npm - @wildo-ai/saas-models - Versions diffs - 1.1.8 → 1.1.10 - Mend

@wildo-ai/saas-models 1.1.8 → 1.1.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (951) hide show

package/dist/esm/security/authentications/authentication.shared.dto.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAE/G;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,0HAA0H;IAC1H,yCAAa,CAAA;IACb,sHAAsH;IACtH,uCAAW,CAAA;IACX,8TAA8T;IAC9T,yCAAa,CAAA;AACf,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE;IACvB,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,2FAA2F;IAC3F,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3D,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAEvB,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEvD,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,oCAAoC;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,8FAA8F;QAC9F,6DAA6D;QAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,4DAA4D;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,+CAA+C;QAC/E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC,wCAAwC;IACxC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;IACxE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB;IAEhD,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qCAAqC;IACxF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,mCAAmC;CAC5F,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,oBAAoB;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACjD,CAAC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;QACF,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC;AAIH,kCAAkC;AAClC,gCAAgC;AAChC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,gCAAgC,IAAI,wBAAwB,CAAC,KAAK,CAAC;QAC/G,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH,kCAAkC;AAClC,wCAAwC;AACxC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACpD,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACpC,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,yBAAyB;IACzB,iCAAiC;IACjC,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEzC,sEAAsE;IACtE,oEAAoE;IACpE,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEnC,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9E,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;;;OAOG;IACH,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,uBAAuB;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,kCAAkC;AAClC,2BAA2B;AAC3B,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAG9D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,qDAA6B,CAAA;IAC7B,wFAAwF;IACxF,uDAA+B,CAAA;AACjC,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,oBAAoB;IACpB,iDAAmB,CAAA;IACnB,uDAAyB,CAAA;IACzB,mFAAqD,CAAA;IACrD,+EAAiD,CAAA;IACjD,2DAA6B,CAAA;IAC7B,qFAAuD,CAAA;IACvD,qDAAuB,CAAA;IACvB,mEAAqC,CAAA;IAErC,mCAAmC;IACnC,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,iFAAmD,CAAA;IACnD,2EAA6C,CAAA;IAC7C,uEAAyC,CAAA;IAEzC,kBAAkB;IAClB,+CAAiB,CAAA;IACjB,iDAAmB,CAAA;IACnB,+CAAiB,CAAA,CAA8B,0CAA0C;AAC3F,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACzC,4DAA4D;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,wGAAwG;IACxG,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAEzC,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,gJAAgJ;IAChJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,kFAAkF;IAClF,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE5C,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAEzC,gGAAgG;IAChG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEpE,2HAA2H;IAC3H,eAAe,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAEzD,wHAAwH;IACxH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEnE,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAEjD,oBAAoB;IACpB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAExE,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE5C,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IAEtB,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,mDAAmD;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,8FAA8F;QAC9F,6DAA6D;QAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAClC,6DAA6D;AAC7D,gEAAgE;AAChE,yEAAyE;AAEzE;;;GAGG;AACH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;KAClH,CAAC;CACH,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,gBAAgB,EAAE;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAA+B,MAAe;IAChF,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,aAAa,EAAE;KAClE,CAAY,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAA+B,MAAe;IACxE,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,GAAG,EAAE;KACxD,CAAY,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAKH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC1D,CAAC,CAAC,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACH,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,cAAc,6CAA6C,CAAC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\nimport { UserContextSchema } from '../../users/users.shared.schemas';\nimport {\n AuthMethod,\n AuthFactorLevel,\n AuthNextStep,\n AuthSessionPurpose,\n AuthScopeType,\n AvailableMethodSchema,\n SsoConnectionType,\n} from './authentication.shared.schemas';\nimport { ExternalAssuranceAssessmentSchema } from '../../external-providers/provider-authentication-assurance.shared.schemas';\nimport { AuthUtils } from './authentication.shared.utils';\nimport { isSameOriginRedirectPath } from './same-origin-redirect-path.shared';\nimport { SessionType } from '../../runtime/execution-context.shared.schemas';\nimport { PasswordPolicyRulesSchema } from '../../config/app-configuration-shared.shared.schemas';\nimport { AutocompleteFieldIdentifier, ZodTypeForColors, AutocompleteModifier } from '@wildo-ai/zod-decorators';\n\n/\n Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,\n * from the invitation token alone, which first-factor auth methods the target\n * organization allows and whether the org is SSO/SCIM-managed.\n \n Distinct from `identify()` (keyed by email→domain, requires an existing user):\n * this is token-keyed and works for a not-yet-activated invitee (INVITED\n * membership, no session). Populated by `GET /auth/invitation/info?token=…`,\n * which reads the token WITHOUT consuming it (unlike accept). See\n * `.claude/plans/invitation-multi-method-auth.md`.\n /\nexport enum InvitationManagementMode {\n /* No enterprise identity authority — invitee may set a local credential (password/passkey) or use any allowed method. /\n OPEN = 'open',\n /* Org authenticates via enterprise SSO — route the invitee to the IdP (JIT consumes the invite; no local accept). /\n SSO = 'sso',\n /* Org is ACTIVELY directory-managed (SCIM live — DIRECTORY_PROVISIONING feature + a live SCIM token) — informational only, NO local credential: a local password/passkey/magic-link would survive IdP deprovisioning. Derived per-org (not from the org-TYPE mount flag) — see `isOrgActivelyDirectoryManaged` / AUTH-23. /\n SCIM = 'scim',\n}\n\nexport const AuthInvitationInfoResponseSchema = z.object({\n /* The invitee's email (from the INVITED membership's denormalized `userEmail`). /\n inviteeEmail: z.email(),\n /* Display name of the organization the invitee is joining. /\n organizationName: z.string(),\n /* First-factor methods the org allows for a joining member of the invitee's user type. /\n availableFirstFactorMethods: z.array(AvailableMethodSchema),\n /* Identity-management posture — drives chooser (open/sso) vs informational state (scim). /\n managementMode: z.enum(InvitationManagementMode),\n /\n The org-join user type's ORG-MERGED password policy (the SAME policy the accept\n * endpoint validates against). Lets the chooser's PASSWORD form show the invitee the\n * org's REAL requirements (strength indicator + client pre-check) instead of the\n * app-level default — so an org that strengthens `passwordPolicy` via `authOverrides`\n * doesn't reject a client-accepted password after submit. Absent when the policy can't\n * be resolved (unknown user type / degraded org read); the frontend then falls back to\n * the app-level resolved policy. Structurally the frontend validation subset\n * (`PasswordPolicyRulesSchema`); the backend's `PasswordPolicyConfig` is field-identical\n * and parses through it losslessly.\n /\n passwordPolicy: PasswordPolicyRulesSchema.optional(),\n});\nexport type AuthInvitationInfoResponse = z.infer<typeof AuthInvitationInfoResponseSchema>;\n\n/\n Step 1: User identification by email\n * Returns available authentication methods for the user\n /\nexport const AuthIdentificationRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional()\n});\n\n\n\n/\n Step 1 Response: Available authentication methods with factor classification\n /\nexport const AuthIdentificationResponseSchema = z.object({\n sessionId: z.string(),\n email: z.email(),\n userExists: z.boolean(),\n\n // First factor methods (primary authentication)\n firstFactorMethods: z.array(AvailableMethodSchema),\n defaultFirstFactorMethod: z.enum(AuthMethod).optional(),\n\n // Second factor methods (MFA) - only shown if MFA is required\n secondFactorMethods: z.array(AvailableMethodSchema),\n requiresMFA: z.boolean(),\n mfaMethodsRequired: z.number().default(1),\n\n // Organization-specific information\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n // The organization's own tab icon (#1799). No application fallback: the application's icon is\n // already the page's, so an absent value leaves it in place.\n faviconUrl: z.string().optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // Available integrations (if any auth method supports them)\n availableIntegrations: z.array(z.object({\n integrationId: z.string(),\n externalProviderId: z.string(), // Which auth provider enables this integration\n iconUrl: z.url().optional()\n })).default([]),\n});\n\n\n\n// ===============================\n// AUTHENTICATION REQUEST SCHEMAS\n// ===============================\n\n/\n Base authentication request schema with factor context\n /\nexport const BaseAuthRequestSchema = z.object({\n sessionId: z.string().min(1),\n method: z.enum(AuthMethod),\n factorLevel: z.enum(AuthFactorLevel),\n rememberMe: z.boolean().default(false),\n\n // Integration access request (optional)\n requestedIntegrations: z.array(z.string()).default([])\n});\n\n\n\n/\n Password Authentication (First factor only)\n /\nexport const PasswordAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSWORD),\n factorLevel: z.literal(AuthFactorLevel.FIRST),\n password: z.string().min(1)\n});\n\n\n\n/\n Third-Party OAuth2 Authentication (First factor, extensible)\n /\nexport const External_OAuth2_AuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EXTERNAL_OAUTH2),\n factorLevel: z.enum(AuthFactorLevel),\n externalProviderId: z.string().min(1), // References configured provider\n redirectUri: z.url(),\n state: z.string().optional(), // CSRF protection\n\n // Integration-specific parameters\n additionalScopes: z.array(z.string()).default([]), // Additional scopes for integrations\n integrationPermissions: z.array(z.string()).default([]) // Specific integration permissions\n});\n\n\n\n/\n Organization SSO Authentication (First or second factor, organization-restricted)\n /\nexport const OrganizationSSOAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.enum([AuthMethod.ORG_SAML, AuthMethod.ORG_OPENID_CONNECT]),\n factorLevel: z.enum(AuthFactorLevel),\n ssoId: z.string().min(1),\n organizationId: z.string().min(1),\n\n // SSO-specific data\n samlResponse: z.string().optional(), // For SAML\n idToken: z.string().optional(), // For OpenID Connect\n state: z.string().optional()\n});\n\n\n\n/\n OAuth2 Callback Schema (for both third-party and SSO)\n /\nexport const OAuth2CallbackSchema = z.object({\n sessionId: z.string().min(1),\n externalProviderId: z.string().optional(), // For third-party OAuth2\n ssoId: z.string().optional(), // For organization SSO\n code: z.string().min(1),\n state: z.string().optional(),\n error: z.string().optional(),\n errorDescription: z.string().optional()\n});\n\n\n\n/\n TOTP Authentication (Second factor only)\n /\nexport const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.TOTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^(\\d{6}\|[a-f0-9]{8})$/)\n});\n\n\n\n/\n SMS OTP Authentication (First or second factor)\n /\n/\n Verifying an SMS one-time code.\n \n There is deliberately NO `phoneNumber` here. One was accepted — optional, E.164-shaped — and read\n * by nothing: the code is matched by the session's account and the session id, and the destination\n * was always resolved from the account. Its only effect was that the value a CALLER supplied was\n * written into both audit rows as though it were the number the code went to, so a caller could\n * attribute their own attempts to a number that was never involved. An audit trail whose subject\n * chooses what it says about them is not attributable.\n \n No first-party client ever sent it — the engine's own `SmsOtpAuthMethod` calls\n * `handleMfaVerify(sessionId, method, code)` — so removing it takes nothing away from a caller.\n /\nexport const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.SMS_OTP),\n factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Email OTP Authentication (Second factor only)\n /\nexport const EmailOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EMAIL_OTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Passkey (WebAuthn) Authentication (First or second factor)\n /\nexport const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSKEY),\n factorLevel: z.enum(AuthFactorLevel),\n // WebAuthn authentication response from navigator.credentials.get()\n response: z.object({\n id: z.string(),\n rawId: z.string(),\n response: z.object({\n authenticatorData: z.string(),\n clientDataJSON: z.string(),\n signature: z.string(),\n userHandle: z.string().optional(),\n }),\n authenticatorAttachment: z.string().optional(),\n clientExtensionResults: z.record(z.string(), z.any()).default({}),\n type: z.literal('public-key'),\n }),\n});\n\n\n\n// ===============================\n// MAGIC LINK SCHEMAS (Phase G2)\n// ===============================\n\n/\n The longest deep link an emailed sign-in link carries. A longer same-origin path is dropped, not refused.\n /\nexport const MAX_CARRIED_AUTH_REDIRECT_LENGTH = 2048;\n\n/\n Decide whether a request's post-auth deep link rides an emailed sign-in link (#1014) — shared by the\n * magic-link send, the invitation accept and password-less registration (#1086), the requests that email one.\n \n Kept only when it is a same-origin path by {@link isSameOriginRedirectPath} (the one predicate every\n * auth redirect answers through) and no longer than {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}; otherwise\n * `undefined`. An absolute or foreign value would turn a trusted application email into an open redirect\n * that fires right after the person proves who they are. Dropping rather than a 400 — for the length too —\n * keeps the request's answer identical for every redirect (the send's anti-enumeration contract), and a\n * person whose redirect was dropped still signs in, at the application home.\n /\nexport function carriedAuthRedirect(value: string \| undefined): string \| undefined {\n return value !== undefined && value.length <= MAX_CARRIED_AUTH_REDIRECT_LENGTH && isSameOriginRedirectPath(value)\n ? value\n : undefined;\n}\n\n/\n Magic Link Send Request — triggers a magic link email to the user.\n * Separate from the main AuthenticationRequestSchema because it doesn't\n * go through the standard authenticate() dispatch.\n /\nexport const MagicLinkSendRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n /\n The deep link the person asked for a magic link from (`/login?redirect=/deals/42`), carried into the\n * emailed URL so signing in lands there, including through an MFA detour (#1014).\n \n {@link carriedAuthRedirect} decides it: kept only when it is a same-origin path no longer than\n * {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}, otherwise DROPPED — never refused.\n /\n redirect: z.string().optional().transform(carriedAuthRedirect),\n});\n\n\n\n\n/\n Magic Link Verify Request — verifies the token from the magic link.\n * Used by POST /auth/magic-link/verify for programmatic verification.\n * Intentionally NOT added to AuthenticationRequestSchema discriminated union\n * because magic link verification follows a separate flow (GET from email click\n * → exchange code → POST verify).\n /\nexport const MagicLinkVerifyRequestSchema = z.object({\n token: z.string().min(1),\n email: z.email().toLowerCase(),\n});\n\n\n\n\n// ===============================\n// PHONE VERIFICATION SCHEMAS (Phase G2)\n// ===============================\n\n/\n Phone Verification Send Request — triggers a verification code to a phone number.\n * Used for phone number ownership verification, separate from SMS OTP auth.\n /\nexport const PhoneVerifySendRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n});\n\n\n\n\n/\n Phone Verification Confirm Request — confirms the verification code.\n /\nexport const PhoneVerifyConfirmRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n code: z.string().regex(/^\\d{4,8}$/),\n});\n\n\n\n\n/\n Union of all authentication request types\n /\nexport const AuthenticationRequestSchema = z.discriminatedUnion('method', [\n PasswordAuthRequestSchema,\n External_OAuth2_AuthRequestSchema,\n OrganizationSSOAuthRequestSchema,\n TOTPAuthRequestSchema,\n SMSOTPAuthRequestSchema,\n EmailOTPAuthRequestSchema,\n PasskeyAuthRequestSchema\n]);\n\n\n\n/\n Authentication Response Schema with Factor Context and Integration Access.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string().optional()` which was emitted in the JSON\n * body for every authentication response. The cookie migration (A-Step 2,\n * 2026-04-13) added `Set-Cookie: __wildo_refresh=…` as a parallel\n * channel; A-Step 3 (2026-04-13) made the SaaS-frontend stop reading\n * the body field; A-Step 6 (THIS step) DROPS the body field entirely\n * so the wire response physically cannot carry the refresh token.\n \n Backend internals: the orchestrator's\n * `_buildAuthenticationSuccessMethod` returns\n * `AuthenticationServiceResult = AuthenticationResponse & { refreshToken?: string }`\n * (a backend-only TS type — NOT a wire schema) so the controller can\n * extract the refresh-token value and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`. The wire\n * payload (this schema) STILL has no `refreshToken` field — the\n * controller's helper sets the cookie and emits the body separately.\n \n `integrationTokens[].refreshToken` (below) is a third-party-IdP\n * OAuth2 refresh token (Google, Microsoft, etc.) — NOT a Wildo refresh\n * token. It stays on the wire because the frontend needs it to drive\n * IdP-side API calls; it is bound to a different security model\n * (IdP-issued, IdP-rotated, never used to mint Wildo JWTs).\n /\nexport const AuthenticationResponseSchema = z.object({\n success: z.boolean(),\n sessionId: z.string(),\n userExists: z.boolean(),\n factorLevel: z.enum(AuthFactorLevel),\n authMethod: z.enum(AuthMethod).optional(),\n\n // Success response. NOTE: `refreshToken` deliberately ABSENT from the\n // wire schema (Auth-hardening A-Step 6) — see the file/schema-level\n // JSDoc above for the cookie-only contract.\n accessToken: z.string().optional(),\n expiresIn: z.number().optional(),\n user: UserContextSchema.optional(),\n\n // Integration access tokens (if requested and granted)\n integrationTokens: z.array(z.object({\n integrationId: z.string(),\n accessToken: z.string(),\n refreshToken: z.string().optional(),\n expiresIn: z.number().optional(),\n scopes: z.array(z.string())\n })).default([]),\n\n // MFA continuation\n requiresMFA: z.boolean().default(false),\n availableMFAMethods: z.array(AvailableMethodSchema).optional(),\n mfaMethodsRequired: z.number().optional(),\n completedFactors: z.array(z.enum(AuthMethod)).optional(),\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // W4.5: MFA enrollment routing\n nextStep: z.enum(AuthNextStep).optional(),\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // Error response\n error: z.string().optional(),\n errorCode: z.string().optional(),\n retryAllowed: z.boolean().default(true),\n remainingAttempts: z.number().optional(),\n lockoutUntil: z.date().optional(),\n /\n PASSKEY only: the relying party holds no credential with the presented id for the account the\n * assertion names (also answered when that account does not exist, so it discloses nothing).\n \n The one passkey refusal a client should act on: it may call\n * `PublicKeyCredential.signalUnknownCredential({ rpId, credentialId })` so the browser stops offering a\n * passkey this application deleted. Never set for a signature, user-verification or counter refusal.\n /\n passkeyCredentialUnknown: z.boolean().optional(),\n\n // Method-specific data\n challengeData: z.record(z.string(), z.any()).optional(),\n redirectUrl: z.url().optional()\n});\n\n\n\n// ===============================\n// MFA SETUP AND MANAGEMENT\n// ===============================\n\n/\n MFA Setup Request\n /\nexport const MFASetupRequestSchema = z.object({\n method: z.enum(AuthMethod),\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n deviceName: z.string().optional()\n}).refine((data) => AuthUtils.canBeSecondFactor(data.method));\n\n\n/\n MFA Setup Response\n /\nexport const MFASetupResponseSchema = z.object({\n method: z.enum(AuthMethod),\n setupToken: z.string(),\n qrCodeUrl: z.url().optional(),\n secret: z.string().optional(),\n challenge: z.record(z.string(), z.any()).optional(),\n recoveryCodes: z.array(z.string()).optional()\n});\n\n\n\n\n/\n Authentication Session State\n /\n/\n Something an account owes before a parked sign-in may complete (#1374).\n \n `ONBOARDING_PENDING` used to mean exactly one thing — the organization named at onboarding — and could not carry\n * a second. Each member is derived from durable state, has its own step and completion door, and has its own\n * \"can this ever finish?\" answer, so one unfulfillable obligation never strands an account that owes another.\n /\nexport enum OnboardingObligation {\n /* The organization the user type names at onboarding (`pendingOrgType` names its type). /\n ORGANIZATION = 'organization',\n /* The person's first and last name, when the user type collects them at onboarding. /\n PROFILE_NAMES = 'profile_names',\n}\n\nexport enum AuthenticationSessionState {\n // Login flow states\n CREATED = 'CREATED', // Session created, waiting for identification\n IDENTIFIED = 'IDENTIFIED', // User identified, methods available\n FIRST_FACTOR_IN_PROGRESS = 'FIRST_FACTOR_IN_PROGRESS', // First factor authentication in progress\n FIRST_FACTOR_COMPLETED = 'FIRST_FACTOR_COMPLETED', // First factor completed\n MFA_REQUIRED = 'MFA_REQUIRED', // MFA required, waiting for second factor\n SECOND_FACTOR_IN_PROGRESS = 'SECOND_FACTOR_IN_PROGRESS', // Second factor in progress\n COMPLETED = 'COMPLETED', // Authentication completed successfully\n PASSWORD_EXPIRED = 'PASSWORD_EXPIRED', // W2.2: Password expired, must change before token issuance\n\n // W4: Registration pipeline states\n REGISTERED = 'REGISTERED', // Invitation acceptance's correlation session (audit id only); self-registration creates none since #1010\n EMAIL_VERIFIED = 'EMAIL_VERIFIED', // Email confirmed, checking MFA requirements\n MFA_ENROLLMENT_REQUIRED = 'MFA_ENROLLMENT_REQUIRED', // MFA enrollment needed before tokens can be issued\n MFA_ENROLLMENT_GRACE = 'MFA_ENROLLMENT_GRACE', // Within grace period — tokens issued with mfaGraceExpiresAt claim\n ONBOARDING_PENDING = 'ONBOARDING_PENDING', // Auth complete, the organization named at onboarding is still owed — reached by the registration pipeline AND, since #1091, by a login of an account that owes one\n\n // Terminal states\n FAILED = 'FAILED', // Authentication failed\n EXPIRED = 'EXPIRED', // Session expired\n LOCKED = 'LOCKED' // Account locked due to too many attempts\n}\n\n/* W4.2: Session purpose — drives UI rendering and valid state transitions. /\nexport const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);\n\n/\n #1103 — what a FEDERATED sign-in (OAuth2 / OIDC callback, SAML ACS) established about itself, carried on the\n * session it was parked on when the account still owed its organization at onboarding.\n \n A federated sign-in that completes at once records `USER_SSO_LOGIN` with this evidence on the spot. A parked\n * one signs nobody in yet, so the record waits for the onboarding completion that does — and without this object\n * that completion could only record a generic login, losing which provider and connection proved the identity\n * and the provider MFA assurance verdict (a `WARNED` verdict exists nowhere else once the callback has returned).\n * The auth source is not stored: it follows from the proved factor (`ORG_SAML` is SAML, the other federated\n * methods are OIDC).\n /\nexport const FederatedSignInEvidenceSchema = z.object({\n providerRef: z.string().min(1),\n connectionType: z.enum(SsoConnectionType),\n /* The connection's scope, for an enterprise connection. /\n scopeType: z.enum(AuthScopeType).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n /* The provider MFA assurance verdict the callback assessed. Absent where no assessment runs (SAML). /\n assurance: ExternalAssuranceAssessmentSchema.optional(),\n});\nexport type FederatedSignInEvidence = z.infer<typeof FederatedSignInEvidenceSchema>;\n\n/\n Authentication Session Schema\n * Tracks the complete state of an authentication session\n /\nexport const AuthenticationSessionSchema = z.object({\n sessionId: z.string(),\n state: z.enum(AuthenticationSessionState),\n\n // User identification\n email: z.email().optional(),\n userExists: z.boolean().optional(),\n userId: z.string().optional(),\n /* Trusted organization created transactionally by deferred registration onboarding. /\n organizationId: z.string().optional(),\n /\n Untrusted DNS-verified email-domain ownership hint used only to tighten SSO policy.\n * It is deliberately distinct from `organizationId`, which has trusted onboarding provenance.\n /\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n\n /* W3.5: Resolved user type for this session (from X-Frontend-Service-Name → frontendServices → userType). Drives per-user-type auth policy. /\n activeUserType: z.string().optional(),\n\n /* W4.2: Session purpose — determines valid state transitions and frontend UI. /\n purpose: AuthSessionPurposeSchema.optional(),\n\n /* W4: Next step hint for frontend routing after state transitions. /\n nextStep: z.enum(AuthNextStep).optional(),\n\n /* W4.5: ISO date when MFA grace period expires. Present when state is MFA_ENROLLMENT_GRACE. /\n mfaGraceExpiresAt: z.string().optional(),\n\n /* W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. /\n pendingOrgType: z.string().optional(),\n\n /\n Every obligation still owed before this parked session may sign in (#1374). Present on an\n * `ONBOARDING_PENDING` session; each member is discharged by its own completion door, and the session\n * mints only once none remain. Re-derived from durable state at every parking and after every\n * completion, so it is a projection, never the record.\n /\n pendingObligations: z.array(z.enum(OnboardingObligation)).optional(),\n\n /* #1103: the federated sign-in this session was parked for — recorded as its USER_SSO_LOGIN when onboarding completes. /\n federatedSignIn: FederatedSignInEvidenceSchema.optional(),\n\n /* W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). /\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),\n\n // Authentication flow state\n completedFactors: z.array(z.enum(AuthMethod)).default([]),\n /\n Whether the authenticator LOCALLY VERIFIED the person in this session's passkey ceremony (#1248).\n \n Persisted because it is the difference between a passkey that proved one factor and one that\n * proved two, and nothing else on the session records it — `completedFactors` says PASSKEY either\n * way. The MFA decision reads the flag transiently at sign-in; an ID token is minted long\n * afterwards, from the session, so without this the token could not carry the distinction its own\n * acceptance asks for.\n \n Absent means no passkey ceremony completed on this session, or one completed without user\n * verification. Those are deliberately not distinguished: neither proves the activation, and a\n * relying party reading `amr` needs to know only whether it happened.\n /\n passkeyUserVerified: z.boolean().optional(),\n currentFactor: z.enum(AuthFactorLevel).optional(),\n\n // Available methods\n availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),\n availableSecondFactorMethods: z.array(AvailableMethodSchema).default([]),\n\n // MFA requirements\n requiresMFA: z.boolean().default(false),\n mfaMethodsRequired: z.number().default(1),\n /\n What the user has ENROLLED — factors that took a deliberate setup act. *Empty means nothing is\n set up*, and that is the question this field answers; ask `usableSecondFactorMethods` instead\n for \"can a challenge run\".\n \n It used to carry `AuthMethod.EMAIL_OTP` unconditionally, so it was never empty and could not\n * answer its own question. Callers that branch on \"has this user got a second factor\" must read\n * this; callers that branch on \"is there a challenge to render\" must not.\n /\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /\n Intersection of `availableSecondFactorMethods` (what the policy accepts) with what the user can\n * PRESENT — enrolled ∪ the factors that need no enrollment. Not an intersection with\n * `enrolledSecondFactorMethods`, which this said until the two concepts were separated: a user\n * whose only accepted factor is email OTP has enrolled nothing and can still complete a challenge.\n \n This is the field every \"where do I send this user\" decision reads.\n /\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /\n When true, the factors that need no enrollment are excluded from the accepted set — see\n * `AuthUtils.getAlwaysAvailableSecondFactorMethods()`, which is the one place that list lives.\n * (Today that is `EMAIL_OTP`; this doc named the complement by hand and would have gone stale the\n * day a second such factor appeared.)\n /\n requireStrongMFA: z.boolean().default(false),\n\n // Session metadata\n createdAt: z.date(),\n expiresAt: z.date(),\n lastActivity: z.date(),\n\n // Security tracking\n attempts: z.number().default(0),\n maxAttempts: z.number().default(5),\n lockoutUntil: z.date().optional(),\n\n // Device and context\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional(),\n\n // Integration requests\n requestedIntegrations: z.array(z.string()).default([]),\n\n // Session-specific data for ongoing flows\n challengeData: z.record(z.string(), z.any()).optional(),\n pendingRedirectUrl: z.url().optional(),\n\n // Organization branding (cached for consistent UI)\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n // The organization's own tab icon (#1799). No application fallback: the application's icon is\n // already the page's, so an absent value leaves it in place.\n faviconUrl: z.string().optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // M1: Optimistic concurrency control version for atomic session updates\n version: z.number().default(0),\n}).superRefine((session, ctx) => {\n if ((session.scopeType === undefined) !== (session.scopeId === undefined)) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Authentication session scopeType and scopeId must be provided together',\n });\n }\n});\n\n\n\n// ===============================\n// SIMPLIFIED FORM DTOs\n// ===============================\n// Used by frontend Form components and backend body parsing.\n// These are the \"what the user fills in\" schemas — services add\n// programmatic fields (sessionId, method, factorLevel) before API calls.\n\n/\n Identify step form DTO — user enters email to discover auth methods.\n * Used by the public auth page's first step.\n /\n/\n The sign-in identification form.\n \n The email field renders `autocomplete=\"username webauthn\"`: `webauthn` is what lets the browser offer\n * the person's passkeys for this site in the field's autofill list (conditional mediation), so they can\n * sign in by picking an account instead of typing an email and choosing a method.\n \n spec-cite: https://web.dev/articles/passkey-form-autofill — the username input requires `autocomplete=\"username webauthn\"`: \"Include both `username` and `webauthn` as space-separated values.\"\n /\nexport const AuthIdentifyFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME, autoCompleteModifier: AutocompleteModifier.WEBAUTHN },\n }),\n});\n\n\n\n\n/\n Login step form DTO — user enters email + password.\n * Used by the public auth page when password auth is shown.\n * The .isPassword() decorator tells FormField to render a password input.\n /\nexport const AuthLoginFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n }),\n password: z.string().min(1).isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.CURRENT_PASSWORD },\n }),\n});\n\nfunction withOneTimeCodeAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.ONE_TIME_CODE },\n }) as TSchema;\n}\n\nfunction withTelAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.TEL },\n }) as TSchema;\n}\n\n/\n MFA email OTP challenge form DTO.\n * Used by the MFA challenge screen after the email code has been sent.\n /\nexport const EmailOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA SMS OTP challenge form DTO.\n * Used by the MFA challenge screen after the SMS code has been sent.\n /\nexport const SmsOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA TOTP challenge form DTO.\n * Used by the MFA challenge screen for authenticator-app verification.\n /\nexport const TotpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n Phone enrollment start form DTO.\n * Used by the enrollment gate before sending a phone verification code.\n /\nexport const PhoneEnrollmentStartFormDtoSchema = z.object({\n phoneNumber: withTelAutocomplete(z.string().min(1)),\n});\n\n/\n Phone enrollment verification form DTO.\n * Used by the enrollment gate after a verification code has been sent.\n /\nexport const PhoneEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n TOTP enrollment verification form DTO.\n * Used after the user scans the QR code and confirms setup with a first code.\n /\nexport const TotpEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n\n\n\n/\n `POST /auth/token/exchange` — the answer when the one-time code parked a FEDERATED sign-in at organization\n * onboarding instead of signing it in (#1103).\n \n An OAuth2 / OIDC callback or a SAML ACS for an account that still owes its organization (#1091) opens an\n * authentication session at `ONBOARDING_PENDING` and puts THAT in the exchange code rather than tokens. Redeeming\n * the code answers with the session to complete on the organization-onboarding step, and nothing else: no access\n * token, and no refresh cookie. Deliberately a SEPARATE schema from `TokenExchangeResponseSchema`, whose strict\n * signed-in shape the docs site also parses: a handoff code redeemed there can never be parked, and widening that\n * shape would make every receiver narrow for a case only the SaaS frontend meets.\n /\nexport const TokenExchangeOrganizationOnboardingResponseSchema = z.strictObject({\n nextStep: z.literal(AuthNextStep.ONBOARDING),\n sessionId: z.string().min(1),\n});\n\nexport type TokenExchangeOrganizationOnboardingResponse = z.infer<typeof TokenExchangeOrganizationOnboardingResponseSchema>;\n\n/\n One-off session token exchange response.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string()` which was emitted in the JSON body. The\n * cookie migration (A-Step 2) routed the refresh token to\n * `Set-Cookie: __wildo_refresh=…`; A-Step 6 removes the body field\n * entirely so a one-off-session client receives ONLY a (short-lived)\n * access token + the cookie. The controller's\n * `_jsonSuccessWithRefreshCookie` helper sets the cookie from a\n * separately-passed argument.\n /\nexport const OneOffTokenExchangeResponseSchema = z.object({\n accessToken: z.string(),\n sessionType: z.enum(SessionType),\n consumableTokenValue: z.string().optional(),\n tokenExpiresAt: z.string().optional(),\n context: z.object({\n tokenId: z.string(),\n tokenType: z.string(),\n targeting: z.object({\n initiatorIds: z.record(z.string(), z.string()).optional(),\n }).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n userId: z.string(),\n }),\n});\n\n// Cross-frontend handoff DTO atoms (cross-app-jwt-propagation Step 2) live\n// in `./cross-frontend-handoff.shared.dto.schemas` so a browser-safe subpath\n// (`@wildo-ai/saas-models/public-runtime`) can re-export them without\n// dragging this file's full transitive web (UserContext, SessionType,\n// AuthMethod, AuthFactorLevel, AuthSessionPurpose, AuthUtils,\n// `@wildo-ai/zod-decorators`). See saas-models-public-runtime.md K-2.\nexport from './cross-frontend-handoff.shared.dto.schemas';\n\n// ===============================\n// INFERRED TYPES\n// ===============================\n\n// Authentication method types\nexport type AuthIdentificationRequest = z.infer<typeof AuthIdentificationRequestSchema>;\nexport type AuthIdentificationResponse = z.infer<typeof AuthIdentificationResponseSchema>;\n\n\n\n// Authentication request types\nexport type AuthenticationRequest = z.infer<typeof AuthenticationRequestSchema>;\nexport type AuthenticationResponse = z.infer<typeof AuthenticationResponseSchema>;\nexport type PasswordAuthRequest = z.infer<typeof PasswordAuthRequestSchema>;\nexport type External_OAuth2_AuthRequest = z.infer<typeof External_OAuth2_AuthRequestSchema>;\nexport type OrganizationSSOAuthRequest = z.infer<typeof OrganizationSSOAuthRequestSchema>;\nexport type OAuth2Callback = z.infer<typeof OAuth2CallbackSchema>;\nexport type TOTPAuthRequest = z.infer<typeof TOTPAuthRequestSchema>;\nexport type SMSOTPAuthRequest = z.infer<typeof SMSOTPAuthRequestSchema>;\nexport type EmailOTPAuthRequest = z.infer<typeof EmailOTPAuthRequestSchema>;\nexport type PasskeyAuthRequest = z.infer<typeof PasskeyAuthRequestSchema>;\n\nexport type MagicLinkSendRequest = z.infer<typeof MagicLinkSendRequestSchema>;\nexport type MagicLinkVerifyRequest = z.infer<typeof MagicLinkVerifyRequestSchema>;\n\nexport type PhoneVerifySendRequest = z.infer<typeof PhoneVerifySendRequestSchema>;\nexport type PhoneVerifyConfirmRequest = z.infer<typeof PhoneVerifyConfirmRequestSchema>;\n\n// MFA types\nexport type MFASetupRequest = z.infer<typeof MFASetupRequestSchema>;\nexport type MFASetupResponse = z.infer<typeof MFASetupResponseSchema>;\n\nexport type AuthIdentifyFormDto = z.infer<typeof AuthIdentifyFormDtoSchema>;\nexport type AuthLoginFormDto = z.infer<typeof AuthLoginFormDtoSchema>;\nexport type EmailOtpChallengeFormDto = z.infer<typeof EmailOtpChallengeFormDtoSchema>;\nexport type SmsOtpChallengeFormDto = z.infer<typeof SmsOtpChallengeFormDtoSchema>;\nexport type TotpChallengeFormDto = z.infer<typeof TotpChallengeFormDtoSchema>;\nexport type PhoneEnrollmentStartFormDto = z.infer<typeof PhoneEnrollmentStartFormDtoSchema>;\nexport type PhoneEnrollmentVerifyFormDto = z.infer<typeof PhoneEnrollmentVerifyFormDtoSchema>;\nexport type TotpEnrollmentVerifyFormDto = z.infer<typeof TotpEnrollmentVerifyFormDtoSchema>;\n\n// Session types\nexport type AuthenticationSession = z.infer<typeof AuthenticationSessionSchema>;\nexport type OneOffTokenExchangeResponse = z.infer<typeof OneOffTokenExchangeResponseSchema>;\n"]}
1	+ {"version":3,"file":"authentication.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iCAAiC,EAAE,MAAM,2EAA2E,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAE/G;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,0HAA0H;IAC1H,yCAAa,CAAA;IACb,sHAAsH;IACtH,uCAAW,CAAA;IACX,8TAA8T;IAC9T,yCAAa,CAAA;AACf,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,oFAAoF;IACpF,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE;IACvB,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,2FAA2F;IAC3F,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3D,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,cAAc,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IAEvB,gDAAgD;IAChD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAClD,wBAAwB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEvD,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzC,oCAAoC;IACpC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,8FAA8F;QAC9F,6DAA6D;QAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,4DAA4D;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,+CAA+C;QAC/E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChB,CAAC,CAAC;AAIH,kCAAkC;AAClC,iCAAiC;AACjC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC,wCAAwC;IACxC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iCAAiC;IACxE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,kBAAkB;IAEhD,kCAAkC;IAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qCAAqC;IACxF,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,mCAAmC;CAC5F,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,oBAAoB;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qBAAqB;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CACjD,CAAC,CAAC;AAIH;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;YAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC,CAAC;QACF,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC9B,CAAC;CACH,CAAC,CAAC;AAIH,kCAAkC;AAClC,gCAAgC;AAChC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,gCAAgC,IAAI,wBAAwB,CAAC,KAAK,CAAC;QAC/G,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAKH,kCAAkC;AAClC,wCAAwC;AACxC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACpD,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;CACpC,CAAC,CAAC;AAKH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,yBAAyB;IACzB,iCAAiC;IACjC,gCAAgC;IAChC,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IAEzC,sEAAsE;IACtE,oEAAoE;IACpE,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEnC,uDAAuD;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEf,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IACzC,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9E,iBAAiB;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;;;;OAOG;IACH,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,uBAAuB;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,kCAAkC;AAClC,2BAA2B;AAC3B,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAG9D;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAKH;;GAEG;AACH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,4FAA4F;IAC5F,qDAA6B,CAAA;IAC7B,wFAAwF;IACxF,uDAA+B,CAAA;AACjC,CAAC,EALW,oBAAoB,KAApB,oBAAoB,QAK/B;AAED,MAAM,CAAN,IAAY,0BAsBX;AAtBD,WAAY,0BAA0B;IACpC,oBAAoB;IACpB,iDAAmB,CAAA;IACnB,uDAAyB,CAAA;IACzB,mFAAqD,CAAA;IACrD,+EAAiD,CAAA;IACjD,2DAA6B,CAAA;IAC7B,qFAAuD,CAAA;IACvD,qDAAuB,CAAA;IACvB,mEAAqC,CAAA;IAErC,mCAAmC;IACnC,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,iFAAmD,CAAA;IACnD,2EAA6C,CAAA;IAC7C,uEAAyC,CAAA;IAEzC,kBAAkB;IAClB,+CAAiB,CAAA;IACjB,iDAAmB,CAAA;IACnB,+CAAiB,CAAA,CAA8B,0CAA0C;AAC3F,CAAC,EAtBW,0BAA0B,KAA1B,0BAA0B,QAsBrC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACzC,4DAA4D;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,wGAAwG;IACxG,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAEzC,sBAAsB;IACtB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,gJAAgJ;IAChJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,kFAAkF;IAClF,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE5C,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAEzC,gGAAgG;IAChG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEpE,2HAA2H;IAC3H,eAAe,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAEzD,wHAAwH;IACxH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEnE,4BAA4B;IAC5B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAEjD,oBAAoB;IACpB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAExE,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE5C,mBAAmB;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IAEtB,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,mDAAmD;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7B,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACzC,8FAA8F;QAC9F,6DAA6D;QAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CAAC,QAAQ,EAAE;IAEb,wEAAwE;IACxE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,kCAAkC;AAClC,uBAAuB;AACvB,kCAAkC;AAClC,6DAA6D;AAC7D,gEAAgE;AAChE,yEAAyE;AAEzE;;;GAGG;AACH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;KAClH,CAAC;CACH,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,QAAQ,EAAE;KAC7D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,gBAAgB,EAAE;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAA+B,MAAe;IAChF,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,aAAa,EAAE;KAClE,CAAY,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAA+B,MAAe;IACxE,OAAQ,MAAc,CAAC,QAAQ,CAAC;QAC9B,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,GAAG,EAAE;KACxD,CAAY,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,2BAA2B,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAChE;CACF,CAAC,CAAC;AAKH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAChC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC1D,CAAC,CAAC,QAAQ,EAAE;QACb,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACH,CAAC,CAAC;AAEH,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,sEAAsE;AACtE,cAAc,6CAA6C,CAAC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\nimport { UserContextSchema } from '../../users/users.shared.schemas';\nimport {\n AuthMethod,\n AuthFactorLevel,\n AuthNextStep,\n AuthSessionPurpose,\n AuthScopeType,\n AvailableMethodSchema,\n SsoConnectionType,\n} from './authentication.shared.schemas';\nimport { ExternalAssuranceAssessmentSchema } from '../../external-providers/provider-authentication-assurance.shared.schemas';\nimport { AuthUtils } from './authentication.shared.utils';\nimport { isSameOriginRedirectPath } from './same-origin-redirect-path.shared';\nimport { SessionType } from '../../runtime/execution-context.shared.schemas';\nimport { PasswordPolicyRulesSchema } from '../../config/app-configuration-shared.shared.schemas';\nimport { AutocompleteFieldIdentifier, ZodTypeForColors, AutocompleteModifier } from '@wildo-ai/zod-decorators';\n\n/\n Invitation-accept discovery — how a PUBLIC invitation-accept screen learns,\n * from the invitation token alone, which first-factor auth methods the target\n * organization allows and whether the org is SSO/SCIM-managed.\n \n Distinct from `identify()` (keyed by email→domain, requires an existing user):\n * this is token-keyed and works for a not-yet-activated invitee (INVITED\n * membership, no session). Populated by `GET /auth/invitation/info?token=…`,\n * which reads the token WITHOUT consuming it (unlike accept). See\n * `.claude/plans/invitation-multi-method-auth.md`.\n /\nexport enum InvitationManagementMode {\n /* No enterprise identity authority — invitee may set a local credential (password/passkey) or use any allowed method. /\n OPEN = 'open',\n /* Org authenticates via enterprise SSO — route the invitee to the IdP (JIT consumes the invite; no local accept). /\n SSO = 'sso',\n /* Org is ACTIVELY directory-managed (SCIM live — DIRECTORY_PROVISIONING feature + a live SCIM token) — informational only, NO local credential: a local password/passkey/magic-link would survive IdP deprovisioning. Derived per-org (not from the org-TYPE mount flag) — see `isOrgActivelyDirectoryManaged` / AUTH-23. /\n SCIM = 'scim',\n}\n\nexport const AuthInvitationInfoResponseSchema = z.object({\n /* The invitee's email (from the INVITED membership's denormalized `userEmail`). /\n inviteeEmail: z.email(),\n /* Display name of the organization the invitee is joining. /\n organizationName: z.string(),\n /* First-factor methods the org allows for a joining member of the invitee's user type. /\n availableFirstFactorMethods: z.array(AvailableMethodSchema),\n /* Identity-management posture — drives chooser (open/sso) vs informational state (scim). /\n managementMode: z.enum(InvitationManagementMode),\n /\n The org-join user type's ORG-MERGED password policy (the SAME policy the accept\n * endpoint validates against). Lets the chooser's PASSWORD form show the invitee the\n * org's REAL requirements (strength indicator + client pre-check) instead of the\n * app-level default — so an org that strengthens `passwordPolicy` via `authOverrides`\n * doesn't reject a client-accepted password after submit. Absent when the policy can't\n * be resolved (unknown user type / degraded org read); the frontend then falls back to\n * the app-level resolved policy. Structurally the frontend validation subset\n * (`PasswordPolicyRulesSchema`); the backend's `PasswordPolicyConfig` is field-identical\n * and parses through it losslessly.\n /\n passwordPolicy: PasswordPolicyRulesSchema.optional(),\n});\nexport type AuthInvitationInfoResponse = z.infer<typeof AuthInvitationInfoResponseSchema>;\n\n/\n Step 1: User identification by email\n * Returns available authentication methods for the user\n /\nexport const AuthIdentificationRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional()\n});\n\n\n\n/\n Step 1 Response: Available authentication methods with factor classification\n /\nexport const AuthIdentificationResponseSchema = z.object({\n sessionId: z.string(),\n email: z.email(),\n userExists: z.boolean(),\n\n // First factor methods (primary authentication)\n firstFactorMethods: z.array(AvailableMethodSchema),\n defaultFirstFactorMethod: z.enum(AuthMethod).optional(),\n\n // Second factor methods (MFA) - only shown if MFA is required\n secondFactorMethods: z.array(AvailableMethodSchema),\n requiresMFA: z.boolean(),\n mfaMethodsRequired: z.number().default(1),\n\n // Organization-specific information\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n // The organization's own tab icon (#1799). No application fallback: the application's icon is\n // already the page's, so an absent value leaves it in place.\n faviconUrl: z.string().optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // Available integrations (if any auth method supports them)\n availableIntegrations: z.array(z.object({\n integrationId: z.string(),\n externalProviderId: z.string(), // Which auth provider enables this integration\n iconUrl: z.url().optional()\n })).default([]),\n});\n\n\n\n// ===============================\n// AUTHENTICATION REQUEST SCHEMAS\n// ===============================\n\n/\n Base authentication request schema with factor context\n /\nexport const BaseAuthRequestSchema = z.object({\n sessionId: z.string().min(1),\n method: z.enum(AuthMethod),\n factorLevel: z.enum(AuthFactorLevel),\n rememberMe: z.boolean().default(false),\n\n // Integration access request (optional)\n requestedIntegrations: z.array(z.string()).default([])\n});\n\n\n\n/\n Password Authentication (First factor only)\n /\nexport const PasswordAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSWORD),\n factorLevel: z.literal(AuthFactorLevel.FIRST),\n password: z.string().min(1)\n});\n\n\n\n/\n Third-Party OAuth2 Authentication (First factor, extensible)\n /\nexport const External_OAuth2_AuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EXTERNAL_OAUTH2),\n factorLevel: z.enum(AuthFactorLevel),\n externalProviderId: z.string().min(1), // References configured provider\n redirectUri: z.url(),\n state: z.string().optional(), // CSRF protection\n\n // Integration-specific parameters\n additionalScopes: z.array(z.string()).default([]), // Additional scopes for integrations\n integrationPermissions: z.array(z.string()).default([]) // Specific integration permissions\n});\n\n\n\n/\n Organization SSO Authentication (First or second factor, organization-restricted)\n /\nexport const OrganizationSSOAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.enum([AuthMethod.ORG_SAML, AuthMethod.ORG_OPENID_CONNECT]),\n factorLevel: z.enum(AuthFactorLevel),\n ssoId: z.string().min(1),\n organizationId: z.string().min(1),\n\n // SSO-specific data\n samlResponse: z.string().optional(), // For SAML\n idToken: z.string().optional(), // For OpenID Connect\n state: z.string().optional()\n});\n\n\n\n/\n OAuth2 Callback Schema (for both third-party and SSO)\n /\nexport const OAuth2CallbackSchema = z.object({\n sessionId: z.string().min(1),\n externalProviderId: z.string().optional(), // For third-party OAuth2\n ssoId: z.string().optional(), // For organization SSO\n code: z.string().min(1),\n state: z.string().optional(),\n error: z.string().optional(),\n errorDescription: z.string().optional()\n});\n\n\n\n/\n TOTP Authentication (Second factor only)\n /\nexport const TOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.TOTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^(\\d{6}\|[a-f0-9]{8})$/)\n});\n\n\n\n/\n SMS OTP Authentication (First or second factor)\n /\n/\n Verifying an SMS one-time code.\n \n There is deliberately NO `phoneNumber` here. One was accepted — optional, E.164-shaped — and read\n * by nothing: the code is matched by the session's account and the session id, and the destination\n * was always resolved from the account. Its only effect was that the value a CALLER supplied was\n * written into both audit rows as though it were the number the code went to, so a caller could\n * attribute their own attempts to a number that was never involved. An audit trail whose subject\n * chooses what it says about them is not attributable.\n \n No first-party client ever sent it — the engine's own `SmsOtpAuthMethod` calls\n * `handleMfaVerify(sessionId, method, code)` — so removing it takes nothing away from a caller.\n /\nexport const SMSOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.SMS_OTP),\n factorLevel: z.union([z.literal(AuthFactorLevel.FIRST), z.literal(AuthFactorLevel.SECOND)]),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Email OTP Authentication (Second factor only)\n /\nexport const EmailOTPAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.EMAIL_OTP),\n factorLevel: z.literal(AuthFactorLevel.SECOND),\n token: z.string().regex(/^\\d{4,8}$/).optional()\n});\n\n\n\n/\n Passkey (WebAuthn) Authentication (First or second factor)\n /\nexport const PasskeyAuthRequestSchema = BaseAuthRequestSchema.extend({\n method: z.literal(AuthMethod.PASSKEY),\n factorLevel: z.enum(AuthFactorLevel),\n // WebAuthn authentication response from navigator.credentials.get()\n response: z.object({\n id: z.string(),\n rawId: z.string(),\n response: z.object({\n authenticatorData: z.string(),\n clientDataJSON: z.string(),\n signature: z.string(),\n userHandle: z.string().optional(),\n }),\n authenticatorAttachment: z.string().optional(),\n clientExtensionResults: z.record(z.string(), z.any()).default({}),\n type: z.literal('public-key'),\n }),\n});\n\n\n\n// ===============================\n// MAGIC LINK SCHEMAS (Phase G2)\n// ===============================\n\n/\n The longest deep link an emailed sign-in link carries. A longer same-origin path is dropped, not refused.\n /\nexport const MAX_CARRIED_AUTH_REDIRECT_LENGTH = 2048;\n\n/\n Decide whether a request's post-auth deep link rides an emailed sign-in link (#1014) — shared by the\n * magic-link send, the invitation accept and password-less registration (#1086), the requests that email one.\n \n Kept only when it is a same-origin path by {@link isSameOriginRedirectPath} (the one predicate every\n * auth redirect answers through) and no longer than {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}; otherwise\n * `undefined`. An absolute or foreign value would turn a trusted application email into an open redirect\n * that fires right after the person proves who they are. Dropping rather than a 400 — for the length too —\n * keeps the request's answer identical for every redirect (the send's anti-enumeration contract), and a\n * person whose redirect was dropped still signs in, at the application home.\n /\nexport function carriedAuthRedirect(value: string \| undefined): string \| undefined {\n return value !== undefined && value.length <= MAX_CARRIED_AUTH_REDIRECT_LENGTH && isSameOriginRedirectPath(value)\n ? value\n : undefined;\n}\n\n/\n Magic Link Send Request — triggers a magic link email to the user.\n * Separate from the main AuthenticationRequestSchema because it doesn't\n * go through the standard authenticate() dispatch.\n /\nexport const MagicLinkSendRequestSchema = z.object({\n email: z.email().toLowerCase(),\n organizationId: z.string().optional(),\n /\n The deep link the person asked for a magic link from (`/login?redirect=/deals/42`), carried into the\n * emailed URL so signing in lands there, including through an MFA detour (#1014).\n \n {@link carriedAuthRedirect} decides it: kept only when it is a same-origin path no longer than\n * {@link MAX_CARRIED_AUTH_REDIRECT_LENGTH}, otherwise DROPPED — never refused.\n /\n redirect: z.string().optional().transform(carriedAuthRedirect),\n});\n\n\n\n\n/\n Magic Link Verify Request — verifies the token from the magic link.\n * Used by POST /auth/magic-link/verify for programmatic verification.\n * Intentionally NOT added to AuthenticationRequestSchema discriminated union\n * because magic link verification follows a separate flow (GET from email click\n * → exchange code → POST verify).\n /\nexport const MagicLinkVerifyRequestSchema = z.object({\n token: z.string().min(1),\n email: z.email().toLowerCase(),\n});\n\n\n\n\n// ===============================\n// PHONE VERIFICATION SCHEMAS (Phase G2)\n// ===============================\n\n/\n Phone Verification Send Request — triggers a verification code to a phone number.\n * Used for phone number ownership verification, separate from SMS OTP auth.\n /\nexport const PhoneVerifySendRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n});\n\n\n\n\n/\n Phone Verification Confirm Request — confirms the verification code.\n /\nexport const PhoneVerifyConfirmRequestSchema = z.object({\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/),\n code: z.string().regex(/^\\d{4,8}$/),\n});\n\n\n\n\n/\n Union of all authentication request types\n /\nexport const AuthenticationRequestSchema = z.discriminatedUnion('method', [\n PasswordAuthRequestSchema,\n External_OAuth2_AuthRequestSchema,\n OrganizationSSOAuthRequestSchema,\n TOTPAuthRequestSchema,\n SMSOTPAuthRequestSchema,\n EmailOTPAuthRequestSchema,\n PasskeyAuthRequestSchema\n]);\n\n\n\n/\n Authentication Response Schema with Factor Context and Integration Access.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string().optional()` which was emitted in the JSON\n * body for every authentication response. The cookie migration (A-Step 2,\n * 2026-04-13) added `Set-Cookie: __wildo_refresh=…` as a parallel\n * channel; A-Step 3 (2026-04-13) made the SaaS-frontend stop reading\n * the body field; A-Step 6 (THIS step) DROPS the body field entirely\n * so the wire response physically cannot carry the refresh token.\n \n Backend internals: the orchestrator's\n * `_buildAuthenticationSuccessMethod` returns\n * `AuthenticationServiceResult = AuthenticationResponse & { refreshToken?: string }`\n * (a backend-only TS type — NOT a wire schema) so the controller can\n * extract the refresh-token value and pass it explicitly to\n * `_jsonSuccessWithRefreshCookie(res, body, refreshToken)`. The wire\n * payload (this schema) STILL has no `refreshToken` field — the\n * controller's helper sets the cookie and emits the body separately.\n \n `integrationTokens[].refreshToken` (below) is a third-party-IdP\n * OAuth2 refresh token (Google, Microsoft, etc.) — NOT a Wildo refresh\n * token. It stays on the wire because the frontend needs it to drive\n * IdP-side API calls; it is bound to a different security model\n * (IdP-issued, IdP-rotated, never used to mint Wildo JWTs).\n /\nexport const AuthenticationResponseSchema = z.object({\n success: z.boolean(),\n sessionId: z.string(),\n userExists: z.boolean(),\n factorLevel: z.enum(AuthFactorLevel),\n authMethod: z.enum(AuthMethod).optional(),\n\n // Success response. NOTE: `refreshToken` deliberately ABSENT from the\n // wire schema (Auth-hardening A-Step 6) — see the file/schema-level\n // JSDoc above for the cookie-only contract.\n accessToken: z.string().optional(),\n expiresIn: z.number().optional(),\n user: UserContextSchema.optional(),\n\n // Integration access tokens (if requested and granted)\n integrationTokens: z.array(z.object({\n integrationId: z.string(),\n accessToken: z.string(),\n refreshToken: z.string().optional(),\n expiresIn: z.number().optional(),\n scopes: z.array(z.string())\n })).default([]),\n\n // MFA continuation\n requiresMFA: z.boolean().default(false),\n availableMFAMethods: z.array(AvailableMethodSchema).optional(),\n mfaMethodsRequired: z.number().optional(),\n completedFactors: z.array(z.enum(AuthMethod)).optional(),\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // W4.5: MFA enrollment routing\n nextStep: z.enum(AuthNextStep).optional(),\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).optional().default([]),\n\n // Error response\n error: z.string().optional(),\n errorCode: z.string().optional(),\n retryAllowed: z.boolean().default(true),\n remainingAttempts: z.number().optional(),\n lockoutUntil: z.date().optional(),\n /\n PASSKEY only: the relying party holds no credential with the presented id for the account the\n * assertion names (also answered when that account does not exist, so it discloses nothing).\n \n The one passkey refusal a client should act on: it may call\n * `PublicKeyCredential.signalUnknownCredential({ rpId, credentialId })` so the browser stops offering a\n * passkey this application deleted. Never set for a signature, user-verification or counter refusal.\n /\n passkeyCredentialUnknown: z.boolean().optional(),\n\n // Method-specific data\n challengeData: z.record(z.string(), z.any()).optional(),\n redirectUrl: z.url().optional()\n});\n\n\n\n// ===============================\n// MFA SETUP AND MANAGEMENT\n// ===============================\n\n/\n MFA Setup Request\n /\nexport const MFASetupRequestSchema = z.object({\n method: z.enum(AuthMethod),\n phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional(),\n deviceName: z.string().optional()\n}).refine((data) => AuthUtils.canBeSecondFactor(data.method));\n\n\n/\n MFA Setup Response\n /\nexport const MFASetupResponseSchema = z.object({\n method: z.enum(AuthMethod),\n setupToken: z.string(),\n qrCodeUrl: z.url().optional(),\n secret: z.string().optional(),\n challenge: z.record(z.string(), z.any()).optional(),\n recoveryCodes: z.array(z.string()).optional()\n});\n\n\n\n\n/\n Authentication Session State\n /\n/\n Something an account owes before a parked sign-in may complete (#1374).\n \n `ONBOARDING_PENDING` used to mean exactly one thing — the organization named at onboarding — and could not carry\n * a second. Each member is derived from durable state, has its own step and completion door, and has its own\n * \"can this ever finish?\" answer, so one unfulfillable obligation never strands an account that owes another.\n /\nexport enum OnboardingObligation {\n /* The organization the user type names at onboarding (`pendingOrgType` names its type). /\n ORGANIZATION = 'organization',\n /* The person's first and last name, when the user type collects them at onboarding. /\n PROFILE_NAMES = 'profile_names',\n}\n\nexport enum AuthenticationSessionState {\n // Login flow states\n CREATED = 'CREATED', // Session created, waiting for identification\n IDENTIFIED = 'IDENTIFIED', // User identified, methods available\n FIRST_FACTOR_IN_PROGRESS = 'FIRST_FACTOR_IN_PROGRESS', // First factor authentication in progress\n FIRST_FACTOR_COMPLETED = 'FIRST_FACTOR_COMPLETED', // First factor completed\n MFA_REQUIRED = 'MFA_REQUIRED', // MFA required, waiting for second factor\n SECOND_FACTOR_IN_PROGRESS = 'SECOND_FACTOR_IN_PROGRESS', // Second factor in progress\n COMPLETED = 'COMPLETED', // Authentication completed successfully\n PASSWORD_EXPIRED = 'PASSWORD_EXPIRED', // W2.2: Password expired, must change before token issuance\n\n // W4: Registration pipeline states\n REGISTERED = 'REGISTERED', // Invitation acceptance's correlation session (audit id only); self-registration creates none since #1010\n EMAIL_VERIFIED = 'EMAIL_VERIFIED', // Email confirmed, checking MFA requirements\n MFA_ENROLLMENT_REQUIRED = 'MFA_ENROLLMENT_REQUIRED', // MFA enrollment needed before tokens can be issued\n MFA_ENROLLMENT_GRACE = 'MFA_ENROLLMENT_GRACE', // Within grace period — tokens issued with mfaGraceExpiresAt claim\n ONBOARDING_PENDING = 'ONBOARDING_PENDING', // Auth complete, the organization named at onboarding is still owed — reached by the registration pipeline AND, since #1091, by a login of an account that owes one\n\n // Terminal states\n FAILED = 'FAILED', // Authentication failed\n EXPIRED = 'EXPIRED', // Session expired\n LOCKED = 'LOCKED' // Account locked due to too many attempts\n}\n\n/* W4.2: Session purpose — drives UI rendering and valid state transitions. /\nexport const AuthSessionPurposeSchema = z.enum(AuthSessionPurpose);\n\n/\n #1103 — what a FEDERATED sign-in (OAuth2 / OIDC callback, SAML ACS) established about itself, carried on the\n * session it was parked on when the account still owed its organization at onboarding.\n \n A federated sign-in that completes at once records `USER_SSO_LOGIN` with this evidence on the spot. A parked\n * one signs nobody in yet, so the record waits for the onboarding completion that does — and without this object\n * that completion could only record a generic login, losing which provider and connection proved the identity\n * and the provider MFA assurance verdict (a `WARNED` verdict exists nowhere else once the callback has returned).\n * The auth source is not stored: it follows from the proved factor (`ORG_SAML` is SAML, the other federated\n * methods are OIDC).\n /\nexport const FederatedSignInEvidenceSchema = z.object({\n providerRef: z.string().min(1),\n connectionType: z.enum(SsoConnectionType),\n /* The connection's scope, for an enterprise connection. /\n scopeType: z.enum(AuthScopeType).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n /* The provider MFA assurance verdict the callback assessed. Absent where no assessment runs (SAML). /\n assurance: ExternalAssuranceAssessmentSchema.optional(),\n});\nexport type FederatedSignInEvidence = z.infer<typeof FederatedSignInEvidenceSchema>;\n\n/\n Authentication Session Schema\n * Tracks the complete state of an authentication session\n /\nexport const AuthenticationSessionSchema = z.object({\n sessionId: z.string(),\n state: z.enum(AuthenticationSessionState),\n\n // User identification\n email: z.email().optional(),\n userExists: z.boolean().optional(),\n userId: z.string().optional(),\n /* Trusted organization created transactionally by deferred registration onboarding. /\n organizationId: z.string().optional(),\n /\n Untrusted DNS-verified email-domain ownership hint used only to tighten SSO policy.\n * It is deliberately distinct from `organizationId`, which has trusted onboarding provenance.\n /\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n\n /* W3.5: Resolved user type for this session (from X-Frontend-Service-Name → frontendServices → userType). Drives per-user-type auth policy. /\n activeUserType: z.string().optional(),\n\n /* W4.2: Session purpose — determines valid state transitions and frontend UI. /\n purpose: AuthSessionPurposeSchema.optional(),\n\n /* W4: Next step hint for frontend routing after state transitions. /\n nextStep: z.enum(AuthNextStep).optional(),\n\n /* W4.5: ISO date when MFA grace period expires. Present when state is MFA_ENROLLMENT_GRACE. /\n mfaGraceExpiresAt: z.string().optional(),\n\n /* W5.7: Org type awaiting onboarding name collection. Set when orgNameSource is 'onboarding'. /\n pendingOrgType: z.string().optional(),\n\n /\n Every obligation still owed before this parked session may sign in (#1374). Present on an\n * `ONBOARDING_PENDING` session; each member is discharged by its own completion door, and the session\n * mints only once none remain. Re-derived from durable state at every parking and after every\n * completion, so it is a projection, never the record.\n /\n pendingObligations: z.array(z.enum(OnboardingObligation)).optional(),\n\n /* #1103: the federated sign-in this session was parked for — recorded as its USER_SSO_LOGIN when onboarding completes. /\n federatedSignIn: FederatedSignInEvidenceSchema.optional(),\n\n /* W4.3: Methods available for MFA enrollment (distinct from usableSecondFactorMethods which are for MFA challenge). /\n availableEnrollmentMethods: z.array(z.enum(AuthMethod)).default([]),\n\n // Authentication flow state\n completedFactors: z.array(z.enum(AuthMethod)).default([]),\n /\n Whether the authenticator LOCALLY VERIFIED the person in this session's passkey ceremony (#1248).\n \n Persisted because it is the difference between a passkey that proved one factor and one that\n * proved two, and nothing else on the session records it — `completedFactors` says PASSKEY either\n * way. The MFA decision reads the flag transiently at sign-in; an ID token is minted long\n * afterwards, from the session, so without this the token could not carry the distinction its own\n * acceptance asks for.\n \n Absent means no passkey ceremony completed on this session, or one completed without user\n * verification. Those are deliberately not distinguished: neither proves the activation, and a\n * relying party reading `amr` needs to know only whether it happened.\n /\n passkeyUserVerified: z.boolean().optional(),\n currentFactor: z.enum(AuthFactorLevel).optional(),\n\n // Available methods\n availableFirstFactorMethods: z.array(AvailableMethodSchema).default([]),\n availableSecondFactorMethods: z.array(AvailableMethodSchema).default([]),\n\n // MFA requirements\n requiresMFA: z.boolean().default(false),\n mfaMethodsRequired: z.number().default(1),\n /\n What the user has ENROLLED — factors that took a deliberate setup act. *Empty means nothing is\n set up*, and that is the question this field answers; ask `usableSecondFactorMethods` instead\n for \"can a challenge run\".\n \n It used to carry `AuthMethod.EMAIL_OTP` unconditionally, so it was never empty and could not\n * answer its own question. Callers that branch on \"has this user got a second factor\" must read\n * this; callers that branch on \"is there a challenge to render\" must not.\n /\n enrolledSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /\n Intersection of `availableSecondFactorMethods` (what the policy accepts) with what the user can\n * PRESENT — enrolled ∪ the factors that need no enrollment. Not an intersection with\n * `enrolledSecondFactorMethods`, which this said until the two concepts were separated: a user\n * whose only accepted factor is email OTP has enrolled nothing and can still complete a challenge.\n \n This is the field every \"where do I send this user\" decision reads.\n /\n usableSecondFactorMethods: z.array(z.enum(AuthMethod)).default([]),\n /\n When true, the factors that need no enrollment are excluded from the accepted set — see\n * `AuthUtils.getAlwaysAvailableSecondFactorMethods()`, which is the one place that list lives.\n * (Today that is `EMAIL_OTP`; this doc named the complement by hand and would have gone stale the\n * day a second such factor appeared.)\n /\n requireStrongMFA: z.boolean().default(false),\n\n // Session metadata\n createdAt: z.date(),\n expiresAt: z.date(),\n lastActivity: z.date(),\n\n // Security tracking\n attempts: z.number().default(0),\n maxAttempts: z.number().default(5),\n lockoutUntil: z.date().optional(),\n\n // Device and context\n deviceInfo: z.object({\n userAgent: z.string().optional(),\n ipAddress: z.string().optional(),\n }).optional(),\n\n // Integration requests\n requestedIntegrations: z.array(z.string()).default([]),\n\n // Session-specific data for ongoing flows\n challengeData: z.record(z.string(), z.any()).optional(),\n pendingRedirectUrl: z.url().optional(),\n\n // Organization branding (cached for consistent UI)\n organizationBranding: z.object({\n // Backend-populated from config brandAssets via `resolveBrandLogoUrl`.\n // `z.string()` (not `z.url()`) because a RuntimeBrandAsset.url may be a\n // servable URL OR an app-relative path (e.g. `/favicon.png`).\n logoUrl: z.string().optional(),\n primaryColor: ZodTypeForColors.optional(),\n // The organization's own tab icon (#1799). No application fallback: the application's icon is\n // already the page's, so an absent value leaves it in place.\n faviconUrl: z.string().optional(),\n organizationName: z.string().optional()\n }).optional(),\n\n // M1: Optimistic concurrency control version for atomic session updates\n version: z.number().default(0),\n}).superRefine((session, ctx) => {\n if ((session.scopeType === undefined) !== (session.scopeId === undefined)) {\n ctx.addIssue({\n code: 'custom',\n path: ['scopeType'],\n message: 'Authentication session scopeType and scopeId must be provided together',\n });\n }\n});\n\n\n\n// ===============================\n// SIMPLIFIED FORM DTOs\n// ===============================\n// Used by frontend Form components and backend body parsing.\n// These are the \"what the user fills in\" schemas — services add\n// programmatic fields (sessionId, method, factorLevel) before API calls.\n\n/\n Identify step form DTO — user enters email to discover auth methods.\n * Used by the public auth page's first step.\n /\n/\n The sign-in identification form.\n \n The email field renders `autocomplete=\"username webauthn\"`: `webauthn` is what lets the browser offer\n * the person's passkeys for this site in the field's autofill list (conditional mediation), so they can\n * sign in by picking an account instead of typing an email and choosing a method.\n \n spec-cite: https://web.dev/articles/passkey-form-autofill — the username input requires `autocomplete=\"username webauthn\"`: \"Include both `username` and `webauthn` as space-separated values.\"\n /\nexport const AuthIdentifyFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME, autoCompleteModifier: AutocompleteModifier.WEBAUTHN },\n }),\n});\n\n\n\n\n/\n Login step form DTO — user enters email + password.\n * Used by the public auth page when password auth is shown.\n * The .isPassword() decorator tells FormField to render a password input.\n /\nexport const AuthLoginFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.USERNAME },\n }),\n password: z.string().min(1).isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.CURRENT_PASSWORD },\n }),\n});\n\nfunction withOneTimeCodeAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.ONE_TIME_CODE },\n }) as TSchema;\n}\n\nfunction withTelAutocomplete<TSchema extends z.ZodTypeAny>(schema: TSchema): TSchema {\n return (schema as any).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.TEL },\n }) as TSchema;\n}\n\n/\n MFA email OTP challenge form DTO.\n * Used by the MFA challenge screen after the email code has been sent.\n /\nexport const EmailOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA SMS OTP challenge form DTO.\n * Used by the MFA challenge screen after the SMS code has been sent.\n /\nexport const SmsOtpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(4).max(8).regex(/^\\d+$/).isOtp({ maxLength: 8 }),\n ),\n});\n\n/\n MFA TOTP challenge form DTO.\n * Used by the MFA challenge screen for authenticator-app verification.\n /\nexport const TotpChallengeFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n Phone enrollment start form DTO.\n * Used by the enrollment gate before sending a phone verification code.\n /\nexport const PhoneEnrollmentStartFormDtoSchema = z.object({\n phoneNumber: withTelAutocomplete(z.string().min(1)),\n});\n\n/\n Phone enrollment verification form DTO.\n * Used by the enrollment gate after a verification code has been sent.\n /\nexport const PhoneEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n/\n TOTP enrollment verification form DTO.\n * Used after the user scans the QR code and confirms setup with a first code.\n /\nexport const TotpEnrollmentVerifyFormDtoSchema = z.object({\n code: withOneTimeCodeAutocomplete(\n z.string().min(6).max(6).regex(/^\\d+$/).isOtp({ maxLength: 6 }),\n ),\n});\n\n\n\n\n/\n `POST /auth/token/exchange` — the answer when the one-time code parked a FEDERATED sign-in at organization\n * onboarding instead of signing it in (#1103).\n \n An OAuth2 / OIDC callback or a SAML ACS for an account that still owes its organization (#1091) opens an\n * authentication session at `ONBOARDING_PENDING` and puts THAT in the exchange code rather than tokens. Redeeming\n * the code answers with the session to complete on the organization-onboarding step, and nothing else: no access\n * token, and no refresh cookie. Deliberately a SEPARATE schema from `TokenExchangeResponseSchema`, whose strict\n * signed-in shape the docs site also parses: a handoff code redeemed there can never be parked, and widening that\n * shape would make every receiver narrow for a case only the SaaS frontend meets.\n /\nexport const TokenExchangeOrganizationOnboardingResponseSchema = z.strictObject({\n nextStep: z.literal(AuthNextStep.ONBOARDING),\n sessionId: z.string().min(1),\n});\n\nexport type TokenExchangeOrganizationOnboardingResponse = z.infer<typeof TokenExchangeOrganizationOnboardingResponseSchema>;\n\n/\n One-off session token exchange response.\n \n Wire contract — refresh token is NEVER included (Auth-hardening\n * Slice A Step 6, 2026-04-13). Pre-Slice-A this schema carried\n * `refreshToken: z.string()` which was emitted in the JSON body. The\n * cookie migration (A-Step 2) routed the refresh token to\n * `Set-Cookie: __wildo_refresh=…`; A-Step 6 removes the body field\n * entirely so a one-off-session client receives ONLY a (short-lived)\n * access token + the cookie. The controller's\n * `_jsonSuccessWithRefreshCookie` helper sets the cookie from a\n * separately-passed argument.\n /\nexport const OneOffTokenExchangeResponseSchema = z.object({\n accessToken: z.string(),\n sessionType: z.enum(SessionType),\n consumableTokenValue: z.string().optional(),\n tokenExpiresAt: z.string().optional(),\n context: z.object({\n tokenId: z.string(),\n tokenType: z.string(),\n targeting: z.object({\n initiatorIds: z.record(z.string(), z.string()).optional(),\n }).optional(),\n organizationId: z.string().optional(),\n applicationId: z.string().optional(),\n userId: z.string(),\n }),\n});\n\n// Cross-frontend handoff DTO atoms (cross-app-jwt-propagation Step 2) live\n// in `./cross-frontend-handoff.shared.dto.schemas` so a browser-safe subpath\n// (`@wildo-ai/saas-models/public-runtime`) can re-export them without\n// dragging this file's full transitive web (UserContext, SessionType,\n// AuthMethod, AuthFactorLevel, AuthSessionPurpose, AuthUtils,\n// `@wildo-ai/zod-decorators`). See saas-models-public-runtime.md K-2.\nexport from './cross-frontend-handoff.shared.dto.schemas';\n\n// ===============================\n// INFERRED TYPES\n// ===============================\n\n// Authentication method types\nexport type AuthIdentificationRequest = z.infer<typeof AuthIdentificationRequestSchema>;\nexport type AuthIdentificationResponse = z.infer<typeof AuthIdentificationResponseSchema>;\n\n\n\n// Authentication request types\nexport type AuthenticationRequest = z.infer<typeof AuthenticationRequestSchema>;\nexport type AuthenticationResponse = z.infer<typeof AuthenticationResponseSchema>;\nexport type PasswordAuthRequest = z.infer<typeof PasswordAuthRequestSchema>;\nexport type External_OAuth2_AuthRequest = z.infer<typeof External_OAuth2_AuthRequestSchema>;\nexport type OrganizationSSOAuthRequest = z.infer<typeof OrganizationSSOAuthRequestSchema>;\nexport type OAuth2Callback = z.infer<typeof OAuth2CallbackSchema>;\nexport type TOTPAuthRequest = z.infer<typeof TOTPAuthRequestSchema>;\nexport type SMSOTPAuthRequest = z.infer<typeof SMSOTPAuthRequestSchema>;\nexport type EmailOTPAuthRequest = z.infer<typeof EmailOTPAuthRequestSchema>;\nexport type PasskeyAuthRequest = z.infer<typeof PasskeyAuthRequestSchema>;\n\nexport type MagicLinkSendRequest = z.infer<typeof MagicLinkSendRequestSchema>;\nexport type MagicLinkVerifyRequest = z.infer<typeof MagicLinkVerifyRequestSchema>;\n\nexport type PhoneVerifySendRequest = z.infer<typeof PhoneVerifySendRequestSchema>;\nexport type PhoneVerifyConfirmRequest = z.infer<typeof PhoneVerifyConfirmRequestSchema>;\n\n// MFA types\nexport type MFASetupRequest = z.infer<typeof MFASetupRequestSchema>;\nexport type MFASetupResponse = z.infer<typeof MFASetupResponseSchema>;\n\nexport type AuthIdentifyFormDto = z.infer<typeof AuthIdentifyFormDtoSchema>;\nexport type AuthLoginFormDto = z.infer<typeof AuthLoginFormDtoSchema>;\nexport type EmailOtpChallengeFormDto = z.infer<typeof EmailOtpChallengeFormDtoSchema>;\nexport type SmsOtpChallengeFormDto = z.infer<typeof SmsOtpChallengeFormDtoSchema>;\nexport type TotpChallengeFormDto = z.infer<typeof TotpChallengeFormDtoSchema>;\nexport type PhoneEnrollmentStartFormDto = z.infer<typeof PhoneEnrollmentStartFormDtoSchema>;\nexport type PhoneEnrollmentVerifyFormDto = z.infer<typeof PhoneEnrollmentVerifyFormDtoSchema>;\nexport type TotpEnrollmentVerifyFormDto = z.infer<typeof TotpEnrollmentVerifyFormDtoSchema>;\n\n// Session types\nexport type AuthenticationSession = z.infer<typeof AuthenticationSessionSchema>;\nexport type OneOffTokenExchangeResponse = z.infer<typeof OneOffTokenExchangeResponseSchema>;\n"]}

package/dist/esm/security/authentications/authentication.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AAExG;;;;;;;GAOG;AAGH,eAAO,MAAM,mBAAmB,EAAE,4BAA4B,EAG7D,CAAC;AAOF;;;GAGG;AACH,oBAAY,cAAc;IACxB,UAAU,eAAe,CAAQ,kDAAkD;IACnF,WAAW,gBAAgB,CAAM,0CAA0C;IAC3E,eAAe,oBAAoB,CAAE,+CAA+C;IACpF,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,UAAU,eAAe,CAAY,6BAA6B;IAClE,eAAe,oBAAoB,CAAE,yDAAyD;IAC9F,OAAO,YAAY,CAAiB,oDAAoD;IACxF,SAAS,cAAc,CAAa,yCAAyC;IAC7E,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAG,mBAA4B,CAAC;AAEnE,oBAAY,cAAc;IACtB,wDAAwD;IACxD,4BAA4B,iCAAiC;IAC7D,sDAAsD;IACtD,0BAA0B,+BAA+B;IACzD,mCAAmC;IACnC,mBAAmB,wBAAwB;IAC3C,sCAAsC;IACtC,sBAAsB,2BAA2B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,aAAa;IACrB,qEAAqE;IACrE,qBAAqB,0BAA0B;IAE/C,0EAA0E;IAC1E,iCAAiC,sCAAsC;CAC1E;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,EAAE,WAAW,CAAC,MAAM,CAKjE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,oBAAY,UAAU;IAEpB,QAAQ,aAAa;IAGrB,eAAe,oBAAoB,CAAE,qCAAqC;IAG1E,QAAQ,aAAa,CAAsB,wBAAwB;IACnE,kBAAkB,uBAAuB,CAAE,kCAAkC;IAG7E,UAAU,eAAe,CAAO,uBAAuB;IAGvD,IAAI,SAAS,CAAqB,+BAA+B;IACjE,OAAO,YAAY,CAAc,wBAAwB;IACzD,SAAS,cAAc,CAAU,0BAA0B;IAG3D,OAAO,YAAY;CACpB;AACD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAEhE;AACD,sDAAsD;AAEtD;;GAEG;AACH,oBAAY,UAAU;IACpB,MAAM,WAAW,CAAQ,+BAA+B;IACxD,KAAK,UAAU;CAChB;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,cAAc,mBAAmB,CAAE,sBAAsB;IACzD,KAAK,UAAU,CAAU,8BAA8B;IACvD,MAAM,WAAW;CAClB;AAED;;;GAGG;AACH,oBAAY,YAAY;IACtB,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,eAAe,oBAAoB;IACnC;;;;;;;;;;;;OAYG;IACH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;GAQG;AACH,oBAAY,uBAAuB;IACjC,OAAO,YAAY;IACnB,kBAAkB,uBAAuB;CAC1C;AAED;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,0BAA0B,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,MAAM,EAAE,+BAA+B,CAAC;CACzC;AAED;;;GAGG;AACH,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,eAAe,GAAG,UAAU,CAAC,kBAAkB,GAAG,UAAU,CAAC,QAAQ,CAAC;AAE/H;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IACzB,MAAM,WAAW;IACjB,WAAW,gBAAgB;CAC5B;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,QAAQ,aAAa;CACtB;AAMD;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,CAmBrE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,UAAU,EAU9C,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAU3E,CAAC;AAEF;;;;;;;GAOG;AACH,oBAAY,kBAAkB;IAC5B,0BAA0B;IAC1B,SAAS,cAAc;IACvB,0BAA0B;IAC1B,UAAU,eAAe;IACzB,yBAAyB;IACzB,SAAS,cAAc;IACvB,+DAA+D;IAC/D,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,gBAAgB;IAC1B,8DAA8D;IAC9D,IAAI,SAAS;IACb,8BAA8B;IAC9B,KAAK,UAAU;IACf,4DAA4D;IAC5D,IAAI,SAAS;IACb,yEAAyE;IACzE,mBAAmB,wBAAwB;IAC3C,yDAAyD;IACzD,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,oBAAY,6BAA6B;IACvC,yCAAyC;IACzC,KAAK,UAAU;IACf,2FAA2F;IAC3F,kBAAkB,uBAAuB;CAC1C;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,yBAAyB,EAAE,6BAA6B,CAAC;CACnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAuDvE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAMjF;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAUjE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oCAAoC,CAClD,gBAAgB,EAAE,SAAS,UAAU,EAAE,EACvC,QAAQ,CAAC,EAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3C,MAAM,EAAE,CAcV;AAED,sDAAsD;AAEtD;;;;;GAKG;AACH,oBAAY,aAAa;IACvB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;CAC5B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAStC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAmDhC,CAAC;AAGH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,oBAAY,qBAAqB;IAC/B,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B;AAED;;;;;;GAMG;AACH,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,UAAU,eAAe;CAC1B;AAED;;;;;GAKG;AACH,oBAAY,sBAAsB;IAChC,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,IAAI,SAAS;CACd"}
1	+ {"version":3,"file":"authentication.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AAExG;;;;;;;GAOG;AAGH,eAAO,MAAM,mBAAmB,EAAE,4BAA4B,EAG7D,CAAC;AAOF;;;GAGG;AACH,oBAAY,cAAc;IACxB,UAAU,eAAe,CAAQ,kDAAkD;IACnF,WAAW,gBAAgB,CAAM,0CAA0C;IAC3E,eAAe,oBAAoB,CAAE,+CAA+C;IACpF,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,UAAU,eAAe,CAAY,6BAA6B;IAClE,eAAe,oBAAoB,CAAE,yDAAyD;IAC9F,OAAO,YAAY,CAAiB,oDAAoD;IACxF,SAAS,cAAc,CAAa,yCAAyC;IAC7E,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAG,mBAA4B,CAAC;AAEnE,oBAAY,cAAc;IACtB,wDAAwD;IACxD,4BAA4B,iCAAiC;IAC7D,sDAAsD;IACtD,0BAA0B,+BAA+B;IACzD,mCAAmC;IACnC,mBAAmB,wBAAwB;IAC3C,sCAAsC;IACtC,sBAAsB,2BAA2B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,aAAa;IACrB,qEAAqE;IACrE,qBAAqB,0BAA0B;IAE/C,0EAA0E;IAC1E,iCAAiC,sCAAsC;CAC1E;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,EAAE,WAAW,CAAC,MAAM,CAKjE,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,oBAAY,UAAU;IAEpB,QAAQ,aAAa;IAGrB,eAAe,oBAAoB,CAAE,qCAAqC;IAG1E,QAAQ,aAAa,CAAsB,wBAAwB;IACnE,kBAAkB,uBAAuB,CAAE,kCAAkC;IAG7E,UAAU,eAAe,CAAO,uBAAuB;IAGvD,IAAI,SAAS,CAAqB,+BAA+B;IACjE,OAAO,YAAY,CAAc,wBAAwB;IACzD,SAAS,cAAc,CAAU,0BAA0B;IAG3D,OAAO,YAAY;CACpB;AACD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAEhE;AACD,sDAAsD;AAEtD;;GAEG;AACH,oBAAY,UAAU;IACpB,MAAM,WAAW,CAAQ,+BAA+B;IACxD,KAAK,UAAU;CAChB;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,cAAc,mBAAmB,CAAE,sBAAsB;IACzD,KAAK,UAAU,CAAU,8BAA8B;IACvD,MAAM,WAAW;CAClB;AAED;;;GAGG;AACH,oBAAY,YAAY;IACtB,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,kBAAkB,uBAAuB;IACzC,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,eAAe,oBAAoB;IACnC;;;;;;;;;;;;OAYG;IACH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;GAQG;AACH,oBAAY,uBAAuB;IACjC,OAAO,YAAY;IACnB,kBAAkB,uBAAuB;CAC1C;AAED;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,0BAA0B,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,MAAM,EAAE,+BAA+B,CAAC;CACzC;AAED;;;GAGG;AACH,MAAM,MAAM,+BAA+B,GAAG,UAAU,CAAC,eAAe,GAAG,UAAU,CAAC,kBAAkB,GAAG,UAAU,CAAC,QAAQ,CAAC;AAE/H;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IACzB,MAAM,WAAW;IACjB,WAAW,gBAAgB;CAC5B;AAED;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,YAAY,iBAAiB;IAC7B,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,QAAQ,aAAa;CACtB;AAMD;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc,CAmBrE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,UAAU,EAU9C,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAU3E,CAAC;AAEF;;;;;;;GAOG;AACH,oBAAY,kBAAkB;IAC5B,0BAA0B;IAC1B,SAAS,cAAc;IACvB,0BAA0B;IAC1B,UAAU,eAAe;IACzB,yBAAyB;IACzB,SAAS,cAAc;IACvB,+DAA+D;IAC/D,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,gBAAgB;IAC1B,8DAA8D;IAC9D,IAAI,SAAS;IACb,8BAA8B;IAC9B,KAAK,UAAU;IACf,4DAA4D;IAC5D,IAAI,SAAS;IACb,yEAAyE;IACzE,mBAAmB,wBAAwB;IAC3C,yDAAyD;IACzD,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,oBAAY,6BAA6B;IACvC,yCAAyC;IACzC,KAAK,UAAU;IACf,2FAA2F;IAC3F,kBAAkB,uBAAuB;CAC1C;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,yBAAyB,EAAE,6BAA6B,CAAC;CACnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAuDvE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAMjF;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAUjE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oCAAoC,CAClD,gBAAgB,EAAE,SAAS,UAAU,EAAE,EACvC,QAAQ,CAAC,EAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3C,MAAM,EAAE,CAcV;AAED,sDAAsD;AAEtD;;;;;GAKG;AACH,oBAAY,aAAa;IACvB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;CAC5B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAStC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAmDhC,CAAC;AAGH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,oBAAY,qBAAqB;IAC/B,iBAAiB,sBAAsB;IACvC,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B;AAED;;;;;;GAMG;AACH,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,UAAU,eAAe;CAC1B;AAED;;;;;GAKG;AACH,oBAAY,sBAAsB;IAChC,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,IAAI,SAAS;CACd"}

package/dist/esm/security/authentications/authentication.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAGzH;;;;;;;GAOG;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAmC;IACjE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAGF,kCAAkC;AAClC,oCAAoC;AACpC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,cAKX;AALD,WAAY,cAAc;IACxB,2CAAyB,CAAA;IACzB,6CAA2B,CAAA;IAC3B,qDAAmC,CAAA;IACnC,6BAAW,CAAA,CAAsB,4DAA4D;AAC/F,CAAC,EALW,cAAc,KAAd,cAAc,QAKzB;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,yDAAmC,CAAA;IACnC,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;IACvB,6CAAuB,CAAA,CAAa,wCAAwC;AAC9E,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAA4B,CAAC;AAEnE,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACtB,wDAAwD;IACxD,+EAA6D,CAAA;IAC7D,sDAAsD;IACtD,2EAAyD,CAAA;IACzD,mCAAmC;IACnC,6DAA2C,CAAA;IAC3C,sCAAsC;IACtC,mEAAiD,CAAA;AACrD,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qEAAqE;IACrE,gEAA+C,CAAA;IAE/C,0EAA0E;IAC1E,wFAAuE,CAAA;AAC3E,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAC;IAC7E,wGAAwG;IACxG,0GAA0G;IAC1G,mGAAmG;IACnG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACvH,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,CAAN,IAAY,UAqBX;AArBD,WAAY,UAAU;IACpB,uCAAuC;IACvC,mCAAqB,CAAA;IAErB,sEAAsE;IACtE,iDAAmC,CAAA;IAEnC,uDAAuD;IACvD,mCAAqB,CAAA;IACrB,uDAAyC,CAAA;IAEzC,mCAAmC;IACnC,uCAAyB,CAAA;IAEzB,2EAA2E;IAC3E,2BAAa,CAAA;IACb,iCAAmB,CAAA;IACnB,qCAAuB,CAAA;IAEvB,4CAA4C;IAC5C,iCAAmB,CAAA,CAAc,0BAA0B;AAC7D,CAAC,EArBW,UAAU,KAAV,UAAU,QAqBrB;AACD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC,KAAK,CAAC;AACzE,CAAC;AACD,sDAAsD;AAEtD;;GAEG;AACH,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,6BAAe,CAAA,CAAU,uCAAuC;AAClE,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,oDAAiC,CAAA;IACjC,kCAAe,CAAA;IACf,oCAAiB,CAAA,CAAQ,qCAAqC;AAChE,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,YAgCX;AAhCD,WAAY,YAAY;IACtB,iDAAiC,CAAA;IACjC,yCAAyB,CAAA;IACzB,qCAAqB,CAAA;IACrB,yDAAyC,CAAA;IACzC,mDAAmC,CAAA;IACnC;;;;OAIG;IACH,mDAAmC,CAAA;IACnC;;;;;;;;;;;;OAYG;IACH,yDAAyC,CAAA;IACzC;;;;OAIG;IACH,qDAAqC,CAAA;AACvC,CAAC,EAhCW,YAAY,KAAZ,YAAY,QAgCvB;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IACjC,8CAAmB,CAAA;IACnB,oEAAyC,CAAA;AAC3C,CAAC,EAHW,uBAAuB,KAAvB,uBAAuB,QAGlC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uBAAuB,CAAC;AAsB3E;;GAEG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mDAA6B,CAAA;IAC7B,+CAAyB,CAAA;IACzB,uCAAiB,CAAA;IACjB,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,yCAAmB,CAAA;IACnB,qCAAe,CAAA;IACf,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,kCAAkC;AAClC,uCAAuC;AACvC,kCAAkC;AAElC;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,0CAA0C;IAC1C,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAEhD,6CAA6C;IAC7C,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU;IAElD,0EAA0E;IAC1E,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,UAAU;IACvD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAChD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,cAAc,CAAC,UAAU;IAE1D,gFAAgF;IAChF,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,WAAW;IAC7C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;IACpD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW;IAElD,4CAA4C;IAC5C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;CACrD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA0B;IAC3D,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,eAAe;IAC1B,UAAU,CAAC,IAAI;IACf,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,SAAS;CACZ,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2C;IAC9E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACpD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACtD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,eAAe;IAChE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,OAAO;IACjD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,OAAO;IAC3D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAC/C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAClD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,SAAS;IACpD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;CACnD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kBASX;AATD,WAAY,kBAAkB;IAC5B,0BAA0B;IAC1B,6CAAuB,CAAA;IACvB,0BAA0B;IAC1B,+CAAyB,CAAA;IACzB,yBAAyB;IACzB,6CAAuB,CAAA;IACvB,+DAA+D;IAC/D,6CAAuB,CAAA;AACzB,CAAC,EATW,kBAAkB,KAAlB,kBAAkB,QAS7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,gBAWX;AAXD,WAAY,gBAAgB;IAC1B,8DAA8D;IAC9D,iCAAa,CAAA;IACb,8BAA8B;IAC9B,mCAAe,CAAA;IACf,4DAA4D;IAC5D,iCAAa,CAAA;IACb,yEAAyE;IACzE,+DAA2C,CAAA;IAC3C,yDAAyD;IACzD,2CAAuB,CAAA;AACzB,CAAC,EAXW,gBAAgB,KAAhB,gBAAgB,QAW3B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,yCAAyC;IACzC,gDAAe,CAAA;IACf,2FAA2F;IAC3F,0EAAyC,CAAA;AAC3C,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA2C;IAC1E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;QACrB,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,IAAI;QAC9B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QACvB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,KAAK;QAC/B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;QACtB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,KAAK;QAC/B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACpB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,IAAI;QAC9B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;QACjB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,IAAI;QAC9B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACpB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,mBAAmB;QAC7C,iBAAiB,EAAE,IAAI;QACvB,yBAAyB,EAAE,6BAA6B,CAAC,kBAAkB;KAC5E;IACD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE;QAC5B,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,SAAS;QACnC,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;QACrB,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,SAAS;QACnC,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;QAC/B,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,SAAS;QACnC,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAiB,EAAE,MAAkB;IACtE,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;IACzD,IAAI,YAAY,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,YAAY,KAAK,oBAAoB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0C;IACpE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC;IAC9B,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;IAC1B,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IACpC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IACtC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC;IAChC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC;IAC9B,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE;IAChC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE;IACnC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oCAAoC,CAClD,gBAAuC,EACvC,QAA4C;IAE5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACpH,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAC7D,gBAAgB,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,mBAAmB,IAAI,eAAe;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9D,mGAAmG;IACnG,6FAA6F;IAC7F,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,sDAAsD;AAEtD;;;;;GAKG;AACH,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,8CAA6B,CAAA;IAC7B,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAE9B;;;;;;;;;OASG;IACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAEhC;;;;;;;;;;;;;;;;;;OAkBG;IACH,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE;IAE1C,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAC7E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IAC/D,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAElD,2BAA2B;IAC3B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,uBAAuB;IACvB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAKH,kCAAkC;AAClC,wBAAwB;AACxB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,gEAAuC,CAAA;IACvC,8DAAqC,CAAA;IACrC,4DAAmC,CAAA;IACnC,0DAAiC,CAAA;IACjC,sDAA6B,CAAA;AAC/B,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,8CAAyB,CAAA;AAC3B,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,2CAAiB,CAAA;IACjB,uCAAa,CAAA;IACb,uCAAa,CAAA;IACb,uCAAa,CAAA;AACf,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\n\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport type { PolymorphicVariantDefinition } from '../../resources/utils/resource-polymorphism.schemas';\n\n/\n Auth Scope Variants (Shared)\n \n The 2 auth scope variants — shared across all auth polymorphic resources\n * (SsoConfig, SsoConnection, SiemExportConfig, SiemDeliveryDlq,\n * ScimTokens, ScimProvisioningConfig).\n \n /\n\n\nexport const AUTH_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n { parentResourceType: CoreResourceType.APPLICATION, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION], isPrimaryScope: true },\n];\n\n\n// ===============================\n// AUTHENTICATION METHOD DEFINITIONS\n// ===============================\n\n/*\n Authentication Factor Classification\n * Defines when an authentication method can be used in the flow\n /\nexport enum AuthFactorType {\n FIRST_ONLY = 'FIRST_ONLY', // Can only be used as first factor (primary auth)\n SECOND_ONLY = 'SECOND_ONLY', // Can only be used as second factor (MFA)\n FIRST_OR_SECOND = 'FIRST_OR_SECOND', // Can be used as either first or second factor\n ANY = 'ANY' // Can be used in any context (first, second, or standalone)\n}\n\n/\n Authentication Method Categories\n * Separates different types of authentication methods by scope and configuration\n /\nexport enum AuthMethodCategory {\n CREDENTIAL = 'CREDENTIAL', // Password-based credentials\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Extensible third-party SaaS OAuth2 (application-level)\n ORG_SSO = 'ORG_SSO', // Organization-restricted SSO (SAML/OpenID Connect)\n MFA_TOKEN = 'MFA_TOKEN', // Time-based or generated tokens for MFA\n BIOMETRIC = 'BIOMETRIC' // Modern biometric/passwordless methods\n}\n\n/\n The signing-key purposes an application holds, and the platform-service keys it verifies against.\n \n MOVED HERE FROM `saas-backend-lib` on 2026-09-02. These name identities that CROSS A PROCESS\n * BOUNDARY — the platform issues a token, the application verifies it; the application signs a\n * webhook, an integrator verifies it — and a name that crosses a boundary belongs in the shared\n * package rather than in the runtime on one side of it. The signing and verification MACHINERY did\n * not move; `jwt.backend.schemas.ts` re-exports both so no consumer changed.\n \n It also unblocked attesting `WILDO.IDENTITY.SIGNING_KEY_LIFECYCLE`: the retirement guarantee is\n * per key, and the assurance layer could not name the keys it applies to from a package it must not\n * depend on.\n \n Storage locations (unchanged, and stated here because the names are meaningless without them):\n * - private: `wildo_application_secrets.security.jwt.privateKey[key]`\n * - public: `wildo_application_config.jwt.publicKey[key]`, env `PLATFORM_<SERVICE_NAME>_PUBLIC_KEY`\n /\n/\n `iss` claim on every JWT the application signs, whichever key kind signs it. Receivers of\n * webhooks, workers and platform services pin this value; it is application-wide, not per key.\n /\nexport const APPLICATION_JWT_ISSUER = 'wildo-application' as const;\n\nexport enum JwtPrivateKeys {\n /* Application signing requests to platform services /\n APPLICATION_PLATFORM_REQUEST = 'APPLICATION_PLATFORM_REQUEST',\n /* Application signing requests to worker runtimes /\n APPLICATION_WORKER_REQUEST = 'APPLICATION_WORKER_REQUEST',\n /* Application signing webhooks /\n APPLICATION_WEBHOOK = 'APPLICATION_WEBHOOK',\n /* Application signing auth tokens /\n APPLICATION_AUTH_TOKEN = 'APPLICATION_AUTH_TOKEN',\n}\n\n/\n Platform Service JWT Public Keys\n * \n * Used to verify JWTs from platform services.\n * Public keys are stored in apps-manager env config.\n * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY\n /\nexport enum JwtPublicKeys {\n /* Platform service: apps-manager - central platform orchestrator /\n PLATFORM_APPS_MANAGER = 'PLATFORM_APPS_MANAGER',\n\n /* Platform service: crontabs-batches-manager - handles scheduled jobs /\n PLATFORM_CRONTABS_BATCHES_MANAGER = 'PLATFORM_CRONTABS_BATCHES_MANAGER',\n}\n\n/\n The OIDC / RFC 7519 protocol + security claim names the ID-token builder OWNS. `extraClaims` (the\n * scope-gated IDENTITY claims from the userinfo/ID-token resolver) must carry ONLY identity claims — these\n * reserved names are stripped BEFORE `extraClaims` is spread, so a same-named entry can never ride into the\n * ID token uncontrolled: a smuggled `nbf` (which would later make the token fail verification), a forged\n * `nonce` / `acr` / `amr` / `at_hash`, or a spoofed `iss` / `aud` / `sub` (the last are already overridden by\n * the server-set claims below — these are the ones the builder does NOT otherwise re-set). ONE named source\n * (closed vocabulary) so the strip list can never drift from the builder's own claim set.\n * semantic-literal-boundary: OIDC Core / RFC 7519 registered claim names.\n * assurance-control: WILDO.IDENTITY.TOKEN_INTEGRITY — an ID token's protocol/security claims are server-authored only.\n /\nexport const OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES: ReadonlySet<string> = new Set([\n // `sid` (OIDC Session Management / Front-Channel & Back-Channel Logout) is SERVER-AUTHORED here — it is\n // the End-User's OP session id the RP-Initiated Logout endpoint keys on (revocation-C). Reserving it bars\n // a client from smuggling its own `sid` via `extraClaims`, exactly like `nonce`/`acr`/`azp` below.\n 'iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti', 'azp', 'nonce', 'auth_time', 'at_hash', 'c_hash', 'acr', 'amr', 'sid',\n]);\n\n/\n @wildo_source:part:start saas.models.auth.methods facet:layer:shared facet:audience:app-developer\n \n Every way a person can prove who they are. An application chooses per USER TYPE which of these are\n * enabled, under `authMethodsEnabled` in the backend-authored config.\n \n Imported from `@wildo-ai/saas-models`.\n \n ## Enabling a method is necessary, and for four of them it is not sufficient\n \n \| method \| may be \| also required before it works \|\n * \|---\|---\|---\|\n * \| `PASSWORD` \| first \| a `passwordPolicy` on the user type \|\n * \| `MAGIC_LINK` \| first \| — \|\n * \| `PASSKEY` \| first or second \| `auth.passkeyConfig` (`rpName`, `rpId`) — the app does not boot without it \|\n * \| `SMS_OTP` \| first or second \| a verified phone number on the account \|\n * \| `TOTP` \| second \| enrolment (authenticator app or backup codes) \|\n * \| `EMAIL_OTP` \| second \| — \|\n * \| `EXTERNAL_OAUTH2` \| any \| a `socialOAuth2Providers` entry (client id + secret reference) AND a declared provider scope \|\n * \| `ORG_SAML` \| first or second \| a connection resource on the organization, AND a Java runtime with the schema-validation helper compiled on every host that serves SAML \|\n * \| `ORG_OPENID_CONNECT` \| first or second \| a connection resource on the organization \|\n \n ## Passkeys sign in without an email, and several accounts can share one device\n \n Enabling `PASSKEY` gives the sign-in screen two username-less entries on top of the passkey method\n * shown after an email: passkey AUTOFILL on the email field, and a \"Sign in with a passkey\" button. The\n * device lists every account the person holds a passkey for on this site, and the account that signs\n * in is the one the chosen passkey belongs to — whatever email, if any, was typed.\n \n - Every passkey is a discoverable credential. There is no setting to turn this off: sign-in\n * names no account to the device, so the device must be able to offer the account itself.\n * - The sign-in options are identical for every email, so they never reveal whether an account\n * exists or holds a passkey.\n * - A signed-in account is held to the same rules as a typed email: the frontend must be allowed\n * to sign in that account's user type, and an organization that restricts its domain to SSO refuses\n * a passkey sign-in exactly as it refuses a password.\n * - Re-authentication does not offer the username-less entries — a re-proof must be the same person.\n \n ## Organization SSO also requires an enabled method in the effective policy\n \n A configured connection alone does not enable `ORG_SAML` / `ORG_OPENID_CONNECT`. Check the user\n * type's methods and the application's `auth.orgAuthMethodPolicy`: RESTRICT_ONLY intersects,\n * EXPAND_WITHIN_SET permits additions from `auth.expandableOrgMethods`, and UNRESTRICTED uses the\n * organization's set. Explicit organization method overrides intersect across memberships.\n * Login-method expansion does not weaken the separate MFA, password or step-up requirements.\n \n ## Other refusals worth knowing before you pick one\n \n - *`EXTERNAL_OAUTH2` will not automatically link by email or create an account from a provider that does not report the\n email address as VERIFIED.** That is a refusal, not a warning — a provider whose claim mapping\n * does not surface a verified flag cannot be used for sign-up until the mapping is corrected.\n * - A missing SAML validation helper surfaces as an invalid signature, not as a missing\n * dependency, which sends an operator to the certificate instead of to the host.\n * - A person in an actively directory-managed organization loses every LOCAL first factor, by\n * design, so a credential minted before the directory took over cannot complete a session.\n * `EMAIL_OTP` is deliberately exempt because it is a second factor.\n \n ## ⚠️ Signing IN and signing UP are two different lists\n \n `authMethodsEnabled` decides how an EXISTING account authenticates. It does not create accounts.\n * Public registration is gated separately by `registration.allowedMethods` on the same user type,\n * which defaults to `[PASSWORD]` — so enabling `MAGIC_LINK` for sign-in and expecting people to\n * sign up with it gets a password-only signup and no error.\n \n Only four methods have a public-signup implementation — `PASSWORD`, `EXTERNAL_OAUTH2`,\n * `MAGIC_LINK`, `PASSKEY`. Listing any other (an SSO method, an MFA factor) is refused when the\n * config is built, deliberately: a method advertised to a registrant that the runtime cannot execute\n * fails them AFTER they have committed to it. Open registration also requires the list to be\n * non-empty.\n \n ## Which methods count as a second factor is a separate question\n \n `mfaPolicy` on the user type decides whether a second factor is required and narrows which of these\n * count. The guard that stops somebody removing their last second factor counts passkeys and a\n * verified phone number — it does NOT count `EMAIL_OTP`, so the arithmetic differs from what a person\n * might expect.\n \n Extensible at application level for `EXTERNAL_OAUTH2` providers; the method vocabulary itself is\n * closed.\n /\nexport enum AuthMethod {\n // Credential-based (First factor only)\n PASSWORD = 'PASSWORD',\n\n // Third-party SaaS OAuth2 (Application-level, extensible, any factor)\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Generic extensible OAuth2 provider\n\n // Organization-restricted SSO (First or second factor)\n ORG_SAML = 'ORG_SAML', // Organization SAML SSO\n ORG_OPENID_CONNECT = 'ORG_OPENID_CONNECT', // Organization OpenID Connect SSO\n\n // Passwordless (First factor only)\n MAGIC_LINK = 'MAGIC_LINK', // Magic Link via email\n\n // MFA tokens (Second factor only, except SMS_OTP which is FIRST_OR_SECOND)\n TOTP = 'TOTP', // Time-based One-Time Password\n SMS_OTP = 'SMS_OTP', // SMS One-Time Password\n EMAIL_OTP = 'EMAIL_OTP', // Email One-Time Password\n\n // Biometric/Modern (First or second factor)\n PASSKEY = 'PASSKEY' // WebAuthn/FIDO2 Passkeys\n}\n/\n Is this method strong enough for a policy that demands a STRONG second factor?\n \n Derived from the method's own channel rather than from a hand-kept weak list: a second factor\n * delivered to an email address is excluded, because email is not an acceptable channel for\n * out-of-band authentication at all — \"Email SHALL NOT be used for out-of-band authentication because\n * it may be vulnerable to: Access using only a password; Interception in transit or at intermediate\n * mail servers; Rerouting attacks\".\n \n spec-cite: NIST SP 800-63B-4 §3.1.3.1 \"Out-of-Band Authenticators\"\n * (https://pages.nist.gov/800-63-4/sp800-63b.html).\n \n This reproduces the set the previous rule produced, and that is deliberate. `requireStrongMFA`\n * used to be expressed as \"drop the factors that need no enrolment\", which removed `EMAIL_OTP`\n * because an address the account already proved needs no setup. That reasoning is sound and it was\n * reaching the right answer by a property that only coincides with the one it meant — a second\n * always-available factor on another channel would have been excluded for no reason, and a weak\n * factor that DID need enrolment would have passed. Deriving from the channel says the thing itself.\n \n What it deliberately does NOT change: `SMS_OTP` stays strong. NIST classes PSTN out-of-band as\n * the one RESTRICTED authenticator (§3.2.9) — permitted, with an obligation to offer an unrestricted\n * alternative — rather than as a prohibited channel, and promoting \"restricted\" to \"not strong\" is a\n * posture decision an application should make, not one this predicate should make for it.\n /\nexport function isStrongSecondFactor(method: AuthMethod): boolean {\n return AUTH_METHOD_EVIDENCE[method].channel !== AuthProofChannel.EMAIL;\n}\n/* @wildo_source:part:end saas.models.auth.methods /\n\n/\n Authentication Factor Levels\n /\nexport enum AuthFactor {\n SINGLE = 'SINGLE', // Single factor authentication\n MULTI = 'MULTI' // Multi-factor authentication required\n}\n\n/\n Authentication Factor Level (First or Second Factor)\n /\nexport enum AuthFactorLevel {\n IDENTIFICATION = 'IDENTIFICATION', // Identification only\n FIRST = 'FIRST', // First factor authentication\n SECOND = 'SECOND' // Second factor authentication (MFA)\n}\n\n/\n W4: Next step hint for frontend routing after auth state transitions.\n * Drives UI flow (MFA enrollment, onboarding, email verification, etc.).\n /\nexport enum AuthNextStep {\n MFA_ENROLLMENT = 'mfa_enrollment',\n ONBOARDING = 'onboarding',\n COMPLETE = 'complete',\n EMAIL_VERIFICATION = 'email_verification',\n PASSWORD_CHANGE = 'password_change',\n /\n A password-less public registration completed and a magic link is on its way (#463). Clicking it\n * proves the address and establishes the first session — there is nothing else for the registrant\n * to do, and nothing to authenticate with until they do it.\n /\n MAGIC_LINK_SENT = 'magic_link_sent',\n /\n As {@link MAGIC_LINK_SENT}, and the click leads to enrolling a passkey.\n \n A separate member rather than a flag on the one above, because the client renders different copy\n * from the first screen onward — \"check your email to finish\" versus \"check your email, then set up\n * your passkey\" — and a registrant told the wrong one abandons at the step they were not warned\n * about.\n \n The magic link is not incidental here: a passkey proves possession of an authenticator and says\n * nothing about an address, so a public passkey signup must prove the address some other way, and\n * the link is that proof. It is also, permanently, the recovery path — see the note on\n * `registerUser`.\n /\n PASSKEY_ENROLLMENT = 'passkey_enrollment',\n /\n An invitation was accepted and no session was issued (#1158). The user's effective policy disables the sign-in the\n * invitation link amounts to (possession of the email address), so they continue on the sign-in page with a method\n * their policy allows.\n /\n SIGN_IN_REQUIRED = 'sign_in_required',\n}\n\n/\n What a re-authentication proof is FOR (#1417). It decides which factors may mint the proof and which\n * doors accept it.\n \n - `STEP_UP`: a sensitive operation, removing a way to sign in, or turning TOTP off. Minted only from\n * a factor the effective `stepUpAuth.methods` accepts, as a `REAUTH` token.\n * - `BIND_AUTHENTICATOR`: adding a way to sign in. Minted from any factor the account holds, as a\n * `REAUTH_BIND` token, which only the binding doors accept.\n /\nexport enum ReAuthenticationPurpose {\n STEP_UP = 'step_up',\n BIND_AUTHENTICATOR = 'bind_authenticator',\n}\n\n/\n The frontend page a federated re-authentication returns to (#1441), inside the popup the step-up\n * dialog opened. The backend redirects there with `?code=` (a one-time `REAUTH_CODE_EXCHANGE` code) or\n * `?error=`; the page hands either to the window that opened it and closes. ONE constant, so the URL the\n * backend writes and the route the frontend mounts cannot disagree.\n /\nexport const REAUTHENTICATION_CALLBACK_PAGE_PATH = '/auth/reauth/callback';\n\n/\n A linked identity that can re-authenticate its account through its provider (#1441): what the step-up\n * dialog shows as \"Continue with <displayName>\", what `GET /auth/reauth/methods` lists beside the local\n * factors, and what `POST /auth/reauth/federated/authorize` accepts by `identityLinkId`.\n /\nexport interface ReAuthenticationIdentityLink {\n identityLinkId: string;\n providerRef: string;\n /* The provider's (social) or the connection's (enterprise) display name. /\n displayName: string;\n /* What a step-up policy names this factor by. /\n method: FederatedReAuthenticationMethod;\n}\n\n/\n The methods a linked identity re-authenticates with (#1441): `EXTERNAL_OAUTH2` for a social OIDC link,\n * `ORG_OPENID_CONNECT` for an enterprise OIDC one, `ORG_SAML` for an enterprise SAML one.\n /\nexport type FederatedReAuthenticationMethod = AuthMethod.EXTERNAL_OAUTH2 \| AuthMethod.ORG_OPENID_CONNECT \| AuthMethod.ORG_SAML;\n\n/\n W4.2: Session purpose — drives UI rendering and valid state transitions.\n /\nexport enum AuthSessionPurpose {\n LOGIN = 'login',\n REGISTRATION = 'registration',\n INVITATION = 'invitation',\n REAUTH = 'reauth',\n DEVICE_AUTH = 'device_auth',\n}\n\n/\n W4.6: MFA enrollment lifecycle state on UserCredentials.\n * Computed at user creation and updated on enrollment completion.\n /\nexport enum MfaEnrollmentState {\n NOT_REQUIRED = 'not_required',\n PENDING = 'pending',\n GRACE = 'grace',\n ENROLLED = 'enrolled',\n}\n\n// ===============================\n// AUTHENTICATION METHOD CLASSIFICATION\n// ===============================\n\n/\n @wildo_source:part:start saas.models.auth.methods facet:layer:shared facet:audience:app-developer\n \n ## What each method PROVES, and how the engine decides with it\n \n Three maps classify a method, and they answer different questions. Reach for the right one:\n \n \| map \| answers \|\n * \|---\|---\|\n * \| `AUTH_METHOD_FACTOR_MAP` \| WHERE it may sit — first factor, second factor, or either \|\n * \| `AUTH_METHOD_CATEGORY_MAP` \| which GROUP the sign-in page renders it in \|\n * \| `AUTH_METHOD_EVIDENCE` \| what it PROVES — the one the engine's factor rules read \|\n /\n\n/\n Authentication Method Factor Classification Map\n /\nexport const AUTH_METHOD_FACTOR_MAP: Record<AuthMethod, AuthFactorType> = {\n // First factor only - Primary credentials\n [AuthMethod.PASSWORD]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - Passwordless via email\n [AuthMethod.MAGIC_LINK]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - SSO redirect flows are not MFA ceremonies (B-SEC-1)\n [AuthMethod.EXTERNAL_OAUTH2]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_SAML]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthFactorType.FIRST_ONLY,\n\n // Second factor only - MFA tokens (except SMS_OTP which can be first or second)\n [AuthMethod.TOTP]: AuthFactorType.SECOND_ONLY,\n [AuthMethod.SMS_OTP]: AuthFactorType.FIRST_OR_SECOND,\n [AuthMethod.EMAIL_OTP]: AuthFactorType.SECOND_ONLY,\n\n // First or second factor - Modern biometric\n [AuthMethod.PASSKEY]: AuthFactorType.FIRST_OR_SECOND\n};\n\n/\n The order authentication methods are PRESENTED in, and the order that decides which one is offered first.\n \n ONE authority, deliberately. Until #1218 there were two and neither was: the backend returned methods in\n * `AUTH_METHOD_FACTOR_MAP` declaration order — so `defaultFirstFactorMethod` was `PASSWORD` because PASSWORD happens to\n * be the first key of an unrelated map — and the frontend threw that order away and re-sorted by a display list only it\n * could see. A domain routed to an enterprise identity provider still met the password form, with \"Continue with your\n * provider\" relegated to \"other methods\".\n \n The head is the one the sign-in page already used, promoted rather than invented: the organization's own identity\n * provider first, because a domain that routes to one is telling you where this person signs in; then the credentials a\n * person holds directly; then the delegated and one-time channels.\n \n The TRAILER orders the second-factor challenge, and it is strongest-first. Those members are second-factor-only\n * (or, for `SMS_OTP`, first-or-second), so they never appear in a first-factor list and their position here decides one\n * thing: what the MFA screen offers first. `TOTP` leads them because it is an unrestricted authenticator; `SMS_OTP`\n * follows because NIST classes PSTN out-of-band as RESTRICTED — permitted, with an obligation to offer an unrestricted\n * alternative — and `EMAIL_OTP` is last because email \"SHALL NOT be used for out-of-band authentication\".\n * spec-cite: NIST SP 800-63B-4 §3.2.9 (restricted authenticators) and §3.1.3.1 (out-of-band authenticators)\n * (https://pages.nist.gov/800-63-4/sp800-63b.html). The same two sections `isStrongSecondFactor` cites.\n \n The frontend's deleted display order put `TOTP` last, behind both OTP channels, for no recorded reason — that is what\n * this replaces, and the change is deliberate rather than incidental.\n \n TOTAL over the vocabulary, and pinned as total: a method added to `AuthMethod` tomorrow must be PLACED here, rather\n * than appearing silently at the end of whichever list happened to be sorted last.\n /\nexport const AUTH_METHOD_PRECEDENCE: readonly AuthMethod[] = [\n AuthMethod.ORG_SAML,\n AuthMethod.ORG_OPENID_CONNECT,\n AuthMethod.PASSWORD,\n AuthMethod.PASSKEY,\n AuthMethod.MAGIC_LINK,\n AuthMethod.EXTERNAL_OAUTH2,\n AuthMethod.TOTP,\n AuthMethod.SMS_OTP,\n AuthMethod.EMAIL_OTP,\n] as const;\n\n/\n Authentication Method Category Map\n /\nexport const AUTH_METHOD_CATEGORY_MAP: Record<AuthMethod, AuthMethodCategory> = {\n [AuthMethod.PASSWORD]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.MAGIC_LINK]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.EXTERNAL_OAUTH2]: AuthMethodCategory.EXTERNAL_OAUTH2,\n [AuthMethod.ORG_SAML]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.TOTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.SMS_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.EMAIL_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.PASSKEY]: AuthMethodCategory.BIOMETRIC\n};\n\n/\n The factor CATEGORY a method proves, in the classical three — plus the one Wildo cannot classify.\n \n `FEDERATED` is not a fourth kind of factor. It means the proof happened at an identity provider, so\n * what was proved is the IdP's answer and not ours: the engine reads it from the assertion's `acr`\n * demands and assurance evidence rather than declaring it here. Giving a federated method a concrete\n * category would be asserting something about somebody else's ceremony.\n /\nexport enum AuthFactorCategory {\n /* Something you know. /\n KNOWLEDGE = 'KNOWLEDGE',\n /* Something you have. /\n POSSESSION = 'POSSESSION',\n /* Something you are. /\n INHERENCE = 'INHERENCE',\n /* Proved elsewhere; the assertion says what, not this map. /\n FEDERATED = 'FEDERATED',\n}\n\n/\n The CHANNEL a method's proof travels over — the axis that decides whether two factors are\n * independent.\n \n Two factors that share a channel are one factor counted twice: whoever holds the channel holds\n * both. A magic link and an email one-time code are the worked example, and the law states the rule\n * directly — \"the breach of one of the elements does not compromise the reliability of the other\n * elements\".\n \n spec-cite: Commission Delegated Regulation (EU) 2018/389, Art. 9(1) \"Independence of the elements\"\n * (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R0389). That regulation binds\n * payment service providers; it is cited here as the clearest statement of the principle, never as an\n * obligation a Wildo application inherits.\n \n `NONE` means the proof does not travel: a password is typed, a TOTP code is computed from a secret\n * shared once at enrolment. Those can never collide with anything, which is why the rule is expressed\n * as \"not the same channel\" rather than as a list of forbidden pairs.\n /\nexport enum AuthProofChannel {\n /* Nothing is delivered — the proof is presented directly. /\n NONE = 'NONE',\n /* Delivered to a mailbox. /\n EMAIL = 'EMAIL',\n /* Delivered over the public switched telephone network. /\n PSTN = 'PSTN',\n /* Produced by an authenticator on the device, and never transmitted. /\n LOCAL_AUTHENTICATOR = 'LOCAL_AUTHENTICATOR',\n /* Carried in an assertion from an identity provider. /\n FEDERATED = 'FEDERATED',\n}\n\n/\n Whether ONE ceremony of this method can prove TWO factors by itself.\n \n Only a cryptographic authenticator can, and only when an activation factor unlocked its key —\n * \"a multi-factor cryptographic authenticator is 'something you have' and is activated by an\n * activation factor that represents either 'something you know' or 'something you are'\".\n \n spec-cite: NIST SP 800-63B-4 §3.1.7 \"Multi-Factor Cryptographic Authentication\"\n * (https://pages.nist.gov/800-63-4/sp800-63b.html).\n \n `WHEN_USER_VERIFIED` is therefore a CONDITION, not a property: the same passkey proves two factors\n * in a ceremony that verified the person and one in a ceremony that did not, and both produce a valid\n * assertion. The engine reads the WebAuthn `UV` flag off the assertion to tell them apart.\n /\nexport enum AuthSelfSufficientMultiFactor {\n /* One ceremony, one factor — always. /\n NEVER = 'NEVER',\n /* Two factors when the authenticator locally verified the person, one when it did not. /\n WHEN_USER_VERIFIED = 'WHEN_USER_VERIFIED',\n}\n\n/* What one authentication method proves. See {@link AUTH_METHOD_EVIDENCE}. /\nexport interface AuthMethodEvidence {\n readonly factorCategory: AuthFactorCategory;\n readonly channel: AuthProofChannel;\n /\n Whether presenting this method to an impostor verifier is useless to the impostor.\n \n True for `PASSKEY` alone, and that is not a judgement — \"authenticators that involve the manual\n * entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be\n * considered phishing-resistant because the manual entry does not bind the authenticator output to\n * the specific session being authenticated\". A typed code is relayable, TOTP included.\n \n spec-cite: NIST SP 800-63B-4 §3.2.5 \"Phishing Resistance\"\n * (https://pages.nist.gov/800-63-4/sp800-63b.html).\n \n A federated method is `false` because Wildo cannot know how the IdP authenticated the person;\n * that question is answered by the connection's `acr` demands, not by this map.\n /\n readonly phishingResistant: boolean;\n readonly selfSufficientMultiFactor: AuthSelfSufficientMultiFactor;\n}\n\n/\n Authentication Method Evidence Map — what each method PROVES.\n \n The two maps above say where a method may sit and how it is grouped on screen. Neither says what it\n * proves, so every rule that depends on the strength of a proof used to be hand-applied at its own\n * door and derived differently at each one: the MFA waiver matched a method NAME, `requireStrongMFA`\n * was expressed as \"drop the ones needing no enrolment\", and nothing anywhere expressed the channel —\n * which is why a magic-link sign-in could be completed by an email code to the same mailbox.\n \n Being `Record<AuthMethod, …>` is the point: a method added to the vocabulary tomorrow does not\n * compile until it declares what it proves, so the rules below stay total over the vocabulary instead\n * of quietly omitting it.\n \n ## Reading the rows\n \n - `MAGIC_LINK` is POSSESSION, not knowledge. It sits beside `PASSWORD` in\n * `AUTH_METHOD_CATEGORY_MAP` because both are rendered as \"credentials\", and that grouping is a\n * screen concern. What a magic link proves is control of a mailbox.\n * - `TOTP` has NO channel. The secret is shared once at enrolment and the code is computed\n * locally, so nothing is delivered and it can never collide with another factor's channel.\n * - The three federated methods are `FEDERATED` on both axes. Their strength question already has\n * an answer — `externalAssuranceEnforcement` and the connection's `acr` demands — and this map must\n * not grow a second, competing one.\n \n Imported from `@wildo-ai/saas-models`.\n /\nexport const AUTH_METHOD_EVIDENCE: Record<AuthMethod, AuthMethodEvidence> = {\n [AuthMethod.PASSWORD]: {\n factorCategory: AuthFactorCategory.KNOWLEDGE,\n channel: AuthProofChannel.NONE,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.MAGIC_LINK]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.EMAIL,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.EMAIL_OTP]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.EMAIL,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.SMS_OTP]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.PSTN,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.TOTP]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.NONE,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.PASSKEY]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.LOCAL_AUTHENTICATOR,\n phishingResistant: true,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.WHEN_USER_VERIFIED,\n },\n [AuthMethod.EXTERNAL_OAUTH2]: {\n factorCategory: AuthFactorCategory.FEDERATED,\n channel: AuthProofChannel.FEDERATED,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.ORG_SAML]: {\n factorCategory: AuthFactorCategory.FEDERATED,\n channel: AuthProofChannel.FEDERATED,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.ORG_OPENID_CONNECT]: {\n factorCategory: AuthFactorCategory.FEDERATED,\n channel: AuthProofChannel.FEDERATED,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n};\n\n/\n Do these two methods prove things a single breach could reach?\n \n The rule the engine applies when it offers or accepts a SECOND factor: a factor whose channel the\n * FIRST factor already proved is not a second factor. `NONE` never collides, because nothing is\n * delivered over it.\n \n @example\n * sharesProofChannel(AuthMethod.MAGIC_LINK, AuthMethod.EMAIL_OTP); // true — one mailbox, counted twice\n * sharesProofChannel(AuthMethod.PASSWORD, AuthMethod.EMAIL_OTP); // false — nothing is delivered to prove a password\n /\nexport function sharesProofChannel(first: AuthMethod, second: AuthMethod): boolean {\n const firstChannel = AUTH_METHOD_EVIDENCE[first].channel;\n if (firstChannel === AuthProofChannel.NONE) {\n return false;\n }\n return firstChannel === AUTH_METHOD_EVIDENCE[second].channel;\n}\n/\n The RFC 8176 `amr` values each method may claim, and nothing else (#1248).\n \n `amr` is what an ID token tells a relying party about HOW the person authenticated. Wildo demands\n * exactly this of every identity provider it trusts — `oauth2-authentication` reads an upstream `amr`\n * as session evidence — and published none of its own, so a client receiving a Wildo ID token could not\n * make the decision Wildo insists on making about its own upstreams. That asymmetry is the defect.\n \n spec-cite: RFC 8176 \"Authentication Method Reference Values\", §2 — the registry of short names and\n * their definitions (https://www.rfc-editor.org/rfc/rfc8176.html). Every value below is taken from\n * that registry; none is invented.\n \n ## Only REGISTERED values, which is why three methods contribute none\n \n A value outside the registry is a private string a generic relying party cannot read, so an\n * unregistered \"email\" or \"sso\" would be worse than silence — the same reasoning that keeps `acr`\n * unpublished until Wildo defines what its values mean.\n \n - The federated methods contribute nothing. The registry has no value for \"the person proved\n * themselves to somebody else and that party vouched for them\", and restating the UPSTREAM's `amr`\n * as our own would assert a proof this application never observed. What the upstream proved is the\n * upstream's claim to make.\n * - `MAGIC_LINK` and `EMAIL_OTP` claim `mca`, \"Multiple-channel authentication involving\n * communication over distinct channels\", which is literally what they are: the credential travels by\n * email, a channel distinct from the browser. That is applying a registered definition, not\n * stretching one. `EMAIL_OTP` also claims `otp`, which it plainly is; `MAGIC_LINK` is not an OTP —\n * the link itself is the credential.\n * - `PASSKEY` claims `user`, \"User presence test\", because WebAuthn always tests presence. It does\n * NOT claim `hwk` or `swk`: which is true depends on whether the credential is single-device or\n * synced, and the session does not carry the credential's device type. Claiming either would be a\n * guess about the authenticator, and `hwk` is precisely what a relying party reads as\n * phishing-resistant hardware.\n /\nexport const AUTH_METHOD_AMR: Record<AuthMethod, readonly string[]> = {\n [AuthMethod.PASSWORD]: ['pwd'],\n [AuthMethod.TOTP]: ['otp'],\n [AuthMethod.SMS_OTP]: ['sms', 'otp'],\n [AuthMethod.EMAIL_OTP]: ['mca', 'otp'],\n [AuthMethod.MAGIC_LINK]: ['mca'],\n [AuthMethod.PASSKEY]: ['user'],\n [AuthMethod.EXTERNAL_OAUTH2]: [],\n [AuthMethod.ORG_OPENID_CONNECT]: [],\n [AuthMethod.ORG_SAML]: [],\n};\n\n/\n What an ID token may say about how THIS session was authenticated (#1248).\n \n Returns the sorted, de-duplicated registered `amr` values for the factors the session actually\n * completed — never for the factors it could have used. An empty result means the session has nothing\n * a relying party could read, and the caller omits the claim rather than emitting `[]`: an empty array\n * asserts \"authenticated by no method\", which is false, where an absent claim correctly says nothing.\n \n ## `mfa` is DERIVED, and it is the value that matters most\n \n \"Multiple-factor authentication\" is claimed when the session genuinely holds two independent proofs,\n * decided by the same {@link AUTH_METHOD_EVIDENCE} channels that decide whether a second factor is\n * admissible — so an ID token cannot claim `mfa` for a pair this application's own sign-in doors would\n * refuse as sharing a channel. A password plus an email OTP is two methods and one mailbox; it does\n * not claim `mfa`.\n \n A single passkey claims `mfa` when the authenticator locally verified the person, because that\n * ceremony IS two factors — possession of the authenticator and the activation that unlocked it — and\n * the WebAuthn UV flag is the only report that the activation happened. That is the distinction the\n * acceptance asks an ID token to carry, and it is readable only because the verifier reads the flag\n * off the assertion rather than inferring it from the policy that requested it.\n /\nexport function deriveAuthenticationMethodReferences(\n completedFactors: readonly AuthMethod[],\n ceremony?: { passkeyUserVerified?: boolean },\n): string[] {\n const values = new Set<string>();\n for (const method of completedFactors) {\n for (const value of AUTH_METHOD_AMR[method] ?? []) values.add(value);\n }\n\n const userVerifiedPasskey = completedFactors.includes(AuthMethod.PASSKEY) && ceremony?.passkeyUserVerified === true;\n const independentPair = completedFactors.some((first, index) =>\n completedFactors.slice(index + 1).some((second) => !sharesProofChannel(first, second)));\n if (userVerifiedPasskey \|\| independentPair) values.add('mfa');\n\n // Sorted so the claim is stable across sign-ins completing the same factors in a different order —\n // a relying party comparing tokens should not see a difference that is only iteration order.\n return [...values].sort();\n}\n\n/* @wildo_source:part:end saas.models.auth.methods /\n\n/\n Scope type for auth policies — organization-level vs application-level.\n \n Declared before the browser-safe available-method schema because that schema\n * evaluates this enum at module initialization time.\n /\nexport enum AuthScopeType {\n ORGANIZATION = 'organization',\n APPLICATION = 'application',\n}\n\n/\n Public, browser-safe configuration attached to an available auth method.\n \n The fields span passkey and enterprise-SSO methods, but every field is named\n * and typed: this cross-layer contract must never collapse back to\n * `Record<string, any>`, which previously forced frontend assertions for the\n * tenant scope and connection identity.\n /\nexport const AvailableMethodConfigSchema = z.object({\n rpName: z.string().optional(),\n rpId: z.string().optional(),\n displayName: z.string().optional(),\n providerRef: z.string().optional(),\n connectionId: z.string().optional(),\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n loginUrl: z.string().optional(),\n});\n\nexport type AvailableMethodConfig = z.infer<typeof AvailableMethodConfigSchema>;\n\nexport const AvailableMethodSchema = z.object({\n method: z.enum(AuthMethod),\n factorType: z.enum(AuthFactorType),\n category: z.enum(AuthMethodCategory),\n canBeFirstFactor: z.boolean(),\n canBeSecondFactor: z.boolean(),\n\n /\n The organization that owns this address requires THIS method as the first factor.\n \n True only where an enterprise connection's `enforcement.requireSSO` is set, so it appears on\n * `ORG_SAML` and `ORG_OPENID_CONNECT` and nowhere else. It is not the same statement as \"this is\n * the only method offered\": when the tenant allows a password fallback, or names break-glass\n * accounts, the offered list deliberately KEEPS the password field for every address at the domain\n * (enumeration safety — narrowing it for the listed accounts would publish who they are). This flag\n * is what lets the sign-in page say that the password beside it is a fallback rather than a peer.\n /\n enforcedFirstFactor: z.boolean(),\n\n /\n The account's policy requires a second factor, and this method can serve as one.\n \n Meaningful only in a SECOND-factor list. It is derived from `mfaPolicy.requireMFA` together with\n * the method's factor classification, so it is true of every acceptable second factor at once — it\n * says \"a second factor is mandatory\", never \"this particular one is\".\n \n ## Why this is two fields and not one\n \n Both of these were a single `required: boolean` until #1220, written by two branches with\n * incompatible meanings, and `_buildAvailableMethodObject` builds BOTH the first- and second-factor\n * lists — so each writer was noise in the other's list. In the FIRST-factor list a passkey came back\n * `required: true` merely because the user type demands MFA, where it means nothing at all; the flag\n * was read by no frontend code, so nothing ever noticed. A consumer taking it at face value would\n * have presented a passkey as a mandatory first factor, which is the opposite of true.\n \n Two names, one writer each, each meaningful in exactly one list. Merging them back would restore a\n * field whose meaning depends on which list you found it in, which is not a meaning.\n /\n satisfiesRequiredSecondFactor: z.boolean(),\n\n // Provider-specific information\n oauth2ProviderRefs: z.array(z.string()).optional(), // For third-party OAuth2\n ssoIds: z.array(z.string()).optional(), // For organization SSO\n organizationRestricted: z.boolean().default(false),\n\n // Integration capabilities\n supportsIntegrations: z.boolean().default(false),\n availableIntegrations: z.array(z.string()).default([]).optional(),\n\n // Public configuration\n config: AvailableMethodConfigSchema.optional()\n});\n\n\nexport type AvailableMethod = z.infer<typeof AvailableMethodSchema>;\n\n// ===============================\n// CROSS-LAYER CONSTANTS\n// ===============================\n\n/\n Error codes used in redirect query params (backend → frontend).\n * Backend appends `?error=<code>` to redirect URLs; frontend reads and displays.\n /\nexport enum AuthRedirectErrorCode {\n SAML_LOGIN_FAILED = 'saml_login_failed',\n SAML_AUTH_FAILED = 'saml_auth_failed',\n SAML_SLO_FAILED = 'saml_slo_failed',\n MISSING_PARAMS = 'missing_params',\n OAUTH_FAILED = 'oauth_failed',\n}\n\n/\n Ownership class of an external authentication connection.\n \n This is intentionally independent from {@link AuthScopeType}: a social\n * connection has no enterprise tenant scope, while an enterprise connection\n * must carry one.\n /\nexport enum SsoConnectionType {\n SOCIAL = 'social',\n ENTERPRISE = 'enterprise',\n}\n\n/\n Mechanism that established an external identity.\n \n This is wider than the SSO protocol vocabulary because SCIM establishes and\n * maintains identity links without being an interactive SSO protocol.\n */\nexport enum ExternalIdentitySource {\n OAUTH2 = 'oauth2',\n OIDC = 'oidc',\n SAML = 'saml',\n SCIM = 'scim',\n}\n"]}
1	+ {"version":3,"file":"authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAGzH;;;;;;;GAOG;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAmC;IACjE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAGF,kCAAkC;AAClC,oCAAoC;AACpC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,cAKX;AALD,WAAY,cAAc;IACxB,2CAAyB,CAAA;IACzB,6CAA2B,CAAA;IAC3B,qDAAmC,CAAA;IACnC,6BAAW,CAAA,CAAsB,4DAA4D;AAC/F,CAAC,EALW,cAAc,KAAd,cAAc,QAKzB;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,yDAAmC,CAAA;IACnC,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;IACvB,6CAAuB,CAAA,CAAa,wCAAwC;AAC9E,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAA4B,CAAC;AAEnE,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACtB,wDAAwD;IACxD,+EAA6D,CAAA;IAC7D,sDAAsD;IACtD,2EAAyD,CAAA;IACzD,mCAAmC;IACnC,6DAA2C,CAAA;IAC3C,sCAAsC;IACtC,mEAAiD,CAAA;AACrD,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qEAAqE;IACrE,gEAA+C,CAAA;IAE/C,0EAA0E;IAC1E,wFAAuE,CAAA;AAC3E,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAC;IAC7E,wGAAwG;IACxG,0GAA0G;IAC1G,mGAAmG;IACnG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACvH,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,CAAN,IAAY,UAqBX;AArBD,WAAY,UAAU;IACpB,uCAAuC;IACvC,mCAAqB,CAAA;IAErB,sEAAsE;IACtE,iDAAmC,CAAA;IAEnC,uDAAuD;IACvD,mCAAqB,CAAA;IACrB,uDAAyC,CAAA;IAEzC,mCAAmC;IACnC,uCAAyB,CAAA;IAEzB,2EAA2E;IAC3E,2BAAa,CAAA;IACb,iCAAmB,CAAA;IACnB,qCAAuB,CAAA;IAEvB,4CAA4C;IAC5C,iCAAmB,CAAA,CAAc,0BAA0B;AAC7D,CAAC,EArBW,UAAU,KAAV,UAAU,QAqBrB;AACD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC,KAAK,CAAC;AACzE,CAAC;AACD,sDAAsD;AAEtD;;GAEG;AACH,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,6BAAe,CAAA,CAAU,uCAAuC;AAClE,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,oDAAiC,CAAA;IACjC,kCAAe,CAAA;IACf,oCAAiB,CAAA,CAAQ,qCAAqC;AAChE,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,YAgCX;AAhCD,WAAY,YAAY;IACtB,iDAAiC,CAAA;IACjC,yCAAyB,CAAA;IACzB,qCAAqB,CAAA;IACrB,yDAAyC,CAAA;IACzC,mDAAmC,CAAA;IACnC;;;;OAIG;IACH,mDAAmC,CAAA;IACnC;;;;;;;;;;;;OAYG;IACH,yDAAyC,CAAA;IACzC;;;;OAIG;IACH,qDAAqC,CAAA;AACvC,CAAC,EAhCW,YAAY,KAAZ,YAAY,QAgCvB;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IACjC,8CAAmB,CAAA;IACnB,oEAAyC,CAAA;AAC3C,CAAC,EAHW,uBAAuB,KAAvB,uBAAuB,QAGlC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uBAAuB,CAAC;AAsB3E;;GAEG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mDAA6B,CAAA;IAC7B,+CAAyB,CAAA;IACzB,uCAAiB,CAAA;IACjB,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,yCAAmB,CAAA;IACnB,qCAAe,CAAA;IACf,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,kCAAkC;AAClC,uCAAuC;AACvC,kCAAkC;AAElC;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,0CAA0C;IAC1C,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAEhD,6CAA6C;IAC7C,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU;IAElD,0EAA0E;IAC1E,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,UAAU;IACvD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAChD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,cAAc,CAAC,UAAU;IAE1D,gFAAgF;IAChF,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,WAAW;IAC7C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;IACpD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW;IAElD,4CAA4C;IAC5C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;CACrD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA0B;IAC3D,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,eAAe;IAC1B,UAAU,CAAC,IAAI;IACf,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,SAAS;CACZ,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2C;IAC9E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACpD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACtD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,eAAe;IAChE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,OAAO;IACjD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,OAAO;IAC3D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAC/C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAClD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,SAAS;IACpD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;CACnD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kBASX;AATD,WAAY,kBAAkB;IAC5B,0BAA0B;IAC1B,6CAAuB,CAAA;IACvB,0BAA0B;IAC1B,+CAAyB,CAAA;IACzB,yBAAyB;IACzB,6CAAuB,CAAA;IACvB,+DAA+D;IAC/D,6CAAuB,CAAA;AACzB,CAAC,EATW,kBAAkB,KAAlB,kBAAkB,QAS7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,gBAWX;AAXD,WAAY,gBAAgB;IAC1B,8DAA8D;IAC9D,iCAAa,CAAA;IACb,8BAA8B;IAC9B,mCAAe,CAAA;IACf,4DAA4D;IAC5D,iCAAa,CAAA;IACb,yEAAyE;IACzE,+DAA2C,CAAA;IAC3C,yDAAyD;IACzD,2CAAuB,CAAA;AACzB,CAAC,EAXW,gBAAgB,KAAhB,gBAAgB,QAW3B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,yCAAyC;IACzC,gDAAe,CAAA;IACf,2FAA2F;IAC3F,0EAAyC,CAAA;AAC3C,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA2C;IAC1E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;QACrB,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,IAAI;QAC9B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QACvB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,KAAK;QAC/B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;QACtB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,KAAK;QAC/B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACpB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,IAAI;QAC9B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;QACjB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,IAAI;QAC9B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACpB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,mBAAmB;QAC7C,iBAAiB,EAAE,IAAI;QACvB,yBAAyB,EAAE,6BAA6B,CAAC,kBAAkB;KAC5E;IACD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE;QAC5B,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,SAAS;QACnC,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;QACrB,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,SAAS;QACnC,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;QAC/B,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,SAAS;QACnC,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAiB,EAAE,MAAkB;IACtE,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;IACzD,IAAI,YAAY,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,YAAY,KAAK,oBAAoB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0C;IACpE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC;IAC9B,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;IAC1B,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IACpC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IACtC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC;IAChC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC;IAC9B,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE;IAChC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE;IACnC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oCAAoC,CAClD,gBAAuC,EACvC,QAA4C;IAE5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACpH,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAC7D,gBAAgB,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,mBAAmB,IAAI,eAAe;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9D,mGAAmG;IACnG,6FAA6F;IAC7F,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,sDAAsD;AAEtD;;;;;GAKG;AACH,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,8CAA6B,CAAA;IAC7B,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAE9B;;;;;;;;;OASG;IACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAEhC;;;;;;;;;;;;;;;;;;OAkBG;IACH,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE;IAE1C,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAC7E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IAC/D,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAElD,2BAA2B;IAC3B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,uBAAuB;IACvB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAKH,kCAAkC;AAClC,wBAAwB;AACxB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,gEAAuC,CAAA;IACvC,8DAAqC,CAAA;IACrC,4DAAmC,CAAA;IACnC,0DAAiC,CAAA;IACjC,sDAA6B,CAAA;AAC/B,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,8CAAyB,CAAA;AAC3B,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,2CAAiB,CAAA;IACjB,uCAAa,CAAA;IACb,uCAAa,CAAA;IACb,uCAAa,CAAA;AACf,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\n\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport type { PolymorphicVariantDefinition } from '../../resources/utils/resource-polymorphism.schemas';\n\n/\n Auth Scope Variants (Shared)\n \n The 2 auth scope variants — shared across all auth polymorphic resources\n * (SsoConfig, SsoConnection, SiemExportConfig, SiemDeliveryDlq,\n * ScimTokens, ScimProvisioningConfig).\n \n /\n\n\nexport const AUTH_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n { parentResourceType: CoreResourceType.APPLICATION, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION], isPrimaryScope: true },\n];\n\n\n// ===============================\n// AUTHENTICATION METHOD DEFINITIONS\n// ===============================\n\n/*\n Authentication Factor Classification\n * Defines when an authentication method can be used in the flow\n /\nexport enum AuthFactorType {\n FIRST_ONLY = 'FIRST_ONLY', // Can only be used as first factor (primary auth)\n SECOND_ONLY = 'SECOND_ONLY', // Can only be used as second factor (MFA)\n FIRST_OR_SECOND = 'FIRST_OR_SECOND', // Can be used as either first or second factor\n ANY = 'ANY' // Can be used in any context (first, second, or standalone)\n}\n\n/\n Authentication Method Categories\n * Separates different types of authentication methods by scope and configuration\n /\nexport enum AuthMethodCategory {\n CREDENTIAL = 'CREDENTIAL', // Password-based credentials\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Extensible third-party SaaS OAuth2 (application-level)\n ORG_SSO = 'ORG_SSO', // Organization-restricted SSO (SAML/OpenID Connect)\n MFA_TOKEN = 'MFA_TOKEN', // Time-based or generated tokens for MFA\n BIOMETRIC = 'BIOMETRIC' // Modern biometric/passwordless methods\n}\n\n/\n The signing-key purposes an application holds, and the platform-service keys it verifies against.\n \n MOVED HERE FROM `saas-backend-lib` on 2026-09-02. These name identities that CROSS A PROCESS\n * BOUNDARY — the platform issues a token, the application verifies it; the application signs a\n * webhook, an integrator verifies it — and a name that crosses a boundary belongs in the shared\n * package rather than in the runtime on one side of it. The signing and verification MACHINERY did\n * not move; `jwt.backend.schemas.ts` re-exports both so no consumer changed.\n \n It also unblocked attesting `WILDO.IDENTITY.SIGNING_KEY_LIFECYCLE`: the retirement guarantee is\n * per key, and the assurance layer could not name the keys it applies to from a package it must not\n * depend on.\n \n Storage locations (unchanged, and stated here because the names are meaningless without them):\n * - private: `wildo_application_secrets.security.jwt.privateKey[key]`\n * - public: `wildo_application_config.jwt.publicKey[key]`, env `PLATFORM_<SERVICE_NAME>_PUBLIC_KEY`\n /\n/\n `iss` claim on every JWT the application signs, whichever key kind signs it. Receivers of\n * webhooks, workers and platform services pin this value; it is application-wide, not per key.\n /\nexport const APPLICATION_JWT_ISSUER = 'wildo-application' as const;\n\nexport enum JwtPrivateKeys {\n /* Application signing requests to platform services /\n APPLICATION_PLATFORM_REQUEST = 'APPLICATION_PLATFORM_REQUEST',\n /* Application signing requests to worker runtimes /\n APPLICATION_WORKER_REQUEST = 'APPLICATION_WORKER_REQUEST',\n /* Application signing webhooks /\n APPLICATION_WEBHOOK = 'APPLICATION_WEBHOOK',\n /* Application signing auth tokens /\n APPLICATION_AUTH_TOKEN = 'APPLICATION_AUTH_TOKEN',\n}\n\n/\n Platform Service JWT Public Keys\n * \n * Used to verify JWTs from platform services.\n * Public keys are stored in apps-manager env config.\n * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY\n /\nexport enum JwtPublicKeys {\n /* Platform service: apps-manager - central platform orchestrator /\n PLATFORM_APPS_MANAGER = 'PLATFORM_APPS_MANAGER',\n\n /* Platform service: crontabs-batches-manager - handles scheduled jobs /\n PLATFORM_CRONTABS_BATCHES_MANAGER = 'PLATFORM_CRONTABS_BATCHES_MANAGER',\n}\n\n/\n The OIDC / RFC 7519 protocol + security claim names the ID-token builder OWNS. `extraClaims` (the\n * scope-gated IDENTITY claims from the userinfo/ID-token resolver) must carry ONLY identity claims — these\n * reserved names are stripped BEFORE `extraClaims` is spread, so a same-named entry can never ride into the\n * ID token uncontrolled: a smuggled `nbf` (which would later make the token fail verification), a forged\n * `nonce` / `acr` / `amr` / `at_hash`, or a spoofed `iss` / `aud` / `sub` (the last are already overridden by\n * the server-set claims below — these are the ones the builder does NOT otherwise re-set). ONE named source\n * (closed vocabulary) so the strip list can never drift from the builder's own claim set.\n * semantic-literal-boundary: OIDC Core / RFC 7519 registered claim names.\n * assurance-control: WILDO.IDENTITY.TOKEN_INTEGRITY — an ID token's protocol/security claims are server-authored only.\n /\nexport const OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES: ReadonlySet<string> = new Set([\n // `sid` (OIDC Session Management / Front-Channel & Back-Channel Logout) is SERVER-AUTHORED here — it is\n // the End-User's OP session id the RP-Initiated Logout endpoint keys on (revocation-C). Reserving it bars\n // a client from smuggling its own `sid` via `extraClaims`, exactly like `nonce`/`acr`/`azp` below.\n 'iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti', 'azp', 'nonce', 'auth_time', 'at_hash', 'c_hash', 'acr', 'amr', 'sid',\n]);\n\n/\n @wildo_source:part:start saas.models.auth.methods facet:layer:shared facet:audience:app-developer\n \n Every way a person can prove who they are. An application chooses per USER TYPE which of these are\n * enabled, under `authMethodsEnabled` in the backend-authored config.\n \n Imported from `@wildo-ai/saas-models`.\n \n ## Enabling a method is necessary, and for four of them it is not sufficient\n \n \| method \| may be \| also required before it works \|\n * \|---\|---\|---\|\n * \| `PASSWORD` \| first \| a `passwordPolicy` on the user type \|\n * \| `MAGIC_LINK` \| first \| — \|\n * \| `PASSKEY` \| first or second \| `auth.passkeyConfig` (`rpName`, `rpId`) — the app does not boot without it \|\n * \| `SMS_OTP` \| first or second \| a verified phone number on the account \|\n * \| `TOTP` \| second \| enrolment (authenticator app or backup codes) \|\n * \| `EMAIL_OTP` \| second \| — \|\n * \| `EXTERNAL_OAUTH2` \| any \| a `socialOAuth2Providers` entry (client id + secret reference) AND a declared provider scope \|\n * \| `ORG_SAML` \| first or second \| a connection resource on the organization, AND a Java runtime with the schema-validation helper compiled on every host that serves SAML \|\n * \| `ORG_OPENID_CONNECT` \| first or second \| a connection resource on the organization \|\n \n ## Passkeys sign in without an email, and several accounts can share one device\n \n Enabling `PASSKEY` gives the sign-in screen two username-less entries on top of the passkey method\n * shown after an email: passkey AUTOFILL on the email field, and a \"Sign in with a passkey\" button. The\n * device lists every account the person holds a passkey for on this site, and the account that signs\n * in is the one the chosen passkey belongs to — whatever email, if any, was typed.\n \n - Every passkey is a discoverable credential. There is no setting to turn this off: sign-in\n * names no account to the device, so the device must be able to offer the account itself.\n * - The sign-in options are identical for every email, so they never reveal whether an account\n * exists or holds a passkey.\n * - A signed-in account is held to the same rules as a typed email: the frontend must be allowed\n * to sign in that account's user type, and an organization that restricts its domain to SSO refuses\n * a passkey sign-in exactly as it refuses a password.\n * - Re-authentication does not offer the username-less entries — a re-proof must be the same person.\n \n ## Organization SSO also requires an enabled method in the effective policy\n \n A configured connection alone does not enable `ORG_SAML` / `ORG_OPENID_CONNECT`. Check the user\n * type's methods and the application's `auth.orgAuthMethodPolicy`: RESTRICT_ONLY intersects,\n * EXPAND_WITHIN_SET permits additions from `auth.expandableOrgMethods`, and UNRESTRICTED uses the\n * organization's set. Explicit organization method overrides intersect across memberships.\n * Login-method expansion does not weaken the separate MFA, password or step-up requirements.\n \n ## Other refusals worth knowing before you pick one\n \n - *`EXTERNAL_OAUTH2` will not automatically link by email or create an account from a provider that does not report the\n email address as VERIFIED.** That is a refusal, not a warning — a provider whose claim mapping\n * does not surface a verified flag cannot be used for sign-up until the mapping is corrected.\n * - A missing SAML validation helper surfaces as an invalid signature, not as a missing\n * dependency, which sends an operator to the certificate instead of to the host.\n * - A person in an actively directory-managed organization loses every LOCAL first factor, by\n * design, so a credential minted before the directory took over cannot complete a session.\n * `EMAIL_OTP` is deliberately exempt because it is a second factor.\n \n ## ⚠️ Signing IN and signing UP are two different lists\n \n `authMethodsEnabled` decides how an EXISTING account authenticates. It does not create accounts.\n * Public registration is gated separately by `registration.allowedMethods` on the same user type,\n * which defaults to `[PASSWORD]` — so enabling `MAGIC_LINK` for sign-in and expecting people to\n * sign up with it gets a password-only signup and no error.\n \n Only four methods have a public-signup implementation — `PASSWORD`, `EXTERNAL_OAUTH2`,\n * `MAGIC_LINK`, `PASSKEY`. Listing any other (an SSO method, an MFA factor) is refused when the\n * config is built, deliberately: a method advertised to a registrant that the runtime cannot execute\n * fails them AFTER they have committed to it. Open registration also requires the list to be\n * non-empty.\n \n ## Which methods count as a second factor is a separate question\n \n `mfaPolicy` on the user type decides whether a second factor is required and narrows which of these\n * count. The guard that stops somebody removing their last second factor counts passkeys and a\n * verified phone number — it does NOT count `EMAIL_OTP`, so the arithmetic differs from what a person\n * might expect.\n \n Extensible at application level for `EXTERNAL_OAUTH2` providers; the method vocabulary itself is\n * closed.\n /\nexport enum AuthMethod {\n // Credential-based (First factor only)\n PASSWORD = 'PASSWORD',\n\n // Third-party SaaS OAuth2 (Application-level, extensible, any factor)\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Generic extensible OAuth2 provider\n\n // Organization-restricted SSO (First or second factor)\n ORG_SAML = 'ORG_SAML', // Organization SAML SSO\n ORG_OPENID_CONNECT = 'ORG_OPENID_CONNECT', // Organization OpenID Connect SSO\n\n // Passwordless (First factor only)\n MAGIC_LINK = 'MAGIC_LINK', // Magic Link via email\n\n // MFA tokens (Second factor only, except SMS_OTP which is FIRST_OR_SECOND)\n TOTP = 'TOTP', // Time-based One-Time Password\n SMS_OTP = 'SMS_OTP', // SMS One-Time Password\n EMAIL_OTP = 'EMAIL_OTP', // Email One-Time Password\n\n // Biometric/Modern (First or second factor)\n PASSKEY = 'PASSKEY' // WebAuthn/FIDO2 Passkeys\n}\n/\n Is this method strong enough for a policy that demands a STRONG second factor?\n \n Derived from the method's own channel rather than from a hand-kept weak list: a second factor\n * delivered to an email address is excluded, because email is not an acceptable channel for\n * out-of-band authentication at all — \"Email SHALL NOT be used for out-of-band authentication because\n * it may be vulnerable to: Access using only a password; Interception in transit or at intermediate\n * mail servers; Rerouting attacks\".\n \n spec-cite: NIST SP 800-63B-4 §3.1.3.1 \"Out-of-Band Authenticators\"\n * (https://pages.nist.gov/800-63-4/sp800-63b.html).\n \n This reproduces the set the previous rule produced, and that is deliberate. `requireStrongMFA`\n * used to be expressed as \"drop the factors that need no enrolment\", which removed `EMAIL_OTP`\n * because an address the account already proved needs no setup. That reasoning is sound and it was\n * reaching the right answer by a property that only coincides with the one it meant — a second\n * always-available factor on another channel would have been excluded for no reason, and a weak\n * factor that DID need enrolment would have passed. Deriving from the channel says the thing itself.\n \n What it deliberately does NOT change: `SMS_OTP` stays strong. NIST classes PSTN out-of-band as\n * the one RESTRICTED authenticator (§3.2.9) — permitted, with an obligation to offer an unrestricted\n * alternative — rather than as a prohibited channel, and promoting \"restricted\" to \"not strong\" is a\n * posture decision an application should make, not one this predicate should make for it.\n /\nexport function isStrongSecondFactor(method: AuthMethod): boolean {\n return AUTH_METHOD_EVIDENCE[method].channel !== AuthProofChannel.EMAIL;\n}\n/* @wildo_source:part:end saas.models.auth.methods /\n\n/\n Authentication Factor Levels\n /\nexport enum AuthFactor {\n SINGLE = 'SINGLE', // Single factor authentication\n MULTI = 'MULTI' // Multi-factor authentication required\n}\n\n/\n Authentication Factor Level (First or Second Factor)\n /\nexport enum AuthFactorLevel {\n IDENTIFICATION = 'IDENTIFICATION', // Identification only\n FIRST = 'FIRST', // First factor authentication\n SECOND = 'SECOND' // Second factor authentication (MFA)\n}\n\n/\n W4: Next step hint for frontend routing after auth state transitions.\n * Drives UI flow (MFA enrollment, onboarding, email verification, etc.).\n /\nexport enum AuthNextStep {\n MFA_ENROLLMENT = 'mfa_enrollment',\n ONBOARDING = 'onboarding',\n COMPLETE = 'complete',\n EMAIL_VERIFICATION = 'email_verification',\n PASSWORD_CHANGE = 'password_change',\n /\n A password-less public registration completed and a magic link is on its way (#463). Clicking it\n * proves the address and establishes the first session — there is nothing else for the registrant\n * to do, and nothing to authenticate with until they do it.\n /\n MAGIC_LINK_SENT = 'magic_link_sent',\n /\n As {@link MAGIC_LINK_SENT}, and the click leads to enrolling a passkey.\n \n A separate member rather than a flag on the one above, because the client renders different copy\n * from the first screen onward — \"check your email to finish\" versus \"check your email, then set up\n * your passkey\" — and a registrant told the wrong one abandons at the step they were not warned\n * about.\n \n The magic link is not incidental here: a passkey proves possession of an authenticator and says\n * nothing about an address, so a public passkey signup must prove the address some other way, and\n * the link is that proof. It is also, permanently, the recovery path — see the note on\n * `registerUser`.\n /\n PASSKEY_ENROLLMENT = 'passkey_enrollment',\n /\n An invitation was accepted and no session was issued (#1158). The user's effective policy disables the sign-in the\n * invitation link amounts to (possession of the email address), so they continue on the sign-in page with a method\n * their policy allows.\n /\n SIGN_IN_REQUIRED = 'sign_in_required',\n}\n\n/\n What a re-authentication proof is FOR (#1417). It decides which factors may mint the proof and which\n * doors accept it.\n \n - `STEP_UP`: a sensitive operation, removing a way to sign in, or turning TOTP off. Minted only from\n * a factor the effective `stepUpAuth.methods` accepts, as a `REAUTH` token.\n * - `BIND_AUTHENTICATOR`: adding a way to sign in. Minted from any factor the account holds, as a\n * `REAUTH_BIND` token, which only the binding doors accept.\n /\nexport enum ReAuthenticationPurpose {\n STEP_UP = 'step_up',\n BIND_AUTHENTICATOR = 'bind_authenticator',\n}\n\n/\n The frontend page a federated re-authentication returns to (#1441), inside the popup the step-up\n * dialog opened. The backend redirects there with `?code=` (a one-time `REAUTH_CODE_EXCHANGE` code) or\n * `?error=`; the page hands either to the window that opened it and closes. ONE constant, so the URL the\n * backend writes and the route the frontend mounts cannot disagree.\n /\nexport const REAUTHENTICATION_CALLBACK_PAGE_PATH = '/auth/reauth/callback';\n\n/\n A linked identity that can re-authenticate its account through its provider (#1441): what the step-up\n * dialog shows as \"Continue with <displayName>\", what `GET /auth/reauth/methods` lists beside the local\n * factors, and what `POST /auth/reauth/federated/authorize` accepts by `identityLinkId`.\n /\nexport interface ReAuthenticationIdentityLink {\n identityLinkId: string;\n providerRef: string;\n /* The provider's (social) or the connection's (enterprise) display name. /\n displayName: string;\n /* What a step-up policy names this factor by. /\n method: FederatedReAuthenticationMethod;\n}\n\n/\n The methods a linked identity re-authenticates with (#1441): `EXTERNAL_OAUTH2` for a social OIDC link,\n * `ORG_OPENID_CONNECT` for an enterprise OIDC one, `ORG_SAML` for an enterprise SAML one.\n /\nexport type FederatedReAuthenticationMethod = AuthMethod.EXTERNAL_OAUTH2 \| AuthMethod.ORG_OPENID_CONNECT \| AuthMethod.ORG_SAML;\n\n/\n W4.2: Session purpose — drives UI rendering and valid state transitions.\n /\nexport enum AuthSessionPurpose {\n LOGIN = 'login',\n REGISTRATION = 'registration',\n INVITATION = 'invitation',\n REAUTH = 'reauth',\n DEVICE_AUTH = 'device_auth',\n}\n\n/\n W4.6: MFA enrollment lifecycle state on UserCredentials.\n * Computed at user creation and updated on enrollment completion.\n /\nexport enum MfaEnrollmentState {\n NOT_REQUIRED = 'not_required',\n PENDING = 'pending',\n GRACE = 'grace',\n ENROLLED = 'enrolled',\n}\n\n// ===============================\n// AUTHENTICATION METHOD CLASSIFICATION\n// ===============================\n\n/\n @wildo_source:part:start saas.models.auth.methods facet:layer:shared facet:audience:app-developer\n \n ## What each method PROVES, and how the engine decides with it\n \n Three maps classify a method, and they answer different questions. Reach for the right one:\n \n \| map \| answers \|\n * \|---\|---\|\n * \| `AUTH_METHOD_FACTOR_MAP` \| WHERE it may sit — first factor, second factor, or either \|\n * \| `AUTH_METHOD_CATEGORY_MAP` \| which GROUP the sign-in page renders it in \|\n * \| `AUTH_METHOD_EVIDENCE` \| what it PROVES — the one the engine's factor rules read \|\n /\n\n/\n Authentication Method Factor Classification Map\n /\nexport const AUTH_METHOD_FACTOR_MAP: Record<AuthMethod, AuthFactorType> = {\n // First factor only - Primary credentials\n [AuthMethod.PASSWORD]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - Passwordless via email\n [AuthMethod.MAGIC_LINK]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - SSO redirect flows are not MFA ceremonies (B-SEC-1)\n [AuthMethod.EXTERNAL_OAUTH2]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_SAML]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthFactorType.FIRST_ONLY,\n\n // Second factor only - MFA tokens (except SMS_OTP which can be first or second)\n [AuthMethod.TOTP]: AuthFactorType.SECOND_ONLY,\n [AuthMethod.SMS_OTP]: AuthFactorType.FIRST_OR_SECOND,\n [AuthMethod.EMAIL_OTP]: AuthFactorType.SECOND_ONLY,\n\n // First or second factor - Modern biometric\n [AuthMethod.PASSKEY]: AuthFactorType.FIRST_OR_SECOND\n};\n\n/\n The order authentication methods are PRESENTED in, and the order that decides which one is offered first.\n \n ONE authority, deliberately. Until #1218 there were two and neither was: the backend returned methods in\n * `AUTH_METHOD_FACTOR_MAP` declaration order — so `defaultFirstFactorMethod` was `PASSWORD` because PASSWORD happens to\n * be the first key of an unrelated map — and the frontend threw that order away and re-sorted by a display list only it\n * could see. A domain routed to an enterprise identity provider still met the password form, with \"Continue with your\n * provider\" relegated to \"other methods\".\n \n The head is the one the sign-in page already used, promoted rather than invented: the organization's own identity\n * provider first, because a domain that routes to one is telling you where this person signs in; then the credentials a\n * person holds directly; then the delegated and one-time channels.\n \n The TRAILER orders the second-factor challenge, and it is strongest-first. Those members are second-factor-only\n * (or, for `SMS_OTP`, first-or-second), so they never appear in a first-factor list and their position here decides one\n * thing: what the MFA screen offers first. `TOTP` leads them because it is an unrestricted authenticator; `SMS_OTP`\n * follows because NIST classes PSTN out-of-band as RESTRICTED — permitted, with an obligation to offer an unrestricted\n * alternative — and `EMAIL_OTP` is last because email \"SHALL NOT be used for out-of-band authentication\".\n * spec-cite: NIST SP 800-63B-4 §3.2.9 (restricted authenticators) and §3.1.3.1 (out-of-band authenticators)\n * (https://pages.nist.gov/800-63-4/sp800-63b.html). The same two sections `isStrongSecondFactor` cites.\n \n The frontend's deleted display order put `TOTP` last, behind both OTP channels, for no recorded reason — that is what\n * this replaces, and the change is deliberate rather than incidental.\n \n TOTAL over the vocabulary, and pinned as total: a method added to `AuthMethod` tomorrow must be PLACED here, rather\n * than appearing silently at the end of whichever list happened to be sorted last.\n /\nexport const AUTH_METHOD_PRECEDENCE: readonly AuthMethod[] = [\n AuthMethod.ORG_SAML,\n AuthMethod.ORG_OPENID_CONNECT,\n AuthMethod.PASSWORD,\n AuthMethod.PASSKEY,\n AuthMethod.MAGIC_LINK,\n AuthMethod.EXTERNAL_OAUTH2,\n AuthMethod.TOTP,\n AuthMethod.SMS_OTP,\n AuthMethod.EMAIL_OTP,\n] as const;\n\n/\n Authentication Method Category Map\n /\nexport const AUTH_METHOD_CATEGORY_MAP: Record<AuthMethod, AuthMethodCategory> = {\n [AuthMethod.PASSWORD]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.MAGIC_LINK]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.EXTERNAL_OAUTH2]: AuthMethodCategory.EXTERNAL_OAUTH2,\n [AuthMethod.ORG_SAML]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.TOTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.SMS_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.EMAIL_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.PASSKEY]: AuthMethodCategory.BIOMETRIC\n};\n\n/\n The factor CATEGORY a method proves, in the classical three — plus the one Wildo cannot classify.\n \n `FEDERATED` is not a fourth kind of factor. It means the proof happened at an identity provider, so\n * what was proved is the IdP's answer and not ours: the engine reads it from the assertion's `acr`\n * demands and assurance evidence rather than declaring it here. Giving a federated method a concrete\n * category would be asserting something about somebody else's ceremony.\n /\nexport enum AuthFactorCategory {\n /* Something you know. /\n KNOWLEDGE = 'KNOWLEDGE',\n /* Something you have. /\n POSSESSION = 'POSSESSION',\n /* Something you are. /\n INHERENCE = 'INHERENCE',\n /* Proved elsewhere; the assertion says what, not this map. /\n FEDERATED = 'FEDERATED',\n}\n\n/\n The CHANNEL a method's proof travels over — the axis that decides whether two factors are\n * independent.\n \n Two factors that share a channel are one factor counted twice: whoever holds the channel holds\n * both. A magic link and an email one-time code are the worked example, and the law states the rule\n * directly — \"the breach of one of the elements does not compromise the reliability of the other\n * elements\".\n \n spec-cite: Commission Delegated Regulation (EU) 2018/389, Art. 9(1) \"Independence of the elements\"\n * (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R0389). That regulation binds\n * payment service providers; it is cited here as the clearest statement of the principle, never as an\n * obligation a Wildo application inherits.\n \n `NONE` means the proof does not travel: a password is typed, a TOTP code is computed from a secret\n * shared once at enrolment. Those can never collide with anything, which is why the rule is expressed\n * as \"not the same channel\" rather than as a list of forbidden pairs.\n /\nexport enum AuthProofChannel {\n /* Nothing is delivered — the proof is presented directly. /\n NONE = 'NONE',\n /* Delivered to a mailbox. /\n EMAIL = 'EMAIL',\n /* Delivered over the public switched telephone network. /\n PSTN = 'PSTN',\n /* Produced by an authenticator on the device, and never transmitted. /\n LOCAL_AUTHENTICATOR = 'LOCAL_AUTHENTICATOR',\n /* Carried in an assertion from an identity provider. /\n FEDERATED = 'FEDERATED',\n}\n\n/\n Whether ONE ceremony of this method can prove TWO factors by itself.\n \n Only a cryptographic authenticator can, and only when an activation factor unlocked its key —\n * \"a multi-factor cryptographic authenticator is 'something you have' and is activated by an\n * activation factor that represents either 'something you know' or 'something you are'\".\n \n spec-cite: NIST SP 800-63B-4 §3.1.7 \"Multi-Factor Cryptographic Authentication\"\n * (https://pages.nist.gov/800-63-4/sp800-63b.html).\n \n `WHEN_USER_VERIFIED` is therefore a CONDITION, not a property: the same passkey proves two factors\n * in a ceremony that verified the person and one in a ceremony that did not, and both produce a valid\n * assertion. The engine reads the WebAuthn `UV` flag off the assertion to tell them apart.\n /\nexport enum AuthSelfSufficientMultiFactor {\n /* One ceremony, one factor — always. /\n NEVER = 'NEVER',\n /* Two factors when the authenticator locally verified the person, one when it did not. /\n WHEN_USER_VERIFIED = 'WHEN_USER_VERIFIED',\n}\n\n/* What one authentication method proves. See {@link AUTH_METHOD_EVIDENCE}. /\nexport interface AuthMethodEvidence {\n readonly factorCategory: AuthFactorCategory;\n readonly channel: AuthProofChannel;\n /\n Whether presenting this method to an impostor verifier is useless to the impostor.\n \n True for `PASSKEY` alone, and that is not a judgement — \"authenticators that involve the manual\n * entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be\n * considered phishing-resistant because the manual entry does not bind the authenticator output to\n * the specific session being authenticated\". A typed code is relayable, TOTP included.\n \n spec-cite: NIST SP 800-63B-4 §3.2.5 \"Phishing Resistance\"\n * (https://pages.nist.gov/800-63-4/sp800-63b.html).\n \n A federated method is `false` because Wildo cannot know how the IdP authenticated the person;\n * that question is answered by the connection's `acr` demands, not by this map.\n /\n readonly phishingResistant: boolean;\n readonly selfSufficientMultiFactor: AuthSelfSufficientMultiFactor;\n}\n\n/\n Authentication Method Evidence Map — what each method PROVES.\n \n The two maps above say where a method may sit and how it is grouped on screen. Neither says what it\n * proves, so every rule that depends on the strength of a proof used to be hand-applied at its own\n * door and derived differently at each one: the MFA waiver matched a method NAME, `requireStrongMFA`\n * was expressed as \"drop the ones needing no enrolment\", and nothing anywhere expressed the channel —\n * which is why a magic-link sign-in could be completed by an email code to the same mailbox.\n \n Being `Record<AuthMethod, …>` is the point: a method added to the vocabulary tomorrow does not\n * compile until it declares what it proves, so the rules below stay total over the vocabulary instead\n * of quietly omitting it.\n \n ## Reading the rows\n \n - `MAGIC_LINK` is POSSESSION, not knowledge. It sits beside `PASSWORD` in\n * `AUTH_METHOD_CATEGORY_MAP` because both are rendered as \"credentials\", and that grouping is a\n * screen concern. What a magic link proves is control of a mailbox.\n * - `TOTP` has NO channel. The secret is shared once at enrolment and the code is computed\n * locally, so nothing is delivered and it can never collide with another factor's channel.\n * - The three federated methods are `FEDERATED` on both axes. Their strength question already has\n * an answer — `externalAssuranceEnforcement` and the connection's `acr` demands — and this map must\n * not grow a second, competing one.\n \n Imported from `@wildo-ai/saas-models`.\n /\nexport const AUTH_METHOD_EVIDENCE: Record<AuthMethod, AuthMethodEvidence> = {\n [AuthMethod.PASSWORD]: {\n factorCategory: AuthFactorCategory.KNOWLEDGE,\n channel: AuthProofChannel.NONE,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.MAGIC_LINK]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.EMAIL,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.EMAIL_OTP]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.EMAIL,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.SMS_OTP]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.PSTN,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.TOTP]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.NONE,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.PASSKEY]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.LOCAL_AUTHENTICATOR,\n phishingResistant: true,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.WHEN_USER_VERIFIED,\n },\n [AuthMethod.EXTERNAL_OAUTH2]: {\n factorCategory: AuthFactorCategory.FEDERATED,\n channel: AuthProofChannel.FEDERATED,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.ORG_SAML]: {\n factorCategory: AuthFactorCategory.FEDERATED,\n channel: AuthProofChannel.FEDERATED,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.ORG_OPENID_CONNECT]: {\n factorCategory: AuthFactorCategory.FEDERATED,\n channel: AuthProofChannel.FEDERATED,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n};\n\n/\n Do these two methods prove things a single breach could reach?\n \n The rule the engine applies when it offers or accepts a SECOND factor: a factor whose channel the\n * FIRST factor already proved is not a second factor. `NONE` never collides, because nothing is\n * delivered over it.\n \n @example\n * sharesProofChannel(AuthMethod.MAGIC_LINK, AuthMethod.EMAIL_OTP); // true — one mailbox, counted twice\n * sharesProofChannel(AuthMethod.PASSWORD, AuthMethod.EMAIL_OTP); // false — nothing is delivered to prove a password\n /\nexport function sharesProofChannel(first: AuthMethod, second: AuthMethod): boolean {\n const firstChannel = AUTH_METHOD_EVIDENCE[first].channel;\n if (firstChannel === AuthProofChannel.NONE) {\n return false;\n }\n return firstChannel === AUTH_METHOD_EVIDENCE[second].channel;\n}\n/\n The RFC 8176 `amr` values each method may claim, and nothing else (#1248).\n \n `amr` is what an ID token tells a relying party about HOW the person authenticated. Wildo demands\n * exactly this of every identity provider it trusts — `oauth2-authentication` reads an upstream `amr`\n * as session evidence — and published none of its own, so a client receiving a Wildo ID token could not\n * make the decision Wildo insists on making about its own upstreams. That asymmetry is the defect.\n \n spec-cite: RFC 8176 \"Authentication Method Reference Values\", §2 — the registry of short names and\n * their definitions (https://www.rfc-editor.org/rfc/rfc8176.html). Every value below is taken from\n * that registry; none is invented.\n \n ## Only REGISTERED values, which is why three methods contribute none\n \n A value outside the registry is a private string a generic relying party cannot read, so an\n * unregistered \"email\" or \"sso\" would be worse than silence — the same reasoning that keeps `acr`\n * unpublished until Wildo defines what its values mean.\n \n - The federated methods contribute nothing. The registry has no value for \"the person proved\n * themselves to somebody else and that party vouched for them\", and restating the UPSTREAM's `amr`\n * as our own would assert a proof this application never observed. What the upstream proved is the\n * upstream's claim to make.\n * - `MAGIC_LINK` and `EMAIL_OTP` claim `mca`, \"Multiple-channel authentication involving\n * communication over distinct channels\", which is literally what they are: the credential travels by\n * email, a channel distinct from the browser. That is applying a registered definition, not\n * stretching one. `EMAIL_OTP` also claims `otp`, which it plainly is; `MAGIC_LINK` is not an OTP —\n * the link itself is the credential.\n * - `PASSKEY` claims `user`, \"User presence test\", because WebAuthn always tests presence. It does\n * NOT claim `hwk` or `swk`: which is true depends on whether the credential is single-device or\n * synced, and the session does not carry the credential's device type. Claiming either would be a\n * guess about the authenticator, and `hwk` is precisely what a relying party reads as\n * phishing-resistant hardware.\n /\nexport const AUTH_METHOD_AMR: Record<AuthMethod, readonly string[]> = {\n [AuthMethod.PASSWORD]: ['pwd'],\n [AuthMethod.TOTP]: ['otp'],\n [AuthMethod.SMS_OTP]: ['sms', 'otp'],\n [AuthMethod.EMAIL_OTP]: ['mca', 'otp'],\n [AuthMethod.MAGIC_LINK]: ['mca'],\n [AuthMethod.PASSKEY]: ['user'],\n [AuthMethod.EXTERNAL_OAUTH2]: [],\n [AuthMethod.ORG_OPENID_CONNECT]: [],\n [AuthMethod.ORG_SAML]: [],\n};\n\n/\n What an ID token may say about how THIS session was authenticated (#1248).\n \n Returns the sorted, de-duplicated registered `amr` values for the factors the session actually\n * completed — never for the factors it could have used. An empty result means the session has nothing\n * a relying party could read, and the caller omits the claim rather than emitting `[]`: an empty array\n * asserts \"authenticated by no method\", which is false, where an absent claim correctly says nothing.\n \n ## `mfa` is DERIVED, and it is the value that matters most\n \n \"Multiple-factor authentication\" is claimed when the session genuinely holds two independent proofs,\n * decided by the same {@link AUTH_METHOD_EVIDENCE} channels that decide whether a second factor is\n * admissible — so an ID token cannot claim `mfa` for a pair this application's own sign-in doors would\n * refuse as sharing a channel. A password plus an email OTP is two methods and one mailbox; it does\n * not claim `mfa`.\n \n A single passkey claims `mfa` when the authenticator locally verified the person, because that\n * ceremony IS two factors — possession of the authenticator and the activation that unlocked it — and\n * the WebAuthn UV flag is the only report that the activation happened. That is the distinction the\n * acceptance asks an ID token to carry, and it is readable only because the verifier reads the flag\n * off the assertion rather than inferring it from the policy that requested it.\n /\nexport function deriveAuthenticationMethodReferences(\n completedFactors: readonly AuthMethod[],\n ceremony?: { passkeyUserVerified?: boolean },\n): string[] {\n const values = new Set<string>();\n for (const method of completedFactors) {\n for (const value of AUTH_METHOD_AMR[method] ?? []) values.add(value);\n }\n\n const userVerifiedPasskey = completedFactors.includes(AuthMethod.PASSKEY) && ceremony?.passkeyUserVerified === true;\n const independentPair = completedFactors.some((first, index) =>\n completedFactors.slice(index + 1).some((second) => !sharesProofChannel(first, second)));\n if (userVerifiedPasskey \|\| independentPair) values.add('mfa');\n\n // Sorted so the claim is stable across sign-ins completing the same factors in a different order —\n // a relying party comparing tokens should not see a difference that is only iteration order.\n return [...values].sort();\n}\n\n/* @wildo_source:part:end saas.models.auth.methods /\n\n/\n Scope type for auth policies — organization-level vs application-level.\n \n Declared before the browser-safe available-method schema because that schema\n * evaluates this enum at module initialization time.\n /\nexport enum AuthScopeType {\n ORGANIZATION = 'organization',\n APPLICATION = 'application',\n}\n\n/\n Public, browser-safe configuration attached to an available auth method.\n \n The fields span passkey and enterprise-SSO methods, but every field is named\n * and typed: this cross-layer contract must never collapse back to\n * `Record<string, any>`, which previously forced frontend assertions for the\n * tenant scope and connection identity.\n /\nexport const AvailableMethodConfigSchema = z.object({\n rpName: z.string().optional(),\n rpId: z.string().optional(),\n displayName: z.string().optional(),\n providerRef: z.string().optional(),\n connectionId: z.string().optional(),\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n loginUrl: z.string().optional(),\n});\n\nexport type AvailableMethodConfig = z.infer<typeof AvailableMethodConfigSchema>;\n\nexport const AvailableMethodSchema = z.object({\n method: z.enum(AuthMethod),\n factorType: z.enum(AuthFactorType),\n category: z.enum(AuthMethodCategory),\n canBeFirstFactor: z.boolean(),\n canBeSecondFactor: z.boolean(),\n\n /\n The organization that owns this address requires THIS method as the first factor.\n \n True only where an enterprise connection's `enforcement.requireSSO` is set, so it appears on\n * `ORG_SAML` and `ORG_OPENID_CONNECT` and nowhere else. It is not the same statement as \"this is\n * the only method offered\": when the tenant allows a password fallback, or names break-glass\n * accounts, the offered list deliberately KEEPS the password field for every address at the domain\n * (enumeration safety — narrowing it for the listed accounts would publish who they are). This flag\n * is what lets the sign-in page say that the password beside it is a fallback rather than a peer.\n /\n enforcedFirstFactor: z.boolean(),\n\n /\n The account's policy requires a second factor, and this method can serve as one.\n \n Meaningful only in a SECOND-factor list. It is derived from `mfaPolicy.requireMFA` together with\n * the method's factor classification, so it is true of every acceptable second factor at once — it\n * says \"a second factor is mandatory\", never \"this particular one is\".\n \n ## Why this is two fields and not one\n \n Both of these were a single `required: boolean` until #1220, written by two branches with\n * incompatible meanings, and `_buildAvailableMethodObject` builds BOTH the first- and second-factor\n * lists — so each writer was noise in the other's list. In the FIRST-factor list a passkey came back\n * `required: true` merely because the user type demands MFA, where it means nothing at all; the flag\n * was read by no frontend code, so nothing ever noticed. A consumer taking it at face value would\n * have presented a passkey as a mandatory first factor, which is the opposite of true.\n \n Two names, one writer each, each meaningful in exactly one list. Merging them back would restore a\n * field whose meaning depends on which list you found it in, which is not a meaning.\n /\n satisfiesRequiredSecondFactor: z.boolean(),\n\n // Provider-specific information\n oauth2ProviderRefs: z.array(z.string()).optional(), // For third-party OAuth2\n ssoIds: z.array(z.string()).optional(), // For organization SSO\n organizationRestricted: z.boolean().default(false),\n\n // Integration capabilities\n supportsIntegrations: z.boolean().default(false),\n availableIntegrations: z.array(z.string()).default([]).optional(),\n\n // Public configuration\n config: AvailableMethodConfigSchema.optional()\n});\n\n\nexport type AvailableMethod = z.infer<typeof AvailableMethodSchema>;\n\n// ===============================\n// CROSS-LAYER CONSTANTS\n// ===============================\n\n/\n Error codes used in redirect query params (backend → frontend).\n * Backend appends `?error=<code>` to redirect URLs; frontend reads and displays.\n /\nexport enum AuthRedirectErrorCode {\n SAML_LOGIN_FAILED = 'saml_login_failed',\n SAML_AUTH_FAILED = 'saml_auth_failed',\n SAML_SLO_FAILED = 'saml_slo_failed',\n MISSING_PARAMS = 'missing_params',\n OAUTH_FAILED = 'oauth_failed',\n}\n\n/\n Ownership class of an external authentication connection.\n \n This is intentionally independent from {@link AuthScopeType}: a social\n * connection has no enterprise tenant scope, while an enterprise connection\n * must carry one.\n /\nexport enum SsoConnectionType {\n SOCIAL = 'social',\n ENTERPRISE = 'enterprise',\n}\n\n/\n Mechanism that established an external identity.\n \n This is wider than the SSO protocol vocabulary because SCIM establishes and\n * maintains identity links without being an interactive SSO protocol.\n */\nexport enum ExternalIdentitySource {\n OAUTH2 = 'oauth2',\n OIDC = 'oidc',\n SAML = 'saml',\n SCIM = 'scim',\n}\n"]}

package/dist/esm/security/authentications/authentication.shared.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.utils.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/authentication.shared.utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,cAAc,EAA4E,MAAM,iCAAiC,CAAC;AACvJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAA+B,MAAM,sDAAsD,CAAC;AACxH,OAAO,EAAyB,KAAK,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAGzG;;GAEG;AACH,qBAAa,SAAS;IACpB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOpD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOrD;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,SAAS;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE;IAKrF;;OAEG;IACH,MAAM,CAAC,qBAAqB,IAAI,UAAU,EAAE;IAU5C;;OAEG;IACH,MAAM,CAAC,sBAAsB,IAAI,UAAU,EAAE;IAU7C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc;IAIxD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB;IAIhE;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAI5D;;OAEG;IACH,MAAM,CAAC,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAK7D;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO;IAOnF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CAAC,qCAAqC,IAAI,UAAU,EAAE;IAI5D;;;;;;;OAOG;IACH,MAAM,CAAC,gCAAgC,IAAI,UAAU,EAAE;IAKvD;;;;;;;;;;OAUG;IACH,MAAM,CAAC,8BAA8B,CAAC,IAAI,EAAE;QAC1C,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE;IASnC;;;;;;;OAOG;IACH,MAAM,CAAC,iCAAiC,CAAC,IAAI,EAAE;QAC7C,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE;IAInC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,6BAA6B,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,CAAC,EAAE,wBAAwB,GAC1C;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;CA4B5C"}
1	+ {"version":3,"file":"authentication.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,cAAc,EAA4E,MAAM,iCAAiC,CAAC;AACvJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAA+B,MAAM,sDAAsD,CAAC;AACxH,OAAO,EAAyB,KAAK,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAGzG;;GAEG;AACH,qBAAa,SAAS;IACpB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOpD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOrD;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,SAAS;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE;IAKrF;;OAEG;IACH,MAAM,CAAC,qBAAqB,IAAI,UAAU,EAAE;IAU5C;;OAEG;IACH,MAAM,CAAC,sBAAsB,IAAI,UAAU,EAAE;IAU7C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc;IAIxD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB;IAIhE;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAI5D;;OAEG;IACH,MAAM,CAAC,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAK7D;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO;IAOnF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CAAC,qCAAqC,IAAI,UAAU,EAAE;IAI5D;;;;;;;OAOG;IACH,MAAM,CAAC,gCAAgC,IAAI,UAAU,EAAE;IAKvD;;;;;;;;;;OAUG;IACH,MAAM,CAAC,8BAA8B,CAAC,IAAI,EAAE;QAC1C,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE;IASnC;;;;;;;OAOG;IACH,MAAM,CAAC,iCAAiC,CAAC,IAAI,EAAE;QAC7C,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE;IAInC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,6BAA6B,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,CAAC,EAAE,wBAAwB,GAC1C;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;CA4B5C"}