back to\n * the app-level resolved policy. Structurally the frontend validation subset\n * (`PasswordPolicyRulesSchema`); the backend's `PasswordPolicyConfig` is field-identical\n * and parses through it losslessly.\n /\n passwordPolicy: PasswordPolicyRulesSchema.optional(),\n});\nexport type AuthInvitationInfoResponse = z.infer<typeof AuthInvitationInfoResponseSchema>;\n\n/\n Step 1: User identification by email\n * Returns available authentication methods for the user\n /\nexport const AuthIdentificationRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional()\n});\n\n\n\n/\n Step 1 Response: Available authentication methods with factor classification\n /\nexport const AuthIdentificationResponseSchema = z.object({\n sessionId: z.string(),\n email: z.email(),\n userExists: z.boolean(),\n\n // First factor methods (primary authentication)\n firstFactorMethods: z.array(AvailableMethodSchema),\n defaultFirstFactorMethod: z.enum(AuthMethod).optional(),\n\n // Second factor methods (MFA) - only shown if MFA is required\n secondFactorMethods: z.array(AvailableMethodSchema),\n requiresMFA: z.boolean(),\n mfaMethodsRequired: z.number().default(1),\n\n // Organization-specific information\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // Available integrations (if any auth method supports them)\n availableIntegrations: z.array(z.object({\n integrationId: z.string(),\n externalProviderId: z.string(), // Which auth provider enables this integration\n iconUrl: z.url().optional()\n })).default([]),\n});\n\n\n\n// ===============================\n// AUTHENTICATION REQUEST SCHEMAS\n// ===============================\n\n/\n Base authentication request schema with factor context\n /\nexport const BaseAuthRequestSchema = z.object({\n sessionId: z.string().min(1),\n method: z.enum(AuthMethod),\n factorLevel: z.enum(AuthFactorLevel),\n rememberMe: z.boolean().default(false),\n\n // Integration access request (optional)\n requestedIntegrations: z.array(z.string()).default([])\n});\n\n\n\n/\n Password Authentication (First factor only)\n /\nexport const PasswordAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSWORD),\n factorLevel: z.literal(AuthFactorLevel.FIRST),\n password: z.string().min(1)\n});\n\n\n\n/\n Third-Party OAuth2 Authentication (First factor, extensible)\n /\nexport const External_OAuth2_AuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EXTERNAL_OAUTH2),\n factorLevel: z.enum(AuthFactorLevel),\n externalProviderId: z.string().min(1), // References configured provider\n redirectUri: z.url(),\n state: z.string().optional(), // CSRF protection\n\n // Integration-specific parameters\n additionalScopes: z.array(z.string()).default([]), // Additional scopes for integrations\n integrationPermissions: z.array(z.string()).default([]) // Specific integration permissions\n});\n\n\n\n/\n Organization SSO Authentication (First or second factor, organization-restricted)\n /\nexport const OrganizationSSOAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.enum([AuthMethod.ORG_SAML, AuthMethod.ORG_OPENID_CONNECT]),\n factorLevel: z.enum(AuthFactorLevel),\n ssoId: z.string().min(1),\n organizationId: z.string().min(1),\n\n // SSO-specific data\n samlResponse: z.string().optional(), // For SAML\n idToken: z.string().optional(), // For OpenID Connect\n state: z.string().optional()\n});\n\n\n\n/\n OAuth2 Callback Schema (for both third-party and SSO)\n /\nexport const OAuth2CallbackSchema = z.object({\n sessionId: z.string().min(1),\n externalProviderId: z.string().optional(), // For third-party OAuth2\n ssoId: z.string().optional(), // For organization SSO\n code: z.string().min(1),\n state: z.string().optional(),\n error: z.string().optional(),\n errorDescription: z.string().optional()\n});\n\n\n\n/\n TOTP Authentication (Second factor only)\n /\nexport const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.TOTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^(\\d{6}\|[a-f0-9]{8})$/)\n});\n\n\n\n/\n SMS OTP Authentication (First or second factor)\n /\n/\n Verifying an SMS one-time code.\n \n There is deliberately NO `phoneNumber` here. One was accepted — optional, E.164-shaped — and read\n * by nothing: the code is matched by the session's account and the session id, and the destination\n * was always resolved from the account. Its only effect was that the value a CALLER supplied was\n * written into both audit rows as though it were the number the code went to, so a caller could\n * attribute their own attempts to a number that was never involved. An audit trail whose subject\n * chooses what it says about them is not attributable.\n \n No first-party client ever sent it — the engine's own `SmsOtpAuthMethod` calls\n * `handleMfaVerify(sessionId, method, code)` — so removing it takes nothing away from a caller.\n /\nexport const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.SMS_OTP),\n factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Email OTP Authentication (Second factor only)\n /\nexport const EmailOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EMAIL_OTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Passkey (WebAuthn) Authentication (First or second factor)\n /\nexport const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSKEY),\n factorLevel: z.enum(AuthFactorLevel),\n // WebAuthn authentication response from navigator.credentials.get()\n response: z.object({\n id: z.string(),\n rawId: z.string(),\n response: z.object({\n authenticatorData: z.string(),\n clientDataJSON: z.string(),\n signature: z.string(),\n userHandle: z.string().optional(),\n }),\n authenticatorAttachment: z.string().optional(),\n clientExtensionResults: z.record(z.string(), z.any()).default({}),\n type: z.literal('public-key'),\n }),\n});\n\n\n\n// ===============================\n// MAGIC LINK SCHEMAS (Phase G2)\n// ===============================\n\n/\n The longest deep link an emailed sign-in link carries. A longer same-origin path is dropped, not refused.\n /\nexport const MAX_CARRIED_AUTH_REDIRECT_LENGTH = 2048;\n\n/\n Decide whether a request's post-auth deep link rides an emailed sign-in link (#1014) — shared by the\n * magic-link send, the invitation accept and password-less registration (#1086), the requests that email one.\n \n Kept only when it is a same-origin path by {@link isSameOriginRedirectPath} (the one predicate every\n * auth redirect answers through) and no longer than {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}; otherwise\n * `undefined`. An absolute or foreign value would turn a trusted application email into an open redirect\n * that fires right after the person proves who they are. Dropping rather than a 400 — for the length too —\n * keeps the request's answer identical for every redirect (the send's anti-enumeration contract), and a\n * person whose redirect was dropped still signs in, at the application home.\n /\nexport function carriedAuthRedirect(value: string \| undefined): string \| undefined {\n return value !== undefined && value.length <= MAX_CARRIED_AUTH_REDIRECT_LENGTH && isSameOriginRedirectPath(value)\n ? value\n : undefined;\n}\n\n/\n Magic Link Send Request — triggers a magic link email to the user.\n * Separate from the main AuthenticationRequestSchema because it doesn't\n * go through the standard authenticate() dispatch.\n /\nexport const MagicLinkSendRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n /\n The deep link the person asked for a magic link from (`/login?redirect=/deals/42`), carried into the\n * emailed URL so signing in lands there, including through an MFA detour (#1014).\n \n {@link carriedAuthRedirect} decides it: kept only when it is a same-origin path no longer than\n * {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}, otherwise DROPPED — never refused.\n /\n redirect: z.string().optional().transform(carriedAuthRedirect),\n});\n\n\n\n\n/\n Magic Link Verify Request — verifies the token from the magic link.\n * Used by POST /auth/magic-link/verify for programmatic verification.\n * Intentionally NOT added to AuthenticationRequestSchema discriminated union\n * because magic link verification follows a separate flow (GET from email click\n * → exchange code → POST verify).\n /\nexport const MagicLinkVerifyRequestSchema = z.object({\n token: z.string().min(1),\n email: z.email().toLowerCase(),\n});\n\n\n\n\n// ===============================\n// PHONE VERIFICATION SCHEMAS (Phase G2)\n// ===============================\n\n/\n Phone Verification Send Request — triggers a verification code to a phone number.\n * Used for phone number ownership verification, separate from SMS OTP auth.\n /\nexport const PhoneVerifySendRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n});\n\n\n\n\n/\n Phone Verification Confirm Request — confirms the verification code.\n /\nexport const PhoneVerifyConfirmRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n code: z.string().regex(/^\\d{4,8}$/),\n});\n\n\n\n\n/\n Union of all authentication request types\n /\nexport const AuthenticationRequestSchema = z.discriminatedUnion('method', [\n PasswordAuthRequestSchema,\n External_OAuth2_AuthRequestSchema,\n OrganizationSSOAuthRequestSchema,\n TOTPAuthRequestSchema,\n SMSOTPAuthRequestSchema,\n EmailOTPAuthRequestSchema,\n PasskeyAuthRequestSchema\n]);\n\n\n\n/\n Authentication Response Schema with Factor Context and Integration Access.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string().optional()` which was emitted in the JSON\n * body for every authentication response. The cookie migration (A-Step 2,\n * 2026-04-13) added `Set-Cookie: __wildo_refresh=…` as a parallel\n * channel; A-Step 3 (2026-04-13) made the SaaS-frontend stop reading\n * the body field; A-Step 6 (THIS step) DROPS the body field entirely\n * so the wire response physically cannot carry the refresh token.\n \n Backend internals: the orchestrator's\n * `_buildAuthenticationSuccessMethod` returns\n * `AuthenticationServiceResult = AuthenticationResponse & { refreshToken?: string }`\n * (a backend-only TS type — NOT a wire schema) so the controller can\n * extract the refresh-token value and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`. The wire\n * payload (this schema) STILL has no `refreshToken` field — the\n * controller's helper sets the cookie and emits the body separately.\n \n `integrationTokens[].refreshToken` (below) is a third-party-IdP\n * OAuth2 refresh token (Google, Microsoft, etc.) — NOT a Wildo refresh\n * token. It stays on the wire because the frontend needs it to drive\n * IdP-side API calls; it is bound to a different security model\n * (IdP-issued, IdP-rotated, never used to mint Wildo JWTs).\n /\nexport const AuthenticationResponseSchema = z.object({\n success: z.boolean(),\n sessionId: z.string(),\n userExists: z.boolean(),\n factorLevel: z.enum(AuthFactorLevel),\n authMethod: z.enum(AuthMethod).optional(),\n\n // Success response. NOTE: `refreshToken` deliberately ABSENT from the\n // wire schema (Auth-hardening A-Step 6) — see the file/schema-level\n // JSDoc above for the cookie-only contract.\n accessToken: z.string().optional(),\n expiresIn: z.number().optional(),\n user: UserContextSchema.optional(),\n\n // Integration access tokens (if requested and granted)\n integrationTokens: z.array(z.object({\n integrationId: z.string(),\n accessToken: z.string(),\n refreshToken: z.string().optional(),\n expiresIn: z.number().optional(),\n scopes: z.array(z.string())\n })).default([]),\n\n // MFA continuation\n requiresMFA: z.boolean().default(false),\n availableMFAMethods: z.array(AvailableMethodSchema).optional(),\n mfaMethodsRequired: z.number().optional(),\n completedFactors: z.array(z.enum(AuthMethod)).optional(),\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // W4.5: MFA enrollment routing\n nextStep: z.enum(AuthNextStep).optional(),\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // Error response\n error: z.string().optional(),\n errorCode: z.string().optional(),\n retryAllowed: z.boolean().default(true),\n remainingAttempts: z.number().optional(),\n lockoutUntil: z.date().optional(),\n /\n PASSKEY only: the relying party holds no credential with the presented id for the account the\n * assertion names (also answered when that account does not exist, so it discloses nothing).\n \n The one passkey refusal a client should act on: it may call\n * `PublicKeyCredential.signalUnknownCredential({ rpId, credentialId })` so the browser stops offering a\n * passkey this application deleted. Never set for a signature, user-verification or counter refusal.\n /\n passkeyCredentialUnknown: z.boolean().optional(),\n\n // Method-specific data\n challengeData: z.record(z.string(), z.any()).optional(),\n redirectUrl: z.url().optional()\n});\n\n\n\n// ===============================\n// MFA SETUP AND MANAGEMENT\n// ===============================\n\n/\n MFA Setup Request\n /\nexport const MFASetupRequestSchema = z.object({\n method: z.enum(AuthMethod),\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n deviceName: z.string().optional()\n}).refine((data) => AuthUtils.canBeSecondFactor(data.method));\n\n\n/\n MFA Setup Response\n /\nexport const MFASetupResponseSchema = z.object({\n method: z.enum(AuthMethod),\n setupToken: z.string(),\n qrCodeUrl: z.url().optional(),\n secret: z.string().optional(),\n challenge: z.record(z.string(), z.any()).optional(),\n recoveryCodes: z.array(z.string()).optional()\n});\n\n\n\n\n/\n Authentication Session State\n /\n/\n Something an account owes before a parked sign-in may complete (#1374).\n \n `ONBOARDING_PENDING` used to mean exactly one thing — the organization named at onboarding — and could not carry\n * a second. Each member is derived from durable state, has its own step and completion door, and has its own\n * \"can this ever finish?\" answer, so one unfulfillable obligation never strands an account that owes another.\n /\nexport enum OnboardingObligation {\n /* The organization the user type names at onboarding (`pendingOrgType` names its type). /\n ORGANIZATION = 'organization',\n /* The person's first and last name, when the user type collects them at onboarding. /\n PROFILE_NAMES = 'profile_names',\n}\n\nexport enum AuthenticationSessionState {\n // Login flow states\n CREATED = 'CREATED', // Session created, waiting for identification\n IDENTIFIED = 'IDENTIFIED', // User identified, methods available\n FIRST_FACTOR_IN_PROGRESS = 'FIRST_FACTOR_IN_PROGRESS', // First factor authentication in progress\n FIRST_FACTOR_COMPLETED = 'FIRST_FACTOR_COMPLETED', // First factor completed\n MFA_REQUIRED = 'MFA_REQUIRED', // MFA required, waiting for second factor\n SECOND_FACTOR_IN_PROGRESS = 'SECOND_FACTOR_IN_PROGRESS', // Second factor in progress\n COMPLETED = 'COMPLETED', // Authentication completed successfully\n PASSWORD_EXPIRED = 'PASSWORD_EXPIRED', // W2.2: Password expired, must change before token issuance\n\n // W4: Registration pipeline states\n REGISTERED = 'REGISTERED', // Invitation acceptance's correlation session (audit id only); self-registration creates none since #1010\n EMAIL_VERIFIED = 'EMAIL_VERIFIED', // Email confirmed, checking MFA requirements\n MFA_ENROLLMENT_REQUIRED = 'MFA_ENROLLMENT_REQUIRED', // MFA enrollment needed before tokens can be issued\n MFA_ENROLLMENT_GRACE = 'MFA_ENROLLMENT_GRACE', // Within grace period — tokens issued with mfaGraceExpiresAt claim\n ONBOARDING_PENDING = 'ONBOARDING_PENDING', // Auth complete, the organization named at onboarding is still owed — reached by the registration pipeline AND, since #1091, by a login of an account that owes one\n\n // Terminal states\n FAILED = 'FAILED', // Authentication failed\n EXPIRED = 'EXPIRED', // Session expired\n LOCKED = 'LOCKED' // Account locked due to too many attempts\n}\n\n/* W4.2: Session purpose — drives UI rendering and valid state transitions. /\nexport const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);\n\n/\n #1103 — what a FEDERATED sign-in (OAuth2 / OIDC callback, SAML ACS) established about itself, carried on the\n * session it was parked on when the account still owed its organization at onboarding.\n \n A federated sign-in that completes at once records `USER_SSO_LOGIN` with this evidence on the spot. A parked\n * one signs nobody in yet, so the record waits for the onboarding completion that does — and without this object\n * that completion could only record a generic login, losing which provider and connection proved the identity\n * and the provider MFA assurance verdict (a `WARNED` verdict exists nowhere else once the callback has returned).\n * The auth source is not stored: it follows from the proved factor (`ORG_SAML` is SAML, the other federated\n * methods are OIDC).\n /\nexport const FederatedSignInEvidenceSchema = z.object({\n providerRef: z.string().min(1),\n connectionType: z.enum(SsoConnectionType),\n /* The connection's scope, for an enterprise connection. /\n scopeType: z.enum(AuthScopeType).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n /* The provider MFA assurance verdict the callback assessed. Absent where no assessment runs (SAML). /\n assurance: ExternalAssuranceAssessmentSchema.optional(),\n});\nexport type FederatedSignInEvidence = z.infer<typeof FederatedSignInEvidenceSchema>;\n\n/\n Authentication Session Schema\n * Tracks the complete state of an authentication session\n /\nexport const AuthenticationSessionSchema = z.object({\n sessionId: z.string(),\n state: z.enum(AuthenticationSessionState),\n\n // User identification\n email: z.email().optional(),\n userExists: z.boolean().optional(),\n userId: z.string().optional(),\n /* Trusted organization created transactionally by deferred registration onboarding. /\n organizationId: z.string().optional(),\n /\n Untrusted DNS-verified email-domain ownership hint used only to tighten SSO policy.\n * It is deliberately distinct from `organizationId`, which has trusted onboarding provenance.\n /\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n\n /* W3.5: Resolved user type for this session (from X-Frontend-Service-Name → frontendServices → userType). Drives per-user-type auth policy. /\n activeUserType: z.string().optional(),\n\n /* W4.2: Session purpose — determines valid state transitions and frontend UI. /\n purpose: AuthSessionPurposeSchema.optional(),\n\n /* W4: Next step hint for frontend routing after state transitions. /\n nextStep: z.enum(AuthNextStep).optional(),\n\n /* W4.5: ISO date when MFA grace period expires. Present when state is MFA_ENROLLMENT_GRACE. /\n mfaGraceExpiresAt: z.string().optional(),\n\n /* W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. /\n pendingOrgType: z.string().optional(),\n\n /\n Every obligation still owed before this parked session may sign in (#1374). Present on an\n * `ONBOARDING_PENDING` session; each member is discharged by its own completion door, and the session\n * mints only once none remain. Re-derived from durable state at every parking and after every\n * completion, so it is a projection, never the record.\n /\n pendingObligations: z.array(z.enum(OnboardingObligation)).optional(),\n\n /* #1103: the federated sign-in this session was parked for — recorded as its USER_SSO_LOGIN when onboarding completes. /\n federatedSignIn: FederatedSignInEvidenceSchema.optional(),\n\n /* W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). /\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),\n\n // Authentication flow state\n completedFactors: z.array(z.enum(AuthMethod)).default([]),\n /\n Whether the authenticator LOCALLY VERIFIED the person in this session's passkey ceremony (#1248).\n \n Persisted because it is the difference between a passkey that proved one factor and one that\n * proved two, and nothing else on the session records it — `completedFactors` says PASSKEY either\n * way. The MFA decision reads the flag transiently at sign-in; an ID token is minted long\n * afterwards, from the session, so without this the token could not carry the distinction its own\n * acceptance asks for.\n \n Absent means no passkey ceremony completed on this session, or one completed without user\n * verification. Those are deliberately not distinguished: neither proves the activation, and a\n * relying party reading `amr` needs to know only whether it happened.\n /\n passkeyUserVerified: z.boolean().optional(),\n currentFactor: z.enum(AuthFactorLevel).optional(),\n\n // Available methods\n availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),\n availableSecondFactorMethods: z.array(AvailableMethodSchema).default([]),\n\n // MFA requirements\n requiresMFA: z.boolean().default(false),\n mfaMethodsRequired: z.number().default(1),\n /\n What the user has ENROLLED — factors that took a deliberate setup act. *Empty means nothing is\n set up*, and that is the question this field answers; ask `usableSecondFactorMethods` instead\n for \"can a challenge run\".\n \n It used to carry `AuthMethod.EMAIL_OTP` unconditionally, so it was never empty and could not\n * answer its own question. Callers that branch on \"has this user got a second factor\" must read\n * this; callers that branch on \"is there a challenge to render\" must not.\n /\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /\n Intersection of `availableSecondFactorMethods` (what the policy accepts) with what the user can\n * PRESENT — enrolled ∪ the factors that need no enrollment. Not an intersection with\n * `enrolledSecondFactorMethods`, which this said until the two concepts were separated: a user\n * whose only accepted factor is email OTP has enrolled nothing and can still complete a challenge.\n \n This is the field every \"where do I send this user\" decision reads.\n /\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /\n When true, the factors that need no enrollment are excluded from the accepted set — see\n * `AuthUtils.getAlwaysAvailableSecondFactorMethods()`, which is the one place that list lives.\n * (Today that is `EMAIL_OTP`; this doc named the complement by hand and would have gone stale the\n * day a second such factor appeared.)\n /\n requireStrongMFA: z.boolean().default(false),\n\n // Session metadata\n createdAt: z.date(),\n expiresAt: z.date(),\n lastActivity: z.date(),\n\n // Security tracking\n attempts: z.number().default(0),\n maxAttempts: z.number().default(5),\n lockoutUntil: z.date().optional(),\n\n // Device and context\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional(),\n\n // Integration requests\n requestedIntegrations: z.array(z.string()).default([]),\n\n // Session-specific data for ongoing flows\n challengeData: z.record(z.string(), z.any()).optional(),\n pendingRedirectUrl: z.url().optional(),\n\n // Organization branding (cached for consistent UI)\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // M1: Optimistic concurrency control version for atomic session updates\n version: z.number().default(0),\n}).superRefine((session, ctx) => {\n if ((session.scopeType === undefined) !== (session.scopeId === undefined)) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Authentication session scopeType and scopeId must be provided together',\n });\n }\n});\n\n\n\n// ===============================\n// SIMPLIFIED FORM DTOs\n// ===============================\n// Used by frontend Form components and backend body parsing.\n// These are the \"what the user fills in\" schemas — services add\n// programmatic fields (sessionId, method, factorLevel) before API calls.\n\n/\n Identify step form DTO — user enters email to discover auth methods.\n * Used by the public auth page's first step.\n /\n/\n The sign-in identification form.\n \n The email field renders `autocomplete=\"username webauthn\"`: `webauthn` is what lets the browser offer\n * the person's passkeys for this site in the field's autofill list (conditional mediation), so they can\n * sign in by picking an account instead of typing an email and choosing a method.\n \n spec-cite: https://web.dev/articles/passkey-form-autofill — the username input requires `autocomplete=\"username webauthn\"`: \"Include both `username` and `webauthn` as space-separated values.\"\n /\nexport const AuthIdentifyFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME, autoCompleteModifier: AutocompleteModifier.WEBAUTHN },\n }),\n});\n\n\n\n\n/\n Login step form DTO — user enters email + password.\n * Used by the public auth page when password auth is shown.\n * The .isPassword() decorator tells FormField to render a password input.\n /\nexport const AuthLoginFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n }),\n password: z.string().min(1).isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.CURRENT_PASSWORD },\n }),\n});\n\nfunction withOneTimeCodeAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.ONE_TIME_CODE },\n }) as TSchema;\n}\n\nfunction withTelAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.TEL },\n }) as TSchema;\n}\n\n/\n MFA email OTP challenge form DTO.\n * Used by the MFA challenge screen after the email code has been sent.\n /\nexport const EmailOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA SMS OTP challenge form DTO.\n * Used by the MFA challenge screen after the SMS code has been sent.\n /\nexport const SmsOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA TOTP challenge form DTO.\n * Used by the MFA challenge screen for authenticator-app verification.\n /\nexport const TotpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n Phone enrollment start form DTO.\n * Used by the enrollment gate before sending a phone verification code.\n /\nexport const PhoneEnrollmentStartFormDtoSchema = z.object({\n phoneNumber: withTelAutocomplete(z.string().min(1)),\n});\n\n/\n Phone enrollment verification form DTO.\n * Used by the enrollment gate after a verification code has been sent.\n /\nexport const PhoneEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n TOTP enrollment verification form DTO.\n * Used after the user scans the QR code and confirms setup with a first code.\n /\nexport const TotpEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n\n\n\n/\n `POST /auth/token/exchange` — the answer when the one-time code parked a FEDERATED sign-in at organization\n * onboarding instead of signing it in (#1103).\n \n An OAuth2 / OIDC callback or a SAML ACS for an account that still owes its organization (#1091) opens an\n * authentication session at `ONBOARDING_PENDING` and puts THAT in the exchange code rather than tokens. Redeeming\n * the code answers with the session to complete on the organization-onboarding step, and nothing else: no access\n * token, and no refresh cookie. Deliberately a SEPARATE schema from `TokenExchangeResponseSchema`, whose strict\n * signed-in shape the docs site also parses: a handoff code redeemed there can never be parked, and widening that\n * shape would make every receiver narrow for a case only the SaaS frontend meets.\n /\nexport const TokenExchangeOrganizationOnboardingResponseSchema = z.strictObject({\n nextStep: z.literal(AuthNextStep.ONBOARDING),\n sessionId: z.string().min(1),\n});\n\nexport type TokenExchangeOrganizationOnboardingResponse = z.infer<typeof TokenExchangeOrganizationOnboardingResponseSchema>;\n\n/\n One-off session token exchange response.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string()` which was emitted in the JSON body. The\n * cookie migration (A-Step 2) routed the refresh token to\n * `Set-Cookie: __wildo_refresh=…`; A-Step 6 removes the body field\n * entirely so a one-off-session client receives ONLY a (short-lived)\n * access token + the cookie. The controller's\n * `_jsonSuccessWithRefreshCookie` helper sets the cookie from a\n * separately-passed argument.\n /\nexport const OneOffTokenExchangeResponseSchema = z.object({\n accessToken: z.string(),\n sessionType: z.enum(SessionType),\n consumableTokenValue: z.string().optional(),\n tokenExpiresAt: z.string().optional(),\n context: z.object({\n tokenId: z.string(),\n tokenType: z.string(),\n targeting: z.object({\n initiatorIds: z.record(z.string(), z.string()).optional(),\n }).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n userId: z.string(),\n }),\n});\n\n// Cross-frontend handoff DTO atoms (cross-app-jwt-propagation Step 2) live\n// in `./cross-frontend-handoff.shared.dto.schemas` so a browser-safe subpath\n// (`@wildo-ai/saas-models/public-runtime`) can re-export them without\n// dragging this file's full transitive web (UserContext, SessionType,\n// AuthMethod, AuthFactorLevel, AuthSessionPurpose, AuthUtils,\n// `@wildo-ai/zod-decorators`). See saas-models-public-runtime.md K-2.\nexport from './cross-frontend-handoff.shared.dto.schemas';\n\n// ===============================\n// INFERRED TYPES\n// ===============================\n\n// Authentication method types\nexport type AuthIdentificationRequest = z.infer<typeof AuthIdentificationRequestSchema>;\nexport type AuthIdentificationResponse = z.infer<typeof AuthIdentificationResponseSchema>;\n\n\n\n// Authentication request types\nexport type AuthenticationRequest = z.infer<typeof AuthenticationRequestSchema>;\nexport type AuthenticationResponse = z.infer<typeof AuthenticationResponseSchema>;\nexport type PasswordAuthRequest = z.infer<typeof PasswordAuthRequestSchema>;\nexport type External_OAuth2_AuthRequest = z.infer<typeof External_OAuth2_AuthRequestSchema>;\nexport type OrganizationSSOAuthRequest = z.infer<typeof OrganizationSSOAuthRequestSchema>;\nexport type OAuth2Callback = z.infer<typeof OAuth2CallbackSchema>;\nexport type TOTPAuthRequest = z.infer<typeof TOTPAuthRequestSchema>;\nexport type SMSOTPAuthRequest = z.infer<typeof SMSOTPAuthRequestSchema>;\nexport type EmailOTPAuthRequest = z.infer<typeof EmailOTPAuthRequestSchema>;\nexport type PasskeyAuthRequest = z.infer<typeof PasskeyAuthRequestSchema>;\n\nexport type MagicLinkSendRequest = z.infer<typeof MagicLinkSendRequestSchema>;\nexport type MagicLinkVerifyRequest = z.infer<typeof MagicLinkVerifyRequestSchema>;\n\nexport type PhoneVerifySendRequest = z.infer<typeof PhoneVerifySendRequestSchema>;\nexport type PhoneVerifyConfirmRequest = z.infer<typeof PhoneVerifyConfirmRequestSchema>;\n\n// MFA types\nexport type MFASetupRequest = z.infer<typeof MFASetupRequestSchema>;\nexport type MFASetupResponse = z.infer<typeof MFASetupResponseSchema>;\n\nexport type AuthIdentifyFormDto = z.infer<typeof AuthIdentifyFormDtoSchema>;\nexport type AuthLoginFormDto = z.infer<typeof AuthLoginFormDtoSchema>;\nexport type EmailOtpChallengeFormDto = z.infer<typeof EmailOtpChallengeFormDtoSchema>;\nexport type SmsOtpChallengeFormDto = z.infer<typeof SmsOtpChallengeFormDtoSchema>;\nexport type TotpChallengeFormDto = z.infer<typeof TotpChallengeFormDtoSchema>;\nexport type PhoneEnrollmentStartFormDto = z.infer<typeof PhoneEnrollmentStartFormDtoSchema>;\nexport type PhoneEnrollmentVerifyFormDto = z.infer<typeof PhoneEnrollmentVerifyFormDtoSchema>;\nexport type TotpEnrollmentVerifyFormDto = z.infer<typeof TotpEnrollmentVerifyFormDtoSchema>;\n\n// Session types\nexport type AuthenticationSession = z.infer<typeof AuthenticationSessionSchema>;\nexport type OneOffTokenExchangeResponse = z.infer<typeof OneOffTokenExchangeResponseSchema>;\n"]}

package/dist/esm/security/authentications/authentication.shared.schemas.d.ts CHANGED Viewed

@@ -114,17 +114,33 @@ export declare const OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES: ReadonlySet<string>;
  * | `ORG_SAML` | first or second | a connection resource on the organization, AND a Java runtime with the schema-validation helper compiled on every host that serves SAML |
  * | `ORG_OPENID_CONNECT` | first or second | a connection resource on the organization |
  *
- * ## ⚠️ The organization SSO methods are gated by the USER TYPE first
+ * ## Passkeys sign in without an email, and several accounts can share one device
  *
- * A perfectly configured SSO connection is never offered unless the user type enables `ORG_SAML` /
- * `ORG_OPENID_CONNECT`: the connection lookup only runs when the resolved policy already has the
- * method, so the organization is never consulted. The symptom is a login screen that simply does not
- * show the option, with nothing wrong on the connection and nothing in the logs. Enable the method on
- * the user type BEFORE debugging the connection.
+ * Enabling `PASSKEY` gives the sign-in screen two username-less entries on top of the passkey method
+ * shown after an email: passkey AUTOFILL on the email field, and a "Sign in with a passkey" button. The
+ * device lists every account the person holds a passkey for on this site, and the account that signs
+ * in is the one the chosen passkey belongs to — whatever email, if any, was typed.
+ *
+ * - **Every passkey is a discoverable credential.** There is no setting to turn this off: sign-in
+ *   names no account to the device, so the device must be able to offer the account itself.
+ * - **The sign-in options are identical for every email**, so they never reveal whether an account
+ *   exists or holds a passkey.
+ * - **A signed-in account is held to the same rules as a typed email**: the frontend must be allowed
+ *   to sign in that account's user type, and an organization that restricts its domain to SSO refuses
+ *   a passkey sign-in exactly as it refuses a password.
+ * - **Re-authentication does not offer the username-less entries** — a re-proof must be the same person.
+ *
+ * ## Organization SSO also requires an enabled method in the effective policy
+ *
+ * A configured connection alone does not enable `ORG_SAML` / `ORG_OPENID_CONNECT`. Check the user
+ * type's methods and the application's `auth.orgAuthMethodPolicy`: RESTRICT_ONLY intersects,
+ * EXPAND_WITHIN_SET permits additions from `auth.expandableOrgMethods`, and UNRESTRICTED uses the
+ * organization's set. Explicit organization method overrides intersect across memberships.
+ * Login-method expansion does not weaken the separate MFA, password or step-up requirements.
  *
  * ## Other refusals worth knowing before you pick one
  *
- * - **`EXTERNAL_OAUTH2` will not link or create an account from a provider that does not report the
+ * - **`EXTERNAL_OAUTH2` will not automatically link by email or create an account from a provider that does not report the
  *   email address as VERIFIED.** That is a refusal, not a warning — a provider whose claim mapping
  *   does not surface a verified flag cannot be used for sign-up until the mapping is corrected.
  * - **A missing SAML validation helper surfaces as an invalid signature**, not as a missing
@@ -167,6 +183,31 @@ export declare enum AuthMethod {
     EMAIL_OTP = "EMAIL_OTP",// Email One-Time Password
     PASSKEY = "PASSKEY"
 }
+/**
+ * Is this method strong enough for a policy that demands a STRONG second factor?
+ *
+ * Derived from the method's own channel rather than from a hand-kept weak list: a second factor
+ * delivered to an email address is excluded, because email is not an acceptable channel for
+ * out-of-band authentication at all — "Email SHALL NOT be used for out-of-band authentication because
+ * it may be vulnerable to: Access using only a password; Interception in transit or at intermediate
+ * mail servers; Rerouting attacks".
+ *
+ * spec-cite: NIST SP 800-63B-4 §3.1.3.1 "Out-of-Band Authenticators"
+ * (https://pages.nist.gov/800-63-4/sp800-63b.html).
+ *
+ * **This reproduces the set the previous rule produced, and that is deliberate.** `requireStrongMFA`
+ * used to be expressed as "drop the factors that need no enrolment", which removed `EMAIL_OTP`
+ * because an address the account already proved needs no setup. That reasoning is sound and it was
+ * reaching the right answer by a property that only coincides with the one it meant — a second
+ * always-available factor on another channel would have been excluded for no reason, and a weak
+ * factor that DID need enrolment would have passed. Deriving from the channel says the thing itself.
+ *
+ * **What it deliberately does NOT change:** `SMS_OTP` stays strong. NIST classes PSTN out-of-band as
+ * the one RESTRICTED authenticator (§3.2.9) — permitted, with an obligation to offer an unrestricted
+ * alternative — rather than as a prohibited channel, and promoting "restricted" to "not strong" is a
+ * posture decision an application should make, not one this predicate should make for it.
+ */
+export declare function isStrongSecondFactor(method: AuthMethod): boolean;
 /** @wildo_source:part:end saas.models.auth.methods */
 /**
  * Authentication Factor Levels
@@ -212,8 +253,52 @@ export declare enum AuthNextStep {
      * the link is that proof. It is also, permanently, the recovery path — see the note on
      * `registerUser`.
      */
-    PASSKEY_ENROLLMENT = "passkey_enrollment"
+    PASSKEY_ENROLLMENT = "passkey_enrollment",
+    /**
+     * An invitation was accepted and no session was issued (#1158). The user's effective policy disables the sign-in the
+     * invitation link amounts to (possession of the email address), so they continue on the sign-in page with a method
+     * their policy allows.
+     */
+    SIGN_IN_REQUIRED = "sign_in_required"
 }
+/**
+ * What a re-authentication proof is FOR (#1417). It decides which factors may mint the proof and which
+ * doors accept it.
+ *
+ * - `STEP_UP`: a sensitive operation, removing a way to sign in, or turning TOTP off. Minted only from
+ *   a factor the effective `stepUpAuth.methods` accepts, as a `REAUTH` token.
+ * - `BIND_AUTHENTICATOR`: adding a way to sign in. Minted from any factor the account holds, as a
+ *   `REAUTH_BIND` token, which only the binding doors accept.
+ */
+export declare enum ReAuthenticationPurpose {
+    STEP_UP = "step_up",
+    BIND_AUTHENTICATOR = "bind_authenticator"
+}
+/**
+ * The frontend page a federated re-authentication returns to (#1441), inside the popup the step-up
+ * dialog opened. The backend redirects there with `?code=` (a one-time `REAUTH_CODE_EXCHANGE` code) or
+ * `?error=`; the page hands either to the window that opened it and closes. ONE constant, so the URL the
+ * backend writes and the route the frontend mounts cannot disagree.
+ */
+export declare const REAUTHENTICATION_CALLBACK_PAGE_PATH = "/auth/reauth/callback";
+/**
+ * A linked identity that can re-authenticate its account through its provider (#1441): what the step-up
+ * dialog shows as "Continue with <displayName>", what `GET /auth/reauth/methods` lists beside the local
+ * factors, and what `POST /auth/reauth/federated/authorize` accepts by `identityLinkId`.
+ */
+export interface ReAuthenticationIdentityLink {
+    identityLinkId: string;
+    providerRef: string;
+    /** The provider's (social) or the connection's (enterprise) display name. */
+    displayName: string;
+    /** What a step-up policy names this factor by. */
+    method: FederatedReAuthenticationMethod;
+}
+/**
+ * The methods a linked identity re-authenticates with (#1441): `EXTERNAL_OAUTH2` for a social OIDC link,
+ * `ORG_OPENID_CONNECT` for an enterprise OIDC one, `ORG_SAML` for an enterprise SAML one.
+ */
+export type FederatedReAuthenticationMethod = AuthMethod.EXTERNAL_OAUTH2 | AuthMethod.ORG_OPENID_CONNECT | AuthMethod.ORG_SAML;
 /**
  * W4.2: Session purpose — drives UI rendering and valid state transitions.
  */
@@ -234,14 +319,243 @@ export declare enum MfaEnrollmentState {
     GRACE = "grace",
     ENROLLED = "enrolled"
 }
+/**
+ * @wildo_source:part:start saas.models.auth.methods facet:layer:shared facet:audience:app-developer
+ *
+ * ## What each method PROVES, and how the engine decides with it
+ *
+ * Three maps classify a method, and they answer different questions. Reach for the right one:
+ *
+ * | map | answers |
+ * |---|---|
+ * | `AUTH_METHOD_FACTOR_MAP` | WHERE it may sit — first factor, second factor, or either |
+ * | `AUTH_METHOD_CATEGORY_MAP` | which GROUP the sign-in page renders it in |
+ * | `AUTH_METHOD_EVIDENCE` | what it PROVES — the one the engine's factor rules read |
+ */
 /**
  * Authentication Method Factor Classification Map
  */
 export declare const AUTH_METHOD_FACTOR_MAP: Record<AuthMethod, AuthFactorType>;
+/**
+ * The order authentication methods are PRESENTED in, and the order that decides which one is offered first.
+ *
+ * ONE authority, deliberately. Until #1218 there were two and neither was: the backend returned methods in
+ * `AUTH_METHOD_FACTOR_MAP` declaration order — so `defaultFirstFactorMethod` was `PASSWORD` because PASSWORD happens to
+ * be the first key of an unrelated map — and the frontend threw that order away and re-sorted by a display list only it
+ * could see. A domain routed to an enterprise identity provider still met the password form, with "Continue with your
+ * provider" relegated to "other methods".
+ *
+ * The head is the one the sign-in page already used, promoted rather than invented: the organization's own identity
+ * provider first, because a domain that routes to one is telling you where this person signs in; then the credentials a
+ * person holds directly; then the delegated and one-time channels.
+ *
+ * **The TRAILER orders the second-factor challenge, and it is strongest-first.** Those members are second-factor-only
+ * (or, for `SMS_OTP`, first-or-second), so they never appear in a first-factor list and their position here decides one
+ * thing: what the MFA screen offers first. `TOTP` leads them because it is an unrestricted authenticator; `SMS_OTP`
+ * follows because NIST classes PSTN out-of-band as RESTRICTED — permitted, with an obligation to offer an unrestricted
+ * alternative — and `EMAIL_OTP` is last because email "SHALL NOT be used for out-of-band authentication".
+ * spec-cite: NIST SP 800-63B-4 §3.2.9 (restricted authenticators) and §3.1.3.1 (out-of-band authenticators)
+ * (https://pages.nist.gov/800-63-4/sp800-63b.html). The same two sections `isStrongSecondFactor` cites.
+ *
+ * The frontend's deleted display order put `TOTP` last, behind both OTP channels, for no recorded reason — that is what
+ * this replaces, and the change is deliberate rather than incidental.
+ *
+ * TOTAL over the vocabulary, and pinned as total: a method added to `AuthMethod` tomorrow must be PLACED here, rather
+ * than appearing silently at the end of whichever list happened to be sorted last.
+ */
+export declare const AUTH_METHOD_PRECEDENCE: readonly AuthMethod[];
 /**
  * Authentication Method Category Map
  */
 export declare const AUTH_METHOD_CATEGORY_MAP: Record<AuthMethod, AuthMethodCategory>;
+/**
+ * The factor CATEGORY a method proves, in the classical three — plus the one Wildo cannot classify.
+ *
+ * `FEDERATED` is not a fourth kind of factor. It means the proof happened at an identity provider, so
+ * what was proved is the IdP's answer and not ours: the engine reads it from the assertion's `acr`
+ * demands and assurance evidence rather than declaring it here. Giving a federated method a concrete
+ * category would be asserting something about somebody else's ceremony.
+ */
+export declare enum AuthFactorCategory {
+    /** Something you know. */
+    KNOWLEDGE = "KNOWLEDGE",
+    /** Something you have. */
+    POSSESSION = "POSSESSION",
+    /** Something you are. */
+    INHERENCE = "INHERENCE",
+    /** Proved elsewhere; the assertion says what, not this map. */
+    FEDERATED = "FEDERATED"
+}
+/**
+ * The CHANNEL a method's proof travels over — the axis that decides whether two factors are
+ * independent.
+ *
+ * Two factors that share a channel are one factor counted twice: whoever holds the channel holds
+ * both. A magic link and an email one-time code are the worked example, and the law states the rule
+ * directly — "the breach of one of the elements does not compromise the reliability of the other
+ * elements".
+ *
+ * spec-cite: Commission Delegated Regulation (EU) 2018/389, Art. 9(1) "Independence of the elements"
+ * (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R0389). That regulation binds
+ * payment service providers; it is cited here as the clearest statement of the principle, never as an
+ * obligation a Wildo application inherits.
+ *
+ * `NONE` means the proof does not travel: a password is typed, a TOTP code is computed from a secret
+ * shared once at enrolment. Those can never collide with anything, which is why the rule is expressed
+ * as "not the same channel" rather than as a list of forbidden pairs.
+ */
+export declare enum AuthProofChannel {
+    /** Nothing is delivered — the proof is presented directly. */
+    NONE = "NONE",
+    /** Delivered to a mailbox. */
+    EMAIL = "EMAIL",
+    /** Delivered over the public switched telephone network. */
+    PSTN = "PSTN",
+    /** Produced by an authenticator on the device, and never transmitted. */
+    LOCAL_AUTHENTICATOR = "LOCAL_AUTHENTICATOR",
+    /** Carried in an assertion from an identity provider. */
+    FEDERATED = "FEDERATED"
+}
+/**
+ * Whether ONE ceremony of this method can prove TWO factors by itself.
+ *
+ * Only a cryptographic authenticator can, and only when an activation factor unlocked its key —
+ * "a multi-factor cryptographic authenticator is 'something you have' and is activated by an
+ * activation factor that represents either 'something you know' or 'something you are'".
+ *
+ * spec-cite: NIST SP 800-63B-4 §3.1.7 "Multi-Factor Cryptographic Authentication"
+ * (https://pages.nist.gov/800-63-4/sp800-63b.html).
+ *
+ * `WHEN_USER_VERIFIED` is therefore a CONDITION, not a property: the same passkey proves two factors
+ * in a ceremony that verified the person and one in a ceremony that did not, and both produce a valid
+ * assertion. The engine reads the WebAuthn `UV` flag off the assertion to tell them apart.
+ */
+export declare enum AuthSelfSufficientMultiFactor {
+    /** One ceremony, one factor — always. */
+    NEVER = "NEVER",
+    /** Two factors when the authenticator locally verified the person, one when it did not. */
+    WHEN_USER_VERIFIED = "WHEN_USER_VERIFIED"
+}
+/** What one authentication method proves. See {@link AUTH_METHOD_EVIDENCE}. */
+export interface AuthMethodEvidence {
+    readonly factorCategory: AuthFactorCategory;
+    readonly channel: AuthProofChannel;
+    /**
+     * Whether presenting this method to an impostor verifier is useless to the impostor.
+     *
+     * True for `PASSKEY` alone, and that is not a judgement — "authenticators that involve the manual
+     * entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be
+     * considered phishing-resistant because the manual entry does not bind the authenticator output to
+     * the specific session being authenticated". A typed code is relayable, TOTP included.
+     *
+     * spec-cite: NIST SP 800-63B-4 §3.2.5 "Phishing Resistance"
+     * (https://pages.nist.gov/800-63-4/sp800-63b.html).
+     *
+     * A federated method is `false` because Wildo cannot know how the IdP authenticated the person;
+     * that question is answered by the connection's `acr` demands, not by this map.
+     */
+    readonly phishingResistant: boolean;
+    readonly selfSufficientMultiFactor: AuthSelfSufficientMultiFactor;
+}
+/**
+ * Authentication Method Evidence Map — what each method PROVES.
+ *
+ * The two maps above say where a method may sit and how it is grouped on screen. Neither says what it
+ * proves, so every rule that depends on the strength of a proof used to be hand-applied at its own
+ * door and derived differently at each one: the MFA waiver matched a method NAME, `requireStrongMFA`
+ * was expressed as "drop the ones needing no enrolment", and nothing anywhere expressed the channel —
+ * which is why a magic-link sign-in could be completed by an email code to the same mailbox.
+ *
+ * Being `Record<AuthMethod, …>` is the point: a method added to the vocabulary tomorrow does not
+ * compile until it declares what it proves, so the rules below stay total over the vocabulary instead
+ * of quietly omitting it.
+ *
+ * ## Reading the rows
+ *
+ * - **`MAGIC_LINK` is POSSESSION, not knowledge.** It sits beside `PASSWORD` in
+ *   `AUTH_METHOD_CATEGORY_MAP` because both are rendered as "credentials", and that grouping is a
+ *   screen concern. What a magic link proves is control of a mailbox.
+ * - **`TOTP` has NO channel.** The secret is shared once at enrolment and the code is computed
+ *   locally, so nothing is delivered and it can never collide with another factor's channel.
+ * - **The three federated methods are `FEDERATED` on both axes.** Their strength question already has
+ *   an answer — `externalAssuranceEnforcement` and the connection's `acr` demands — and this map must
+ *   not grow a second, competing one.
+ *
+ * Imported from `@wildo-ai/saas-models`.
+ */
+export declare const AUTH_METHOD_EVIDENCE: Record<AuthMethod, AuthMethodEvidence>;
+/**
+ * Do these two methods prove things a single breach could reach?
+ *
+ * The rule the engine applies when it offers or accepts a SECOND factor: a factor whose channel the
+ * FIRST factor already proved is not a second factor. `NONE` never collides, because nothing is
+ * delivered over it.
+ *
+ * @example
+ * sharesProofChannel(AuthMethod.MAGIC_LINK, AuthMethod.EMAIL_OTP); // true — one mailbox, counted twice
+ * sharesProofChannel(AuthMethod.PASSWORD, AuthMethod.EMAIL_OTP);   // false — nothing is delivered to prove a password
+ */
+export declare function sharesProofChannel(first: AuthMethod, second: AuthMethod): boolean;
+/**
+ * The RFC 8176 `amr` values each method may claim, and nothing else (#1248).
+ *
+ * `amr` is what an ID token tells a relying party about HOW the person authenticated. Wildo demands
+ * exactly this of every identity provider it trusts — `oauth2-authentication` reads an upstream `amr`
+ * as session evidence — and published none of its own, so a client receiving a Wildo ID token could not
+ * make the decision Wildo insists on making about its own upstreams. That asymmetry is the defect.
+ *
+ * spec-cite: RFC 8176 "Authentication Method Reference Values", §2 — the registry of short names and
+ * their definitions (https://www.rfc-editor.org/rfc/rfc8176.html). Every value below is taken from
+ * that registry; none is invented.
+ *
+ * ## Only REGISTERED values, which is why three methods contribute none
+ *
+ * A value outside the registry is a private string a generic relying party cannot read, so an
+ * unregistered "email" or "sso" would be worse than silence — the same reasoning that keeps `acr`
+ * unpublished until Wildo defines what its values mean.
+ *
+ * - **The federated methods contribute nothing.** The registry has no value for "the person proved
+ *   themselves to somebody else and that party vouched for them", and restating the UPSTREAM's `amr`
+ *   as our own would assert a proof this application never observed. What the upstream proved is the
+ *   upstream's claim to make.
+ * - **`MAGIC_LINK` and `EMAIL_OTP` claim `mca`**, "Multiple-channel authentication involving
+ *   communication over distinct channels", which is literally what they are: the credential travels by
+ *   email, a channel distinct from the browser. That is applying a registered definition, not
+ *   stretching one. `EMAIL_OTP` also claims `otp`, which it plainly is; `MAGIC_LINK` is not an OTP —
+ *   the link itself is the credential.
+ * - **`PASSKEY` claims `user`**, "User presence test", because WebAuthn always tests presence. It does
+ *   NOT claim `hwk` or `swk`: which is true depends on whether the credential is single-device or
+ *   synced, and the session does not carry the credential's device type. Claiming either would be a
+ *   guess about the authenticator, and `hwk` is precisely what a relying party reads as
+ *   phishing-resistant hardware.
+ */
+export declare const AUTH_METHOD_AMR: Record<AuthMethod, readonly string[]>;
+/**
+ * What an ID token may say about how THIS session was authenticated (#1248).
+ *
+ * Returns the sorted, de-duplicated registered `amr` values for the factors the session actually
+ * completed — never for the factors it could have used. An empty result means the session has nothing
+ * a relying party could read, and the caller omits the claim rather than emitting `[]`: an empty array
+ * asserts "authenticated by no method", which is false, where an absent claim correctly says nothing.
+ *
+ * ## `mfa` is DERIVED, and it is the value that matters most
+ *
+ * "Multiple-factor authentication" is claimed when the session genuinely holds two independent proofs,
+ * decided by the same {@link AUTH_METHOD_EVIDENCE} channels that decide whether a second factor is
+ * admissible — so an ID token cannot claim `mfa` for a pair this application's own sign-in doors would
+ * refuse as sharing a channel. A password plus an email OTP is two methods and one mailbox; it does
+ * not claim `mfa`.
+ *
+ * A single passkey claims `mfa` when the authenticator locally verified the person, because that
+ * ceremony IS two factors — possession of the authenticator and the activation that unlocked it — and
+ * the WebAuthn UV flag is the only report that the activation happened. That is the distinction the
+ * acceptance asks an ID token to carry, and it is readable only because the verifier reads the flag
+ * off the assertion rather than inferring it from the policy that requested it.
+ */
+export declare function deriveAuthenticationMethodReferences(completedFactors: readonly AuthMethod[], ceremony?: {
+    passkeyUserVerified?: boolean;
+}): string[];
+/** @wildo_source:part:end saas.models.auth.methods */
 /**
  * Scope type for auth policies — organization-level vs application-level.
  *
@@ -277,7 +591,8 @@ export declare const AvailableMethodSchema: z.ZodObject<{
     category: z.ZodEnum<typeof AuthMethodCategory>;
     canBeFirstFactor: z.ZodBoolean;
     canBeSecondFactor: z.ZodBoolean;
-    required: z.ZodBoolean;
+    enforcedFirstFactor: z.ZodBoolean;
+    satisfiesRequiredSecondFactor: z.ZodBoolean;
     oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
     ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
     organizationRestricted: z.ZodDefault<z.ZodBoolean>;