@friggframework/core 2.0.0--canary.684.0da024b.0 → 2.0.0--canary.679.a2bcc2f.0

package/modules/use-cases/multi-step-authorization.js

@@ -3,8 +3,6 @@ const { FetchError } = require('../../errors/fetch-error');
 const { getLogger } = require('../../logs');
 const { AuthorizationSession } = require('../domain/authorization-session');
 const { findDefinition, getAuthStepCount } = require('./entity-types');
-const { describeRecord } = require('../scope-visibility');
-const { DEFAULT_SCOPE_POLICY } = require('../scope-policy');
 
 const log = getLogger('frigg.api.authorize');
 
@@ -146,30 +144,21 @@ class SubmitAuthorizationStep {
         moduleDefinitions,
         getAuthorizationRequirements,
         authorizationSessionRepository,
-        authorizeEntityForUser,
+        processAuthorizationCallback,
         moduleRepository,
         credentialRepository,
         createModule,
-        scopePolicy,
     }) {
-        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
         this.moduleDefinitions = moduleDefinitions || [];
         this.getAuthorizationRequirements = getAuthorizationRequirements;
         this.sessions = authorizationSessionRepository;
-        this.authorizeEntityForUser = authorizeEntityForUser;
+        this.processAuthorizationCallback = processAuthorizationCallback;
         this.moduleRepository = moduleRepository;
         this.credentialRepository = credentialRepository;
         this.createModule = createModule || defaultCreateModule;
     }
 
-    /**
-     * @param {Object} params
-     * @param {string} [params.scope] - the scope the caller asks for, from the
-     *   deciding level's allow list (ADR-056 §3.1). Never `global`.
-     * @param {string} [params.fixedScope] - re-authorization keeps the scope the
-     *   credential already has, whatever the config says now.
-     */
-    async execute({ user, entityType, data, step = 1, sessionId, credentialId = null, scope, fixedScope }) {
+    async execute({ user, entityType, data, step = 1, sessionId, credentialId = null }) {
         if (!data || typeof data !== 'object' || Array.isArray(data)) {
             throw Boom.badRequest('data must be an object', {
                 code: 'VALIDATION_ERROR',
@@ -177,16 +166,7 @@ class SubmitAuthorizationStep {
             });
         }
         const definition = findDefinition(this.moduleDefinitions, entityType);
-        // `userId` binds a session to the caller and is what GET /authorize
-        // computes too. The owner of the entity this creates is decided by
-        // scope (§3.2), not by user.primary, and is `ownership.ownerId`.
         const userId = user.getId();
-        const ownership = this.authorizeEntityForUser.resolveOwnership({
-            user,
-            entityType,
-            scope,
-            fixedScope,
-        });
 
         if (!isMultiStep(definition)) {
             if (step !== 1) {
@@ -194,7 +174,7 @@ class SubmitAuthorizationStep {
                     code: 'INVALID_STEP',
                 });
             }
-            return this.complete({ ownership, user, entityType, params: data, credentialId });
+            return this.complete({ userId, entityType, params: data, credentialId });
         }
 
         const totalSteps = getAuthStepCount(definition);
@@ -225,7 +205,7 @@ class SubmitAuthorizationStep {
             );
         }
 
-        const module = this.createModule({ userId: ownership.ownerId, definition });
+        const module = this.createModule({ userId, definition });
         let result;
         try {
             result = await definition.processAuthorizationStep(
@@ -244,8 +224,7 @@ class SubmitAuthorizationStep {
             session.markComplete();
             await this.sessions.update(session);
             const outcome = await this.complete({
-                ownership,
-                user,
+                userId,
                 entityType,
                 params: result.authData || {},
                 credentialId,
@@ -282,15 +261,14 @@ class SubmitAuthorizationStep {
         };
     }
 
-    async complete({ ownership, user, entityType, params, credentialId }) {
+    async complete({ userId, entityType, params, credentialId }) {
         let callback;
         try {
-            ({ result: callback } = await this.authorizeEntityForUser.execute({
-                user,
+            callback = await this.processAuthorizationCallback.execute(
+                userId,
                 entityType,
-                data: params,
-                ownership,
-            }));
+                params
+            );
         } catch (error) {
             throw toAuthorizationError(error);
         }
@@ -298,18 +276,13 @@ class SubmitAuthorizationStep {
             this.moduleRepository.findEntityById(callback.entity_id),
             this.credentialRepository.findCredentialById(callback.credential_id),
         ]);
-        // What the new entity is to this caller (§3.4), so a client need not list again.
-        const tenancy = entity
-            ? describeRecord(entity, this.scopePolicy.accessContext(user), 'entity')
-            : null;
         const outcome = {
             status: 'complete',
-            entity: entity && tenancy ? { ...entity, tenancy } : entity,
+            entity,
             credential: credential && {
                 ...credential,
                 type: entityType,
                 entityIds: entity ? [String(entity.id)] : [],
-                ...(tenancy && { tenancy }),
             },
         };
         if (credentialId && String(callback.credential_id) !== String(credentialId)) {

package/modules/use-cases/process-authorization-callback.js

@@ -1,16 +1,5 @@
 const { Module } = require('../module');
 const { ModuleConstants } = require('../ModuleConstants');
-const { pickExistingEntity } = require('../scope-resolution');
-
-/**
- * What an entity belongs to when the caller says nothing: the person's own,
- * outside any organization.
- */
-const DEFAULT_TENANCY = Object.freeze({
-    scope: 'individual',
-    organizationId: null,
-    legacyOrgId: null,
-});
 const { getLogger } = require('../../logs');
 
 const log = getLogger('frigg.modules.authorization_callback');
@@ -41,17 +30,7 @@ class ProcessAuthorizationCallback {
         this.integrationRepository = integrationRepository;
     }
 
-    /**
-     * @param {string} userId - the OWNER of what this creates (ADR-056 §3.2): the
-     *   person for `individual`, the organization's user for `organization`.
-     *   Not necessarily the caller; callers resolve it from the scope.
-     * @param {string} entityType
-     * @param {Object} params - what the module's authorization needs
-     * @param {{scope: string, organizationId: (string|null), legacyOrgId: (string|null)}} [tenancy]
-     *   the entity's scope and organization (§3.6); default: the person's own,
-     *   with no organization
-     */
-    async execute(userId, entityType, params, tenancy = DEFAULT_TENANCY) {
+    async execute(userId, entityType, params) {
         log.debug('Authorization callback started', {
             eventName: `${log.name}.started`,
             userId,
@@ -78,7 +57,10 @@ class ProcessAuthorizationCallback {
                 userId,
                 entityType
             );
-        const existingEntity = pickExistingEntity(existingEntities, tenancy);
+        const existingEntity =
+            existingEntities && existingEntities.length > 0
+                ? existingEntities[0]
+                : null;
 
         if (existingEntity) {
             log.debug('Existing entity found', {
@@ -174,8 +156,7 @@ class ProcessAuthorizationCallback {
         const persistedEntity = await this.findOrCreateEntity(
             entityDetails,
             entityType,
-            module.credential.id,
-            tenancy
+            module.credential.id
         );
         log.debug('Authorization callback completed', {
             eventName: `${log.name}.completed`,
@@ -252,12 +233,7 @@ class ProcessAuthorizationCallback {
         module.credential = persisted;
     }
 
-    async findOrCreateEntity(
-        entityDetails,
-        moduleName,
-        credentialId,
-        tenancy = DEFAULT_TENANCY
-    ) {
+    async findOrCreateEntity(entityDetails, moduleName, credentialId) {
         const { identifiers, details } = entityDetails;
 
         // Support both 'user' and 'userId' field names from module definitions
@@ -271,16 +247,11 @@ class ProcessAuthorizationCallback {
             );
         }
 
-        // The same provider account in two organizations is two entities
-        // (ADR-056 §3.6), so the match is per organization.
-        const existingEntity = pickExistingEntity(
-            await this.moduleRepository.findEntities({
-                externalId: identifiers.externalId,
-                user: userId,
-                moduleName: moduleName,
-            }),
-            tenancy
-        );
+        const existingEntity = await this.moduleRepository.findEntity({
+            externalId: identifiers.externalId,
+            user: userId,
+            moduleName: moduleName,
+        });
 
         if (existingEntity) {
             // Repoint the entity's credentialId when re-auth produced a
@@ -311,17 +282,12 @@ class ProcessAuthorizationCallback {
             return existingEntity;
         }
 
-        // `organizationId` is not part of the entity data: that carries provider
-        // fields, and one that happens to be called organizationId is theirs.
-        return await this.moduleRepository.createEntity(
-            {
-                ...identifiers,
-                ...details,
-                moduleName: moduleName,
-                credential: credentialId,
-            },
-            { organizationId: tenancy.organizationId ?? null }
-        );
+        return await this.moduleRepository.createEntity({
+            ...identifiers,
+            ...details,
+            moduleName: moduleName,
+            credential: credentialId,
+        });
     }
 }
 

package/modules/use-cases/refresh-entity-options.js

@@ -1,5 +1,4 @@
 const { Module } = require('../module');
-const { DEFAULT_SCOPE_POLICY } = require('../scope-policy');
 
 class RefreshEntityOptions {
     /**
@@ -7,11 +6,9 @@ class RefreshEntityOptions {
      * @param {import('../repositories/module-repository-interface').ModuleRepositoryInterface} params.moduleRepository
      * @param {} params.moduleDefinitions
      */
-    constructor({ moduleRepository, moduleDefinitions, scopePolicy }) {
+    constructor({ moduleRepository, moduleDefinitions }) {
         this.moduleRepository = moduleRepository;
         this.moduleDefinitions = moduleDefinitions;
-        // Who may load an entity follows its scope (ADR-056 §3.6).
-        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
     }
 
     /**
@@ -39,7 +36,7 @@ class RefreshEntityOptions {
 
         // Validate entity ownership
         const isOwned = typeof userIdOrUser === 'object' && userIdOrUser?.ownsUserId
-            ? this.scopePolicy.canUseEntity(userIdOrUser, entity)
+            ? userIdOrUser.ownsUserId(entity.userId)
             : entity.userId?.toString() === userId?.toString();
 
         if (!isOwned) {
@@ -61,11 +58,8 @@ class RefreshEntityOptions {
             );
         }
 
-        // Built for the entity's OWNER, not the caller: a caller may use an
-        // organization's entity, and a token refresh during this call must
-        // update the owner's credential, not create one under the caller.
         const module = new Module({
-            userId: entity.userId ?? userId,
+            userId,
             entity,
             definition: moduleDefinition,
         });

package/modules/use-cases/test-module-auth.js

@@ -1,5 +1,4 @@
 const { Module } = require('../module');
-const { DEFAULT_SCOPE_POLICY } = require('../scope-policy');
 
 class TestModuleAuth {
     /**
@@ -7,11 +6,9 @@ class TestModuleAuth {
      * @param {import('../repositories/module-repository-interface').ModuleRepositoryInterface} params.moduleRepository - Repository for module data operations.
      * @param {Array<Object>} params.moduleDefinitions - Array of module definitions.
      */
-    constructor({ moduleRepository, moduleDefinitions, scopePolicy }) {
+    constructor({ moduleRepository, moduleDefinitions }) {
         this.moduleRepository = moduleRepository;
         this.moduleDefinitions = moduleDefinitions;
-        // Who may load an entity follows its scope (ADR-056 §3.6).
-        this.scopePolicy = scopePolicy || DEFAULT_SCOPE_POLICY;
     }
 
     /**
@@ -38,7 +35,7 @@ class TestModuleAuth {
 
         // Validate entity ownership
         const isOwned = typeof userIdOrUser === 'object' && userIdOrUser?.ownsUserId
-            ? this.scopePolicy.canUseEntity(userIdOrUser, entity)
+            ? userIdOrUser.ownsUserId(entity.userId)
             : entity.userId?.toString() === userId?.toString();
 
         if (!isOwned) {
@@ -60,11 +57,8 @@ class TestModuleAuth {
             );
         }
 
-        // Built for the entity's OWNER, not the caller: a caller may use an
-        // organization's entity, and a token refresh during this call must
-        // update the owner's credential, not create one under the caller.
         const module = new Module({
-            userId: entity.userId ?? userId,
+            userId,
             entity,
             definition: moduleDefinition,
         });

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.684.0da024b.0",
+    "version": "2.0.0--canary.679.a2bcc2f.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -28,7 +28,6 @@
         "express-async-handler": "^1.2.0",
         "form-data": "^4.0.6",
         "fs-extra": "^11.2.0",
-        "jose": "^5.10.0",
         "lodash": "4.18.1",
         "lodash.get": "^4.4.2",
         "node-fetch": "^2.6.7",
@@ -48,9 +47,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.684.0da024b.0",
-        "@friggframework/prettier-config": "2.0.0--canary.684.0da024b.0",
-        "@friggframework/test": "2.0.0--canary.684.0da024b.0",
+        "@friggframework/eslint-config": "2.0.0--canary.679.a2bcc2f.0",
+        "@friggframework/prettier-config": "2.0.0--canary.679.a2bcc2f.0",
+        "@friggframework/test": "2.0.0--canary.679.a2bcc2f.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -90,5 +89,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "0da024bd724c987e4bc839ab0c302580333466a1"
+    "gitHead": "a2bcc2f124b0574c0d868beff77b4da848fd7849"
 }

package/prisma-mongodb/schema.prisma

@@ -56,14 +56,6 @@ model User {
   integrations Integration[]
   processes    Process[]
 
-  // Organization memberships (ADR-056 §3.6). `organizationId` above is the legacy
-  // single-org pointer: set on a person's first link, never moved afterwards, and
-  // read as an implicit membership when no row exists for it.
-  // As an individual: the organizations this person belongs to.
-  memberships OrganizationMembership[] @relation("IndividualMemberships")
-  // As an organization: the people who belong to it.
-  orgMembers OrganizationMembership[] @relation("OrganizationMemberships")
-
   @@unique([username, appUserId])
   @@index([type])
   @@index([appUserId])
@@ -134,14 +126,6 @@ model Entity {
   moduleName   String?
   externalId   String?
 
-  // Organization this entity was connected in (ADR-056 §3.6): the active
-  // organization for `individual`, the owner for `organization`, null for
-  // `global`. Null on an `individual` entity is also what every row written
-  // before this column existed has, and what `individualAcross: 'all'` writes.
-  // Deliberately not a relation: a deleted organization must leave its rows
-  // invisible, not turn them into "unscoped" ones (SetNull would do that).
-  organizationId String? @db.ObjectId
-
   data Json @default("{}")
 
   createdAt DateTime @default(now())
@@ -158,7 +142,6 @@ model Entity {
   associationObjects AssociationObject[]
 
   @@index([userId])
-  @@index([userId, organizationId])
   @@index([externalId])
   @@index([moduleName])
   @@index([credentialId])
@@ -176,11 +159,6 @@ model Integration {
   user   User?             @relation(fields: [userId], references: [id], onDelete: Cascade)
   status IntegrationStatus @default(IN_CREATION)
 
-  // Organization this integration was created in (ADR-056 §3.6): the active
-  // organization at create time. Null for rows that predate the column. Not a
-  // relation, for the same reason as Entity.organizationId.
-  organizationId String? @db.ObjectId
-
   // Configuration and version
   config  Json? // Integration configuration object
   version String?
@@ -205,7 +183,6 @@ model Integration {
   processes    Process[]
 
   @@index([userId])
-  @@index([userId, organizationId])
   @@index([status])
   @@map("Integration")
 }
@@ -503,27 +480,3 @@ model AuthorizationSession {
   @@index([expiresAt])
   @@map("AuthorizationSession")
 }
-
-// ============================================================================
-// ORGANIZATION MEMBERSHIP (ADR-056 §3.6)
-// ============================================================================
-
-/// One person's membership of one organization. Unique on the pair, so adding a
-/// membership is an idempotent upsert. `orgRole` is the organization role the
-/// adopter token carried when the membership was created (MEMBER when it named none). NoAction on delete
-/// because MongoDB gives no referential integrity: delete a user's memberships
-/// before the user.
-model OrganizationMembership {
-  id                 String   @id @default(auto()) @map("_id") @db.ObjectId
-  individualUserId   String   @db.ObjectId
-  organizationUserId String   @db.ObjectId
-  orgRole            String   @default("MEMBER")
-  createdAt          DateTime @default(now())
-
-  individualUser   User @relation("IndividualMemberships", fields: [individualUserId], references: [id], onDelete: NoAction, onUpdate: NoAction)
-  organizationUser User @relation("OrganizationMemberships", fields: [organizationUserId], references: [id], onDelete: NoAction, onUpdate: NoAction)
-
-  @@unique([individualUserId, organizationUserId])
-  @@index([organizationUserId])
-  @@map("OrganizationMembership")
-}

package/prisma-postgresql/schema.prisma

@@ -56,14 +56,6 @@ model User {
   integrations Integration[]
   processes    Process[]
 
-  // Organization memberships (ADR-056 §3.6). `organizationId` above is the legacy
-  // single-org pointer: set on a person's first link, never moved afterwards, and
-  // read as an implicit membership when no row exists for it.
-  // As an individual: the organizations this person belongs to.
-  memberships OrganizationMembership[] @relation("IndividualMemberships")
-  // As an organization: the people who belong to it.
-  orgMembers OrganizationMembership[] @relation("OrganizationMemberships")
-
   @@unique([username, appUserId])
   @@index([type])
   @@index([appUserId])
@@ -131,14 +123,6 @@ model Entity {
   moduleName   String?
   externalId   String?
 
-  // Organization this entity was connected in (ADR-056 §3.6): the active
-  // organization for `individual`, the owner for `organization`, null for
-  // `global`. Null on an `individual` entity is also what every row written
-  // before this column existed has, and what `individualAcross: 'all'` writes.
-  // Deliberately not a relation: a deleted organization must leave its rows
-  // invisible, not turn them into "unscoped" ones (SetNull would do that).
-  organizationId Int?
-
   data Json @default("{}")
 
   createdAt DateTime @default(now())
@@ -152,7 +136,6 @@ model Entity {
   associationObjects AssociationObject[]
 
   @@index([userId])
-  @@index([userId, organizationId])
   @@index([externalId])
   @@index([moduleName])
   @@index([credentialId])
@@ -169,11 +152,6 @@ model Integration {
   user   User?             @relation(fields: [userId], references: [id], onDelete: Cascade)
   status IntegrationStatus @default(IN_CREATION)
 
-  // Organization this integration was created in (ADR-056 §3.6): the active
-  // organization at create time. Null for rows that predate the column. Not a
-  // relation, for the same reason as Entity.organizationId.
-  organizationId Int?
-
   // Configuration and version
   config  Json? // Integration configuration object
   version String?
@@ -197,7 +175,6 @@ model Integration {
   processes    Process[]
 
   @@index([userId])
-  @@index([userId, organizationId])
   @@index([status])
 }
 
@@ -483,24 +460,3 @@ model AuthorizationSession {
   @@index([userId, entityType])
   @@index([expiresAt])
 }
-
-// ============================================================================
-// ORGANIZATION MEMBERSHIP (ADR-056 §3.6)
-// ============================================================================
-
-/// One person's membership of one organization. Unique on the pair, so adding a
-/// membership is an idempotent upsert. `orgRole` is the organization role the
-/// adopter token carried when the membership was created (MEMBER when it named none).
-model OrganizationMembership {
-  id                 Int      @id @default(autoincrement())
-  individualUserId   Int
-  organizationUserId Int
-  orgRole            String   @default("MEMBER")
-  createdAt          DateTime @default(now())
-
-  individualUser   User @relation("IndividualMemberships", fields: [individualUserId], references: [id], onDelete: Cascade, onUpdate: NoAction)
-  organizationUser User @relation("OrganizationMemberships", fields: [organizationUserId], references: [id], onDelete: Cascade, onUpdate: NoAction)
-
-  @@unique([individualUserId, organizationUserId])
-  @@index([organizationUserId])
-}

package/types/index.d.ts

@@ -12,5 +12,4 @@
 /// <reference path="./eslint-config/index.d.ts" />
 /// <reference path="./associations/index.d.ts" />
 /// <reference path="./syncs/index.d.ts" />
-/// <reference path="./user/index.d.ts" />
 /// <reference path="./modules/index.d.ts" />

package/types/modules/index.d.ts

@@ -36,100 +36,13 @@ declare module "@friggframework/core" {
     [entityType: string]: EntityRegistration | boolean | undefined;
   }
 
-  /**
-   * One level's setting: a scope, or a default plus the scopes a request may
-   * choose from (ADR-056 §3.1). `global` is never chosen by a tenant request.
-   */
-  export type ScopeSetting =
-    | EntityScope
-    | { default?: EntityScope; allow?: EntityScope[] };
-
-  /**
-   * `appDefinition.ownership` (ADR-056 §3, §3.6). Resolution order for a new
-   * connection: request, binding, integration, entity type (`entities[name].scope`),
-   * this `scope`, then `organization` for an organization-primary app and
-   * `individual` otherwise.
-   */
-  export interface AppOwnership {
-    scope?: ScopeSetting;
-    /**
-     * `'organization'` (default): an individual entity belongs to the organization
-     * it was connected in. `'all'`: one connection per person across every
-     * organization, stored with no `organizationId`.
-     */
-    individualAcross?: "organization" | "all";
-  }
-
-  /** `Definition.ownership` on an integration (ADR-056 §3.1, §3.3). */
-  export interface IntegrationOwnership {
-    /** Scope every binding of this integration accepts unless it sets its own. */
-    scope?: ScopeSetting;
-    /** `'derive'` (default): organization when every entity it uses is organization-scoped. */
-    owner?: "derive" | "individual" | "organization";
-  }
-
   export interface AppDefinition {
     integrations: any[];
     /** App-level entity type registry (ADR-059). */
     entities?: AppDefinitionEntities;
-    /** Who owns what a person connects (ADR-056). */
-    ownership?: AppOwnership;
     [key: string]: unknown;
   }
 
-  /** Whose a record is and what the caller may do with it (ADR-056 §3.4). */
-  export interface RecordTenancy {
-    scope: Exclude<EntityScope, "global">;
-    owner: { type: Exclude<EntityScope, "global">; id: string };
-    /** Null for an individual entity connected outside an organization, or under `individualAcross: 'all'`. */
-    organizationId: string | null;
-    /** `manage`: create, reauthorize, delete. `use`: bind it, proxy through it. `view`: metadata only. */
-    access: "manage" | "use" | "view";
-  }
-
-  /** Which scope a connection gets, and from which level of the order (ADR-056 §3.1). */
-  export interface ResolvedScope {
-    scope: EntityScope;
-    /** Where `scope` came from. `request` when the request chose within the allowed list. */
-    source: "request" | "binding" | "integration" | "entityType" | "app" | "default";
-    /** The level that decided what a request may choose from. */
-    decidedBy: "binding" | "integration" | "entityType" | "app" | "default";
-    allow: EntityScope[];
-  }
-
-  /**
-   * First match wins, each level overriding the ones below it. A request may
-   * choose only from the deciding level's `allow`; `global` never comes from a
-   * tenant request. Throws a Boom 400/403 for a request scope that is not allowed.
-   */
-  export function resolveScope(levels: {
-    request?: EntityScope;
-    binding?: ScopeSetting;
-    integration?: ScopeSetting;
-    entityType?: ScopeSetting;
-    app?: ScopeSetting;
-    primary?: "individual" | "organization";
-  }): ResolvedScope;
-
-  /** Every binding of every integration with its resolved scope (for tooling that wants to show the chain). */
-  export function listBindingScopes(
-    appDefinition: Pick<AppDefinition, "integrations" | "ownership">,
-    entityTypeRegistry: EntityTypeRegistry,
-    primary?: "individual" | "organization"
-  ): Array<{
-    integration: string;
-    binding: string;
-    moduleName: string | null;
-    scope: EntityScope;
-    source: ResolvedScope["source"];
-    owner: "derive" | "individual" | "organization";
-  }>;
-
-  /** Invalid ownership or scope setting, thrown at app-definition load. `code` is always `OWNERSHIP_CONFIG_INVALID`. */
-  export class OwnershipConfigError extends Error {
-    code: "OWNERSHIP_CONFIG_INVALID";
-  }
-
   /**
    * Builds the registry from `entities` plus the modules integrations bind.
    * Throws EntityRegistryError on an invalid registry.