@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/security/authentications/registration.shared.dto.schemas.d.ts

@@ -5,6 +5,7 @@
  * Used by both frontend (AutomatedForm component) and backend (req.body parsing).
  */
 import { z } from 'zod';
+import type { OnboardingSurveyQuestion } from '../../config/frontend/onboarding.shared.schemas';
 import { AuthMethod } from './authentication.shared.schemas';
 /**
  * POST /auth/register — registration form fields.
@@ -17,6 +18,45 @@ import { AuthMethod } from './authentication.shared.schemas';
  * (not here) because the error message needs i18n.
  * The .isPassword() decorator tells FormField to render password inputs.
  */
+/**
+ * Answers to the extra profile questions a user type declares for sign-up (#1371).
+ *
+ * Keyed by the question's `id`, valued by the scalar kinds a bindable question can produce. It is
+ * NOT a free-form bag: the server validates every key against the resolved user type's own
+ * `registration.additionalProfileQuestions` and refuses anything undeclared, so a client cannot use
+ * it to write a profile field the application never asked about.
+ */
+export declare const RegistrationProfileAnswersSchema: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+export type RegistrationProfileAnswers = z.infer<typeof RegistrationProfileAnswersSchema>;
+/** What the declaration made of the answers a registrant submitted. */
+export interface ResolvedRegistrationProfileAnswers {
+    /** Profile FIELD → value, ready to ride the composition seed. Keyed by `bindToField`, not by question id. */
+    readonly profileFields: Record<string, string | number | boolean>;
+    /** Submitted keys this user type never declared. Non-empty means the payload is refused. */
+    readonly undeclaredQuestionIds: readonly string[];
+    /** Declared-and-required questions with no usable answer. Non-empty means the payload is refused. */
+    readonly missingRequiredQuestionIds: readonly string[];
+}
+/**
+ * Reconcile submitted sign-up answers against the questions the user type actually declares (#1371).
+ *
+ * Shared rather than written in the controller, because the FORM builds its fields from the same
+ * declaration: one function decides what a question means, so the screen and the server cannot
+ * disagree about which answers are legitimate.
+ *
+ * ## Undeclared keys are REFUSED, not dropped
+ *
+ * Dropping would make `profileAnswers` a silent no-op for a client that names a field the
+ * application never asked about — and silence is exactly how a write reaches a place nobody
+ * intended. Refusing keeps the transport a projection of the declaration rather than a door onto
+ * the profile.
+ *
+ * ## An empty string is not an answer
+ *
+ * A required question submitted as `''` is MISSING, not answered. Without that, a required question
+ * is satisfied by a field the person tabbed through, which is the opposite of what `required` means.
+ */
+export declare function resolveRegistrationProfileAnswers(declaredQuestions: readonly OnboardingSurveyQuestion[] | undefined, submitted: RegistrationProfileAnswers | undefined): ResolvedRegistrationProfileAnswers;
 export declare const UserRegisterFormDtoSchema: z.ZodObject<{
     email: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEmail>;
     firstName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
@@ -33,11 +73,14 @@ export type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;
  */
 export declare const UserRegisterApiDtoSchema: z.ZodObject<{
     email: z.ZodEmail;
-    firstName: z.ZodString;
-    lastName: z.ZodString;
+    firstName: z.ZodOptional<z.ZodString>;
+    lastName: z.ZodOptional<z.ZodString>;
     password: z.ZodOptional<z.ZodString>;
     organizationName: z.ZodOptional<z.ZodString>;
     method: z.ZodOptional<z.ZodEnum<typeof AuthMethod>>;
+    acceptedGovernedDocumentReleaseIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    redirect: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string, string>>;
+    profileAnswers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
 }, z.core.$strip>;
 export type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;
 /**
@@ -96,6 +139,7 @@ export declare const UserInvitationApiDtoSchema: z.ZodObject<{
         MAGIC_LINK: AuthMethod.MAGIC_LINK;
         PASSKEY: AuthMethod.PASSKEY;
     }>>;
+    redirect: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string, string>>;
 }, z.core.$strip>;
 export type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;
 /**
@@ -116,4 +160,46 @@ export declare const EmailVerifyDtoSchema: z.ZodObject<{
     email: z.ZodEmail;
 }, z.core.$strip>;
 export type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;
+/**
+ * POST /auth/onboarding/complete-org — the organization-name step (#1090).
+ *
+ * Shown to an account whose authentication session is parked at `ONBOARDING_PENDING`: after registration, email
+ * verification or enrollment when its user type names its organization at onboarding, or after a sign-in answered
+ * `nextStep: onboarding` because the account still owes one (#1091). The frontend AutomatedForm schema; the API
+ * contract below adds the session id.
+ */
+export declare const OrganizationOnboardingFormDtoSchema: z.ZodObject<{
+    organizationName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+}, z.core.$strip>;
+export type OrganizationOnboardingFormDto = z.infer<typeof OrganizationOnboardingFormDtoSchema>;
+/**
+ * POST /auth/onboarding/complete-org — API contract. `sessionId` is the parked session the answer that led
+ * here carried; it is what authorizes the completion, and the completion consumes it.
+ */
+export declare const OrganizationOnboardingCompleteApiDtoSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    organizationName: z.ZodString;
+}, z.core.$strip>;
+export type OrganizationOnboardingCompleteApiDto = z.infer<typeof OrganizationOnboardingCompleteApiDtoSchema>;
+/**
+ * POST /auth/onboarding/complete-profile — API contract (#1374). Discharges
+ * `OnboardingObligation.PROFILE_NAMES` on the parked session: the person's first and last name, collected after
+ * the address and credential were proven. Same bounds as the sign-up form's name fields, and trimmed, so a name
+ * of spaces is refused rather than stored.
+ */
+export declare const ProfileOnboardingCompleteApiDtoSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    firstName: z.ZodString;
+    lastName: z.ZodString;
+}, z.core.$strip>;
+export type ProfileOnboardingCompleteApiDto = z.infer<typeof ProfileOnboardingCompleteApiDtoSchema>;
+/**
+ * The onboarding step's names form (#1374) — the sign-up form's own two name fields, so the same bounds and the
+ * same autocomplete hints apply wherever the names are asked.
+ */
+export declare const ProfileOnboardingFormDtoSchema: z.ZodObject<{
+    firstName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    lastName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+}, z.core.$strip>;
+export type ProfileOnboardingFormDto = z.infer<typeof ProfileOnboardingFormDtoSchema>;
 //# sourceMappingURL=registration.shared.dto.schemas.d.ts.map

package/dist/esm/security/authentications/registration.shared.dto.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAM7D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAoBpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;iBAkBnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;iBAqBtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,2EAIvC,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC;AAErG;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;iBASrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"registration.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAEhG,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAO7D;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,yFAG5C,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,uEAAuE;AACvE,MAAM,WAAW,kCAAkC;IACjD,6GAA6G;IAC7G,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IAClE,4FAA4F;IAC5F,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,qGAAqG;IACrG,QAAQ,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC;CACxD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iCAAiC,CAC/C,iBAAiB,EAAE,SAAS,wBAAwB,EAAE,GAAG,SAAS,EAClE,SAAS,EAAE,0BAA0B,GAAG,SAAS,GAChD,kCAAkC,CAsBpC;AAED,eAAO,MAAM,yBAAyB;;;;;;;iBAoBpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;iBAuDnC,CAAC;AAGH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;iBAqBtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,2EAIvC,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,OAAO,oCAAoC,CAAC,CAAC,MAAM,CAAC,CAAC;AAErG;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAgBrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;iBAG3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAoBlE;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC;;iBAI9C,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;GAGG;AACH,eAAO,MAAM,0CAA0C;;;iBAGrD,CAAC;AAEH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC;;;;iBAIhD,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;iBAAsE,CAAC;AAElH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/esm/security/authentications/registration.shared.dto.schemas.js

@@ -7,6 +7,7 @@
 import { z } from 'zod';
 import { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';
 import { AuthMethod } from './authentication.shared.schemas.js';
+import { carriedAuthRedirect } from './authentication.shared.dto.schemas.js';
 // ═══════════════════════════════════════════════════════════════
 // Registration Form + API DTO
 // ═══════════════════════════════════════════════════════════════
@@ -21,6 +22,56 @@ import { AuthMethod } from './authentication.shared.schemas.js';
  * (not here) because the error message needs i18n.
  * The .isPassword() decorator tells FormField to render password inputs.
  */
+/**
+ * Answers to the extra profile questions a user type declares for sign-up (#1371).
+ *
+ * Keyed by the question's `id`, valued by the scalar kinds a bindable question can produce. It is
+ * NOT a free-form bag: the server validates every key against the resolved user type's own
+ * `registration.additionalProfileQuestions` and refuses anything undeclared, so a client cannot use
+ * it to write a profile field the application never asked about.
+ */
+export const RegistrationProfileAnswersSchema = z.record(z.string().min(1), z.union([z.string(), z.number(), z.boolean()]));
+/**
+ * Reconcile submitted sign-up answers against the questions the user type actually declares (#1371).
+ *
+ * Shared rather than written in the controller, because the FORM builds its fields from the same
+ * declaration: one function decides what a question means, so the screen and the server cannot
+ * disagree about which answers are legitimate.
+ *
+ * ## Undeclared keys are REFUSED, not dropped
+ *
+ * Dropping would make `profileAnswers` a silent no-op for a client that names a field the
+ * application never asked about — and silence is exactly how a write reaches a place nobody
+ * intended. Refusing keeps the transport a projection of the declaration rather than a door onto
+ * the profile.
+ *
+ * ## An empty string is not an answer
+ *
+ * A required question submitted as `''` is MISSING, not answered. Without that, a required question
+ * is satisfied by a field the person tabbed through, which is the opposite of what `required` means.
+ */
+export function resolveRegistrationProfileAnswers(declaredQuestions, submitted) {
+    const questions = declaredQuestions ?? [];
+    const answers = submitted ?? {};
+    const byId = new Map(questions.map((question) => [question.id, question]));
+    const undeclaredQuestionIds = Object.keys(answers).filter((id) => !byId.has(id));
+    const profileFields = {};
+    const missingRequiredQuestionIds = [];
+    for (const question of questions) {
+        const value = answers[question.id];
+        const isAnswered = value !== undefined && value !== '';
+        if (!isAnswered) {
+            if (question.required)
+                missingRequiredQuestionIds.push(question.id);
+            continue;
+        }
+        // `bindToField` is guaranteed by the config schema, which refuses a sign-up question without
+        // one. Guarded anyway: this function is exported and a caller may hold a hand-built list.
+        if (question.bindToField)
+            profileFields[question.bindToField] = value;
+    }
+    return { profileFields, undeclaredQuestionIds, missingRequiredQuestionIds };
+}
 export const UserRegisterFormDtoSchema = z.object({
     email: z.email().toLowerCase().stringUI({
         edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },
@@ -49,8 +100,13 @@ export const UserRegisterFormDtoSchema = z.object({
  */
 export const UserRegisterApiDtoSchema = z.object({
     email: z.email().toLowerCase(),
-    firstName: z.string().min(1).max(50),
-    lastName: z.string().min(1).max(50),
+    /**
+     * Optional on the WIRE because a user type may collect the names at onboarding instead (#1374,
+     * `ProfileNamesCollectionMoment.ONBOARDING`). Whether they are required is decided per user type by the
+     * registration service — a `REGISTRATION`-moment user type is refused without them, exactly as before.
+     */
+    firstName: z.string().min(1).max(50).optional(),
+    lastName: z.string().min(1).max(50).optional(),
     password: z.string().min(1).optional(),
     /** W6.2: Org name when orgNameSource is 'ask'. */
     organizationName: z.string().min(1).max(200).optional(),
@@ -65,6 +121,38 @@ export const UserRegisterApiDtoSchema = z.object({
      * which is a better answer than a schema rejection that cannot say what IS allowed.
      */
     method: z.enum(AuthMethod).optional(),
+    /**
+     * Which governed-document releases the registrant AFFIRMATIVELY accepted (issue #54).
+     *
+     * Release IDS only, and the asymmetry is the security property: the client supplies WHETHER a box
+     * was ticked, and the SERVER supplies everything else. It resolves the in-force releases from
+     * `compliance.governedDocumentReleases`, matches these ids against them, and records the matches.
+     * An id naming nothing in force is ignored rather than refused — a stale form is a stale form, and
+     * a registration is not the place to fail on one. So a caller cannot choose which VERSION of the
+     * terms they accepted, cannot invent a release, and cannot accept a document the application does
+     * not publish.
+     *
+     * Absent ⇒ nothing was accepted, which is what a client predating this field means and also what a
+     * registrant who ticked nothing means. Those two are deliberately the same answer: the record says
+     * what was accepted, never what was refused.
+     */
+    acceptedGovernedDocumentReleaseIds: z.array(z.string().min(1)).max(20).optional(),
+    /**
+     * The deep link the registration screen was opened with, carried into the emailed sign-in link of a
+     * PASSWORD-LESS signup (#1086) — the one register outcome that signs the person in on another page.
+     * Decided by {@link carriedAuthRedirect}, the same rule as the magic-link send and the invitation accept:
+     * kept only when same-origin and within bounds, otherwise dropped, never refused.
+     */
+    redirect: z.string().optional().transform(carriedAuthRedirect),
+    /**
+     * Answers to the user type's declared sign-up profile questions (#1371), keyed by question id.
+     *
+     * Validated SERVER-SIDE against that user type's own declaration — an undeclared key is refused
+     * rather than ignored, so this cannot become a door onto arbitrary profile fields. The form half
+     * is built at render time, because the questions are runtime configuration and a module-scope Zod
+     * object cannot carry a field per application.
+     */
+    profileAnswers: RegistrationProfileAnswersSchema.optional(),
 });
 // ═══════════════════════════════════════════════════════════════
 // Invitation Acceptance DTOs
@@ -135,6 +223,13 @@ export const UserInvitationApiDtoSchema = z.object({
     lastName: z.string().trim().min(1).max(50),
     password: z.string().optional(),
     credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),
+    /**
+     * The deep link the invitation was opened with, carried into the emailed link when `credentialMethod` is
+     * `MAGIC_LINK` (#1014) — the one accept outcome that signs the invitee in on another page. Decided by
+     * {@link carriedAuthRedirect}, the same rule as the magic-link send: kept only when same-origin and within
+     * bounds, otherwise dropped, never refused.
+     */
+    redirect: z.string().optional().transform(carriedAuthRedirect),
 });
 /**
  * POST /auth/invitation/reject — API contract.
@@ -155,4 +250,56 @@ export const EmailVerifyDtoSchema = z.object({
     token: z.string().min(1),
     email: z.email().toLowerCase(),
 });
+// ═══════════════════════════════════════════════════════════════
+// Organization Onboarding Form + API DTO
+// ═══════════════════════════════════════════════════════════════
+/**
+ * The characters an organization name may not contain. Markup delimiters, quotes and code punctuation are
+ * refused so a name renders as text wherever it is shown. One definition, so the onboarding form refuses
+ * exactly what `POST /auth/onboarding/complete-org` refuses.
+ */
+const ORGANIZATION_NAME_DISALLOWED_CHARACTERS = /^[^<>"'`;{}()\\]+$/;
+/**
+ * An organization name, as onboarding accepts it: trimmed FIRST, so a whitespace-only name fails `min(1)` at
+ * the boundary rather than trimming to empty after it. The ONE definition — the form and the API contract
+ * below both use it, so the form refuses exactly what `POST /auth/onboarding/complete-org` refuses.
+ */
+const OnboardingOrganizationNameSchema = z.string().trim().min(1).max(200).regex(ORGANIZATION_NAME_DISALLOWED_CHARACTERS);
+/**
+ * POST /auth/onboarding/complete-org — the organization-name step (#1090).
+ *
+ * Shown to an account whose authentication session is parked at `ONBOARDING_PENDING`: after registration, email
+ * verification or enrollment when its user type names its organization at onboarding, or after a sign-in answered
+ * `nextStep: onboarding` because the account still owes one (#1091). The frontend AutomatedForm schema; the API
+ * contract below adds the session id.
+ */
+export const OrganizationOnboardingFormDtoSchema = z.object({
+    organizationName: OnboardingOrganizationNameSchema.stringUI({
+        edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },
+    }),
+});
+/**
+ * POST /auth/onboarding/complete-org — API contract. `sessionId` is the parked session the answer that led
+ * here carried; it is what authorizes the completion, and the completion consumes it.
+ */
+export const OrganizationOnboardingCompleteApiDtoSchema = z.object({
+    sessionId: z.string().min(1),
+    organizationName: OnboardingOrganizationNameSchema,
+});
+/**
+ * POST /auth/onboarding/complete-profile — API contract (#1374). Discharges
+ * `OnboardingObligation.PROFILE_NAMES` on the parked session: the person's first and last name, collected after
+ * the address and credential were proven. Same bounds as the sign-up form's name fields, and trimmed, so a name
+ * of spaces is refused rather than stored.
+ */
+export const ProfileOnboardingCompleteApiDtoSchema = z.object({
+    sessionId: z.string().min(1),
+    firstName: z.string().trim().min(1).max(50),
+    lastName: z.string().trim().min(1).max(50),
+});
+/**
+ * The onboarding step's names form (#1374) — the sign-up form's own two name fields, so the same bounds and the
+ * same autocomplete hints apply wherever the names are asked.
+ */
+export const ProfileOnboardingFormDtoSchema = UserRegisterFormDtoSchema.pick({ firstName: true, lastName: true });
 //# sourceMappingURL=registration.shared.dto.schemas.js.map

package/dist/esm/security/authentications/registration.shared.dto.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,8FAA8F;IAC9F,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACzC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACV,CAAC;AAWX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8EAA8E;IAC9E,gFAAgF;IAChF,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC","sourcesContent":["/**\n * User Registration — Shared DTO Schemas\n *\n * Single source of truth for user registration validation.\n * Used by both frontend (AutomatedForm component) and backend (req.body parsing).\n */\n\nimport { z } from 'zod';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\nimport { AuthMethod } from './authentication.shared.schemas';\n\n// ═══════════════════════════════════════════════════════════════\n// Registration Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/register — registration form fields.\n * Used as:\n * - Frontend: AutomatedForm schema (all 5 fields rendered)\n * - Backend: req.body parsing (minus confirmPassword)\n *\n * confirmPassword is a frontend-only field for client-side match validation.\n * The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n.\n * The .isPassword() decorator tells FormField to render password inputs.\n */\nexport const UserRegisterFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n  }),\n  firstName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  /** W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. */\n  organizationName: z.string().min(1).max(200).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n  }).optional(),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\n\nexport type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;\n\n/**\n * POST /auth/register — API contract (what goes over the wire).\n * Backend uses this for req.body parsing.\n * confirmPassword is NOT sent to the backend.\n */\nexport const UserRegisterApiDtoSchema = z.object({\n  email: z.email().toLowerCase(),\n  firstName: z.string().min(1).max(50),\n  lastName: z.string().min(1).max(50),\n  password: z.string().min(1).optional(),\n  /** W6.2: Org name when orgNameSource is 'ask'. */\n  organizationName: z.string().min(1).max(200).optional(),\n  /**\n   * How the registrant will authenticate afterwards (#463). Absent ⇒ PASSWORD, so a client that\n   * predates password-less signup keeps working unchanged.\n   *\n   * Typed as the whole `AuthMethod` vocabulary rather than a narrowed subset, deliberately: the set\n   * a given application accepts is `registration.allowedMethods`, which is per user type and\n   * authored, and duplicating a narrower list here would be a second place for it to drift. A method\n   * this application does not allow is refused by the service with the allowed set in the message,\n   * which is a better answer than a schema rejection that cannot say what IS allowed.\n   */\n  method: z.enum(AuthMethod).optional(),\n});\n\n\nexport type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Invitation Acceptance DTOs\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/invitation/accept — public invitation-acceptance form fields.\n *\n * The invitation token identifies the target invitation. Name/password fields are optional\n * because an existing invited user may only need to confirm the invitation, while a new\n * invited user can provide profile/password data in the same flow.\n *\n * confirmPassword is frontend-only and excluded from the API DTO.\n */\nexport const UserInvitationFormDtoSchema = z.object({\n  // Required, mirroring registration: the invitee establishes their identity at acceptance, and\n  // the profile seed keys on non-empty first+last (UserProfileSchema requires both).\n  // `.regex(/\\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS\n  // (\"  \" has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`\n  // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,\n  // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the\n  // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is\n  // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).\n  firstName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  password: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\nexport type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;\n\n/**\n * The first-factor credential the invitee chooses to establish at acceptance.\n *\n * The invitation-accept endpoint supports exactly three establishment paths (SSO-managed\n * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):\n * - `PASSWORD` — set a password now. When both `credentialMethod` and\n *   `password` are omitted, intentionally activate with no local credential;\n *   another configured authentication method can establish later sessions.\n * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the\n *   session is established when the invitee clicks it.\n * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps\n *   the session and the passkey is registered as the go-forward credential.\n */\nexport const INVITATION_ACCEPT_CREDENTIAL_METHODS = [\n  AuthMethod.PASSWORD,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.PASSKEY,\n] as const;\n\n/**\n * The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-\n * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are\n * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and\n * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift\n * wider than the wire contract it is fed from.\n */\nexport type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];\n\n/**\n * POST /auth/invitation/accept — API contract.\n *\n * `credentialMethod` is optional by design. When absent, a provided `password`\n * establishes a password credential; without one, acceptance activates the\n * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are\n * explicit because they initiate method-specific work.\n */\nexport const UserInvitationApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.\n  // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary\n  // (a direct API caller can't seed a blank profile name).\n  firstName: z.string().trim().min(1).max(50),\n  lastName: z.string().trim().min(1).max(50),\n  password: z.string().optional(),\n  credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),\n});\n\nexport type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;\n\n/**\n * POST /auth/invitation/reject — API contract.\n */\nexport const UserInvitationRejectApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  rejectionReason: z.string().max(500).optional(),\n});\n\nexport type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Email Verification API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/verify-email — API contract.\n * Token and email are extracted from URL query parameters on the frontend.\n * Email is required for defense-in-depth constant-time comparison against token metadata.\n */\nexport const EmailVerifyDtoSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\nexport type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;\n"]}
+{"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/C,CAAC;AAaF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,iBAAkE,EAClE,SAAiD;IAEjD,MAAM,SAAS,GAAG,iBAAiB,IAAI,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,SAAS,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,aAAa,GAA8C,EAAE,CAAC;IACpE,MAAM,0BAA0B,GAAa,EAAE,CAAC;IAEhD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;QACvD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,CAAC,QAAQ;gBAAE,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,6FAA6F;QAC7F,0FAA0F;QAC1F,IAAI,QAAQ,CAAC,WAAW;YAAE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;;;;;;;;OAcG;IACH,kCAAkC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjF;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;IAC9D;;;;;;;OAOG;IACH,cAAc,EAAE,gCAAgC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,8FAA8F;IAC9F,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACzC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACV,CAAC;AAWX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8EAA8E;IAC9E,gFAAgF;IAChF,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;IACzE;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAIH,kEAAkE;AAClE,yCAAyC;AACzC,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,uCAAuC,GAAW,oBAAoB,CAAC;AAE7E;;;;GAIG;AACH,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAE1H;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,gBAAgB,EAAE,gCAAgC,CAAC,QAAQ,CAAC;QAC1D,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC;CACH,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gBAAgB,EAAE,gCAAgC;CACnD,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC","sourcesContent":["/**\n * User Registration — Shared DTO Schemas\n *\n * Single source of truth for user registration validation.\n * Used by both frontend (AutomatedForm component) and backend (req.body parsing).\n */\n\nimport { z } from 'zod';\nimport type { OnboardingSurveyQuestion } from '../../config/frontend/onboarding.shared.schemas';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\nimport { AuthMethod } from './authentication.shared.schemas';\nimport { carriedAuthRedirect } from './authentication.shared.dto.schemas';\n\n// ═══════════════════════════════════════════════════════════════\n// Registration Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/register — registration form fields.\n * Used as:\n * - Frontend: AutomatedForm schema (all 5 fields rendered)\n * - Backend: req.body parsing (minus confirmPassword)\n *\n * confirmPassword is a frontend-only field for client-side match validation.\n * The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n.\n * The .isPassword() decorator tells FormField to render password inputs.\n */\n/**\n * Answers to the extra profile questions a user type declares for sign-up (#1371).\n *\n * Keyed by the question's `id`, valued by the scalar kinds a bindable question can produce. It is\n * NOT a free-form bag: the server validates every key against the resolved user type's own\n * `registration.additionalProfileQuestions` and refuses anything undeclared, so a client cannot use\n * it to write a profile field the application never asked about.\n */\nexport const RegistrationProfileAnswersSchema = z.record(\n  z.string().min(1),\n  z.union([z.string(), z.number(), z.boolean()]),\n);\nexport type RegistrationProfileAnswers = z.infer<typeof RegistrationProfileAnswersSchema>;\n\n/** What the declaration made of the answers a registrant submitted. */\nexport interface ResolvedRegistrationProfileAnswers {\n  /** Profile FIELD → value, ready to ride the composition seed. Keyed by `bindToField`, not by question id. */\n  readonly profileFields: Record<string, string | number | boolean>;\n  /** Submitted keys this user type never declared. Non-empty means the payload is refused. */\n  readonly undeclaredQuestionIds: readonly string[];\n  /** Declared-and-required questions with no usable answer. Non-empty means the payload is refused. */\n  readonly missingRequiredQuestionIds: readonly string[];\n}\n\n/**\n * Reconcile submitted sign-up answers against the questions the user type actually declares (#1371).\n *\n * Shared rather than written in the controller, because the FORM builds its fields from the same\n * declaration: one function decides what a question means, so the screen and the server cannot\n * disagree about which answers are legitimate.\n *\n * ## Undeclared keys are REFUSED, not dropped\n *\n * Dropping would make `profileAnswers` a silent no-op for a client that names a field the\n * application never asked about — and silence is exactly how a write reaches a place nobody\n * intended. Refusing keeps the transport a projection of the declaration rather than a door onto\n * the profile.\n *\n * ## An empty string is not an answer\n *\n * A required question submitted as `''` is MISSING, not answered. Without that, a required question\n * is satisfied by a field the person tabbed through, which is the opposite of what `required` means.\n */\nexport function resolveRegistrationProfileAnswers(\n  declaredQuestions: readonly OnboardingSurveyQuestion[] | undefined,\n  submitted: RegistrationProfileAnswers | undefined,\n): ResolvedRegistrationProfileAnswers {\n  const questions = declaredQuestions ?? [];\n  const answers = submitted ?? {};\n  const byId = new Map(questions.map((question) => [question.id, question]));\n\n  const undeclaredQuestionIds = Object.keys(answers).filter((id) => !byId.has(id));\n  const profileFields: Record<string, string | number | boolean> = {};\n  const missingRequiredQuestionIds: string[] = [];\n\n  for (const question of questions) {\n    const value = answers[question.id];\n    const isAnswered = value !== undefined && value !== '';\n    if (!isAnswered) {\n      if (question.required) missingRequiredQuestionIds.push(question.id);\n      continue;\n    }\n    // `bindToField` is guaranteed by the config schema, which refuses a sign-up question without\n    // one. Guarded anyway: this function is exported and a caller may hold a hand-built list.\n    if (question.bindToField) profileFields[question.bindToField] = value;\n  }\n\n  return { profileFields, undeclaredQuestionIds, missingRequiredQuestionIds };\n}\n\nexport const UserRegisterFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n  }),\n  firstName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  /** W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. */\n  organizationName: z.string().min(1).max(200).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n  }).optional(),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\n\nexport type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;\n\n/**\n * POST /auth/register — API contract (what goes over the wire).\n * Backend uses this for req.body parsing.\n * confirmPassword is NOT sent to the backend.\n */\nexport const UserRegisterApiDtoSchema = z.object({\n  email: z.email().toLowerCase(),\n  /**\n   * Optional on the WIRE because a user type may collect the names at onboarding instead (#1374,\n   * `ProfileNamesCollectionMoment.ONBOARDING`). Whether they are required is decided per user type by the\n   * registration service — a `REGISTRATION`-moment user type is refused without them, exactly as before.\n   */\n  firstName: z.string().min(1).max(50).optional(),\n  lastName: z.string().min(1).max(50).optional(),\n  password: z.string().min(1).optional(),\n  /** W6.2: Org name when orgNameSource is 'ask'. */\n  organizationName: z.string().min(1).max(200).optional(),\n  /**\n   * How the registrant will authenticate afterwards (#463). Absent ⇒ PASSWORD, so a client that\n   * predates password-less signup keeps working unchanged.\n   *\n   * Typed as the whole `AuthMethod` vocabulary rather than a narrowed subset, deliberately: the set\n   * a given application accepts is `registration.allowedMethods`, which is per user type and\n   * authored, and duplicating a narrower list here would be a second place for it to drift. A method\n   * this application does not allow is refused by the service with the allowed set in the message,\n   * which is a better answer than a schema rejection that cannot say what IS allowed.\n   */\n  method: z.enum(AuthMethod).optional(),\n  /**\n   * Which governed-document releases the registrant AFFIRMATIVELY accepted (issue #54).\n   *\n   * Release IDS only, and the asymmetry is the security property: the client supplies WHETHER a box\n   * was ticked, and the SERVER supplies everything else. It resolves the in-force releases from\n   * `compliance.governedDocumentReleases`, matches these ids against them, and records the matches.\n   * An id naming nothing in force is ignored rather than refused — a stale form is a stale form, and\n   * a registration is not the place to fail on one. So a caller cannot choose which VERSION of the\n   * terms they accepted, cannot invent a release, and cannot accept a document the application does\n   * not publish.\n   *\n   * Absent ⇒ nothing was accepted, which is what a client predating this field means and also what a\n   * registrant who ticked nothing means. Those two are deliberately the same answer: the record says\n   * what was accepted, never what was refused.\n   */\n  acceptedGovernedDocumentReleaseIds: z.array(z.string().min(1)).max(20).optional(),\n  /**\n   * The deep link the registration screen was opened with, carried into the emailed sign-in link of a\n   * PASSWORD-LESS signup (#1086) — the one register outcome that signs the person in on another page.\n   * Decided by {@link carriedAuthRedirect}, the same rule as the magic-link send and the invitation accept:\n   * kept only when same-origin and within bounds, otherwise dropped, never refused.\n   */\n  redirect: z.string().optional().transform(carriedAuthRedirect),\n  /**\n   * Answers to the user type's declared sign-up profile questions (#1371), keyed by question id.\n   *\n   * Validated SERVER-SIDE against that user type's own declaration — an undeclared key is refused\n   * rather than ignored, so this cannot become a door onto arbitrary profile fields. The form half\n   * is built at render time, because the questions are runtime configuration and a module-scope Zod\n   * object cannot carry a field per application.\n   */\n  profileAnswers: RegistrationProfileAnswersSchema.optional(),\n});\n\n\nexport type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Invitation Acceptance DTOs\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/invitation/accept — public invitation-acceptance form fields.\n *\n * The invitation token identifies the target invitation. Name/password fields are optional\n * because an existing invited user may only need to confirm the invitation, while a new\n * invited user can provide profile/password data in the same flow.\n *\n * confirmPassword is frontend-only and excluded from the API DTO.\n */\nexport const UserInvitationFormDtoSchema = z.object({\n  // Required, mirroring registration: the invitee establishes their identity at acceptance, and\n  // the profile seed keys on non-empty first+last (UserProfileSchema requires both).\n  // `.regex(/\\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS\n  // (\"  \" has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`\n  // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,\n  // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the\n  // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is\n  // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).\n  firstName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  password: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\nexport type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;\n\n/**\n * The first-factor credential the invitee chooses to establish at acceptance.\n *\n * The invitation-accept endpoint supports exactly three establishment paths (SSO-managed\n * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):\n * - `PASSWORD` — set a password now. When both `credentialMethod` and\n *   `password` are omitted, intentionally activate with no local credential;\n *   another configured authentication method can establish later sessions.\n * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the\n *   session is established when the invitee clicks it.\n * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps\n *   the session and the passkey is registered as the go-forward credential.\n */\nexport const INVITATION_ACCEPT_CREDENTIAL_METHODS = [\n  AuthMethod.PASSWORD,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.PASSKEY,\n] as const;\n\n/**\n * The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-\n * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are\n * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and\n * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift\n * wider than the wire contract it is fed from.\n */\nexport type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];\n\n/**\n * POST /auth/invitation/accept — API contract.\n *\n * `credentialMethod` is optional by design. When absent, a provided `password`\n * establishes a password credential; without one, acceptance activates the\n * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are\n * explicit because they initiate method-specific work.\n */\nexport const UserInvitationApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.\n  // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary\n  // (a direct API caller can't seed a blank profile name).\n  firstName: z.string().trim().min(1).max(50),\n  lastName: z.string().trim().min(1).max(50),\n  password: z.string().optional(),\n  credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),\n  /**\n   * The deep link the invitation was opened with, carried into the emailed link when `credentialMethod` is\n   * `MAGIC_LINK` (#1014) — the one accept outcome that signs the invitee in on another page. Decided by\n   * {@link carriedAuthRedirect}, the same rule as the magic-link send: kept only when same-origin and within\n   * bounds, otherwise dropped, never refused.\n   */\n  redirect: z.string().optional().transform(carriedAuthRedirect),\n});\n\nexport type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;\n\n/**\n * POST /auth/invitation/reject — API contract.\n */\nexport const UserInvitationRejectApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  rejectionReason: z.string().max(500).optional(),\n});\n\nexport type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Email Verification API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/verify-email — API contract.\n * Token and email are extracted from URL query parameters on the frontend.\n * Email is required for defense-in-depth constant-time comparison against token metadata.\n */\nexport const EmailVerifyDtoSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\nexport type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Organization Onboarding Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * The characters an organization name may not contain. Markup delimiters, quotes and code punctuation are\n * refused so a name renders as text wherever it is shown. One definition, so the onboarding form refuses\n * exactly what `POST /auth/onboarding/complete-org` refuses.\n */\nconst ORGANIZATION_NAME_DISALLOWED_CHARACTERS: RegExp = /^[^<>\"'`;{}()\\\\]+$/;\n\n/**\n * An organization name, as onboarding accepts it: trimmed FIRST, so a whitespace-only name fails `min(1)` at\n * the boundary rather than trimming to empty after it. The ONE definition — the form and the API contract\n * below both use it, so the form refuses exactly what `POST /auth/onboarding/complete-org` refuses.\n */\nconst OnboardingOrganizationNameSchema = z.string().trim().min(1).max(200).regex(ORGANIZATION_NAME_DISALLOWED_CHARACTERS);\n\n/**\n * POST /auth/onboarding/complete-org — the organization-name step (#1090).\n *\n * Shown to an account whose authentication session is parked at `ONBOARDING_PENDING`: after registration, email\n * verification or enrollment when its user type names its organization at onboarding, or after a sign-in answered\n * `nextStep: onboarding` because the account still owes one (#1091). The frontend AutomatedForm schema; the API\n * contract below adds the session id.\n */\nexport const OrganizationOnboardingFormDtoSchema = z.object({\n  organizationName: OnboardingOrganizationNameSchema.stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n  }),\n});\n\nexport type OrganizationOnboardingFormDto = z.infer<typeof OrganizationOnboardingFormDtoSchema>;\n\n/**\n * POST /auth/onboarding/complete-org — API contract. `sessionId` is the parked session the answer that led\n * here carried; it is what authorizes the completion, and the completion consumes it.\n */\nexport const OrganizationOnboardingCompleteApiDtoSchema = z.object({\n  sessionId: z.string().min(1),\n  organizationName: OnboardingOrganizationNameSchema,\n});\n\nexport type OrganizationOnboardingCompleteApiDto = z.infer<typeof OrganizationOnboardingCompleteApiDtoSchema>;\n\n/**\n * POST /auth/onboarding/complete-profile — API contract (#1374). Discharges\n * `OnboardingObligation.PROFILE_NAMES` on the parked session: the person's first and last name, collected after\n * the address and credential were proven. Same bounds as the sign-up form's name fields, and trimmed, so a name\n * of spaces is refused rather than stored.\n */\nexport const ProfileOnboardingCompleteApiDtoSchema = z.object({\n  sessionId: z.string().min(1),\n  firstName: z.string().trim().min(1).max(50),\n  lastName: z.string().trim().min(1).max(50),\n});\n\nexport type ProfileOnboardingCompleteApiDto = z.infer<typeof ProfileOnboardingCompleteApiDtoSchema>;\n\n/**\n * The onboarding step's names form (#1374) — the sign-up form's own two name fields, so the same bounds and the\n * same autocomplete hints apply wherever the names are asked.\n */\nexport const ProfileOnboardingFormDtoSchema = UserRegisterFormDtoSchema.pick({ firstName: true, lastName: true });\n\nexport type ProfileOnboardingFormDto = z.infer<typeof ProfileOnboardingFormDtoSchema>;\n"]}

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.d.ts

@@ -69,23 +69,69 @@ export declare function resolveScimOrganizationUnitId(directoryValue: string | u
 export type ScimOrganizationUnitAssignment = {
     readonly _id: string;
     readonly organizationUnitId: string;
+    /**
+     * The membership side of the edge. A real junction row ALWAYS carries it; it is optional here only
+     * because the department axis never projects it, and requiring it would make every caller and pin
+     * on that axis supply a value nothing reads. Required in practice on
+     * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} — see the contract check there.
+     */
+    readonly organizationMemberId?: string;
 };
-/** The writes a push must perform to make the member's assignments match the directory. */
+/**
+ * Which side of the (member, unit) edge the directory is currently speaking about.
+ *
+ * Both SCIM paths reconcile the SAME junction and the same way — "make the edges incident to ONE
+ * anchor match exactly what the directory says" — and differ only in which node is the anchor. That
+ * is one concept seen from two sides, not two concepts, so it is one function; the axis names the
+ * side so neither call site has to re-derive the transposition.
+ */
+export declare enum ScimOrganizationUnitReconciliationAxis {
+    /** Anchored on ONE member; the units vary. The `/Users` department push (`department` → unit). */
+    MEMBER_UNITS = "member_units",
+    /** Anchored on ONE unit; the members vary. The `/Groups` membership push (`members` → memberships). */
+    UNIT_MEMBERS = "unit_members"
+}
+/** The writes a push must perform to make the anchor's assignments match the directory. */
 export type ScimOrganizationUnitReconciliation = {
-    /** Units to assign that the member does not already hold. */
-    readonly unitIdsToCreate: string[];
-    /** Assignment rows to delete — everything the directory no longer says. */
+    /**
+     * Counterparts to assign that the anchor does not already hold — unit ids on
+     * {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, organization-member ids on
+     * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS}.
+     */
+    readonly counterpartIdsToCreate: string[];
+    /** Assignment rows to delete — everything the directory no longer says, minus what it cannot speak for. */
     readonly assignmentIdsToRemove: string[];
 };
+export type ScimOrganizationUnitReconciliationOptions = {
+    /** Defaults to {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, the department push. */
+    readonly axis?: ScimOrganizationUnitReconciliationAxis;
+    /**
+     * Counterparts this push has NO authority over: neither created nor removed, whatever the directory
+     * says about them.
+     *
+     * The department push supplies the member's units that a `/Groups` push owns
+     * (`OrganizationUnit.externalSource === SCIM`). Without it the two directory paths silently fight:
+     * department reconciliation is authoritative over the member's WHOLE set, so every `/Users` push
+     * would delete the assignments `/Groups` made — and Entra sends group membership as DELTAS
+     * (`PATCH … op: Add|Remove`), so nothing would ever restore them. The member would quietly lose the
+     * group's access on their next attribute sync, which is under-privilege nobody is told about.
+     *
+     * It is NOT a general "leave this alone" hatch: an id belongs here only when ANOTHER directory-owned
+     * path is authoritative for it. A hand-made assignment is still removed, which is the documented
+     * cost of opting an organization into `organizationUnitMapping`.
+     */
+    readonly counterpartIdsOutsideAuthority?: readonly string[];
+};
 /**
- * Compute the exact writes that make a member's unit assignments match the directory.
+ * Compute the exact writes that make one anchor's unit assignments match the directory.
  *
- * Idempotent by construction: an unchanged department produces no writes at all, so a directory that
- * re-pushes every user nightly does not churn the junction table or its audit trail.
+ * Idempotent by construction: an unchanged department — or an unchanged group membership — produces
+ * no writes at all, so a directory that re-pushes everything nightly does not churn the junction
+ * table or its audit trail.
  *
- * A `desiredUnitIds` of `[]` (the directory sent no department, or one nobody mapped) removes every
- * assignment — that is the authoritative half, and it is what makes leaving a department actually
- * revoke its access.
+ * A `desiredCounterpartIds` of `[]` removes every assignment the caller has authority over. That is
+ * the authoritative half, and it is what makes leaving a department (or a group) actually revoke its
+ * access rather than accumulate it.
  */
-export declare function resolveScimOrganizationUnitReconciliation(desiredUnitIds: readonly string[], currentAssignments: readonly ScimOrganizationUnitAssignment[]): ScimOrganizationUnitReconciliation;
+export declare function resolveScimOrganizationUnitReconciliation(desiredCounterpartIds: readonly string[], currentAssignments: readonly ScimOrganizationUnitAssignment[], options?: ScimOrganizationUnitReconciliationOptions): ScimOrganizationUnitReconciliation;
 //# sourceMappingURL=scim-organization-unit-mapping.shared.d.ts.map

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-organization-unit-mapping.shared.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;iBAKjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0GAA0G;AAC1G,MAAM,MAAM,oCAAoC,GAAG;IACjD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,gCAAgC,EAAE,GAAG,IAAI,CAAC;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEhI;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACzC,OAAO,EAAE,SAAS,gCAAgC,EAAE,GAAG,SAAS,GAAG,IAAI,GACtE,MAAM,GAAG,SAAS,CAKpB;AAED,qDAAqD;AACrD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAM,kCAAkC,GAAG;IAC/C,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,yCAAyC,CACvD,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,GAC5D,kCAAkC,CAUpC"}
+{"version":3,"file":"scim-organization-unit-mapping.shared.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;iBAKjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0GAA0G;AAC1G,MAAM,MAAM,oCAAoC,GAAG;IACjD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,gCAAgC,EAAE,GAAG,IAAI,CAAC;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEhI;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACzC,OAAO,EAAE,SAAS,gCAAgC,EAAE,GAAG,SAAS,GAAG,IAAI,GACtE,MAAM,GAAG,SAAS,CAKpB;AAED,qDAAqD;AACrD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC,CAAC;AAEF;;;;;;;GAOG;AACH,oBAAY,sCAAsC;IAChD,kGAAkG;IAClG,YAAY,iBAAiB;IAC7B,uGAAuG;IACvG,YAAY,iBAAiB;CAC9B;AAED,2FAA2F;AAC3F,MAAM,MAAM,kCAAkC,GAAG;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAC1C,2GAA2G;IAC3G,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,yCAAyC,GAAG;IACtD,oGAAoG;IACpG,QAAQ,CAAC,IAAI,CAAC,EAAE,sCAAsC,CAAC;IACvD;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,yCAAyC,CACvD,qBAAqB,EAAE,SAAS,MAAM,EAAE,EACxC,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,EAC7D,OAAO,CAAC,EAAE,yCAAyC,GAClD,kCAAkC,CA8BpC"}

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.js

@@ -39,9 +39,9 @@ import { z } from 'zod';
  */
 export const ScimOrganizationUnitMappingEntrySchema = z.object({
     /** The value the directory pushes, e.g. `"Sales"`. Matched exactly, whitespace-trimmed. */
-    directoryValue: z.string().min(1).max(200),
+    directoryValue: z.string().min(1).max(200).describe("A department value the directory sends, such as `Sales`, up to 200 characters. It must match exactly, apart from surrounding whitespace; a department with no entry is ignored."),
     /** The `ORGANIZATION_UNITS` row this value binds to. */
-    organizationUnitId: z.string().min(1),
+    organizationUnitId: z.string().min(1).describe("The organization unit a member with this department is assigned to."),
 });
 /**
  * Is this organization managing unit assignments through SCIM at all?
@@ -69,22 +69,55 @@ export function resolveScimOrganizationUnitId(directoryValue, mapping) {
     return mapping?.find((entry) => entry.directoryValue.trim() === normalizedValue)?.organizationUnitId;
 }
 /**
- * Compute the exact writes that make a member's unit assignments match the directory.
+ * Which side of the (member, unit) edge the directory is currently speaking about.
  *
- * Idempotent by construction: an unchanged department produces no writes at all, so a directory that
- * re-pushes every user nightly does not churn the junction table or its audit trail.
+ * Both SCIM paths reconcile the SAME junction and the same way — "make the edges incident to ONE
+ * anchor match exactly what the directory says" — and differ only in which node is the anchor. That
+ * is one concept seen from two sides, not two concepts, so it is one function; the axis names the
+ * side so neither call site has to re-derive the transposition.
+ */
+export var ScimOrganizationUnitReconciliationAxis;
+(function (ScimOrganizationUnitReconciliationAxis) {
+    /** Anchored on ONE member; the units vary. The `/Users` department push (`department` → unit). */
+    ScimOrganizationUnitReconciliationAxis["MEMBER_UNITS"] = "member_units";
+    /** Anchored on ONE unit; the members vary. The `/Groups` membership push (`members` → memberships). */
+    ScimOrganizationUnitReconciliationAxis["UNIT_MEMBERS"] = "unit_members";
+})(ScimOrganizationUnitReconciliationAxis || (ScimOrganizationUnitReconciliationAxis = {}));
+/**
+ * Compute the exact writes that make one anchor's unit assignments match the directory.
  *
- * A `desiredUnitIds` of `[]` (the directory sent no department, or one nobody mapped) removes every
- * assignment — that is the authoritative half, and it is what makes leaving a department actually
- * revoke its access.
+ * Idempotent by construction: an unchanged department — or an unchanged group membership — produces
+ * no writes at all, so a directory that re-pushes everything nightly does not churn the junction
+ * table or its audit trail.
+ *
+ * A `desiredCounterpartIds` of `[]` removes every assignment the caller has authority over. That is
+ * the authoritative half, and it is what makes leaving a department (or a group) actually revoke its
+ * access rather than accumulate it.
  */
-export function resolveScimOrganizationUnitReconciliation(desiredUnitIds, currentAssignments) {
-    const desired = new Set(desiredUnitIds);
-    const held = new Set(currentAssignments.map((assignment) => assignment.organizationUnitId));
+export function resolveScimOrganizationUnitReconciliation(desiredCounterpartIds, currentAssignments, options) {
+    const axis = options?.axis ?? ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS;
+    const outsideAuthority = new Set(options?.counterpartIdsOutsideAuthority ?? []);
+    const counterpartIdOf = (assignment) => {
+        if (axis === ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS)
+            return assignment.organizationUnitId;
+        // A junction row without its membership FK cannot be placed on this axis, and GUESSING would
+        // silently withhold a revocation — the one outcome this reconciliation exists to guarantee. A
+        // contract violation by the caller, so it is loud rather than absorbed.
+        if (assignment.organizationMemberId === undefined) {
+            throw new Error(`resolveScimOrganizationUnitReconciliation: assignment ${assignment._id} has no organizationMemberId, `
+                + `which ${ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} requires.`);
+        }
+        return assignment.organizationMemberId;
+    };
+    const desired = new Set(desiredCounterpartIds);
+    const held = new Set(currentAssignments.map(counterpartIdOf));
     return {
-        unitIdsToCreate: [...desired].filter((unitId) => !held.has(unitId)),
+        counterpartIdsToCreate: [...desired].filter((id) => !held.has(id) && !outsideAuthority.has(id)),
         assignmentIdsToRemove: currentAssignments
-            .filter((assignment) => !desired.has(assignment.organizationUnitId))
+            .filter((assignment) => {
+            const counterpartId = counterpartIdOf(assignment);
+            return !desired.has(counterpartId) && !outsideAuthority.has(counterpartId);
+        })
             .map((assignment) => assignment._id),
     };
 }