@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/security/api-keys/api-keys.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,oBAAY,WAAW;IACrB,YAAY,iBAAkB;IAC9B,WAAW,gBAAkB;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAGnF,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uCAAuC,iBAAgC,CAAC;AAErF,+GAA+G;AAC/G,eAAO,MAAM,+BAA+B,EAAE,4BAG5C,CAAC;AAEH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;CACjE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAQD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBAyC3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;iBAenC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;iBAelC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE1C,CAAC;AAGH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
+{"version":3,"file":"api-keys.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED,oBAAY,WAAW;IACrB,YAAY,iBAAkB;IAC9B,WAAW,gBAAkB;CAC9B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAGnF,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uCAAuC,iBAAgC,CAAC;AAErF,+GAA+G;AAC/G,eAAO,MAAM,+BAA+B,EAAE,4BAG5C,CAAC;AAEH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;CACjE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAQD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;iBAqD3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;iBAgBnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;iBAgBlC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE1C,CAAC;AAGH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEzC,CAAC;AAGH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;iBAQ9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}

package/dist/esm/security/api-keys/api-keys.shared.schemas.js

@@ -74,6 +74,16 @@ export const ApiKeySchemaBase = z.object({
     roles: z.array(RolesSchema).default([]).isAuditEvidence(),
     status: z.enum(ApiKeyStatus).default(ApiKeyStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),
     expiresAt: z.date().optional().isDBIndexed().isSummaryField(),
+    /**
+     * The capability grant this key was minted or reissued under (#1631), when a service firm's expert did it through a
+     * lent `MANAGE_API_KEYS`. Such a key's `expiresAt` is capped at the grant's end, and it is deactivated when the grant
+     * is revoked or its relationship ends — a secret handed to the firm under a lending ends with the lending. Absent for
+     * a key the organization's own administrators handled. Server-written only.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a credential obtained through delegated administration cannot outlive the delegation.
+     */
+    lentUnderCapabilityGrantId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence()
+        .describe('The capability grant a service firm\'s expert minted or reissued this key under, through administration the organization lent the firm. Such a key expires no later than the grant and is deactivated when the grant is revoked or the relationship ends. Absent for a key the organization\'s own administrators handled.'),
     lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
     createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
@@ -94,16 +104,18 @@ export const ApiKeySchemaBase = z.object({
     // First 8 chars of the prior secret — retained for support/audit display while the
     // previous secret is still valid (not a secret, so surfaced). Overwritten on the
     // next rotation.
-    previousKeyPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),
+    previousKeyPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate()
+        .describe('The first eight characters of the previous secret, which still authenticates until `previousKeyInvalidationDate`, or, when that is empty, until the key is rotated or regenerated again.'),
     // When the previous secret stops authenticating. `null`/absent = no scheduled
     // invalidation (REGENERATE overlap — the prior secret stays valid until the next
     // rotation). A future date (ROTATE `oldKeyInvalidationDate`) = honored until then,
     // then rejected. `now`/past (ROTATE default) = immediate hard cutover. Surfaced so
     // operators can see when the old secret dies.
     previousKeyInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate()
+        .describe('When the previous secret stops authenticating. Empty after a regenerate: the previous secret then keeps working until the next rotation.')
 });
 export const ApiKeyOrganizationSchema = ApiKeySchemaBase.extend({
-    scope: z.literal(ApiKeyScope.ORGANIZATION),
+    scope: z.literal(ApiKeyScope.ORGANIZATION).describe("Always `organization`: the key authenticates on behalf of one organization, and its value starts with `sk_org_`."),
     organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
     // Backend-only field - stored in DB but never sent to frontend (security)
     // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses
@@ -115,11 +127,12 @@ export const ApiKeyOrganizationSchema = ApiKeySchemaBase.extend({
     // but a uniqueness contract avoids two rows being returned to the
     // resolver on a hash-collision and prevents shadow-key duplicates
     // during rotation.
-    hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),
+    hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate()
+        .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),
     keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),
 });
 export const ApiKeyApplicationSchema = ApiKeySchemaBase.extend({
-    scope: z.literal(ApiKeyScope.APPLICATION),
+    scope: z.literal(ApiKeyScope.APPLICATION).describe("Always `application`: the key authenticates on behalf of the application itself, and its value starts with `sk_app_`."),
     applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
     // Backend-only field - stored in DB but never sent to frontend (security)
     // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses
@@ -131,7 +144,8 @@ export const ApiKeyApplicationSchema = ApiKeySchemaBase.extend({
     // but a uniqueness contract avoids two rows being returned to the
     // resolver on a hash-collision and prevents shadow-key duplicates
     // during rotation.
-    hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),
+    hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate()
+        .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),
     keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),
 });
 /**
@@ -143,4 +157,24 @@ export const ApiKeyOrganizationContextSchema = ApiKeyOrganizationSchema.extend({
 export const ApiKeyApplicationContextSchema = ApiKeyApplicationSchema.extend({
     rateLimit: ApiRequest_RateLimitSchema
 });
+/**
+ * The response of an API key's `usage_stats` operation — one definition for the organization key's two
+ * variants and the application key's one, which used to be three hand-kept copies (#1797).
+ *
+ * The counts come from the usage recorder, which counts every request a key authenticates, in
+ * per-minute and per-hour buckets. They are a rolling measurement over the last week, not a ledger.
+ * Two fields the operation used to publish are gone rather than reported as zero, because nothing can
+ * answer them truthfully: a LIFETIME request total needs a durable counter on the key, and a rate-limit
+ * count needs a limiter that knows the key — every limiter in front of a REST request runs before the
+ * key is resolved and counts by source address.
+ */
+export const ApiKeyUsageStatisticsResponseSchema = z.object({
+    keyId: z.string().describe('The id of the API key these statistics are for.'),
+    requestsLastHour: z.number().int().min(0).describe('Requests authenticated with this key in the last 60 minutes.'),
+    requestsLastDay: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 23 hours before it.'),
+    requestsLastWeek: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 167 hours before it. Counts older than that are not kept.'),
+    lastUsedAt: z.date().optional().describe('When the key was last accepted, to the minute. Absent when it has never been used.'),
+    mostUsedEndpoint: z.string().optional().describe('The route this key reached most often over the last week, as its method and path template (for example `GET /organizations/:organizationId/todos`). Absent when no request was counted.'),
+    errorRate: z.number().min(0).max(100).describe('The percentage of the last week\'s requests that answered with a status of 400 or above, or were closed before an answer. 0 when there were none.'),
+});
 //# sourceMappingURL=api-keys.shared.schemas.js.map

package/dist/esm/security/api-keys/api-keys.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAC,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,kCAAkC;AAClC,gBAAgB;AAChB,kCAAkC;AAIlC,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,iCAAiB,CAAA;IACjB,qCAAqB,CAAA;IACrB,mCAAmB,CAAA;AACrB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4CAA8B,CAAA;IAC9B,0CAA6B,CAAA;AAC/B,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA0C,MAAM,CAAC,MAAM,CAAC;IACrG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,SAAS;IACrC,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,SAAS;CACrC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,eAAe,CAAC,aAAa,CAAC;AAErF,+GAA+G;AAC/G,MAAM,CAAC,MAAM,+BAA+B,GAAiC,MAAM,CAAC,MAAM,CAAC;IACzF,mBAAmB,EAAE,uCAAuC;IAC5D,eAAe,EAAE,kCAAkC;CACpD,CAAC,CAAC;AAOH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAQ,MAAM,CAAC,MAAM,CAAC,WAAW,CAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,kCAAkC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAClD,CAAC;AAGD,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAElC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACzD,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACzD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC1G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,4DAA4D;IAC5D,oFAAoF;IACpF,+EAA+E;IAC/E,kFAAkF;IAClF,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,4EAA4E;IAC5E,iFAAiF;IACjF,0DAA0D;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrH,mFAAmF;IACnF,iFAAiF;IACjF,iBAAiB;IACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC1F,8EAA8E;IAC9E,iFAAiF;IACjF,mFAAmF;IACnF,mFAAmF;IACnF,8CAA8C;IAC9C,2BAA2B,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC5I,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAClG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC5I,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC","sourcesContent":["/**\n * API Key Shared Schemas\n *\n * Frontend/backend shared API key schemas and DTOs only.\n * Backend-specific logic stays in saas-backend-lib.\n */\n\nimport { z } from 'zod';\nimport { RolesSchema } from '../authorizations/roles.shared.schemas';\nimport { ApiRequest_RateLimitSchema} from '../../requests/rate-limits.shared.schemas';\nimport { WildoHeaderKeys } from '../../requests/header-keys.shared';\n\n// ===============================\n// API KEY ENUMS\n// ===============================\n\n\n\nexport enum ApiKeyStatus {\n  ACTIVE = 'active',\n  INACTIVE = 'inactive',\n  EXPIRED = 'expired'\n}\n\nexport enum ApiKeyScope {\n  ORGANIZATION  = 'organization',\n  APPLICATION   = 'application',\n}\n\n/**\n * Public API-key presentation is one cross-layer contract.\n *\n * A key's scope decides the prefix that identifies it to request authentication;\n * the request itself carries the complete opaque key in the `Authorization`\n * field without an authentication scheme. That scheme-less presentation is an\n * application protocol contract, not OAuth bearer-token syntax. Keeping it at the shared\n * model boundary makes minting, request routing and consumer documentation\n * derive from one source instead of re-typing `sk_org_` / `sk_app_` in each.\n */\nexport const API_KEY_CREDENTIAL_PREFIX_BY_SCOPE: Readonly<Record<ApiKeyScope, string>> = Object.freeze({\n  [ApiKeyScope.ORGANIZATION]: 'sk_org_',\n  [ApiKeyScope.APPLICATION]: 'sk_app_',\n});\n\n/**\n * API keys reuse the request-authentication field name as their transport.\n *\n * This aliases the protocol-wide header vocabulary rather than re-declaring a\n * second literal. The raw value intentionally has no `Bearer` scheme, so callers\n * must follow this application's exact wire contract rather than infer OAuth syntax.\n * It belongs beside the prefix map because both values describe the one public\n * presentation contract of an API-key credential.\n */\nexport const API_KEY_CREDENTIAL_AUTHORIZATION_HEADER = WildoHeaderKeys.AUTHORIZATION;\n\n/** Complete public transport/prefix presentation used by request authentication and consumer documentation. */\nexport const API_KEY_CREDENTIAL_PRESENTATION: ApiKeyCredentialPresentation = Object.freeze({\n  authorizationHeader: API_KEY_CREDENTIAL_AUTHORIZATION_HEADER,\n  prefixesByScope: API_KEY_CREDENTIAL_PREFIX_BY_SCOPE,\n});\n\nexport interface ApiKeyCredentialPresentation {\n  readonly authorizationHeader: string;\n  readonly prefixesByScope: Readonly<Record<ApiKeyScope, string>>;\n}\n\nexport function apiKeyScopeForCredential(value: string): ApiKeyScope | null {\n  return (Object.values(ApiKeyScope) as ApiKeyScope[]).find((scope) => value.startsWith(API_KEY_CREDENTIAL_PREFIX_BY_SCOPE[scope])) ?? null;\n}\n\nexport function isApiKeyCredential(value: string): boolean {\n  return apiKeyScopeForCredential(value) !== null;\n}\n\n\n// ===============================\n// CORE API KEY SCHEMAS\n// ===============================\n\n// Base schema for extension (needs to be z.object for extend to work)\nexport const ApiKeySchemaBase = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n  description: z.string().max(500).optional(),\n  scope: z.enum(ApiKeyScope).isDBIndexed().isSummaryField(),\n  // `.isAuditEvidence()` on both: a machine credential's roles ARE its authority, and its status\n  // decides whether that authority is live. This resource exposes no core UPDATE and gates roles\n  // only at minting, so the before/after values are the only way to reconstruct what a key could\n  // do at a point in time. Closed vocabulary — no personal data reaches the audit ledger.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n  roles: z.array(RolesSchema).default([]).isAuditEvidence(),\n  status: z.enum(ApiKeyStatus).default(ApiKeyStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),\n  expiresAt: z.date().optional().isDBIndexed().isSummaryField(),\n  lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  // ── Rotation grace window ─────────────────────────────────────────────────\n  // When a key is ROTATED or REGENERATEd, the PRIOR secret is retained here so it\n  // keeps authenticating during an overlap window — callers can migrate to the new\n  // secret without a hard cutover. The bearer-token auth path\n  // (`execution-context-creator.backend.service.ts`) resolves a presented key against\n  // the current `hashedKey` OR this `previousHashedKey` while the window is open\n  // (`previousKeyInvalidationDate` is null or in the future) AND the key is ACTIVE.\n  // All three are server-managed by the rotate/regenerate impls only — never\n  // client-settable (`.excludeFromCreate().excludeFromUpdate()`).\n  //\n  // `previousHashedKey` — `sha256` of the prior secret; the auth path looks a\n  // presented key up against it, so it is `.isDBIndexed()`. Backend-only (a secret\n  // hash, never surfaced). Absent until the first rotation.\n  previousHashedKey: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n  // First 8 chars of the prior secret — retained for support/audit display while the\n  // previous secret is still valid (not a secret, so surfaced). Overwritten on the\n  // next rotation.\n  previousKeyPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),\n  // When the previous secret stops authenticating. `null`/absent = no scheduled\n  // invalidation (REGENERATE overlap — the prior secret stays valid until the next\n  // rotation). A future date (ROTATE `oldKeyInvalidationDate`) = honored until then,\n  // then rejected. `now`/past (ROTATE default) = immediate hard cutover. Surfaced so\n  // operators can see when the old secret dies.\n  previousKeyInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate()\n});\n\nexport type ApiKeyBase = z.infer<typeof ApiKeySchemaBase>;\n\nexport const ApiKeyOrganizationSchema = ApiKeySchemaBase.extend({\n  scope: z.literal(ApiKeyScope.ORGANIZATION),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // Backend-only field - stored in DB but never sent to frontend (security)\n  // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n  // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n  // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n  // on every authenticated request). Without an index this is an O(n)\n  // collection scan per request. Compound unique guarantees only one\n  // active row per hash — cryptographically near-impossible by accident,\n  // but a uniqueness contract avoids two rows being returned to the\n  // resolver on a hash-collision and prevents shadow-key duplicates\n  // during rotation.\n  hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate(),\n  keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyOrganization = z.infer<typeof ApiKeyOrganizationSchema>;\n\nexport const ApiKeyApplicationSchema = ApiKeySchemaBase.extend({\n  scope: z.literal(ApiKeyScope.APPLICATION),\n  applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // Backend-only field - stored in DB but never sent to frontend (security)\n  // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n  // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n  // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n  // on every authenticated request). Without an index this is an O(n)\n  // collection scan per request. Compound unique guarantees only one\n  // active row per hash — cryptographically near-impossible by accident,\n  // but a uniqueness contract avoids two rows being returned to the\n  // resolver on a hash-collision and prevents shadow-key duplicates\n  // during rotation.\n  hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate(),\n  keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyApplication = z.infer<typeof ApiKeyApplicationSchema>;\n\n/**\n * API Key Context for middleware and validation\n */\nexport const ApiKeyOrganizationContextSchema = ApiKeyOrganizationSchema.extend({\n  rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyOrganizationContext = z.infer<typeof ApiKeyOrganizationContextSchema>;\n\nexport const ApiKeyApplicationContextSchema = ApiKeyApplicationSchema.extend({\n  rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyApplicationContext = z.infer<typeof ApiKeyApplicationContextSchema>;\n"]}
+{"version":3,"file":"api-keys.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAC,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,kCAAkC;AAClC,gBAAgB;AAChB,kCAAkC;AAIlC,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,iCAAiB,CAAA;IACjB,qCAAqB,CAAA;IACrB,mCAAmB,CAAA;AACrB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4CAA8B,CAAA;IAC9B,0CAA6B,CAAA;AAC/B,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA0C,MAAM,CAAC,MAAM,CAAC;IACrG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,SAAS;IACrC,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,SAAS;CACrC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,eAAe,CAAC,aAAa,CAAC;AAErF,+GAA+G;AAC/G,MAAM,CAAC,MAAM,+BAA+B,GAAiC,MAAM,CAAC,MAAM,CAAC;IACzF,mBAAmB,EAAE,uCAAuC;IAC5D,eAAe,EAAE,kCAAkC;CACpD,CAAC,CAAC;AAOH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAQ,MAAM,CAAC,MAAM,CAAC,WAAW,CAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,kCAAkC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAClD,CAAC;AAGD,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAElC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACzD,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACzD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC1G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC7D;;;;;;;OAOG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;SAC7H,QAAQ,CAAC,4TAA4T,CAAC;IACzU,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,4DAA4D;IAC5D,oFAAoF;IACpF,+EAA+E;IAC/E,kFAAkF;IAClF,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,4EAA4E;IAC5E,iFAAiF;IACjF,0DAA0D;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrH,mFAAmF;IACnF,iFAAiF;IACjF,iBAAiB;IACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACvF,QAAQ,CAAC,0LAA0L,CAAC;IACvM,8EAA8E;IAC9E,iFAAiF;IACjF,mFAAmF;IACnF,mFAAmF;IACnF,8CAA8C;IAC9C,2BAA2B,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACrF,QAAQ,CAAC,0IAA0I,CAAC;CACxJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,kHAAkH,CAAC;IACvK,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACzI,QAAQ,CAAC,0JAA0J,CAAC;IACvK,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,uHAAuH,CAAC;IAC3K,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAClG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACzI,QAAQ,CAAC,0JAA0J,CAAC;IACvK,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC;AAKH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IAClH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sFAAsF,CAAC;IACzI,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4HAA4H,CAAC;IAChL,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oFAAoF,CAAC;IAC9H,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yLAAyL,CAAC;IAC3O,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,mJAAmJ,CAAC;CACpM,CAAC,CAAC","sourcesContent":["/**\n * API Key Shared Schemas\n *\n * Frontend/backend shared API key schemas and DTOs only.\n * Backend-specific logic stays in saas-backend-lib.\n */\n\nimport { z } from 'zod';\nimport { RolesSchema } from '../authorizations/roles.shared.schemas';\nimport { ApiRequest_RateLimitSchema} from '../../requests/rate-limits.shared.schemas';\nimport { WildoHeaderKeys } from '../../requests/header-keys.shared';\n\n// ===============================\n// API KEY ENUMS\n// ===============================\n\n\n\nexport enum ApiKeyStatus {\n  ACTIVE = 'active',\n  INACTIVE = 'inactive',\n  EXPIRED = 'expired'\n}\n\nexport enum ApiKeyScope {\n  ORGANIZATION  = 'organization',\n  APPLICATION   = 'application',\n}\n\n/**\n * Public API-key presentation is one cross-layer contract.\n *\n * A key's scope decides the prefix that identifies it to request authentication;\n * the request itself carries the complete opaque key in the `Authorization`\n * field without an authentication scheme. That scheme-less presentation is an\n * application protocol contract, not OAuth bearer-token syntax. Keeping it at the shared\n * model boundary makes minting, request routing and consumer documentation\n * derive from one source instead of re-typing `sk_org_` / `sk_app_` in each.\n */\nexport const API_KEY_CREDENTIAL_PREFIX_BY_SCOPE: Readonly<Record<ApiKeyScope, string>> = Object.freeze({\n  [ApiKeyScope.ORGANIZATION]: 'sk_org_',\n  [ApiKeyScope.APPLICATION]: 'sk_app_',\n});\n\n/**\n * API keys reuse the request-authentication field name as their transport.\n *\n * This aliases the protocol-wide header vocabulary rather than re-declaring a\n * second literal. The raw value intentionally has no `Bearer` scheme, so callers\n * must follow this application's exact wire contract rather than infer OAuth syntax.\n * It belongs beside the prefix map because both values describe the one public\n * presentation contract of an API-key credential.\n */\nexport const API_KEY_CREDENTIAL_AUTHORIZATION_HEADER = WildoHeaderKeys.AUTHORIZATION;\n\n/** Complete public transport/prefix presentation used by request authentication and consumer documentation. */\nexport const API_KEY_CREDENTIAL_PRESENTATION: ApiKeyCredentialPresentation = Object.freeze({\n  authorizationHeader: API_KEY_CREDENTIAL_AUTHORIZATION_HEADER,\n  prefixesByScope: API_KEY_CREDENTIAL_PREFIX_BY_SCOPE,\n});\n\nexport interface ApiKeyCredentialPresentation {\n  readonly authorizationHeader: string;\n  readonly prefixesByScope: Readonly<Record<ApiKeyScope, string>>;\n}\n\nexport function apiKeyScopeForCredential(value: string): ApiKeyScope | null {\n  return (Object.values(ApiKeyScope) as ApiKeyScope[]).find((scope) => value.startsWith(API_KEY_CREDENTIAL_PREFIX_BY_SCOPE[scope])) ?? null;\n}\n\nexport function isApiKeyCredential(value: string): boolean {\n  return apiKeyScopeForCredential(value) !== null;\n}\n\n\n// ===============================\n// CORE API KEY SCHEMAS\n// ===============================\n\n// Base schema for extension (needs to be z.object for extend to work)\nexport const ApiKeySchemaBase = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n  description: z.string().max(500).optional(),\n  scope: z.enum(ApiKeyScope).isDBIndexed().isSummaryField(),\n  // `.isAuditEvidence()` on both: a machine credential's roles ARE its authority, and its status\n  // decides whether that authority is live. This resource exposes no core UPDATE and gates roles\n  // only at minting, so the before/after values are the only way to reconstruct what a key could\n  // do at a point in time. Closed vocabulary — no personal data reaches the audit ledger.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n  roles: z.array(RolesSchema).default([]).isAuditEvidence(),\n  status: z.enum(ApiKeyStatus).default(ApiKeyStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),\n  expiresAt: z.date().optional().isDBIndexed().isSummaryField(),\n  /**\n   * The capability grant this key was minted or reissued under (#1631), when a service firm's expert did it through a\n   * lent `MANAGE_API_KEYS`. Such a key's `expiresAt` is capped at the grant's end, and it is deactivated when the grant\n   * is revoked or its relationship ends — a secret handed to the firm under a lending ends with the lending. Absent for\n   * a key the organization's own administrators handled. Server-written only.\n   *\n   * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a credential obtained through delegated administration cannot outlive the delegation.\n   */\n  lentUnderCapabilityGrantId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence()\n    .describe('The capability grant a service firm\\'s expert minted or reissued this key under, through administration the organization lent the firm. Such a key expires no later than the grant and is deactivated when the grant is revoked or the relationship ends. Absent for a key the organization\\'s own administrators handled.'),\n  lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  // ── Rotation grace window ─────────────────────────────────────────────────\n  // When a key is ROTATED or REGENERATEd, the PRIOR secret is retained here so it\n  // keeps authenticating during an overlap window — callers can migrate to the new\n  // secret without a hard cutover. The bearer-token auth path\n  // (`execution-context-creator.backend.service.ts`) resolves a presented key against\n  // the current `hashedKey` OR this `previousHashedKey` while the window is open\n  // (`previousKeyInvalidationDate` is null or in the future) AND the key is ACTIVE.\n  // All three are server-managed by the rotate/regenerate impls only — never\n  // client-settable (`.excludeFromCreate().excludeFromUpdate()`).\n  //\n  // `previousHashedKey` — `sha256` of the prior secret; the auth path looks a\n  // presented key up against it, so it is `.isDBIndexed()`. Backend-only (a secret\n  // hash, never surfaced). Absent until the first rotation.\n  previousHashedKey: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n  // First 8 chars of the prior secret — retained for support/audit display while the\n  // previous secret is still valid (not a secret, so surfaced). Overwritten on the\n  // next rotation.\n  previousKeyPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate()\n    .describe('The first eight characters of the previous secret, which still authenticates until `previousKeyInvalidationDate`, or, when that is empty, until the key is rotated or regenerated again.'),\n  // When the previous secret stops authenticating. `null`/absent = no scheduled\n  // invalidation (REGENERATE overlap — the prior secret stays valid until the next\n  // rotation). A future date (ROTATE `oldKeyInvalidationDate`) = honored until then,\n  // then rejected. `now`/past (ROTATE default) = immediate hard cutover. Surfaced so\n  // operators can see when the old secret dies.\n  previousKeyInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate()\n    .describe('When the previous secret stops authenticating. Empty after a regenerate: the previous secret then keeps working until the next rotation.')\n});\n\nexport type ApiKeyBase = z.infer<typeof ApiKeySchemaBase>;\n\nexport const ApiKeyOrganizationSchema = ApiKeySchemaBase.extend({\n  scope: z.literal(ApiKeyScope.ORGANIZATION).describe(\"Always `organization`: the key authenticates on behalf of one organization, and its value starts with `sk_org_`.\"),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // Backend-only field - stored in DB but never sent to frontend (security)\n  // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n  // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n  // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n  // on every authenticated request). Without an index this is an O(n)\n  // collection scan per request. Compound unique guarantees only one\n  // active row per hash — cryptographically near-impossible by accident,\n  // but a uniqueness contract avoids two rows being returned to the\n  // resolver on a hash-collision and prevents shadow-key duplicates\n  // during rotation.\n  hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate()\n    .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),\n  keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyOrganization = z.infer<typeof ApiKeyOrganizationSchema>;\n\nexport const ApiKeyApplicationSchema = ApiKeySchemaBase.extend({\n  scope: z.literal(ApiKeyScope.APPLICATION).describe(\"Always `application`: the key authenticates on behalf of the application itself, and its value starts with `sk_app_`.\"),\n  applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // Backend-only field - stored in DB but never sent to frontend (security)\n  // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n  // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n  // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n  // on every authenticated request). Without an index this is an O(n)\n  // collection scan per request. Compound unique guarantees only one\n  // active row per hash — cryptographically near-impossible by accident,\n  // but a uniqueness contract avoids two rows being returned to the\n  // resolver on a hash-collision and prevents shadow-key duplicates\n  // during rotation.\n  hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate()\n    .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),\n  keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyApplication = z.infer<typeof ApiKeyApplicationSchema>;\n\n/**\n * API Key Context for middleware and validation\n */\nexport const ApiKeyOrganizationContextSchema = ApiKeyOrganizationSchema.extend({\n  rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyOrganizationContext = z.infer<typeof ApiKeyOrganizationContextSchema>;\n\nexport const ApiKeyApplicationContextSchema = ApiKeyApplicationSchema.extend({\n  rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyApplicationContext = z.infer<typeof ApiKeyApplicationContextSchema>;\n\n/**\n * The response of an API key's `usage_stats` operation — one definition for the organization key's two\n * variants and the application key's one, which used to be three hand-kept copies (#1797).\n *\n * The counts come from the usage recorder, which counts every request a key authenticates, in\n * per-minute and per-hour buckets. They are a rolling measurement over the last week, not a ledger.\n * Two fields the operation used to publish are gone rather than reported as zero, because nothing can\n * answer them truthfully: a LIFETIME request total needs a durable counter on the key, and a rate-limit\n * count needs a limiter that knows the key — every limiter in front of a REST request runs before the\n * key is resolved and counts by source address.\n */\nexport const ApiKeyUsageStatisticsResponseSchema = z.object({\n  keyId: z.string().describe('The id of the API key these statistics are for.'),\n  requestsLastHour: z.number().int().min(0).describe('Requests authenticated with this key in the last 60 minutes.'),\n  requestsLastDay: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 23 hours before it.'),\n  requestsLastWeek: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 167 hours before it. Counts older than that are not kept.'),\n  lastUsedAt: z.date().optional().describe('When the key was last accepted, to the minute. Absent when it has never been used.'),\n  mostUsedEndpoint: z.string().optional().describe('The route this key reached most often over the last week, as its method and path template (for example `GET /organizations/:organizationId/todos`). Absent when no request was counted.'),\n  errorRate: z.number().min(0).max(100).describe('The percentage of the last week\\'s requests that answered with a status of 400 or above, or were closed before an answer. 0 when there were none.'),\n});\nexport type ApiKeyUsageStatisticsResponse = z.infer<typeof ApiKeyUsageStatisticsResponseSchema>;\n"]}

package/dist/esm/security/authentications/anonymous-session/anonymous-session.shared.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-session.shared.contract.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/anonymous-session/anonymous-session.shared.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oCAAoC;;;CAGvC,CAAC;AAEX,MAAM,MAAM,+BAA+B,GACzC,OAAO,oCAAoC,CAAC,MAAM,OAAO,oCAAoC,CAAC,CAAC;AAOjG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,8BAA8B;;;;CAIjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,OAAO,8BAA8B,CAAC,MAAM,OAAO,8BAA8B,CAAC,CAAC;AAOrF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B;;;CAG/B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,mCAAmC,EAAG,KAAc,CAAC;AAOlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzD,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;CAC9B,CAIC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,sCAAsC;IAChD,IAAI,SAAiB;IACrB,YAAY,iBAAiB;IAC7B,MAAM,WAAiB;IACvB,WAAW,gBAAiB;IAC5B,OAAO,YAAiB;CACzB;AAED,eAAO,MAAM,wCAAwC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,sCAAsC,CAC9D,CAAC;AAEjD,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC"}
+{"version":3,"file":"anonymous-session.shared.contract.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/anonymous-session/anonymous-session.shared.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oCAAoC;;;CAGvC,CAAC;AAEX,MAAM,MAAM,+BAA+B,GACzC,OAAO,oCAAoC,CAAC,MAAM,OAAO,oCAAoC,CAAC,CAAC;AAOjG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,8BAA8B;;;;CAIjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,OAAO,8BAA8B,CAAC,MAAM,OAAO,8BAA8B,CAAC,CAAC;AAOrF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B;;;CAG/B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,mCAAmC,EAAG,KAAc,CAAC;AAOlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzD,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;IAC7B,GAAG,EAAc,CAAC,CAAC,SAAS,CAAC;CAC9B,CAIC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,oBAAY,sCAAsC;IAChD,IAAI,SAAiB;IACrB,YAAY,iBAAiB;IAC7B,MAAM,WAAiB;IACvB,WAAW,gBAAiB;IAC5B,OAAO,YAAiB;CACzB;AAED,eAAO,MAAM,wCAAwC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,sCAAsC,CAC9D,CAAC;AAEjD,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC"}

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts

@@ -4,7 +4,7 @@
  * Core authentication schemas shared between frontend and backend
  */
 import { z } from 'zod';
-import { AuthMethod, AuthFactorLevel, AuthNextStep, AuthSessionPurpose, AuthScopeType } from './authentication.shared.schemas';
+import { AuthMethod, AuthFactorLevel, AuthNextStep, AuthSessionPurpose, AuthScopeType, SsoConnectionType } from './authentication.shared.schemas';
 import { SessionType } from '../../runtime/execution-context.shared.schemas';
 /**
  * Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,
@@ -34,7 +34,8 @@ export declare const AuthInvitationInfoResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -88,7 +89,8 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -112,7 +114,8 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -134,6 +137,7 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
     organizationBranding: z.ZodOptional<z.ZodObject<{
         logoUrl: z.ZodOptional<z.ZodString>;
         primaryColor: z.ZodOptional<z.ZodString>;
+        faviconUrl: z.ZodOptional<z.ZodString>;
         organizationName: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     availableIntegrations: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -222,13 +226,25 @@ export declare const TOTPAuthRequestSchema: z.ZodObject<{
 /**
  * SMS OTP Authentication (First or second factor)
  */
+/**
+ * Verifying an SMS one-time code.
+ *
+ * There is deliberately NO `phoneNumber` here. One was accepted — optional, E.164-shaped — and read
+ * by nothing: the code is matched by the session's account and the session id, and the destination
+ * was always resolved from the account. Its only effect was that the value a CALLER supplied was
+ * written into both audit rows as though it were the number the code went to, so a caller could
+ * attribute their own attempts to a number that was never involved. An audit trail whose subject
+ * chooses what it says about them is not attributable.
+ *
+ * No first-party client ever sent it — the engine's own `SmsOtpAuthMethod` calls
+ * `handleMfaVerify(sessionId, method, code)` — so removing it takes nothing away from a caller.
+ */
 export declare const SMSOTPAuthRequestSchema: z.ZodObject<{
     sessionId: z.ZodString;
     rememberMe: z.ZodDefault<z.ZodBoolean>;
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
     method: z.ZodLiteral<AuthMethod.SMS_OTP>;
     factorLevel: z.ZodUnion<readonly [z.ZodLiteral<AuthFactorLevel.FIRST>, z.ZodLiteral<AuthFactorLevel.SECOND>]>;
-    phoneNumber: z.ZodOptional<z.ZodString>;
     token: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /**
@@ -265,6 +281,22 @@ export declare const PasskeyAuthRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"public-key">;
     }, z.core.$strip>;
 }, z.core.$strip>;
+/**
+ * The longest deep link an emailed sign-in link carries. A longer same-origin path is dropped, not refused.
+ */
+export declare const MAX_CARRIED_AUTH_REDIRECT_LENGTH = 2048;
+/**
+ * Decide whether a request's post-auth deep link rides an emailed sign-in link (#1014) — shared by the
+ * magic-link send, the invitation accept and password-less registration (#1086), the requests that email one.
+ *
+ * Kept only when it is a same-origin path by {@link isSameOriginRedirectPath} (the one predicate every
+ * auth redirect answers through) and no longer than {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}; otherwise
+ * `undefined`. An absolute or foreign value would turn a trusted application email into an open redirect
+ * that fires right after the person proves who they are. Dropping rather than a 400 — for the length too —
+ * keeps the request's answer identical for every redirect (the send's anti-enumeration contract), and a
+ * person whose redirect was dropped still signs in, at the application home.
+ */
+export declare function carriedAuthRedirect(value: string | undefined): string | undefined;
 /**
  * Magic Link Send Request — triggers a magic link email to the user.
  * Separate from the main AuthenticationRequestSchema because it doesn't
@@ -273,6 +305,7 @@ export declare const PasskeyAuthRequestSchema: z.ZodObject<{
 export declare const MagicLinkSendRequestSchema: z.ZodObject<{
     email: z.ZodEmail;
     organizationId: z.ZodOptional<z.ZodString>;
+    redirect: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string, string>>;
 }, z.core.$strip>;
 /**
  * Magic Link Verify Request — verifies the token from the magic link.
@@ -347,7 +380,6 @@ export declare const AuthenticationRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
     requestedIntegrations: z.ZodDefault<z.ZodArray<z.ZodString>>;
     method: z.ZodLiteral<AuthMethod.SMS_OTP>;
     factorLevel: z.ZodUnion<readonly [z.ZodLiteral<AuthFactorLevel.FIRST>, z.ZodLiteral<AuthFactorLevel.SECOND>]>;
-    phoneNumber: z.ZodOptional<z.ZodString>;
     token: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     sessionId: z.ZodString;
@@ -414,6 +446,7 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
     user: z.ZodOptional<z.ZodObject<{
         _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
         email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>>>>;
+        emailVerifiedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
         status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").UserStatus>>>>>>;
         appRoles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_APP_ROLES>, z.ZodString]>>>>>;
         userTypes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
@@ -436,14 +469,12 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
             userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
             notifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
                 email: z.ZodDefault<z.ZodBoolean>;
-                push: z.ZodDefault<z.ZodBoolean>;
-                sms: z.ZodDefault<z.ZodBoolean>;
                 inApp: z.ZodDefault<z.ZodBoolean>;
             }, z.core.$strip>>>;
-            privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
-                dataProcessingConsent: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").DataProcessingConsent>>>;
-                privacyLevel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").PrivacyLevel>>>;
-            }, z.core.$strip>>>;
+            privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
+                consentedPurposes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("../..").ConsentPurpose>>>>>;
+                consentDecidedAt: z.ZodOptional<z.ZodDate>;
+            }, z.core.$strip>>>>;
             ui: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
                 theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("../..").UserTheme>>>;
             }, z.core.$strip>>>;
@@ -456,13 +487,12 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
             languagePreferences: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
                 primaryLanguage: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>;
                 fallbackLanguages: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>>;
-                autoDetect: z.ZodDefault<z.ZodBoolean>;
                 useOrganizationDefault: z.ZodDefault<z.ZodBoolean>;
             }, z.core.$strip>>>>;
         }, z.core.$strip>>;
         organizationMembers: z.ZodOptional<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
             _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+            userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
             userEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEmail>>>>>>;
             organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
             roles: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("../..").CORE_ORG_ROLES>, z.ZodString]>>>>>>;
@@ -471,6 +501,9 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
             userTitle: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
             invitedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
             invitedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
+            serviceProviderRelationshipId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>>;
+            providerOrganizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>>;
+            providerOrganizationName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
             instanceLabel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
             createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
             updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
@@ -490,7 +523,8 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -518,6 +552,7 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
     retryAllowed: z.ZodDefault<z.ZodBoolean>;
     remainingAttempts: z.ZodOptional<z.ZodNumber>;
     lockoutUntil: z.ZodOptional<z.ZodDate>;
+    passkeyCredentialUnknown: z.ZodOptional<z.ZodBoolean>;
     challengeData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     redirectUrl: z.ZodOptional<z.ZodURL>;
 }, z.core.$strip>;
@@ -543,6 +578,19 @@ export declare const MFASetupResponseSchema: z.ZodObject<{
 /**
  * Authentication Session State
  */
+/**
+ * Something an account owes before a parked sign-in may complete (#1374).
+ *
+ * `ONBOARDING_PENDING` used to mean exactly one thing — the organization named at onboarding — and could not carry
+ * a second. Each member is derived from durable state, has its own step and completion door, and has its own
+ * "can this ever finish?" answer, so one unfulfillable obligation never strands an account that owes another.
+ */
+export declare enum OnboardingObligation {
+    /** The organization the user type names at onboarding (`pendingOrgType` names its type). */
+    ORGANIZATION = "organization",
+    /** The person's first and last name, when the user type collects them at onboarding. */
+    PROFILE_NAMES = "profile_names"
+}
 export declare enum AuthenticationSessionState {
     CREATED = "CREATED",// Session created, waiting for identification
     IDENTIFIED = "IDENTIFIED",// User identified, methods available
@@ -552,17 +600,41 @@ export declare enum AuthenticationSessionState {
     SECOND_FACTOR_IN_PROGRESS = "SECOND_FACTOR_IN_PROGRESS",// Second factor in progress
     COMPLETED = "COMPLETED",// Authentication completed successfully
     PASSWORD_EXPIRED = "PASSWORD_EXPIRED",// W2.2: Password expired, must change before token issuance
-    REGISTERED = "REGISTERED",// Account created, email verification pending/deferred
+    REGISTERED = "REGISTERED",// Invitation acceptance's correlation session (audit id only); self-registration creates none since #1010
     EMAIL_VERIFIED = "EMAIL_VERIFIED",// Email confirmed, checking MFA requirements
     MFA_ENROLLMENT_REQUIRED = "MFA_ENROLLMENT_REQUIRED",// MFA enrollment needed before tokens can be issued
     MFA_ENROLLMENT_GRACE = "MFA_ENROLLMENT_GRACE",// Within grace period — tokens issued with mfaGraceExpiresAt claim
-    ONBOARDING_PENDING = "ONBOARDING_PENDING",// Auth complete, guidance/onboarding steps remain
+    ONBOARDING_PENDING = "ONBOARDING_PENDING",// Auth complete, the organization named at onboarding is still owed — reached by the registration pipeline AND, since #1091, by a login of an account that owes one
     FAILED = "FAILED",// Authentication failed
     EXPIRED = "EXPIRED",// Session expired
     LOCKED = "LOCKED"
 }
 /** W4.2: Session purpose — drives UI rendering and valid state transitions. */
 export declare const AuthSessionPurposeSchema: z.ZodEnum<typeof AuthSessionPurpose>;
+/**
+ * #1103 — what a FEDERATED sign-in (OAuth2 / OIDC callback, SAML ACS) established about itself, carried on the
+ * session it was parked on when the account still owed its organization at onboarding.
+ *
+ * A federated sign-in that completes at once records `USER_SSO_LOGIN` with this evidence on the spot. A parked
+ * one signs nobody in yet, so the record waits for the onboarding completion that does — and without this object
+ * that completion could only record a generic login, losing which provider and connection proved the identity
+ * and the provider MFA assurance verdict (a `WARNED` verdict exists nowhere else once the callback has returned).
+ * The auth source is not stored: it follows from the proved factor (`ORG_SAML` is SAML, the other federated
+ * methods are OIDC).
+ */
+export declare const FederatedSignInEvidenceSchema: z.ZodObject<{
+    providerRef: z.ZodString;
+    connectionType: z.ZodEnum<typeof SsoConnectionType>;
+    scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    applicationId: z.ZodOptional<z.ZodString>;
+    assurance: z.ZodOptional<z.ZodObject<{
+        decision: z.ZodEnum<typeof import("../..").ExternalAssuranceDecision>;
+        reason: z.ZodEnum<typeof import("../..").ExternalAssuranceReason>;
+        enforcement: z.ZodEnum<typeof import("../..").ExternalAssuranceEnforcement>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type FederatedSignInEvidence = z.infer<typeof FederatedSignInEvidenceSchema>;
 /**
  * Authentication Session Schema
  * Tracks the complete state of an authentication session
@@ -581,8 +653,22 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
     nextStep: z.ZodOptional<z.ZodEnum<typeof AuthNextStep>>;
     mfaGraceExpiresAt: z.ZodOptional<z.ZodString>;
     pendingOrgType: z.ZodOptional<z.ZodString>;
+    pendingObligations: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof OnboardingObligation>>>;
+    federatedSignIn: z.ZodOptional<z.ZodObject<{
+        providerRef: z.ZodString;
+        connectionType: z.ZodEnum<typeof SsoConnectionType>;
+        scopeType: z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>;
+        organizationId: z.ZodOptional<z.ZodString>;
+        applicationId: z.ZodOptional<z.ZodString>;
+        assurance: z.ZodOptional<z.ZodObject<{
+            decision: z.ZodEnum<typeof import("../..").ExternalAssuranceDecision>;
+            reason: z.ZodEnum<typeof import("../..").ExternalAssuranceReason>;
+            enforcement: z.ZodEnum<typeof import("../..").ExternalAssuranceEnforcement>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     availableEnrollmentMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
     completedFactors: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+    passkeyUserVerified: z.ZodOptional<z.ZodBoolean>;
     currentFactor: z.ZodOptional<z.ZodEnum<typeof AuthFactorLevel>>;
     availableFirstFactorMethods: z.ZodDefault<z.ZodArray<z.ZodObject<{
         method: z.ZodEnum<typeof AuthMethod>;
@@ -590,7 +676,8 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -613,7 +700,8 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
         category: z.ZodEnum<typeof import("./authentication.shared.schemas").AuthMethodCategory>;
         canBeFirstFactor: z.ZodBoolean;
         canBeSecondFactor: z.ZodBoolean;
-        required: z.ZodBoolean;
+        enforcedFirstFactor: z.ZodBoolean;
+        satisfiesRequiredSecondFactor: z.ZodBoolean;
         oauth2ProviderRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssoIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
         organizationRestricted: z.ZodDefault<z.ZodBoolean>;
@@ -651,6 +739,7 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
     organizationBranding: z.ZodOptional<z.ZodObject<{
         logoUrl: z.ZodOptional<z.ZodString>;
         primaryColor: z.ZodOptional<z.ZodString>;
+        faviconUrl: z.ZodOptional<z.ZodString>;
         organizationName: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     version: z.ZodDefault<z.ZodNumber>;
@@ -659,6 +748,15 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
  * Identify step form DTO — user enters email to discover auth methods.
  * Used by the public auth page's first step.
  */
+/**
+ * The sign-in identification form.
+ *
+ * The email field renders `autocomplete="username webauthn"`: `webauthn` is what lets the browser offer
+ * the person's passkeys for this site in the field's autofill list (conditional mediation), so they can
+ * sign in by picking an account instead of typing an email and choosing a method.
+ *
+ * spec-cite: https://web.dev/articles/passkey-form-autofill — the username input requires `autocomplete="username webauthn"`: "Include both `username` and `webauthn` as space-separated values."
+ */
 export declare const AuthIdentifyFormDtoSchema: z.ZodObject<{
     email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>;
 }, z.core.$strip>;
@@ -713,6 +811,22 @@ export declare const PhoneEnrollmentVerifyFormDtoSchema: z.ZodObject<{
 export declare const TotpEnrollmentVerifyFormDtoSchema: z.ZodObject<{
     code: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * `POST /auth/token/exchange` — the answer when the one-time code parked a FEDERATED sign-in at organization
+ * onboarding instead of signing it in (#1103).
+ *
+ * An OAuth2 / OIDC callback or a SAML ACS for an account that still owes its organization (#1091) opens an
+ * authentication session at `ONBOARDING_PENDING` and puts THAT in the exchange code rather than tokens. Redeeming
+ * the code answers with the session to complete on the organization-onboarding step, and nothing else: no access
+ * token, and no refresh cookie. Deliberately a SEPARATE schema from `TokenExchangeResponseSchema`, whose strict
+ * signed-in shape the docs site also parses: a handoff code redeemed there can never be parked, and widening that
+ * shape would make every receiver narrow for a case only the SaaS frontend meets.
+ */
+export declare const TokenExchangeOrganizationOnboardingResponseSchema: z.ZodObject<{
+    nextStep: z.ZodLiteral<AuthNextStep.ONBOARDING>;
+    sessionId: z.ZodString;
+}, z.core.$strict>;
+export type TokenExchangeOrganizationOnboardingResponse = z.infer<typeof TokenExchangeOrganizationOnboardingResponseSchema>;
 /**
  * One-off session token exchange response.
  *

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EAEd,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8B3C,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;iBAKlC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6CvC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,uDAAuD;IACtG,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,kDAAkD;IAGjG,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+FtC,CAAC;AAWH;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}
+{"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiC3C,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBAIlC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIjF;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;iBAWrC,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsDvC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,oBAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,YAAY,iBAAiB;IAC7B,wFAAwF;IACxF,aAAa,kBAAkB;CAChC;AAED,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,0GAA0G;IACzJ,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,oKAAoK;IAGnN,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgJtC,CAAC;AAWH;;;GAGG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iDAAiD;;;kBAG5D,CAAC;AAEH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}