@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/config/services/app-configuration.backend.utils.d.ts

@@ -12,6 +12,12 @@ export interface AppPrimaryLanguageConfigShape {
         languages?: {
             defaultLanguage?: string | AvailableLanguage;
             fallbackLanguage?: string | AvailableLanguage;
+            /**
+             * The locale set a user or organization may SELECT. Optional here so every existing caller
+             * of the primary/fallback helpers keeps type-checking against the narrower shape it already
+             * passes; `getConfiguredEnabledLanguages` treats its absence as "only the primary".
+             */
+            enabledLanguages?: readonly (string | AvailableLanguage)[];
         };
     };
 }
@@ -36,6 +42,33 @@ export declare function getConfiguredPrimaryLanguage(config: AppPrimaryLanguageC
  * primary locale so backend runtime consumers never invent a separate default.
  */
 export declare function getConfiguredFallbackLanguage(config: AppPrimaryLanguageConfigShape | null | undefined): AvailableLanguage;
+/**
+ * Resolve the full set of locales this application ENABLES — the locales a user or an organization
+ * may select, which is a strictly wider question than "the locale this SaaS authors natively".
+ *
+ * This is the named backend source for that set, and it exists because there was none: before it,
+ * `appPreferences.languages.enabledLanguages` was read by the frontend (`I18nContext`) and by the
+ * dev companion (which keeps its own private copy for the same reason), and by NOTHING in
+ * `saas-backend-lib`. Every backend consumer therefore answered locale questions with the PRIMARY
+ * locale, because that was the only helper on offer — which is exactly how the email-template
+ * startup check came to prove coverage for one locale in an application that enables two.
+ *
+ * Three deliberate properties:
+ *
+ * - **The primary is always a member, and always first.** An application that declares
+ *   `defaultLanguage: fr` and omits it from `enabledLanguages` has still enabled French — the
+ *   primary is enabled by definition, not by enumeration. Putting it first makes the returned array
+ *   usable as a report order without a second sort.
+ * - **Unknown values are DROPPED rather than thrown on**, unlike the primary/fallback helpers. Those
+ *   two resolve a single scalar the runtime must have, so an invalid value there is unusable and
+ *   failing fast is the only honest answer. This one resolves a SET whose other members are still
+ *   perfectly usable; refusing the whole set over one bad member would turn a typo in a secondary
+ *   language into a boot failure. The Zod config schema already rejects an out-of-vocabulary value
+ *   at parse time, so this filter is a defence for hand-built and partially-typed config objects.
+ * - **Duplicates collapse**, so a config that lists the primary explicitly reads identically to one
+ *   that does not.
+ */
+export declare function getConfiguredEnabledLanguages(config: AppPrimaryLanguageConfigShape | null | undefined): AvailableLanguage[];
 export declare class ApplicationUtils {
     /**
      * Transforms backend application configuration to a frontend-safe shared payload.

package/dist/esm/config/services/app-configuration.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-configuration.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/config/services/app-configuration.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAC/F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAIzE,MAAM,WAAW,6BAA6B;IAC5C,cAAc,CAAC,EAAE;QACf,SAAS,CAAC,EAAE;YACV,eAAe,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC;YAC7C,gBAAgB,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC;SAC/C,CAAC;KACH,CAAC;CACH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GACvD,iBAAiB,CAOnB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GACvD,iBAAiB,CAOnB;AAkBD,qBAAa,gBAAgB;IAC3B;;;;OAIG;IACH,MAAM,CAAC,yBAAyB,CAC9B,MAAM,EAAE,gBAAgB;IACxB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,GACrB,uBAAuB;CAgF3B"}
+{"version":3,"file":"app-configuration.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/config/services/app-configuration.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAC/F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAIzE,MAAM,WAAW,6BAA6B;IAC5C,cAAc,CAAC,EAAE;QACf,SAAS,CAAC,EAAE;YACV,eAAe,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC;YAC7C,gBAAgB,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC;YAC9C;;;;eAIG;YACH,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,iBAAiB,CAAC,EAAE,CAAC;SAC5D,CAAC;KACH,CAAC;CACH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GACvD,iBAAiB,CAOnB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GACvD,iBAAiB,CAOnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GACvD,iBAAiB,EAAE,CAQrB;AAkBD,qBAAa,gBAAgB;IAC3B;;;;OAIG;IACH,MAAM,CAAC,yBAAyB,CAC9B,MAAM,EAAE,gBAAgB;IACxB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,GACrB,uBAAuB;CAmF3B"}

package/dist/esm/config/services/app-configuration.backend.utils.js

@@ -43,6 +43,41 @@ export function getConfiguredFallbackLanguage(config) {
     const found = Object.values(AvailableLanguage).find((value) => value === configured);
     return found ?? getConfiguredPrimaryLanguage(config);
 }
+/**
+ * Resolve the full set of locales this application ENABLES — the locales a user or an organization
+ * may select, which is a strictly wider question than "the locale this SaaS authors natively".
+ *
+ * This is the named backend source for that set, and it exists because there was none: before it,
+ * `appPreferences.languages.enabledLanguages` was read by the frontend (`I18nContext`) and by the
+ * dev companion (which keeps its own private copy for the same reason), and by NOTHING in
+ * `saas-backend-lib`. Every backend consumer therefore answered locale questions with the PRIMARY
+ * locale, because that was the only helper on offer — which is exactly how the email-template
+ * startup check came to prove coverage for one locale in an application that enables two.
+ *
+ * Three deliberate properties:
+ *
+ * - **The primary is always a member, and always first.** An application that declares
+ *   `defaultLanguage: fr` and omits it from `enabledLanguages` has still enabled French — the
+ *   primary is enabled by definition, not by enumeration. Putting it first makes the returned array
+ *   usable as a report order without a second sort.
+ * - **Unknown values are DROPPED rather than thrown on**, unlike the primary/fallback helpers. Those
+ *   two resolve a single scalar the runtime must have, so an invalid value there is unusable and
+ *   failing fast is the only honest answer. This one resolves a SET whose other members are still
+ *   perfectly usable; refusing the whole set over one bad member would turn a typo in a secondary
+ *   language into a boot failure. The Zod config schema already rejects an out-of-vocabulary value
+ *   at parse time, so this filter is a defence for hand-built and partially-typed config objects.
+ * - **Duplicates collapse**, so a config that lists the primary explicitly reads identically to one
+ *   that does not.
+ */
+export function getConfiguredEnabledLanguages(config) {
+    const primary = getConfiguredPrimaryLanguage(config);
+    const declared = config?.appPreferences?.languages?.enabledLanguages;
+    const knownLanguages = new Set(Object.values(AvailableLanguage));
+    const enabled = Array.isArray(declared)
+        ? declared.filter((language) => knownLanguages.has(language))
+        : [];
+    return [...new Set([primary, ...enabled])];
+}
 function buildPublicSocialOAuth2Providers(auth) {
     return Object.fromEntries(Object.entries(auth?.socialOAuth2Providers ?? {})
         .filter(([, providerConfig]) => isEnabledSocialOAuth2LoginProvider(providerConfig))
@@ -88,7 +123,10 @@ export class ApplicationUtils {
         const apiJwtPublicKey = config.jwt.publicKey[JwtPrivateKeys.APPLICATION_AUTH_TOKEN];
         // Strip backend-only auth fields before sending to frontend.
         // Same pattern as runtime (stripping appCustomRoot, internalUrl, platform-only endpoints).
-        const { socialOAuth2Providers: _privateSocialOAuth2Providers, passwordHashing, passkeyOperational, otpOperational, magicLinkOperational, totpOperational, ...sharedAuth } = auth;
+        const { socialOAuth2Providers: _privateSocialOAuth2Providers, passwordHashing, passkeyOperational, otpOperational, magicLinkOperational, totpOperational, 
+        // A consent lifetime is an operator policy the browser has no use for (#465).
+        consentGrantLifetimeDays, ...sharedAuth } = auth;
+        void consentGrantLifetimeDays;
         // W6.9: Strip backend-only fields from per-user-type auth policies before frontend projection
         const strippedUserTypes = Object.fromEntries(Object.entries(userTypes ?? {}).map(([typeName, typeDef]) => {
             if (!typeDef?.auth)

package/dist/esm/config/services/app-configuration.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-configuration.backend.utils.js","sourceRoot":"","sources":["../../../../../src/config/services/app-configuration.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAGxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,uFAAuF,CAAC;AAW3I;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAwD;IAExD,MAAM,UAAU,GAAG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,CAAC;IACtE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,UAA+B,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,uFAAuF,CAAC,CAAC;IAC9J,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;IACrF,OAAO,KAAK,IAAI,iBAAiB,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAwD;IAExD,MAAM,UAAU,GAAG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,CAAC;IACvE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,UAA+B,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,UAAU,CAAC,wFAAwF,CAAC,CAAC;IAChK,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;IACrF,OAAO,KAAK,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,gCAAgC,CACvC,IAAiD;IAEjD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,qBAAqB,IAAI,EAAE,CAAC;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,cAAc,CAAC,CAAC;SAClF,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;QACtC,WAAW;QACX;YACE,WAAW,EAAE,cAAc,EAAE,WAAW;SACzC;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAGD,MAAM,OAAO,gBAAgB;IAC3B;;;;OAIG;IACH,MAAM,CAAC,yBAAyB,CAC9B,MAAwB;IACxB;;;;;;;OAOG;IACH,aAAsB;QAEtB,MAAM,EACJ,WAAW,EACX,WAAW,EACX,cAAc,EACd,OAAO,EACP,IAAI,EACJ,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,OAAO,EACP,SAAS,EACT,SAAS,GACV,GAAG,MAAM,CAAC;QAEX,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC;QAE5C,iEAAiE;QACjE,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC9E,MAAM,0BAA0B,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAA8B,CAAC,CAAC;QAEnC,mEAAmE;QACnE,MAAM,qCAAqC,GAAG,MAAM,CAAC,WAAW,CAC9D,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YACjE,MAAM;YACN,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;SAC/B,CAAC,CACkC,CAAC;QAEvC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAEpF,6DAA6D;QAC7D,2FAA2F;QAC3F,MAAM,EACJ,qBAAqB,EAAE,6BAA6B,EACpD,eAAe,EACf,kBAAkB,EAAE,cAAc,EAAE,oBAAoB,EAAE,eAAe,EACzE,GAAG,UAAU,EACd,GAAG,IAAI,CAAC;QAET,8FAA8F;QAC9F,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE;YAC1D,IAAI,CAAC,OAAO,EAAE,IAAI;gBAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,IAAW,CAAC;YACjG,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,wFAAwF;YACxF,yFAAyF;YACzF,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW;YAC5E,WAAW;YACX,cAAc;YACd,OAAO,EAAE;gBACP,SAAS,EAAE,qCAAqC;aACjD;YACD,IAAI,EAAE;gBACJ,GAAG,UAAU;gBACb,qBAAqB,EAAE,gCAAgC,CAAC,IAAI,CAAC;aAC9D;YACD,SAAS,EAAE,iBAAiB;YAC5B,gBAAgB;YAChB,iBAAiB;YACjB,UAAU;YACV,OAAO;YACP,SAAS;YACT,SAAS;YACT,eAAe;SAChB,CAAC;IACJ,CAAC;CAEF","sourcesContent":["/**\n * Frontend Configuration Transformers Service\n *\n * Backend service to transform complete backend application configuration\n * into frontend-safe subsets for API endpoints.\n */\n\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { AppConfiguration } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport type { AppConfiguration_Shared } from '@wildo-ai/saas-models';\nimport { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';\nimport { PlatformApplicationType } from '~wildo-backend-lib/applications/models/applications.backend.schemas';\nimport { isEnabledSocialOAuth2LoginProvider } from '~wildo-backend-lib/security/authentications/utils/social-oauth2-purpose.backend.utils';\n\nexport interface AppPrimaryLanguageConfigShape {\n  appPreferences?: {\n    languages?: {\n      defaultLanguage?: string | AvailableLanguage;\n      fallbackLanguage?: string | AvailableLanguage;\n    };\n  };\n}\n\n/**\n * Resolve the SaaS application's authoring / primary locale from the\n * canonical app-config path.\n *\n * This is the single source of truth for generation-time label ownership:\n * app-label labellize, app-label translate, and email-label generation all\n * derive their primary locale from\n * `appPreferences.languages.defaultLanguage`.\n *\n * Runtime consumers may still serve ORG / user-selected locales from the\n * enabled-languages set, but when a pipeline needs \"the locale this SaaS owns\n * natively\", this helper is the contract.\n */\nexport function getConfiguredPrimaryLanguage(\n  config: AppPrimaryLanguageConfigShape | null | undefined,\n): AvailableLanguage {\n  const configured = config?.appPreferences?.languages?.defaultLanguage;\n  if (configured !== undefined && !Object.values(AvailableLanguage).includes(configured as AvailableLanguage)) {\n    throw new Error(`Invalid app primary language \"${String(configured)}\". Configure appPreferences.languages.defaultLanguage with a valid AvailableLanguage.`);\n  }\n  const found = Object.values(AvailableLanguage).find((value) => value === configured);\n  return found ?? AvailableLanguage.EN;\n}\n\n/**\n * Resolve the runtime fallback locale from app config.\n *\n * If the configured fallback is absent or invalid, fall back to the configured\n * primary locale so backend runtime consumers never invent a separate default.\n */\nexport function getConfiguredFallbackLanguage(\n  config: AppPrimaryLanguageConfigShape | null | undefined,\n): AvailableLanguage {\n  const configured = config?.appPreferences?.languages?.fallbackLanguage;\n  if (configured !== undefined && !Object.values(AvailableLanguage).includes(configured as AvailableLanguage)) {\n    throw new Error(`Invalid app fallback language \"${String(configured)}\". Configure appPreferences.languages.fallbackLanguage with a valid AvailableLanguage.`);\n  }\n  const found = Object.values(AvailableLanguage).find((value) => value === configured);\n  return found ?? getConfiguredPrimaryLanguage(config);\n}\n\nfunction buildPublicSocialOAuth2Providers(\n  auth: AppConfiguration['auth'] | null | undefined,\n): Record<string, { displayName?: string }> {\n  return Object.fromEntries(\n    Object.entries(auth?.socialOAuth2Providers ?? {})\n      .filter(([, providerConfig]) => isEnabledSocialOAuth2LoginProvider(providerConfig))\n      .map(([providerRef, providerConfig]) => [\n        providerRef,\n        {\n          displayName: providerConfig?.displayName,\n        },\n      ]),\n  );\n}\n\n\nexport class ApplicationUtils {\n  /**\n   * Transforms backend application configuration to a frontend-safe shared payload.\n   * Filters out private/backend-only runtime endpoints and preserves only app-owned\n   * frontend service entries keyed by frontend service identity.\n   */\n  static toAppConfiguration_Shared(\n    config: AppConfiguration,\n    /**\n     * The application's own id, which the AUTHORED configuration does not carry — it is runtime\n     * identity, resolved at startup, not something an application declares about itself. Passed in\n     * rather than read here so this projection stays a pure function of its input.\n     *\n     * Optional so every existing caller and fixture keeps working; an absent id simply leaves the\n     * field off, which is the pre-existing behaviour.\n     */\n    applicationId?: string,\n  ): AppConfiguration_Shared {\n    const {\n      appIdentity,\n      brandAssets,\n      appPreferences,\n      runtime,\n      auth,\n      userTypes,\n      frontendServices,\n      organizationTypes,\n      compliance,\n      billing,\n      analytics,\n      lifecycle,\n    } = config;\n\n    const runtime_endPoints = runtime.endPoints;\n\n    // Keep only shared endpoints by excluding platform-private keys.\n    // Config-defined frontend service endpoints pass through automatically.\n    const platformTypes = new Set<string>(Object.values(PlatformApplicationType));\n    const runtime_endPoints_frontend = Object.keys(runtime_endPoints).reduce((acc, key) => {\n      if (!platformTypes.has(key)) {\n        acc[key] = runtime_endPoints[key];\n      }\n      return acc;\n    }, {} as typeof runtime_endPoints);\n\n    // For frontend, expose only publicUrl; explicitly drop internalUrl\n    const runtime_endPoints_frontend_publicOnly = Object.fromEntries(\n      Object.entries(runtime_endPoints_frontend).map(([appKey, urls]) => [\n        appKey,\n        { publicUrl: urls?.publicUrl },\n      ])\n    ) as typeof runtime_endPoints_frontend;\n\n    const apiJwtPublicKey = config.jwt.publicKey[JwtPrivateKeys.APPLICATION_AUTH_TOKEN];\n\n    // Strip backend-only auth fields before sending to frontend.\n    // Same pattern as runtime (stripping appCustomRoot, internalUrl, platform-only endpoints).\n    const {\n      socialOAuth2Providers: _privateSocialOAuth2Providers,\n      passwordHashing,\n      passkeyOperational, otpOperational, magicLinkOperational, totpOperational,\n      ...sharedAuth\n    } = auth;\n\n    // W6.9: Strip backend-only fields from per-user-type auth policies before frontend projection\n    const strippedUserTypes = Object.fromEntries(\n      Object.entries(userTypes ?? {}).map(([typeName, typeDef]) => {\n        if (!typeDef?.auth) return [typeName, typeDef];\n        const { lockoutPolicy: _lp, maxConcurrentSessions: _mcs, ...frontendAuth } = typeDef.auth as any;\n        return [typeName, { ...typeDef, auth: frontendAuth }];\n      }),\n    );\n\n    return {\n      // The id is MERGED here rather than declared upstream: `appIdentity` is authored by the\n      // application, and this is runtime identity the client needs to name its own scope room.\n      appIdentity: applicationId ? { ...appIdentity, applicationId } : appIdentity,\n      brandAssets,\n      appPreferences,\n      runtime: {\n        endPoints: runtime_endPoints_frontend_publicOnly\n      },\n      auth: {\n        ...sharedAuth,\n        socialOAuth2Providers: buildPublicSocialOAuth2Providers(auth),\n      },\n      userTypes: strippedUserTypes,\n      frontendServices,\n      organizationTypes,\n      compliance,\n      billing,\n      analytics,\n      lifecycle,\n      apiJwtPublicKey,\n    };\n  }\n\n}\n"]}
+{"version":3,"file":"app-configuration.backend.utils.js","sourceRoot":"","sources":["../../../../src/config/services/app-configuration.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,wEAAwE,CAAC;AAGxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAC9G,OAAO,EAAE,kCAAkC,EAAE,MAAM,uFAAuF,CAAC;AAiB3I;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAwD;IAExD,MAAM,UAAU,GAAG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,CAAC;IACtE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,UAA+B,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,uFAAuF,CAAC,CAAC;IAC9J,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;IACrF,OAAO,KAAK,IAAI,iBAAiB,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAwD;IAExD,MAAM,UAAU,GAAG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,CAAC;IACvE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,UAA+B,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,UAAU,CAAC,wFAAwF,CAAC,CAAC;IAChK,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;IACrF,OAAO,KAAK,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAwD;IAExD,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,CAAC;IACrE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAiC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,QAAkB,CAAC,CAAC;QACtG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CAAC,GAAG,IAAI,GAAG,CAAoB,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,gCAAgC,CACvC,IAAiD;IAEjD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,qBAAqB,IAAI,EAAE,CAAC;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,kCAAkC,CAAC,cAAc,CAAC,CAAC;SAClF,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;QACtC,WAAW;QACX;YACE,WAAW,EAAE,cAAc,EAAE,WAAW;SACzC;KACF,CAAC,CACL,CAAC;AACJ,CAAC;AAGD,MAAM,OAAO,gBAAgB;IAC3B;;;;OAIG;IACH,MAAM,CAAC,yBAAyB,CAC9B,MAAwB;IACxB;;;;;;;OAOG;IACH,aAAsB;QAEtB,MAAM,EACJ,WAAW,EACX,WAAW,EACX,cAAc,EACd,OAAO,EACP,IAAI,EACJ,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,OAAO,EACP,SAAS,EACT,SAAS,GACV,GAAG,MAAM,CAAC;QAEX,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC;QAE5C,iEAAiE;QACjE,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC9E,MAAM,0BAA0B,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAA8B,CAAC,CAAC;QAEnC,mEAAmE;QACnE,MAAM,qCAAqC,GAAG,MAAM,CAAC,WAAW,CAC9D,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YACjE,MAAM;YACN,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;SAC/B,CAAC,CACkC,CAAC;QAEvC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAEpF,6DAA6D;QAC7D,2FAA2F;QAC3F,MAAM,EACJ,qBAAqB,EAAE,6BAA6B,EACpD,eAAe,EACf,kBAAkB,EAAE,cAAc,EAAE,oBAAoB,EAAE,eAAe;QACzE,8EAA8E;QAC9E,wBAAwB,EACxB,GAAG,UAAU,EACd,GAAG,IAAI,CAAC;QACT,KAAK,wBAAwB,CAAC;QAE9B,8FAA8F;QAC9F,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE;YAC1D,IAAI,CAAC,OAAO,EAAE,IAAI;gBAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,IAAW,CAAC;YACjG,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,wFAAwF;YACxF,yFAAyF;YACzF,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,WAAW;YAC5E,WAAW;YACX,cAAc;YACd,OAAO,EAAE;gBACP,SAAS,EAAE,qCAAqC;aACjD;YACD,IAAI,EAAE;gBACJ,GAAG,UAAU;gBACb,qBAAqB,EAAE,gCAAgC,CAAC,IAAI,CAAC;aAC9D;YACD,SAAS,EAAE,iBAAiB;YAC5B,gBAAgB;YAChB,iBAAiB;YACjB,UAAU;YACV,OAAO;YACP,SAAS;YACT,SAAS;YACT,eAAe;SAChB,CAAC;IACJ,CAAC;CAEF","sourcesContent":["/**\n * Frontend Configuration Transformers Service\n *\n * Backend service to transform complete backend application configuration\n * into frontend-safe subsets for API endpoints.\n */\n\nimport { JwtPrivateKeys } from '~wildo-backend-lib/security/authentications/models/jwt.backend.schemas';\nimport { AppConfiguration } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport type { AppConfiguration_Shared } from '@wildo-ai/saas-models';\nimport { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';\nimport { PlatformApplicationType } from '~wildo-backend-lib/applications/models/applications.backend.schemas';\nimport { isEnabledSocialOAuth2LoginProvider } from '~wildo-backend-lib/security/authentications/utils/social-oauth2-purpose.backend.utils';\n\nexport interface AppPrimaryLanguageConfigShape {\n  appPreferences?: {\n    languages?: {\n      defaultLanguage?: string | AvailableLanguage;\n      fallbackLanguage?: string | AvailableLanguage;\n      /**\n       * The locale set a user or organization may SELECT. Optional here so every existing caller\n       * of the primary/fallback helpers keeps type-checking against the narrower shape it already\n       * passes; `getConfiguredEnabledLanguages` treats its absence as \"only the primary\".\n       */\n      enabledLanguages?: readonly (string | AvailableLanguage)[];\n    };\n  };\n}\n\n/**\n * Resolve the SaaS application's authoring / primary locale from the\n * canonical app-config path.\n *\n * This is the single source of truth for generation-time label ownership:\n * app-label labellize, app-label translate, and email-label generation all\n * derive their primary locale from\n * `appPreferences.languages.defaultLanguage`.\n *\n * Runtime consumers may still serve ORG / user-selected locales from the\n * enabled-languages set, but when a pipeline needs \"the locale this SaaS owns\n * natively\", this helper is the contract.\n */\nexport function getConfiguredPrimaryLanguage(\n  config: AppPrimaryLanguageConfigShape | null | undefined,\n): AvailableLanguage {\n  const configured = config?.appPreferences?.languages?.defaultLanguage;\n  if (configured !== undefined && !Object.values(AvailableLanguage).includes(configured as AvailableLanguage)) {\n    throw new Error(`Invalid app primary language \"${String(configured)}\". Configure appPreferences.languages.defaultLanguage with a valid AvailableLanguage.`);\n  }\n  const found = Object.values(AvailableLanguage).find((value) => value === configured);\n  return found ?? AvailableLanguage.EN;\n}\n\n/**\n * Resolve the runtime fallback locale from app config.\n *\n * If the configured fallback is absent or invalid, fall back to the configured\n * primary locale so backend runtime consumers never invent a separate default.\n */\nexport function getConfiguredFallbackLanguage(\n  config: AppPrimaryLanguageConfigShape | null | undefined,\n): AvailableLanguage {\n  const configured = config?.appPreferences?.languages?.fallbackLanguage;\n  if (configured !== undefined && !Object.values(AvailableLanguage).includes(configured as AvailableLanguage)) {\n    throw new Error(`Invalid app fallback language \"${String(configured)}\". Configure appPreferences.languages.fallbackLanguage with a valid AvailableLanguage.`);\n  }\n  const found = Object.values(AvailableLanguage).find((value) => value === configured);\n  return found ?? getConfiguredPrimaryLanguage(config);\n}\n\n/**\n * Resolve the full set of locales this application ENABLES — the locales a user or an organization\n * may select, which is a strictly wider question than \"the locale this SaaS authors natively\".\n *\n * This is the named backend source for that set, and it exists because there was none: before it,\n * `appPreferences.languages.enabledLanguages` was read by the frontend (`I18nContext`) and by the\n * dev companion (which keeps its own private copy for the same reason), and by NOTHING in\n * `saas-backend-lib`. Every backend consumer therefore answered locale questions with the PRIMARY\n * locale, because that was the only helper on offer — which is exactly how the email-template\n * startup check came to prove coverage for one locale in an application that enables two.\n *\n * Three deliberate properties:\n *\n * - **The primary is always a member, and always first.** An application that declares\n *   `defaultLanguage: fr` and omits it from `enabledLanguages` has still enabled French — the\n *   primary is enabled by definition, not by enumeration. Putting it first makes the returned array\n *   usable as a report order without a second sort.\n * - **Unknown values are DROPPED rather than thrown on**, unlike the primary/fallback helpers. Those\n *   two resolve a single scalar the runtime must have, so an invalid value there is unusable and\n *   failing fast is the only honest answer. This one resolves a SET whose other members are still\n *   perfectly usable; refusing the whole set over one bad member would turn a typo in a secondary\n *   language into a boot failure. The Zod config schema already rejects an out-of-vocabulary value\n *   at parse time, so this filter is a defence for hand-built and partially-typed config objects.\n * - **Duplicates collapse**, so a config that lists the primary explicitly reads identically to one\n *   that does not.\n */\nexport function getConfiguredEnabledLanguages(\n  config: AppPrimaryLanguageConfigShape | null | undefined,\n): AvailableLanguage[] {\n  const primary = getConfiguredPrimaryLanguage(config);\n  const declared = config?.appPreferences?.languages?.enabledLanguages;\n  const knownLanguages = new Set<string>(Object.values(AvailableLanguage));\n  const enabled = Array.isArray(declared)\n    ? declared.filter((language): language is AvailableLanguage => knownLanguages.has(language as string))\n    : [];\n  return [...new Set<AvailableLanguage>([primary, ...enabled])];\n}\n\nfunction buildPublicSocialOAuth2Providers(\n  auth: AppConfiguration['auth'] | null | undefined,\n): Record<string, { displayName?: string }> {\n  return Object.fromEntries(\n    Object.entries(auth?.socialOAuth2Providers ?? {})\n      .filter(([, providerConfig]) => isEnabledSocialOAuth2LoginProvider(providerConfig))\n      .map(([providerRef, providerConfig]) => [\n        providerRef,\n        {\n          displayName: providerConfig?.displayName,\n        },\n      ]),\n  );\n}\n\n\nexport class ApplicationUtils {\n  /**\n   * Transforms backend application configuration to a frontend-safe shared payload.\n   * Filters out private/backend-only runtime endpoints and preserves only app-owned\n   * frontend service entries keyed by frontend service identity.\n   */\n  static toAppConfiguration_Shared(\n    config: AppConfiguration,\n    /**\n     * The application's own id, which the AUTHORED configuration does not carry — it is runtime\n     * identity, resolved at startup, not something an application declares about itself. Passed in\n     * rather than read here so this projection stays a pure function of its input.\n     *\n     * Optional so every existing caller and fixture keeps working; an absent id simply leaves the\n     * field off, which is the pre-existing behaviour.\n     */\n    applicationId?: string,\n  ): AppConfiguration_Shared {\n    const {\n      appIdentity,\n      brandAssets,\n      appPreferences,\n      runtime,\n      auth,\n      userTypes,\n      frontendServices,\n      organizationTypes,\n      compliance,\n      billing,\n      analytics,\n      lifecycle,\n    } = config;\n\n    const runtime_endPoints = runtime.endPoints;\n\n    // Keep only shared endpoints by excluding platform-private keys.\n    // Config-defined frontend service endpoints pass through automatically.\n    const platformTypes = new Set<string>(Object.values(PlatformApplicationType));\n    const runtime_endPoints_frontend = Object.keys(runtime_endPoints).reduce((acc, key) => {\n      if (!platformTypes.has(key)) {\n        acc[key] = runtime_endPoints[key];\n      }\n      return acc;\n    }, {} as typeof runtime_endPoints);\n\n    // For frontend, expose only publicUrl; explicitly drop internalUrl\n    const runtime_endPoints_frontend_publicOnly = Object.fromEntries(\n      Object.entries(runtime_endPoints_frontend).map(([appKey, urls]) => [\n        appKey,\n        { publicUrl: urls?.publicUrl },\n      ])\n    ) as typeof runtime_endPoints_frontend;\n\n    const apiJwtPublicKey = config.jwt.publicKey[JwtPrivateKeys.APPLICATION_AUTH_TOKEN];\n\n    // Strip backend-only auth fields before sending to frontend.\n    // Same pattern as runtime (stripping appCustomRoot, internalUrl, platform-only endpoints).\n    const {\n      socialOAuth2Providers: _privateSocialOAuth2Providers,\n      passwordHashing,\n      passkeyOperational, otpOperational, magicLinkOperational, totpOperational,\n      // A consent lifetime is an operator policy the browser has no use for (#465).\n      consentGrantLifetimeDays,\n      ...sharedAuth\n    } = auth;\n    void consentGrantLifetimeDays;\n\n    // W6.9: Strip backend-only fields from per-user-type auth policies before frontend projection\n    const strippedUserTypes = Object.fromEntries(\n      Object.entries(userTypes ?? {}).map(([typeName, typeDef]) => {\n        if (!typeDef?.auth) return [typeName, typeDef];\n        const { lockoutPolicy: _lp, maxConcurrentSessions: _mcs, ...frontendAuth } = typeDef.auth as any;\n        return [typeName, { ...typeDef, auth: frontendAuth }];\n      }),\n    );\n\n    return {\n      // The id is MERGED here rather than declared upstream: `appIdentity` is authored by the\n      // application, and this is runtime identity the client needs to name its own scope room.\n      appIdentity: applicationId ? { ...appIdentity, applicationId } : appIdentity,\n      brandAssets,\n      appPreferences,\n      runtime: {\n        endPoints: runtime_endPoints_frontend_publicOnly\n      },\n      auth: {\n        ...sharedAuth,\n        socialOAuth2Providers: buildPublicSocialOAuth2Providers(auth),\n      },\n      userTypes: strippedUserTypes,\n      frontendServices,\n      organizationTypes,\n      compliance,\n      billing,\n      analytics,\n      lifecycle,\n      apiJwtPublicKey,\n    };\n  }\n\n}\n"]}

package/dist/esm/config/services/application-startup-config-validator.backend.service.d.ts

@@ -353,6 +353,43 @@ export declare class ApplicationStartupConfigValidatorService {
     private warnOnDuplicateClaimedDomains;
     private warnOnBroadAutoLinkSocialOAuth2;
     private collectStorageIssues;
+    /**
+     * Refuse to boot an application whose file fields DECLARE a required scan with nothing to scan them.
+     *
+     * Keyed on the per-field `scanPolicy: 'required'` declaration only, and that is complete rather than a
+     * gap — the reasoning is worth recording because the obvious second branch is dead code.
+     *
+     * `FileScanningBackendService.isGlobalScanningEnabled()` (the application-wide default for a field that
+     * declares no policy) is DERIVED from the scanner topology: it is
+     * `clamavScanner.isConfigured() || yaraScanner.isEnabled()`. So "scanning is globally on and no scanner
+     * is reachable" is not a state this configuration can be in, and a branch reporting it would be
+     * `false && …` at every boot of every application — a check that can never fire, which reports a clean
+     * configuration and a broken checker identically. It was considered on 2026-09-09, when the dead global
+     * switch was repaired, and deliberately not added; it becomes necessary the day that switch is turned
+     * back into a separately-declared boolean, which is one of the three reasons it was not.
+     *
+     * The remaining route into "a scan was requested with no scanner" is therefore exactly the per-field
+     * declaration this collector already walks — plus any field this walk MISSES, which the `catch
+     * { continue; }` below makes possible and which is why `executeScan` also refuses at runtime rather
+     * than trusting that boot has already answered.
+     *
+     * ClamAV specifically, not "any scanner": YARA is a pattern layer documented as running on top of
+     * signature AV, not a replacement for it, so a `required` field is not satisfied by YARA alone. That is
+     * a posture, not an oversight — relaxing it would let an application satisfy `scanPolicy: 'required'`
+     * with no signature scanning at all.
+     */
+    /**
+     * A vendor file storage whose PICKER an application lists in a frontend scope while the storage
+     * itself is not configured (#394 P5): every field that accepts that storage offers a picker whose
+     * every link is refused with CONFIGURATION. The chooser reads a static artifact and cannot know;
+     * this is the one place the two scopes are seen together with the registry ready, so it is said
+     * here, as a WARNING — the application still starts, the field still takes local uploads.
+     *
+     * Runs inside `collectStorageIssues` on purpose: `router.initialize()` visits only CONFIGURED
+     * providers, and only when a framework storage exists, so a diagnostic placed on the provider's
+     * own `initialize()` never executes (review of #394 P5, finding F-1).
+     */
+    private collectVendorStorageListedWithoutConnectionIssues;
     private collectScanningIssues;
     private collectYaraIssues;
     /**

package/dist/esm/config/services/application-startup-config-validator.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-startup-config-validator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/config/services/application-startup-config-validator.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,EAiBL,KAAK,6BAA6B,EAWnC,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,KAAK,EACV,gBAAgB,EACjB,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,2BAA2B,EAAE,MAAM,kEAAkE,CAAC;AAC/G,OAAO,EAAE,yBAAyB,EAAE,MAAM,gEAAgE,CAAC;AAK3G,OAAO,KAAK,EACV,mCAAmC,EACpC,MAAM,yFAAyF,CAAC;AAIjG,OAAO,KAAK,EACV,2DAA2D,EAC5D,MAAM,qHAAqH,CAAC;AAC7H,OAAO,KAAK,EACV,2CAA2C,EAE5C,MAAM,yFAAyF,CAAC;AAejG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAClI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAC5F,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,8EAA8E,CAAC;AAC1I,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAqBpH;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7E,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAEtC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAGnC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAO/C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAGzC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IAG3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAClC;;;;OAIG;IAGH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA9ClC,OAAO,CAAC,QAAQ,CAA+D;gBAGzB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAExF,yBAAyB,EAAE,uCAAuC,EAElE,mBAAmB,EAAE,0BAA0B,EAE/C,iBAAiB,EAAE,+BAA+B,EAElD,kBAAkB,EAAE,gCAAgC,EAEpD,iBAAiB,EAAE,+BAA+B,EAElD,aAAa,EAAE,2BAA2B,EAE1C,WAAW,EAAE,yBAAyB,EAEtC,qBAAqB,EAAE,mCAAmC,EAE1D,kBAAkB,EAAE,2DAA2D,EAG/E,6BAA6B,CAAC,EAC7C,2CAA2C,EAM5B,uBAAuB,CAAC,EAAE,qCAAqC,EAG/D,yBAAyB,CAAC,EAAE,gCAAgC,EAG5D,gBAAgB,CAAC,EAAE,uBAAuB;IAC3D;;;;OAIG;IAGc,cAAc,CAAC,EAAE,cAAc;IAS3C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAW/C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,yCAAyC;IAkBjD;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAO;IAElE;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,+BAA+B;IAkCvC;;;;;;;OAOG;IACH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gCAAgC;IAUxC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,yCAAyC;IASjD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,yCAAyC;IAMjD;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,+BAA+B;IASvC,OAAO,CAAC,aAAa;IAUrB;sGACkG;IAC3F,mCAAmC,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,6BAA6B;IAUpG;;;;;;;;;;;;OAYG;IACI,2CAA2C,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,6BAA6B;IAO5G;;;;;;OAMG;IACI,uCAAuC,IAAI,6BAA6B;IAK/E;;;;;;;;;OASG;IACU,8CAA8C,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACU,qCAAqC,IAAI,OAAO,CAAC,IAAI,CAAC;YAKrD,+BAA+B;IA8G7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACH,OAAO,CAAC,gCAAgC;IAgCxC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,4BAA4B;IA+B1C,+FAA+F;YACjF,6BAA6B;IA6B3C;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA8B9B,OAAO,CAAC,+BAA+B;IA+BvC,OAAO,CAAC,+BAA+B;IAgIvC,OAAO,CAAC,sCAAsC;IAsB9C,OAAO,CAAC,8BAA8B;IAYtC,OAAO,CAAC,6BAA6B;IA0BrC,OAAO,CAAC,+BAA+B;IA0BvC,OAAO,CAAC,oBAAoB;IAiE5B,OAAO,CAAC,qBAAqB;IAqC7B,OAAO,CAAC,iBAAiB;IAkBzB;;;;;;OAMG;IACH,OAAO,CAAC,mDAAmD;IA0C3D;;;;;;;;;OASG;IACH,OAAO,CAAC,uDAAuD;IAyH/D;;;;;;;OAOG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,uCAAuC;IAiB/C,OAAO,CAAC,qCAAqC;IAyB7C;;;;;;;;;OASG;IACH,OAAO,CAAC,8CAA8C;IA0BtD;;;;;;;;OAQG;IACH,OAAO,CAAC,6CAA6C;IAyDrD;;;;;;;;;OASG;IACH,OAAO,CAAC,iDAAiD;IAwCzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACH,OAAO,CAAC,mCAAmC;IAqF3C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,2CAA2C;IAyDnD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,gDAAgD;IAyDxD;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sDAAsD;IAoC9D,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAchC;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;CA2FjC"}
+{"version":3,"file":"application-startup-config-validator.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/config/services/application-startup-config-validator.backend.service.ts"],"names":[],"mappings":"AACA,OAAO,EAiBL,KAAK,6BAA6B,EAWnC,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,KAAK,EACV,gBAAgB,EACjB,MAAM,6DAA6D,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,wEAAwE,CAAC;AAC1H,OAAO,EAAE,+BAA+B,EAAE,MAAM,sEAAsE,CAAC;AACvH,OAAO,EAAE,2BAA2B,EAAE,MAAM,kEAAkE,CAAC;AAC/G,OAAO,EAAE,yBAAyB,EAAE,MAAM,gEAAgE,CAAC;AAK3G,OAAO,KAAK,EACV,mCAAmC,EACpC,MAAM,yFAAyF,CAAC;AAIjG,OAAO,KAAK,EACV,2DAA2D,EAC5D,MAAM,qHAAqH,CAAC;AAC7H,OAAO,KAAK,EACV,2CAA2C,EAE5C,MAAM,yFAAyF,CAAC;AAejG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAClI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAC5F,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,8EAA8E,CAAC;AAC1I,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAqBpH;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7E,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAE1C,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAEtC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAGnC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAO/C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAGzC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IAG3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAClC;;;;OAIG;IAGH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA9ClC,OAAO,CAAC,QAAQ,CAA+D;gBAGzB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAExF,yBAAyB,EAAE,uCAAuC,EAElE,mBAAmB,EAAE,0BAA0B,EAE/C,iBAAiB,EAAE,+BAA+B,EAElD,kBAAkB,EAAE,gCAAgC,EAEpD,iBAAiB,EAAE,+BAA+B,EAElD,aAAa,EAAE,2BAA2B,EAE1C,WAAW,EAAE,yBAAyB,EAEtC,qBAAqB,EAAE,mCAAmC,EAE1D,kBAAkB,EAAE,2DAA2D,EAG/E,6BAA6B,CAAC,EAC7C,2CAA2C,EAM5B,uBAAuB,CAAC,EAAE,qCAAqC,EAG/D,yBAAyB,CAAC,EAAE,gCAAgC,EAG5D,gBAAgB,CAAC,EAAE,uBAAuB;IAC3D;;;;OAIG;IAGc,cAAc,CAAC,EAAE,cAAc;IAS3C,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAW/C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,yCAAyC;IAkBjD;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAO;IAElE;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,+BAA+B;IAkCvC;;;;;;;OAOG;IACH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gCAAgC;IAUxC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,yCAAyC;IASjD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,yCAAyC;IAMjD;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,+BAA+B;IASvC,OAAO,CAAC,aAAa;IAUrB;sGACkG;IAC3F,mCAAmC,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,6BAA6B;IAUpG;;;;;;;;;;;;OAYG;IACI,2CAA2C,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,6BAA6B;IAO5G;;;;;;OAMG;IACI,uCAAuC,IAAI,6BAA6B;IAK/E;;;;;;;;;OASG;IACU,8CAA8C,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACU,qCAAqC,IAAI,OAAO,CAAC,IAAI,CAAC;YAKrD,+BAA+B;IA8G7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACH,OAAO,CAAC,gCAAgC;IAgCxC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,4BAA4B;IA+B1C,+FAA+F;YACjF,6BAA6B;IA6B3C;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA8B9B,OAAO,CAAC,+BAA+B;IA+BvC,OAAO,CAAC,+BAA+B;IAgIvC,OAAO,CAAC,sCAAsC;IAsB9C,OAAO,CAAC,8BAA8B;IAYtC,OAAO,CAAC,6BAA6B;IA0BrC,OAAO,CAAC,+BAA+B;IA0BvC,OAAO,CAAC,oBAAoB;IAkE5B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iDAAiD;IAmBzD,OAAO,CAAC,qBAAqB;IAqC7B,OAAO,CAAC,iBAAiB;IAkBzB;;;;;;OAMG;IACH,OAAO,CAAC,mDAAmD;IA0C3D;;;;;;;;;OASG;IACH,OAAO,CAAC,uDAAuD;IAwI/D;;;;;;;OAOG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,uCAAuC;IAiB/C,OAAO,CAAC,qCAAqC;IAyB7C;;;;;;;;;OASG;IACH,OAAO,CAAC,8CAA8C;IA0BtD;;;;;;;;OAQG;IACH,OAAO,CAAC,6CAA6C;IAyDrD;;;;;;;;;OASG;IACH,OAAO,CAAC,iDAAiD;IAwCzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACH,OAAO,CAAC,mCAAmC;IAqF3C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,2CAA2C;IAyDnD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,gDAAgD;IAyDxD;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sDAAsD;IAoC9D,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAchC;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;CA2FjC"}

package/dist/esm/config/services/application-startup-config-validator.backend.service.js

@@ -912,6 +912,7 @@ let ApplicationStartupConfigValidatorService = class ApplicationStartupConfigVal
             [FileStorageAccepted.LOCAL_DIRECTORY]: 'STORAGE_LOCAL_BASE_DIR',
         };
         const issues = [];
+        issues.push(...this.collectVendorStorageListedWithoutConnectionIssues());
         for (const resourceType of allResourceTypes) {
             let fileFields;
             try {
@@ -945,6 +946,58 @@ let ApplicationStartupConfigValidatorService = class ApplicationStartupConfigVal
         return issues;
     }
     // ─── Scanning (ClamAV) ──────────────────────────────────────────────────
+    /**
+     * Refuse to boot an application whose file fields DECLARE a required scan with nothing to scan them.
+     *
+     * Keyed on the per-field `scanPolicy: 'required'` declaration only, and that is complete rather than a
+     * gap — the reasoning is worth recording because the obvious second branch is dead code.
+     *
+     * `FileScanningBackendService.isGlobalScanningEnabled()` (the application-wide default for a field that
+     * declares no policy) is DERIVED from the scanner topology: it is
+     * `clamavScanner.isConfigured() || yaraScanner.isEnabled()`. So "scanning is globally on and no scanner
+     * is reachable" is not a state this configuration can be in, and a branch reporting it would be
+     * `false && …` at every boot of every application — a check that can never fire, which reports a clean
+     * configuration and a broken checker identically. It was considered on 2026-09-09, when the dead global
+     * switch was repaired, and deliberately not added; it becomes necessary the day that switch is turned
+     * back into a separately-declared boolean, which is one of the three reasons it was not.
+     *
+     * The remaining route into "a scan was requested with no scanner" is therefore exactly the per-field
+     * declaration this collector already walks — plus any field this walk MISSES, which the `catch
+     * { continue; }` below makes possible and which is why `executeScan` also refuses at runtime rather
+     * than trusting that boot has already answered.
+     *
+     * ClamAV specifically, not "any scanner": YARA is a pattern layer documented as running on top of
+     * signature AV, not a replacement for it, so a `required` field is not satisfied by YARA alone. That is
+     * a posture, not an oversight — relaxing it would let an application satisfy `scanPolicy: 'required'`
+     * with no signature scanning at all.
+     */
+    /**
+     * A vendor file storage whose PICKER an application lists in a frontend scope while the storage
+     * itself is not configured (#394 P5): every field that accepts that storage offers a picker whose
+     * every link is refused with CONFIGURATION. The chooser reads a static artifact and cannot know;
+     * this is the one place the two scopes are seen together with the registry ready, so it is said
+     * here, as a WARNING — the application still starts, the field still takes local uploads.
+     *
+     * Runs inside `collectStorageIssues` on purpose: `router.initialize()` visits only CONFIGURED
+     * providers, and only when a framework storage exists, so a diagnostic placed on the provider's
+     * own `initialize()` never executes (review of #394 P5, finding F-1).
+     */
+    collectVendorStorageListedWithoutConnectionIssues() {
+        const frontendServices = this.appConfigService?.config.providers?.scopes?.frontendServices ?? {};
+        const issues = [];
+        for (const provider of this.fileStorageRouter.listProviders()) {
+            if (provider.connectedProviderRef === undefined || provider.isConfigured())
+                continue;
+            const listing = Object.entries(frontendServices)
+                .filter(([, scope]) => scope?.providers?.[provider.connectedProviderRef] !== undefined)
+                .map(([serviceName]) => serviceName);
+            if (listing.length === 0)
+                continue;
+            issues.push(issueWarning(ConfigurationValidationDomain.STORAGE, `frontend scope(s) [${listing.join(', ')}] list the '${provider.connectedProviderRef}' picker but the ${provider.providerId} storage it links into is not configured — `
+                + `add '${provider.connectedProviderRef}' to the backend providers scope with its OAuth2 client registration, or every link from that picker is refused`, { providerRef: provider.connectedProviderRef, storage: provider.providerId, frontendServices: listing }));
+        }
+        return issues;
+    }
     collectScanningIssues() {
         const issues = [];
         const allResourceTypes = this.resourcesRegistry.getResourceTypes();
@@ -1030,7 +1083,22 @@ let ApplicationStartupConfigValidatorService = class ApplicationStartupConfigVal
         const userTypeEntries = Object.entries(config.userTypes ?? {});
         const selfRegistrationUserTypes = userTypeEntries
             .filter(([, definition]) => isRegistrationAcquisitionAllowed(definition.auth.registration.mode, RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE)
-            && definition.auth.registration.allowedMethods.includes(AuthMethod.PASSWORD))
+            /*
+             * Any method whose signup runs through `createSelfRegistrationPersistenceRequest`, not
+             * PASSWORD alone (#463).
+             *
+             * MAGIC_LINK and PASSKEY gained public registration and use the SAME persistence path — they
+             * differ only in holding no credential and minting a link afterwards. Left as `PASSWORD`
+             * alone, an application enabling ONLY password-less signup would not have this boundary
+             * declared, and its first registration would fail at the transaction rather than at
+             * configuration time.
+             *
+             * EXTERNAL_OAUTH2 is deliberately NOT here: social JIT creation has its own boundary
+             * request, collected below.
+             */
+            && definition.auth.registration.allowedMethods.some((method) => method === AuthMethod.PASSWORD
+                || method === AuthMethod.MAGIC_LINK
+                || method === AuthMethod.PASSKEY))
             .map(([userType]) => userType);
         if (selfRegistrationUserTypes.length > 0) {
             const eligibleUserTypes = new Set(selfRegistrationUserTypes);