@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/security/api-keys/api-keys.shared.schemas.js

@@ -74,6 +74,16 @@ export const ApiKeySchemaBase = z.object({
     roles: z.array(RolesSchema).default([]).isAuditEvidence(),
     status: z.enum(ApiKeyStatus).default(ApiKeyStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),
     expiresAt: z.date().optional().isDBIndexed().isSummaryField(),
+    /**
+     * The capability grant this key was minted or reissued under (#1631), when a service firm's expert did it through a
+     * lent `MANAGE_API_KEYS`. Such a key's `expiresAt` is capped at the grant's end, and it is deactivated when the grant
+     * is revoked or its relationship ends — a secret handed to the firm under a lending ends with the lending. Absent for
+     * a key the organization's own administrators handled. Server-written only.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a credential obtained through delegated administration cannot outlive the delegation.
+     */
+    lentUnderCapabilityGrantId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence()
+        .describe('The capability grant a service firm\'s expert minted or reissued this key under, through administration the organization lent the firm. Such a key expires no later than the grant and is deactivated when the grant is revoked or the relationship ends. Absent for a key the organization\'s own administrators handled.'),
     lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
     createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
@@ -94,16 +104,18 @@ export const ApiKeySchemaBase = z.object({
     // First 8 chars of the prior secret — retained for support/audit display while the
     // previous secret is still valid (not a secret, so surfaced). Overwritten on the
     // next rotation.
-    previousKeyPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),
+    previousKeyPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate()
+        .describe('The first eight characters of the previous secret, which still authenticates until `previousKeyInvalidationDate`, or, when that is empty, until the key is rotated or regenerated again.'),
     // When the previous secret stops authenticating. `null`/absent = no scheduled
     // invalidation (REGENERATE overlap — the prior secret stays valid until the next
     // rotation). A future date (ROTATE `oldKeyInvalidationDate`) = honored until then,
     // then rejected. `now`/past (ROTATE default) = immediate hard cutover. Surfaced so
     // operators can see when the old secret dies.
     previousKeyInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate()
+        .describe('When the previous secret stops authenticating. Empty after a regenerate: the previous secret then keeps working until the next rotation.')
 });
 export const ApiKeyOrganizationSchema = ApiKeySchemaBase.extend({
-    scope: z.literal(ApiKeyScope.ORGANIZATION),
+    scope: z.literal(ApiKeyScope.ORGANIZATION).describe("Always `organization`: the key authenticates on behalf of one organization, and its value starts with `sk_org_`."),
     organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
     // Backend-only field - stored in DB but never sent to frontend (security)
     // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses
@@ -115,11 +127,12 @@ export const ApiKeyOrganizationSchema = ApiKeySchemaBase.extend({
     // but a uniqueness contract avoids two rows being returned to the
     // resolver on a hash-collision and prevents shadow-key duplicates
     // during rotation.
-    hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),
+    hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate()
+        .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),
     keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),
 });
 export const ApiKeyApplicationSchema = ApiKeySchemaBase.extend({
-    scope: z.literal(ApiKeyScope.APPLICATION),
+    scope: z.literal(ApiKeyScope.APPLICATION).describe("Always `application`: the key authenticates on behalf of the application itself, and its value starts with `sk_app_`."),
     applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
     // Backend-only field - stored in DB but never sent to frontend (security)
     // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses
@@ -131,7 +144,8 @@ export const ApiKeyApplicationSchema = ApiKeySchemaBase.extend({
     // but a uniqueness contract avoids two rows being returned to the
     // resolver on a hash-collision and prevents shadow-key duplicates
     // during rotation.
-    hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),
+    hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate()
+        .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),
     keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),
 });
 /**
@@ -143,4 +157,24 @@ export const ApiKeyOrganizationContextSchema = ApiKeyOrganizationSchema.extend({
 export const ApiKeyApplicationContextSchema = ApiKeyApplicationSchema.extend({
     rateLimit: ApiRequest_RateLimitSchema
 });
+/**
+ * The response of an API key's `usage_stats` operation — one definition for the organization key's two
+ * variants and the application key's one, which used to be three hand-kept copies (#1797).
+ *
+ * The counts come from the usage recorder, which counts every request a key authenticates, in
+ * per-minute and per-hour buckets. They are a rolling measurement over the last week, not a ledger.
+ * Two fields the operation used to publish are gone rather than reported as zero, because nothing can
+ * answer them truthfully: a LIFETIME request total needs a durable counter on the key, and a rate-limit
+ * count needs a limiter that knows the key — every limiter in front of a REST request runs before the
+ * key is resolved and counts by source address.
+ */
+export const ApiKeyUsageStatisticsResponseSchema = z.object({
+    keyId: z.string().describe('The id of the API key these statistics are for.'),
+    requestsLastHour: z.number().int().min(0).describe('Requests authenticated with this key in the last 60 minutes.'),
+    requestsLastDay: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 23 hours before it.'),
+    requestsLastWeek: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 167 hours before it. Counts older than that are not kept.'),
+    lastUsedAt: z.date().optional().describe('When the key was last accepted, to the minute. Absent when it has never been used.'),
+    mostUsedEndpoint: z.string().optional().describe('The route this key reached most often over the last week, as its method and path template (for example `GET /organizations/:organizationId/todos`). Absent when no request was counted.'),
+    errorRate: z.number().min(0).max(100).describe('The percentage of the last week\'s requests that answered with a status of 400 or above, or were closed before an answer. 0 when there were none.'),
+});
 //# sourceMappingURL=api-keys.shared.schemas.js.map

package/dist/esm/security/api-keys/api-keys.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAC,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,kCAAkC;AAClC,gBAAgB;AAChB,kCAAkC;AAIlC,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,iCAAiB,CAAA;IACjB,qCAAqB,CAAA;IACrB,mCAAmB,CAAA;AACrB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4CAA8B,CAAA;IAC9B,0CAA6B,CAAA;AAC/B,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA0C,MAAM,CAAC,MAAM,CAAC;IACrG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,SAAS;IACrC,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,SAAS;CACrC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,eAAe,CAAC,aAAa,CAAC;AAErF,+GAA+G;AAC/G,MAAM,CAAC,MAAM,+BAA+B,GAAiC,MAAM,CAAC,MAAM,CAAC;IACzF,mBAAmB,EAAE,uCAAuC;IAC5D,eAAe,EAAE,kCAAkC;CACpD,CAAC,CAAC;AAOH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAQ,MAAM,CAAC,MAAM,CAAC,WAAW,CAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,kCAAkC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAClD,CAAC;AAGD,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAElC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACzD,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACzD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC1G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,4DAA4D;IAC5D,oFAAoF;IACpF,+EAA+E;IAC/E,kFAAkF;IAClF,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,4EAA4E;IAC5E,iFAAiF;IACjF,0DAA0D;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrH,mFAAmF;IACnF,iFAAiF;IACjF,iBAAiB;IACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC1F,8EAA8E;IAC9E,iFAAiF;IACjF,mFAAmF;IACnF,mFAAmF;IACnF,8CAA8C;IAC9C,2BAA2B,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC5I,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAClG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC5I,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC","sourcesContent":["/**\n * API Key Shared Schemas\n *\n * Frontend/backend shared API key schemas and DTOs only.\n * Backend-specific logic stays in saas-backend-lib.\n */\n\nimport { z } from 'zod';\nimport { RolesSchema } from '../authorizations/roles.shared.schemas';\nimport { ApiRequest_RateLimitSchema} from '../../requests/rate-limits.shared.schemas';\nimport { WildoHeaderKeys } from '../../requests/header-keys.shared';\n\n// ===============================\n// API KEY ENUMS\n// ===============================\n\n\n\nexport enum ApiKeyStatus {\n  ACTIVE = 'active',\n  INACTIVE = 'inactive',\n  EXPIRED = 'expired'\n}\n\nexport enum ApiKeyScope {\n  ORGANIZATION  = 'organization',\n  APPLICATION   = 'application',\n}\n\n/**\n * Public API-key presentation is one cross-layer contract.\n *\n * A key's scope decides the prefix that identifies it to request authentication;\n * the request itself carries the complete opaque key in the `Authorization`\n * field without an authentication scheme. That scheme-less presentation is an\n * application protocol contract, not OAuth bearer-token syntax. Keeping it at the shared\n * model boundary makes minting, request routing and consumer documentation\n * derive from one source instead of re-typing `sk_org_` / `sk_app_` in each.\n */\nexport const API_KEY_CREDENTIAL_PREFIX_BY_SCOPE: Readonly<Record<ApiKeyScope, string>> = Object.freeze({\n  [ApiKeyScope.ORGANIZATION]: 'sk_org_',\n  [ApiKeyScope.APPLICATION]: 'sk_app_',\n});\n\n/**\n * API keys reuse the request-authentication field name as their transport.\n *\n * This aliases the protocol-wide header vocabulary rather than re-declaring a\n * second literal. The raw value intentionally has no `Bearer` scheme, so callers\n * must follow this application's exact wire contract rather than infer OAuth syntax.\n * It belongs beside the prefix map because both values describe the one public\n * presentation contract of an API-key credential.\n */\nexport const API_KEY_CREDENTIAL_AUTHORIZATION_HEADER = WildoHeaderKeys.AUTHORIZATION;\n\n/** Complete public transport/prefix presentation used by request authentication and consumer documentation. */\nexport const API_KEY_CREDENTIAL_PRESENTATION: ApiKeyCredentialPresentation = Object.freeze({\n  authorizationHeader: API_KEY_CREDENTIAL_AUTHORIZATION_HEADER,\n  prefixesByScope: API_KEY_CREDENTIAL_PREFIX_BY_SCOPE,\n});\n\nexport interface ApiKeyCredentialPresentation {\n  readonly authorizationHeader: string;\n  readonly prefixesByScope: Readonly<Record<ApiKeyScope, string>>;\n}\n\nexport function apiKeyScopeForCredential(value: string): ApiKeyScope | null {\n  return (Object.values(ApiKeyScope) as ApiKeyScope[]).find((scope) => value.startsWith(API_KEY_CREDENTIAL_PREFIX_BY_SCOPE[scope])) ?? null;\n}\n\nexport function isApiKeyCredential(value: string): boolean {\n  return apiKeyScopeForCredential(value) !== null;\n}\n\n\n// ===============================\n// CORE API KEY SCHEMAS\n// ===============================\n\n// Base schema for extension (needs to be z.object for extend to work)\nexport const ApiKeySchemaBase = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n  description: z.string().max(500).optional(),\n  scope: z.enum(ApiKeyScope).isDBIndexed().isSummaryField(),\n  // `.isAuditEvidence()` on both: a machine credential's roles ARE its authority, and its status\n  // decides whether that authority is live. This resource exposes no core UPDATE and gates roles\n  // only at minting, so the before/after values are the only way to reconstruct what a key could\n  // do at a point in time. Closed vocabulary — no personal data reaches the audit ledger.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n  roles: z.array(RolesSchema).default([]).isAuditEvidence(),\n  status: z.enum(ApiKeyStatus).default(ApiKeyStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),\n  expiresAt: z.date().optional().isDBIndexed().isSummaryField(),\n  lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  // ── Rotation grace window ─────────────────────────────────────────────────\n  // When a key is ROTATED or REGENERATEd, the PRIOR secret is retained here so it\n  // keeps authenticating during an overlap window — callers can migrate to the new\n  // secret without a hard cutover. The bearer-token auth path\n  // (`execution-context-creator.backend.service.ts`) resolves a presented key against\n  // the current `hashedKey` OR this `previousHashedKey` while the window is open\n  // (`previousKeyInvalidationDate` is null or in the future) AND the key is ACTIVE.\n  // All three are server-managed by the rotate/regenerate impls only — never\n  // client-settable (`.excludeFromCreate().excludeFromUpdate()`).\n  //\n  // `previousHashedKey` — `sha256` of the prior secret; the auth path looks a\n  // presented key up against it, so it is `.isDBIndexed()`. Backend-only (a secret\n  // hash, never surfaced). Absent until the first rotation.\n  previousHashedKey: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n  // First 8 chars of the prior secret — retained for support/audit display while the\n  // previous secret is still valid (not a secret, so surfaced). Overwritten on the\n  // next rotation.\n  previousKeyPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),\n  // When the previous secret stops authenticating. `null`/absent = no scheduled\n  // invalidation (REGENERATE overlap — the prior secret stays valid until the next\n  // rotation). A future date (ROTATE `oldKeyInvalidationDate`) = honored until then,\n  // then rejected. `now`/past (ROTATE default) = immediate hard cutover. Surfaced so\n  // operators can see when the old secret dies.\n  previousKeyInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate()\n});\n\nexport type ApiKeyBase = z.infer<typeof ApiKeySchemaBase>;\n\nexport const ApiKeyOrganizationSchema = ApiKeySchemaBase.extend({\n  scope: z.literal(ApiKeyScope.ORGANIZATION),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // Backend-only field - stored in DB but never sent to frontend (security)\n  // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n  // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n  // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n  // on every authenticated request). Without an index this is an O(n)\n  // collection scan per request. Compound unique guarantees only one\n  // active row per hash — cryptographically near-impossible by accident,\n  // but a uniqueness contract avoids two rows being returned to the\n  // resolver on a hash-collision and prevents shadow-key duplicates\n  // during rotation.\n  hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate(),\n  keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyOrganization = z.infer<typeof ApiKeyOrganizationSchema>;\n\nexport const ApiKeyApplicationSchema = ApiKeySchemaBase.extend({\n  scope: z.literal(ApiKeyScope.APPLICATION),\n  applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // Backend-only field - stored in DB but never sent to frontend (security)\n  // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n  // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n  // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n  // on every authenticated request). Without an index this is an O(n)\n  // collection scan per request. Compound unique guarantees only one\n  // active row per hash — cryptographically near-impossible by accident,\n  // but a uniqueness contract avoids two rows being returned to the\n  // resolver on a hash-collision and prevents shadow-key duplicates\n  // during rotation.\n  hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate(),\n  keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyApplication = z.infer<typeof ApiKeyApplicationSchema>;\n\n/**\n * API Key Context for middleware and validation\n */\nexport const ApiKeyOrganizationContextSchema = ApiKeyOrganizationSchema.extend({\n  rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyOrganizationContext = z.infer<typeof ApiKeyOrganizationContextSchema>;\n\nexport const ApiKeyApplicationContextSchema = ApiKeyApplicationSchema.extend({\n  rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyApplicationContext = z.infer<typeof ApiKeyApplicationContextSchema>;\n"]}
+{"version":3,"file":"api-keys.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/api-keys/api-keys.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAC,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,kCAAkC;AAClC,gBAAgB;AAChB,kCAAkC;AAIlC,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,iCAAiB,CAAA;IACjB,qCAAqB,CAAA;IACrB,mCAAmB,CAAA;AACrB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4CAA8B,CAAA;IAC9B,0CAA6B,CAAA;AAC/B,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAA0C,MAAM,CAAC,MAAM,CAAC;IACrG,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,SAAS;IACrC,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,SAAS;CACrC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,eAAe,CAAC,aAAa,CAAC;AAErF,+GAA+G;AAC/G,MAAM,CAAC,MAAM,+BAA+B,GAAiC,MAAM,CAAC,MAAM,CAAC;IACzF,mBAAmB,EAAE,uCAAuC;IAC5D,eAAe,EAAE,kCAAkC;CACpD,CAAC,CAAC;AAOH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAQ,MAAM,CAAC,MAAM,CAAC,WAAW,CAAmB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,kCAAkC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAClD,CAAC;AAGD,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAElC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACzD,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACzD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC1G,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC7D;;;;;;;OAOG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;SAC7H,QAAQ,CAAC,4TAA4T,CAAC;IACzU,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,4DAA4D;IAC5D,oFAAoF;IACpF,+EAA+E;IAC/E,kFAAkF;IAClF,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,4EAA4E;IAC5E,iFAAiF;IACjF,0DAA0D;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrH,mFAAmF;IACnF,iFAAiF;IACjF,iBAAiB;IACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACvF,QAAQ,CAAC,0LAA0L,CAAC;IACvM,8EAA8E;IAC9E,iFAAiF;IACjF,mFAAmF;IACnF,mFAAmF;IACnF,8CAA8C;IAC9C,2BAA2B,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACrF,QAAQ,CAAC,0IAA0I,CAAC;CACxJ,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,kHAAkH,CAAC;IACvK,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACzI,QAAQ,CAAC,0JAA0J,CAAC;IACvK,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,uHAAuH,CAAC;IAC3K,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAClG,0EAA0E;IAC1E,2GAA2G;IAC3G,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,uEAAuE;IACvE,kEAAkE;IAClE,kEAAkE;IAClE,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAG,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACzI,QAAQ,CAAC,0JAA0J,CAAC;IACvK,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACzF,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,wBAAwB,CAAC,MAAM,CAAC;IAC7E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC3E,SAAS,EAAE,0BAA0B;CACtC,CAAC,CAAC;AAKH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IAClH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sFAAsF,CAAC;IACzI,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4HAA4H,CAAC;IAChL,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oFAAoF,CAAC;IAC9H,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yLAAyL,CAAC;IAC3O,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,mJAAmJ,CAAC;CACpM,CAAC,CAAC","sourcesContent":["/**\n * API Key Shared Schemas\n *\n * Frontend/backend shared API key schemas and DTOs only.\n * Backend-specific logic stays in saas-backend-lib.\n */\n\nimport { z } from 'zod';\nimport { RolesSchema } from '../authorizations/roles.shared.schemas';\nimport { ApiRequest_RateLimitSchema} from '../../requests/rate-limits.shared.schemas';\nimport { WildoHeaderKeys } from '../../requests/header-keys.shared';\n\n// ===============================\n// API KEY ENUMS\n// ===============================\n\n\n\nexport enum ApiKeyStatus {\n  ACTIVE = 'active',\n  INACTIVE = 'inactive',\n  EXPIRED = 'expired'\n}\n\nexport enum ApiKeyScope {\n  ORGANIZATION  = 'organization',\n  APPLICATION   = 'application',\n}\n\n/**\n * Public API-key presentation is one cross-layer contract.\n *\n * A key's scope decides the prefix that identifies it to request authentication;\n * the request itself carries the complete opaque key in the `Authorization`\n * field without an authentication scheme. That scheme-less presentation is an\n * application protocol contract, not OAuth bearer-token syntax. Keeping it at the shared\n * model boundary makes minting, request routing and consumer documentation\n * derive from one source instead of re-typing `sk_org_` / `sk_app_` in each.\n */\nexport const API_KEY_CREDENTIAL_PREFIX_BY_SCOPE: Readonly<Record<ApiKeyScope, string>> = Object.freeze({\n  [ApiKeyScope.ORGANIZATION]: 'sk_org_',\n  [ApiKeyScope.APPLICATION]: 'sk_app_',\n});\n\n/**\n * API keys reuse the request-authentication field name as their transport.\n *\n * This aliases the protocol-wide header vocabulary rather than re-declaring a\n * second literal. The raw value intentionally has no `Bearer` scheme, so callers\n * must follow this application's exact wire contract rather than infer OAuth syntax.\n * It belongs beside the prefix map because both values describe the one public\n * presentation contract of an API-key credential.\n */\nexport const API_KEY_CREDENTIAL_AUTHORIZATION_HEADER = WildoHeaderKeys.AUTHORIZATION;\n\n/** Complete public transport/prefix presentation used by request authentication and consumer documentation. */\nexport const API_KEY_CREDENTIAL_PRESENTATION: ApiKeyCredentialPresentation = Object.freeze({\n  authorizationHeader: API_KEY_CREDENTIAL_AUTHORIZATION_HEADER,\n  prefixesByScope: API_KEY_CREDENTIAL_PREFIX_BY_SCOPE,\n});\n\nexport interface ApiKeyCredentialPresentation {\n  readonly authorizationHeader: string;\n  readonly prefixesByScope: Readonly<Record<ApiKeyScope, string>>;\n}\n\nexport function apiKeyScopeForCredential(value: string): ApiKeyScope | null {\n  return (Object.values(ApiKeyScope) as ApiKeyScope[]).find((scope) => value.startsWith(API_KEY_CREDENTIAL_PREFIX_BY_SCOPE[scope])) ?? null;\n}\n\nexport function isApiKeyCredential(value: string): boolean {\n  return apiKeyScopeForCredential(value) !== null;\n}\n\n\n// ===============================\n// CORE API KEY SCHEMAS\n// ===============================\n\n// Base schema for extension (needs to be z.object for extend to work)\nexport const ApiKeySchemaBase = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n  description: z.string().max(500).optional(),\n  scope: z.enum(ApiKeyScope).isDBIndexed().isSummaryField(),\n  // `.isAuditEvidence()` on both: a machine credential's roles ARE its authority, and its status\n  // decides whether that authority is live. This resource exposes no core UPDATE and gates roles\n  // only at minting, so the before/after values are the only way to reconstruct what a key could\n  // do at a point in time. Closed vocabulary — no personal data reaches the audit ledger.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n  roles: z.array(RolesSchema).default([]).isAuditEvidence(),\n  status: z.enum(ApiKeyStatus).default(ApiKeyStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),\n  expiresAt: z.date().optional().isDBIndexed().isSummaryField(),\n  /**\n   * The capability grant this key was minted or reissued under (#1631), when a service firm's expert did it through a\n   * lent `MANAGE_API_KEYS`. Such a key's `expiresAt` is capped at the grant's end, and it is deactivated when the grant\n   * is revoked or its relationship ends — a secret handed to the firm under a lending ends with the lending. Absent for\n   * a key the organization's own administrators handled. Server-written only.\n   *\n   * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a credential obtained through delegated administration cannot outlive the delegation.\n   */\n  lentUnderCapabilityGrantId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence()\n    .describe('The capability grant a service firm\\'s expert minted or reissued this key under, through administration the organization lent the firm. Such a key expires no later than the grant and is deactivated when the grant is revoked or the relationship ends. Absent for a key the organization\\'s own administrators handled.'),\n  lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  // ── Rotation grace window ─────────────────────────────────────────────────\n  // When a key is ROTATED or REGENERATEd, the PRIOR secret is retained here so it\n  // keeps authenticating during an overlap window — callers can migrate to the new\n  // secret without a hard cutover. The bearer-token auth path\n  // (`execution-context-creator.backend.service.ts`) resolves a presented key against\n  // the current `hashedKey` OR this `previousHashedKey` while the window is open\n  // (`previousKeyInvalidationDate` is null or in the future) AND the key is ACTIVE.\n  // All three are server-managed by the rotate/regenerate impls only — never\n  // client-settable (`.excludeFromCreate().excludeFromUpdate()`).\n  //\n  // `previousHashedKey` — `sha256` of the prior secret; the auth path looks a\n  // presented key up against it, so it is `.isDBIndexed()`. Backend-only (a secret\n  // hash, never surfaced). Absent until the first rotation.\n  previousHashedKey: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n  // First 8 chars of the prior secret — retained for support/audit display while the\n  // previous secret is still valid (not a secret, so surfaced). Overwritten on the\n  // next rotation.\n  previousKeyPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate()\n    .describe('The first eight characters of the previous secret, which still authenticates until `previousKeyInvalidationDate`, or, when that is empty, until the key is rotated or regenerated again.'),\n  // When the previous secret stops authenticating. `null`/absent = no scheduled\n  // invalidation (REGENERATE overlap — the prior secret stays valid until the next\n  // rotation). A future date (ROTATE `oldKeyInvalidationDate`) = honored until then,\n  // then rejected. `now`/past (ROTATE default) = immediate hard cutover. Surfaced so\n  // operators can see when the old secret dies.\n  previousKeyInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate()\n    .describe('When the previous secret stops authenticating. Empty after a regenerate: the previous secret then keeps working until the next rotation.')\n});\n\nexport type ApiKeyBase = z.infer<typeof ApiKeySchemaBase>;\n\nexport const ApiKeyOrganizationSchema = ApiKeySchemaBase.extend({\n  scope: z.literal(ApiKeyScope.ORGANIZATION).describe(\"Always `organization`: the key authenticates on behalf of one organization, and its value starts with `sk_org_`.\"),\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // Backend-only field - stored in DB but never sent to frontend (security)\n  // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n  // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n  // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n  // on every authenticated request). Without an index this is an O(n)\n  // collection scan per request. Compound unique guarantees only one\n  // active row per hash — cryptographically near-impossible by accident,\n  // but a uniqueness contract avoids two rows being returned to the\n  // resolver on a hash-collision and prevents shadow-key duplicates\n  // during rotation.\n  hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate()\n    .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),\n  keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyOrganization = z.infer<typeof ApiKeyOrganizationSchema>;\n\nexport const ApiKeyApplicationSchema = ApiKeySchemaBase.extend({\n  scope: z.literal(ApiKeyScope.APPLICATION).describe(\"Always `application`: the key authenticates on behalf of the application itself, and its value starts with `sk_app_`.\"),\n  applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // Backend-only field - stored in DB but never sent to frontend (security)\n  // excludeFromCreate ensures it doesn't appear in forms; isBackendOnly ensures it's stripped from responses\n  // M3 (third-pass review): `hashedKey` is the lookup key for bearer-token\n  // auth (`registry-bearer-token.middleware.ts` resolves api-keys by it\n  // on every authenticated request). Without an index this is an O(n)\n  // collection scan per request. Compound unique guarantees only one\n  // active row per hash — cryptographically near-impossible by accident,\n  // but a uniqueness contract avoids two rows being returned to the\n  // resolver on a hash-collision and prevents shadow-key duplicates\n  // during rotation.\n  hashedKey: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation : true }).excludeFromCreate().excludeFromUpdate()\n    .describe('The SHA-256 hash of the key, the only form the application keeps. Returned in the creation response only; the key itself is `plainKey`, shown that once.'),\n  keyPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type ApiKeyApplication = z.infer<typeof ApiKeyApplicationSchema>;\n\n/**\n * API Key Context for middleware and validation\n */\nexport const ApiKeyOrganizationContextSchema = ApiKeyOrganizationSchema.extend({\n  rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyOrganizationContext = z.infer<typeof ApiKeyOrganizationContextSchema>;\n\nexport const ApiKeyApplicationContextSchema = ApiKeyApplicationSchema.extend({\n  rateLimit: ApiRequest_RateLimitSchema\n});\n\n\nexport type ApiKeyApplicationContext = z.infer<typeof ApiKeyApplicationContextSchema>;\n\n/**\n * The response of an API key's `usage_stats` operation — one definition for the organization key's two\n * variants and the application key's one, which used to be three hand-kept copies (#1797).\n *\n * The counts come from the usage recorder, which counts every request a key authenticates, in\n * per-minute and per-hour buckets. They are a rolling measurement over the last week, not a ledger.\n * Two fields the operation used to publish are gone rather than reported as zero, because nothing can\n * answer them truthfully: a LIFETIME request total needs a durable counter on the key, and a rate-limit\n * count needs a limiter that knows the key — every limiter in front of a REST request runs before the\n * key is resolved and counts by source address.\n */\nexport const ApiKeyUsageStatisticsResponseSchema = z.object({\n  keyId: z.string().describe('The id of the API key these statistics are for.'),\n  requestsLastHour: z.number().int().min(0).describe('Requests authenticated with this key in the last 60 minutes.'),\n  requestsLastDay: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 23 hours before it.'),\n  requestsLastWeek: z.number().int().min(0).describe('Requests authenticated with this key in the current hour and the 167 hours before it. Counts older than that are not kept.'),\n  lastUsedAt: z.date().optional().describe('When the key was last accepted, to the minute. Absent when it has never been used.'),\n  mostUsedEndpoint: z.string().optional().describe('The route this key reached most often over the last week, as its method and path template (for example `GET /organizations/:organizationId/todos`). Absent when no request was counted.'),\n  errorRate: z.number().min(0).max(100).describe('The percentage of the last week\\'s requests that answered with a status of 400 or above, or were closed before an answer. 0 when there were none.'),\n});\nexport type ApiKeyUsageStatisticsResponse = z.infer<typeof ApiKeyUsageStatisticsResponseSchema>;\n"]}

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts

@@ -137,6 +137,7 @@ export declare const AuthIdentificationResponseSchema: z.ZodObject<{
     organizationBranding: z.ZodOptional<z.ZodObject<{
         logoUrl: z.ZodOptional<z.ZodString>;
         primaryColor: z.ZodOptional<z.ZodString>;
+        faviconUrl: z.ZodOptional<z.ZodString>;
         organizationName: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     availableIntegrations: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -468,8 +469,6 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
             userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
             notifications: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
                 email: z.ZodDefault<z.ZodBoolean>;
-                push: z.ZodDefault<z.ZodBoolean>;
-                sms: z.ZodDefault<z.ZodBoolean>;
                 inApp: z.ZodDefault<z.ZodBoolean>;
             }, z.core.$strip>>>;
             privacy: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
@@ -488,7 +487,6 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
             languagePreferences: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodObject<{
                 primaryLanguage: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>;
                 fallbackLanguages: z.ZodDefault<z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("@wildo-ai/presets-components-models").AvailableLanguage>>>>>;
-                autoDetect: z.ZodDefault<z.ZodBoolean>;
                 useOrganizationDefault: z.ZodDefault<z.ZodBoolean>;
             }, z.core.$strip>>>>;
         }, z.core.$strip>>;
@@ -503,6 +501,9 @@ export declare const AuthenticationResponseSchema: z.ZodObject<{
             userTitle: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
             invitedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
             invitedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
+            serviceProviderRelationshipId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>>;
+            providerOrganizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>>;
+            providerOrganizationName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
             instanceLabel: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
             createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
             updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
@@ -738,6 +739,7 @@ export declare const AuthenticationSessionSchema: z.ZodObject<{
     organizationBranding: z.ZodOptional<z.ZodObject<{
         logoUrl: z.ZodOptional<z.ZodString>;
         primaryColor: z.ZodOptional<z.ZodString>;
+        faviconUrl: z.ZodOptional<z.ZodString>;
         organizationName: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     version: z.ZodDefault<z.ZodNumber>;

package/dist/esm/security/authentications/authentication.shared.dto.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8B3C,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBAIlC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIjF;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;iBAWrC,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsDvC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,oBAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,YAAY,iBAAiB;IAC7B,wFAAwF;IACxF,aAAa,kBAAkB;CAChC;AAED,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,0GAA0G;IACzJ,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,oKAAoK;IAGnN,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6ItC,CAAC;AAWH;;;GAGG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iDAAiD;;;kBAG5D,CAAC;AAEH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}
+{"version":3,"file":"authentication.shared.dto.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAI7E;;;;;;;;;;GAUG;AACH,oBAAY,wBAAwB;IAClC,0HAA0H;IAC1H,IAAI,SAAS;IACb,sHAAsH;IACtH,GAAG,QAAQ;IACX,8TAA8T;IAC9T,IAAI,SAAS;CACd;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAO1C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiC3C,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;iBAQhC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;iBAU5C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAU3C,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAIhC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBAIlC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AAIH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIjF;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;iBAWrC,CAAC;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AASH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,+BAA+B;;;iBAG1C,CAAC;AAKH;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQtC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsDvC,CAAC;AAQH;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;iBAI2B,CAAC;AAG9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,oBAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,YAAY,iBAAiB;IAC7B,wFAAwF;IACxF,aAAa,kBAAkB;CAChC;AAED,oBAAY,0BAA0B;IAEpC,OAAO,YAAY,CAA4B,8CAA8C;IAC7F,UAAU,eAAe,CAAsB,qCAAqC;IACpF,wBAAwB,6BAA6B,CAAE,0CAA0C;IACjG,sBAAsB,2BAA2B,CAAM,yBAAyB;IAChF,YAAY,iBAAiB,CAAkB,0CAA0C;IACzF,yBAAyB,8BAA8B,CAAE,4BAA4B;IACrF,SAAS,cAAc,CAAwB,wCAAwC;IACvF,gBAAgB,qBAAqB,CAAU,4DAA4D;IAG3G,UAAU,eAAe,CAAsB,0GAA0G;IACzJ,cAAc,mBAAmB,CAAc,6CAA6C;IAC5F,uBAAuB,4BAA4B,CAAE,oDAAoD;IACzG,oBAAoB,yBAAyB,CAAE,mEAAmE;IAClH,kBAAkB,uBAAuB,CAAM,oKAAoK;IAGnN,MAAM,WAAW,CAA8B,wBAAwB;IACvE,OAAO,YAAY,CAA4B,kBAAkB;IACjE,MAAM,WAAW;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,sCAA6B,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;iBASxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgJtC,CAAC;AAWH;;;GAGG;AACH;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;iBAIpC,CAAC;AAKH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;iBAOjC,CAAC;AAcH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;iBAIzC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;iBAIvC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;iBAIrC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;iBAI7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;iBAI5C,CAAC;AAKH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iDAAiD;;;kBAG5D,CAAC;AAEH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iDAAiD,CAAC,CAAC;AAE5H;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;iBAe5C,CAAC;AAQH,cAAc,6CAA6C,CAAC;AAO5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAK1F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/esm/security/authentications/authentication.shared.dto.schemas.js

@@ -87,6 +87,9 @@ export const AuthIdentificationResponseSchema = z.object({
         // servable URL OR an app-relative path (e.g. `/favicon.png`).
         logoUrl: z.string().optional(),
         primaryColor: ZodTypeForColors.optional(),
+        // The organization's own tab icon (#1799). No application fallback: the application's icon is
+        // already the page's, so an absent value leaves it in place.
+        faviconUrl: z.string().optional(),
         organizationName: z.string().optional()
     }).optional(),
     // Available integrations (if any auth method supports them)
@@ -568,6 +571,9 @@ export const AuthenticationSessionSchema = z.object({
         // servable URL OR an app-relative path (e.g. `/favicon.png`).
         logoUrl: z.string().optional(),
         primaryColor: ZodTypeForColors.optional(),
+        // The organization's own tab icon (#1799). No application fallback: the application's icon is
+        // already the page's, so an absent value leaves it in place.
+        faviconUrl: z.string().optional(),
         organizationName: z.string().optional()
     }).optional(),
     // M1: Optimistic concurrency control version for atomic session updates

package/dist/esm/security/authentications/authentication.shared.dto.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAE/G;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,0HAA0H;IAC1H,yCAAa,CAAA;IACb,sHAAsH;IACtH,uCAAW,CAAA;IACX,8TAA8T;IAC9T,yCAAa,CAAA;AACf,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE;IACvB,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,2FAA2F;IAC3F,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3D,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAEvB,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEvD,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,oCAAoC;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,4DAA4D;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,+CAA+C;QAC/E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC,wCAAwC;IACxC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;IACxE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB;IAEhD,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qCAAqC;IACxF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,mCAAmC;CAC5F,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,oBAAoB;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACjD,CAAC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;QACF,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC;AAIH,kCAAkC;AAClC,gCAAgC;AAChC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,gCAAgC,IAAI,wBAAwB,CAAC,KAAK,CAAC;QAC/G,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH,kCAAkC;AAClC,wCAAwC;AACxC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACpD,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACpC,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,yBAAyB;IACzB,iCAAiC;IACjC,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEzC,sEAAsE;IACtE,oEAAoE;IACpE,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEnC,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9E,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;;;OAOG;IACH,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,uBAAuB;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,kCAAkC;AAClC,2BAA2B;AAC3B,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAG9D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,qDAA6B,CAAA;IAC7B,wFAAwF;IACxF,uDAA+B,CAAA;AACjC,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,oBAAoB;IACpB,iDAAmB,CAAA;IACnB,uDAAyB,CAAA;IACzB,mFAAqD,CAAA;IACrD,+EAAiD,CAAA;IACjD,2DAA6B,CAAA;IAC7B,qFAAuD,CAAA;IACvD,qDAAuB,CAAA;IACvB,mEAAqC,CAAA;IAErC,mCAAmC;IACnC,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,iFAAmD,CAAA;IACnD,2EAA6C,CAAA;IAC7C,uEAAyC,CAAA;IAEzC,kBAAkB;IAClB,+CAAiB,CAAA;IACjB,iDAAmB,CAAA;IACnB,+CAAiB,CAAA,CAA8B,0CAA0C;AAC3F,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACzC,4DAA4D;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,wGAAwG;IACxG,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAEzC,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,gJAAgJ;IAChJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,kFAAkF;IAClF,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE5C,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAEzC,gGAAgG;IAChG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEpE,2HAA2H;IAC3H,eAAe,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAEzD,wHAAwH;IACxH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEnE,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAEjD,oBAAoB;IACpB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAExE,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE5C,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IAEtB,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,mDAAmD;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAClC,6DAA6D;AAC7D,gEAAgE;AAChE,yEAAyE;AAEzE;;;GAGG;AACH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;KAClH,CAAC;CACH,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,gBAAgB,EAAE;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAA+B,MAAe;IAChF,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,aAAa,EAAE;KAClE,CAAY,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAA+B,MAAe;IACxE,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,GAAG,EAAE;KACxD,CAAY,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAKH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC1D,CAAC,CAAC,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACH,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,cAAc,6CAA6C,CAAC","sourcesContent":["/**\n * Authentication Shared Schemas\n *\n * Core authentication schemas shared between frontend and backend\n */\n\nimport { z } from 'zod';\nimport { UserContextSchema } from '../../users/users.shared.schemas';\nimport {\n  AuthMethod,\n  AuthFactorLevel,\n  AuthNextStep,\n  AuthSessionPurpose,\n  AuthScopeType,\n  AvailableMethodSchema,\n  SsoConnectionType,\n} from './authentication.shared.schemas';\nimport { ExternalAssuranceAssessmentSchema } from '../../external-providers/provider-authentication-assurance.shared.schemas';\nimport { AuthUtils } from './authentication.shared.utils';\nimport { isSameOriginRedirectPath } from './same-origin-redirect-path.shared';\nimport { SessionType } from '../../runtime/execution-context.shared.schemas';\nimport { PasswordPolicyRulesSchema } from '../../config/app-configuration-shared.shared.schemas';\nimport { AutocompleteFieldIdentifier, ZodTypeForColors, AutocompleteModifier } from '@wildo-ai/zod-decorators';\n\n/**\n * Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,\n * from the invitation token alone, which first-factor auth methods the target\n * organization allows and whether the org is SSO/SCIM-managed.\n *\n * Distinct from `identify()` (keyed by email→domain, requires an existing user):\n * this is token-keyed and works for a not-yet-activated invitee (INVITED\n * membership, no session). Populated by `GET /auth/invitation/info?token=…`,\n * which reads the token WITHOUT consuming it (unlike accept). See\n * `.claude/plans/invitation-multi-method-auth.md`.\n */\nexport enum InvitationManagementMode {\n  /** No enterprise identity authority — invitee may set a local credential (password/passkey) or use any allowed method. */\n  OPEN = 'open',\n  /** Org authenticates via enterprise SSO — route the invitee to the IdP (JIT consumes the invite; no local accept). */\n  SSO = 'sso',\n  /** Org is ACTIVELY directory-managed (SCIM live — DIRECTORY_PROVISIONING feature + a live SCIM token) — informational only, NO local credential: a local password/passkey/magic-link would survive IdP deprovisioning. Derived per-org (not from the org-TYPE mount flag) — see `isOrgActivelyDirectoryManaged` / AUTH-23. */\n  SCIM = 'scim',\n}\n\nexport const AuthInvitationInfoResponseSchema = z.object({\n  /** The invitee's email (from the INVITED membership's denormalized `userEmail`). */\n  inviteeEmail: z.email(),\n  /** Display name of the organization the invitee is joining. */\n  organizationName: z.string(),\n  /** First-factor methods the org allows for a joining member of the invitee's user type. */\n  availableFirstFactorMethods: z.array(AvailableMethodSchema),\n  /** Identity-management posture — drives chooser (open/sso) vs informational state (scim). */\n  managementMode: z.enum(InvitationManagementMode),\n  /**\n   * The org-join user type's ORG-MERGED password policy (the SAME policy the accept\n   * endpoint validates against). Lets the chooser's PASSWORD form show the invitee the\n   * org's REAL requirements (strength indicator + client pre-check) instead of the\n   * app-level default — so an org that strengthens `passwordPolicy` via `authOverrides`\n   * doesn't reject a client-accepted password after submit. Absent when the policy can't\n   * be resolved (unknown user type / degraded org read); the frontend then falls back to\n   * the app-level resolved policy. Structurally the frontend validation subset\n   * (`PasswordPolicyRulesSchema`); the backend's `PasswordPolicyConfig` is field-identical\n   * and parses through it losslessly.\n   */\n  passwordPolicy: PasswordPolicyRulesSchema.optional(),\n});\nexport type AuthInvitationInfoResponse = z.infer<typeof AuthInvitationInfoResponseSchema>;\n\n/**\n * Step 1: User identification by email\n * Returns available authentication methods for the user\n */\nexport const AuthIdentificationRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  organizationId: z.string().optional(),\n  deviceInfo: z.object({\n    userAgent: z.string().optional(),\n    ipAddress: z.string().optional(),\n  }).optional()\n});\n\n\n\n/**\n * Step 1 Response: Available authentication methods with factor classification\n */\nexport const AuthIdentificationResponseSchema = z.object({\n  sessionId: z.string(),\n  email: z.email(),\n  userExists: z.boolean(),\n\n  // First factor methods (primary authentication)\n  firstFactorMethods: z.array(AvailableMethodSchema),\n  defaultFirstFactorMethod: z.enum(AuthMethod).optional(),\n\n  // Second factor methods (MFA) - only shown if MFA is required\n  secondFactorMethods: z.array(AvailableMethodSchema),\n  requiresMFA: z.boolean(),\n  mfaMethodsRequired: z.number().default(1),\n\n  // Organization-specific information\n  organizationBranding: z.object({\n    // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n    // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n    // servable URL OR an app-relative path (e.g. `/favicon.png`).\n    logoUrl: z.string().optional(),\n    primaryColor: ZodTypeForColors.optional(),\n    organizationName: z.string().optional()\n  }).optional(),\n\n  // Available integrations (if any auth method supports them)\n  availableIntegrations: z.array(z.object({\n    integrationId: z.string(),\n    externalProviderId: z.string(), // Which auth provider enables this integration\n    iconUrl: z.url().optional()\n  })).default([]),\n});\n\n\n\n// ===============================\n// AUTHENTICATION REQUEST SCHEMAS\n// ===============================\n\n/**\n * Base authentication request schema with factor context\n */\nexport const BaseAuthRequestSchema = z.object({\n  sessionId: z.string().min(1),\n  method: z.enum(AuthMethod),\n  factorLevel: z.enum(AuthFactorLevel),\n  rememberMe: z.boolean().default(false),\n\n  // Integration access request (optional)\n  requestedIntegrations: z.array(z.string()).default([])\n});\n\n\n\n/**\n * Password Authentication (First factor only)\n */\nexport const PasswordAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.PASSWORD),\n  factorLevel: z.literal(AuthFactorLevel.FIRST),\n  password: z.string().min(1)\n});\n\n\n\n/**\n * Third-Party OAuth2 Authentication (First factor, extensible)\n */\nexport const External_OAuth2_AuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.EXTERNAL_OAUTH2),\n  factorLevel: z.enum(AuthFactorLevel),\n  externalProviderId: z.string().min(1), // References configured provider\n  redirectUri: z.url(),\n  state: z.string().optional(), // CSRF protection\n\n  // Integration-specific parameters\n  additionalScopes: z.array(z.string()).default([]), // Additional scopes for integrations\n  integrationPermissions: z.array(z.string()).default([]) // Specific integration permissions\n});\n\n\n\n/**\n * Organization SSO Authentication (First or second factor, organization-restricted)\n */\nexport const OrganizationSSOAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.enum([AuthMethod.ORG_SAML, AuthMethod.ORG_OPENID_CONNECT]),\n  factorLevel: z.enum(AuthFactorLevel),\n  ssoId: z.string().min(1),\n  organizationId: z.string().min(1),\n\n  // SSO-specific data\n  samlResponse: z.string().optional(), // For SAML\n  idToken: z.string().optional(), // For OpenID Connect\n  state: z.string().optional()\n});\n\n\n\n/**\n * OAuth2 Callback Schema (for both third-party and SSO)\n */\nexport const OAuth2CallbackSchema = z.object({\n  sessionId: z.string().min(1),\n  externalProviderId: z.string().optional(), // For third-party OAuth2\n  ssoId: z.string().optional(), // For organization SSO\n  code: z.string().min(1),\n  state: z.string().optional(),\n  error: z.string().optional(),\n  errorDescription: z.string().optional()\n});\n\n\n\n/**\n * TOTP Authentication (Second factor only)\n */\nexport const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.TOTP),\n  factorLevel: z.literal(AuthFactorLevel.SECOND),\n  token: z.string().regex(/^(\\d{6}|[a-f0-9]{8})$/)\n});\n\n\n\n/**\n * SMS OTP Authentication (First or second factor)\n */\n/**\n * Verifying an SMS one-time code.\n *\n * There is deliberately NO `phoneNumber` here. One was accepted — optional, E.164-shaped — and read\n * by nothing: the code is matched by the session's account and the session id, and the destination\n * was always resolved from the account. Its only effect was that the value a CALLER supplied was\n * written into both audit rows as though it were the number the code went to, so a caller could\n * attribute their own attempts to a number that was never involved. An audit trail whose subject\n * chooses what it says about them is not attributable.\n *\n * No first-party client ever sent it — the engine's own `SmsOtpAuthMethod` calls\n * `handleMfaVerify(sessionId, method, code)` — so removing it takes nothing away from a caller.\n */\nexport const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.SMS_OTP),\n  factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),\n  token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/**\n * Email OTP Authentication (Second factor only)\n */\nexport const EmailOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.EMAIL_OTP),\n  factorLevel: z.literal(AuthFactorLevel.SECOND),\n  token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/**\n * Passkey (WebAuthn) Authentication (First or second factor)\n */\nexport const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.PASSKEY),\n  factorLevel: z.enum(AuthFactorLevel),\n  // WebAuthn authentication response from navigator.credentials.get()\n  response: z.object({\n    id: z.string(),\n    rawId: z.string(),\n    response: z.object({\n      authenticatorData: z.string(),\n      clientDataJSON: z.string(),\n      signature: z.string(),\n      userHandle: z.string().optional(),\n    }),\n    authenticatorAttachment: z.string().optional(),\n    clientExtensionResults: z.record(z.string(), z.any()).default({}),\n    type: z.literal('public-key'),\n  }),\n});\n\n\n\n// ===============================\n// MAGIC LINK SCHEMAS (Phase G2)\n// ===============================\n\n/**\n * The longest deep link an emailed sign-in link carries. A longer same-origin path is dropped, not refused.\n */\nexport const MAX_CARRIED_AUTH_REDIRECT_LENGTH = 2048;\n\n/**\n * Decide whether a request's post-auth deep link rides an emailed sign-in link (#1014) — shared by the\n * magic-link send, the invitation accept and password-less registration (#1086), the requests that email one.\n *\n * Kept only when it is a same-origin path by {@link isSameOriginRedirectPath} (the one predicate every\n * auth redirect answers through) and no longer than {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}; otherwise\n * `undefined`. An absolute or foreign value would turn a trusted application email into an open redirect\n * that fires right after the person proves who they are. Dropping rather than a 400 — for the length too —\n * keeps the request's answer identical for every redirect (the send's anti-enumeration contract), and a\n * person whose redirect was dropped still signs in, at the application home.\n */\nexport function carriedAuthRedirect(value: string | undefined): string | undefined {\n  return value !== undefined && value.length <= MAX_CARRIED_AUTH_REDIRECT_LENGTH && isSameOriginRedirectPath(value)\n    ? value\n    : undefined;\n}\n\n/**\n * Magic Link Send Request — triggers a magic link email to the user.\n * Separate from the main AuthenticationRequestSchema because it doesn't\n * go through the standard authenticate() dispatch.\n */\nexport const MagicLinkSendRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  organizationId: z.string().optional(),\n  /**\n   * The deep link the person asked for a magic link from (`/login?redirect=/deals/42`), carried into the\n   * emailed URL so signing in lands there, including through an MFA detour (#1014).\n   *\n   * {@link carriedAuthRedirect} decides it: kept only when it is a same-origin path no longer than\n   * {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}, otherwise DROPPED — never refused.\n   */\n  redirect: z.string().optional().transform(carriedAuthRedirect),\n});\n\n\n\n\n/**\n * Magic Link Verify Request — verifies the token from the magic link.\n * Used by POST /auth/magic-link/verify for programmatic verification.\n * Intentionally NOT added to AuthenticationRequestSchema discriminated union\n * because magic link verification follows a separate flow (GET from email click\n * → exchange code → POST verify).\n */\nexport const MagicLinkVerifyRequestSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\n\n\n\n// ===============================\n// PHONE VERIFICATION SCHEMAS (Phase G2)\n// ===============================\n\n/**\n * Phone Verification Send Request — triggers a verification code to a phone number.\n * Used for phone number ownership verification, separate from SMS OTP auth.\n */\nexport const PhoneVerifySendRequestSchema = z.object({\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n});\n\n\n\n\n/**\n * Phone Verification Confirm Request — confirms the verification code.\n */\nexport const PhoneVerifyConfirmRequestSchema = z.object({\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n  code: z.string().regex(/^\\d{4,8}$/),\n});\n\n\n\n\n/**\n * Union of all authentication request types\n */\nexport const AuthenticationRequestSchema = z.discriminatedUnion('method', [\n  PasswordAuthRequestSchema,\n  External_OAuth2_AuthRequestSchema,\n  OrganizationSSOAuthRequestSchema,\n  TOTPAuthRequestSchema,\n  SMSOTPAuthRequestSchema,\n  EmailOTPAuthRequestSchema,\n  PasskeyAuthRequestSchema\n]);\n\n\n\n/**\n * Authentication Response Schema with Factor Context and Integration Access.\n *\n * **Wire contract — refresh token is NEVER included** (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string().optional()` which was emitted in the JSON\n * body for every authentication response. The cookie migration (A-Step 2,\n * 2026-04-13) added `Set-Cookie: __wildo_refresh=…` as a parallel\n * channel; A-Step 3 (2026-04-13) made the SaaS-frontend stop reading\n * the body field; A-Step 6 (THIS step) DROPS the body field entirely\n * so the wire response physically cannot carry the refresh token.\n *\n * Backend internals: the orchestrator's\n * `_buildAuthenticationSuccessMethod` returns\n * `AuthenticationServiceResult = AuthenticationResponse & { refreshToken?: string }`\n * (a backend-only TS type — NOT a wire schema) so the controller can\n * extract the refresh-token value and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`. The wire\n * payload (this schema) STILL has no `refreshToken` field — the\n * controller's helper sets the cookie and emits the body separately.\n *\n * `integrationTokens[].refreshToken` (below) is a third-party-IdP\n * OAuth2 refresh token (Google, Microsoft, etc.) — NOT a Wildo refresh\n * token. It stays on the wire because the frontend needs it to drive\n * IdP-side API calls; it is bound to a different security model\n * (IdP-issued, IdP-rotated, never used to mint Wildo JWTs).\n */\nexport const AuthenticationResponseSchema = z.object({\n  success: z.boolean(),\n  sessionId: z.string(),\n  userExists: z.boolean(),\n  factorLevel: z.enum(AuthFactorLevel),\n  authMethod: z.enum(AuthMethod).optional(),\n\n  // Success response. NOTE: `refreshToken` deliberately ABSENT from the\n  // wire schema (Auth-hardening A-Step 6) — see the file/schema-level\n  // JSDoc above for the cookie-only contract.\n  accessToken: z.string().optional(),\n  expiresIn: z.number().optional(),\n   user: UserContextSchema.optional(),\n\n  // Integration access tokens (if requested and granted)\n  integrationTokens: z.array(z.object({\n    integrationId: z.string(),\n    accessToken: z.string(),\n    refreshToken: z.string().optional(),\n    expiresIn: z.number().optional(),\n    scopes: z.array(z.string())\n  })).default([]),\n\n  // MFA continuation\n  requiresMFA: z.boolean().default(false),\n  availableMFAMethods: z.array(AvailableMethodSchema).optional(),\n  mfaMethodsRequired: z.number().optional(),\n  completedFactors: z.array(z.enum(AuthMethod)).optional(),\n  enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n  usableSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n  // W4.5: MFA enrollment routing\n  nextStep: z.enum(AuthNextStep).optional(),\n  availableEnrollmentMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n  // Error response\n  error: z.string().optional(),\n  errorCode: z.string().optional(),\n  retryAllowed: z.boolean().default(true),\n  remainingAttempts: z.number().optional(),\n  lockoutUntil: z.date().optional(),\n  /**\n   * PASSKEY only: the relying party holds no credential with the presented id for the account the\n   * assertion names (also answered when that account does not exist, so it discloses nothing).\n   *\n   * The one passkey refusal a client should act on: it may call\n   * `PublicKeyCredential.signalUnknownCredential({ rpId, credentialId })` so the browser stops offering a\n   * passkey this application deleted. Never set for a signature, user-verification or counter refusal.\n   */\n  passkeyCredentialUnknown: z.boolean().optional(),\n\n  // Method-specific data\n  challengeData: z.record(z.string(), z.any()).optional(),\n  redirectUrl: z.url().optional()\n});\n\n\n\n// ===============================\n// MFA SETUP AND MANAGEMENT\n// ===============================\n\n/**\n * MFA Setup Request\n */\nexport const MFASetupRequestSchema = z.object({\n  method: z.enum(AuthMethod),\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n  deviceName: z.string().optional()\n}).refine((data) => AuthUtils.canBeSecondFactor(data.method));\n\n\n/**\n * MFA Setup Response\n */\nexport const MFASetupResponseSchema = z.object({\n  method: z.enum(AuthMethod),\n  setupToken: z.string(),\n  qrCodeUrl: z.url().optional(),\n  secret: z.string().optional(),\n  challenge: z.record(z.string(), z.any()).optional(),\n  recoveryCodes: z.array(z.string()).optional()\n});\n\n\n\n\n/**\n * Authentication Session State\n */\n/**\n * Something an account owes before a parked sign-in may complete (#1374).\n *\n * `ONBOARDING_PENDING` used to mean exactly one thing — the organization named at onboarding — and could not carry\n * a second. Each member is derived from durable state, has its own step and completion door, and has its own\n * \"can this ever finish?\" answer, so one unfulfillable obligation never strands an account that owes another.\n */\nexport enum OnboardingObligation {\n  /** The organization the user type names at onboarding (`pendingOrgType` names its type). */\n  ORGANIZATION = 'organization',\n  /** The person's first and last name, when the user type collects them at onboarding. */\n  PROFILE_NAMES = 'profile_names',\n}\n\nexport enum AuthenticationSessionState {\n  // Login flow states\n  CREATED = 'CREATED',                           // Session created, waiting for identification\n  IDENTIFIED = 'IDENTIFIED',                     // User identified, methods available\n  FIRST_FACTOR_IN_PROGRESS = 'FIRST_FACTOR_IN_PROGRESS', // First factor authentication in progress\n  FIRST_FACTOR_COMPLETED = 'FIRST_FACTOR_COMPLETED',     // First factor completed\n  MFA_REQUIRED = 'MFA_REQUIRED',                 // MFA required, waiting for second factor\n  SECOND_FACTOR_IN_PROGRESS = 'SECOND_FACTOR_IN_PROGRESS', // Second factor in progress\n  COMPLETED = 'COMPLETED',                       // Authentication completed successfully\n  PASSWORD_EXPIRED = 'PASSWORD_EXPIRED',         // W2.2: Password expired, must change before token issuance\n\n  // W4: Registration pipeline states\n  REGISTERED = 'REGISTERED',                     // Invitation acceptance's correlation session (audit id only); self-registration creates none since #1010\n  EMAIL_VERIFIED = 'EMAIL_VERIFIED',             // Email confirmed, checking MFA requirements\n  MFA_ENROLLMENT_REQUIRED = 'MFA_ENROLLMENT_REQUIRED', // MFA enrollment needed before tokens can be issued\n  MFA_ENROLLMENT_GRACE = 'MFA_ENROLLMENT_GRACE', // Within grace period — tokens issued with mfaGraceExpiresAt claim\n  ONBOARDING_PENDING = 'ONBOARDING_PENDING',     // Auth complete, the organization named at onboarding is still owed — reached by the registration pipeline AND, since #1091, by a login of an account that owes one\n\n  // Terminal states\n  FAILED = 'FAILED',                             // Authentication failed\n  EXPIRED = 'EXPIRED',                           // Session expired\n  LOCKED = 'LOCKED'                              // Account locked due to too many attempts\n}\n\n/** W4.2: Session purpose — drives UI rendering and valid state transitions. */\nexport const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);\n\n/**\n * #1103 — what a FEDERATED sign-in (OAuth2 / OIDC callback, SAML ACS) established about itself, carried on the\n * session it was parked on when the account still owed its organization at onboarding.\n *\n * A federated sign-in that completes at once records `USER_SSO_LOGIN` with this evidence on the spot. A parked\n * one signs nobody in yet, so the record waits for the onboarding completion that does — and without this object\n * that completion could only record a generic login, losing which provider and connection proved the identity\n * and the provider MFA assurance verdict (a `WARNED` verdict exists nowhere else once the callback has returned).\n * The auth source is not stored: it follows from the proved factor (`ORG_SAML` is SAML, the other federated\n * methods are OIDC).\n */\nexport const FederatedSignInEvidenceSchema = z.object({\n  providerRef: z.string().min(1),\n  connectionType: z.enum(SsoConnectionType),\n  /** The connection's scope, for an enterprise connection. */\n  scopeType: z.enum(AuthScopeType).optional(),\n  organizationId: z.string().optional(),\n  applicationId: z.string().optional(),\n  /** The provider MFA assurance verdict the callback assessed. Absent where no assessment runs (SAML). */\n  assurance: ExternalAssuranceAssessmentSchema.optional(),\n});\nexport type FederatedSignInEvidence = z.infer<typeof FederatedSignInEvidenceSchema>;\n\n/**\n * Authentication Session Schema\n * Tracks the complete state of an authentication session\n */\nexport const AuthenticationSessionSchema = z.object({\n  sessionId: z.string(),\n  state: z.enum(AuthenticationSessionState),\n\n  // User identification\n  email: z.email().optional(),\n  userExists: z.boolean().optional(),\n  userId: z.string().optional(),\n  /** Trusted organization created transactionally by deferred registration onboarding. */\n  organizationId: z.string().optional(),\n  /**\n   * Untrusted DNS-verified email-domain ownership hint used only to tighten SSO policy.\n   * It is deliberately distinct from `organizationId`, which has trusted onboarding provenance.\n   */\n  scopeType: z.enum(AuthScopeType).optional(),\n  scopeId: z.string().optional(),\n\n  /** W3.5: Resolved user type for this session (from X-Frontend-Service-Name → frontendServices → userType). Drives per-user-type auth policy. */\n  activeUserType: z.string().optional(),\n\n  /** W4.2: Session purpose — determines valid state transitions and frontend UI. */\n  purpose: AuthSessionPurposeSchema.optional(),\n\n  /** W4: Next step hint for frontend routing after state transitions. */\n  nextStep: z.enum(AuthNextStep).optional(),\n\n  /** W4.5: ISO date when MFA grace period expires. Present when state is MFA_ENROLLMENT_GRACE. */\n  mfaGraceExpiresAt: z.string().optional(),\n\n  /** W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. */\n  pendingOrgType: z.string().optional(),\n\n  /**\n   * Every obligation still owed before this parked session may sign in (#1374). Present on an\n   * `ONBOARDING_PENDING` session; each member is discharged by its own completion door, and the session\n   * mints only once none remain. Re-derived from durable state at every parking and after every\n   * completion, so it is a projection, never the record.\n   */\n  pendingObligations: z.array(z.enum(OnboardingObligation)).optional(),\n\n  /** #1103: the federated sign-in this session was parked for — recorded as its USER_SSO_LOGIN when onboarding completes. */\n  federatedSignIn: FederatedSignInEvidenceSchema.optional(),\n\n  /** W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). */\n  availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),\n\n  // Authentication flow state\n  completedFactors: z.array(z.enum(AuthMethod)).default([]),\n  /**\n   * Whether the authenticator LOCALLY VERIFIED the person in this session's passkey ceremony (#1248).\n   *\n   * Persisted because it is the difference between a passkey that proved one factor and one that\n   * proved two, and nothing else on the session records it — `completedFactors` says PASSKEY either\n   * way. The MFA decision reads the flag transiently at sign-in; an ID token is minted long\n   * afterwards, from the session, so without this the token could not carry the distinction its own\n   * acceptance asks for.\n   *\n   * Absent means no passkey ceremony completed on this session, or one completed without user\n   * verification. Those are deliberately not distinguished: neither proves the activation, and a\n   * relying party reading `amr` needs to know only whether it happened.\n   */\n  passkeyUserVerified: z.boolean().optional(),\n  currentFactor: z.enum(AuthFactorLevel).optional(),\n\n  // Available methods\n  availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),\n  availableSecondFactorMethods: z.array(AvailableMethodSchema).default([]),\n\n  // MFA requirements\n  requiresMFA: z.boolean().default(false),\n  mfaMethodsRequired: z.number().default(1),\n  /**\n   * What the user has ENROLLED — factors that took a deliberate setup act. **Empty means nothing is\n   * set up**, and that is the question this field answers; ask `usableSecondFactorMethods` instead\n   * for \"can a challenge run\".\n   *\n   * It used to carry `AuthMethod.EMAIL_OTP` unconditionally, so it was never empty and could not\n   * answer its own question. Callers that branch on \"has this user got a second factor\" must read\n   * this; callers that branch on \"is there a challenge to render\" must not.\n   */\n  enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n  /**\n   * Intersection of `availableSecondFactorMethods` (what the policy accepts) with what the user can\n   * PRESENT — enrolled ∪ the factors that need no enrollment. **Not** an intersection with\n   * `enrolledSecondFactorMethods`, which this said until the two concepts were separated: a user\n   * whose only accepted factor is email OTP has enrolled nothing and can still complete a challenge.\n   *\n   * This is the field every \"where do I send this user\" decision reads.\n   */\n  usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n  /**\n   * When true, the factors that need no enrollment are excluded from the accepted set — see\n   * `AuthUtils.getAlwaysAvailableSecondFactorMethods()`, which is the one place that list lives.\n   * (Today that is `EMAIL_OTP`; this doc named the complement by hand and would have gone stale the\n   * day a second such factor appeared.)\n   */\n  requireStrongMFA: z.boolean().default(false),\n\n  // Session metadata\n  createdAt: z.date(),\n  expiresAt: z.date(),\n  lastActivity: z.date(),\n\n  // Security tracking\n  attempts: z.number().default(0),\n  maxAttempts: z.number().default(5),\n  lockoutUntil: z.date().optional(),\n\n  // Device and context\n  deviceInfo: z.object({\n    userAgent: z.string().optional(),\n    ipAddress: z.string().optional(),\n  }).optional(),\n\n  // Integration requests\n  requestedIntegrations: z.array(z.string()).default([]),\n\n  // Session-specific data for ongoing flows\n  challengeData: z.record(z.string(), z.any()).optional(),\n  pendingRedirectUrl: z.url().optional(),\n\n  // Organization branding (cached for consistent UI)\n  organizationBranding: z.object({\n    // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n    // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n    // servable URL OR an app-relative path (e.g. `/favicon.png`).\n    logoUrl: z.string().optional(),\n    primaryColor: ZodTypeForColors.optional(),\n    organizationName: z.string().optional()\n  }).optional(),\n\n  // M1: Optimistic concurrency control version for atomic session updates\n  version: z.number().default(0),\n}).superRefine((session, ctx) => {\n  if ((session.scopeType === undefined) !== (session.scopeId === undefined)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['scopeType'],\n      message: 'Authentication session scopeType and scopeId must be provided together',\n    });\n  }\n});\n\n\n\n// ===============================\n// SIMPLIFIED FORM DTOs\n// ===============================\n// Used by frontend Form components and backend body parsing.\n// These are the \"what the user fills in\" schemas — services add\n// programmatic fields (sessionId, method, factorLevel) before API calls.\n\n/**\n * Identify step form DTO — user enters email to discover auth methods.\n * Used by the public auth page's first step.\n */\n/**\n * The sign-in identification form.\n *\n * The email field renders `autocomplete=\"username webauthn\"`: `webauthn` is what lets the browser offer\n * the person's passkeys for this site in the field's autofill list (conditional mediation), so they can\n * sign in by picking an account instead of typing an email and choosing a method.\n *\n * spec-cite: https://web.dev/articles/passkey-form-autofill — the username input requires `autocomplete=\"username webauthn\"`: \"Include both `username` and `webauthn` as space-separated values.\"\n */\nexport const AuthIdentifyFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME, autoCompleteModifier: AutocompleteModifier.WEBAUTHN },\n  }),\n});\n\n\n\n\n/**\n * Login step form DTO — user enters email + password.\n * Used by the public auth page when password auth is shown.\n * The .isPassword() decorator tells FormField to render a password input.\n */\nexport const AuthLoginFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n  }),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.CURRENT_PASSWORD },\n  }),\n});\n\nfunction withOneTimeCodeAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n  return (schema as any).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ONE_TIME_CODE },\n  }) as TSchema;\n}\n\nfunction withTelAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n  return (schema as any).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.TEL },\n  }) as TSchema;\n}\n\n/**\n * MFA email OTP challenge form DTO.\n * Used by the MFA challenge screen after the email code has been sent.\n */\nexport const EmailOtpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n  ),\n});\n\n/**\n * MFA SMS OTP challenge form DTO.\n * Used by the MFA challenge screen after the SMS code has been sent.\n */\nexport const SmsOtpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n  ),\n});\n\n/**\n * MFA TOTP challenge form DTO.\n * Used by the MFA challenge screen for authenticator-app verification.\n */\nexport const TotpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n/**\n * Phone enrollment start form DTO.\n * Used by the enrollment gate before sending a phone verification code.\n */\nexport const PhoneEnrollmentStartFormDtoSchema = z.object({\n  phoneNumber: withTelAutocomplete(z.string().min(1)),\n});\n\n/**\n * Phone enrollment verification form DTO.\n * Used by the enrollment gate after a verification code has been sent.\n */\nexport const PhoneEnrollmentVerifyFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n/**\n * TOTP enrollment verification form DTO.\n * Used after the user scans the QR code and confirms setup with a first code.\n */\nexport const TotpEnrollmentVerifyFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n\n\n\n/**\n * `POST /auth/token/exchange` — the answer when the one-time code parked a FEDERATED sign-in at organization\n * onboarding instead of signing it in (#1103).\n *\n * An OAuth2 / OIDC callback or a SAML ACS for an account that still owes its organization (#1091) opens an\n * authentication session at `ONBOARDING_PENDING` and puts THAT in the exchange code rather than tokens. Redeeming\n * the code answers with the session to complete on the organization-onboarding step, and nothing else: no access\n * token, and no refresh cookie. Deliberately a SEPARATE schema from `TokenExchangeResponseSchema`, whose strict\n * signed-in shape the docs site also parses: a handoff code redeemed there can never be parked, and widening that\n * shape would make every receiver narrow for a case only the SaaS frontend meets.\n */\nexport const TokenExchangeOrganizationOnboardingResponseSchema = z.strictObject({\n  nextStep: z.literal(AuthNextStep.ONBOARDING),\n  sessionId: z.string().min(1),\n});\n\nexport type TokenExchangeOrganizationOnboardingResponse = z.infer<typeof TokenExchangeOrganizationOnboardingResponseSchema>;\n\n/**\n * One-off session token exchange response.\n *\n * **Wire contract — refresh token is NEVER included** (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string()` which was emitted in the JSON body. The\n * cookie migration (A-Step 2) routed the refresh token to\n * `Set-Cookie: __wildo_refresh=…`; A-Step 6 removes the body field\n * entirely so a one-off-session client receives ONLY a (short-lived)\n * access token + the cookie. The controller's\n * `_jsonSuccessWithRefreshCookie` helper sets the cookie from a\n * separately-passed argument.\n */\nexport const OneOffTokenExchangeResponseSchema = z.object({\n  accessToken: z.string(),\n  sessionType: z.enum(SessionType),\n  consumableTokenValue: z.string().optional(),\n  tokenExpiresAt: z.string().optional(),\n  context: z.object({\n    tokenId: z.string(),\n    tokenType: z.string(),\n    targeting: z.object({\n      initiatorIds: z.record(z.string(), z.string()).optional(),\n    }).optional(),\n    organizationId: z.string().optional(),\n    applicationId: z.string().optional(),\n    userId: z.string(),\n  }),\n});\n\n// Cross-frontend handoff DTO atoms (cross-app-jwt-propagation Step 2) live\n// in `./cross-frontend-handoff.shared.dto.schemas` so a browser-safe subpath\n// (`@wildo-ai/saas-models/public-runtime`) can re-export them without\n// dragging this file's full transitive web (UserContext, SessionType,\n// AuthMethod, AuthFactorLevel, AuthSessionPurpose, AuthUtils,\n// `@wildo-ai/zod-decorators`). See saas-models-public-runtime.md K-2.\nexport * from './cross-frontend-handoff.shared.dto.schemas';\n\n// ===============================\n// INFERRED TYPES\n// ===============================\n\n// Authentication method types\nexport type AuthIdentificationRequest = z.infer<typeof AuthIdentificationRequestSchema>;\nexport type AuthIdentificationResponse = z.infer<typeof AuthIdentificationResponseSchema>;\n\n\n\n// Authentication request types\nexport type AuthenticationRequest = z.infer<typeof AuthenticationRequestSchema>;\nexport type AuthenticationResponse = z.infer<typeof AuthenticationResponseSchema>;\nexport type PasswordAuthRequest = z.infer<typeof PasswordAuthRequestSchema>;\nexport type External_OAuth2_AuthRequest = z.infer<typeof External_OAuth2_AuthRequestSchema>;\nexport type OrganizationSSOAuthRequest = z.infer<typeof OrganizationSSOAuthRequestSchema>;\nexport type OAuth2Callback = z.infer<typeof OAuth2CallbackSchema>;\nexport type TOTPAuthRequest = z.infer<typeof TOTPAuthRequestSchema>;\nexport type SMSOTPAuthRequest = z.infer<typeof SMSOTPAuthRequestSchema>;\nexport type EmailOTPAuthRequest = z.infer<typeof EmailOTPAuthRequestSchema>;\nexport type PasskeyAuthRequest = z.infer<typeof PasskeyAuthRequestSchema>;\n\nexport type MagicLinkSendRequest = z.infer<typeof MagicLinkSendRequestSchema>;\nexport type MagicLinkVerifyRequest = z.infer<typeof MagicLinkVerifyRequestSchema>;\n\nexport type PhoneVerifySendRequest = z.infer<typeof PhoneVerifySendRequestSchema>;\nexport type PhoneVerifyConfirmRequest = z.infer<typeof PhoneVerifyConfirmRequestSchema>;\n\n// MFA types\nexport type MFASetupRequest = z.infer<typeof MFASetupRequestSchema>;\nexport type MFASetupResponse = z.infer<typeof MFASetupResponseSchema>;\n\nexport type AuthIdentifyFormDto = z.infer<typeof AuthIdentifyFormDtoSchema>;\nexport type AuthLoginFormDto = z.infer<typeof AuthLoginFormDtoSchema>;\nexport type EmailOtpChallengeFormDto = z.infer<typeof EmailOtpChallengeFormDtoSchema>;\nexport type SmsOtpChallengeFormDto = z.infer<typeof SmsOtpChallengeFormDtoSchema>;\nexport type TotpChallengeFormDto = z.infer<typeof TotpChallengeFormDtoSchema>;\nexport type PhoneEnrollmentStartFormDto = z.infer<typeof PhoneEnrollmentStartFormDtoSchema>;\nexport type PhoneEnrollmentVerifyFormDto = z.infer<typeof PhoneEnrollmentVerifyFormDtoSchema>;\nexport type TotpEnrollmentVerifyFormDto = z.infer<typeof TotpEnrollmentVerifyFormDtoSchema>;\n\n// Session types\nexport type AuthenticationSession = z.infer<typeof AuthenticationSessionSchema>;\nexport type OneOffTokenExchangeResponse = z.infer<typeof OneOffTokenExchangeResponseSchema>;\n"]}
+{"version":3,"file":"authentication.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAE/G;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,0HAA0H;IAC1H,yCAAa,CAAA;IACb,sHAAsH;IACtH,uCAAW,CAAA;IACX,8TAA8T;IAC9T,yCAAa,CAAA;AACf,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE;IACvB,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,2FAA2F;IAC3F,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3D,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAEvB,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEvD,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,oCAAoC;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,8FAA8F;QAC9F,6DAA6D;QAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,4DAA4D;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,+CAA+C;QAC/E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC,wCAAwC;IACxC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;IACxE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB;IAEhD,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qCAAqC;IACxF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,mCAAmC;CAC5F,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,oBAAoB;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACjD,CAAC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;QACF,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC;AAIH,kCAAkC;AAClC,gCAAgC;AAChC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,gCAAgC,IAAI,wBAAwB,CAAC,KAAK,CAAC;QAC/G,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH,kCAAkC;AAClC,wCAAwC;AACxC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACpD,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACpC,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,yBAAyB;IACzB,iCAAiC;IACjC,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEzC,sEAAsE;IACtE,oEAAoE;IACpE,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEnC,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9E,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;;;OAOG;IACH,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,uBAAuB;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,kCAAkC;AAClC,2BAA2B;AAC3B,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAG9D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,qDAA6B,CAAA;IAC7B,wFAAwF;IACxF,uDAA+B,CAAA;AACjC,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,oBAAoB;IACpB,iDAAmB,CAAA;IACnB,uDAAyB,CAAA;IACzB,mFAAqD,CAAA;IACrD,+EAAiD,CAAA;IACjD,2DAA6B,CAAA;IAC7B,qFAAuD,CAAA;IACvD,qDAAuB,CAAA;IACvB,mEAAqC,CAAA;IAErC,mCAAmC;IACnC,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,iFAAmD,CAAA;IACnD,2EAA6C,CAAA;IAC7C,uEAAyC,CAAA;IAEzC,kBAAkB;IAClB,+CAAiB,CAAA;IACjB,iDAAmB,CAAA;IACnB,+CAAiB,CAAA,CAA8B,0CAA0C;AAC3F,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACzC,4DAA4D;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,wGAAwG;IACxG,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAEzC,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,gJAAgJ;IAChJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,kFAAkF;IAClF,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE5C,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAEzC,gGAAgG;IAChG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEpE,2HAA2H;IAC3H,eAAe,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAEzD,wHAAwH;IACxH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEnE,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAEjD,oBAAoB;IACpB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAExE,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE5C,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IAEtB,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,mDAAmD;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,8FAA8F;QAC9F,6DAA6D;QAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAClC,6DAA6D;AAC7D,gEAAgE;AAChE,yEAAyE;AAEzE;;;GAGG;AACH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;KAClH,CAAC;CACH,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,gBAAgB,EAAE;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAA+B,MAAe;IAChF,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,aAAa,EAAE;KAClE,CAAY,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAA+B,MAAe;IACxE,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,GAAG,EAAE;KACxD,CAAY,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAKH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC1D,CAAC,CAAC,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACH,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,cAAc,6CAA6C,CAAC","sourcesContent":["/**\n * Authentication Shared Schemas\n *\n * Core authentication schemas shared between frontend and backend\n */\n\nimport { z } from 'zod';\nimport { UserContextSchema } from '../../users/users.shared.schemas';\nimport {\n  AuthMethod,\n  AuthFactorLevel,\n  AuthNextStep,\n  AuthSessionPurpose,\n  AuthScopeType,\n  AvailableMethodSchema,\n  SsoConnectionType,\n} from './authentication.shared.schemas';\nimport { ExternalAssuranceAssessmentSchema } from '../../external-providers/provider-authentication-assurance.shared.schemas';\nimport { AuthUtils } from './authentication.shared.utils';\nimport { isSameOriginRedirectPath } from './same-origin-redirect-path.shared';\nimport { SessionType } from '../../runtime/execution-context.shared.schemas';\nimport { PasswordPolicyRulesSchema } from '../../config/app-configuration-shared.shared.schemas';\nimport { AutocompleteFieldIdentifier, ZodTypeForColors, AutocompleteModifier } from '@wildo-ai/zod-decorators';\n\n/**\n * Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,\n * from the invitation token alone, which first-factor auth methods the target\n * organization allows and whether the org is SSO/SCIM-managed.\n *\n * Distinct from `identify()` (keyed by email→domain, requires an existing user):\n * this is token-keyed and works for a not-yet-activated invitee (INVITED\n * membership, no session). Populated by `GET /auth/invitation/info?token=…`,\n * which reads the token WITHOUT consuming it (unlike accept). See\n * `.claude/plans/invitation-multi-method-auth.md`.\n */\nexport enum InvitationManagementMode {\n  /** No enterprise identity authority — invitee may set a local credential (password/passkey) or use any allowed method. */\n  OPEN = 'open',\n  /** Org authenticates via enterprise SSO — route the invitee to the IdP (JIT consumes the invite; no local accept). */\n  SSO = 'sso',\n  /** Org is ACTIVELY directory-managed (SCIM live — DIRECTORY_PROVISIONING feature + a live SCIM token) — informational only, NO local credential: a local password/passkey/magic-link would survive IdP deprovisioning. Derived per-org (not from the org-TYPE mount flag) — see `isOrgActivelyDirectoryManaged` / AUTH-23. */\n  SCIM = 'scim',\n}\n\nexport const AuthInvitationInfoResponseSchema = z.object({\n  /** The invitee's email (from the INVITED membership's denormalized `userEmail`). */\n  inviteeEmail: z.email(),\n  /** Display name of the organization the invitee is joining. */\n  organizationName: z.string(),\n  /** First-factor methods the org allows for a joining member of the invitee's user type. */\n  availableFirstFactorMethods: z.array(AvailableMethodSchema),\n  /** Identity-management posture — drives chooser (open/sso) vs informational state (scim). */\n  managementMode: z.enum(InvitationManagementMode),\n  /**\n   * The org-join user type's ORG-MERGED password policy (the SAME policy the accept\n   * endpoint validates against). Lets the chooser's PASSWORD form show the invitee the\n   * org's REAL requirements (strength indicator + client pre-check) instead of the\n   * app-level default — so an org that strengthens `passwordPolicy` via `authOverrides`\n   * doesn't reject a client-accepted password after submit. Absent when the policy can't\n   * be resolved (unknown user type / degraded org read); the frontend then falls back to\n   * the app-level resolved policy. Structurally the frontend validation subset\n   * (`PasswordPolicyRulesSchema`); the backend's `PasswordPolicyConfig` is field-identical\n   * and parses through it losslessly.\n   */\n  passwordPolicy: PasswordPolicyRulesSchema.optional(),\n});\nexport type AuthInvitationInfoResponse = z.infer<typeof AuthInvitationInfoResponseSchema>;\n\n/**\n * Step 1: User identification by email\n * Returns available authentication methods for the user\n */\nexport const AuthIdentificationRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  organizationId: z.string().optional(),\n  deviceInfo: z.object({\n    userAgent: z.string().optional(),\n    ipAddress: z.string().optional(),\n  }).optional()\n});\n\n\n\n/**\n * Step 1 Response: Available authentication methods with factor classification\n */\nexport const AuthIdentificationResponseSchema = z.object({\n  sessionId: z.string(),\n  email: z.email(),\n  userExists: z.boolean(),\n\n  // First factor methods (primary authentication)\n  firstFactorMethods: z.array(AvailableMethodSchema),\n  defaultFirstFactorMethod: z.enum(AuthMethod).optional(),\n\n  // Second factor methods (MFA) - only shown if MFA is required\n  secondFactorMethods: z.array(AvailableMethodSchema),\n  requiresMFA: z.boolean(),\n  mfaMethodsRequired: z.number().default(1),\n\n  // Organization-specific information\n  organizationBranding: z.object({\n    // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n    // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n    // servable URL OR an app-relative path (e.g. `/favicon.png`).\n    logoUrl: z.string().optional(),\n    primaryColor: ZodTypeForColors.optional(),\n    // The organization's own tab icon (#1799). No application fallback: the application's icon is\n    // already the page's, so an absent value leaves it in place.\n    faviconUrl: z.string().optional(),\n    organizationName: z.string().optional()\n  }).optional(),\n\n  // Available integrations (if any auth method supports them)\n  availableIntegrations: z.array(z.object({\n    integrationId: z.string(),\n    externalProviderId: z.string(), // Which auth provider enables this integration\n    iconUrl: z.url().optional()\n  })).default([]),\n});\n\n\n\n// ===============================\n// AUTHENTICATION REQUEST SCHEMAS\n// ===============================\n\n/**\n * Base authentication request schema with factor context\n */\nexport const BaseAuthRequestSchema = z.object({\n  sessionId: z.string().min(1),\n  method: z.enum(AuthMethod),\n  factorLevel: z.enum(AuthFactorLevel),\n  rememberMe: z.boolean().default(false),\n\n  // Integration access request (optional)\n  requestedIntegrations: z.array(z.string()).default([])\n});\n\n\n\n/**\n * Password Authentication (First factor only)\n */\nexport const PasswordAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.PASSWORD),\n  factorLevel: z.literal(AuthFactorLevel.FIRST),\n  password: z.string().min(1)\n});\n\n\n\n/**\n * Third-Party OAuth2 Authentication (First factor, extensible)\n */\nexport const External_OAuth2_AuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.EXTERNAL_OAUTH2),\n  factorLevel: z.enum(AuthFactorLevel),\n  externalProviderId: z.string().min(1), // References configured provider\n  redirectUri: z.url(),\n  state: z.string().optional(), // CSRF protection\n\n  // Integration-specific parameters\n  additionalScopes: z.array(z.string()).default([]), // Additional scopes for integrations\n  integrationPermissions: z.array(z.string()).default([]) // Specific integration permissions\n});\n\n\n\n/**\n * Organization SSO Authentication (First or second factor, organization-restricted)\n */\nexport const OrganizationSSOAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.enum([AuthMethod.ORG_SAML, AuthMethod.ORG_OPENID_CONNECT]),\n  factorLevel: z.enum(AuthFactorLevel),\n  ssoId: z.string().min(1),\n  organizationId: z.string().min(1),\n\n  // SSO-specific data\n  samlResponse: z.string().optional(), // For SAML\n  idToken: z.string().optional(), // For OpenID Connect\n  state: z.string().optional()\n});\n\n\n\n/**\n * OAuth2 Callback Schema (for both third-party and SSO)\n */\nexport const OAuth2CallbackSchema = z.object({\n  sessionId: z.string().min(1),\n  externalProviderId: z.string().optional(), // For third-party OAuth2\n  ssoId: z.string().optional(), // For organization SSO\n  code: z.string().min(1),\n  state: z.string().optional(),\n  error: z.string().optional(),\n  errorDescription: z.string().optional()\n});\n\n\n\n/**\n * TOTP Authentication (Second factor only)\n */\nexport const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.TOTP),\n  factorLevel: z.literal(AuthFactorLevel.SECOND),\n  token: z.string().regex(/^(\\d{6}|[a-f0-9]{8})$/)\n});\n\n\n\n/**\n * SMS OTP Authentication (First or second factor)\n */\n/**\n * Verifying an SMS one-time code.\n *\n * There is deliberately NO `phoneNumber` here. One was accepted — optional, E.164-shaped — and read\n * by nothing: the code is matched by the session's account and the session id, and the destination\n * was always resolved from the account. Its only effect was that the value a CALLER supplied was\n * written into both audit rows as though it were the number the code went to, so a caller could\n * attribute their own attempts to a number that was never involved. An audit trail whose subject\n * chooses what it says about them is not attributable.\n *\n * No first-party client ever sent it — the engine's own `SmsOtpAuthMethod` calls\n * `handleMfaVerify(sessionId, method, code)` — so removing it takes nothing away from a caller.\n */\nexport const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.SMS_OTP),\n  factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),\n  token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/**\n * Email OTP Authentication (Second factor only)\n */\nexport const EmailOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.EMAIL_OTP),\n  factorLevel: z.literal(AuthFactorLevel.SECOND),\n  token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/**\n * Passkey (WebAuthn) Authentication (First or second factor)\n */\nexport const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({\n  method: z.literal(AuthMethod.PASSKEY),\n  factorLevel: z.enum(AuthFactorLevel),\n  // WebAuthn authentication response from navigator.credentials.get()\n  response: z.object({\n    id: z.string(),\n    rawId: z.string(),\n    response: z.object({\n      authenticatorData: z.string(),\n      clientDataJSON: z.string(),\n      signature: z.string(),\n      userHandle: z.string().optional(),\n    }),\n    authenticatorAttachment: z.string().optional(),\n    clientExtensionResults: z.record(z.string(), z.any()).default({}),\n    type: z.literal('public-key'),\n  }),\n});\n\n\n\n// ===============================\n// MAGIC LINK SCHEMAS (Phase G2)\n// ===============================\n\n/**\n * The longest deep link an emailed sign-in link carries. A longer same-origin path is dropped, not refused.\n */\nexport const MAX_CARRIED_AUTH_REDIRECT_LENGTH = 2048;\n\n/**\n * Decide whether a request's post-auth deep link rides an emailed sign-in link (#1014) — shared by the\n * magic-link send, the invitation accept and password-less registration (#1086), the requests that email one.\n *\n * Kept only when it is a same-origin path by {@link isSameOriginRedirectPath} (the one predicate every\n * auth redirect answers through) and no longer than {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}; otherwise\n * `undefined`. An absolute or foreign value would turn a trusted application email into an open redirect\n * that fires right after the person proves who they are. Dropping rather than a 400 — for the length too —\n * keeps the request's answer identical for every redirect (the send's anti-enumeration contract), and a\n * person whose redirect was dropped still signs in, at the application home.\n */\nexport function carriedAuthRedirect(value: string | undefined): string | undefined {\n  return value !== undefined && value.length <= MAX_CARRIED_AUTH_REDIRECT_LENGTH && isSameOriginRedirectPath(value)\n    ? value\n    : undefined;\n}\n\n/**\n * Magic Link Send Request — triggers a magic link email to the user.\n * Separate from the main AuthenticationRequestSchema because it doesn't\n * go through the standard authenticate() dispatch.\n */\nexport const MagicLinkSendRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  organizationId: z.string().optional(),\n  /**\n   * The deep link the person asked for a magic link from (`/login?redirect=/deals/42`), carried into the\n   * emailed URL so signing in lands there, including through an MFA detour (#1014).\n   *\n   * {@link carriedAuthRedirect} decides it: kept only when it is a same-origin path no longer than\n   * {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}, otherwise DROPPED — never refused.\n   */\n  redirect: z.string().optional().transform(carriedAuthRedirect),\n});\n\n\n\n\n/**\n * Magic Link Verify Request — verifies the token from the magic link.\n * Used by POST /auth/magic-link/verify for programmatic verification.\n * Intentionally NOT added to AuthenticationRequestSchema discriminated union\n * because magic link verification follows a separate flow (GET from email click\n * → exchange code → POST verify).\n */\nexport const MagicLinkVerifyRequestSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\n\n\n\n// ===============================\n// PHONE VERIFICATION SCHEMAS (Phase G2)\n// ===============================\n\n/**\n * Phone Verification Send Request — triggers a verification code to a phone number.\n * Used for phone number ownership verification, separate from SMS OTP auth.\n */\nexport const PhoneVerifySendRequestSchema = z.object({\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n});\n\n\n\n\n/**\n * Phone Verification Confirm Request — confirms the verification code.\n */\nexport const PhoneVerifyConfirmRequestSchema = z.object({\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n  code: z.string().regex(/^\\d{4,8}$/),\n});\n\n\n\n\n/**\n * Union of all authentication request types\n */\nexport const AuthenticationRequestSchema = z.discriminatedUnion('method', [\n  PasswordAuthRequestSchema,\n  External_OAuth2_AuthRequestSchema,\n  OrganizationSSOAuthRequestSchema,\n  TOTPAuthRequestSchema,\n  SMSOTPAuthRequestSchema,\n  EmailOTPAuthRequestSchema,\n  PasskeyAuthRequestSchema\n]);\n\n\n\n/**\n * Authentication Response Schema with Factor Context and Integration Access.\n *\n * **Wire contract — refresh token is NEVER included** (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string().optional()` which was emitted in the JSON\n * body for every authentication response. The cookie migration (A-Step 2,\n * 2026-04-13) added `Set-Cookie: __wildo_refresh=…` as a parallel\n * channel; A-Step 3 (2026-04-13) made the SaaS-frontend stop reading\n * the body field; A-Step 6 (THIS step) DROPS the body field entirely\n * so the wire response physically cannot carry the refresh token.\n *\n * Backend internals: the orchestrator's\n * `_buildAuthenticationSuccessMethod` returns\n * `AuthenticationServiceResult = AuthenticationResponse & { refreshToken?: string }`\n * (a backend-only TS type — NOT a wire schema) so the controller can\n * extract the refresh-token value and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`. The wire\n * payload (this schema) STILL has no `refreshToken` field — the\n * controller's helper sets the cookie and emits the body separately.\n *\n * `integrationTokens[].refreshToken` (below) is a third-party-IdP\n * OAuth2 refresh token (Google, Microsoft, etc.) — NOT a Wildo refresh\n * token. It stays on the wire because the frontend needs it to drive\n * IdP-side API calls; it is bound to a different security model\n * (IdP-issued, IdP-rotated, never used to mint Wildo JWTs).\n */\nexport const AuthenticationResponseSchema = z.object({\n  success: z.boolean(),\n  sessionId: z.string(),\n  userExists: z.boolean(),\n  factorLevel: z.enum(AuthFactorLevel),\n  authMethod: z.enum(AuthMethod).optional(),\n\n  // Success response. NOTE: `refreshToken` deliberately ABSENT from the\n  // wire schema (Auth-hardening A-Step 6) — see the file/schema-level\n  // JSDoc above for the cookie-only contract.\n  accessToken: z.string().optional(),\n  expiresIn: z.number().optional(),\n   user: UserContextSchema.optional(),\n\n  // Integration access tokens (if requested and granted)\n  integrationTokens: z.array(z.object({\n    integrationId: z.string(),\n    accessToken: z.string(),\n    refreshToken: z.string().optional(),\n    expiresIn: z.number().optional(),\n    scopes: z.array(z.string())\n  })).default([]),\n\n  // MFA continuation\n  requiresMFA: z.boolean().default(false),\n  availableMFAMethods: z.array(AvailableMethodSchema).optional(),\n  mfaMethodsRequired: z.number().optional(),\n  completedFactors: z.array(z.enum(AuthMethod)).optional(),\n  enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n  usableSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n  // W4.5: MFA enrollment routing\n  nextStep: z.enum(AuthNextStep).optional(),\n  availableEnrollmentMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n  // Error response\n  error: z.string().optional(),\n  errorCode: z.string().optional(),\n  retryAllowed: z.boolean().default(true),\n  remainingAttempts: z.number().optional(),\n  lockoutUntil: z.date().optional(),\n  /**\n   * PASSKEY only: the relying party holds no credential with the presented id for the account the\n   * assertion names (also answered when that account does not exist, so it discloses nothing).\n   *\n   * The one passkey refusal a client should act on: it may call\n   * `PublicKeyCredential.signalUnknownCredential({ rpId, credentialId })` so the browser stops offering a\n   * passkey this application deleted. Never set for a signature, user-verification or counter refusal.\n   */\n  passkeyCredentialUnknown: z.boolean().optional(),\n\n  // Method-specific data\n  challengeData: z.record(z.string(), z.any()).optional(),\n  redirectUrl: z.url().optional()\n});\n\n\n\n// ===============================\n// MFA SETUP AND MANAGEMENT\n// ===============================\n\n/**\n * MFA Setup Request\n */\nexport const MFASetupRequestSchema = z.object({\n  method: z.enum(AuthMethod),\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n  deviceName: z.string().optional()\n}).refine((data) => AuthUtils.canBeSecondFactor(data.method));\n\n\n/**\n * MFA Setup Response\n */\nexport const MFASetupResponseSchema = z.object({\n  method: z.enum(AuthMethod),\n  setupToken: z.string(),\n  qrCodeUrl: z.url().optional(),\n  secret: z.string().optional(),\n  challenge: z.record(z.string(), z.any()).optional(),\n  recoveryCodes: z.array(z.string()).optional()\n});\n\n\n\n\n/**\n * Authentication Session State\n */\n/**\n * Something an account owes before a parked sign-in may complete (#1374).\n *\n * `ONBOARDING_PENDING` used to mean exactly one thing — the organization named at onboarding — and could not carry\n * a second. Each member is derived from durable state, has its own step and completion door, and has its own\n * \"can this ever finish?\" answer, so one unfulfillable obligation never strands an account that owes another.\n */\nexport enum OnboardingObligation {\n  /** The organization the user type names at onboarding (`pendingOrgType` names its type). */\n  ORGANIZATION = 'organization',\n  /** The person's first and last name, when the user type collects them at onboarding. */\n  PROFILE_NAMES = 'profile_names',\n}\n\nexport enum AuthenticationSessionState {\n  // Login flow states\n  CREATED = 'CREATED',                           // Session created, waiting for identification\n  IDENTIFIED = 'IDENTIFIED',                     // User identified, methods available\n  FIRST_FACTOR_IN_PROGRESS = 'FIRST_FACTOR_IN_PROGRESS', // First factor authentication in progress\n  FIRST_FACTOR_COMPLETED = 'FIRST_FACTOR_COMPLETED',     // First factor completed\n  MFA_REQUIRED = 'MFA_REQUIRED',                 // MFA required, waiting for second factor\n  SECOND_FACTOR_IN_PROGRESS = 'SECOND_FACTOR_IN_PROGRESS', // Second factor in progress\n  COMPLETED = 'COMPLETED',                       // Authentication completed successfully\n  PASSWORD_EXPIRED = 'PASSWORD_EXPIRED',         // W2.2: Password expired, must change before token issuance\n\n  // W4: Registration pipeline states\n  REGISTERED = 'REGISTERED',                     // Invitation acceptance's correlation session (audit id only); self-registration creates none since #1010\n  EMAIL_VERIFIED = 'EMAIL_VERIFIED',             // Email confirmed, checking MFA requirements\n  MFA_ENROLLMENT_REQUIRED = 'MFA_ENROLLMENT_REQUIRED', // MFA enrollment needed before tokens can be issued\n  MFA_ENROLLMENT_GRACE = 'MFA_ENROLLMENT_GRACE', // Within grace period — tokens issued with mfaGraceExpiresAt claim\n  ONBOARDING_PENDING = 'ONBOARDING_PENDING',     // Auth complete, the organization named at onboarding is still owed — reached by the registration pipeline AND, since #1091, by a login of an account that owes one\n\n  // Terminal states\n  FAILED = 'FAILED',                             // Authentication failed\n  EXPIRED = 'EXPIRED',                           // Session expired\n  LOCKED = 'LOCKED'                              // Account locked due to too many attempts\n}\n\n/** W4.2: Session purpose — drives UI rendering and valid state transitions. */\nexport const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);\n\n/**\n * #1103 — what a FEDERATED sign-in (OAuth2 / OIDC callback, SAML ACS) established about itself, carried on the\n * session it was parked on when the account still owed its organization at onboarding.\n *\n * A federated sign-in that completes at once records `USER_SSO_LOGIN` with this evidence on the spot. A parked\n * one signs nobody in yet, so the record waits for the onboarding completion that does — and without this object\n * that completion could only record a generic login, losing which provider and connection proved the identity\n * and the provider MFA assurance verdict (a `WARNED` verdict exists nowhere else once the callback has returned).\n * The auth source is not stored: it follows from the proved factor (`ORG_SAML` is SAML, the other federated\n * methods are OIDC).\n */\nexport const FederatedSignInEvidenceSchema = z.object({\n  providerRef: z.string().min(1),\n  connectionType: z.enum(SsoConnectionType),\n  /** The connection's scope, for an enterprise connection. */\n  scopeType: z.enum(AuthScopeType).optional(),\n  organizationId: z.string().optional(),\n  applicationId: z.string().optional(),\n  /** The provider MFA assurance verdict the callback assessed. Absent where no assessment runs (SAML). */\n  assurance: ExternalAssuranceAssessmentSchema.optional(),\n});\nexport type FederatedSignInEvidence = z.infer<typeof FederatedSignInEvidenceSchema>;\n\n/**\n * Authentication Session Schema\n * Tracks the complete state of an authentication session\n */\nexport const AuthenticationSessionSchema = z.object({\n  sessionId: z.string(),\n  state: z.enum(AuthenticationSessionState),\n\n  // User identification\n  email: z.email().optional(),\n  userExists: z.boolean().optional(),\n  userId: z.string().optional(),\n  /** Trusted organization created transactionally by deferred registration onboarding. */\n  organizationId: z.string().optional(),\n  /**\n   * Untrusted DNS-verified email-domain ownership hint used only to tighten SSO policy.\n   * It is deliberately distinct from `organizationId`, which has trusted onboarding provenance.\n   */\n  scopeType: z.enum(AuthScopeType).optional(),\n  scopeId: z.string().optional(),\n\n  /** W3.5: Resolved user type for this session (from X-Frontend-Service-Name → frontendServices → userType). Drives per-user-type auth policy. */\n  activeUserType: z.string().optional(),\n\n  /** W4.2: Session purpose — determines valid state transitions and frontend UI. */\n  purpose: AuthSessionPurposeSchema.optional(),\n\n  /** W4: Next step hint for frontend routing after state transitions. */\n  nextStep: z.enum(AuthNextStep).optional(),\n\n  /** W4.5: ISO date when MFA grace period expires. Present when state is MFA_ENROLLMENT_GRACE. */\n  mfaGraceExpiresAt: z.string().optional(),\n\n  /** W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. */\n  pendingOrgType: z.string().optional(),\n\n  /**\n   * Every obligation still owed before this parked session may sign in (#1374). Present on an\n   * `ONBOARDING_PENDING` session; each member is discharged by its own completion door, and the session\n   * mints only once none remain. Re-derived from durable state at every parking and after every\n   * completion, so it is a projection, never the record.\n   */\n  pendingObligations: z.array(z.enum(OnboardingObligation)).optional(),\n\n  /** #1103: the federated sign-in this session was parked for — recorded as its USER_SSO_LOGIN when onboarding completes. */\n  federatedSignIn: FederatedSignInEvidenceSchema.optional(),\n\n  /** W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). */\n  availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),\n\n  // Authentication flow state\n  completedFactors: z.array(z.enum(AuthMethod)).default([]),\n  /**\n   * Whether the authenticator LOCALLY VERIFIED the person in this session's passkey ceremony (#1248).\n   *\n   * Persisted because it is the difference between a passkey that proved one factor and one that\n   * proved two, and nothing else on the session records it — `completedFactors` says PASSKEY either\n   * way. The MFA decision reads the flag transiently at sign-in; an ID token is minted long\n   * afterwards, from the session, so without this the token could not carry the distinction its own\n   * acceptance asks for.\n   *\n   * Absent means no passkey ceremony completed on this session, or one completed without user\n   * verification. Those are deliberately not distinguished: neither proves the activation, and a\n   * relying party reading `amr` needs to know only whether it happened.\n   */\n  passkeyUserVerified: z.boolean().optional(),\n  currentFactor: z.enum(AuthFactorLevel).optional(),\n\n  // Available methods\n  availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),\n  availableSecondFactorMethods: z.array(AvailableMethodSchema).default([]),\n\n  // MFA requirements\n  requiresMFA: z.boolean().default(false),\n  mfaMethodsRequired: z.number().default(1),\n  /**\n   * What the user has ENROLLED — factors that took a deliberate setup act. **Empty means nothing is\n   * set up**, and that is the question this field answers; ask `usableSecondFactorMethods` instead\n   * for \"can a challenge run\".\n   *\n   * It used to carry `AuthMethod.EMAIL_OTP` unconditionally, so it was never empty and could not\n   * answer its own question. Callers that branch on \"has this user got a second factor\" must read\n   * this; callers that branch on \"is there a challenge to render\" must not.\n   */\n  enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n  /**\n   * Intersection of `availableSecondFactorMethods` (what the policy accepts) with what the user can\n   * PRESENT — enrolled ∪ the factors that need no enrollment. **Not** an intersection with\n   * `enrolledSecondFactorMethods`, which this said until the two concepts were separated: a user\n   * whose only accepted factor is email OTP has enrolled nothing and can still complete a challenge.\n   *\n   * This is the field every \"where do I send this user\" decision reads.\n   */\n  usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n  /**\n   * When true, the factors that need no enrollment are excluded from the accepted set — see\n   * `AuthUtils.getAlwaysAvailableSecondFactorMethods()`, which is the one place that list lives.\n   * (Today that is `EMAIL_OTP`; this doc named the complement by hand and would have gone stale the\n   * day a second such factor appeared.)\n   */\n  requireStrongMFA: z.boolean().default(false),\n\n  // Session metadata\n  createdAt: z.date(),\n  expiresAt: z.date(),\n  lastActivity: z.date(),\n\n  // Security tracking\n  attempts: z.number().default(0),\n  maxAttempts: z.number().default(5),\n  lockoutUntil: z.date().optional(),\n\n  // Device and context\n  deviceInfo: z.object({\n    userAgent: z.string().optional(),\n    ipAddress: z.string().optional(),\n  }).optional(),\n\n  // Integration requests\n  requestedIntegrations: z.array(z.string()).default([]),\n\n  // Session-specific data for ongoing flows\n  challengeData: z.record(z.string(), z.any()).optional(),\n  pendingRedirectUrl: z.url().optional(),\n\n  // Organization branding (cached for consistent UI)\n  organizationBranding: z.object({\n    // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n    // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n    // servable URL OR an app-relative path (e.g. `/favicon.png`).\n    logoUrl: z.string().optional(),\n    primaryColor: ZodTypeForColors.optional(),\n    // The organization's own tab icon (#1799). No application fallback: the application's icon is\n    // already the page's, so an absent value leaves it in place.\n    faviconUrl: z.string().optional(),\n    organizationName: z.string().optional()\n  }).optional(),\n\n  // M1: Optimistic concurrency control version for atomic session updates\n  version: z.number().default(0),\n}).superRefine((session, ctx) => {\n  if ((session.scopeType === undefined) !== (session.scopeId === undefined)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['scopeType'],\n      message: 'Authentication session scopeType and scopeId must be provided together',\n    });\n  }\n});\n\n\n\n// ===============================\n// SIMPLIFIED FORM DTOs\n// ===============================\n// Used by frontend Form components and backend body parsing.\n// These are the \"what the user fills in\" schemas — services add\n// programmatic fields (sessionId, method, factorLevel) before API calls.\n\n/**\n * Identify step form DTO — user enters email to discover auth methods.\n * Used by the public auth page's first step.\n */\n/**\n * The sign-in identification form.\n *\n * The email field renders `autocomplete=\"username webauthn\"`: `webauthn` is what lets the browser offer\n * the person's passkeys for this site in the field's autofill list (conditional mediation), so they can\n * sign in by picking an account instead of typing an email and choosing a method.\n *\n * spec-cite: https://web.dev/articles/passkey-form-autofill — the username input requires `autocomplete=\"username webauthn\"`: \"Include both `username` and `webauthn` as space-separated values.\"\n */\nexport const AuthIdentifyFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME, autoCompleteModifier: AutocompleteModifier.WEBAUTHN },\n  }),\n});\n\n\n\n\n/**\n * Login step form DTO — user enters email + password.\n * Used by the public auth page when password auth is shown.\n * The .isPassword() decorator tells FormField to render a password input.\n */\nexport const AuthLoginFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n  }),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.CURRENT_PASSWORD },\n  }),\n});\n\nfunction withOneTimeCodeAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n  return (schema as any).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ONE_TIME_CODE },\n  }) as TSchema;\n}\n\nfunction withTelAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n  return (schema as any).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.TEL },\n  }) as TSchema;\n}\n\n/**\n * MFA email OTP challenge form DTO.\n * Used by the MFA challenge screen after the email code has been sent.\n */\nexport const EmailOtpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n  ),\n});\n\n/**\n * MFA SMS OTP challenge form DTO.\n * Used by the MFA challenge screen after the SMS code has been sent.\n */\nexport const SmsOtpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n  ),\n});\n\n/**\n * MFA TOTP challenge form DTO.\n * Used by the MFA challenge screen for authenticator-app verification.\n */\nexport const TotpChallengeFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n/**\n * Phone enrollment start form DTO.\n * Used by the enrollment gate before sending a phone verification code.\n */\nexport const PhoneEnrollmentStartFormDtoSchema = z.object({\n  phoneNumber: withTelAutocomplete(z.string().min(1)),\n});\n\n/**\n * Phone enrollment verification form DTO.\n * Used by the enrollment gate after a verification code has been sent.\n */\nexport const PhoneEnrollmentVerifyFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n/**\n * TOTP enrollment verification form DTO.\n * Used after the user scans the QR code and confirms setup with a first code.\n */\nexport const TotpEnrollmentVerifyFormDtoSchema = z.object({\n  code: withOneTimeCodeAutocomplete(\n    z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n  ),\n});\n\n\n\n\n/**\n * `POST /auth/token/exchange` — the answer when the one-time code parked a FEDERATED sign-in at organization\n * onboarding instead of signing it in (#1103).\n *\n * An OAuth2 / OIDC callback or a SAML ACS for an account that still owes its organization (#1091) opens an\n * authentication session at `ONBOARDING_PENDING` and puts THAT in the exchange code rather than tokens. Redeeming\n * the code answers with the session to complete on the organization-onboarding step, and nothing else: no access\n * token, and no refresh cookie. Deliberately a SEPARATE schema from `TokenExchangeResponseSchema`, whose strict\n * signed-in shape the docs site also parses: a handoff code redeemed there can never be parked, and widening that\n * shape would make every receiver narrow for a case only the SaaS frontend meets.\n */\nexport const TokenExchangeOrganizationOnboardingResponseSchema = z.strictObject({\n  nextStep: z.literal(AuthNextStep.ONBOARDING),\n  sessionId: z.string().min(1),\n});\n\nexport type TokenExchangeOrganizationOnboardingResponse = z.infer<typeof TokenExchangeOrganizationOnboardingResponseSchema>;\n\n/**\n * One-off session token exchange response.\n *\n * **Wire contract — refresh token is NEVER included** (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string()` which was emitted in the JSON body. The\n * cookie migration (A-Step 2) routed the refresh token to\n * `Set-Cookie: __wildo_refresh=…`; A-Step 6 removes the body field\n * entirely so a one-off-session client receives ONLY a (short-lived)\n * access token + the cookie. The controller's\n * `_jsonSuccessWithRefreshCookie` helper sets the cookie from a\n * separately-passed argument.\n */\nexport const OneOffTokenExchangeResponseSchema = z.object({\n  accessToken: z.string(),\n  sessionType: z.enum(SessionType),\n  consumableTokenValue: z.string().optional(),\n  tokenExpiresAt: z.string().optional(),\n  context: z.object({\n    tokenId: z.string(),\n    tokenType: z.string(),\n    targeting: z.object({\n      initiatorIds: z.record(z.string(), z.string()).optional(),\n    }).optional(),\n    organizationId: z.string().optional(),\n    applicationId: z.string().optional(),\n    userId: z.string(),\n  }),\n});\n\n// Cross-frontend handoff DTO atoms (cross-app-jwt-propagation Step 2) live\n// in `./cross-frontend-handoff.shared.dto.schemas` so a browser-safe subpath\n// (`@wildo-ai/saas-models/public-runtime`) can re-export them without\n// dragging this file's full transitive web (UserContext, SessionType,\n// AuthMethod, AuthFactorLevel, AuthSessionPurpose, AuthUtils,\n// `@wildo-ai/zod-decorators`). See saas-models-public-runtime.md K-2.\nexport * from './cross-frontend-handoff.shared.dto.schemas';\n\n// ===============================\n// INFERRED TYPES\n// ===============================\n\n// Authentication method types\nexport type AuthIdentificationRequest = z.infer<typeof AuthIdentificationRequestSchema>;\nexport type AuthIdentificationResponse = z.infer<typeof AuthIdentificationResponseSchema>;\n\n\n\n// Authentication request types\nexport type AuthenticationRequest = z.infer<typeof AuthenticationRequestSchema>;\nexport type AuthenticationResponse = z.infer<typeof AuthenticationResponseSchema>;\nexport type PasswordAuthRequest = z.infer<typeof PasswordAuthRequestSchema>;\nexport type External_OAuth2_AuthRequest = z.infer<typeof External_OAuth2_AuthRequestSchema>;\nexport type OrganizationSSOAuthRequest = z.infer<typeof OrganizationSSOAuthRequestSchema>;\nexport type OAuth2Callback = z.infer<typeof OAuth2CallbackSchema>;\nexport type TOTPAuthRequest = z.infer<typeof TOTPAuthRequestSchema>;\nexport type SMSOTPAuthRequest = z.infer<typeof SMSOTPAuthRequestSchema>;\nexport type EmailOTPAuthRequest = z.infer<typeof EmailOTPAuthRequestSchema>;\nexport type PasskeyAuthRequest = z.infer<typeof PasskeyAuthRequestSchema>;\n\nexport type MagicLinkSendRequest = z.infer<typeof MagicLinkSendRequestSchema>;\nexport type MagicLinkVerifyRequest = z.infer<typeof MagicLinkVerifyRequestSchema>;\n\nexport type PhoneVerifySendRequest = z.infer<typeof PhoneVerifySendRequestSchema>;\nexport type PhoneVerifyConfirmRequest = z.infer<typeof PhoneVerifyConfirmRequestSchema>;\n\n// MFA types\nexport type MFASetupRequest = z.infer<typeof MFASetupRequestSchema>;\nexport type MFASetupResponse = z.infer<typeof MFASetupResponseSchema>;\n\nexport type AuthIdentifyFormDto = z.infer<typeof AuthIdentifyFormDtoSchema>;\nexport type AuthLoginFormDto = z.infer<typeof AuthLoginFormDtoSchema>;\nexport type EmailOtpChallengeFormDto = z.infer<typeof EmailOtpChallengeFormDtoSchema>;\nexport type SmsOtpChallengeFormDto = z.infer<typeof SmsOtpChallengeFormDtoSchema>;\nexport type TotpChallengeFormDto = z.infer<typeof TotpChallengeFormDtoSchema>;\nexport type PhoneEnrollmentStartFormDto = z.infer<typeof PhoneEnrollmentStartFormDtoSchema>;\nexport type PhoneEnrollmentVerifyFormDto = z.infer<typeof PhoneEnrollmentVerifyFormDtoSchema>;\nexport type TotpEnrollmentVerifyFormDto = z.infer<typeof TotpEnrollmentVerifyFormDtoSchema>;\n\n// Session types\nexport type AuthenticationSession = z.infer<typeof AuthenticationSessionSchema>;\nexport type OneOffTokenExchangeResponse = z.infer<typeof OneOffTokenExchangeResponseSchema>;\n"]}

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.js

@@ -39,9 +39,9 @@ import { z } from 'zod';
  */
 export const ScimOrganizationUnitMappingEntrySchema = z.object({
     /** The value the directory pushes, e.g. `"Sales"`. Matched exactly, whitespace-trimmed. */
-    directoryValue: z.string().min(1).max(200),
+    directoryValue: z.string().min(1).max(200).describe("A department value the directory sends, such as `Sales`, up to 200 characters. It must match exactly, apart from surrounding whitespace; a department with no entry is ignored."),
     /** The `ORGANIZATION_UNITS` row this value binds to. */
-    organizationUnitId: z.string().min(1),
+    organizationUnitId: z.string().min(1).describe("The organization unit a member with this department is assigned to."),
 });
 /**
  * Is this organization managing unit assignments through SCIM at all?