# Identity Contract Extraction Map

## Source to Target Mapping

| Current Source | Target Group | Notes |
|---|---|---|
| thalos-service identity token contracts | Contracts/Tokens | Keep payload shape behavior-compatible |
| thalos-service policy contracts | Contracts/Policies | Preserve policy semantics and required fields |
| thalos-service policy context contracts | Contracts/Context | Keep field naming stable for compatibility window |
| thalos-bff refresh session contracts | Contracts/Sessions | Candidate for shared capability standardization |
| provider flow metadata (JWT/Azure/Google) | Contracts/Conventions | Provider metadata stays transport-neutral and additive |

## Namespace Strategy
- Current Thalos namespaces are mapped to `BuildingBlock.Identity.Contracts.*`.
- Existing Thalos namespaces remain supported during compatibility window.

## Extraction Sequence
1. Introduce target contract namespaces in building-block-identity.
2. Add compatibility bridge in Thalos consumers.
3. Migrate service consumers first, then BFF consumers.
4. Deprecate old namespace usage after compatibility window.
5. Keep provider enum and provider-specific fields additive to avoid breaking consumers.