{"version":3,"sources":["../src/auth/auth.enums.ts","../src/auth/auth.schemas.ts","../src/auth/mfa.enums.ts","../src/auth/mfa.schemas.ts","../src/auth/reauth.enums.ts","../src/auth/reauth.schemas.ts"],"names":["IdentityProvider","LinkRequiredReasonEnum","OauthResolveKind","PASSWORD_REGEX","PASSWORD_MESSAGE","PasswordSchema","z","RegisterRequestSchema","UserRole","RegisterResponseSchema","LoginRequestSchema","VerifyOtpRequestSchema","ResendOtpRequestSchema","VerifyOtpResponseSchema","LoginResponseSchema","SwitchProfileRequestSchema","SwitchProfileResponseSchema","RefreshTokenRequestSchema","LogoutRequestSchema","ForgotPasswordRequestSchema","ForgotPasswordResponseSchema","ResetPasswordRequestSchema","ChangePasswordRequestSchema","OauthStartQuerySchema","OauthStartResponseSchema","OauthExchangeRequestSchema","OauthDirectTokenRequestSchema","OauthLinkCompleteRequestSchema","v","OauthLinkSendOtpRequestSchema","LinkRequiredResponseSchema","OauthLinkSendOtpResponseSchema","ProvidersListItemSchema","ProvidersListResponseSchema","OauthLinkCompleteEmailRequestSchema","MFA_ACTIONS","TotpCodeSchema","RecoveryCodeSchema","EnableMfaBodySchema","DisableMfaBodySchema","MfaChallengeBodySchema","MfaVerifyBodySchema","REAUTH_ACTIONS","ConfirmPinSchema","ReauthTokenResponseSchema"],"mappings":"kEAAO,IAAMA,EAAmB,CAC9B,MAAA,CAAQ,SACR,KAAA,CAAO,OAAA,CACP,SAAU,UAAA,CACV,OAAA,CAAS,SACX,CAAA,CAEaC,CAAAA,CAAyB,CACpC,WAAA,CAAa,aAAA,CACb,WAAY,eACd,CAAA,CAGaC,EAAmB,CAC9B,SAAA,CAAW,YACX,SAAA,CAAW,WAAA,CACX,cAAe,eACjB,MCbMC,CAAAA,CAAiB,IAAI,OACzB,yFACF,CAAA,CAEMC,EACJ,gIAAA,CAEWC,CAAAA,CAAiBC,EAC3B,MAAA,EAAO,CACP,GAAA,CAAI,CAAA,CAAGF,CAAgB,CAAA,CACvB,MAAMD,CAAAA,CAAgBC,CAAgB,EAK5BG,CAAAA,CAAwBD,CAAAA,CAAE,OAAO,CAC5C,KAAA,CAAOA,EAAE,KAAA,EAAM,CAAE,aAAY,CAC7B,QAAA,CAAUD,EACV,SAAA,CAAWC,CAAAA,CAAE,QAAO,CACpB,QAAA,CAAUA,EAAE,MAAA,EAAO,CACnB,KAAMA,CAAAA,CAAE,IAAA,CAAKE,GAAQ,CAAA,CAAE,QAAA,EACzB,CAAC,CAAA,CAKYC,EAAyBH,CAAAA,CAAE,MAAA,CAAO,CAC7C,QAAA,CAAUA,CAAAA,CAAE,QAAO,CACnB,SAAA,CAAWA,EAAE,MAAA,EAAO,CACpB,IAAA,CAAMA,CAAAA,CAAE,IAAA,CAAKE,GAAQ,EAAE,QAAA,EACzB,CAAC,CAAA,CAKYE,CAAAA,CAAqBJ,EAAE,MAAA,CAAO,CACzC,MAAOA,CAAAA,CAAE,KAAA,GAAQ,WAAA,EAAY,CAC7B,SAAUD,CAAAA,CACV,IAAA,CAAMC,EAAE,IAAA,CAAKE,GAAQ,EAAE,QAAA,EACzB,CAAC,CAAA,CAEYG,CAAAA,CAAyBL,EAAE,MAAA,CAAO,CAC7C,IAAKA,CAAAA,CAAE,MAAA,GAAS,MAAA,CAAO,CAAC,EACxB,SAAA,CAAWA,CAAAA,CAAE,QAAO,CACpB,IAAA,CAAMA,EAAE,IAAA,CAAK,CAAC,cAAA,CAAgB,eAAe,CAAC,CAChD,CAAC,CAAA,CAEYM,CAAAA,CAAyBN,EAAE,MAAA,CAAO,CAC7C,UAAWA,CAAAA,CAAE,MAAA,GACb,IAAA,CAAMA,CAAAA,CAAE,KAAK,CAAC,cAAA,CAAgB,eAAe,CAAC,CAChD,CAAC,CAAA,CAEYO,CAAAA,CAA0BP,EAAE,MAAA,CAAO,CAC9C,QAASA,CAAAA,CAAE,OAAA,GACX,OAAA,CAASA,CAAAA,CAAE,QAAO,CAClB,SAAA,CAAWA,EAAE,MAAA,EAAO,CAAE,UACxB,CAAC,EAKYQ,CAAAA,CAAsBR,CAAAA,CAAE,OAAO,CAC1C,WAAA,CAAaA,CAAAA,CAAE,MAAA,EAAO,CACtB,YAAA,CAAcA,EAAE,MAAA,EAAO,CACvB,QAASA,CAAAA,CAAE,MAAA,GACX,SAAA,CAAWA,CAAAA,CAAE,QAAO,CACpB,SAAA,CAAWA,EAAE,OAAA,CAAQ,QAAQ,EAE7B,cAAA,CAAgBA,CAAAA,CAAE,MAAMA,CAAAA,CAAE,IAAA,CAAKE,GAAQ,CAAC,CAAA,CAExC,eAAgBF,CAAAA,CAAE,IAAA,CAAKE,GAAQ,CAAA,CAAE,QAAA,EACnC,CAAC,CAAA,CAKYO,EAA6BT,CAAAA,CAAE,MAAA,CAAO,CACjD,IAAA,CAAMA,CAAAA,CAAE,KAAKE,GAAQ,CACvB,CAAC,CAAA,CAKYQ,CAAAA,CAA8BV,CAAAA,CAAE,MAAA,CAAO,CAClD,cAAA,CAAgBA,EAAE,IAAA,CAAKE,GAAQ,CACjC,CAAC,CAAA,CAKYS,EAA4BX,CAAAA,CAAE,MAAA,CAAO,CAChD,YAAA,CAAcA,CAAAA,CAAE,QAClB,CAAC,EAEYY,CAAAA,CAAsBZ,CAAAA,CAAE,OAAO,CAC1C,YAAA,CAAcA,EAAE,MAAA,EAAO,CACvB,YAAaA,CAAAA,CAAE,MAAA,EACjB,CAAC,CAAA,CAKYa,EAA8Bb,CAAAA,CAAE,MAAA,CAAO,CAClD,KAAA,CAAOA,CAAAA,CAAE,OAAM,CAAE,WAAA,EACnB,CAAC,CAAA,CAEYc,EAA+Bd,CAAAA,CAAE,MAAA,CAAO,CACnD,WAAA,CAAaA,CAAAA,CAAE,MAAA,GACf,cAAA,CAAgBA,CAAAA,CAAE,QAAO,CACzB,aAAA,CAAeA,EAAE,MAAA,EACnB,CAAC,CAAA,CAKYe,CAAAA,CAA6Bf,EAAE,MAAA,CAAO,CACjD,MAAOA,CAAAA,CAAE,MAAA,GACT,WAAA,CAAaD,CACf,CAAC,CAAA,CAKYiB,CAAAA,CAA8BhB,EAAE,MAAA,CAAO,CAClD,gBAAiBD,CAAAA,CACjB,WAAA,CAAaA,CACf,CAAC,CAAA,CAEYkB,EAAwBjB,CAAAA,CAAE,MAAA,CAAO,CAC5C,UAAA,CAAYA,CAAAA,CAAE,QAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA,CAAE,QAAA,EAC1C,CAAC,CAAA,CAEYkB,CAAAA,CAA2BlB,EAAE,MAAA,CAAO,CAC/C,aAAcA,CAAAA,CAAE,GAAA,EAClB,CAAC,CAAA,CAEYmB,EAA6BnB,CAAAA,CAAE,MAAA,CAAO,CACjD,OAAA,CAASA,CAAAA,CAAE,QAAO,CAAE,GAAA,CAAI,EAAE,CAAA,CAAE,GAAA,CAAI,GAAG,CACrC,CAAC,CAAA,CAEYoB,EAAgCpB,CAAAA,CAAE,MAAA,CAAO,CACpD,OAAA,CAASA,CAAAA,CAAE,QAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA,CACnC,KAAA,CAAOA,EAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAChC,iBAAA,CAAmBA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,IAAI,CAAA,CAAE,UAAS,CACxD,IAAA,CAAMA,EACH,MAAA,CAAO,CACN,KAAMA,CAAAA,CACH,MAAA,CAAO,CACN,SAAA,CAAWA,CAAAA,CAAE,QAAO,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,GAAW,QAAA,EAAS,CACnD,SAAUA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS,CAAE,UAC3C,CAAC,CAAA,CACA,QAAA,EACL,CAAC,EACA,QAAA,EACL,CAAC,CAAA,CAEYqB,CAAAA,CAAiCrB,EAC3C,MAAA,CAAO,CACN,YAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,EAAE,EAAE,GAAA,CAAI,GAAG,EACvC,QAAA,CAAUD,CAAAA,CAAe,UAAS,CAClC,YAAA,CAAcC,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA,CAAE,UAAS,CAClD,GAAA,CAAKA,EAAE,MAAA,EAAO,CAAE,OAAO,CAAC,CAAA,CAAE,UAC5B,CAAC,CAAA,CACA,MAAA,CACEsB,CAAAA,EAAOA,CAAAA,CAAE,SAAW,IAAA,CAAOA,CAAAA,CAAE,cAAgBA,CAAAA,CAAE,GAAA,CAChD,kEACF,CAAA,CAEWC,CAAAA,CAAgCvB,EAAE,MAAA,CAAO,CACpD,YAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,EAAE,EAAE,GAAA,CAAI,GAAG,CACzC,CAAC,CAAA,CAEYwB,EAA6BxB,CAAAA,CAAE,MAAA,CAAO,CACjD,IAAA,CAAMA,CAAAA,CAAE,QAAQ,eAAe,CAAA,CAC/B,OAAQA,CAAAA,CAAE,IAAA,CAAKL,CAAsB,CAAA,CACrC,WAAA,CAAaK,EAAE,MAAA,EAAO,CACtB,YAAaA,CAAAA,CAAE,MAAA,EAAO,CACtB,WAAA,CAAaA,CAAAA,CAAE,OAAA,GACf,QAAA,CAAUA,CAAAA,CAAE,KAAKN,CAAgB,CACnC,CAAC,CAAA,CAEY+B,CAAAA,CAAiCzB,EAAE,MAAA,CAAO,CACrD,aAAcA,CAAAA,CAAE,MAAA,EAClB,CAAC,CAAA,CAEY0B,EAA0B1B,CAAAA,CAAE,MAAA,CAAO,CAC9C,IAAA,CAAMA,CAAAA,CAAE,KAAKN,CAAgB,CAAA,CAC7B,QAASM,CAAAA,CAAE,OAAA,GACX,SAAA,CAAWA,CAAAA,CAAE,SACf,CAAC,EAEY2B,CAAAA,CAA8B3B,CAAAA,CAAE,OAAO,CAClD,SAAA,CAAWA,EAAE,KAAA,CAAM0B,CAAuB,CAC5C,CAAC,CAAA,CAEYE,CAAAA,CAAsC5B,EAAE,MAAA,CAAO,CAC1D,YAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,EAAE,EAAE,GAAA,CAAI,GAAG,EACvC,KAAA,CAAOA,CAAAA,CAAE,OAAM,CAAE,GAAA,CAAI,GAAG,CAC1B,CAAC,EC1MM,IAAM6B,CAAAA,CAAc,CACzB,QAAA,CAAU,UAAA,CACV,aAAc,cAAA,CACd,QAAA,CAAU,WACV,WAAA,CAAa,aAAA,CACb,0BAA2B,2BAC7B,MCHaC,CAAAA,CAAiB9B,CAAAA,CAC3B,QAAO,CACP,IAAA,EAAK,CACL,KAAA,CAAM,SAAA,CAAW,2BAA2B,EAElC+B,CAAAA,CAAqB/B,CAAAA,CAC/B,QAAO,CACP,IAAA,GACA,KAAA,CAAM,uBAAA,CAAyB,2BAA2B,CAAA,CAEhDgC,CAAAA,CAAsBhC,EAAE,MAAA,CAAO,CAC1C,SAAU8B,CACZ,CAAC,EAEYG,CAAAA,CAAuBjC,CAAAA,CACjC,OAAO,CACN,QAAA,CAAU8B,EAAe,QAAA,EAAS,CAClC,aAAcC,CAAAA,CAAmB,QAAA,EACnC,CAAC,CAAA,CACA,OACET,CAAAA,EAAM,CAAC,CAACA,CAAAA,CAAE,QAAA,EAAa,CAAC,CAACA,CAAAA,CAAE,aAC5B,iDACF,CAAA,CAEWY,CAAAA,CAAyBlC,CAAAA,CAAE,MAAA,CAAO,CAC7C,OAAQA,CAAAA,CAAE,IAAA,CAAK6B,CAAW,CAC5B,CAAC,EAEYM,CAAAA,CAAsBnC,CAAAA,CAChC,OAAO,CACN,cAAA,CAAgBA,EAAE,MAAA,EAAO,CAAE,IAAI,EAAA,CAAI,4BAA4B,EAC/D,QAAA,CAAU8B,CAAAA,CAAe,UAAS,CAClC,YAAA,CAAcC,EAAmB,QAAA,EACnC,CAAC,CAAA,CACA,MAAA,CACET,GAAM,CAAC,CAACA,EAAE,QAAA,EAAa,CAAC,CAACA,CAAAA,CAAE,YAAA,CAC5B,iDACF,EC9BK,IAAMc,EAAiB,CAC5B,QAAA,CAAU,UAAA,CACV,YAAA,CAAc,cAAA,CACd,QAAA,CAAU,WACV,WAAA,CAAa,aACf,ECRO,IAAMC,GAAmBrC,CAAAA,CAAE,MAAA,CAAO,CACvC,GAAA,CAAKA,CAAAA,CACF,QAAO,CACP,IAAA,GACA,KAAA,CAAM,SAAA,CAAW,sBAAsB,CAAA,CAC1C,MAAA,CAAQA,CAAAA,CAAE,KAAKoC,CAAc,CAC/B,CAAC,CAAA,CAOYE,EAAAA,CAA4BtC,EAAE,MAAA,CAAO,CAChD,YAAaA,CAAAA,CAAE,MAAA,GACf,MAAA,CAAQA,CAAAA,CAAE,KAAKoC,CAAc,CAAA,CAC7B,UAAWpC,CAAAA,CAAE,GAAA,CAAI,QAAA,EACnB,CAAC","file":"chunk-YY73YQSG.mjs","sourcesContent":["export const IdentityProvider = {\n  GOOGLE: 'GOOGLE',\n  APPLE: 'APPLE',\n  FACEBOOK: 'FACEBOOK',\n  TWITTER: 'TWITTER',\n} as const;\nexport type IdentityProvider = (typeof IdentityProvider)[keyof typeof IdentityProvider];\nexport const LinkRequiredReasonEnum = {\n  EMAIL_MATCH: 'email_match',\n  EMAIL_MISS: 'email_missing',\n} as const;\nexport type LinkRequiredReasonEnum =\n  (typeof LinkRequiredReasonEnum)[keyof typeof LinkRequiredReasonEnum];\nexport const OauthResolveKind = {\n  SIGNED_IN: 'signed_in',\n  SIGNED_UP: 'signed_up',\n  LINK_REQUIRED: 'link_required',\n} as const;\nexport type OauthResolveKind = (typeof OauthResolveKind)[keyof typeof OauthResolveKind];\n","import { z } from 'zod';\nimport { UserRole } from '../user';\nimport { IdentityProvider, LinkRequiredReasonEnum } from './auth.enums';\n\nconst PASSWORD_REGEX = new RegExp(\n  '^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[ !\"#$%&\\'()*+,-./:;<=>?@[\\\\]^_`{|}~]).{8,}$',\n);\n\nconst PASSWORD_MESSAGE =\n  'Password must be at least 8 characters and include an uppercase letter, a lowercase letter, a number, and a special character.';\n\nexport const PasswordSchema = z\n  .string()\n  .min(8, PASSWORD_MESSAGE)\n  .regex(PASSWORD_REGEX, PASSWORD_MESSAGE);\n\n/**\n * Zod schema for registration request.\n */\nexport const RegisterRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  password: PasswordSchema,\n  firstName: z.string(),\n  lastName: z.string(),\n  role: z.enum(UserRole).optional(),\n});\n\n/**\n * Zod schema for registration response.\n */\nexport const RegisterResponseSchema = z.object({\n  username: z.string(),\n  reference: z.string(),\n  role: z.enum(UserRole).optional(),\n});\n\n/**\n * Zod schema for login request.\n */\nexport const LoginRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  password: PasswordSchema,\n  role: z.enum(UserRole).optional(),\n});\n\nexport const VerifyOtpRequestSchema = z.object({\n  otp: z.string().length(4),\n  reference: z.string(),\n  type: z.enum(['registration', 'passwordReset']),\n});\n\nexport const ResendOtpRequestSchema = z.object({\n  reference: z.string(),\n  type: z.enum(['registration', 'passwordReset']),\n});\n\nexport const VerifyOtpResponseSchema = z.object({\n  isValid: z.boolean(),\n  message: z.string(),\n  reference: z.string().optional(),\n});\n\n/**\n * Zod schema for login response.\n */\nexport const LoginResponseSchema = z.object({\n  AccessToken: z.string(),\n  RefreshToken: z.string(),\n  IdToken: z.string(),\n  ExpiresIn: z.number(),\n  TokenType: z.literal('Bearer'),\n  /** The user's roles bitmask decomposed into an array of UserRole values. */\n  availableRoles: z.array(z.enum(UserRole)),\n  /** The role the user was last active as, or null on first login / never-switched. */\n  lastActiveRole: z.enum(UserRole).nullable(),\n});\n\n/**\n * Zod schema for switch profile request.\n */\nexport const SwitchProfileRequestSchema = z.object({\n  role: z.enum(UserRole),\n});\n\n/**\n * Zod schema for switch profile response.\n */\nexport const SwitchProfileResponseSchema = z.object({\n  lastActiveRole: z.enum(UserRole),\n});\n\n/**\n * Zod schema for refresh token request.\n */\nexport const RefreshTokenRequestSchema = z.object({\n  refreshToken: z.string(),\n});\n\nexport const LogoutRequestSchema = z.object({\n  refreshToken: z.string(),\n  accessToken: z.string(),\n});\n\n/**\n * Zod schema for forgot password request.\n */\nexport const ForgotPasswordRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n});\n\nexport const ForgotPasswordResponseSchema = z.object({\n  destination: z.string(),\n  deliveryMedium: z.string(),\n  attributeName: z.string(),\n});\n\n/**\n * Zod schema for reset password request.\n */\nexport const ResetPasswordRequestSchema = z.object({\n  token: z.string(),\n  newPassword: PasswordSchema,\n});\n\n/**\n * Zod schema for change password request.\n */\nexport const ChangePasswordRequestSchema = z.object({\n  currentPassword: PasswordSchema,\n  newPassword: PasswordSchema,\n});\n\nexport const OauthStartQuerySchema = z.object({\n  redirectTo: z.string().min(1).max(2048).optional(),\n});\n\nexport const OauthStartResponseSchema = z.object({\n  authorizeUrl: z.url(),\n});\n\nexport const OauthExchangeRequestSchema = z.object({\n  handoff: z.string().min(16).max(128),\n});\n\nexport const OauthDirectTokenRequestSchema = z.object({\n  idToken: z.string().min(1).max(8192),\n  nonce: z.string().min(8).max(256),\n  authorizationCode: z.string().min(1).max(1024).optional(),\n  user: z\n    .object({\n      name: z\n        .object({\n          firstName: z.string().max(128).nullable().optional(),\n          lastName: z.string().max(128).nullable().optional(),\n        })\n        .optional(),\n    })\n    .optional(),\n});\n\nexport const OauthLinkCompleteRequestSchema = z\n  .object({\n    linkHandoff: z.string().min(16).max(128),\n    password: PasswordSchema.optional(),\n    otpReference: z.string().min(1).max(128).optional(),\n    otp: z.string().length(4).optional(),\n  })\n  .refine(\n    (v) => (v.password ? true : v.otpReference && v.otp),\n    'either `password` OR (`otpReference` AND `otp`) must be provided',\n  );\n\nexport const OauthLinkSendOtpRequestSchema = z.object({\n  linkHandoff: z.string().min(16).max(128),\n});\n\nexport const LinkRequiredResponseSchema = z.object({\n  kind: z.literal('link_required'),\n  reason: z.enum(LinkRequiredReasonEnum),\n  linkHandoff: z.string(),\n  maskedEmail: z.string(),\n  hasPassword: z.boolean(),\n  provider: z.enum(IdentityProvider),\n});\n\nexport const OauthLinkSendOtpResponseSchema = z.object({\n  otpReference: z.string(),\n});\n\nexport const ProvidersListItemSchema = z.object({\n  name: z.enum(IdentityProvider),\n  enabled: z.boolean(),\n  canSignUp: z.boolean(),\n});\n\nexport const ProvidersListResponseSchema = z.object({\n  providers: z.array(ProvidersListItemSchema),\n});\n\nexport const OauthLinkCompleteEmailRequestSchema = z.object({\n  linkHandoff: z.string().min(16).max(128),\n  email: z.email().max(320),\n});\n","export const MFA_ACTIONS = {\n  WITHDRAW: 'WITHDRAW',\n  CANCEL_EVENT: 'CANCEL_EVENT',\n  END_LIVE: 'END_LIVE',\n  DISABLE_MFA: 'DISABLE_MFA',\n  UPDATE_SETTLEMENT_ACCOUNT: 'UPDATE_SETTLEMENT_ACCOUNT',\n} as const;\n\nexport type MfaAction = (typeof MFA_ACTIONS)[keyof typeof MFA_ACTIONS];\n","import z from 'zod';\nimport { MFA_ACTIONS } from './mfa.enums';\n\nexport const TotpCodeSchema = z\n  .string()\n  .trim()\n  .regex(/^\\d{6}$/, 'totpCode must be 6 digits');\n\nexport const RecoveryCodeSchema = z\n  .string()\n  .trim()\n  .regex(/^[A-Za-z0-9-]{10,12}$/, 'recoveryCode is malformed');\n\nexport const EnableMfaBodySchema = z.object({\n  totpCode: TotpCodeSchema,\n});\n\nexport const DisableMfaBodySchema = z\n  .object({\n    totpCode: TotpCodeSchema.optional(),\n    recoveryCode: RecoveryCodeSchema.optional(),\n  })\n  .refine(\n    (v) => !!v.totpCode !== !!v.recoveryCode,\n    'Provide exactly one of totpCode or recoveryCode',\n  );\n\nexport const MfaChallengeBodySchema = z.object({\n  action: z.enum(MFA_ACTIONS),\n});\n\nexport const MfaVerifyBodySchema = z\n  .object({\n    challengeToken: z.string().min(16, 'challengeToken is required'),\n    totpCode: TotpCodeSchema.optional(),\n    recoveryCode: RecoveryCodeSchema.optional(),\n  })\n  .refine(\n    (v) => !!v.totpCode !== !!v.recoveryCode,\n    'Provide exactly one of totpCode or recoveryCode',\n  );\n","/**\n * Actions that require step-up reauth (a fresh PIN confirmation) before\n * they can be executed. Each protected endpoint on the backend declares\n * its action via `@ReauthRequired(...)`; the FE mints an action-scoped\n * token through `POST /auth/confirm-pin` and passes it in the\n * `X-Reauth-Token` header.\n *\n * Tokens are single-use, TTL-bounded (5 min), and scoped — a token\n * issued for `WITHDRAW` will 401 if replayed against `END_LIVE`.\n */\nexport const REAUTH_ACTIONS = {\n  END_LIVE: 'END_LIVE',\n  CANCEL_EVENT: 'CANCEL_EVENT',\n  WITHDRAW: 'WITHDRAW',\n  FUND_ESCROW: 'FUND_ESCROW',\n} as const;\n\nexport type ReauthAction = (typeof REAUTH_ACTIONS)[keyof typeof REAUTH_ACTIONS];\n","import { z } from 'zod';\nimport { REAUTH_ACTIONS } from './reauth.enums';\n\n/**\n * `POST /auth/confirm-pin` body. Regex matches the digit-string PIN\n * format enforced when the PIN was first set (`POST /users/pin`).\n */\nexport const ConfirmPinSchema = z.object({\n  pin: z\n    .string()\n    .trim()\n    .regex(/^\\d{5}$/, 'pin must be 5 digits'),\n  action: z.enum(REAUTH_ACTIONS),\n});\n\n/**\n * `POST /auth/confirm-pin` response. The `reauthToken` is presented via\n * `X-Reauth-Token` on the subsequent destructive request; single-use,\n * scoped to `action`.\n */\nexport const ReauthTokenResponseSchema = z.object({\n  reauthToken: z.string(),\n  action: z.enum(REAUTH_ACTIONS),\n  expiresAt: z.iso.datetime(),\n});\n"]}