@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/config/app-configuration-shared.shared.schemas.js

@@ -13,8 +13,12 @@ import { AvailableLanguage } from '@wildo-ai/presets-components-models';
 import { z } from 'zod';
 import { AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas.js';
 import { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas.js';
-import { DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas.js';
+import { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas.js';
+import { ClientInstanceIdScope, DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas.js';
+import { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas.js';
 import { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas.js';
+import { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas.js';
+import { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas.js';
 import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
 import { ValueMomentSchema } from './analytics-value-moments.shared.schemas.js';
 import { UserTypesConfigSchema, FrontendServicesConfigSchema, OrganizationTypesConfigSchema, OrgAuthMethodPolicy, } from './entity-identity-config.shared.schemas.js';
@@ -36,7 +40,14 @@ export const PasswordPolicyRulesSchema = z.object({
     requireLowercase: z.boolean().default(true),
     requireNumbers: z.boolean().default(true),
     requireSpecialChars: z.boolean().default(false),
-    /** R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. */
+    /**
+     * R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),
+     * NOT used in the client-side password pre-check — but it IS a field of this shared schema and
+     * therefore ships wherever the schema is serialized (e.g. `AuthInvitationInfoResponse.passwordPolicy`).
+     * Non-secret. (Corrected from the prior "Backend-only" which wrongly implied it is never serialized.)
+     * NOTE: `PasswordPolicyConfigSchema` (entity-identity-config) must stay field-identical to this schema
+     * — the invitation response `.parse()` silently strips any field present there but absent here.
+     */
     expiryDays: z.number().min(0).default(0),
 });
 /**
@@ -71,12 +82,17 @@ export const AppConfiguration_Shared_AuthSchema = z.object({
         rpId: z.string().min(1),
         maxPasskeysPerUser: z.number().min(1).max(50).default(10),
     }),
-    ssoProviders: z.record(z.string(), z.object({
-        providerRef: z.string(),
-        enabled: z.boolean().default(true),
-        allowedDomains: z.array(z.string()).optional(),
+    /**
+     * Minimal frontend-facing social OAuth2 projection.
+     *
+     * Backend runtime still owns the full backend-private
+     * `auth.socialOAuth2Providers` authoring shape
+     * (enabled flags, scopes, allowed domains, secrets-related semantics). The
+     * shared `/application-config` payload only needs the enabled public provider
+     * refs plus an optional app-authored display-name override.
+     */
+    socialOAuth2Providers: z.record(z.string(), z.object({
         displayName: z.string().optional(),
-        additionalScopes: z.array(z.string()).optional(),
     })).default({}),
     /** E-10, D-15: How much orgs can override user-type auth methods. */
     orgAuthMethodPolicy: z.enum(OrgAuthMethodPolicy).default(OrgAuthMethodPolicy.RESTRICT_ONLY),
@@ -91,6 +107,20 @@ export const AppConfiguration_Shared_AuthSchema = z.object({
 export const AppConfiguration_Shared_ComplianceSchema = z.object({
     userProfileVisibility: z.enum(UserProfileVisibility).default(UserProfileVisibility.ORGANIZATION),
     organizationProfileVisibility: z.enum(OrganizationProfileVisibility).default(OrganizationProfileVisibility.PRIVATE),
+    /**
+     * Client-install identification policy (`clientInstanceId`) — **OFF unless authored**.
+     *
+     * Lives on `compliance` because it is a privacy decision, not an observability knob, and lives on
+     * the SHARED config because both halves of the mechanism must obey ONE authored value: the
+     * frontend decides whether to mint/store/send the id, and the backend independently decides
+     * whether to ingest and record it. Two gates, one source — an application that never opts in is
+     * protected even if some client sends the header anyway.
+     *
+     * Defaults to {@link ClientInstanceIdScope.DISABLED} so the privacy-preserving posture is the one
+     * you get by doing nothing. See the enum's JSDoc for the ePrivacy/GDPR/NIST reasoning and the
+     * obligations attached to each non-`DISABLED` member.
+     */
+    clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),
 });
 export const AppConfiguration_Shared_AppIdentity_Schema = z.object({
     /** Technical app name — used as fallback when displayName is absent */
@@ -99,8 +129,6 @@ export const AppConfiguration_Shared_AppIdentity_Schema = z.object({
     displayName: z.string().optional(),
     /** Short description of the application */
     description: z.string().optional(),
-    /** URL to the application logo (used in emails, login pages, etc.) */
-    logoUrl: z.string().url().optional(),
     version: z.string().min(1, { error: 'Version is required' }),
 });
 export const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({
@@ -196,6 +224,25 @@ export const AnalyticsConfigSchema = z.object({
 // =====================================================
 export const AppConfiguration_Shared_Schema = z.object({
     appIdentity: AppConfiguration_Shared_AppIdentity_Schema,
+    /**
+     * The generated brand assets — the runtime projection of the brand identity
+     * an app's build-time logo step produces. THE single source of truth every
+     * logo/favicon/brand-image consumer resolves against via `resolveBrandAsset`
+     * (by composition × theme × purpose). Empty/absent until a brand is
+     * generated; consumers fall back to a placeholder.
+     *
+     * MOVED OFF `appIdentity` (2026-07): brand assets are app-authored,
+     * BUILD-TIME content (a CLI generates them from a spec SSOT and writes a
+     * `backend-api/src/brand-assets.generated.ts` the backend config composes),
+     * NOT platform-declaration identity. `appIdentity` is
+     * platform-declaration-materialized and boundary-blocked for backend
+     * authoring (`AppConfiguration_BackendAuthored` Omits `appIdentity`, and the
+     * `applyBackendConfig` inspector rejects it), so a backend-authorable slot is
+     * required. This top-level `brandAssets` is that slot — it is present on both
+     * the frontend shared payload (here) and the backend-authored managed config
+     * (`_AppConfiguration_AppManagedConfiguration_Schema`).
+     */
+    brandAssets: z.array(RuntimeBrandAssetSchema).optional(),
     appPreferences: z.object({
         languages: AppConfiguration_Shared_AppPreferencesLanguage_Schema,
     }),
@@ -215,5 +262,22 @@ export const AppConfiguration_Shared_Schema = z.object({
     analytics: AnalyticsConfigSchema.optional(),
     // Lifecycle Configuration (optional: lifecycle disabled by default)
     lifecycle: LifecycleConfigSchema.optional(),
+    // Tenant-Teardown Configuration (optional: every field defaults, so omitting the block yields a
+    // working 30-day retention window purged nightly). Holds the operator-tunable retention window,
+    // purge cron and per-run batch size consumed by the engine-owned `organization-purge` batch.
+    // See TenantTeardownConfigSchema for why this is NOT folded into `lifecycle` (which is the USER
+    // lifecycle and is disabled by default).
+    tenantTeardown: TenantTeardownConfigSchema.optional(),
+    // Data-Seeding Configuration (optional: when omitted, the engine-owned
+    // `data-seeding:scheduled-rerun` batch uses the manifest's built-in
+    // minute-tick default cron — see DataSeedingConfigSchema for the full
+    // rationale on why operators rarely need to override this).
+    dataSeeding: DataSeedingConfigSchema.optional(),
+    // Audit-Trail Configuration (optional: when omitted, NO archival runs and
+    // audit records are retained in the primary AUDIT_LOGS store indefinitely).
+    // Holds the operator-tunable archival horizon (`archiveAfterDays`) consumed
+    // by the engine-owned `compliance:audit-logs-archive` batch. Records are
+    // never deleted (AUDIT_LOGS is immutable, G5) — see AuditTrailConfigSchema.
+    auditTrail: AuditTrailConfigSchema.optional(),
 });
-//# sourceMappingURL=app-configuration-shared.shared.schemas.js.map
+//# sourceMappingURL=app-configuration-shared.shared.schemas.js.map

package/dist/esm/config/app-configuration-shared.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-configuration-shared.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAC3I,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,8EAA8E;IAC9E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,mBAAmB;CACzB,CAAC;AAMX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzD,6EAA6E;IAE7E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF,YAAY,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACjD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjB,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC;IAE3F,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE5D,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE5C,sDAAsD;IACtD,kFAAkF;IAClF,8EAA8E;CAE/E,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC;IAChG,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;CAEpH,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACrE,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAC7D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACzG,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAsC,aAA2B,EAAE,EAAE;IAC/H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC,+BAA+B,CAAC,CAAC;AAInI,wDAAwD;AACxD,0BAA0B;AAC1B,wDAAwD;AAExD,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,wDAA+B,CAAA;AACjC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,6GAA6G;IAC7G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kEAAkE;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEnC,qCAAqC;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,2EAA2E;IAC3E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAEvF;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,+DAA+D;QAC/D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,yCAAyC;IACzC,mBAAmB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC,CAAC;AAGH,wDAAwD;AACxD,gCAAgC;AAChC,wDAAwD;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAErD,WAAW,EAAE,0CAA0C;IAEvD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,qDAAqD;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAE/E,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,mDAAmD;IACnD,SAAS,EAAE,qBAAqB;IAChC,0HAA0H;IAC1H,gBAAgB,EAAE,4BAA4B;IAC9C,qEAAqE;IACrE,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,wCAAwC;IAEpD,gEAAgE;IAChE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAE9C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAE5C,CAAC,CAAC"}
+{"version":3,"file":"app-configuration-shared.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAClK,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,mBAAmB;CACzB,CAAC;AAMX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzD,6EAA6E;IAE7E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF;;;;;;;;OAQG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjB,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC;IAE3F,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE5D,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE5C,sDAAsD;IACtD,kFAAkF;IAClF,8EAA8E;CAE/E,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC;IAChG,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAEnH;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC;CAE7F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACrE,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAC7D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACzG,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAsC,aAA2B,EAAE,EAAE;IAC/H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC,+BAA+B,CAAC,CAAC;AAInI,wDAAwD;AACxD,0BAA0B;AAC1B,wDAAwD;AAExD,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,wDAA+B,CAAA;AACjC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,6GAA6G;IAC7G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kEAAkE;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEnC,qCAAqC;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,2EAA2E;IAC3E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAEvF;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,+DAA+D;QAC/D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,yCAAyC;IACzC,mBAAmB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC,CAAC;AAGH,wDAAwD;AACxD,gCAAgC;AAChC,wDAAwD;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAErD,WAAW,EAAE,0CAA0C;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAExD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,qDAAqD;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAE/E,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,mDAAmD;IACnD,SAAS,EAAE,qBAAqB;IAChC,0HAA0H;IAC1H,gBAAgB,EAAE,4BAA4B;IAC9C,qEAAqE;IACrE,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,wCAAwC;IAEpD,gEAAgE;IAChE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAE9C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,yCAAyC;IACzC,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAErD,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,4DAA4D;IAC5D,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAE/C,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAE9C,CAAC,CAAC","sourcesContent":["/**\n * Frontend Application Configuration Schemas\n *\n * Pure frontend configuration schemas that define what configuration\n * the frontend applications expect to receive from backend endpoints.\n *\n * NOTE: OAuth2 providers are NOT configured here. OAuth2 is a protocol\n * defined at the provider level in external-connectors, just like REST_API\n * and HOOKS protocols. This configuration only enables/disables which\n * external providers are available for SSO authentication.\n */\n\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models';\nimport { z } from 'zod';\nimport { AllSharedApplicationTypes, AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas';\nimport { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas';\nimport { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas';\nimport { ClientInstanceIdScope, DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas';\nimport { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas';\nimport { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas';\nimport { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas';\nimport { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { ValueMomentSchema } from './analytics-value-moments.shared.schemas';\nimport {\n  UserTypesConfigSchema,\n  FrontendServicesConfigSchema,\n  OrganizationTypesConfigSchema,\n  OrgAuthMethodPolicy,\n} from './entity-identity-config.shared.schemas';\n\n\n\n/**\n * Shared Password Policy Rules Schema\n *\n * Contains ONLY the validation rules that both frontend and backend need.\n * The backend extends these rules with hashing config (argon2 params)\n * via AppConfiguration_AuthSchema in app-config.backend.schemas.ts.\n *\n * Frontend uses these rules for:\n * - Real-time password strength validation as user types\n * - Password policy indicator in reset/registration forms\n */\n\n\nexport const PasswordPolicyRulesSchema = z.object({\n  minLength: z.number().min(6).max(128).default(8),\n  maxLength: z.number().min(8).max(256).default(128),\n  requireUppercase: z.boolean().default(true),\n  requireLowercase: z.boolean().default(true),\n  requireNumbers: z.boolean().default(true),\n  requireSpecialChars: z.boolean().default(false),\n  /**\n   * R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),\n   * NOT used in the client-side password pre-check — but it IS a field of this shared schema and\n   * therefore ships wherever the schema is serialized (e.g. `AuthInvitationInfoResponse.passwordPolicy`).\n   * Non-secret. (Corrected from the prior \"Backend-only\" which wrongly implied it is never serialized.)\n   * NOTE: `PasswordPolicyConfigSchema` (entity-identity-config) must stay field-identical to this schema\n   * — the invitation response `.parse()` silently strips any field present there but absent here.\n   */\n  expiryDays: z.number().min(0).default(0),\n});\n\nexport type PasswordPolicyRules = z.infer<typeof PasswordPolicyRulesSchema>;\n\n/**\n * I18n label keys for password policy violations.\n * Values match PasswordPolicyLabel in presets-components-models for frontend resolution.\n * Labels support placeholders: policyMinLength → {minLength}, policyMaxLength → {maxLength}.\n */\nexport const PasswordPolicyViolationCode = {\n  MIN_LENGTH: 'policyMinLength',\n  MAX_LENGTH: 'policyMaxLength',\n  UPPERCASE: 'policyUppercase',\n  LOWERCASE: 'policyLowercase',\n  NUMBER: 'policyNumber',\n  SPECIAL_CHAR: 'policySpecialChar',\n} as const;\n\nexport type PasswordPolicyViolationCode = (typeof PasswordPolicyViolationCode)[keyof typeof PasswordPolicyViolationCode];\n\n\n\n/**\n * Global Auth Config — infrastructure + app-level only.\n *\n * Auth POLICY (authMethodsEnabled, mfaPolicy, registration, passwordPolicy,\n * sessionDurationMinutes, lockoutPolicy, autoLinkByEmail, stepUpAuth,\n * methodManagement) is now per-user-type on UserTypeAuthPolicySchema\n * in entity-identity-config.shared.schemas.ts.\n *\n * This section retains only infrastructure and app-level settings that apply\n * equally regardless of user type.\n *\n */\nexport const AppConfiguration_Shared_AuthSchema = z.object({\n\n  // ─── INFRASTRUCTURE (stays on global auth) ────────────────────────────────\n\n  passkeyConfig: z.object({\n    rpName: z.string().min(1),\n    rpId: z.string().min(1),\n    maxPasskeysPerUser: z.number().min(1).max(50).default(10),\n  }),\n\n  /**\n   * Minimal frontend-facing social OAuth2 projection.\n   *\n   * Backend runtime still owns the full backend-private\n   * `auth.socialOAuth2Providers` authoring shape\n   * (enabled flags, scopes, allowed domains, secrets-related semantics). The\n   * shared `/application-config` payload only needs the enabled public provider\n   * refs plus an optional app-authored display-name override.\n   */\n  socialOAuth2Providers: z.record(\n    z.string(),\n    z.object({\n      displayName: z.string().optional(),\n    })).default({}),\n\n  /** E-10, D-15: How much orgs can override user-type auth methods. */\n  orgAuthMethodPolicy: z.enum(OrgAuthMethodPolicy).default(OrgAuthMethodPolicy.RESTRICT_ONLY),\n\n  /** E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. */\n  expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),\n\n  /** E-4, D-2: Can a user authenticated via Org A SSO access Org B? */\n  crossOrgSSOAccess: z.boolean().default(true),\n\n  // W6.8: All per-user-type auth policy fields REMOVED.\n  // Use userTypes[t].auth.* instead (see entity-identity-config.shared.schemas.ts).\n  // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).\n\n});\n\n\n\n\nexport const AppConfiguration_Shared_ComplianceSchema = z.object({\n  userProfileVisibility: z.enum(UserProfileVisibility).default(UserProfileVisibility.ORGANIZATION),\n  organizationProfileVisibility: z.enum(OrganizationProfileVisibility).default(OrganizationProfileVisibility.PRIVATE),\n\n  /**\n   * Client-install identification policy (`clientInstanceId`) — **OFF unless authored**.\n   *\n   * Lives on `compliance` because it is a privacy decision, not an observability knob, and lives on\n   * the SHARED config because both halves of the mechanism must obey ONE authored value: the\n   * frontend decides whether to mint/store/send the id, and the backend independently decides\n   * whether to ingest and record it. Two gates, one source — an application that never opts in is\n   * protected even if some client sends the header anyway.\n   *\n   * Defaults to {@link ClientInstanceIdScope.DISABLED} so the privacy-preserving posture is the one\n   * you get by doing nothing. See the enum's JSDoc for the ePrivacy/GDPR/NIST reasoning and the\n   * obligations attached to each non-`DISABLED` member.\n   */\n  clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),\n\n});\n\n\n\nexport const AppConfiguration_Shared_AppIdentity_Schema = z.object({\n  /** Technical app name — used as fallback when displayName is absent */\n  appName: z.string().min(1, { error: 'Application name is required' }),\n  /** Human-readable display name shown in UI and emails */\n  displayName: z.string().optional(),\n  /** Short description of the application */\n  description: z.string().optional(),\n  version: z.string().min(1, { error: 'Version is required' }),\n});\n\n\nexport const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({\n  defaultLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n  enabledLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]),\n  fallbackLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n  autoDetectFromBrowser: z.boolean().default(true),\n  allowUserOverride: z.boolean().default(true),\n  allowOrganizationOverride: z.boolean().default(true),\n  enableLanguageSwitcher: z.boolean().default(true)\n});\n\n\nexport const appConfiguration_Shared_RuntimeSchemaBuilder = <T extends AllSharedApplicationTypes>(appTypeSchema: z.ZodType<T>) => {\n  return z.object({\n    endPoints: z.record(z.string(), z.object({\n      publicUrl: z.string().optional(),\n      internalUrl: z.string().optional(),\n    })),\n  })\n}\n\nexport const AppConfiguration_Shared_RuntimeSchema = appConfiguration_Shared_RuntimeSchemaBuilder(AllSharedApplicationTypesSchema);\n\n\n\n// =====================================================\n// Analytics Configuration\n// =====================================================\n\nexport enum AnalyticsProviderType {\n  CONSOLE = 'console',\n  BACKEND_PROXY = 'backend_proxy',\n}\n\n/** Uses providerType (not \"type\") to avoid Mongoose reserved keyword conflict during Zod→Mongoose conversion. */\nexport const AnalyticsProviderConfigSchema = z.object({\n  providerType: z.enum(AnalyticsProviderType),\n  config: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport const AutoInstrumentationConfigSchema = z.object({\n  /** Track page views (NAVIGATION_PANE_CHANGED events) */\n  pageViews: z.boolean().default(true),\n  /** Track resource operations (NOTIFY_RESOURCE_SUCCESS events) */\n  resourceOperations: z.boolean().default(true),\n  /** Track errors (ERROR_OCCURED events). Named 'trackErrors' to avoid Mongoose reserved 'errors' pathname. */\n  trackErrors: z.boolean().default(true),\n  /** Track feature gate hits (shown/blocked) — debounced per feature per session */\n  featureGate: z.boolean().default(true),\n  /** Track user lifecycle events (login, logout, status changes) */\n  userLifecycle: z.boolean().default(true),\n  /** Track notification events (NOTIFY_CUSTOM_* events) */\n  notifications: z.boolean().default(false),\n  /** Track hotkey usage */\n  hotkeys: z.boolean().default(false),\n});\n\nexport const AnalyticsConfigSchema = z.object({\n  /** Master switch — false = no analytics at all, regardless of user consent */\n  enabled: z.boolean().default(false),\n\n  /** Registered analytics providers */\n  providers: z.array(AnalyticsProviderConfigSchema).default([]),\n\n  /** Minimum consent level required for analytics (defaults to ANALYTICS) */\n  requiredConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.ANALYTICS),\n\n  /**\n   * SINGLE DECLARATION SURFACE for all value moments.\n   * TTFV, aha moments, activation stages, and anti-patterns are all here,\n   * distinguished by their `role` field.\n   */\n  valueMoments: z.array(ValueMomentSchema).optional(),\n\n  /** Persistence and evaluation configuration */\n  persistence: z.object({\n    /** Persist achieved moments to localStorage (default: true) */\n    localStorage: z.boolean().default(true),\n    /** Sync achieved moments to backend (default: true) */\n    backendSync: z.boolean().default(true),\n    /**\n     * Backend evaluates RESOURCE_STATE signals + cronjob-originated events.\n     * When true, RESOURCE_STATE signals are evaluated by the backend engine (authoritative).\n     * When false, frontend does optimistic cached count queries.\n     */\n    backendEvaluation: z.boolean().default(true),\n  }).default({\n    localStorage: true,\n    backendSync: true,\n    backendEvaluation: true,\n  }),\n\n  /** Auto-instrumentation configuration */\n  autoInstrumentation: AutoInstrumentationConfigSchema.default({\n    pageViews: true,\n    resourceOperations: true,\n    trackErrors: true,\n    featureGate: true,\n    userLifecycle: true,\n    notifications: false,\n    hotkeys: false,\n  }),\n});\n\n\n// =====================================================\n// Main Shared App Configuration\n// =====================================================\n\nexport const AppConfiguration_Shared_Schema = z.object({\n\n  appIdentity: AppConfiguration_Shared_AppIdentity_Schema,\n\n  /**\n   * The generated brand assets — the runtime projection of the brand identity\n   * an app's build-time logo step produces. THE single source of truth every\n   * logo/favicon/brand-image consumer resolves against via `resolveBrandAsset`\n   * (by composition × theme × purpose). Empty/absent until a brand is\n   * generated; consumers fall back to a placeholder.\n   *\n   * MOVED OFF `appIdentity` (2026-07): brand assets are app-authored,\n   * BUILD-TIME content (a CLI generates them from a spec SSOT and writes a\n   * `backend-api/src/brand-assets.generated.ts` the backend config composes),\n   * NOT platform-declaration identity. `appIdentity` is\n   * platform-declaration-materialized and boundary-blocked for backend\n   * authoring (`AppConfiguration_BackendAuthored` Omits `appIdentity`, and the\n   * `applyBackendConfig` inspector rejects it), so a backend-authorable slot is\n   * required. This top-level `brandAssets` is that slot — it is present on both\n   * the frontend shared payload (here) and the backend-authored managed config\n   * (`_AppConfiguration_AppManagedConfiguration_Schema`).\n   */\n  brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n\n  appPreferences: z.object({\n    languages: AppConfiguration_Shared_AppPreferencesLanguage_Schema,\n  }),\n  apiJwtPublicKey: z.string().min(1, { error: 'API JWT public key is required' }),\n\n  runtime: AppConfiguration_Shared_RuntimeSchema,\n  auth: AppConfiguration_Shared_AuthSchema,\n  /** User types — required. No implicit defaults. */\n  userTypes: UserTypesConfigSchema,\n  /** Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. */\n  frontendServices: FrontendServicesConfigSchema,\n  /** Org typing. Optional — only for apps with typed organizations. */\n  organizationTypes: OrganizationTypesConfigSchema.optional(),\n  compliance: AppConfiguration_Shared_ComplianceSchema,\n\n  // Billing Configuration (optional: billing disabled by default)\n  billing: BillingConfigurationSchema.optional(),\n\n  // Analytics Configuration (optional: analytics disabled by default)\n  analytics: AnalyticsConfigSchema.optional(),\n\n  // Lifecycle Configuration (optional: lifecycle disabled by default)\n  lifecycle: LifecycleConfigSchema.optional(),\n\n  // Tenant-Teardown Configuration (optional: every field defaults, so omitting the block yields a\n  // working 30-day retention window purged nightly). Holds the operator-tunable retention window,\n  // purge cron and per-run batch size consumed by the engine-owned `organization-purge` batch.\n  // See TenantTeardownConfigSchema for why this is NOT folded into `lifecycle` (which is the USER\n  // lifecycle and is disabled by default).\n  tenantTeardown: TenantTeardownConfigSchema.optional(),\n\n  // Data-Seeding Configuration (optional: when omitted, the engine-owned\n  // `data-seeding:scheduled-rerun` batch uses the manifest's built-in\n  // minute-tick default cron — see DataSeedingConfigSchema for the full\n  // rationale on why operators rarely need to override this).\n  dataSeeding: DataSeedingConfigSchema.optional(),\n\n  // Audit-Trail Configuration (optional: when omitted, NO archival runs and\n  // audit records are retained in the primary AUDIT_LOGS store indefinitely).\n  // Holds the operator-tunable archival horizon (`archiveAfterDays`) consumed\n  // by the engine-owned `compliance:audit-logs-archive` batch. Records are\n  // never deleted (AUDIT_LOGS is immutable, G5) — see AuditTrailConfigSchema.\n  auditTrail: AuditTrailConfigSchema.optional(),\n\n});\n\n\nexport type AppConfiguration_Shared_Compliance = z.infer<typeof AppConfiguration_Shared_ComplianceSchema>;\nexport type AppConfiguration_Shared_AppIdentity = z.infer<typeof AppConfiguration_Shared_AppIdentity_Schema>;\nexport type AppConfiguration_Shared_AppPreferencesLanguage = z.infer<typeof AppConfiguration_Shared_AppPreferencesLanguage_Schema>;\nexport type AnalyticsProviderConfig = z.infer<typeof AnalyticsProviderConfigSchema>;\nexport type AppConfiguration_Shared_Runtime = z.infer<typeof AppConfiguration_Shared_RuntimeSchema>;\nexport type AutoInstrumentationConfig = z.infer<typeof AutoInstrumentationConfigSchema>;\nexport type AnalyticsConfig = z.infer<typeof AnalyticsConfigSchema>;\nexport type AppConfiguration_Shared_Auth = z.infer<typeof AppConfiguration_Shared_AuthSchema>;\nexport type AppConfiguration_Shared = z.infer<typeof AppConfiguration_Shared_Schema>;\n"]}

package/dist/esm/config/app-frontend-type.shared.schemas.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Runtime-kind taxonomy for a frontend service.
+ *
+ * The taxonomy is intentionally narrow — it captures *what the frontend
+ * runs* (React SPA vs Docusaurus SSG vs static marketing bundle), NOT
+ * what audience it targets or where it lives on the registrable root.
+ * Those concerns are modelled elsewhere:
+ *
+ * - **Audience / positioning** (admin console, customer app, internal
+ *   staff tool, etc.) is a branding concern, not a runtime concern.
+ *   Two services with `frontendType: SAAS_APP` can coexist in the same
+ *   project and point at different audiences — the framework does not
+ *   need to know.
+ * - **Public hostname** (`app.example.com` vs `dev.example.com` vs
+ *   apex) is authored explicitly, per-environment, in
+ *   `infra.serviceHosts`. Never derived from `frontendType` or from
+ *   the service key.
+ *
+ * Why the 3 kinds are genuinely distinct and NOT collapsible:
+ *
+ * - `SAAS_APP` — React SPA built with Vite, served from
+ *   `saas-frontend-lib`, owns an authenticated session
+ *   (`AuthSessionContext`, `PersistentSessionTokenStorage`), is the
+ *   primary user surface. Cross-frontend handoff uses it as the
+ *   source-of-session.
+ * - `STATIC_WEBSITE` — Marketing / landing surface, anonymous-first,
+ *   no session ownership, may expose an anonymous-session seam for
+ *   lead attribution but never an authenticated one.
+ * - `TECH_DOC` — Docusaurus-built static site with embedded auth
+ *   awareness. Different runtime (SSG vs SPA), different session role
+ *   (receiver via `Auth_OneOffSession` + `EphemeralSessionTokenStorage`,
+ *   never owner).
+ *
+ * --------------------------------------------------------------------------
+ * NO NATIVE / WEBVIEW VARIANTS — permanent, locked design decision
+ * --------------------------------------------------------------------------
+ *
+ * The taxonomy intentionally has NO native-shell variant (no
+ * `CAPACITOR_APP`, `ELECTRON_APP`, `IOS_NATIVE`, `ANDROID_NATIVE`, etc.)
+ * and NO `nativeShell` decorator on any of the three kinds above. The
+ * engine targets browser-rendered surfaces exclusively. This is a
+ * product decision, not an oversight:
+ *
+ * - The framework's value proposition is sharing TypeScript across
+ *   stacks (config, models, schemas, services). Native runtimes break
+ *   that property — Capacitor / Electron WebViews bring their own
+ *   storage, deep-link, scheme, and credential constraints that would
+ *   force the framework to fork concepts (cookie vs body refresh,
+ *   browser vs native channel detection, secure-storage adapters,
+ *   `cordova:` / `app://` CSP allowances). Each fork would compound
+ *   maintenance debt for zero shared-TS gain.
+ * - Apps that need a native shell can always wrap a `SAAS_APP` URL in
+ *   their own native container — that is a downstream packaging concern,
+ *   not a framework concern.
+ *
+ * Removed end-to-end on 2026-04-13 (per
+ * `.cursor/plans/cross-frontend-handoff-shells-removal.md`):
+ *
+ * - `NativeShellSchema` (`engine/saas-models/src/config/native-shell.shared.schemas.ts`)
+ *   and the `nativeShell` field on every service-definition schema
+ *   (`AppServiceDefinitionSchema`, `FrontendServiceDefinitionSchema`,
+ *   `AdminAppManagedDeclarationSchema.frontendServices[]`).
+ * - `POST /auth/native-token/exchange` route, `AUTH_NATIVE_TOKEN_EXCHANGE`
+ *   manual-route enum entry, and `NativeTokenExchangeRequestSchema` /
+ *   `NativeTokenExchangeResponseSchema` DTOs.
+ * - `AuthenticationOrchestratorBackendService.handleNativeSDKFirstFactor`,
+ *   `OAuth2AuthenticationBackendService.exchangeNativeToken`, and
+ *   `OAuth2Provider_ConfigurationSchema.nativeClientIds`.
+ * - `NativeSessionTokenStorageAdapter` interface,
+ *   `AuthSessionContext.handleNativeTokenExchange` /
+ *   `initiateNativeSignIn` methods, and the `auth:native-exchange:<ip>`
+ *   rate-limit policy.
+ * - `CrossFrontendHandoffErrorCode` entries
+ *   `TARGET_NATIVE_SHELL_NOT_DECLARED` and
+ *   `TARGET_NATIVE_SHELL_SELECTOR_REQUIRED`, the
+ *   `targetNativeShell` request field, and the corresponding audit-log
+ *   payload field.
+ *
+ * Do NOT re-introduce any of the above. Re-opening this design needs an
+ * explicit user-level decision, NOT a developer-level convenience patch.
+ *
+ * @wildo-bundle-budget
+ *   This file is registered in `../public-runtime/index.ts` and MUST
+ *   stay side-effect-free (no imports beyond what the enum needs —
+ *   currently zero). Adding any import that triggers
+ *   `initZodDecorators()` or pulls a heavy schema graph would silently
+ *   break the public-runtime boundary tests.
+ */
+export declare enum AppFrontendType {
+    SAAS_APP = "saas-app",
+    STATIC_WEBSITE = "static-website",
+    TECH_DOC = "tech-doc"
+}
+//# sourceMappingURL=app-frontend-type.shared.schemas.d.ts.map

package/dist/esm/config/app-frontend-type.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-frontend-type.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/app-frontend-type.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,oBAAY,eAAe;IACzB,QAAQ,aAAa;IACrB,cAAc,mBAAmB;IACjC,QAAQ,aAAa;CACtB"}

package/dist/esm/config/app-frontend-type.shared.schemas.js

@@ -0,0 +1,95 @@
+/**
+ * Runtime-kind taxonomy for a frontend service.
+ *
+ * The taxonomy is intentionally narrow — it captures *what the frontend
+ * runs* (React SPA vs Docusaurus SSG vs static marketing bundle), NOT
+ * what audience it targets or where it lives on the registrable root.
+ * Those concerns are modelled elsewhere:
+ *
+ * - **Audience / positioning** (admin console, customer app, internal
+ *   staff tool, etc.) is a branding concern, not a runtime concern.
+ *   Two services with `frontendType: SAAS_APP` can coexist in the same
+ *   project and point at different audiences — the framework does not
+ *   need to know.
+ * - **Public hostname** (`app.example.com` vs `dev.example.com` vs
+ *   apex) is authored explicitly, per-environment, in
+ *   `infra.serviceHosts`. Never derived from `frontendType` or from
+ *   the service key.
+ *
+ * Why the 3 kinds are genuinely distinct and NOT collapsible:
+ *
+ * - `SAAS_APP` — React SPA built with Vite, served from
+ *   `saas-frontend-lib`, owns an authenticated session
+ *   (`AuthSessionContext`, `PersistentSessionTokenStorage`), is the
+ *   primary user surface. Cross-frontend handoff uses it as the
+ *   source-of-session.
+ * - `STATIC_WEBSITE` — Marketing / landing surface, anonymous-first,
+ *   no session ownership, may expose an anonymous-session seam for
+ *   lead attribution but never an authenticated one.
+ * - `TECH_DOC` — Docusaurus-built static site with embedded auth
+ *   awareness. Different runtime (SSG vs SPA), different session role
+ *   (receiver via `Auth_OneOffSession` + `EphemeralSessionTokenStorage`,
+ *   never owner).
+ *
+ * --------------------------------------------------------------------------
+ * NO NATIVE / WEBVIEW VARIANTS — permanent, locked design decision
+ * --------------------------------------------------------------------------
+ *
+ * The taxonomy intentionally has NO native-shell variant (no
+ * `CAPACITOR_APP`, `ELECTRON_APP`, `IOS_NATIVE`, `ANDROID_NATIVE`, etc.)
+ * and NO `nativeShell` decorator on any of the three kinds above. The
+ * engine targets browser-rendered surfaces exclusively. This is a
+ * product decision, not an oversight:
+ *
+ * - The framework's value proposition is sharing TypeScript across
+ *   stacks (config, models, schemas, services). Native runtimes break
+ *   that property — Capacitor / Electron WebViews bring their own
+ *   storage, deep-link, scheme, and credential constraints that would
+ *   force the framework to fork concepts (cookie vs body refresh,
+ *   browser vs native channel detection, secure-storage adapters,
+ *   `cordova:` / `app://` CSP allowances). Each fork would compound
+ *   maintenance debt for zero shared-TS gain.
+ * - Apps that need a native shell can always wrap a `SAAS_APP` URL in
+ *   their own native container — that is a downstream packaging concern,
+ *   not a framework concern.
+ *
+ * Removed end-to-end on 2026-04-13 (per
+ * `.cursor/plans/cross-frontend-handoff-shells-removal.md`):
+ *
+ * - `NativeShellSchema` (`engine/saas-models/src/config/native-shell.shared.schemas.ts`)
+ *   and the `nativeShell` field on every service-definition schema
+ *   (`AppServiceDefinitionSchema`, `FrontendServiceDefinitionSchema`,
+ *   `AdminAppManagedDeclarationSchema.frontendServices[]`).
+ * - `POST /auth/native-token/exchange` route, `AUTH_NATIVE_TOKEN_EXCHANGE`
+ *   manual-route enum entry, and `NativeTokenExchangeRequestSchema` /
+ *   `NativeTokenExchangeResponseSchema` DTOs.
+ * - `AuthenticationOrchestratorBackendService.handleNativeSDKFirstFactor`,
+ *   `OAuth2AuthenticationBackendService.exchangeNativeToken`, and
+ *   `OAuth2Provider_ConfigurationSchema.nativeClientIds`.
+ * - `NativeSessionTokenStorageAdapter` interface,
+ *   `AuthSessionContext.handleNativeTokenExchange` /
+ *   `initiateNativeSignIn` methods, and the `auth:native-exchange:<ip>`
+ *   rate-limit policy.
+ * - `CrossFrontendHandoffErrorCode` entries
+ *   `TARGET_NATIVE_SHELL_NOT_DECLARED` and
+ *   `TARGET_NATIVE_SHELL_SELECTOR_REQUIRED`, the
+ *   `targetNativeShell` request field, and the corresponding audit-log
+ *   payload field.
+ *
+ * Do NOT re-introduce any of the above. Re-opening this design needs an
+ * explicit user-level decision, NOT a developer-level convenience patch.
+ *
+ * @wildo-bundle-budget
+ *   This file is registered in `../public-runtime/index.ts` and MUST
+ *   stay side-effect-free (no imports beyond what the enum needs —
+ *   currently zero). Adding any import that triggers
+ *   `initZodDecorators()` or pulls a heavy schema graph would silently
+ *   break the public-runtime boundary tests.
+ */
+export var AppFrontendType;
+(function (AppFrontendType) {
+    AppFrontendType["SAAS_APP"] = "saas-app";
+    AppFrontendType["STATIC_WEBSITE"] = "static-website";
+    AppFrontendType["TECH_DOC"] = "tech-doc";
+})(AppFrontendType || (AppFrontendType = {}));
+//# sourceMappingURL=app-frontend-type.shared.schemas.js.map

package/dist/esm/config/app-frontend-type.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-frontend-type.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/app-frontend-type.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,wCAAqB,CAAA;IACrB,oDAAiC,CAAA;IACjC,wCAAqB,CAAA;AACvB,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B","sourcesContent":["/**\n * Runtime-kind taxonomy for a frontend service.\n *\n * The taxonomy is intentionally narrow — it captures *what the frontend\n * runs* (React SPA vs Docusaurus SSG vs static marketing bundle), NOT\n * what audience it targets or where it lives on the registrable root.\n * Those concerns are modelled elsewhere:\n *\n * - **Audience / positioning** (admin console, customer app, internal\n *   staff tool, etc.) is a branding concern, not a runtime concern.\n *   Two services with `frontendType: SAAS_APP` can coexist in the same\n *   project and point at different audiences — the framework does not\n *   need to know.\n * - **Public hostname** (`app.example.com` vs `dev.example.com` vs\n *   apex) is authored explicitly, per-environment, in\n *   `infra.serviceHosts`. Never derived from `frontendType` or from\n *   the service key.\n *\n * Why the 3 kinds are genuinely distinct and NOT collapsible:\n *\n * - `SAAS_APP` — React SPA built with Vite, served from\n *   `saas-frontend-lib`, owns an authenticated session\n *   (`AuthSessionContext`, `PersistentSessionTokenStorage`), is the\n *   primary user surface. Cross-frontend handoff uses it as the\n *   source-of-session.\n * - `STATIC_WEBSITE` — Marketing / landing surface, anonymous-first,\n *   no session ownership, may expose an anonymous-session seam for\n *   lead attribution but never an authenticated one.\n * - `TECH_DOC` — Docusaurus-built static site with embedded auth\n *   awareness. Different runtime (SSG vs SPA), different session role\n *   (receiver via `Auth_OneOffSession` + `EphemeralSessionTokenStorage`,\n *   never owner).\n *\n * --------------------------------------------------------------------------\n * NO NATIVE / WEBVIEW VARIANTS — permanent, locked design decision\n * --------------------------------------------------------------------------\n *\n * The taxonomy intentionally has NO native-shell variant (no\n * `CAPACITOR_APP`, `ELECTRON_APP`, `IOS_NATIVE`, `ANDROID_NATIVE`, etc.)\n * and NO `nativeShell` decorator on any of the three kinds above. The\n * engine targets browser-rendered surfaces exclusively. This is a\n * product decision, not an oversight:\n *\n * - The framework's value proposition is sharing TypeScript across\n *   stacks (config, models, schemas, services). Native runtimes break\n *   that property — Capacitor / Electron WebViews bring their own\n *   storage, deep-link, scheme, and credential constraints that would\n *   force the framework to fork concepts (cookie vs body refresh,\n *   browser vs native channel detection, secure-storage adapters,\n *   `cordova:` / `app://` CSP allowances). Each fork would compound\n *   maintenance debt for zero shared-TS gain.\n * - Apps that need a native shell can always wrap a `SAAS_APP` URL in\n *   their own native container — that is a downstream packaging concern,\n *   not a framework concern.\n *\n * Removed end-to-end on 2026-04-13 (per\n * `.cursor/plans/cross-frontend-handoff-shells-removal.md`):\n *\n * - `NativeShellSchema` (`engine/saas-models/src/config/native-shell.shared.schemas.ts`)\n *   and the `nativeShell` field on every service-definition schema\n *   (`AppServiceDefinitionSchema`, `FrontendServiceDefinitionSchema`,\n *   `AdminAppManagedDeclarationSchema.frontendServices[]`).\n * - `POST /auth/native-token/exchange` route, `AUTH_NATIVE_TOKEN_EXCHANGE`\n *   manual-route enum entry, and `NativeTokenExchangeRequestSchema` /\n *   `NativeTokenExchangeResponseSchema` DTOs.\n * - `AuthenticationOrchestratorBackendService.handleNativeSDKFirstFactor`,\n *   `OAuth2AuthenticationBackendService.exchangeNativeToken`, and\n *   `OAuth2Provider_ConfigurationSchema.nativeClientIds`.\n * - `NativeSessionTokenStorageAdapter` interface,\n *   `AuthSessionContext.handleNativeTokenExchange` /\n *   `initiateNativeSignIn` methods, and the `auth:native-exchange:<ip>`\n *   rate-limit policy.\n * - `CrossFrontendHandoffErrorCode` entries\n *   `TARGET_NATIVE_SHELL_NOT_DECLARED` and\n *   `TARGET_NATIVE_SHELL_SELECTOR_REQUIRED`, the\n *   `targetNativeShell` request field, and the corresponding audit-log\n *   payload field.\n *\n * Do NOT re-introduce any of the above. Re-opening this design needs an\n * explicit user-level decision, NOT a developer-level convenience patch.\n *\n * @wildo-bundle-budget\n *   This file is registered in `../public-runtime/index.ts` and MUST\n *   stay side-effect-free (no imports beyond what the enum needs —\n *   currently zero). Adding any import that triggers\n *   `initZodDecorators()` or pulls a heavy schema graph would silently\n *   break the public-runtime boundary tests.\n */\nexport enum AppFrontendType {\n  SAAS_APP = 'saas-app',\n  STATIC_WEBSITE = 'static-website',\n  TECH_DOC = 'tech-doc',\n}\n"]}

package/dist/esm/config/auth-config-resolution.shared.utils.d.ts

@@ -6,10 +6,10 @@
  *
  * This is a pure function — no DI, no DB, no side effects.
  */
-import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
-import { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas.js';
-import type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig } from './entity-identity-config.shared.schemas.js';
-type AuthMethodsMap = Partial<Record<AuthMethod, boolean | {
+import { AuthMethod } from '../security/authentications/authentication.shared.schemas';
+import { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';
+import type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig } from './entity-identity-config.shared.schemas';
+export type AuthMethodsMap = Partial<Record<AuthMethod, boolean | {
     enabled: boolean;
 }>>;
 export interface AuthConfigResolutionInput {
@@ -23,6 +23,36 @@ export interface ResolvedAuthConfig {
     mfaPolicy: MfaPolicyConfig;
     passwordPolicy: PasswordPolicyConfig;
 }
+export declare function getEnabledMethods(map: AuthMethodsMap | undefined): Set<AuthMethod>;
+/**
+ * Auth methods that establish a LOCAL first-factor credential — a way into the account that does
+ * NOT go through the organization's external identity provider. For an org whose users are
+ * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential
+ * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the
+ * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).
+ * See `.claude/plans/auth-24-credential-lifecycle.md`.
+ *
+ * `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its "credential"
+ * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an
+ * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:
+ * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the
+ * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at
+ * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is
+ * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-
+ * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor
+ * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is
+ * intentionally left intact.)
+ */
+export declare const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[];
+/**
+ * AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every
+ * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies
+ * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity
+ * posture wins over authored config — the same most-restrictive direction as the org-override merge.
+ * This is the "one authority axis, derived" step: every first-factor login gate and every
+ * credential-creation gate that reads the effective policy then honors directory management
+ * automatically, without each site re-deriving it.
+ */
+export declare function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap;
 export declare function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig;
-export {};
 //# sourceMappingURL=auth-config-resolution.shared.utils.d.ts.map

package/dist/esm/config/auth-config-resolution.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config-resolution.shared.utils.d.ts","sourceRoot":"","sources":["../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/I,KAAK,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAAC;AAElF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,cAAc,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,oBAAoB,CAAC;CACtC;AAqOD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CAwBtF"}
+{"version":3,"file":"auth-config-resolution.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/I,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAAC;AAEzF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,cAAc,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,oBAAoB,CAAC;CACtC;AAQD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAOlF;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,UAAU,EAK1E,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,kBAAkB,EAAE,cAAc,GAAG,cAAc,CAMtG;AA8MD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CAwBtF"}

package/dist/esm/config/auth-config-resolution.shared.utils.js

@@ -15,7 +15,7 @@ function isMethodEnabled(value) {
         return value;
     return value.enabled;
 }
-function getEnabledMethods(map) {
+export function getEnabledMethods(map) {
     if (!map)
         return new Set();
     const result = new Set();
@@ -32,6 +32,48 @@ function setToMethodsMap(methods) {
     }
     return result;
 }
+// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────
+/**
+ * Auth methods that establish a LOCAL first-factor credential — a way into the account that does
+ * NOT go through the organization's external identity provider. For an org whose users are
+ * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential
+ * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the
+ * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).
+ * See `.claude/plans/auth-24-credential-lifecycle.md`.
+ *
+ * `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its "credential"
+ * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an
+ * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:
+ * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the
+ * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at
+ * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is
+ * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-
+ * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor
+ * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is
+ * intentionally left intact.)
+ */
+export const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS = [
+    AuthMethod.PASSWORD,
+    AuthMethod.PASSKEY,
+    AuthMethod.MAGIC_LINK,
+    AuthMethod.SMS_OTP,
+];
+/**
+ * AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every
+ * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies
+ * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity
+ * posture wins over authored config — the same most-restrictive direction as the org-override merge.
+ * This is the "one authority axis, derived" step: every first-factor login gate and every
+ * credential-creation gate that reads the effective policy then honors directory management
+ * automatically, without each site re-deriving it.
+ */
+export function disableDirectoryIncompatibleMethods(authMethodsEnabled) {
+    const result = { ...authMethodsEnabled };
+    for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {
+        result[method] = false;
+    }
+    return result;
+}
 // ─── Auth Methods Resolution ────────────────────────────────────────────────
 function resolveAuthMethodsSingle(userTypeMethods, orgOverride, policy, expandable) {
     if (!orgOverride?.authMethodsEnabled)
@@ -208,4 +250,4 @@ export function resolveAuthConfig(input) {
         passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),
     };
 }
-//# sourceMappingURL=auth-config-resolution.shared.utils.js.map
+//# sourceMappingURL=auth-config-resolution.shared.utils.js.map

package/dist/esm/config/auth-config-resolution.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAkB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA+B;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;SAClF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;KACzF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAkB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;SAClF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;KACzF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n *\n * Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).\n * Multi-org: each org type override resolved independently, then most-restrictive across all.\n *\n * This is a pure function — no DI, no DB, no side effects.\n */\n\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean | { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n  userTypeAuth: UserTypeAuthPolicy;\n  orgOverrides: OrgTypeAuthOverrides[];\n  orgAuthMethodPolicy: OrgAuthMethodPolicy;\n  expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n  authMethodsEnabled: AuthMethodsMap;\n  mfaPolicy: MfaPolicyConfig;\n  passwordPolicy: PasswordPolicyConfig;\n}\n\nfunction isMethodEnabled(value: boolean | { enabled: boolean } | undefined): boolean {\n  if (value === undefined) return false;\n  if (typeof value === 'boolean') return value;\n  return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap | undefined): Set<AuthMethod> {\n  if (!map) return new Set();\n  const result = new Set<AuthMethod>();\n  for (const [method, value] of Object.entries(map)) {\n    if (isMethodEnabled(value)) result.add(method as AuthMethod);\n  }\n  return result;\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n  const result: AuthMethodsMap = {};\n  for (const method of Object.values(AuthMethod)) {\n    result[method] = methods.has(method);\n  }\n  return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/**\n * Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n *\n * `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n */\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n  AuthMethod.PASSWORD,\n  AuthMethod.PASSKEY,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.SMS_OTP,\n];\n\n/**\n * AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n */\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n  const result: AuthMethodsMap = { ...authMethodsEnabled };\n  for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n    result[method] = false;\n  }\n  return result;\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n  userTypeMethods: Set<AuthMethod>,\n  orgOverride: OrgTypeAuthOverrides,\n  policy: OrgAuthMethodPolicy,\n  expandable: AuthMethod[],\n): Set<AuthMethod> {\n  if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n  const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n  switch (policy) {\n    case OrgAuthMethodPolicy.RESTRICT_ONLY:\n      return intersection(userTypeMethods, orgMethods);\n\n    case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n      const expandableSet = new Set(expandable);\n      const expansions = intersection(orgMethods, expandableSet);\n      return union(userTypeMethods, expansions);\n    }\n\n    case OrgAuthMethodPolicy.UNRESTRICTED:\n      return new Set(orgMethods);\n\n    default:\n      return new Set(userTypeMethods);\n  }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n  userTypeMethods: Set<AuthMethod>,\n  orgOverrides: OrgTypeAuthOverrides[],\n  policy: OrgAuthMethodPolicy,\n  expandable: AuthMethod[],\n): Set<AuthMethod> {\n  const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n  if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n  const perOrgResults = validOverrides.map(o =>\n    resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n  );\n\n  if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n    // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n    // Each org may expand within the expandable set, but multi-org users only get\n    // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n    return perOrgResults.reduce((acc, set) => intersection(acc, set));\n  }\n\n  return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n  base: MfaPolicyConfig,\n  override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n  return {\n    requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n    requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n    acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n    enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n    passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n  };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n  base: MfaPolicyConfig,\n  orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n  const mfaOverrides = orgOverrides\n    .map(o => o?.mfaPolicy)\n    .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n  if (mfaOverrides.length === 0) return { ...base };\n\n  const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n  return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n  return {\n    requireMFA: a.requireMFA || b.requireMFA,\n    requireStrongMFA: a.requireStrongMFA || b.requireStrongMFA,\n    acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n    enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n    passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n  };\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n  base: PasswordPolicyConfig,\n  override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n  return {\n    minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n    maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n    requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n    requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n    requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n    requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n    expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n  };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n  base: PasswordPolicyConfig,\n  orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n  const pwOverrides = orgOverrides\n    .map(o => o?.passwordPolicy)\n    .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n  if (pwOverrides.length === 0) return { ...base };\n\n  const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n  return normalizePasswordPolicyBounds(\n    perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n  );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n  return normalizePasswordPolicyBounds({\n    minLength: Math.max(a.minLength, b.minLength),\n    maxLength: Math.min(a.maxLength, b.maxLength),\n    requireUppercase: a.requireUppercase || b.requireUppercase,\n    requireLowercase: a.requireLowercase || b.requireLowercase,\n    requireNumbers: a.requireNumbers || b.requireNumbers,\n    requireSpecialChars: a.requireSpecialChars || b.requireSpecialChars,\n    expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n  });\n}\n\n/**\n * Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n  if (policy.maxLength >= policy.minLength) {\n    return policy;\n  }\n\n  return {\n    ...policy,\n    maxLength: policy.minLength,\n  };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean | undefined): boolean {\n  if (override === undefined) return base;\n  return base || override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean | undefined): boolean {\n  if (override === undefined) return base;\n  return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  if (base === 0 && override === 0) return 0;\n  if (base === 0) return override;\n  if (override === 0) return base;\n  return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] | undefined, b: T[] | undefined): T[] | undefined {\n  if (a === undefined) return b;\n  if (b === undefined) return a;\n  const setB = new Set(b);\n  return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n  const result = new Set<T>();\n  for (const item of a) {\n    if (b.has(item)) result.add(item);\n  }\n  return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n  return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n  const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n  if (!orgOverrides.length) {\n    return {\n      authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n      mfaPolicy: { ...userTypeAuth.mfaPolicy },\n      passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n    };\n  }\n\n  const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n  const resolvedMethods = resolveAuthMethodsMultiOrg(\n    userTypeMethods,\n    orgOverrides,\n    orgAuthMethodPolicy,\n    expandableOrgMethods ?? [],\n  );\n\n  return {\n    authMethodsEnabled: setToMethodsMap(resolvedMethods),\n    mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n    passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n  };\n}\n"]}