@mastergnou/auth-contracts

Shared DTOs, enums, auth provider types, and browser storage-key constants for Mount-family auth flows.

Current surface:

• auth provider and session-provider types
• browser auth storage keys
• password-login, refresh-token, and SSO-callback request DTOs
• logout DTOs
• SAML ACS/logout DTOs and SSO protocol payload/result types
• external identity key type
• password setup/reset DTOs
• tenant auth mode / SSO status enums
• identity lifecycle and deprovision contract types
• SCIM error/list DTOs plus normalized patch/user helper types
• tenant auth management DTOs
• shared string sanitization decorator and utility

Import guidance:

• browser apps and browser helper packages should import storage constants from @mastergnou/auth-contracts/storage-keys
• the root @mastergnou/auth-contracts export remains available for DTO and enum compatibility, but it intentionally exposes validation-decorator-backed contracts that are not a narrow browser bundle surface

Current caution:

• AuthTokenPairDTO still includes tenantId because the first extraction slice is Coachiz-led
• revisit that contract before claiming full single-tenant neutrality