npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (972) hide show

package/dist/esm/config/services/app-configuration.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-configuration.backend.service.js","sourceRoot":"","sources":["../../../../../src/config/services/app-configuration.backend.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2CAA2C,EAG3C,uBAAuB,EACxB,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAEL,0BAA0B,EAC1B,wCAAwC,GACzC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAGL,6BAA6B,GAC9B,MAAM,4EAA4E,CAAC;AAEpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,6BAA6B,EAC7B,iBAAiB,GAOlB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G;;;;;;;;;;;;GAYG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAaW;IACa;IACG;IAdnD,QAAQ,CAA+D;IACzE,OAAO,GAA4B,IAAI,CAAC;IACxC,kBAAkB,GAA4C,IAAI,CAAC;IACnE,2BAA2B,GAA2C,EAAE,CAAC;IACzE,wCAAwC,GAAmD,IAAI,CAAC;IAChG,QAAQ,GAAmC,IAAI,CAAC;IAChD,cAAc,GAAkB,IAAI,CAAC;IACrC,eAAe,GAA8B,IAAI,CAAC;IAClD,YAAY,GAAkB,IAAI,CAAC;IACnC,QAAQ,GAAkB,IAAI,CAAC;IAEvC,YAC6C,MAAqB,EACR,YAAwC,EACrC,aAA4C;QAF5D,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACrC,kBAAa,GAAb,aAAa,CAA+B;QAEvG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,IAAI,CAAC,2BAA2B,GAAG,EAAE,CAAC;YACtC,IAAI,CAAC,wCAAwC,GAAG,IAAI,CAAC;YACrD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YACnI,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;YACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC;YAC3B,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,oBAAoB,CAAC,eAAe,CAAC;YAC5D,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;YAExB,IAAI,CAAC,QAAQ,CAAC,oDAAoD,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACI,4BAA4B,CAAC,OAUnC;QACC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,iEAAiE;oBAC1E,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,iGAAiG;wBACjG,uCAAuC;oBACzC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACnE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,+FAA+F;wBAC/F,gEAAgE;oBAClE,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,kBAAkB,GAAG,wCAAwC,CACjE,OAAO,CAAC,kBAAkB,EAC1B,OAAO,CAAC,MAAM,CACf,CAAC;YACF,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EACL,oFAAoF,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;wBAC3H,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;qBACrC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4EAA4E,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC;QAChC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAE/B,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE;YACvC,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,qBAAqB,CAAC,QAAgB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,SAAS;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,OAAO,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACI,qCAAqC,CAAC,mBAA2B,EAAE,QAAgB;QACxF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC9F,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,mBAA2B;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACI,sCAAsC,CAAC,mBAA2B;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,qBAAqB,GAAG,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAC9E,IAAI,CAAC,qBAAqB,EAAE,eAAe;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAED;;;;;;;;OAQG;IACI,sCAAsC,CAAC,QAAgB;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE9C,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,MAAM,KAAK,GAAG,qBAAqB,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,mBAAmB,CAAC;YAChD,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,QAAQ,GAAG,mBAAmB,CAAC;QAC9D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACI,iCAAiC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE9C,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/F,IAAI,UAAU;gBAAE,OAAO,mBAAmB,CAAC;QAC7C,CAAC;QACD,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,wBAAwB,IAAI,IAAI,CAAC;IAC1C,CAAC;IAEO,4BAA4B,CAAC,MAAwB;QAC3D,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAClE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAErD,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC5F,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,OAAO,EAAE;4BACP,OAAO,EAAE,oBAAoB,mBAAmB,iDAAiD,QAAQ,KAAK;gCAC5G,0BAA0B,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBAC3D;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC5D,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC9D,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;oBAC3C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;4BACrE,OAAO,EAAE;gCACP,OAAO,EAAE,kDAAkD,QAAQ,KAAK;oCACtE,0BAA0B,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;6BAC3D;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,qBAAqB,EAAE,QAAQ,CAAC;gBAC7D,IAAI,QAAQ,EAAE,CAAC;oBACb,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;wBAC1B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;4BACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gCACrE,OAAO,EAAE;oCACP,OAAO,EAAE,+DAA+D,EAAE,KAAK;wCAC7E,kCAAkC,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iCAClE;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,yBAAyB,CAAC,MAAwB;QACxD,IAAI,MAAM,CAAC,IAAI,EAAE,iBAAiB,KAAK,KAAK,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mJAAmJ,CACpJ,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;YAC9B,IAAI,IAAI,EAAE,wBAAwB,KAAK,IAAI,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qDAAqD,WAAW,4DAA4D,CAC7H,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,EAAE,oBAAoB,KAAK,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mDAAmD,WAAW,wDAAwD,CACvH,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,gBAAgB,IAAI,WAAW,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;gBAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,WAAW,CAAC,gBAAgB,8CAA8C,WAAW,IAAI,CACtJ,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;gBAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;gBACpD,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC;gBACrD,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBACpD,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;oBAC3C,IAAI,WAAW,KAAK,SAAS;wBAAE,OAAO,KAAK,CAAC;oBAC5C,IAAI,OAAO,WAAW,KAAK,SAAS;wBAAE,OAAO,WAAW,CAAC;oBACzD,OAAO,WAAW,CAAC,OAAO,CAAC;gBAC7B,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,WAAW,8BAA8B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iEAAiE,CACnL,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,8BAA8B,CAAC,MAAwB;QAC7D,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,KAAK,2CAA2C,CAAC,OAAO,EAAE,CAAC;YACvF,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,KAAK,2CAA2C,CAAC,OAAO,EAAE,CAAC;YACvF,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,2CAA2C,CAAC,aAAa,EAAE,CAAC;YACnG,gBAAgB,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,2CAA2C,CAAC,WAAW,EAAE,CAAC;YAC/F,gBAAgB,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,2CAA2C,CAAC,SAAS,EAAE,CAAC;YAChF,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAEO,yBAAyB,CAAC,UAAmB;QACnD,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAC;YACjC,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;YACrF,OAAO,EAAE;gBACP,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,cAAc,EAAE,IAAI,CAAC,eAAe;gBACpC,OAAO,EAAE,mDAAmD,UAAU,IAAI,QAAQ,2BAA2B;aAC9G;SACF,CAEF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,aAAa;QAClB,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sCAAsC,GAAuC,SAAS,CAAC;IAE/F,IAAW,qCAAqC;QAC9C,OAAO,IAAI,CAAC,sCAAsC,CAAC;IACrD,CAAC;IAEM,0CAA0C,CAAC,OAA+B;QAC/E,IAAI,CAAC,sCAAsC,GAAG,OAAO,CAAC;IACxD,CAAC;IAED,IAAW,MAAM;QAEf,IAAI,CAAC,IAAI,CAAC,OAAO;YACf,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,OAAQ,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,mBAAmB,CAAC,KAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1E,OAAO,QAAQ,EAAE,GAAG,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,uBAAuB;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,iCAAiC,EAAE,CAAC;QACrE,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,0BAA0B;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACI,6BAA6B,CAAC,IAAwB,EAAE,WAAoB;QACjF,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACnC,kFAAkF;QAClF,IAAI,IAAI,KAAK,kBAAkB,CAAC,GAAG;YAAE,OAAO,WAAW,CAAC;QACxD,MAAM,IAAI,GAAG,GAAG,WAAW,GAAG,6BAA6B,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACjG,kGAAkG;QAClG,gGAAgG;QAChG,kGAAkG;QAClG,qGAAqG;QACrG,uEAAuE;QACvE,mGAAmG;QACnG,6DAA6D;QAC7D,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,2BAA2B,CAAC,KAAsB;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,sEAAsE;QACtE,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IAClE,CAAC;IAGD,IAAW,OAAO;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAElD,OAAO,IAAI,CAAC,QAAS,CAAC;IACxB,CAAC;IAED,IAAW,aAAa;QACtB,IAAI,CAAC,IAAI,CAAC,cAAc;YACtB,MAAM,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC;QAExD,OAAO,IAAI,CAAC,cAAe,CAAC;IAC9B,CAAC;IAED,IAAW,cAAc;QACvB,IAAI,CAAC,IAAI,CAAC,eAAe;YACvB,MAAM,IAAI,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QAEzD,OAAO,IAAI,CAAC,eAAgB,CAAC;IAC/B,CAAC;IAED,IAAW,WAAW;QACpB,IAAI,CAAC,IAAI,CAAC,YAAY;YACpB,MAAM,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAC;QAEtD,OAAO,IAAI,CAAC,YAAa,CAAC;IAC5B,CAAC;IAED;;;;;;;;;OASG;IACH,IAAW,OAAO;QAChB,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,WAAW,EAAE,IAAI,CAAC,YAAY;oBAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;oBAClC,cAAc,EAAE,IAAI,CAAC,eAAe;oBACpC,OAAO,EAAE,yDAAyD;iBACnE;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,aAA+C;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC7E,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAChG,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,sEAAsE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBAC7G,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iEAAiE,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACzG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,cAAkC,EAAE;YAC3D,MAAM,EAAE,gBAAgB;YACxB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE;YACtC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,oBAAoB,CAAC,eAAwC;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,0FAA0F;iBACpG;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,2BAA2B,GAAG,QAAQ,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAC7E,IAAI,CAAC,wCAAwC,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5D,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,IAAI,IAAI;YACzD,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,IAAI,IAAI;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG;YACxB,GAAG,UAAU;YACb,SAAS,EAAE;gBACT,MAAM,EAAE;oBACN,OAAO,EAAE,QAAQ,CAAC,KAAK;iBACxB;aACF;SACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;YACzD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;IACL,CAAC;IAEM,4BAA4B,CAAC,mBAA2B;QAC7D,OAAO,IAAI,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IAED,yHAAyH;IAClH,0CAA0C;QAC/C,OAAO,IAAI,CAAC,wCAAwC,CAAC;IACvD,CAAC;IAED;;;OAGG;IACI,+BAA+B;QACpC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,yBAAyB,CAAC,iCAAiC,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACP,OAAO,EACL,gFAAgF,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAC/G,yFAAyF;aAC5F;SACF,CAAC,CAAC;IACL,CAAC;IAEO,mBAAmB,CACzB,MAAwB,EACxB,OAGC;QAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC;QAC/B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAE/B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE;YAClD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAW,SAAS;QAIlB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG;SACnC,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAW,wBAAwB;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;QAC1C,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,KAAK,IAAI,CAAC,CAAC;IACzF,CAAC;CAEF,CAAA;AA1vBY,uBAAuB;IADnC,UAAU,EAAE;IAcR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;qCAFC,aAAa;QACM,0BAA0B;QACtB,6BAA6B;GAf9F,uBAAuB,CA0vBnC","sourcesContent":["/*\n Application Configuration Service\n \n Service for managing application-level configuration\n /\n\nimport { injectable, inject } from 'inversify';\nimport {\n APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS,\n AppConfiguration,\n type AppConfiguration_PreOverrideSeed,\n AppConfiguration_Schema\n} from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { AppConfigurationSecrets } from '~wildo-backend-lib/config/models/app-config-secrets.backend.schemas';\nimport { AppConfigurationLoaderService } from './app-configuration-loader.backend.service';\nimport {\n type AppConfiguration_BackendAuthored,\n applyBackendAuthoredConfig,\n inspectAppConfigurationBoundaryMutations,\n} from '~wildo-backend-lib/config/models/app-config.backend-authored.definitions';\nimport {\n type ProviderRuntimeArtifact,\n type ProviderRuntimeArtifactEvidenceMetadata,\n ProviderRuntimeArtifactSchema,\n} from '~wildo-backend-lib/config/models/provider-runtime-artifact.backend.schemas';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n ErrorCustomMessageReference,\n ErrorType,\n MAIN_API_BASE_PATH,\n ResourceServerKind,\n RESOURCE_SERVER_MOUNT_ROUTE,\n MANUAL_CONTROLLER_ROUTES_URLS,\n resolveBrandAsset,\n RuntimeEnvironment,\n WildoError_Backend,\n type BrandAssetQuery,\n type FrontendProvidersBlock,\n type PersistenceAdapterType,\n type UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\n\n\n/\n Application Configuration Service\n \n Manages complete application configuration. After T5, the loading chain is:\n * 1. Env vars → database addresses, platform URLs\n * 2. Minimal pre-override skeleton → only the structural placeholders the\n * backend must provide before backendConfig is merged\n * 3. Apps-manager fetch → reduced managed metadata + JWT public keys + appSlug\n * 4. App-authored backendConfig → merged onto the runtime/bootstrap seed\n \n This service uses the loader service for steps 1-3, then provides\n * cached, type-safe access to all configuration sections.\n /\n@injectable()\nexport class AppConfigurationService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n private _config: AppConfiguration \| null = null;\n private _preOverrideConfig: AppConfiguration_PreOverrideSeed \| null = null;\n private _frontendProviderBootstraps: Record<string, FrontendProvidersBlock> = {};\n private _providerRuntimeArtifactEvidenceMetadata: ProviderRuntimeArtifactEvidenceMetadata \| null = null;\n private _secrets: AppConfigurationSecrets \| null = null;\n private _applicationId: string \| null = null;\n private _applicationEnv: RuntimeEnvironment \| null = null;\n private _serviceName: string \| null = null;\n private _appSlug: string \| null = null;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigLoaderService) private loaderService: AppConfigurationLoaderService\n ) {\n this.logDebug = this.logger.debugByType('AppConfigurationService');\n this.logger.setDebugTypeLogging('AppConfigurationService', false);\n }\n\n /\n Initialize the configuration service\n /\n public async initialize(): Promise<void> {\n if (!this._config \|\| !this._secrets) {\n this.logDebug('Initializing application configuration...');\n this._frontendProviderBootstraps = {};\n this._providerRuntimeArtifactEvidenceMetadata = null;\n const { appConfig, appSecrets, applicationId, applicationEnvConfig, serviceName, appSlug } = await this.loaderService.initialize();\n this._preOverrideConfig = appConfig;\n this._secrets = appSecrets;\n this._applicationId = applicationId;\n this._applicationEnv = applicationEnvConfig.APPLICATION_ENV;\n this._serviceName = serviceName;\n this._appSlug = appSlug;\n\n this.logDebug('Application configuration initialized successfully', { appSlug });\n }\n }\n\n /\n Hydrate the service from an already-resolved full configuration object.\n \n Platform startup paths use this when configuration was assembled by another\n * runtime-specific service. Callers must make the ownership decision explicit:\n * either provide a `boundaryBaseConfig` to run the Phase 4 mutation checks, or\n * set `skipBoundaryInspection` when hydrating a platform-owned config that does\n * not go through the tenant backendConfig authoring seam.\n /\n public hydrateResolvedConfiguration(options: {\n config: AppConfiguration;\n secrets: AppConfigurationSecrets;\n applicationId: string;\n applicationEnv: RuntimeEnvironment;\n serviceName: string;\n appSlug: string;\n emitWarnings?: boolean;\n boundaryBaseConfig?: AppConfiguration \| AppConfiguration_PreOverrideSeed;\n skipBoundaryInspection?: boolean;\n }): void {\n const resolvedAppSlug = options.appSlug.trim();\n if (!resolvedAppSlug) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Resolved application configuration requires a non-empty appSlug',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (options.boundaryBaseConfig && options.skipBoundaryInspection) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'hydrateResolvedConfiguration cannot accept both boundaryBaseConfig and skipBoundaryInspection. ' +\n 'Choose one ownership mode explicitly.',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (!options.boundaryBaseConfig && !options.skipBoundaryInspection) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'hydrateResolvedConfiguration requires either boundaryBaseConfig for Phase 4 ownership checks ' +\n 'or skipBoundaryInspection for platform-owned hydrated configs.',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (options.boundaryBaseConfig) {\n const boundaryInspection = inspectAppConfigurationBoundaryMutations(\n options.boundaryBaseConfig,\n options.config,\n );\n if (boundaryInspection.errors.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Hydrated resolved config attempted to cross platform/runtime-managed boundaries: ${boundaryInspection.errors.join(' ')}`,\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n if ((options.emitWarnings ?? true) && boundaryInspection.warnings.length > 0) {\n this.logger.warn(\n `[Config] hydrated resolved config touched migration-seam runtime fields. ${boundaryInspection.warnings.join(' ')}`,\n );\n }\n }\n\n this._secrets = options.secrets;\n this._applicationId = options.applicationId;\n this._applicationEnv = options.applicationEnv;\n this._serviceName = options.serviceName;\n this._appSlug = resolvedAppSlug;\n this._preOverrideConfig = null;\n\n this.applyResolvedConfig(options.config, {\n reason: 'hydrated',\n emitWarnings: options.emitWarnings ?? true,\n });\n }\n\n /\n W3.1: Get auth policy for a specific user type.\n * Returns the complete per-user-type auth policy, or null if the user type doesn't exist in config.\n /\n public getUserTypeAuthPolicy(userType: string): UserTypeAuthPolicy \| null {\n const appConfig = this._config;\n if (!appConfig?.userTypes) return null;\n const typeDef = appConfig.userTypes[userType];\n return typeDef?.auth ?? null;\n }\n\n /\n Resolve a specific frontend-service user-management entry.\n * Used when runtime flows must enforce surface-level auth/register policy\n * for a known frontend service + user-type combination.\n /\n public getFrontendServiceUserManagementEntry(frontendServiceName: string, userType: string): { register: boolean; auth: boolean; isDefault?: boolean } \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n return appConfig.frontendServices[frontendServiceName]?.usersManagement?.[userType] ?? null;\n }\n\n /\n Check whether a frontend service identity is declared in app-owned config.\n * This is the authoritative allow-list used for runtime/public frontend identity.\n /\n public hasFrontendService(frontendServiceName: string): boolean {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return false;\n return !!appConfig.frontendServices[frontendServiceName];\n }\n\n /\n Resolve user type from the active frontend service identity.\n * Reads `frontendServices[frontendServiceName].usersManagement` and returns\n * the default entry, or the first entry when no explicit default exists.\n /\n public resolveUserTypeFromFrontendServiceName(frontendServiceName: string): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n const frontendServiceConfig = appConfig.frontendServices[frontendServiceName];\n if (!frontendServiceConfig?.usersManagement) return null;\n const entries = Object.entries(frontendServiceConfig.usersManagement);\n const defaultEntry = entries.find(([, v]) => v.isDefault);\n const firstEntry = entries[0];\n return (defaultEntry ?? firstEntry)?.[0] ?? null;\n }\n\n /\n Reverse lookup: given a user type, find the frontend service where that user type\n * has `isDefault: true` in usersManagement. Falls back to any app type that\n * references the user type (with `auth: true`) if no isDefault match exists.\n \n This is the mirror of `resolveUserTypeFromFrontendServiceName()`:\n * frontendServiceName → userType (forward)\n * userType → frontendServiceName (reverse)\n /\n public resolveFrontendServiceNameFromUserType(userType: string): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n\n let fallback: string \| null = null;\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(appConfig.frontendServices)) {\n const entry = frontendServiceConfig.usersManagement[userType];\n if (!entry) continue;\n if (entry.isDefault) return frontendServiceName;\n if (entry.auth && !fallback) fallback = frontendServiceName;\n }\n return fallback;\n }\n\n /\n Find the default frontend service — the first frontend service that has any\n * user type entry with `isDefault: true`. Used as a last-resort fallback\n * when no specific user type context is available (e.g., SAML errors\n * before user identification).\n /\n public resolveDefaultFrontendServiceName(): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(appConfig.frontendServices)) {\n const hasDefault = Object.values(frontendServiceConfig.usersManagement).some(v => v.isDefault);\n if (hasDefault) return frontendServiceName;\n }\n const firstFrontendServiceName = Object.keys(appConfig.frontendServices)[0];\n return firstFrontendServiceName ?? null;\n }\n\n private validateEntityIdentityConfig(config: AppConfiguration): void {\n const { userTypes, frontendServices, organizationTypes } = config;\n const userTypeKeys = new Set(Object.keys(userTypes));\n\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(frontendServices)) {\n for (const userType of Object.keys(frontendServiceConfig.usersManagement)) {\n if (!userTypeKeys.has(userType)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `frontendServices.${frontendServiceName}.usersManagement references unknown userType \"${userType}\". ` +\n `userTypes must define: ${[...userTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n\n if (organizationTypes) {\n const orgTypeKeys = new Set(Object.keys(organizationTypes));\n for (const [, orgConfig] of Object.entries(organizationTypes)) {\n for (const userType of orgConfig.userTypes) {\n if (!userTypeKeys.has(userType)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `organizationTypes references unknown userType \"${userType}\". ` +\n `userTypes must define: ${[...userTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n for (const [, userTypeDef] of Object.entries(userTypes)) {\n const orgTypes = userTypeDef.requiresOrgMembership?.orgTypes;\n if (orgTypes) {\n for (const ot of orgTypes) {\n if (!orgTypeKeys.has(ot)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `requiresOrgMembership.orgTypes references unknown org type \"${ot}\". ` +\n `organizationTypes must define: ${[...orgTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n }\n }\n }\n\n private emitDeferredFieldWarnings(config: AppConfiguration): void {\n if (config.auth?.crossOrgSSOAccess === false) {\n this.logger.info(\n `[Config] crossOrgSSOAccess is disabled — users with enterprise SSO links from one organization will be blocked from SSO into other organizations.`\n );\n }\n\n for (const [userTypeKey, userTypeDef] of Object.entries(config.userTypes)) {\n const auth = userTypeDef.auth;\n if (auth?.anonymousSessionsEnabled === true) {\n this.logger.info(\n `[Config] Anonymous sessions enabled for userType \"${userTypeKey}\" — isAnonymizable resources will support ANONYMOUS scope.`\n );\n }\n if (auth?.oneOffSessionAllowed === true) {\n this.logger.info(\n `[Config] One-off sessions enabled for userType \"${userTypeKey}\" — consumable token links can create scoped sessions.`\n );\n }\n if (userTypeDef.uniqueIdentifier && userTypeDef.uniqueIdentifier !== 'email') {\n this.logger.warn(\n `[Config] uniqueIdentifier only supports \"email\" — value \"${userTypeDef.uniqueIdentifier}\" will be treated as \"email\" for userType \"${userTypeKey}\".`\n );\n }\n\n if (auth?.stepUpAuth?.enabled) {\n const stepUpMethods = auth.stepUpAuth.methods ?? [];\n const enabledMethods = auth.authMethodsEnabled ?? {};\n const hasUsableMethod = stepUpMethods.some((method) => {\n const methodValue = enabledMethods[method];\n if (methodValue === undefined) return false;\n if (typeof methodValue === 'boolean') return methodValue;\n return methodValue.enabled;\n });\n if (!hasUsableMethod) {\n this.logger.warn(\n `[Config] stepUpAuth is enabled for userType \"${userTypeKey}\" but none of its methods [${stepUpMethods.join(', ')}] are enabled in authMethodsEnabled — step-up will always fail.`\n );\n }\n }\n }\n }\n\n private getPreOverridePlaceholderPaths(config: AppConfiguration): string[] {\n const placeholderPaths: string[] = [];\n\n if (config.appIdentity.appName === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.appName) {\n placeholderPaths.push('appIdentity.appName');\n }\n if (config.appIdentity.version === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.version) {\n placeholderPaths.push('appIdentity.version');\n }\n if (config.auth.passkeyConfig.rpName === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpName) {\n placeholderPaths.push('auth.passkeyConfig.rpName');\n }\n if (config.auth.passkeyConfig.rpId === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpId) {\n placeholderPaths.push('auth.passkeyConfig.rpId');\n }\n if (config.email.from === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.emailFrom) {\n placeholderPaths.push('email.from');\n }\n\n return placeholderPaths;\n }\n\n private createNotInitializedError(getterName?: string): WildoError_Backend {\n return this.errorBuilder.buildError(\n ErrorType.CONFIGURATION, undefined,{\n customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n context: {\n serviceName: this._serviceName,\n applicationId: this._applicationId,\n applicationEnv: this._applicationEnv,\n message: `Application configuration not initialized : use ${getterName ?? 'getter'} before using the service`\n }\n }\n\n );\n }\n\n /\n Indicates whether the application configuration has been initialized.\n * Returns true only once the final resolved config is available through\n * `config`. A loader-only pre-override seed is not considered initialized for\n * downstream consumers because it still contains unresolved placeholders.\n /\n public isInitialized(): boolean {\n return this._config !== null && this._secrets !== null;\n }\n\n /\n PLATFORM-MODE construction-time default persistence adapter (Phase 5.2/5.3 + review R2).\n \n The one store for the answer \"what adapter does a resource without a declaration resolve\n * to?\" in platform mode, where this service is deliberately unhydrated while repositories are\n * constructed. It lives HERE — not on the repositories registry that historically owned it —\n * because THREE independent resolvers need it and only this service is injected into all of\n * them without a dependency cycle: the repositories-registry resolver (repository\n * construction, the boot door, the schema gate), the services-tier transaction router, and the\n * resource-id/unit-of-work resolver. When the value lived on the registry alone, the other two\n * read hydrated config and agreed with the constructed repositories only at a distance,\n * through the apps-manager env-truth overlay — nothing pinned the agreement.\n \n WRITE only through `RepositoriesRegistryHandlerBackendService.setPlatformModeDefaultPersistenceAdapter`,\n * which owns the conflict guard (a conflicting re-set refuses; a same-value re-set is a legal\n * retried startup phase). This adopt method is the dumb store half on purpose: keeping the\n * guard at the single sanctioned writer keeps it — and its pins — in one place.\n /\n private _platformModeDefaultPersistenceAdapter: PersistenceAdapterType \| undefined = undefined;\n\n public get platformModeDefaultPersistenceAdapter(): PersistenceAdapterType \| undefined {\n return this._platformModeDefaultPersistenceAdapter;\n }\n\n public adoptPlatformModeDefaultPersistenceAdapter(adapter: PersistenceAdapterType): void {\n this._platformModeDefaultPersistenceAdapter = adapter;\n }\n\n public get config(): AppConfiguration {\n\n if (!this._config)\n throw this.createNotInitializedError('config');\n\n return this._config!;\n }\n\n /\n Resolve a servable brand-logo URL for a `(composition[, theme, purpose])`\n * query against the resolved config's `brandAssets` (the CLI-generated,\n * backend-authored runtime projection).\n \n This is the single seam every backend logo consumer (auth-response\n * organization branding, email primary-scope context, ...) should call so\n * the composition/theme/purpose resolution stays consistent instead of each\n * consumer reading a free-form URL. Returns `undefined` when no matching\n * brand asset was generated.\n \n Safe before initialization: returns `undefined` rather than throwing so a\n * consumer building context on a not-yet-resolved config degrades gracefully.\n /\n public resolveBrandLogoUrl(query: BrandAssetQuery): string \| undefined {\n if (!this._config) {\n return undefined;\n }\n const resolved = resolveBrandAsset(this._config.brandAssets ?? [], query);\n return resolved?.url;\n }\n\n /\n Resolve the application's public base URL (`scheme://host[:port]`) used to\n * absolutize app-relative asset/link paths for OUT-OF-APP consumers — most\n * notably email, where a client cannot fetch a same-origin path like\n * `/brand/<ref>.png`.\n \n Source of truth: the DEFAULT frontend service's configured\n * `runtime.endPoints[<service>].publicUrl` (the app's primary frontend URL),\n * trailing slash stripped. This mirrors how notification dashboard/token\n * links resolve their base (`AuthControllerUtils.lookupFrontendPublicUrl`),\n * kept local here so the config layer does not depend on the auth module.\n \n Returns `undefined` pre-initialization, when no default frontend service is\n * resolvable, or when that service has no `publicUrl` configured.\n /\n public resolveAppPublicBaseUrl(): string \| undefined {\n if (!this._config) {\n return undefined;\n }\n const frontendServiceName = this.resolveDefaultFrontendServiceName();\n if (!frontendServiceName) {\n return undefined;\n }\n const publicUrl = this._config.runtime?.endPoints?.[frontendServiceName]?.publicUrl;\n if (!publicUrl) {\n return undefined;\n }\n return publicUrl.replace(/\\/+$/, '');\n }\n\n /\n Canonical audience (RFC 8707 resource indicator) of THIS app's generic API resource\n * server — the `aud` an exchanged machine (client-credentials) access token must carry\n * to be accepted at the resource-operation choke point (external-access D7).\n \n SINGLE SOURCE OF TRUTH: both the request-auth choke point (validation) and the\n * client-credentials token endpoint (minting) resolve the audience through THIS method,\n * so mint and validation cannot drift. Derivation = app public base URL + API mount path.\n * Returns `undefined` (→ fail-closed at the call site) when the public base is unresolvable.\n \n MCP and A2A resource servers carry their OWN canonical audiences (their endpoint URIs),\n * validated inside their own transports — not here.\n /\n public resolveApiResourceAudience(): string \| undefined {\n const base = this.resolveAppPublicBaseUrl();\n return base ? `${base}${MAIN_API_BASE_PATH}` : undefined;\n }\n\n /\n Canonical audience (RFC 8707 resource indicator) of one of this app's OAuth resource\n * servers ({@link ResourceServerKind} — `API` / `A2A` / `MCP`). This is the SINGLE SOURCE\n * OF TRUTH for both MINTING (`aud`) and VALIDATION (each server checks `aud === self`), so an\n * audience-bound token and the surface that consumes it cannot drift.\n \n Derivation: the API audience ({@link resolveApiResourceAudience}) is the base; A2A/MCP append\n * their mount path ({@link RESOURCE_SERVER_MOUNT_ROUTE}). The transports DELEGATE their verify-side\n * audience to THIS method — `A2ABackendService.resolveAgentAudience()` and the MCP controller's\n * `mcpResourceUri()` both return `resolveResourceServerAudience(A2A\|MCP)` — so mint and verify read\n * one function, not three parallel `${apiAudience}${route}` expressions. That is what makes \"cannot\n * drift\" a real guarantee rather than a coincidence. Returns `undefined` (→ fail-closed at the call\n * site) when the app public base URL is unresolvable.\n \n NB (documented follow-up): first-party USER login tokens still carry the legacy `'AUTH_TOKEN'`\n * sentinel audience rather than `resolveResourceServerAudience(API)`. That does NOT weaken the\n * A2A/MCP audience-binding here — a delegated token is `aud`-bound to A2A/MCP and is therefore\n * rejected by the main API (which accepts only `'AUTH_TOKEN'` user tokens or the API-audience\n * machine tokens).\n \n @param instanceRef - optional NAMED instance (multi-MCP / multi-A2A): appends `/<ref>` so each\n * server/agent instance carries its OWN audience. Omit for the DEFAULT (unnamed) surface, which\n * every app always has; `API` ignores it (a single, instance-less resource server).\n /\n public resolveResourceServerAudience(kind: ResourceServerKind, instanceRef?: string): string \| undefined {\n const apiAudience = this.resolveApiResourceAudience();\n if (!apiAudience) return undefined;\n // The API is a single, instance-less resource server — a ref never applies to it.\n if (kind === ResourceServerKind.API) return apiAudience;\n const base = `${apiAudience}${MANUAL_CONTROLLER_ROUTES_URLS[RESOURCE_SERVER_MOUNT_ROUTE[kind]]}`;\n // Multi-instance (multi-MCP / multi-A2A) audience contract: a NAMED server/agent instance appends\n // its ref as a path segment (`…/mcp/<ref>`, `…/a2a/<ref>`), so each instance carries a DISTINCT\n // RFC 8707 audience that its transport validates in isolation — the token-replay boundary between\n // instances. Live since R-2: `ResourceServerInstancesRegistryBackendService` declares the instances,\n // the MCP/A2A controllers resolve `:instanceRef` and pass it here, and\n // `listResourceServerAudiences` enumerates this function over every declared instance so the token\n // endpoint's mintable set and the servable set cannot drift.\n return instanceRef ? `${base}/${encodeURIComponent(instanceRef)}` : base;\n }\n\n /\n Absolute-URL variant of {@link resolveBrandLogoUrl} for out-of-app\n * consumers (email logos). Behaviour:\n \n - resolves the brand-logo URL via {@link resolveBrandLogoUrl}; if none, `undefined`.\n * - if that URL is already absolute (has a `scheme://` prefix or is\n * protocol-relative `//host/...`), it is returned unchanged.\n * - if it is app-relative (e.g. a generated brand-asset path\n * `/brand/<ref>.png`), the {@link resolveAppPublicBaseUrl} is prepended so\n * an email client can fetch it.\n * - if no public base URL is configured, the raw (still-relative) URL is\n * returned rather than dropping it — a relative hint degrades better than\n * nothing.\n \n Prefer this over `resolveBrandLogoUrl` anywhere the URL leaves the app\n * origin (email); same-origin surfaces (e.g. the auth login response) can\n * keep the relative form.\n /\n public resolveBrandLogoAbsoluteUrl(query: BrandAssetQuery): string \| undefined {\n const url = this.resolveBrandLogoUrl(query);\n if (!url) {\n return undefined;\n }\n // Already absolute: any `scheme://…` or protocol-relative `//host/…`.\n if (/^[a-z][a-z0-9+.-]:\\/\\//i.test(url) \|\| url.startsWith('//')) {\n return url;\n }\n const base = this.resolveAppPublicBaseUrl();\n if (!base) {\n return url;\n }\n return url.startsWith('/') ? `${base}${url}` : `${base}/${url}`;\n }\n\n\n public get secrets(): AppConfigurationSecrets {\n if (!this._secrets)\n throw this.createNotInitializedError('secrets');\n\n return this._secrets!;\n }\n\n public get applicationId(): string {\n if (!this._applicationId)\n throw this.createNotInitializedError('applicationId');\n\n return this._applicationId!;\n }\n\n public get applicationEnv(): RuntimeEnvironment {\n if (!this._applicationEnv)\n throw this.createNotInitializedError('applicationEnv');\n\n return this._applicationEnv!;\n }\n\n public get serviceName(): string {\n if (!this._serviceName)\n throw this.createNotInitializedError('serviceName');\n\n return this._serviceName!;\n }\n\n /*\n Application slug — the human-readable application label (e.g.,\n * 'wildo-ai-application'), carried as a secondary JWT claim alongside the\n * canonical `applicationId` and used for human-facing allow-lists.\n \n It is NOT the infrastructure identity: queue names, cron job IDs, and every\n * `wildo.queue.{appId}.` topology key are derived from `applicationId` (the\n Mongo `_id`), never from the slug — a slug is a mutable label and keying\n * infra on it orphans resources on rename. Not for display purposes.\n /\n public get appSlug(): string {\n if (this._appSlug === null) {\n throw this.createNotInitializedError('appSlug');\n }\n\n if (!this._appSlug) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n serviceName: this._serviceName,\n applicationId: this._applicationId,\n applicationEnv: this._applicationEnv,\n message: 'Application configuration is missing a resolved appSlug',\n },\n });\n }\n\n return this._appSlug;\n }\n\n /\n Apply declarative app-authored backend config after the runtime/bootstrap\n * seed has been loaded.\n /\n public applyBackendConfig(backendConfig: AppConfiguration_BackendAuthored): void {\n const baseConfig = this._config ?? this._preOverrideConfig;\n if (!baseConfig) {\n throw this.createNotInitializedError('applyBackendConfig');\n }\n\n const resolvedConfig = applyBackendAuthoredConfig(baseConfig, backendConfig);\n const boundaryInspection = inspectAppConfigurationBoundaryMutations(baseConfig, resolvedConfig);\n if (boundaryInspection.errors.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `backendConfig attempted to mutate platform/runtime-managed fields: ${boundaryInspection.errors.join(' ')}`,\n sections: Object.keys(backendConfig),\n },\n });\n }\n if (boundaryInspection.warnings.length > 0) {\n this.logger.warn(\n `[Config] backendConfig touched migration-seam runtime fields. ${boundaryInspection.warnings.join(' ')}`,\n );\n }\n\n this.applyResolvedConfig(resolvedConfig as AppConfiguration, {\n reason: 'backend-config',\n emitWarnings: true,\n });\n this.logDebug('Applied backend config', {\n reason: 'backend-config',\n sections: Object.keys(backendConfig),\n });\n }\n\n /\n Merge generated, environment-independent backend provider topology.\n \n Provider secrets and per-env URLs stay in the regular env/secrets layers;\n * this only binds the backend process to the precomputed provider scope that\n * was generated into the application package before build/start.\n /\n public applyProviderRuntime(providerRuntime: ProviderRuntimeArtifact): void {\n const baseConfig = this._preOverrideConfig;\n if (!baseConfig) {\n throw this.createNotInitializedError('applyProviderRuntime');\n }\n if (this._config) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'applyProviderRuntime must run before backendConfig resolves the final application config',\n },\n });\n }\n\n const artifact = ProviderRuntimeArtifactSchema.parse(providerRuntime);\n this._frontendProviderBootstraps = artifact.frontendProviderBootstraps ?? {};\n this._providerRuntimeArtifactEvidenceMetadata = Object.freeze({\n sourceDigest: artifact.sourceDigest,\n providerGraphDigest: artifact.providerGraphDigest ?? null,\n lockfileSectionDigest: artifact.lockfileSectionDigest ?? null,\n });\n this._preOverrideConfig = {\n ...baseConfig,\n providers: {\n scopes: {\n backend: artifact.scope,\n },\n },\n };\n\n this.logDebug('Applied generated provider runtime module', {\n artifactKind: artifact.artifactKind,\n sourceDigest: artifact.sourceDigest,\n });\n }\n\n public getFrontendProviderBootstrap(frontendServiceName: string): FrontendProvidersBlock \| undefined {\n return this._frontendProviderBootstraps[frontendServiceName];\n }\n\n /* Exact sanitized identity of the generated provider-runtime artifact applied before backend authored configuration. /\n public getProviderRuntimeArtifactEvidenceMetadata(): ProviderRuntimeArtifactEvidenceMetadata \| null {\n return this._providerRuntimeArtifactEvidenceMetadata;\n }\n\n /\n Fail startup if a non-platform app still carries the explicit pre-override\n * placeholders after its backendConfig should have been applied.\n /\n public assertNoPreOverridePlaceholders(): void {\n if (!this._config) {\n throw this.createNotInitializedError('assertNoPreOverridePlaceholders');\n }\n\n const placeholderPaths = this.getPreOverridePlaceholderPaths(this._config);\n if (placeholderPaths.length === 0) {\n return;\n }\n\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Application configuration still contains pre-override placeholder values at: ${placeholderPaths.join(', ')}. ` +\n `Define those fields in backendConfig instead of relying on backend loader placeholders.`,\n },\n });\n }\n\n private applyResolvedConfig(\n config: AppConfiguration,\n options: {\n reason: 'initial-load' \| 'backend-config' \| 'hydrated';\n emitWarnings: boolean;\n },\n ): void {\n const validatedConfig = AppConfiguration_Schema.parse(config);\n this._config = validatedConfig;\n this._preOverrideConfig = null;\n\n if (this._appSlug !== null) {\n this.logger.reinitialize(validatedConfig, this._appSlug);\n }\n\n this.validateEntityIdentityConfig(validatedConfig);\n if (options.emitWarnings) {\n this.emitDeferredFieldWarnings(validatedConfig);\n }\n\n this.logDebug('Resolved application configuration', {\n reason: options.reason,\n appSlug: this._appSlug,\n });\n }\n\n /\n Get JWT configuration with secrets\n /\n public get jwtConfig(): {\n config: AppConfiguration['jwt'],\n secrets: AppConfigurationSecrets['security']['jwt']\n } {\n return {\n config: this.config.jwt,\n secrets: this.secrets.security.jwt\n };\n }\n\n /* W7.3a: Whether anonymous sessions are enabled for any user type. */\n public get anonymousSessionsEnabled(): boolean {\n const userTypes = this._config?.userTypes;\n if (!userTypes) return false;\n return Object.values(userTypes).some(ut => ut.auth?.anonymousSessionsEnabled === true);\n }\n\n}\n"]}
1	+ {"version":3,"file":"app-configuration.backend.service.js","sourceRoot":"","sources":["../../../../../src/config/services/app-configuration.backend.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;;;;;;;;;;;;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2CAA2C,EAG3C,uBAAuB,EACxB,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,EAEL,0BAA0B,EAC1B,wCAAwC,GACzC,MAAM,0EAA0E,CAAC;AAClF,OAAO,EAGL,6BAA6B,GAC9B,MAAM,4EAA4E,CAAC;AAEpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,6BAA6B,EAC7B,iBAAiB,GAOlB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G;;;;;;;;;;;;GAYG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAaW;IACa;IACG;IAdnD,QAAQ,CAA+D;IACzE,OAAO,GAA4B,IAAI,CAAC;IACxC,kBAAkB,GAA4C,IAAI,CAAC;IACnE,2BAA2B,GAA2C,EAAE,CAAC;IACzE,wCAAwC,GAAmD,IAAI,CAAC;IAChG,QAAQ,GAAmC,IAAI,CAAC;IAChD,cAAc,GAAkB,IAAI,CAAC;IACrC,eAAe,GAA8B,IAAI,CAAC;IAClD,YAAY,GAAkB,IAAI,CAAC;IACnC,QAAQ,GAAkB,IAAI,CAAC;IAEvC,YAC6C,MAAqB,EACR,YAAwC,EACrC,aAA4C;QAF5D,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QACrC,kBAAa,GAAb,aAAa,CAA+B;QAEvG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,IAAI,CAAC,2BAA2B,GAAG,EAAE,CAAC;YACtC,IAAI,CAAC,wCAAwC,GAAG,IAAI,CAAC;YACrD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YACnI,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;YACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC;YAC3B,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,oBAAoB,CAAC,eAAe,CAAC;YAC5D,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;YAExB,IAAI,CAAC,QAAQ,CAAC,oDAAoD,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACI,4BAA4B,CAAC,OAUnC;QACC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,iEAAiE;oBAC1E,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,iGAAiG;wBACjG,uCAAuC;oBACzC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACnE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,+FAA+F;wBAC/F,gEAAgE;oBAClE,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,kBAAkB,GAAG,wCAAwC,CACjE,OAAO,CAAC,kBAAkB,EAC1B,OAAO,CAAC,MAAM,CACf,CAAC;YACF,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;oBACjE,OAAO,EAAE;wBACP,OAAO,EACL,oFAAoF,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;wBAC3H,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;qBACrC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4EAA4E,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC;QAChC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAE/B,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE;YACvC,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,qBAAqB,CAAC,QAAgB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,SAAS;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,OAAO,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACI,qCAAqC,CAAC,mBAA2B,EAAE,QAAgB;QACxF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC9F,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,mBAA2B;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACI,sCAAsC,CAAC,mBAA2B;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,qBAAqB,GAAG,SAAS,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAC9E,IAAI,CAAC,qBAAqB,EAAE,eAAe;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAED;;;;;;;;OAQG;IACI,sCAAsC,CAAC,QAAgB;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE9C,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,MAAM,KAAK,GAAG,qBAAqB,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,mBAAmB,CAAC;YAChD,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,QAAQ,GAAG,mBAAmB,CAAC;QAC9D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACI,iCAAiC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE9C,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtG,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/F,IAAI,UAAU;gBAAE,OAAO,mBAAmB,CAAC;QAC7C,CAAC;QACD,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,wBAAwB,IAAI,IAAI,CAAC;IAC1C,CAAC;IAEO,4BAA4B,CAAC,MAAwB;QAC3D,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAClE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAErD,KAAK,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC5F,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;wBACrE,OAAO,EAAE;4BACP,OAAO,EAAE,oBAAoB,mBAAmB,iDAAiD,QAAQ,KAAK;gCAC5G,0BAA0B,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;yBAC3D;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC5D,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC9D,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;oBAC3C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;4BACrE,OAAO,EAAE;gCACP,OAAO,EAAE,kDAAkD,QAAQ,KAAK;oCACtE,0BAA0B,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;6BAC3D;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,qBAAqB,EAAE,QAAQ,CAAC;gBAC7D,IAAI,QAAQ,EAAE,CAAC;oBACb,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;wBAC1B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;4BACzB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gCACrE,OAAO,EAAE;oCACP,OAAO,EAAE,+DAA+D,EAAE,KAAK;wCAC7E,kCAAkC,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iCAClE;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,yBAAyB,CAAC,MAAwB;QACxD,IAAI,MAAM,CAAC,IAAI,EAAE,iBAAiB,KAAK,KAAK,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mJAAmJ,CACpJ,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;YAC9B,IAAI,IAAI,EAAE,wBAAwB,KAAK,IAAI,EAAE,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qDAAqD,WAAW,4DAA4D,CAC7H,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,EAAE,oBAAoB,KAAK,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mDAAmD,WAAW,wDAAwD,CACvH,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,gBAAgB,IAAI,WAAW,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;gBAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,WAAW,CAAC,gBAAgB,8CAA8C,WAAW,IAAI,CACtJ,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;gBAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;gBACpD,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC;gBACrD,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBACpD,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;oBAC3C,IAAI,WAAW,KAAK,SAAS;wBAAE,OAAO,KAAK,CAAC;oBAC5C,IAAI,OAAO,WAAW,KAAK,SAAS;wBAAE,OAAO,WAAW,CAAC;oBACzD,OAAO,WAAW,CAAC,OAAO,CAAC;gBAC7B,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,WAAW,8BAA8B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iEAAiE,CACnL,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,8BAA8B,CAAC,MAAwB;QAC7D,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,KAAK,2CAA2C,CAAC,OAAO,EAAE,CAAC;YACvF,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,KAAK,2CAA2C,CAAC,OAAO,EAAE,CAAC;YACvF,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,2CAA2C,CAAC,aAAa,EAAE,CAAC;YACnG,gBAAgB,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,2CAA2C,CAAC,WAAW,EAAE,CAAC;YAC/F,gBAAgB,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,2CAA2C,CAAC,SAAS,EAAE,CAAC;YAChF,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAEO,yBAAyB,CAAC,UAAmB;QACnD,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CACjC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAC;YACjC,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;YACrF,OAAO,EAAE;gBACP,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,cAAc,EAAE,IAAI,CAAC,eAAe;gBACpC,OAAO,EAAE,mDAAmD,UAAU,IAAI,QAAQ,2BAA2B;aAC9G;SACF,CAEF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,aAAa;QAClB,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sCAAsC,GAAuC,SAAS,CAAC;IAE/F,IAAW,qCAAqC;QAC9C,OAAO,IAAI,CAAC,sCAAsC,CAAC;IACrD,CAAC;IAEM,0CAA0C,CAAC,OAA+B;QAC/E,IAAI,CAAC,sCAAsC,GAAG,OAAO,CAAC;IACxD,CAAC;IAED,IAAW,MAAM;QAEf,IAAI,CAAC,IAAI,CAAC,OAAO;YACf,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,OAAQ,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,mBAAmB,CAAC,KAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1E,OAAO,QAAQ,EAAE,GAAG,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACI,uBAAuB;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,iCAAiC,EAAE,CAAC;QACrE,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,0BAA0B;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACI,6BAA6B,CAAC,IAAwB,EAAE,WAAoB;QACjF,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACnC,kFAAkF;QAClF,IAAI,IAAI,KAAK,kBAAkB,CAAC,GAAG;YAAE,OAAO,WAAW,CAAC;QACxD,MAAM,IAAI,GAAG,GAAG,WAAW,GAAG,6BAA6B,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACjG,kGAAkG;QAClG,gGAAgG;QAChG,kGAAkG;QAClG,qGAAqG;QACrG,uEAAuE;QACvE,mGAAmG;QACnG,6DAA6D;QAC7D,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,2BAA2B,CAAC,KAAsB;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,sEAAsE;QACtE,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IAClE,CAAC;IAGD,IAAW,OAAO;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAElD,OAAO,IAAI,CAAC,QAAS,CAAC;IACxB,CAAC;IAED,IAAW,aAAa;QACtB,IAAI,CAAC,IAAI,CAAC,cAAc;YACtB,MAAM,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC;QAExD,OAAO,IAAI,CAAC,cAAe,CAAC;IAC9B,CAAC;IAED,IAAW,cAAc;QACvB,IAAI,CAAC,IAAI,CAAC,eAAe;YACvB,MAAM,IAAI,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QAEzD,OAAO,IAAI,CAAC,eAAgB,CAAC;IAC/B,CAAC;IAED,IAAW,WAAW;QACpB,IAAI,CAAC,IAAI,CAAC,YAAY;YACpB,MAAM,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAC;QAEtD,OAAO,IAAI,CAAC,YAAa,CAAC;IAC5B,CAAC;IAED;;;;;;;;;OASG;IACH,IAAW,OAAO;QAChB,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,WAAW,EAAE,IAAI,CAAC,YAAY;oBAC9B,aAAa,EAAE,IAAI,CAAC,cAAc;oBAClC,cAAc,EAAE,IAAI,CAAC,eAAe;oBACpC,OAAO,EAAE,yDAAyD;iBACnE;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,aAA+C;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC7E,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAChG,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,sEAAsE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBAC7G,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iEAAiE,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACzG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,cAAkC,EAAE;YAC3D,MAAM,EAAE,gBAAgB;YACxB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE;YACtC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,oBAAoB,CAAC,eAAwC;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,0FAA0F;iBACpG;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,wFAAwF;YACxF,0FAA0F;YAC1F,2FAA2F;YAC3F,iGAAiG;YACjG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EACL,qGAAqG;0BACnG,6FAA6F;0BAC7F,WAAW,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC3G,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,2BAA2B,GAAG,QAAQ,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAC7E,IAAI,CAAC,wCAAwC,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5D,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,IAAI,IAAI;YACzD,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,IAAI,IAAI;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG;YACxB,GAAG,UAAU;YACb,SAAS,EAAE;gBACT,MAAM,EAAE;oBACN,OAAO,EAAE,QAAQ,CAAC,KAAK;iBACxB;gBACD,8FAA8F;gBAC9F,wFAAwF;gBACxF,6FAA6F;gBAC7F,oFAAoF;gBACpF,uEAAuE;gBACvE,WAAW,EAAE,UAAU,CAAC,SAAS,EAAE,WAAW,IAAI,EAAE;aACrD;SACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,2CAA2C,EAAE;YACzD,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;IACL,CAAC;IAEM,4BAA4B,CAAC,mBAA2B;QAC7D,OAAO,IAAI,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IAED,yHAAyH;IAClH,0CAA0C;QAC/C,OAAO,IAAI,CAAC,wCAAwC,CAAC;IACvD,CAAC;IAED;;;OAGG;IACI,+BAA+B;QACpC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,yBAAyB,CAAC,iCAAiC,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;YACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;YACjE,OAAO,EAAE;gBACP,OAAO,EACL,gFAAgF,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAC/G,yFAAyF;aAC5F;SACF,CAAC,CAAC;IACL,CAAC;IAEO,mBAAmB,CACzB,MAAwB,EACxB,OAGC;QAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC;QAC/B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAE/B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE;YAClD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAW,SAAS;QAIlB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG;SACnC,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAW,wBAAwB;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;QAC1C,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,KAAK,IAAI,CAAC,CAAC;IACzF,CAAC;CAEF,CAAA;AAjxBY,uBAAuB;IADnC,UAAU,EAAE;IAcR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;qCAFC,aAAa;QACM,0BAA0B;QACtB,6BAA6B;GAf9F,uBAAuB,CAixBnC","sourcesContent":["/*\n Application Configuration Service\n \n Service for managing application-level configuration\n /\n\nimport { injectable, inject } from 'inversify';\nimport {\n APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS,\n AppConfiguration,\n type AppConfiguration_PreOverrideSeed,\n AppConfiguration_Schema\n} from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { AppConfigurationSecrets } from '~wildo-backend-lib/config/models/app-config-secrets.backend.schemas';\nimport { AppConfigurationLoaderService } from './app-configuration-loader.backend.service';\nimport {\n type AppConfiguration_BackendAuthored,\n applyBackendAuthoredConfig,\n inspectAppConfigurationBoundaryMutations,\n} from '~wildo-backend-lib/config/models/app-config.backend-authored.definitions';\nimport {\n type ProviderRuntimeArtifact,\n type ProviderRuntimeArtifactEvidenceMetadata,\n ProviderRuntimeArtifactSchema,\n} from '~wildo-backend-lib/config/models/provider-runtime-artifact.backend.schemas';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n ErrorCustomMessageReference,\n ErrorType,\n MAIN_API_BASE_PATH,\n ResourceServerKind,\n RESOURCE_SERVER_MOUNT_ROUTE,\n MANUAL_CONTROLLER_ROUTES_URLS,\n resolveBrandAsset,\n RuntimeEnvironment,\n WildoError_Backend,\n type BrandAssetQuery,\n type FrontendProvidersBlock,\n type PersistenceAdapterType,\n type UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\n\n\n/\n Application Configuration Service\n \n Manages complete application configuration. After T5, the loading chain is:\n * 1. Env vars → database addresses, platform URLs\n * 2. Minimal pre-override skeleton → only the structural placeholders the\n * backend must provide before backendConfig is merged\n * 3. Apps-manager fetch → reduced managed metadata + JWT public keys + appSlug\n * 4. App-authored backendConfig → merged onto the runtime/bootstrap seed\n \n This service uses the loader service for steps 1-3, then provides\n * cached, type-safe access to all configuration sections.\n /\n@injectable()\nexport class AppConfigurationService {\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n private _config: AppConfiguration \| null = null;\n private _preOverrideConfig: AppConfiguration_PreOverrideSeed \| null = null;\n private _frontendProviderBootstraps: Record<string, FrontendProvidersBlock> = {};\n private _providerRuntimeArtifactEvidenceMetadata: ProviderRuntimeArtifactEvidenceMetadata \| null = null;\n private _secrets: AppConfigurationSecrets \| null = null;\n private _applicationId: string \| null = null;\n private _applicationEnv: RuntimeEnvironment \| null = null;\n private _serviceName: string \| null = null;\n private _appSlug: string \| null = null;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigLoaderService) private loaderService: AppConfigurationLoaderService\n ) {\n this.logDebug = this.logger.debugByType('AppConfigurationService');\n this.logger.setDebugTypeLogging('AppConfigurationService', false);\n }\n\n /\n Initialize the configuration service\n /\n public async initialize(): Promise<void> {\n if (!this._config \|\| !this._secrets) {\n this.logDebug('Initializing application configuration...');\n this._frontendProviderBootstraps = {};\n this._providerRuntimeArtifactEvidenceMetadata = null;\n const { appConfig, appSecrets, applicationId, applicationEnvConfig, serviceName, appSlug } = await this.loaderService.initialize();\n this._preOverrideConfig = appConfig;\n this._secrets = appSecrets;\n this._applicationId = applicationId;\n this._applicationEnv = applicationEnvConfig.APPLICATION_ENV;\n this._serviceName = serviceName;\n this._appSlug = appSlug;\n\n this.logDebug('Application configuration initialized successfully', { appSlug });\n }\n }\n\n /\n Hydrate the service from an already-resolved full configuration object.\n \n Platform startup paths use this when configuration was assembled by another\n * runtime-specific service. Callers must make the ownership decision explicit:\n * either provide a `boundaryBaseConfig` to run the Phase 4 mutation checks, or\n * set `skipBoundaryInspection` when hydrating a platform-owned config that does\n * not go through the tenant backendConfig authoring seam.\n /\n public hydrateResolvedConfiguration(options: {\n config: AppConfiguration;\n secrets: AppConfigurationSecrets;\n applicationId: string;\n applicationEnv: RuntimeEnvironment;\n serviceName: string;\n appSlug: string;\n emitWarnings?: boolean;\n boundaryBaseConfig?: AppConfiguration \| AppConfiguration_PreOverrideSeed;\n skipBoundaryInspection?: boolean;\n }): void {\n const resolvedAppSlug = options.appSlug.trim();\n if (!resolvedAppSlug) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'Resolved application configuration requires a non-empty appSlug',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (options.boundaryBaseConfig && options.skipBoundaryInspection) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'hydrateResolvedConfiguration cannot accept both boundaryBaseConfig and skipBoundaryInspection. ' +\n 'Choose one ownership mode explicitly.',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (!options.boundaryBaseConfig && !options.skipBoundaryInspection) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'hydrateResolvedConfiguration requires either boundaryBaseConfig for Phase 4 ownership checks ' +\n 'or skipBoundaryInspection for platform-owned hydrated configs.',\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n\n if (options.boundaryBaseConfig) {\n const boundaryInspection = inspectAppConfigurationBoundaryMutations(\n options.boundaryBaseConfig,\n options.config,\n );\n if (boundaryInspection.errors.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Hydrated resolved config attempted to cross platform/runtime-managed boundaries: ${boundaryInspection.errors.join(' ')}`,\n serviceName: options.serviceName,\n applicationId: options.applicationId,\n },\n });\n }\n if ((options.emitWarnings ?? true) && boundaryInspection.warnings.length > 0) {\n this.logger.warn(\n `[Config] hydrated resolved config touched migration-seam runtime fields. ${boundaryInspection.warnings.join(' ')}`,\n );\n }\n }\n\n this._secrets = options.secrets;\n this._applicationId = options.applicationId;\n this._applicationEnv = options.applicationEnv;\n this._serviceName = options.serviceName;\n this._appSlug = resolvedAppSlug;\n this._preOverrideConfig = null;\n\n this.applyResolvedConfig(options.config, {\n reason: 'hydrated',\n emitWarnings: options.emitWarnings ?? true,\n });\n }\n\n /\n W3.1: Get auth policy for a specific user type.\n * Returns the complete per-user-type auth policy, or null if the user type doesn't exist in config.\n /\n public getUserTypeAuthPolicy(userType: string): UserTypeAuthPolicy \| null {\n const appConfig = this._config;\n if (!appConfig?.userTypes) return null;\n const typeDef = appConfig.userTypes[userType];\n return typeDef?.auth ?? null;\n }\n\n /\n Resolve a specific frontend-service user-management entry.\n * Used when runtime flows must enforce surface-level auth/register policy\n * for a known frontend service + user-type combination.\n /\n public getFrontendServiceUserManagementEntry(frontendServiceName: string, userType: string): { register: boolean; auth: boolean; isDefault?: boolean } \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n return appConfig.frontendServices[frontendServiceName]?.usersManagement?.[userType] ?? null;\n }\n\n /\n Check whether a frontend service identity is declared in app-owned config.\n * This is the authoritative allow-list used for runtime/public frontend identity.\n /\n public hasFrontendService(frontendServiceName: string): boolean {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return false;\n return !!appConfig.frontendServices[frontendServiceName];\n }\n\n /\n Resolve user type from the active frontend service identity.\n * Reads `frontendServices[frontendServiceName].usersManagement` and returns\n * the default entry, or the first entry when no explicit default exists.\n /\n public resolveUserTypeFromFrontendServiceName(frontendServiceName: string): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n const frontendServiceConfig = appConfig.frontendServices[frontendServiceName];\n if (!frontendServiceConfig?.usersManagement) return null;\n const entries = Object.entries(frontendServiceConfig.usersManagement);\n const defaultEntry = entries.find(([, v]) => v.isDefault);\n const firstEntry = entries[0];\n return (defaultEntry ?? firstEntry)?.[0] ?? null;\n }\n\n /\n Reverse lookup: given a user type, find the frontend service where that user type\n * has `isDefault: true` in usersManagement. Falls back to any app type that\n * references the user type (with `auth: true`) if no isDefault match exists.\n \n This is the mirror of `resolveUserTypeFromFrontendServiceName()`:\n * frontendServiceName → userType (forward)\n * userType → frontendServiceName (reverse)\n /\n public resolveFrontendServiceNameFromUserType(userType: string): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n\n let fallback: string \| null = null;\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(appConfig.frontendServices)) {\n const entry = frontendServiceConfig.usersManagement[userType];\n if (!entry) continue;\n if (entry.isDefault) return frontendServiceName;\n if (entry.auth && !fallback) fallback = frontendServiceName;\n }\n return fallback;\n }\n\n /\n Find the default frontend service — the first frontend service that has any\n * user type entry with `isDefault: true`. Used as a last-resort fallback\n * when no specific user type context is available (e.g., SAML errors\n * before user identification).\n /\n public resolveDefaultFrontendServiceName(): string \| null {\n const appConfig = this._config;\n if (!appConfig?.frontendServices) return null;\n\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(appConfig.frontendServices)) {\n const hasDefault = Object.values(frontendServiceConfig.usersManagement).some(v => v.isDefault);\n if (hasDefault) return frontendServiceName;\n }\n const firstFrontendServiceName = Object.keys(appConfig.frontendServices)[0];\n return firstFrontendServiceName ?? null;\n }\n\n private validateEntityIdentityConfig(config: AppConfiguration): void {\n const { userTypes, frontendServices, organizationTypes } = config;\n const userTypeKeys = new Set(Object.keys(userTypes));\n\n for (const [frontendServiceName, frontendServiceConfig] of Object.entries(frontendServices)) {\n for (const userType of Object.keys(frontendServiceConfig.usersManagement)) {\n if (!userTypeKeys.has(userType)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `frontendServices.${frontendServiceName}.usersManagement references unknown userType \"${userType}\". ` +\n `userTypes must define: ${[...userTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n\n if (organizationTypes) {\n const orgTypeKeys = new Set(Object.keys(organizationTypes));\n for (const [, orgConfig] of Object.entries(organizationTypes)) {\n for (const userType of orgConfig.userTypes) {\n if (!userTypeKeys.has(userType)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `organizationTypes references unknown userType \"${userType}\". ` +\n `userTypes must define: ${[...userTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n for (const [, userTypeDef] of Object.entries(userTypes)) {\n const orgTypes = userTypeDef.requiresOrgMembership?.orgTypes;\n if (orgTypes) {\n for (const ot of orgTypes) {\n if (!orgTypeKeys.has(ot)) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n context: {\n message: `requiresOrgMembership.orgTypes references unknown org type \"${ot}\". ` +\n `organizationTypes must define: ${[...orgTypeKeys].join(', ')}`,\n },\n });\n }\n }\n }\n }\n }\n }\n\n private emitDeferredFieldWarnings(config: AppConfiguration): void {\n if (config.auth?.crossOrgSSOAccess === false) {\n this.logger.info(\n `[Config] crossOrgSSOAccess is disabled — users with enterprise SSO links from one organization will be blocked from SSO into other organizations.`\n );\n }\n\n for (const [userTypeKey, userTypeDef] of Object.entries(config.userTypes)) {\n const auth = userTypeDef.auth;\n if (auth?.anonymousSessionsEnabled === true) {\n this.logger.info(\n `[Config] Anonymous sessions enabled for userType \"${userTypeKey}\" — isAnonymizable resources will support ANONYMOUS scope.`\n );\n }\n if (auth?.oneOffSessionAllowed === true) {\n this.logger.info(\n `[Config] One-off sessions enabled for userType \"${userTypeKey}\" — consumable token links can create scoped sessions.`\n );\n }\n if (userTypeDef.uniqueIdentifier && userTypeDef.uniqueIdentifier !== 'email') {\n this.logger.warn(\n `[Config] uniqueIdentifier only supports \"email\" — value \"${userTypeDef.uniqueIdentifier}\" will be treated as \"email\" for userType \"${userTypeKey}\".`\n );\n }\n\n if (auth?.stepUpAuth?.enabled) {\n const stepUpMethods = auth.stepUpAuth.methods ?? [];\n const enabledMethods = auth.authMethodsEnabled ?? {};\n const hasUsableMethod = stepUpMethods.some((method) => {\n const methodValue = enabledMethods[method];\n if (methodValue === undefined) return false;\n if (typeof methodValue === 'boolean') return methodValue;\n return methodValue.enabled;\n });\n if (!hasUsableMethod) {\n this.logger.warn(\n `[Config] stepUpAuth is enabled for userType \"${userTypeKey}\" but none of its methods [${stepUpMethods.join(', ')}] are enabled in authMethodsEnabled — step-up will always fail.`\n );\n }\n }\n }\n }\n\n private getPreOverridePlaceholderPaths(config: AppConfiguration): string[] {\n const placeholderPaths: string[] = [];\n\n if (config.appIdentity.appName === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.appName) {\n placeholderPaths.push('appIdentity.appName');\n }\n if (config.appIdentity.version === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.version) {\n placeholderPaths.push('appIdentity.version');\n }\n if (config.auth.passkeyConfig.rpName === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpName) {\n placeholderPaths.push('auth.passkeyConfig.rpName');\n }\n if (config.auth.passkeyConfig.rpId === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.passkeyRpId) {\n placeholderPaths.push('auth.passkeyConfig.rpId');\n }\n if (config.email.from === APP_CONFIGURATION_PRE_OVERRIDE_PLACEHOLDERS.emailFrom) {\n placeholderPaths.push('email.from');\n }\n\n return placeholderPaths;\n }\n\n private createNotInitializedError(getterName?: string): WildoError_Backend {\n return this.errorBuilder.buildError(\n ErrorType.CONFIGURATION, undefined,{\n customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n context: {\n serviceName: this._serviceName,\n applicationId: this._applicationId,\n applicationEnv: this._applicationEnv,\n message: `Application configuration not initialized : use ${getterName ?? 'getter'} before using the service`\n }\n }\n\n );\n }\n\n /\n Indicates whether the application configuration has been initialized.\n * Returns true only once the final resolved config is available through\n * `config`. A loader-only pre-override seed is not considered initialized for\n * downstream consumers because it still contains unresolved placeholders.\n /\n public isInitialized(): boolean {\n return this._config !== null && this._secrets !== null;\n }\n\n /\n PLATFORM-MODE construction-time default persistence adapter (Phase 5.2/5.3 + review R2).\n \n The one store for the answer \"what adapter does a resource without a declaration resolve\n * to?\" in platform mode, where this service is deliberately unhydrated while repositories are\n * constructed. It lives HERE — not on the repositories registry that historically owned it —\n * because THREE independent resolvers need it and only this service is injected into all of\n * them without a dependency cycle: the repositories-registry resolver (repository\n * construction, the boot door, the schema gate), the services-tier transaction router, and the\n * resource-id/unit-of-work resolver. When the value lived on the registry alone, the other two\n * read hydrated config and agreed with the constructed repositories only at a distance,\n * through the apps-manager env-truth overlay — nothing pinned the agreement.\n \n WRITE only through `RepositoriesRegistryHandlerBackendService.setPlatformModeDefaultPersistenceAdapter`,\n * which owns the conflict guard (a conflicting re-set refuses; a same-value re-set is a legal\n * retried startup phase). This adopt method is the dumb store half on purpose: keeping the\n * guard at the single sanctioned writer keeps it — and its pins — in one place.\n /\n private _platformModeDefaultPersistenceAdapter: PersistenceAdapterType \| undefined = undefined;\n\n public get platformModeDefaultPersistenceAdapter(): PersistenceAdapterType \| undefined {\n return this._platformModeDefaultPersistenceAdapter;\n }\n\n public adoptPlatformModeDefaultPersistenceAdapter(adapter: PersistenceAdapterType): void {\n this._platformModeDefaultPersistenceAdapter = adapter;\n }\n\n public get config(): AppConfiguration {\n\n if (!this._config)\n throw this.createNotInitializedError('config');\n\n return this._config!;\n }\n\n /\n Resolve a servable brand-logo URL for a `(composition[, theme, purpose])`\n * query against the resolved config's `brandAssets` (the CLI-generated,\n * backend-authored runtime projection).\n \n This is the single seam every backend logo consumer (auth-response\n * organization branding, email primary-scope context, ...) should call so\n * the composition/theme/purpose resolution stays consistent instead of each\n * consumer reading a free-form URL. Returns `undefined` when no matching\n * brand asset was generated.\n \n Safe before initialization: returns `undefined` rather than throwing so a\n * consumer building context on a not-yet-resolved config degrades gracefully.\n /\n public resolveBrandLogoUrl(query: BrandAssetQuery): string \| undefined {\n if (!this._config) {\n return undefined;\n }\n const resolved = resolveBrandAsset(this._config.brandAssets ?? [], query);\n return resolved?.url;\n }\n\n /\n Resolve the application's public base URL (`scheme://host[:port]`) used to\n * absolutize app-relative asset/link paths for OUT-OF-APP consumers — most\n * notably email, where a client cannot fetch a same-origin path like\n * `/brand/<ref>.png`.\n \n Source of truth: the DEFAULT frontend service's configured\n * `runtime.endPoints[<service>].publicUrl` (the app's primary frontend URL),\n * trailing slash stripped. This mirrors how notification dashboard/token\n * links resolve their base (`AuthControllerUtils.lookupFrontendPublicUrl`),\n * kept local here so the config layer does not depend on the auth module.\n \n Returns `undefined` pre-initialization, when no default frontend service is\n * resolvable, or when that service has no `publicUrl` configured.\n /\n public resolveAppPublicBaseUrl(): string \| undefined {\n if (!this._config) {\n return undefined;\n }\n const frontendServiceName = this.resolveDefaultFrontendServiceName();\n if (!frontendServiceName) {\n return undefined;\n }\n const publicUrl = this._config.runtime?.endPoints?.[frontendServiceName]?.publicUrl;\n if (!publicUrl) {\n return undefined;\n }\n return publicUrl.replace(/\\/+$/, '');\n }\n\n /\n Canonical audience (RFC 8707 resource indicator) of THIS app's generic API resource\n * server — the `aud` an exchanged machine (client-credentials) access token must carry\n * to be accepted at the resource-operation choke point (external-access D7).\n \n SINGLE SOURCE OF TRUTH: both the request-auth choke point (validation) and the\n * client-credentials token endpoint (minting) resolve the audience through THIS method,\n * so mint and validation cannot drift. Derivation = app public base URL + API mount path.\n * Returns `undefined` (→ fail-closed at the call site) when the public base is unresolvable.\n \n MCP and A2A resource servers carry their OWN canonical audiences (their endpoint URIs),\n * validated inside their own transports — not here.\n /\n public resolveApiResourceAudience(): string \| undefined {\n const base = this.resolveAppPublicBaseUrl();\n return base ? `${base}${MAIN_API_BASE_PATH}` : undefined;\n }\n\n /\n Canonical audience (RFC 8707 resource indicator) of one of this app's OAuth resource\n * servers ({@link ResourceServerKind} — `API` / `A2A` / `MCP`). This is the SINGLE SOURCE\n * OF TRUTH for both MINTING (`aud`) and VALIDATION (each server checks `aud === self`), so an\n * audience-bound token and the surface that consumes it cannot drift.\n \n Derivation: the API audience ({@link resolveApiResourceAudience}) is the base; A2A/MCP append\n * their mount path ({@link RESOURCE_SERVER_MOUNT_ROUTE}). The transports DELEGATE their verify-side\n * audience to THIS method — `A2ABackendService.resolveAgentAudience()` and the MCP controller's\n * `mcpResourceUri()` both return `resolveResourceServerAudience(A2A\|MCP)` — so mint and verify read\n * one function, not three parallel `${apiAudience}${route}` expressions. That is what makes \"cannot\n * drift\" a real guarantee rather than a coincidence. Returns `undefined` (→ fail-closed at the call\n * site) when the app public base URL is unresolvable.\n \n NB (documented follow-up): first-party USER login tokens still carry the legacy `'AUTH_TOKEN'`\n * sentinel audience rather than `resolveResourceServerAudience(API)`. That does NOT weaken the\n * A2A/MCP audience-binding here — a delegated token is `aud`-bound to A2A/MCP and is therefore\n * rejected by the main API (which accepts only `'AUTH_TOKEN'` user tokens or the API-audience\n * machine tokens).\n \n @param instanceRef - optional NAMED instance (multi-MCP / multi-A2A): appends `/<ref>` so each\n * server/agent instance carries its OWN audience. Omit for the DEFAULT (unnamed) surface, which\n * every app always has; `API` ignores it (a single, instance-less resource server).\n /\n public resolveResourceServerAudience(kind: ResourceServerKind, instanceRef?: string): string \| undefined {\n const apiAudience = this.resolveApiResourceAudience();\n if (!apiAudience) return undefined;\n // The API is a single, instance-less resource server — a ref never applies to it.\n if (kind === ResourceServerKind.API) return apiAudience;\n const base = `${apiAudience}${MANUAL_CONTROLLER_ROUTES_URLS[RESOURCE_SERVER_MOUNT_ROUTE[kind]]}`;\n // Multi-instance (multi-MCP / multi-A2A) audience contract: a NAMED server/agent instance appends\n // its ref as a path segment (`…/mcp/<ref>`, `…/a2a/<ref>`), so each instance carries a DISTINCT\n // RFC 8707 audience that its transport validates in isolation — the token-replay boundary between\n // instances. Live since R-2: `ResourceServerInstancesRegistryBackendService` declares the instances,\n // the MCP/A2A controllers resolve `:instanceRef` and pass it here, and\n // `listResourceServerAudiences` enumerates this function over every declared instance so the token\n // endpoint's mintable set and the servable set cannot drift.\n return instanceRef ? `${base}/${encodeURIComponent(instanceRef)}` : base;\n }\n\n /\n Absolute-URL variant of {@link resolveBrandLogoUrl} for out-of-app\n * consumers (email logos). Behaviour:\n \n - resolves the brand-logo URL via {@link resolveBrandLogoUrl}; if none, `undefined`.\n * - if that URL is already absolute (has a `scheme://` prefix or is\n * protocol-relative `//host/...`), it is returned unchanged.\n * - if it is app-relative (e.g. a generated brand-asset path\n * `/brand/<ref>.png`), the {@link resolveAppPublicBaseUrl} is prepended so\n * an email client can fetch it.\n * - if no public base URL is configured, the raw (still-relative) URL is\n * returned rather than dropping it — a relative hint degrades better than\n * nothing.\n \n Prefer this over `resolveBrandLogoUrl` anywhere the URL leaves the app\n * origin (email); same-origin surfaces (e.g. the auth login response) can\n * keep the relative form.\n /\n public resolveBrandLogoAbsoluteUrl(query: BrandAssetQuery): string \| undefined {\n const url = this.resolveBrandLogoUrl(query);\n if (!url) {\n return undefined;\n }\n // Already absolute: any `scheme://…` or protocol-relative `//host/…`.\n if (/^[a-z][a-z0-9+.-]:\\/\\//i.test(url) \|\| url.startsWith('//')) {\n return url;\n }\n const base = this.resolveAppPublicBaseUrl();\n if (!base) {\n return url;\n }\n return url.startsWith('/') ? `${base}${url}` : `${base}/${url}`;\n }\n\n\n public get secrets(): AppConfigurationSecrets {\n if (!this._secrets)\n throw this.createNotInitializedError('secrets');\n\n return this._secrets!;\n }\n\n public get applicationId(): string {\n if (!this._applicationId)\n throw this.createNotInitializedError('applicationId');\n\n return this._applicationId!;\n }\n\n public get applicationEnv(): RuntimeEnvironment {\n if (!this._applicationEnv)\n throw this.createNotInitializedError('applicationEnv');\n\n return this._applicationEnv!;\n }\n\n public get serviceName(): string {\n if (!this._serviceName)\n throw this.createNotInitializedError('serviceName');\n\n return this._serviceName!;\n }\n\n /*\n Application slug — the human-readable application label (e.g.,\n * 'wildo-ai-application'), carried as a secondary JWT claim alongside the\n * canonical `applicationId` and used for human-facing allow-lists.\n \n It is NOT the infrastructure identity: queue names, cron job IDs, and every\n * `wildo.queue.{appId}.` topology key are derived from `applicationId` (the\n Mongo `_id`), never from the slug — a slug is a mutable label and keying\n * infra on it orphans resources on rename. Not for display purposes.\n /\n public get appSlug(): string {\n if (this._appSlug === null) {\n throw this.createNotInitializedError('appSlug');\n }\n\n if (!this._appSlug) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n serviceName: this._serviceName,\n applicationId: this._applicationId,\n applicationEnv: this._applicationEnv,\n message: 'Application configuration is missing a resolved appSlug',\n },\n });\n }\n\n return this._appSlug;\n }\n\n /\n Apply declarative app-authored backend config after the runtime/bootstrap\n * seed has been loaded.\n /\n public applyBackendConfig(backendConfig: AppConfiguration_BackendAuthored): void {\n const baseConfig = this._config ?? this._preOverrideConfig;\n if (!baseConfig) {\n throw this.createNotInitializedError('applyBackendConfig');\n }\n\n const resolvedConfig = applyBackendAuthoredConfig(baseConfig, backendConfig);\n const boundaryInspection = inspectAppConfigurationBoundaryMutations(baseConfig, resolvedConfig);\n if (boundaryInspection.errors.length > 0) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `backendConfig attempted to mutate platform/runtime-managed fields: ${boundaryInspection.errors.join(' ')}`,\n sections: Object.keys(backendConfig),\n },\n });\n }\n if (boundaryInspection.warnings.length > 0) {\n this.logger.warn(\n `[Config] backendConfig touched migration-seam runtime fields. ${boundaryInspection.warnings.join(' ')}`,\n );\n }\n\n this.applyResolvedConfig(resolvedConfig as AppConfiguration, {\n reason: 'backend-config',\n emitWarnings: true,\n });\n this.logDebug('Applied backend config', {\n reason: 'backend-config',\n sections: Object.keys(backendConfig),\n });\n }\n\n /\n Merge generated, environment-independent backend provider topology.\n \n Provider secrets and per-env URLs stay in the regular env/secrets layers;\n * this only binds the backend process to the precomputed provider scope that\n * was generated into the application package before build/start.\n /\n public applyProviderRuntime(providerRuntime: ProviderRuntimeArtifact): void {\n const baseConfig = this._preOverrideConfig;\n if (!baseConfig) {\n throw this.createNotInitializedError('applyProviderRuntime');\n }\n if (this._config) {\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message: 'applyProviderRuntime must run before backendConfig resolves the final application config',\n },\n });\n }\n\n const parsed = ProviderRuntimeArtifactSchema.safeParse(providerRuntime);\n if (!parsed.success) {\n // The artifact is GENERATED from the authored config by `wildo config sync`, so a parse\n // failure here is almost always a stale artifact meeting a newer contract (#328 added the\n // provider identity to every frontend entry). A raw Zod issue list reads as a logic defect\n // in the backend; the remedy is regeneration, so name it (staleness-presents-as-a-logic-defect).\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n 'The generated provider runtime artifact does not satisfy the current contract — it was most likely '\n + 'generated before the contract changed. Regenerate it with `wildo config sync` and restart. '\n + `Issues: ${parsed.error.issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`).join('; ')}`,\n issues: parsed.error.issues,\n },\n });\n }\n const artifact = parsed.data;\n this._frontendProviderBootstraps = artifact.frontendProviderBootstraps ?? {};\n this._providerRuntimeArtifactEvidenceMetadata = Object.freeze({\n sourceDigest: artifact.sourceDigest,\n providerGraphDigest: artifact.providerGraphDigest ?? null,\n lockfileSectionDigest: artifact.lockfileSectionDigest ?? null,\n });\n this._preOverrideConfig = {\n ...baseConfig,\n providers: {\n scopes: {\n backend: artifact.scope,\n },\n // Carried forward rather than defaulted, because this assignment REPLACES the whole providers\n // block. The artifact supplies the backend's resolved scope and knows nothing about the\n // application's connection policy, so rebuilding the block from it alone would silently drop\n // a declared `providers.connections` — and the symptom would be a provider becoming\n // connectable at scopes the application had deliberately switched off.\n connections: baseConfig.providers?.connections ?? {},\n },\n };\n\n this.logDebug('Applied generated provider runtime module', {\n artifactKind: artifact.artifactKind,\n sourceDigest: artifact.sourceDigest,\n });\n }\n\n public getFrontendProviderBootstrap(frontendServiceName: string): FrontendProvidersBlock \| undefined {\n return this._frontendProviderBootstraps[frontendServiceName];\n }\n\n /* Exact sanitized identity of the generated provider-runtime artifact applied before backend authored configuration. /\n public getProviderRuntimeArtifactEvidenceMetadata(): ProviderRuntimeArtifactEvidenceMetadata \| null {\n return this._providerRuntimeArtifactEvidenceMetadata;\n }\n\n /\n Fail startup if a non-platform app still carries the explicit pre-override\n * placeholders after its backendConfig should have been applied.\n /\n public assertNoPreOverridePlaceholders(): void {\n if (!this._config) {\n throw this.createNotInitializedError('assertNoPreOverridePlaceholders');\n }\n\n const placeholderPaths = this.getPreOverridePlaceholderPaths(this._config);\n if (placeholderPaths.length === 0) {\n return;\n }\n\n throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n context: {\n message:\n `Application configuration still contains pre-override placeholder values at: ${placeholderPaths.join(', ')}. ` +\n `Define those fields in backendConfig instead of relying on backend loader placeholders.`,\n },\n });\n }\n\n private applyResolvedConfig(\n config: AppConfiguration,\n options: {\n reason: 'initial-load' \| 'backend-config' \| 'hydrated';\n emitWarnings: boolean;\n },\n ): void {\n const validatedConfig = AppConfiguration_Schema.parse(config);\n this._config = validatedConfig;\n this._preOverrideConfig = null;\n\n if (this._appSlug !== null) {\n this.logger.reinitialize(validatedConfig, this._appSlug);\n }\n\n this.validateEntityIdentityConfig(validatedConfig);\n if (options.emitWarnings) {\n this.emitDeferredFieldWarnings(validatedConfig);\n }\n\n this.logDebug('Resolved application configuration', {\n reason: options.reason,\n appSlug: this._appSlug,\n });\n }\n\n /\n Get JWT configuration with secrets\n /\n public get jwtConfig(): {\n config: AppConfiguration['jwt'],\n secrets: AppConfigurationSecrets['security']['jwt']\n } {\n return {\n config: this.config.jwt,\n secrets: this.secrets.security.jwt\n };\n }\n\n /* W7.3a: Whether anonymous sessions are enabled for any user type. */\n public get anonymousSessionsEnabled(): boolean {\n const userTypes = this._config?.userTypes;\n if (!userTypes) return false;\n return Object.values(userTypes).some(ut => ut.auth?.anonymousSessionsEnabled === true);\n }\n\n}\n"]}

package/dist/esm/config/services/app-configuration.backend.utils.d.ts CHANGED Viewed

@@ -12,6 +12,12 @@ export interface AppPrimaryLanguageConfigShape {
         languages?: {
             defaultLanguage?: string | AvailableLanguage;
             fallbackLanguage?: string | AvailableLanguage;
+            /**
+             * The locale set a user or organization may SELECT. Optional here so every existing caller
+             * of the primary/fallback helpers keeps type-checking against the narrower shape it already
+             * passes; `getConfiguredEnabledLanguages` treats its absence as "only the primary".
+             */
+            enabledLanguages?: readonly (string | AvailableLanguage)[];
         };
     };
 }
@@ -36,12 +42,48 @@ export declare function getConfiguredPrimaryLanguage(config: AppPrimaryLanguageC
  * primary locale so backend runtime consumers never invent a separate default.
  */
 export declare function getConfiguredFallbackLanguage(config: AppPrimaryLanguageConfigShape | null | undefined): AvailableLanguage;
+/**
+ * Resolve the full set of locales this application ENABLES — the locales a user or an organization
+ * may select, which is a strictly wider question than "the locale this SaaS authors natively".
+ *
+ * This is the named backend source for that set, and it exists because there was none: before it,
+ * `appPreferences.languages.enabledLanguages` was read by the frontend (`I18nContext`) and by the
+ * dev companion (which keeps its own private copy for the same reason), and by NOTHING in
+ * `saas-backend-lib`. Every backend consumer therefore answered locale questions with the PRIMARY
+ * locale, because that was the only helper on offer — which is exactly how the email-template
+ * startup check came to prove coverage for one locale in an application that enables two.
+ *
+ * Three deliberate properties:
+ *
+ * - **The primary is always a member, and always first.** An application that declares
+ *   `defaultLanguage: fr` and omits it from `enabledLanguages` has still enabled French — the
+ *   primary is enabled by definition, not by enumeration. Putting it first makes the returned array
+ *   usable as a report order without a second sort.
+ * - **Unknown values are DROPPED rather than thrown on**, unlike the primary/fallback helpers. Those
+ *   two resolve a single scalar the runtime must have, so an invalid value there is unusable and
+ *   failing fast is the only honest answer. This one resolves a SET whose other members are still
+ *   perfectly usable; refusing the whole set over one bad member would turn a typo in a secondary
+ *   language into a boot failure. The Zod config schema already rejects an out-of-vocabulary value
+ *   at parse time, so this filter is a defence for hand-built and partially-typed config objects.
+ * - **Duplicates collapse**, so a config that lists the primary explicitly reads identically to one
+ *   that does not.
+ */
+export declare function getConfiguredEnabledLanguages(config: AppPrimaryLanguageConfigShape | null | undefined): AvailableLanguage[];
 export declare class ApplicationUtils {
     /**
      * Transforms backend application configuration to a frontend-safe shared payload.
      * Filters out private/backend-only runtime endpoints and preserves only app-owned
      * frontend service entries keyed by frontend service identity.
      */
-    static toAppConfiguration_Shared(config: AppConfiguration): AppConfiguration_Shared;
+    static toAppConfiguration_Shared(config: AppConfiguration,
+    /**
+     * The application's own id, which the AUTHORED configuration does not carry — it is runtime
+     * identity, resolved at startup, not something an application declares about itself. Passed in
+     * rather than read here so this projection stays a pure function of its input.
+     *
+     * Optional so every existing caller and fixture keeps working; an absent id simply leaves the
+     * field off, which is the pre-existing behaviour.
+     */
+    applicationId?: string): AppConfiguration_Shared;
 }
 //# sourceMappingURL=app-configuration.backend.utils.d.ts.map

package/dist/esm/config/services/app-configuration.backend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-configuration.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/config/services/app-configuration.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAC/F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAIzE,MAAM,WAAW,6BAA6B;IAC5C,cAAc,CAAC,EAAE;QACf,SAAS,CAAC,EAAE;YACV,eAAe,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC;YAC7C,gBAAgB,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC;~~SAC/C~~,CAAC;KACH,CAAC;CACH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GACvD,iBAAiB,CAOnB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GACvD,iBAAiB,CAOnB;AAkBD,qBAAa,gBAAgB;IAC3B;;;;OAIG;IACH,MAAM,CAAC,yBAAyB,~~CAAC~~,MAAM,EAAE,gBAAgB,~~GAAG~~,uBAAuB;~~CA8EpF~~"}
1	+ {"version":3,"file":"app-configuration.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/config/services/app-configuration.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAC/F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAIzE,MAAM,WAAW,6BAA6B;IAC5C,cAAc,CAAC,EAAE;QACf,SAAS,CAAC,EAAE;YACV,eAAe,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC;YAC7C,gBAAgB,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC;YAC9C;;;;eAIG;YACH,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,iBAAiB,CAAC,EAAE,CAAC;SAC5D,CAAC;KACH,CAAC;CACH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GACvD,iBAAiB,CAOnB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GACvD,iBAAiB,CAOnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GACvD,iBAAiB,EAAE,CAQrB;AAkBD,qBAAa,gBAAgB;IAC3B;;;;OAIG;IACH,MAAM,CAAC,yBAAyB,CAC9B,MAAM,EAAE,gBAAgB;IACxB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,GACrB,uBAAuB;CAmF3B"}

package/dist/esm/config/services/app-configuration.backend.utils.js CHANGED Viewed

@@ -43,6 +43,41 @@ export function getConfiguredFallbackLanguage(config) {
     const found = Object.values(AvailableLanguage).find((value) => value === configured);
     return found ?? getConfiguredPrimaryLanguage(config);
 }
+/**
+ * Resolve the full set of locales this application ENABLES — the locales a user or an organization
+ * may select, which is a strictly wider question than "the locale this SaaS authors natively".
+ *
+ * This is the named backend source for that set, and it exists because there was none: before it,
+ * `appPreferences.languages.enabledLanguages` was read by the frontend (`I18nContext`) and by the
+ * dev companion (which keeps its own private copy for the same reason), and by NOTHING in
+ * `saas-backend-lib`. Every backend consumer therefore answered locale questions with the PRIMARY
+ * locale, because that was the only helper on offer — which is exactly how the email-template
+ * startup check came to prove coverage for one locale in an application that enables two.
+ *
+ * Three deliberate properties:
+ *
+ * - **The primary is always a member, and always first.** An application that declares
+ *   `defaultLanguage: fr` and omits it from `enabledLanguages` has still enabled French — the
+ *   primary is enabled by definition, not by enumeration. Putting it first makes the returned array
+ *   usable as a report order without a second sort.
+ * - **Unknown values are DROPPED rather than thrown on**, unlike the primary/fallback helpers. Those
+ *   two resolve a single scalar the runtime must have, so an invalid value there is unusable and
+ *   failing fast is the only honest answer. This one resolves a SET whose other members are still
+ *   perfectly usable; refusing the whole set over one bad member would turn a typo in a secondary
+ *   language into a boot failure. The Zod config schema already rejects an out-of-vocabulary value
+ *   at parse time, so this filter is a defence for hand-built and partially-typed config objects.
+ * - **Duplicates collapse**, so a config that lists the primary explicitly reads identically to one
+ *   that does not.
+ */
+export function getConfiguredEnabledLanguages(config) {
+    const primary = getConfiguredPrimaryLanguage(config);
+    const declared = config?.appPreferences?.languages?.enabledLanguages;
+    const knownLanguages = new Set(Object.values(AvailableLanguage));
+    const enabled = Array.isArray(declared)
+        ? declared.filter((language) => knownLanguages.has(language))
+        : [];
+    return [...new Set([primary, ...enabled])];
+}
 function buildPublicSocialOAuth2Providers(auth) {
     return Object.fromEntries(Object.entries(auth?.socialOAuth2Providers ?? {})
         .filter(([, providerConfig]) => isEnabledSocialOAuth2LoginProvider(providerConfig))
@@ -59,7 +94,16 @@ export class ApplicationUtils {
      * Filters out private/backend-only runtime endpoints and preserves only app-owned
      * frontend service entries keyed by frontend service identity.
      */
-    static toAppConfiguration_Shared(config) {
+    static toAppConfiguration_Shared(config,
+    /**
+     * The application's own id, which the AUTHORED configuration does not carry — it is runtime
+     * identity, resolved at startup, not something an application declares about itself. Passed in
+     * rather than read here so this projection stays a pure function of its input.
+     *
+     * Optional so every existing caller and fixture keeps working; an absent id simply leaves the
+     * field off, which is the pre-existing behaviour.
+     */
+    applicationId) {
         const { appIdentity, brandAssets, appPreferences, runtime, auth, userTypes, frontendServices, organizationTypes, compliance, billing, analytics, lifecycle, } = config;
         const runtime_endPoints = runtime.endPoints;
         // Keep only shared endpoints by excluding platform-private keys.
@@ -79,7 +123,10 @@ export class ApplicationUtils {
         const apiJwtPublicKey = config.jwt.publicKey[JwtPrivateKeys.APPLICATION_AUTH_TOKEN];
         // Strip backend-only auth fields before sending to frontend.
         // Same pattern as runtime (stripping appCustomRoot, internalUrl, platform-only endpoints).
-        const { socialOAuth2Providers: _privateSocialOAuth2Providers, passwordHashing, passkeyOperational, otpOperational, magicLinkOperational, totpOperational, ...sharedAuth } = auth;
+        const { socialOAuth2Providers: _privateSocialOAuth2Providers, passwordHashing, passkeyOperational, otpOperational, magicLinkOperational, totpOperational,
+        // A consent lifetime is an operator policy the browser has no use for (#465).
+        consentGrantLifetimeDays, ...sharedAuth } = auth;
+        void consentGrantLifetimeDays;
         // W6.9: Strip backend-only fields from per-user-type auth policies before frontend projection
         const strippedUserTypes = Object.fromEntries(Object.entries(userTypes ?? {}).map(([typeName, typeDef]) => {
             if (!typeDef?.auth)
@@ -88,7 +135,9 @@ export class ApplicationUtils {
             return [typeName, { ...typeDef, auth: frontendAuth }];
         }));
         return {
-            appIdentity,
+            // The id is MERGED here rather than declared upstream: `appIdentity` is authored by the
+            // application, and this is runtime identity the client needs to name its own scope room.
+            appIdentity: applicationId ? { ...appIdentity, applicationId } : appIdentity,
             brandAssets,
             appPreferences,
             runtime: {

package/dist/esm/config/services/app-configuration.backend.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-configuration.backend.utils.js","sourceRoot":"","sources":["../../../../../src/config/services/app-configuration.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAGxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,uFAAuF,CAAC;AAW3I;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAwD;IAExD,MAAM,UAAU,GAAG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,CAAC;IACtE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,UAA+B,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,uFAAuF,CAAC,CAAC;IAC9J,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;IACrF,OAAO,KAAK,IAAI,iBAAiB,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAwD;IAExD,MAAM,UAAU,GAAG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,CAAC;IACvE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,UAA+B,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,UAAU,CAAC,wFAAwF,CAAC,CAAC;IAChK,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;IACrF,OAAO,KAAK,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,gCAAgC,CACvC,IAAiD;IAEjD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,qBAAqB,IAAI,EAAE,CAAC;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,cAAc,CAAC,CAAC;SAClF,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;QACtC,WAAW;QACX;YACE,WAAW,EAAE,cAAc,EAAE,WAAW;SACzC;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAGD,MAAM,OAAO,gBAAgB;IAC3B;;;;OAIG;IACH,MAAM,CAAC,yBAAyB,CAAC,MAAwB;QACvD,MAAM,EACJ,WAAW,EACX,WAAW,EACX,cAAc,EACd,OAAO,EACP,IAAI,EACJ,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,OAAO,EACP,SAAS,EACT,SAAS,GACV,GAAG,MAAM,CAAC;QAEX,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC;QAE5C,iEAAiE;QACjE,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC9E,MAAM,0BAA0B,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAA8B,CAAC,CAAC;QAEnC,mEAAmE;QACnE,MAAM,qCAAqC,GAAG,MAAM,CAAC,WAAW,CAC9D,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YACjE,MAAM;YACN,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;SAC/B,CAAC,CACkC,CAAC;QAEvC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAEpF,6DAA6D;QAC7D,2FAA2F;QAC3F,MAAM,EACJ,qBAAqB,EAAE,6BAA6B,EACpD,eAAe,EACf,kBAAkB,EAAE,cAAc,EAAE,oBAAoB,EAAE,eAAe,EACzE,GAAG,UAAU,EACd,GAAG,IAAI,CAAC;QAET,8FAA8F;QAC9F,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE;YAC1D,IAAI,CAAC,OAAO,EAAE,IAAI;gBAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,IAAW,CAAC;YACjG,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,WAAW;YACX,WAAW;YACX,cAAc;YACd,OAAO,EAAE;gBACP,SAAS,EAAE,qCAAqC;aACjD;YACD,IAAI,EAAE;gBACJ,GAAG,UAAU;gBACb,qBAAqB,EAAE,gCAAgC,CAAC,IAAI,CAAC;aAC9D;YACD,SAAS,EAAE,iBAAiB;YAC5B,gBAAgB;YAChB,iBAAiB;YACjB,UAAU;YACV,OAAO;YACP,SAAS;YACT,SAAS;YACT,eAAe;SAChB,CAAC;IACJ,CAAC;CAEF","sourcesContent":["/*\n Frontend Configuration Transformers Service\n \n Backend service to transform complete backend application configuration\n * into frontend-safe subsets for API endpoints.\n /\n\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { AppConfiguration } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport type { AppConfiguration_Shared } from '@wildo-ai/saas-models';\nimport { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';\nimport { PlatformApplicationType } from '~wildo-backend-lib/applications/models/applications.backend.schemas';\nimport { isEnabledSocialOAuth2LoginProvider } from '~wildo-backend-lib/security/authentications/utils/social-oauth2-purpose.backend.utils';\n\nexport interface AppPrimaryLanguageConfigShape {\n appPreferences?: {\n languages?: {\n defaultLanguage?: string \| AvailableLanguage;\n fallbackLanguage?: string \| AvailableLanguage;\n };\n };\n}\n\n/\n Resolve the SaaS application's authoring / primary locale from the\n * canonical app-config path.\n \n This is the single source of truth for generation-time label ownership:\n * app-label labellize, app-label translate, and email-label generation all\n * derive their primary locale from\n * `appPreferences.languages.defaultLanguage`.\n \n Runtime consumers may still serve ORG / user-selected locales from the\n * enabled-languages set, but when a pipeline needs \"the locale this SaaS owns\n * natively\", this helper is the contract.\n /\nexport function getConfiguredPrimaryLanguage(\n config: AppPrimaryLanguageConfigShape \| null \| undefined,\n): AvailableLanguage {\n const configured = config?.appPreferences?.languages?.defaultLanguage;\n if (configured !== undefined && !Object.values(AvailableLanguage).includes(configured as AvailableLanguage)) {\n throw new Error(`Invalid app primary language \"${String(configured)}\". Configure appPreferences.languages.defaultLanguage with a valid AvailableLanguage.`);\n }\n const found = Object.values(AvailableLanguage).find((value) => value === configured);\n return found ?? AvailableLanguage.EN;\n}\n\n/\n Resolve the runtime fallback locale from app config.\n \n If the configured fallback is absent or invalid, fall back to the configured\n * primary locale so backend runtime consumers never invent a separate default.\n /\nexport function getConfiguredFallbackLanguage(\n config: AppPrimaryLanguageConfigShape \| null \| undefined,\n): AvailableLanguage {\n const configured = config?.appPreferences?.languages?.fallbackLanguage;\n if (configured !== undefined && !Object.values(AvailableLanguage).includes(configured as AvailableLanguage)) {\n throw new Error(`Invalid app fallback language \"${String(configured)}\". Configure appPreferences.languages.fallbackLanguage with a valid AvailableLanguage.`);\n }\n const found = Object.values(AvailableLanguage).find((value) => value === configured);\n return found ?? getConfiguredPrimaryLanguage(config);\n}\n\nfunction buildPublicSocialOAuth2Providers(\n auth: AppConfiguration['auth'] \| null \| undefined,\n): Record<string, { displayName?: string }> {\n return Object.fromEntries(\n Object.entries(auth?.socialOAuth2Providers ?? {})\n .filter(([, providerConfig]) => isEnabledSocialOAuth2LoginProvider(providerConfig))\n .map(([providerRef, providerConfig]) => [\n providerRef,\n {\n displayName: providerConfig?.displayName,\n },\n ]),\n );\n}\n\n\nexport class ApplicationUtils {\n /\n Transforms backend application configuration to a frontend-safe shared payload.\n * Filters out private/backend-only runtime endpoints and preserves only app-owned\n * frontend service entries keyed by frontend service identity.\n */\n static toAppConfiguration_Shared(config: AppConfiguration): AppConfiguration_Shared {\n const {\n appIdentity,\n brandAssets,\n appPreferences,\n runtime,\n auth,\n userTypes,\n frontendServices,\n organizationTypes,\n compliance,\n billing,\n analytics,\n lifecycle,\n } = config;\n\n const runtime_endPoints = runtime.endPoints;\n\n // Keep only shared endpoints by excluding platform-private keys.\n // Config-defined frontend service endpoints pass through automatically.\n const platformTypes = new Set<string>(Object.values(PlatformApplicationType));\n const runtime_endPoints_frontend = Object.keys(runtime_endPoints).reduce((acc, key) => {\n if (!platformTypes.has(key)) {\n acc[key] = runtime_endPoints[key];\n }\n return acc;\n }, {} as typeof runtime_endPoints);\n\n // For frontend, expose only publicUrl; explicitly drop internalUrl\n const runtime_endPoints_frontend_publicOnly = Object.fromEntries(\n Object.entries(runtime_endPoints_frontend).map(([appKey, urls]) => [\n appKey,\n { publicUrl: urls?.publicUrl },\n ])\n ) as typeof runtime_endPoints_frontend;\n\n const apiJwtPublicKey = config.jwt.publicKey[JwtPrivateKeys.APPLICATION_AUTH_TOKEN];\n\n // Strip backend-only auth fields before sending to frontend.\n // Same pattern as runtime (stripping appCustomRoot, internalUrl, platform-only endpoints).\n const {\n socialOAuth2Providers: _privateSocialOAuth2Providers,\n passwordHashing,\n passkeyOperational, otpOperational, magicLinkOperational, totpOperational,\n ...sharedAuth\n } = auth;\n\n // W6.9: Strip backend-only fields from per-user-type auth policies before frontend projection\n const strippedUserTypes = Object.fromEntries(\n Object.entries(userTypes ?? {}).map(([typeName, typeDef]) => {\n if (!typeDef?.auth) return [typeName, typeDef];\n const { lockoutPolicy: _lp, maxConcurrentSessions: _mcs, ...frontendAuth } = typeDef.auth as any;\n return [typeName, { ...typeDef, auth: frontendAuth }];\n }),\n );\n\n return {\n appIdentity,\n brandAssets,\n appPreferences,\n runtime: {\n endPoints: runtime_endPoints_frontend_publicOnly\n },\n auth: {\n ...sharedAuth,\n socialOAuth2Providers: buildPublicSocialOAuth2Providers(auth),\n },\n userTypes: strippedUserTypes,\n frontendServices,\n organizationTypes,\n compliance,\n billing,\n analytics,\n lifecycle,\n apiJwtPublicKey,\n };\n }\n\n}\n"]}
1	+ {"version":3,"file":"app-configuration.backend.utils.js","sourceRoot":"","sources":["../../../../../src/config/services/app-configuration.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAGxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,uFAAuF,CAAC;AAiB3I;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAwD;IAExD,MAAM,UAAU,GAAG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,CAAC;IACtE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,UAA+B,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,uFAAuF,CAAC,CAAC;IAC9J,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;IACrF,OAAO,KAAK,IAAI,iBAAiB,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAwD;IAExD,MAAM,UAAU,GAAG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,CAAC;IACvE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,UAA+B,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,UAAU,CAAC,wFAAwF,CAAC,CAAC;IAChK,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;IACrF,OAAO,KAAK,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAwD;IAExD,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,CAAC;IACrE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAiC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,QAAkB,CAAC,CAAC;QACtG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CAAC,GAAG,IAAI,GAAG,CAAoB,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,gCAAgC,CACvC,IAAiD;IAEjD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,qBAAqB,IAAI,EAAE,CAAC;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,cAAc,CAAC,CAAC;SAClF,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;QACtC,WAAW;QACX;YACE,WAAW,EAAE,cAAc,EAAE,WAAW;SACzC;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAGD,MAAM,OAAO,gBAAgB;IAC3B;;;;OAIG;IACH,MAAM,CAAC,yBAAyB,CAC9B,MAAwB;IACxB;;;;;;;OAOG;IACH,aAAsB;QAEtB,MAAM,EACJ,WAAW,EACX,WAAW,EACX,cAAc,EACd,OAAO,EACP,IAAI,EACJ,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,OAAO,EACP,SAAS,EACT,SAAS,GACV,GAAG,MAAM,CAAC;QAEX,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC;QAE5C,iEAAiE;QACjE,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC9E,MAAM,0BAA0B,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAA8B,CAAC,CAAC;QAEnC,mEAAmE;QACnE,MAAM,qCAAqC,GAAG,MAAM,CAAC,WAAW,CAC9D,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YACjE,MAAM;YACN,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;SAC/B,CAAC,CACkC,CAAC;QAEvC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAEpF,6DAA6D;QAC7D,2FAA2F;QAC3F,MAAM,EACJ,qBAAqB,EAAE,6BAA6B,EACpD,eAAe,EACf,kBAAkB,EAAE,cAAc,EAAE,oBAAoB,EAAE,eAAe;QACzE,8EAA8E;QAC9E,wBAAwB,EACxB,GAAG,UAAU,EACd,GAAG,IAAI,CAAC;QACT,KAAK,wBAAwB,CAAC;QAE9B,8FAA8F;QAC9F,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE;YAC1D,IAAI,CAAC,OAAO,EAAE,IAAI;gBAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,IAAW,CAAC;YACjG,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,wFAAwF;YACxF,yFAAyF;YACzF,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW;YAC5E,WAAW;YACX,cAAc;YACd,OAAO,EAAE;gBACP,SAAS,EAAE,qCAAqC;aACjD;YACD,IAAI,EAAE;gBACJ,GAAG,UAAU;gBACb,qBAAqB,EAAE,gCAAgC,CAAC,IAAI,CAAC;aAC9D;YACD,SAAS,EAAE,iBAAiB;YAC5B,gBAAgB;YAChB,iBAAiB;YACjB,UAAU;YACV,OAAO;YACP,SAAS;YACT,SAAS;YACT,eAAe;SAChB,CAAC;IACJ,CAAC;CAEF","sourcesContent":["/*\n Frontend Configuration Transformers Service\n \n Backend service to transform complete backend application configuration\n * into frontend-safe subsets for API endpoints.\n /\n\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { AppConfiguration } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport type { AppConfiguration_Shared } from '@wildo-ai/saas-models';\nimport { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';\nimport { PlatformApplicationType } from '~wildo-backend-lib/applications/models/applications.backend.schemas';\nimport { isEnabledSocialOAuth2LoginProvider } from '~wildo-backend-lib/security/authentications/utils/social-oauth2-purpose.backend.utils';\n\nexport interface AppPrimaryLanguageConfigShape {\n appPreferences?: {\n languages?: {\n defaultLanguage?: string \| AvailableLanguage;\n fallbackLanguage?: string \| AvailableLanguage;\n /\n The locale set a user or organization may SELECT. Optional here so every existing caller\n * of the primary/fallback helpers keeps type-checking against the narrower shape it already\n * passes; `getConfiguredEnabledLanguages` treats its absence as \"only the primary\".\n /\n enabledLanguages?: readonly (string \| AvailableLanguage)[];\n };\n };\n}\n\n/\n Resolve the SaaS application's authoring / primary locale from the\n * canonical app-config path.\n \n This is the single source of truth for generation-time label ownership:\n * app-label labellize, app-label translate, and email-label generation all\n * derive their primary locale from\n * `appPreferences.languages.defaultLanguage`.\n \n Runtime consumers may still serve ORG / user-selected locales from the\n * enabled-languages set, but when a pipeline needs \"the locale this SaaS owns\n * natively\", this helper is the contract.\n /\nexport function getConfiguredPrimaryLanguage(\n config: AppPrimaryLanguageConfigShape \| null \| undefined,\n): AvailableLanguage {\n const configured = config?.appPreferences?.languages?.defaultLanguage;\n if (configured !== undefined && !Object.values(AvailableLanguage).includes(configured as AvailableLanguage)) {\n throw new Error(`Invalid app primary language \"${String(configured)}\". Configure appPreferences.languages.defaultLanguage with a valid AvailableLanguage.`);\n }\n const found = Object.values(AvailableLanguage).find((value) => value === configured);\n return found ?? AvailableLanguage.EN;\n}\n\n/\n Resolve the runtime fallback locale from app config.\n \n If the configured fallback is absent or invalid, fall back to the configured\n * primary locale so backend runtime consumers never invent a separate default.\n /\nexport function getConfiguredFallbackLanguage(\n config: AppPrimaryLanguageConfigShape \| null \| undefined,\n): AvailableLanguage {\n const configured = config?.appPreferences?.languages?.fallbackLanguage;\n if (configured !== undefined && !Object.values(AvailableLanguage).includes(configured as AvailableLanguage)) {\n throw new Error(`Invalid app fallback language \"${String(configured)}\". Configure appPreferences.languages.fallbackLanguage with a valid AvailableLanguage.`);\n }\n const found = Object.values(AvailableLanguage).find((value) => value === configured);\n return found ?? getConfiguredPrimaryLanguage(config);\n}\n\n/\n Resolve the full set of locales this application ENABLES — the locales a user or an organization\n * may select, which is a strictly wider question than \"the locale this SaaS authors natively\".\n \n This is the named backend source for that set, and it exists because there was none: before it,\n * `appPreferences.languages.enabledLanguages` was read by the frontend (`I18nContext`) and by the\n * dev companion (which keeps its own private copy for the same reason), and by NOTHING in\n * `saas-backend-lib`. Every backend consumer therefore answered locale questions with the PRIMARY\n * locale, because that was the only helper on offer — which is exactly how the email-template\n * startup check came to prove coverage for one locale in an application that enables two.\n \n Three deliberate properties:\n \n - The primary is always a member, and always first. An application that declares\n * `defaultLanguage: fr` and omits it from `enabledLanguages` has still enabled French — the\n * primary is enabled by definition, not by enumeration. Putting it first makes the returned array\n * usable as a report order without a second sort.\n * - Unknown values are DROPPED rather than thrown on, unlike the primary/fallback helpers. Those\n * two resolve a single scalar the runtime must have, so an invalid value there is unusable and\n * failing fast is the only honest answer. This one resolves a SET whose other members are still\n * perfectly usable; refusing the whole set over one bad member would turn a typo in a secondary\n * language into a boot failure. The Zod config schema already rejects an out-of-vocabulary value\n * at parse time, so this filter is a defence for hand-built and partially-typed config objects.\n * - Duplicates collapse, so a config that lists the primary explicitly reads identically to one\n * that does not.\n /\nexport function getConfiguredEnabledLanguages(\n config: AppPrimaryLanguageConfigShape \| null \| undefined,\n): AvailableLanguage[] {\n const primary = getConfiguredPrimaryLanguage(config);\n const declared = config?.appPreferences?.languages?.enabledLanguages;\n const knownLanguages = new Set<string>(Object.values(AvailableLanguage));\n const enabled = Array.isArray(declared)\n ? declared.filter((language): language is AvailableLanguage => knownLanguages.has(language as string))\n : [];\n return [...new Set<AvailableLanguage>([primary, ...enabled])];\n}\n\nfunction buildPublicSocialOAuth2Providers(\n auth: AppConfiguration['auth'] \| null \| undefined,\n): Record<string, { displayName?: string }> {\n return Object.fromEntries(\n Object.entries(auth?.socialOAuth2Providers ?? {})\n .filter(([, providerConfig]) => isEnabledSocialOAuth2LoginProvider(providerConfig))\n .map(([providerRef, providerConfig]) => [\n providerRef,\n {\n displayName: providerConfig?.displayName,\n },\n ]),\n );\n}\n\n\nexport class ApplicationUtils {\n /\n Transforms backend application configuration to a frontend-safe shared payload.\n * Filters out private/backend-only runtime endpoints and preserves only app-owned\n * frontend service entries keyed by frontend service identity.\n /\n static toAppConfiguration_Shared(\n config: AppConfiguration,\n /\n The application's own id, which the AUTHORED configuration does not carry — it is runtime\n * identity, resolved at startup, not something an application declares about itself. Passed in\n * rather than read here so this projection stays a pure function of its input.\n \n Optional so every existing caller and fixture keeps working; an absent id simply leaves the\n * field off, which is the pre-existing behaviour.\n */\n applicationId?: string,\n ): AppConfiguration_Shared {\n const {\n appIdentity,\n brandAssets,\n appPreferences,\n runtime,\n auth,\n userTypes,\n frontendServices,\n organizationTypes,\n compliance,\n billing,\n analytics,\n lifecycle,\n } = config;\n\n const runtime_endPoints = runtime.endPoints;\n\n // Keep only shared endpoints by excluding platform-private keys.\n // Config-defined frontend service endpoints pass through automatically.\n const platformTypes = new Set<string>(Object.values(PlatformApplicationType));\n const runtime_endPoints_frontend = Object.keys(runtime_endPoints).reduce((acc, key) => {\n if (!platformTypes.has(key)) {\n acc[key] = runtime_endPoints[key];\n }\n return acc;\n }, {} as typeof runtime_endPoints);\n\n // For frontend, expose only publicUrl; explicitly drop internalUrl\n const runtime_endPoints_frontend_publicOnly = Object.fromEntries(\n Object.entries(runtime_endPoints_frontend).map(([appKey, urls]) => [\n appKey,\n { publicUrl: urls?.publicUrl },\n ])\n ) as typeof runtime_endPoints_frontend;\n\n const apiJwtPublicKey = config.jwt.publicKey[JwtPrivateKeys.APPLICATION_AUTH_TOKEN];\n\n // Strip backend-only auth fields before sending to frontend.\n // Same pattern as runtime (stripping appCustomRoot, internalUrl, platform-only endpoints).\n const {\n socialOAuth2Providers: _privateSocialOAuth2Providers,\n passwordHashing,\n passkeyOperational, otpOperational, magicLinkOperational, totpOperational,\n // A consent lifetime is an operator policy the browser has no use for (#465).\n consentGrantLifetimeDays,\n ...sharedAuth\n } = auth;\n void consentGrantLifetimeDays;\n\n // W6.9: Strip backend-only fields from per-user-type auth policies before frontend projection\n const strippedUserTypes = Object.fromEntries(\n Object.entries(userTypes ?? {}).map(([typeName, typeDef]) => {\n if (!typeDef?.auth) return [typeName, typeDef];\n const { lockoutPolicy: _lp, maxConcurrentSessions: _mcs, ...frontendAuth } = typeDef.auth as any;\n return [typeName, { ...typeDef, auth: frontendAuth }];\n }),\n );\n\n return {\n // The id is MERGED here rather than declared upstream: `appIdentity` is authored by the\n // application, and this is runtime identity the client needs to name its own scope room.\n appIdentity: applicationId ? { ...appIdentity, applicationId } : appIdentity,\n brandAssets,\n appPreferences,\n runtime: {\n endPoints: runtime_endPoints_frontend_publicOnly\n },\n auth: {\n ...sharedAuth,\n socialOAuth2Providers: buildPublicSocialOAuth2Providers(auth),\n },\n userTypes: strippedUserTypes,\n frontendServices,\n organizationTypes,\n compliance,\n billing,\n analytics,\n lifecycle,\n apiJwtPublicKey,\n };\n }\n\n}\n"]}

package/dist/esm/config/services/application-startup-config-validator.backend.service.d.ts CHANGED Viewed

@@ -353,6 +353,31 @@ export declare class ApplicationStartupConfigValidatorService {
     private warnOnDuplicateClaimedDomains;
     private warnOnBroadAutoLinkSocialOAuth2;
     private collectStorageIssues;
+    /**
+     * Refuse to boot an application whose file fields DECLARE a required scan with nothing to scan them.
+     *
+     * Keyed on the per-field `scanPolicy: 'required'` declaration only, and that is complete rather than a
+     * gap — the reasoning is worth recording because the obvious second branch is dead code.
+     *
+     * `FileScanningBackendService.isGlobalScanningEnabled()` (the application-wide default for a field that
+     * declares no policy) is DERIVED from the scanner topology: it is
+     * `clamavScanner.isConfigured() || yaraScanner.isEnabled()`. So "scanning is globally on and no scanner
+     * is reachable" is not a state this configuration can be in, and a branch reporting it would be
+     * `false && …` at every boot of every application — a check that can never fire, which reports a clean
+     * configuration and a broken checker identically. It was considered on 2026-09-09, when the dead global
+     * switch was repaired, and deliberately not added; it becomes necessary the day that switch is turned
+     * back into a separately-declared boolean, which is one of the three reasons it was not.
+     *
+     * The remaining route into "a scan was requested with no scanner" is therefore exactly the per-field
+     * declaration this collector already walks — plus any field this walk MISSES, which the `catch
+     * { continue; }` below makes possible and which is why `executeScan` also refuses at runtime rather
+     * than trusting that boot has already answered.
+     *
+     * ClamAV specifically, not "any scanner": YARA is a pattern layer documented as running on top of
+     * signature AV, not a replacement for it, so a `required` field is not satisfied by YARA alone. That is
+     * a posture, not an oversight — relaxing it would let an application satisfy `scanPolicy: 'required'`
+     * with no signature scanning at all.
+     */
     private collectScanningIssues;
     private collectYaraIssues;
     /**

package/dist/esm/config/services/application-startup-config-validator.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-startup-config-validator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/config/services/application-startup-config-validator.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,EAiBL,KAAK,6BAA6B,EAWnC,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,KAAK,EACV,gBAAgB,EACjB,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,2BAA2B,EAAE,MAAM,kEAAkE,CAAC;AAC/G,OAAO,EAAE,yBAAyB,EAAE,MAAM,gEAAgE,CAAC;AAK3G,OAAO,KAAK,EACV,mCAAmC,EACpC,MAAM,yFAAyF,CAAC;AAIjG,OAAO,KAAK,EACV,2DAA2D,EAC5D,MAAM,qHAAqH,CAAC;AAC7H,OAAO,KAAK,EACV,2CAA2C,EAE5C,MAAM,yFAAyF,CAAC;AAejG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAClI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAC5F,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,8EAA8E,CAAC;AAC1I,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAqBpH;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7E,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAEtC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAGnC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAO/C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAGzC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IAG3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAClC;;;;OAIG;IAGH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA9ClC,OAAO,CAAC,QAAQ,CAA+D;gBAGzB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAExF,yBAAyB,EAAE,uCAAuC,EAElE,mBAAmB,EAAE,0BAA0B,EAE/C,iBAAiB,EAAE,+BAA+B,EAElD,kBAAkB,EAAE,gCAAgC,EAEpD,iBAAiB,EAAE,+BAA+B,EAElD,aAAa,EAAE,2BAA2B,EAE1C,WAAW,EAAE,yBAAyB,EAEtC,qBAAqB,EAAE,mCAAmC,EAE1D,kBAAkB,EAAE,2DAA2D,EAG/E,6BAA6B,CAAC,EAC7C,2CAA2C,EAM5B,uBAAuB,CAAC,EAAE,qCAAqC,EAG/D,yBAAyB,CAAC,EAAE,gCAAgC,EAG5D,gBAAgB,CAAC,EAAE,uBAAuB;IAC3D;;;;OAIG;IAGc,cAAc,CAAC,EAAE,cAAc;IAS3C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAW/C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,yCAAyC;IAkBjD;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAO;IAElE;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,+BAA+B;IAkCvC;;;;;;;OAOG;IACH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gCAAgC;IAUxC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,yCAAyC;IASjD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,yCAAyC;IAMjD;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,+BAA+B;IASvC,OAAO,CAAC,aAAa;IAUrB;sGACkG;IAC3F,mCAAmC,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,6BAA6B;IAUpG;;;;;;;;;;;;OAYG;IACI,2CAA2C,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,6BAA6B;IAO5G;;;;;;OAMG;IACI,uCAAuC,IAAI,6BAA6B;IAK/E;;;;;;;;;OASG;IACU,8CAA8C,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACU,qCAAqC,IAAI,OAAO,CAAC,IAAI,CAAC;YAKrD,+BAA+B;IA8G7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACH,OAAO,CAAC,gCAAgC;IAgCxC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,4BAA4B;IA+B1C,+FAA+F;YACjF,6BAA6B;IA6B3C;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA8B9B,OAAO,CAAC,+BAA+B;IA+BvC,OAAO,CAAC,+BAA+B;IAgIvC,OAAO,CAAC,sCAAsC;IAsB9C,OAAO,CAAC,8BAA8B;IAYtC,OAAO,CAAC,6BAA6B;IA0BrC,OAAO,CAAC,+BAA+B;IA0BvC,OAAO,CAAC,oBAAoB;IAiE5B,OAAO,CAAC,qBAAqB;IAqC7B,OAAO,CAAC,iBAAiB;IAkBzB;;;;;;OAMG;IACH,OAAO,CAAC,mDAAmD;IA0C3D;;;;;;;;;OASG;IACH,OAAO,CAAC,uDAAuD;~~IAyH~~/D;;;;;;;OAOG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,uCAAuC;IAiB/C,OAAO,CAAC,qCAAqC;IAyB7C;;;;;;;;;OASG;IACH,OAAO,CAAC,8CAA8C;IA0BtD;;;;;;;;OAQG;IACH,OAAO,CAAC,6CAA6C;IAyDrD;;;;;;;;;OASG;IACH,OAAO,CAAC,iDAAiD;IAwCzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACH,OAAO,CAAC,mCAAmC;IAqF3C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,2CAA2C;IAyDnD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,gDAAgD;IAyDxD;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sDAAsD;IAoC9D,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAchC;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;CA2FjC"}
1	+ {"version":3,"file":"application-startup-config-validator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/config/services/application-startup-config-validator.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,EAiBL,KAAK,6BAA6B,EAWnC,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,KAAK,EACV,gBAAgB,EACjB,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,2BAA2B,EAAE,MAAM,kEAAkE,CAAC;AAC/G,OAAO,EAAE,yBAAyB,EAAE,MAAM,gEAAgE,CAAC;AAK3G,OAAO,KAAK,EACV,mCAAmC,EACpC,MAAM,yFAAyF,CAAC;AAIjG,OAAO,KAAK,EACV,2DAA2D,EAC5D,MAAM,qHAAqH,CAAC;AAC7H,OAAO,KAAK,EACV,2CAA2C,EAE5C,MAAM,yFAAyF,CAAC;AAejG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAClI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAC5F,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,8EAA8E,CAAC;AAC1I,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAqBpH;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7E,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAEtC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAGnC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAO/C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAGzC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IAG3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAClC;;;;OAIG;IAGH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA9ClC,OAAO,CAAC,QAAQ,CAA+D;gBAGzB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAExF,yBAAyB,EAAE,uCAAuC,EAElE,mBAAmB,EAAE,0BAA0B,EAE/C,iBAAiB,EAAE,+BAA+B,EAElD,kBAAkB,EAAE,gCAAgC,EAEpD,iBAAiB,EAAE,+BAA+B,EAElD,aAAa,EAAE,2BAA2B,EAE1C,WAAW,EAAE,yBAAyB,EAEtC,qBAAqB,EAAE,mCAAmC,EAE1D,kBAAkB,EAAE,2DAA2D,EAG/E,6BAA6B,CAAC,EAC7C,2CAA2C,EAM5B,uBAAuB,CAAC,EAAE,qCAAqC,EAG/D,yBAAyB,CAAC,EAAE,gCAAgC,EAG5D,gBAAgB,CAAC,EAAE,uBAAuB;IAC3D;;;;OAIG;IAGc,cAAc,CAAC,EAAE,cAAc;IAS3C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAW/C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,yCAAyC;IAkBjD;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAO;IAElE;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,+BAA+B;IAkCvC;;;;;;;OAOG;IACH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gCAAgC;IAUxC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,yCAAyC;IASjD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,yCAAyC;IAMjD;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,+BAA+B;IASvC,OAAO,CAAC,aAAa;IAUrB;sGACkG;IAC3F,mCAAmC,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,6BAA6B;IAUpG;;;;;;;;;;;;OAYG;IACI,2CAA2C,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,6BAA6B;IAO5G;;;;;;OAMG;IACI,uCAAuC,IAAI,6BAA6B;IAK/E;;;;;;;;;OASG;IACU,8CAA8C,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACU,qCAAqC,IAAI,OAAO,CAAC,IAAI,CAAC;YAKrD,+BAA+B;IA8G7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACH,OAAO,CAAC,gCAAgC;IAgCxC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,4BAA4B;IA+B1C,+FAA+F;YACjF,6BAA6B;IA6B3C;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA8B9B,OAAO,CAAC,+BAA+B;IA+BvC,OAAO,CAAC,+BAA+B;IAgIvC,OAAO,CAAC,sCAAsC;IAsB9C,OAAO,CAAC,8BAA8B;IAYtC,OAAO,CAAC,6BAA6B;IA0BrC,OAAO,CAAC,+BAA+B;IA0BvC,OAAO,CAAC,oBAAoB;IAiE5B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,qBAAqB;IAqC7B,OAAO,CAAC,iBAAiB;IAkBzB;;;;;;OAMG;IACH,OAAO,CAAC,mDAAmD;IA0C3D;;;;;;;;;OASG;IACH,OAAO,CAAC,uDAAuD;IAwI/D;;;;;;;OAOG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,uCAAuC;IAiB/C,OAAO,CAAC,qCAAqC;IAyB7C;;;;;;;;;OASG;IACH,OAAO,CAAC,8CAA8C;IA0BtD;;;;;;;;OAQG;IACH,OAAO,CAAC,6CAA6C;IAyDrD;;;;;;;;;OASG;IACH,OAAO,CAAC,iDAAiD;IAwCzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACH,OAAO,CAAC,mCAAmC;IAqF3C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,2CAA2C;IAyDnD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,gDAAgD;IAyDxD;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sDAAsD;IAoC9D,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAchC;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;CA2FjC"}

package/dist/esm/config/services/application-startup-config-validator.backend.service.js CHANGED Viewed

@@ -945,6 +945,31 @@ let ApplicationStartupConfigValidatorService = class ApplicationStartupConfigVal
         return issues;
     }
     // ─── Scanning (ClamAV) ──────────────────────────────────────────────────
+    /**
+     * Refuse to boot an application whose file fields DECLARE a required scan with nothing to scan them.
+     *
+     * Keyed on the per-field `scanPolicy: 'required'` declaration only, and that is complete rather than a
+     * gap — the reasoning is worth recording because the obvious second branch is dead code.
+     *
+     * `FileScanningBackendService.isGlobalScanningEnabled()` (the application-wide default for a field that
+     * declares no policy) is DERIVED from the scanner topology: it is
+     * `clamavScanner.isConfigured() || yaraScanner.isEnabled()`. So "scanning is globally on and no scanner
+     * is reachable" is not a state this configuration can be in, and a branch reporting it would be
+     * `false && …` at every boot of every application — a check that can never fire, which reports a clean
+     * configuration and a broken checker identically. It was considered on 2026-09-09, when the dead global
+     * switch was repaired, and deliberately not added; it becomes necessary the day that switch is turned
+     * back into a separately-declared boolean, which is one of the three reasons it was not.
+     *
+     * The remaining route into "a scan was requested with no scanner" is therefore exactly the per-field
+     * declaration this collector already walks — plus any field this walk MISSES, which the `catch
+     * { continue; }` below makes possible and which is why `executeScan` also refuses at runtime rather
+     * than trusting that boot has already answered.
+     *
+     * ClamAV specifically, not "any scanner": YARA is a pattern layer documented as running on top of
+     * signature AV, not a replacement for it, so a `required` field is not satisfied by YARA alone. That is
+     * a posture, not an oversight — relaxing it would let an application satisfy `scanPolicy: 'required'`
+     * with no signature scanning at all.
+     */
     collectScanningIssues() {
         const issues = [];
         const allResourceTypes = this.resourcesRegistry.getResourceTypes();
@@ -1030,7 +1055,22 @@ let ApplicationStartupConfigValidatorService = class ApplicationStartupConfigVal
         const userTypeEntries = Object.entries(config.userTypes ?? {});
         const selfRegistrationUserTypes = userTypeEntries
             .filter(([, definition]) => isRegistrationAcquisitionAllowed(definition.auth.registration.mode, RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE)
-            && definition.auth.registration.allowedMethods.includes(AuthMethod.PASSWORD))
+            /*
+             * Any method whose signup runs through `createSelfRegistrationPersistenceRequest`, not
+             * PASSWORD alone (#463).
+             *
+             * MAGIC_LINK and PASSKEY gained public registration and use the SAME persistence path — they
+             * differ only in holding no credential and minting a link afterwards. Left as `PASSWORD`
+             * alone, an application enabling ONLY password-less signup would not have this boundary
+             * declared, and its first registration would fail at the transaction rather than at
+             * configuration time.
+             *
+             * EXTERNAL_OAUTH2 is deliberately NOT here: social JIT creation has its own boundary
+             * request, collected below.
+             */
+            && definition.auth.registration.allowedMethods.some((method) => method === AuthMethod.PASSWORD
+                || method === AuthMethod.MAGIC_LINK
+                || method === AuthMethod.PASSKEY))
             .map(([userType]) => userType);
         if (selfRegistrationUserTypes.length > 0) {
             const eligibleUserTypes = new Set(selfRegistrationUserTypes);