{"version":3,"sources":["../src/auth/auth.enums.ts","../src/auth/auth.schemas.ts","../src/auth/mfa.enums.ts","../src/auth/mfa.schemas.ts","../src/auth/reauth.enums.ts","../src/auth/reauth.schemas.ts"],"names":["IdentityProvider","LinkRequiredReasonEnum","OauthResolveKind","PASSWORD_REGEX","PASSWORD_MESSAGE","PasswordSchema","z","RegisterRequestSchema","UserRole","LoginRequestSchema","VerifyOtpRequestSchema","ResendOtpRequestSchema","VerifyOtpResponseSchema","LoginResponseSchema","RegisterResponseSchema","SwitchProfileRequestSchema","SwitchProfileResponseSchema","RefreshTokenRequestSchema","LogoutRequestSchema","ForgotPasswordRequestSchema","ForgotPasswordResponseSchema","ResetPasswordRequestSchema","ChangePasswordRequestSchema","OauthStartQuerySchema","OauthStartResponseSchema","OauthExchangeRequestSchema","OauthDirectTokenRequestSchema","OauthLinkCompleteRequestSchema","v","OauthLinkSendOtpRequestSchema","LinkRequiredResponseSchema","OauthLinkSendOtpResponseSchema","ProvidersListItemSchema","ProvidersListResponseSchema","OauthLinkCompleteEmailRequestSchema","MFA_ACTIONS","TotpCodeSchema","RecoveryCodeSchema","EnableMfaBodySchema","DisableMfaBodySchema","MfaChallengeBodySchema","MfaVerifyBodySchema","REAUTH_ACTIONS","ConfirmPinSchema","ReauthTokenResponseSchema"],"mappings":"kEAAO,IAAMA,EAAmB,CAC9B,MAAA,CAAQ,SACR,KAAA,CAAO,OAAA,CACP,SAAU,UAAA,CACV,OAAA,CAAS,SACX,CAAA,CAEaC,CAAAA,CAAyB,CACpC,WAAA,CAAa,aAAA,CACb,UAAA,CAAY,eACd,CAAA,CAGaC,CAAAA,CAAmB,CAC9B,SAAA,CAAW,WAAA,CACX,UAAW,WAAA,CACX,aAAA,CAAe,eACjB,ECbA,IAAMC,EAAiB,IAAI,MAAA,CACzB,yFACF,CAAA,CAEMC,CAAAA,CACJ,iIAEWC,CAAAA,CAAiBC,CAAAA,CAC3B,QAAO,CACP,GAAA,CAAI,CAAA,CAAGF,CAAgB,CAAA,CACvB,KAAA,CAAMD,EAAgBC,CAAgB,CAAA,CAK5BG,EAAwBD,CAAAA,CAAE,MAAA,CAAO,CAC5C,KAAA,CAAOA,CAAAA,CAAE,OAAM,CAAE,WAAA,GACjB,QAAA,CAAUD,CAAAA,CACV,UAAWC,CAAAA,CAAE,MAAA,GACb,QAAA,CAAUA,CAAAA,CAAE,MAAA,EAAO,CACnB,IAAA,CAAMA,CAAAA,CAAE,KAAKE,GAAQ,CAAA,CAAE,UAAS,CAMhC,WAAA,CAAaF,EAAE,MAAA,EAAO,CAAE,GAAA,CAAI,EAAE,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAC3C,CAAC,CAAA,CAKYG,EAAqBH,CAAAA,CAAE,MAAA,CAAO,CACzC,KAAA,CAAOA,CAAAA,CAAE,KAAA,GAAQ,WAAA,EAAY,CAC7B,SAAUD,CAAAA,CACV,IAAA,CAAMC,EAAE,IAAA,CAAKE,GAAQ,EAAE,QAAA,EACzB,CAAC,CAAA,CAEYE,CAAAA,CAAyBJ,EAAE,MAAA,CAAO,CAC7C,IAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,MAAA,CAAO,CAAC,CAAA,CACxB,UAAWA,CAAAA,CAAE,MAAA,GACb,IAAA,CAAMA,CAAAA,CAAE,KAAK,CAAC,cAAA,CAAgB,eAAe,CAAC,CAChD,CAAC,CAAA,CAEYK,CAAAA,CAAyBL,EAAE,MAAA,CAAO,CAC7C,UAAWA,CAAAA,CAAE,MAAA,EAAO,CACpB,IAAA,CAAMA,CAAAA,CAAE,IAAA,CAAK,CAAC,cAAA,CAAgB,eAAe,CAAC,CAChD,CAAC,EAEYM,CAAAA,CAA0BN,CAAAA,CAAE,OAAO,CAC9C,OAAA,CAASA,EAAE,OAAA,EAAQ,CACnB,QAASA,CAAAA,CAAE,MAAA,GACX,SAAA,CAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EACxB,CAAC,CAAA,CAKYO,CAAAA,CAAsBP,EAAE,MAAA,CAAO,CAC1C,YAAaA,CAAAA,CAAE,MAAA,EAAO,CACtB,YAAA,CAAcA,CAAAA,CAAE,MAAA,GAChB,OAAA,CAASA,CAAAA,CAAE,QAAO,CAClB,SAAA,CAAWA,EAAE,MAAA,EAAO,CACpB,SAAA,CAAWA,CAAAA,CAAE,OAAA,CAAQ,QAAQ,EAE7B,cAAA,CAAgBA,CAAAA,CAAE,MAAMA,CAAAA,CAAE,IAAA,CAAKE,GAAQ,CAAC,CAAA,CAExC,eAAgBF,CAAAA,CAAE,IAAA,CAAKE,GAAQ,CAAA,CAAE,QAAA,EACnC,CAAC,CAAA,CAKYM,EAAyBR,CAAAA,CAAE,MAAA,CAAO,CAC7C,QAAA,CAAUA,CAAAA,CAAE,MAAA,GAEZ,SAAA,CAAWA,CAAAA,CAAE,QAAO,CAAE,QAAA,GACtB,IAAA,CAAMA,CAAAA,CAAE,KAAKE,GAAQ,CAAA,CAAE,UAAS,CAEhC,gBAAA,CAAkBF,EAAE,OAAA,EAAQ,CAAE,UAAS,CAEvC,OAAA,CAASO,CAAAA,CAAoB,QAAA,EAC/B,CAAC,EAKYE,CAAAA,CAA6BT,CAAAA,CAAE,OAAO,CACjD,IAAA,CAAMA,EAAE,IAAA,CAAKE,GAAQ,CACvB,CAAC,CAAA,CAKYQ,EAA8BV,CAAAA,CAAE,MAAA,CAAO,CAClD,cAAA,CAAgBA,CAAAA,CAAE,KAAKE,GAAQ,CACjC,CAAC,CAAA,CAKYS,CAAAA,CAA4BX,CAAAA,CAAE,OAAO,CAChD,YAAA,CAAcA,EAAE,MAAA,EAClB,CAAC,CAAA,CAEYY,CAAAA,CAAsBZ,CAAAA,CAAE,MAAA,CAAO,CAC1C,YAAA,CAAcA,EAAE,MAAA,EAAO,CACvB,YAAaA,CAAAA,CAAE,MAAA,EACjB,CAAC,CAAA,CAKYa,CAAAA,CAA8Bb,CAAAA,CAAE,MAAA,CAAO,CAClD,MAAOA,CAAAA,CAAE,KAAA,GAAQ,WAAA,EACnB,CAAC,CAAA,CAEYc,CAAAA,CAA+Bd,EAAE,MAAA,CAAO,CACnD,YAAaA,CAAAA,CAAE,MAAA,GACf,cAAA,CAAgBA,CAAAA,CAAE,QAAO,CACzB,aAAA,CAAeA,CAAAA,CAAE,MAAA,EACnB,CAAC,EAKYe,CAAAA,CAA6Bf,CAAAA,CAAE,OAAO,CACjD,KAAA,CAAOA,EAAE,MAAA,EAAO,CAChB,WAAA,CAAaD,CACf,CAAC,CAAA,CAKYiB,EAA8BhB,CAAAA,CAAE,MAAA,CAAO,CAClD,eAAA,CAAiBD,CAAAA,CACjB,YAAaA,CACf,CAAC,CAAA,CAEYkB,CAAAA,CAAwBjB,CAAAA,CAAE,MAAA,CAAO,CAC5C,UAAA,CAAYA,CAAAA,CAAE,QAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA,CAAE,QAAA,EAC1C,CAAC,CAAA,CAEYkB,EAA2BlB,CAAAA,CAAE,MAAA,CAAO,CAC/C,YAAA,CAAcA,CAAAA,CAAE,GAAA,EAClB,CAAC,CAAA,CAEYmB,EAA6BnB,CAAAA,CAAE,MAAA,CAAO,CACjD,OAAA,CAASA,CAAAA,CAAE,QAAO,CAAE,GAAA,CAAI,EAAE,CAAA,CAAE,GAAA,CAAI,GAAG,CACrC,CAAC,CAAA,CAEYoB,EAAgCpB,CAAAA,CAAE,MAAA,CAAO,CACpD,OAAA,CAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,GAAA,CAAI,IAAI,EACnC,KAAA,CAAOA,CAAAA,CAAE,QAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAChC,iBAAA,CAAmBA,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA,CAAE,QAAA,GAC/C,IAAA,CAAMA,CAAAA,CACH,OAAO,CACN,IAAA,CAAMA,EACH,MAAA,CAAO,CACN,UAAWA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS,CAAE,UAAS,CACnD,QAAA,CAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,GAAW,QAAA,EAC3C,CAAC,CAAA,CACA,QAAA,EACL,CAAC,CAAA,CACA,UACL,CAAC,EAEYqB,CAAAA,CAAiCrB,CAAAA,CAC3C,OAAO,CACN,WAAA,CAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,EAAE,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CACvC,QAAA,CAAUD,EAAe,QAAA,EAAS,CAClC,YAAA,CAAcC,CAAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA,CAAE,UAAS,CAClD,GAAA,CAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,MAAA,CAAO,CAAC,CAAA,CAAE,QAAA,EAC5B,CAAC,CAAA,CACA,OACEsB,CAAAA,EAAOA,CAAAA,CAAE,SAAW,IAAA,CAAOA,CAAAA,CAAE,cAAgBA,CAAAA,CAAE,GAAA,CAChD,kEACF,CAAA,CAEWC,CAAAA,CAAgCvB,EAAE,MAAA,CAAO,CACpD,WAAA,CAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,IAAI,EAAE,CAAA,CAAE,IAAI,GAAG,CACzC,CAAC,CAAA,CAEYwB,CAAAA,CAA6BxB,EAAE,MAAA,CAAO,CACjD,KAAMA,CAAAA,CAAE,OAAA,CAAQ,eAAe,CAAA,CAC/B,MAAA,CAAQA,EAAE,IAAA,CAAKL,CAAsB,CAAA,CACrC,WAAA,CAAaK,CAAAA,CAAE,MAAA,GACf,WAAA,CAAaA,CAAAA,CAAE,QAAO,CACtB,WAAA,CAAaA,EAAE,OAAA,EAAQ,CACvB,SAAUA,CAAAA,CAAE,IAAA,CAAKN,CAAgB,CACnC,CAAC,EAEY+B,CAAAA,CAAiCzB,CAAAA,CAAE,OAAO,CACrD,YAAA,CAAcA,CAAAA,CAAE,MAAA,EAClB,CAAC,EAEY0B,CAAAA,CAA0B1B,CAAAA,CAAE,OAAO,CAC9C,IAAA,CAAMA,EAAE,IAAA,CAAKN,CAAgB,CAAA,CAC7B,OAAA,CAASM,CAAAA,CAAE,OAAA,GACX,SAAA,CAAWA,CAAAA,CAAE,SACf,CAAC,EAEY2B,CAAAA,CAA8B3B,CAAAA,CAAE,MAAA,CAAO,CAClD,SAAA,CAAWA,CAAAA,CAAE,MAAM0B,CAAuB,CAC5C,CAAC,CAAA,CAEYE,CAAAA,CAAsC5B,EAAE,MAAA,CAAO,CAC1D,YAAaA,CAAAA,CAAE,MAAA,GAAS,GAAA,CAAI,EAAE,EAAE,GAAA,CAAI,GAAG,EACvC,KAAA,CAAOA,CAAAA,CAAE,KAAA,EAAM,CAAE,GAAA,CAAI,GAAG,CAC1B,CAAC,MCrNY6B,CAAAA,CAAc,CACzB,SAAU,UAAA,CACV,YAAA,CAAc,eACd,QAAA,CAAU,UAAA,CACV,YAAa,aAAA,CACb,yBAAA,CAA2B,2BAC7B,ECHO,IAAMC,CAAAA,CAAiB9B,CAAAA,CAC3B,MAAA,EAAO,CACP,MAAK,CACL,KAAA,CAAM,UAAW,2BAA2B,CAAA,CAElC+B,EAAqB/B,CAAAA,CAC/B,MAAA,GACA,IAAA,EAAK,CACL,MAAM,uBAAA,CAAyB,2BAA2B,EAEhDgC,CAAAA,CAAsBhC,CAAAA,CAAE,OAAO,CAC1C,QAAA,CAAU8B,CACZ,CAAC,CAAA,CAEYG,CAAAA,CAAuBjC,EACjC,MAAA,CAAO,CACN,SAAU8B,CAAAA,CAAe,QAAA,GACzB,YAAA,CAAcC,CAAAA,CAAmB,QAAA,EACnC,CAAC,CAAA,CACA,OACET,CAAAA,EAAM,CAAC,CAACA,CAAAA,CAAE,QAAA,EAAa,CAAC,CAACA,CAAAA,CAAE,YAAA,CAC5B,iDACF,CAAA,CAEWY,CAAAA,CAAyBlC,EAAE,MAAA,CAAO,CAC7C,OAAQA,CAAAA,CAAE,IAAA,CAAK6B,CAAW,CAC5B,CAAC,EAEYM,CAAAA,CAAsBnC,CAAAA,CAChC,OAAO,CACN,cAAA,CAAgBA,EAAE,MAAA,EAAO,CAAE,IAAI,EAAA,CAAI,4BAA4B,CAAA,CAC/D,QAAA,CAAU8B,CAAAA,CAAe,QAAA,GACzB,YAAA,CAAcC,CAAAA,CAAmB,UACnC,CAAC,EACA,MAAA,CACET,CAAAA,EAAM,CAAC,CAACA,CAAAA,CAAE,QAAA,EAAa,CAAC,CAACA,CAAAA,CAAE,aAC5B,iDACF,MC9BWc,CAAAA,CAAiB,CAC5B,QAAA,CAAU,UAAA,CACV,YAAA,CAAc,cAAA,CACd,SAAU,UAAA,CACV,WAAA,CAAa,aACf,MCRaC,EAAAA,CAAmBrC,CAAAA,CAAE,OAAO,CACvC,GAAA,CAAKA,EACF,MAAA,EAAO,CACP,MAAK,CACL,KAAA,CAAM,SAAA,CAAW,sBAAsB,CAAA,CAC1C,MAAA,CAAQA,EAAE,IAAA,CAAKoC,CAAc,CAC/B,CAAC,CAAA,CAOYE,GAA4BtC,CAAAA,CAAE,MAAA,CAAO,CAChD,WAAA,CAAaA,CAAAA,CAAE,MAAA,GACf,MAAA,CAAQA,CAAAA,CAAE,KAAKoC,CAAc,CAAA,CAC7B,UAAWpC,CAAAA,CAAE,GAAA,CAAI,QAAA,EACnB,CAAC","file":"chunk-SQHH6NXH.mjs","sourcesContent":["export const IdentityProvider = {\n  GOOGLE: 'GOOGLE',\n  APPLE: 'APPLE',\n  FACEBOOK: 'FACEBOOK',\n  TWITTER: 'TWITTER',\n} as const;\nexport type IdentityProvider = (typeof IdentityProvider)[keyof typeof IdentityProvider];\nexport const LinkRequiredReasonEnum = {\n  EMAIL_MATCH: 'email_match',\n  EMAIL_MISS: 'email_missing',\n} as const;\nexport type LinkRequiredReasonEnum =\n  (typeof LinkRequiredReasonEnum)[keyof typeof LinkRequiredReasonEnum];\nexport const OauthResolveKind = {\n  SIGNED_IN: 'signed_in',\n  SIGNED_UP: 'signed_up',\n  LINK_REQUIRED: 'link_required',\n} as const;\nexport type OauthResolveKind = (typeof OauthResolveKind)[keyof typeof OauthResolveKind];\n","import { z } from 'zod';\nimport { UserRole } from '../user';\nimport { IdentityProvider, LinkRequiredReasonEnum } from './auth.enums';\n\nconst PASSWORD_REGEX = new RegExp(\n  '^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[ !\"#$%&\\'()*+,-./:;<=>?@[\\\\]^_`{|}~]).{8,}$',\n);\n\nconst PASSWORD_MESSAGE =\n  'Password must be at least 8 characters and include an uppercase letter, a lowercase letter, a number, and a special character.';\n\nexport const PasswordSchema = z\n  .string()\n  .min(8, PASSWORD_MESSAGE)\n  .regex(PASSWORD_REGEX, PASSWORD_MESSAGE);\n\n/**\n * Zod schema for registration request.\n */\nexport const RegisterRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  password: PasswordSchema,\n  firstName: z.string(),\n  lastName: z.string(),\n  role: z.enum(UserRole).optional(),\n  /**\n   * Token from a private-event invite link. When it is valid and `email` is\n   * the invited address, the account is created verified (the link proves\n   * the inbox) and the response carries a session instead of an OTP step.\n   */\n  inviteToken: z.string().min(16).max(256).optional(),\n});\n\n/**\n * Zod schema for login request.\n */\nexport const LoginRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n  password: PasswordSchema,\n  role: z.enum(UserRole).optional(),\n});\n\nexport const VerifyOtpRequestSchema = z.object({\n  otp: z.string().length(4),\n  reference: z.string(),\n  type: z.enum(['registration', 'passwordReset']),\n});\n\nexport const ResendOtpRequestSchema = z.object({\n  reference: z.string(),\n  type: z.enum(['registration', 'passwordReset']),\n});\n\nexport const VerifyOtpResponseSchema = z.object({\n  isValid: z.boolean(),\n  message: z.string(),\n  reference: z.string().optional(),\n});\n\n/**\n * Zod schema for login response.\n */\nexport const LoginResponseSchema = z.object({\n  AccessToken: z.string(),\n  RefreshToken: z.string(),\n  IdToken: z.string(),\n  ExpiresIn: z.number(),\n  TokenType: z.literal('Bearer'),\n  /** The user's roles bitmask decomposed into an array of UserRole values. */\n  availableRoles: z.array(z.enum(UserRole)),\n  /** The role the user was last active as, or null on first login / never-switched. */\n  lastActiveRole: z.enum(UserRole).nullable(),\n});\n\n/**\n * Zod schema for registration response.\n */\nexport const RegisterResponseSchema = z.object({\n  username: z.string(),\n  /** OTP reference; absent when the invite token already verified the email. */\n  reference: z.string().optional(),\n  role: z.enum(UserRole).optional(),\n  /** True when the invite token verified the email — no OTP step. */\n  verifiedByInvite: z.boolean().optional(),\n  /** Session for a `verifiedByInvite` sign-up (same shape as login). */\n  session: LoginResponseSchema.optional(),\n});\n\n/**\n * Zod schema for switch profile request.\n */\nexport const SwitchProfileRequestSchema = z.object({\n  role: z.enum(UserRole),\n});\n\n/**\n * Zod schema for switch profile response.\n */\nexport const SwitchProfileResponseSchema = z.object({\n  lastActiveRole: z.enum(UserRole),\n});\n\n/**\n * Zod schema for refresh token request.\n */\nexport const RefreshTokenRequestSchema = z.object({\n  refreshToken: z.string(),\n});\n\nexport const LogoutRequestSchema = z.object({\n  refreshToken: z.string(),\n  accessToken: z.string(),\n});\n\n/**\n * Zod schema for forgot password request.\n */\nexport const ForgotPasswordRequestSchema = z.object({\n  email: z.email().toLowerCase(),\n});\n\nexport const ForgotPasswordResponseSchema = z.object({\n  destination: z.string(),\n  deliveryMedium: z.string(),\n  attributeName: z.string(),\n});\n\n/**\n * Zod schema for reset password request.\n */\nexport const ResetPasswordRequestSchema = z.object({\n  token: z.string(),\n  newPassword: PasswordSchema,\n});\n\n/**\n * Zod schema for change password request.\n */\nexport const ChangePasswordRequestSchema = z.object({\n  currentPassword: PasswordSchema,\n  newPassword: PasswordSchema,\n});\n\nexport const OauthStartQuerySchema = z.object({\n  redirectTo: z.string().min(1).max(2048).optional(),\n});\n\nexport const OauthStartResponseSchema = z.object({\n  authorizeUrl: z.url(),\n});\n\nexport const OauthExchangeRequestSchema = z.object({\n  handoff: z.string().min(16).max(128),\n});\n\nexport const OauthDirectTokenRequestSchema = z.object({\n  idToken: z.string().min(1).max(8192),\n  nonce: z.string().min(8).max(256),\n  authorizationCode: z.string().min(1).max(1024).optional(),\n  user: z\n    .object({\n      name: z\n        .object({\n          firstName: z.string().max(128).nullable().optional(),\n          lastName: z.string().max(128).nullable().optional(),\n        })\n        .optional(),\n    })\n    .optional(),\n});\n\nexport const OauthLinkCompleteRequestSchema = z\n  .object({\n    linkHandoff: z.string().min(16).max(128),\n    password: PasswordSchema.optional(),\n    otpReference: z.string().min(1).max(128).optional(),\n    otp: z.string().length(4).optional(),\n  })\n  .refine(\n    (v) => (v.password ? true : v.otpReference && v.otp),\n    'either `password` OR (`otpReference` AND `otp`) must be provided',\n  );\n\nexport const OauthLinkSendOtpRequestSchema = z.object({\n  linkHandoff: z.string().min(16).max(128),\n});\n\nexport const LinkRequiredResponseSchema = z.object({\n  kind: z.literal('link_required'),\n  reason: z.enum(LinkRequiredReasonEnum),\n  linkHandoff: z.string(),\n  maskedEmail: z.string(),\n  hasPassword: z.boolean(),\n  provider: z.enum(IdentityProvider),\n});\n\nexport const OauthLinkSendOtpResponseSchema = z.object({\n  otpReference: z.string(),\n});\n\nexport const ProvidersListItemSchema = z.object({\n  name: z.enum(IdentityProvider),\n  enabled: z.boolean(),\n  canSignUp: z.boolean(),\n});\n\nexport const ProvidersListResponseSchema = z.object({\n  providers: z.array(ProvidersListItemSchema),\n});\n\nexport const OauthLinkCompleteEmailRequestSchema = z.object({\n  linkHandoff: z.string().min(16).max(128),\n  email: z.email().max(320),\n});\n","export const MFA_ACTIONS = {\n  WITHDRAW: 'WITHDRAW',\n  CANCEL_EVENT: 'CANCEL_EVENT',\n  END_LIVE: 'END_LIVE',\n  DISABLE_MFA: 'DISABLE_MFA',\n  UPDATE_SETTLEMENT_ACCOUNT: 'UPDATE_SETTLEMENT_ACCOUNT',\n} as const;\n\nexport type MfaAction = (typeof MFA_ACTIONS)[keyof typeof MFA_ACTIONS];\n","import z from 'zod';\nimport { MFA_ACTIONS } from './mfa.enums';\n\nexport const TotpCodeSchema = z\n  .string()\n  .trim()\n  .regex(/^\\d{6}$/, 'totpCode must be 6 digits');\n\nexport const RecoveryCodeSchema = z\n  .string()\n  .trim()\n  .regex(/^[A-Za-z0-9-]{10,12}$/, 'recoveryCode is malformed');\n\nexport const EnableMfaBodySchema = z.object({\n  totpCode: TotpCodeSchema,\n});\n\nexport const DisableMfaBodySchema = z\n  .object({\n    totpCode: TotpCodeSchema.optional(),\n    recoveryCode: RecoveryCodeSchema.optional(),\n  })\n  .refine(\n    (v) => !!v.totpCode !== !!v.recoveryCode,\n    'Provide exactly one of totpCode or recoveryCode',\n  );\n\nexport const MfaChallengeBodySchema = z.object({\n  action: z.enum(MFA_ACTIONS),\n});\n\nexport const MfaVerifyBodySchema = z\n  .object({\n    challengeToken: z.string().min(16, 'challengeToken is required'),\n    totpCode: TotpCodeSchema.optional(),\n    recoveryCode: RecoveryCodeSchema.optional(),\n  })\n  .refine(\n    (v) => !!v.totpCode !== !!v.recoveryCode,\n    'Provide exactly one of totpCode or recoveryCode',\n  );\n","/**\n * Actions that require step-up reauth (a fresh PIN confirmation) before\n * they can be executed. Each protected endpoint on the backend declares\n * its action via `@ReauthRequired(...)`; the FE mints an action-scoped\n * token through `POST /auth/confirm-pin` and passes it in the\n * `X-Reauth-Token` header.\n *\n * Tokens are single-use, TTL-bounded (5 min), and scoped — a token\n * issued for `WITHDRAW` will 401 if replayed against `END_LIVE`.\n */\nexport const REAUTH_ACTIONS = {\n  END_LIVE: 'END_LIVE',\n  CANCEL_EVENT: 'CANCEL_EVENT',\n  WITHDRAW: 'WITHDRAW',\n  FUND_ESCROW: 'FUND_ESCROW',\n} as const;\n\nexport type ReauthAction = (typeof REAUTH_ACTIONS)[keyof typeof REAUTH_ACTIONS];\n","import { z } from 'zod';\nimport { REAUTH_ACTIONS } from './reauth.enums';\n\n/**\n * `POST /auth/confirm-pin` body. Regex matches the digit-string PIN\n * format enforced when the PIN was first set (`POST /users/pin`).\n */\nexport const ConfirmPinSchema = z.object({\n  pin: z\n    .string()\n    .trim()\n    .regex(/^\\d{5}$/, 'pin must be 5 digits'),\n  action: z.enum(REAUTH_ACTIONS),\n});\n\n/**\n * `POST /auth/confirm-pin` response. The `reauthToken` is presented via\n * `X-Reauth-Token` on the subsequent destructive request; single-use,\n * scoped to `action`.\n */\nexport const ReauthTokenResponseSchema = z.object({\n  reauthToken: z.string(),\n  action: z.enum(REAUTH_ACTIONS),\n  expiresAt: z.iso.datetime(),\n});\n"]}