domain

type Attribute struct {
	Key   AttributeKey `json:"key"`
	Value any          `json:"value"`
}

type AttributeKey string

type AttributeUniqueness int

type Attributes []Attribute

type AuthAttempt struct {
	// ProjectID links to [Project].
	ProjectID string
	// ID is the unique identifier for the auth attempt within the project.
	// The storage layer assigns this value on Create (dialect-minted prefixed opaque string).
	ID string

	// HandoffToken is the single-use token minted explicitly with the handoff call after all required factors are verified, used by the client to exchange for a session.
	HandoffToken *HandoffToken
	// HandedOffAt is the timestamp when the handoff token was generated after the attempt was completed.
	HandedOffAt *time.Time

	// Used to link an auth attempt to a session. Use case is step up auth.
	// In this case we need to copy the factors from the session back to the auth attempt.
	SessionID *string

	// Links to the [AuthCheck]s that belong to the auth attempt.
	// An auth attempt can have multiple checks (e.g. for multi-factor authentication), but a check can only belong to one auth attempt.
	Checks         []AuthCheck
	RequiredChecks []AuthCheckType

	// The time when the auth attempt was created, it must be set by the storage and is read-only.
	CreatedAt time.Time

	// TTL describes how long an auth attempt is valid, it should be set to a reasonable value (e.g. 5 minutes) to prevent abuse and to ensure that old auth attempts are cleaned up.
	// An auth attempt gets garbage collected after CreatedAt + TimeToLive, so it is important to set it to a reasonable value to prevent abuse and to ensure that old auth attempts are cleaned up.
	TimeToLive *time.Duration

	// Internal marks a server-orchestrated ceremony (e.g. management-plane
	// passkey enrollment, ADR 056) whose attempt row is only a state carrier:
	// it must never be handed off, exchanged, or read through the attempt API.
	Internal bool
}

type AuthAttemptCreatedPayload struct{}

type AuthAttemptHandedOffPayload struct{}

type AuthAttemptOption func(*AuthAttempt)

type AuthChallenge interface {
	AuthCheck
	SetID(id string)
	GetID() string
	GetLastChallengedAt() time.Time
	SetLastChallengedAt(lastChallengedAt time.Time)
	GetLastFailedAt() time.Time
	SetLastFailedAt(lastFailedAt time.Time)
	GetFailureCount() uint16
	SetFailureCount(failureCount uint16)
}

type AuthChallengePasskey struct {
	*PasskeyChallenge
	// contains filtered or unexported fields
}

type AuthChallengePasskeyRegistration struct {
	*PasskeyRegistrationChallenge
	// Provisional is true when the challenge minted the user handle itself:
	// the user row does not exist yet and is created when the attestation is
	// verified.
	Provisional bool
	// contains filtered or unexported fields
}

type AuthChallengePassword struct {
	// contains filtered or unexported fields
}

type AuthChallengeUser struct {
	// contains filtered or unexported fields
}

type AuthCheck interface {
	Type() AuthCheckType
	Payload() any
}

type AuthCheckPayload struct {
	CheckID       string `json:"check_id"`
	CheckType     string `json:"check_type,omitempty"`
	AuthAttemptID string `json:"auth_attempt_id,omitempty"`
}

type AuthCheckType uint8

type AuthFactor interface {
	AuthCheck
	GetLastVerifiedAt() time.Time
	SetLastVerifiedAt(lastVerifiedAt time.Time)
}

type AuthFactorPasskey struct {
	UserVerified   bool
	UserID         string
	CredentialID   []byte
	BackupEligible bool
	BackupState    bool
	// contains filtered or unexported fields
}

type AuthFactorPasskeyRegistration struct {
	UserVerified bool
	UserID       string
	// CredentialID is base64url-encoded ([EncodePasskeyCredentialID]).
	CredentialID   string
	BackupEligible bool
	BackupState    bool
	// PasskeyID and Name identify the persisted credential row, so callers of
	// the verify transaction can answer with the created passkey without a
	// read-back that could fail after the ceremony is already consumed.
	PasskeyID string
	Name      string
	// contains filtered or unexported fields
}

type AuthFactorPassword struct {
	// contains filtered or unexported fields
}

type AuthFactorPayload struct {
	UserID   string `json:"user_id"`
	FactorID string `json:"factor_id,omitempty"`
}

type AuthFactorUser struct {
	UserID string
	// contains filtered or unexported fields
}

type AuthTokenIssuedPayload struct {
	Scopes []string `json:"scopes,omitempty"`
}

type AuthTokenRevokedPayload struct{}

type AuthzAssignment struct {
	ID              string
	ProjectID       string
	CatalogID       string
	PrincipalType   AuthzPrincipalType
	PrincipalID     string
	ObjectType      string
	Relation        string
	ScopeKind       AuthzScopeKind
	ScopeTeamID     *string
	ScopeResourceID *string
	GrantorType     *string
	GrantorID       *string
	DelegationID    *string
	ExpiresAt       *time.Time
	RevokedAt       *time.Time
	CreatedAt       time.Time
	UpdatedAt       time.Time
}

type AuthzAssignmentScope struct {
	Kind       AuthzScopeKind
	TeamID     *string
	ResourceID *string
}

type AuthzCatalog struct {
	ID          string
	CatalogKind AuthzCatalogKind
	OwnerID     string
	Version     int
	Status      AuthzCatalogStatus
	SourceHash  *string
	Relations   []AuthzRelation
	References  []AuthzRelationReference
	Edges       []AuthzExpressionEdge
	Closure     []AuthzRelationClosure
}

type AuthzCatalogKind string

type AuthzCatalogStatus string

type AuthzCatalogVersion struct {
	ID          string
	CatalogKind AuthzCatalogKind
	OwnerID     string
	Version     int
	SourceHash  *string
}

type AuthzCheckParams struct {
	CatalogID              string
	ProjectID              string
	PrincipalHomeProjectID string
	PrincipalType          AuthzPrincipalType
	PrincipalID            string
	ObjectType             string
	Relation               string
	ConstraintTeamID       string
	ResourceID             string
	// ResourceTeamID is RSI.team_id for by-id Check (team-scoped grant arm).
	ResourceTeamID string
}

type AuthzExpressionEdge struct {
	ObjectType         string
	Relation           string
	Kind               string
	SourceObjectType   *string
	SourceRelation     *string
	TuplesetObjectType *string
	TuplesetRelation   *string
	Position           int
}

type AuthzGrantedPayload struct {
	PrincipalType string `json:"principal_type,omitempty"`
	PrincipalID   string `json:"principal_id,omitempty"`
	Relation      string `json:"relation,omitempty"`
}

type AuthzListObjectsParams struct {
	AuthzCheckParams
	ResourceKind ResourceKind
}

type AuthzMemberType string

type AuthzMembershipEdge struct {
	ProjectID  string
	MemberType AuthzMemberType
	MemberID   string
	SetType    AuthzSetType
	SetID      string
	CreatedAt  time.Time
}

type AuthzMembershipEdgeField uint8

type AuthzMembershipEdgeKey struct {
	ProjectID  string
	SetType    AuthzSetType
	SetID      string
	MemberType AuthzMemberType
	MemberID   string
}

type AuthzPrincipalType string

type AuthzRelation struct {
	ObjectType string
	Relation   string
	Kind       AuthzRelationKind
}

type AuthzRelationClosure struct {
	FromObjectType string
	FromRelation   string
	ToObjectType   string
	ToRelation     string
	Depth          int
}

type AuthzRelationKind string

type AuthzRelationReference struct {
	ObjectType  string
	Relation    string
	RefType     string
	RefRelation string
	Wildcard    bool
	Condition   string
	Position    int
}

type AuthzRevokedPayload struct {
	PrincipalType string `json:"principal_type,omitempty"`
	PrincipalID   string `json:"principal_id,omitempty"`
	Relation      string `json:"relation,omitempty"`
}

type AuthzScopeKind string

type AuthzSetType string

type Branding struct {
	ProjectID      string
	ID             string
	Layout         string
	LiquidTemplate string
	LogoURL        string
	FontURL        string
	HeroURL        string
	CreatedAt      time.Time
}

type BrandingCreatedPayload = BrandingPayload

type BrandingField uint8

type BrandingPayload struct {
	Layout  string `json:"layout,omitempty"`
	LogoURL string `json:"logo_url,omitempty"`
	FontURL string `json:"font_url,omitempty"`
	HeroURL string `json:"hero_url,omitempty"`
}

type ClaimChallenge struct {
	// ID is the SHA-256 hash of the challenge token. It is the primary key and
	// is supplied by the caller, not minted here.
	ID string
	// ProjectID links to [Project].
	ProjectID string
	// InitiatingSecretHash is the SHA-256 of the project secret that initiated
	// the claim; it proves possession on claim/status (see Claim E1).
	InitiatingSecretHash string
	Status               ClaimChallengeStatus
	ExpiresAt            time.Time
	CreatedAt            time.Time
}

type ClaimChallengeCreatedPayload struct{}

type ClaimChallengeStatus string

type ClaimCompletedPayload struct {
	TeamID string `json:"team_id,omitempty"`
}

type ClaimConflictDetails struct {
	TeamID       string `json:"team_id"`
	DashboardURL string `json:"dashboard_url"`
}

type CollectedAuthMethodData struct {
	Password string
}

type CollectedFlowData struct {
	UserData    map[string]any
	UserID      string
	AuthMethods CollectedAuthMethodData
}

type CreateAttribute struct {
	Key         AttributeKey        `json:"key"`
	Value       any                 `json:"value"`
	UniqueScope AttributeUniqueness `json:"unique_scope"`
	ValueHash   [sha256.Size]byte   `json:"value_hash"`
}

type CreateAttributes []CreateAttribute

type CreateRecoveryCodes struct {
	ID            string
	ProjectID     string
	UserID        string
	RecoveryCodes []string
}

type CreateUser struct {
	ProjectID string
	SchemaURL string
	ID        string
	// LifecycleOwnerTeamID decides who manages this user's identity lifecycle (ADR 024).
	// nil => self-owned: the user survives team deletion and owns their own deprovisioning.
	// set => team-owned: deleting/deactivating that team can deactivate this user per policy.
	LifecycleOwnerTeamID *string
	// InitialMembershipTeamID is optional membership context at create time — not lifecycle ownership.
	// When set, Create also inserts an active team_memberships row for this team and uses it as the
	// team-scoped EAV uniqueness scope for attributes. A self-owned signup user can still set this
	// to their default workspace team; an enterprise provisioned user may set both fields to the
	// same tenant team, but lifecycle ownership and team membership remain separate concerns.
	InitialMembershipTeamID *string
	Attributes              CreateAttributes
}

type CreateUserParams struct {
	ProjectID string
	// TeamID is optional membership context, not lifecycle ownership — it
	// becomes [CreateUser.InitialMembershipTeamID].
	TeamID *string
	// ID is empty for a server-minted id; non-empty is for ceremony only.
	ID string
	// SchemaURL names the schema, and Schema is that schema's document.
	SchemaURL string
	Schema    []byte
	// Attributes is the instance the schema validates: envelope fields (id,
	// schema, metadata) are not part of it, so a schema may declare properties
	// of those names and closed-world keywords such as additionalProperties:
	// false hold.
	Attributes map[string]any
}

type CreateUserPasskey struct {
	ID              string
	ProjectID       string
	UserID          string
	CredentialID    string
	PublicKey       []byte
	AAGUID          []byte
	AttestationType *string
	Transports      []string
	SignCount       int64
	UserVerified    bool
	BackupEligible  bool
	BackupState     bool
	Name            string
	VerifiedAt      *time.Time
}

type CreateUserTOTP struct {
	ID        string
	ProjectID string
	UserID    string
	Secret    []byte
}

type CreatedUserDetails struct {
	UserID string `json:"user_id"`
}

type EncryptionKey struct {
	ID          string
	ProjectID   string
	Purpose     EncryptionKeyPurpose
	Key         string
	Algorithm   jose.ContentEncryption
	State       KeyState
	CreatedAt   time.Time
	ActivatedAt *time.Time
	RetiredAt   *time.Time
}

type EncryptionKeyField uint8

type EncryptionKeyPurpose string

type Environment struct {
	ProjectID string
	ID        string
	Name      string
	CreatedAt time.Time
}

type EnvironmentCreatedPayload = EnvironmentPayload

type EnvironmentField uint8

type EnvironmentPayload struct {
	Name string `json:"name,omitempty"`
}

type Error struct {
	Code    string `json:"code"`
	Message string `json:"message"`
	Details any    `json:"details,omitempty"`
	Parent  error  `json:"-"`
	errreport.Origin
}

type Event struct {
	ProjectID  string
	ID         string
	EventType  EventType
	Category   EventCategory
	OccurredAt time.Time
	CreatedAt  time.Time

	TeamID *string

	ActorID   *string
	ActorType *EventActorType

	EntityType *string
	EntityID   *string

	ClientID       string
	TokenID        string
	DelegationType string
	DelegationID   string
	Grantor        string
	Fingerprint    string

	RequestID *string
	SessionID *string
	FlowID    *string

	Payload  json.RawMessage
	Metadata json.RawMessage

	// OccurredAtWait is an insert-only hint for Path A batching: dialects set
	// occurred_at = created_at - wait (DB clock or equivalent). Path A wait is
	// time since HTTP request start so request.api sorts first on request_id.
	// Zero means Path B (occurred_at = created_at). Not a persisted column.
	OccurredAtWait time.Duration
}

type EventActorType string

type EventCategory string

type EventClientMetadata struct {
	IP        string `json:"ip,omitempty"`
	UserAgent string `json:"user_agent,omitempty"`
	Origin    string `json:"origin,omitempty"`
}

type EventField uint8

type EventMetadata struct {
	Client *EventClientMetadata `json:"client,omitempty"`
}

type EventSink struct {
	ID        string
	Type      EventSinkType
	Scope     EventSinkScope
	ProjectID *string
	URL       string
	Enabled   bool
}

type EventSinkCursor struct {
	SinkID        string
	ProjectID     string
	LastCreatedAt time.Time
	LastEventID   string
}

type EventSinkScope string

type EventSinkType string

type EventType string

type Field string

type FlowAction struct {
	Name    string
	Kind    FlowActionKind
	TextKey string
	Primary bool
}

type FlowActionKind uint8

type FlowAuthAttemptService interface {
	Start(ctx context.Context, in FlowCreateAttemptInput) (attemptID string, err error)
	SubmitIdentifier(ctx context.Context, in FlowSubmitIdentifierInput) (userID string, err error)
	SubmitPassword(ctx context.Context, in FlowSubmitPasswordInput) error
	// IssuePasskeyChallenge mints a WebAuthn assertion challenge and
	// returns its id plus the PublicKeyCredentialRequestOptions the
	// browser passes to navigator.credentials.get().
	IssuePasskeyChallenge(ctx context.Context, in FlowIssuePasskeyChallengeInput) (FlowPasskeyChallengeOutput, error)
	// SubmitPasskey verifies the assertion against the issued challenge
	// and returns the authenticated user id. For a discoverable login the
	// user is resolved from the assertion; for an identified login it is
	// the already-pinned user. Rejection surfaces as
	// [ErrAuthAttemptProofRejected].
	SubmitPasskey(ctx context.Context, in FlowSubmitPasskeyInput) (userID string, err error)
	// IssuePasskeyRegistrationChallenge mints a WebAuthn registration
	// challenge on the attempt and returns its id plus the
	// PublicKeyCredentialCreationOptions the browser passes to
	// navigator.credentials.create(). Enrollment rides the same two-phase
	// ceremony shape as [IssuePasskeyChallenge]/[SubmitPasskey].
	IssuePasskeyRegistrationChallenge(ctx context.Context, in FlowIssuePasskeyRegistrationChallengeInput) (FlowPasskeyRegistrationChallengeOutput, error)
	// SubmitPasskeyRegistration verifies the attestation against the issued
	// challenge and persists the new credential; for a provisional ceremony
	// the user row is created in the same transaction. Rejection surfaces as
	// [ErrAuthAttemptProofRejected]; a conflicting user as
	// [ErrUserAlreadyExists].
	SubmitPasskeyRegistration(ctx context.Context, in FlowSubmitPasskeyRegistrationInput) error
	// Handoff mints the single-use token the client exchanges for a
	// session. Called by the state machine on the terminal step.
	Handoff(ctx context.Context, in FlowHandoffInput) (FlowHandoffOutput, error)
}

type FlowAuthRequestRef struct {
	ID           string
	RequestedACR *string
}

type FlowBackEntry struct {
	StepName string
	// Purpose is kept in the history so the flow returns with the current purpose.
	Purpose FlowDefinitionPurpose
}

type FlowChallengeResponse struct {
	ChallengeID string
	Method      string
	// Proof is the method-specific payload (for passkey, the WebAuthn
	// PublicKeyCredential assertion JSON).
	Proof []byte
}

type FlowCreateAttemptInput struct {
	ProjectID      string
	SessionID      *string
	RequiredChecks []AuthCheckType
}

type FlowDefinition struct {
	ProjectID     string
	ID            string
	Name          string
	SchemaVersion string
	Status        FlowDefinitionStatus
	CreatedAt     time.Time
	UpdatedAt     time.Time
	// UserSchema is the URL of the JSON schema this flow operates on.
	UserSchema string
	// Purposes maps each purpose this definition handles to the name of
	// its entry-point step. Every value must match a step in [Steps].
	Purposes map[FlowDefinitionPurpose]string
	Audience FlowDefinitionAudience
	Steps    []FlowDefinitionStep
}

type FlowDefinitionAudience struct {
	AppIDs  []string
	TeamIDs []string
}

type FlowDefinitionField uint8

type FlowDefinitionPurpose uint8

type FlowDefinitionStatus uint8

type FlowDefinitionStep struct {
	Name string
	// Fields lists the user-schema property names this step collects.
	// Resolved against [FlowDefinition.UserSchema] at runtime to derive
	// per-field type, validation, and implicit outcomes.
	Fields []Field
	// Actions are the user-selectable actions on this step, in display
	// order. Each action's Name is what the frontend echoes back in the
	// submit request.
	Actions []FlowStepAction
	// Gates are security challenges that must be satisfied before the
	// step's submission is accepted, keyed by gate name.
	Gates map[string]FlowStepGate
	// SSOProviders lists the identity providers available on this step.
	SSOProviders []FlowSSOProvider
	// OnSuccess names the server-side mutation to run after field
	// validation passes, before the transition fires. Nil means advance
	// directly with no side effect.
	OnSuccess *FlowOnSuccess
	// Complete, when non-nil, marks this step as terminal and dictates
	// how the frontend finishes (redirect vs. success screen). Nil for
	// regular interactive steps.
	Complete *FlowStepComplete
	// Transitions maps an action or engine-emitted outcome name to the
	// next state. The key is either an action declared in [Actions] or a
	// reserved outcome the engine produces (e.g. `user_not_found`,
	// `callback`).
	Transitions map[string]FlowStepTransition
}

type FlowDefinitionTransitionAction uint8

type FlowField struct {
	// Name is the user-schema property this field collects, as a dotted
	// path for a nested property (`address.street`).
	Name string

	// Type is the UI input kind the client should render. It is
	// derived from the property's JSON `type` and `format` in the user
	// meta-schema. The reserved `x-auth-methods#<method>` field name
	// forces the input kind matching that credential method
	// (e.g. `x-auth-methods#password` → password).
	Type FlowFieldType

	// TextKey is a localization key for the field label (e.g.
	// `field.email`). Resolved client-side via the `| t` filter.
	TextKey string

	// Required reflects membership in the schema's `required` array at
	// every level of the field's path: a nested leaf is required only
	// when each of its ancestors is required too, matching what schema
	// validation accepts for the document as a whole.
	Required bool

	// Value is an optional pre-fill (e.g. an identifier carried over
	// from a pivot). Nil when no pre-fill applies.
	Value *string

	// Validation carries the schema-derived validation rules. Nil when
	// the property has no rules beyond its JSON type.
	Validation *FlowFieldValidation

	// Unique mirrors the property's `x-unique` annotation: the scope at
	// which the value must be unique, or [AttributeUniquenessUnspecified]
	// when absent. The user-creation path consults it to set the
	// per-attribute uniqueness scope on storage.
	Unique AttributeUniqueness

	// Challenge names the auth-attempt challenge the field maps to, or
	// [FlowFieldChallengeNone] when the field carries neither an
	// identifier nor a credential proof. Derivation paths: the field
	// naming the schema's designated identifier (the schema-root
	// `x-identifier` path, ADR 058) surfaces as
	// [FlowFieldChallengeIdentifier]; the reserved `x-auth-methods#password` field
	// name combined with `x-auth-methods.password.enabled = true` at
	// the schema root surfaces as [FlowFieldChallengePassword]. Other
	// credential kinds (passkey, magic_link, sso, otp) do not have
	// field-shaped proofs and are produced by the state machine as
	// challenge steps, not by the resolver. The state machine consults
	// Challenge on submit to route the value — identifier fields drive
	// identifier resolution (and the `user_not_found` implicit outcome),
	// password fields drive the password challenge.
	Challenge FlowFieldChallenge
}

type FlowFieldChallenge string

type FlowFieldResolver interface {
	// Resolve returns the per-field metadata for fields against the
	// provided user schema. stepName is the flow step the fields are
	// being resolved for; it prefixes each field's text_key
	// (`<stepName>.field.<name>`). Schema loading is the caller's
	// responsibility — see [SchemaResolver].
	Resolve(schema *jsonschema.Schema, stepName string, fields []Field) (FlowResolvedFields, error)

	// Validate checks submitted values against the rules carried by a
	// previously resolved field set.
	Validate(fields FlowResolvedFields, values map[string]any) error

	// MissingRequired reports the required fields absent from values.
	// Applied only on field-collecting actions (the submit action and the
	// passkey-register issue leg); other actions legitimately submit a
	// subset of fields or none.
	MissingRequired(fields FlowResolvedFields, values map[string]any) FlowFieldValidationErrors
}

type FlowFieldType string

type FlowFieldValidation struct {
	Format    string
	MinLength int
	MaxLength int
	Enum      []string

	// Const, when non-nil, pins the property to a fixed value (JSON
	// Schema `const`) of any type — e.g. a must-accept checkbox uses
	// `const: true`. A differing submission is reported as
	// [FlowFieldValidationRuleFormat].
	Const any
}

type FlowFieldValidationError struct {
	Field string
	Rule  FlowFieldValidationRule
}

type FlowFieldValidationErrors []FlowFieldValidationError

type FlowFieldValidationRule string

type FlowGateKind uint8

type FlowHandoffInput struct {
	ProjectID string
	AttemptID string
}

type FlowHandoffOutput struct {
	Token     string
	ExpiresAt time.Time
}

type FlowIssuePasskeyChallengeInput struct {
	ProjectID        string
	AttemptID        string
	RPID             string
	RPOrigins        []string
	UserVerification string
}

type FlowIssuePasskeyRegistrationChallengeInput struct {
	ProjectID   string
	AttemptID   string
	UserID      string
	Username    string
	DisplayName string
	RPID        string
	RPOrigins   []string
}

type FlowOnSuccess uint8

type FlowOnSuccessHandler interface {
	Handle(ctx context.Context, in FlowOnSuccessInput) (FlowOnSuccessResult, error)
}

type FlowOnSuccessInput struct {
	ProjectID     string
	UserSchemaURL string
	Fields        map[string]any
	Resolved      FlowResolvedFields
	State         *FlowState
	ResolvedFlow  *FlowDefinition
}

type FlowOnSuccessResult struct {
	StepError *string
	// UserID is set when a handler creates a new user. The state machine
	// only records it in flow state — a handler returning a UserID MUST
	// have persisted the user's verified factors on the auth attempt
	// inside its own transaction (see FlowCreateUserWithPasswordHandler's
	// recordAttemptFactorsAction), or the exchanged session will be bound
	// to a user with no factors.
	UserID string
	// Irreversible flags mutations the user cannot reverse (e.g. created a user).
	Irreversible bool
}

type FlowPasskeyChallengeOutput struct {
	ChallengeID string
	Options     []byte
}

type FlowPasskeyRP struct {
	RPID    string
	Origins []string
}

type FlowPasskeyRegistrationChallengeOutput struct {
	ChallengeID string
	UserID      string
	Options     []byte
}

type FlowPendingChallenge struct {
	// ID is the challenge identifier returned by the auth-attempt
	// service at issue time. The client echoes it back in
	// ChallengeResponse.
	ID string

	// Method names the ceremony kind (e.g. "passkey"). The state
	// machine uses it to route verification to the right service.
	Method string

	// Options is the client-facing ceremony options JSON (for passkey,
	// the PublicKeyCredentialRequestOptions). Surfaced on the rendered
	// step's challenge so the browser can run the ceremony; persisted in
	// the cookie so a re-render re-emits it.
	Options []byte

	// IssuedAt is when the challenge was minted. The auth-attempt
	// service enforces its own freshness window; this field is kept for
	// diagnostics and for the state machine to short-circuit obviously
	// stale challenges before calling Verify.
	IssuedAt time.Time
}

type FlowProgress struct {
	// DefinitionID is the flow definition currently being executed. On
	// pivot it changes to the child definition; on pop it is restored
	// from the parent entry on PivotStack.
	DefinitionID string

	// Purpose is the kind of flow (login, signup, recovery, …). The
	// handler uses it to surface a coarse classification without parsing
	// the definition.
	Purpose FlowDefinitionPurpose

	// CurrentPurpose is the dynamic dispatch mode. Flips on identifier
	// outcomes; Purpose stays pinned for telemetry / ACR.
	CurrentPurpose FlowDefinitionPurpose

	// CurrentStep is the name of the step the user is currently on
	// within DefinitionID. The next submit is interpreted against this
	// step.
	CurrentStep string

	// History is the append-only audit trail of visited steps.
	History []string

	// BackStack maintains the history of visited steps, but gets
	// cleared after an irreversible action.
	// The engine also uses it to decide when an action.back should
	// be injected into the response.
	BackStack []FlowBackEntry

	// CollectedData accumulates submitted field values for this
	// progress entry, keyed by schema property name. A child flow's
	// CollectedData is discarded when its progress is popped.
	CollectedData CollectedFlowData
}

type FlowResolvedFields struct {
	// Fields holds the resolved per-field metadata in the same order as
	// the property names passed to Resolve.
	Fields []FlowField

	// ImplicitOutcomes lists the reserved transition outcomes each
	// field contributes, keyed by field name. The state machine uses it
	// to validate flow definitions and route schema-derived transitions.
	ImplicitOutcomes map[string][]string
}