@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts

@@ -12,16 +12,31 @@
  *   - entity-identity-architecture-analysis.md §4.2
  */
 import { z } from 'zod';
-import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
-import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
-import { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
-/** R-1: Single discriminant replacing enabled/invitationOnly/selfRegistration. */
+import { AuthMethod } from '../security/authentications/authentication.shared.schemas';
+import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';
+import { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';
+import { AppFrontendType } from './app-frontend-type.shared.schemas';
+/** Canonical registration-policy discriminant. */
 export declare enum RegistrationMode {
     OPEN = "open",
     INVITATION_ONLY = "invitation_only",
     ADMIN_ONLY = "admin_only",
     DISABLED = "disabled"
 }
+/**
+ * Semantically distinct ways in which a user can acquire a user type.
+ *
+ * Keep these channels separate even when two currently share the same mode matrix: the actor,
+ * user intent, and security boundary differ, and future policy can evolve one without silently
+ * changing the others.
+ */
+export declare enum RegistrationAcquisitionChannel {
+    PUBLIC_SELF_SERVICE = "public_self_service",
+    SOCIAL_OAUTH_JIT = "social_oauth_jit",
+    ENTERPRISE_SSO_JIT = "enterprise_sso_jit",
+    INVITATION = "invitation",
+    ADMINISTRATIVE_PROVISIONING = "administrative_provisioning"
+}
 /** D-19: Email verification timing. */
 export declare enum EmailVerificationMode {
     REQUIRED_BEFORE_ACCESS = "required_before_access",
@@ -35,7 +50,7 @@ export declare enum OrgAuthMethodPolicy {
 }
 export declare const AuthMethodExpandedConfigSchema: z.ZodObject<{
     enabled: z.ZodBoolean;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;
 export declare const MfaPolicyConfigSchema: z.ZodObject<{
     requireMFA: z.ZodDefault<z.ZodBoolean>;
@@ -43,16 +58,28 @@ export declare const MfaPolicyConfigSchema: z.ZodObject<{
     acceptableMFAMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
     enrollmentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
     passkeyExemptFromMFA: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;
-/** R-1: Registration with mode discriminant. No more enabled/invitationOnly/selfRegistration booleans. */
+/**
+ * Registration policy for one user type.
+ *
+ * Every user type must author this object explicitly. Acquisition policy is security
+ * configuration, so omission must never silently become open registration.
+ */
 export declare const RegistrationConfigSchema: z.ZodObject<{
-    mode: z.ZodDefault<z.ZodEnum<typeof RegistrationMode>>;
+    mode: z.ZodEnum<typeof RegistrationMode>;
+    /**
+     * Only acquisition methods with a complete public-signup implementation are accepted.
+     * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
+     * end-to-end registration flow; declaring them here would otherwise advertise a path
+     * the runtime cannot execute.
+    */
     allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
-    requirePasswordOnRegister: z.ZodDefault<z.ZodBoolean>;
+    /** D-19: 'deferred' gives immediate access, verify later. */
     emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
+    /** R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. */
     blockForSSODomains: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strict>;
 export type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;
 /**
  * Password policy — includes expiryDays (R-8, moved from flat auth field).
@@ -67,26 +94,26 @@ export declare const PasswordPolicyConfigSchema: z.ZodObject<{
     requireNumbers: z.ZodDefault<z.ZodBoolean>;
     requireSpecialChars: z.ZodDefault<z.ZodBoolean>;
     expiryDays: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;
 /** E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. */
 export declare const StepUpAuthConfigSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     maxAgeSeconds: z.ZodDefault<z.ZodNumber>;
     methods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;
 export declare const LockoutPolicyConfigSchema: z.ZodObject<{
     maxLoginAttempts: z.ZodDefault<z.ZodNumber>;
     lockoutDurationMinutes: z.ZodDefault<z.ZodNumber>;
     progressiveLockout: z.ZodDefault<z.ZodBoolean>;
     maxProgressiveLockoutHours: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;
 export declare const MethodManagementConfigSchema: z.ZodObject<{
     allowUserMethodRemoval: z.ZodDefault<z.ZodBoolean>;
     requireReauthForMethodChanges: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;
 /**
  * The complete auth policy for a user type. Every user type MUST define this.
@@ -100,21 +127,28 @@ export type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema
 export declare const UserTypeAuthPolicySchema: z.ZodObject<{
     authMethodsEnabled: z.ZodDefault<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
         enabled: z.ZodBoolean;
-    }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+    }, z.core.$strip>]>>>;
     mfaPolicy: z.ZodDefault<z.ZodObject<{
         requireMFA: z.ZodDefault<z.ZodBoolean>;
         requireStrongMFA: z.ZodDefault<z.ZodBoolean>;
         acceptableMFAMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
         enrollmentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
         passkeyExemptFromMFA: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-    registration: z.ZodDefault<z.ZodObject<{
-        mode: z.ZodDefault<z.ZodEnum<typeof RegistrationMode>>;
+    }, z.core.$strip>>;
+    registration: z.ZodObject<{
+        mode: z.ZodEnum<typeof RegistrationMode>;
+        /**
+         * Only acquisition methods with a complete public-signup implementation are accepted.
+         * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
+         * end-to-end registration flow; declaring them here would otherwise advertise a path
+         * the runtime cannot execute.
+        */
         allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
-        requirePasswordOnRegister: z.ZodDefault<z.ZodBoolean>;
+        /** D-19: 'deferred' gives immediate access, verify later. */
         emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
+        /** R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. */
         blockForSSODomains: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strict>;
     passwordPolicy: z.ZodDefault<z.ZodObject<{
         minLength: z.ZodDefault<z.ZodNumber>;
         maxLength: z.ZodDefault<z.ZodNumber>;
@@ -123,7 +157,7 @@ export declare const UserTypeAuthPolicySchema: z.ZodObject<{
         requireNumbers: z.ZodDefault<z.ZodBoolean>;
         requireSpecialChars: z.ZodDefault<z.ZodBoolean>;
         expiryDays: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
     sessionDurationMinutes: z.ZodDefault<z.ZodNumber>;
     maxConcurrentSessions: z.ZodOptional<z.ZodNumber>;
     lockoutPolicy: z.ZodDefault<z.ZodObject<{
@@ -131,40 +165,48 @@ export declare const UserTypeAuthPolicySchema: z.ZodObject<{
         lockoutDurationMinutes: z.ZodDefault<z.ZodNumber>;
         progressiveLockout: z.ZodDefault<z.ZodBoolean>;
         maxProgressiveLockoutHours: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
     autoLinkByEmail: z.ZodDefault<z.ZodBoolean>;
     stepUpAuth: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         maxAgeSeconds: z.ZodDefault<z.ZodNumber>;
         methods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
     methodManagement: z.ZodDefault<z.ZodObject<{
         allowUserMethodRemoval: z.ZodDefault<z.ZodBoolean>;
         requireReauthForMethodChanges: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
     anonymousSessionsEnabled: z.ZodOptional<z.ZodBoolean>;
     oneOffSessionAllowed: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    oneOffSessionMaxDurationMinutes: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
 export type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;
 export declare const UserTypeDefinitionSchema: z.ZodObject<{
     auth: z.ZodObject<{
         authMethodsEnabled: z.ZodDefault<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
             enabled: z.ZodBoolean;
-        }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+        }, z.core.$strip>]>>>;
         mfaPolicy: z.ZodDefault<z.ZodObject<{
             requireMFA: z.ZodDefault<z.ZodBoolean>;
             requireStrongMFA: z.ZodDefault<z.ZodBoolean>;
             acceptableMFAMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
             enrollmentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
             passkeyExemptFromMFA: z.ZodDefault<z.ZodBoolean>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
-        registration: z.ZodDefault<z.ZodObject<{
-            mode: z.ZodDefault<z.ZodEnum<typeof RegistrationMode>>;
+        }, z.core.$strip>>;
+        registration: z.ZodObject<{
+            mode: z.ZodEnum<typeof RegistrationMode>;
+            /**
+             * Only acquisition methods with a complete public-signup implementation are accepted.
+             * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
+             * end-to-end registration flow; declaring them here would otherwise advertise a path
+             * the runtime cannot execute.
+            */
             allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
-            requirePasswordOnRegister: z.ZodDefault<z.ZodBoolean>;
+            /** D-19: 'deferred' gives immediate access, verify later. */
             emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
+            /** R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. */
             blockForSSODomains: z.ZodDefault<z.ZodBoolean>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strict>;
         passwordPolicy: z.ZodDefault<z.ZodObject<{
             minLength: z.ZodDefault<z.ZodNumber>;
             maxLength: z.ZodDefault<z.ZodNumber>;
@@ -173,7 +215,7 @@ export declare const UserTypeDefinitionSchema: z.ZodObject<{
             requireNumbers: z.ZodDefault<z.ZodBoolean>;
             requireSpecialChars: z.ZodDefault<z.ZodBoolean>;
             expiryDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
         sessionDurationMinutes: z.ZodDefault<z.ZodNumber>;
         maxConcurrentSessions: z.ZodOptional<z.ZodNumber>;
         lockoutPolicy: z.ZodDefault<z.ZodObject<{
@@ -181,63 +223,83 @@ export declare const UserTypeDefinitionSchema: z.ZodObject<{
             lockoutDurationMinutes: z.ZodDefault<z.ZodNumber>;
             progressiveLockout: z.ZodDefault<z.ZodBoolean>;
             maxProgressiveLockoutHours: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
         autoLinkByEmail: z.ZodDefault<z.ZodBoolean>;
         stepUpAuth: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
             maxAgeSeconds: z.ZodDefault<z.ZodNumber>;
             methods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
         methodManagement: z.ZodDefault<z.ZodObject<{
             allowUserMethodRemoval: z.ZodDefault<z.ZodBoolean>;
             requireReauthForMethodChanges: z.ZodDefault<z.ZodBoolean>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
         anonymousSessionsEnabled: z.ZodOptional<z.ZodBoolean>;
         oneOffSessionAllowed: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
+        oneOffSessionMaxDurationMinutes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
     uniqueIdentifier: z.ZodDefault<z.ZodString>;
     defaultAppRoles: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodString]>>>;
     requiresOrgMembership: z.ZodOptional<z.ZodObject<{
         orgTypes: z.ZodArray<z.ZodString>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;
 export declare const FrontendServiceUserManagementEntrySchema: z.ZodObject<{
     register: z.ZodBoolean;
     auth: z.ZodBoolean;
     isDefault: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;
+/**
+ * Backend-runtime view of one frontend service.
+ *
+ * Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`
+ * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.
+ *
+ * - `usersManagement` — auth-policy bindings per user type (legacy field;
+ *   present since the original auth identity model).
+ * - `frontendType` — the runtime kind declared in
+ *   `wildo.saas.config.ts → services[name].frontendType`. Currently
+ *   informational on the backend; reserved for `frontendType`-conditioned
+ *   policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The
+ *   full taxonomy + the "no native variants" decision live in
+ *   `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT
+ *   duplicate that explanation here.
+ */
 export declare const FrontendServiceDefinitionSchema: z.ZodObject<{
     usersManagement: z.ZodRecord<z.ZodString, z.ZodObject<{
         register: z.ZodBoolean;
         auth: z.ZodBoolean;
         isDefault: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>>;
+    frontendType: z.ZodOptional<z.ZodEnum<typeof AppFrontendType>>;
+}, z.core.$strip>;
 export type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;
+/** How a registration-derived organization obtains its initial display name. */
+export declare enum OrganizationNameSource {
+    ASK = "ask",
+    AUTO = "auto",
+    ONBOARDING = "onboarding"
+}
 export declare const OrgCreationPolicySchema: z.ZodObject<{
     createOnUserTypeRegistration: z.ZodArray<z.ZodString>;
-    orgNameSource: z.ZodEnum<{
-        auto: "auto";
-        ask: "ask";
-        onboarding: "onboarding";
-    }>;
+    orgNameSource: z.ZodEnum<typeof OrganizationNameSource>;
     defaultOwnerRole: z.ZodDefault<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;
 /** D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. */
 export declare const OrgTypeAuthOverridesSchema: z.ZodOptional<z.ZodObject<{
     authMethodsEnabled: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
         enabled: z.ZodBoolean;
-    }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+    }, z.core.$strip>]>>>;
     mfaPolicy: z.ZodOptional<z.ZodObject<{
         requireMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
         requireStrongMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
         acceptableMFAMethods: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
         enrollmentGracePeriodDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         passkeyExemptFromMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
     passwordPolicy: z.ZodOptional<z.ZodObject<{
         minLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         maxLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
@@ -246,14 +308,14 @@ export declare const OrgTypeAuthOverridesSchema: z.ZodOptional<z.ZodObject<{
         requireNumbers: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
         requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
         expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>>;
 export type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;
 /** G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). */
 export declare const OrgScimProvisioningSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;
 export declare const OrganizationTypeDefinitionSchema: z.ZodObject<{
     userTypes: z.ZodArray<z.ZodString>;
@@ -262,14 +324,14 @@ export declare const OrganizationTypeDefinitionSchema: z.ZodObject<{
     authOverrides: z.ZodOptional<z.ZodObject<{
         authMethodsEnabled: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
             enabled: z.ZodBoolean;
-        }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+        }, z.core.$strip>]>>>;
         mfaPolicy: z.ZodOptional<z.ZodObject<{
             requireMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             requireStrongMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             acceptableMFAMethods: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
             enrollmentGracePeriodDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
             passkeyExemptFromMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
         passwordPolicy: z.ZodOptional<z.ZodObject<{
             minLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
             maxLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
@@ -278,42 +340,45 @@ export declare const OrganizationTypeDefinitionSchema: z.ZodObject<{
             requireNumbers: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     scimProvisioning: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
     creationPolicy: z.ZodOptional<z.ZodObject<{
         createOnUserTypeRegistration: z.ZodArray<z.ZodString>;
-        orgNameSource: z.ZodEnum<{
-            auto: "auto";
-            ask: "ask";
-            onboarding: "onboarding";
-        }>;
+        orgNameSource: z.ZodEnum<typeof OrganizationNameSource>;
         defaultOwnerRole: z.ZodDefault<z.ZodString>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;
 export declare const UserTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     auth: z.ZodObject<{
         authMethodsEnabled: z.ZodDefault<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
             enabled: z.ZodBoolean;
-        }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+        }, z.core.$strip>]>>>;
         mfaPolicy: z.ZodDefault<z.ZodObject<{
             requireMFA: z.ZodDefault<z.ZodBoolean>;
             requireStrongMFA: z.ZodDefault<z.ZodBoolean>;
             acceptableMFAMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
             enrollmentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
             passkeyExemptFromMFA: z.ZodDefault<z.ZodBoolean>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
-        registration: z.ZodDefault<z.ZodObject<{
-            mode: z.ZodDefault<z.ZodEnum<typeof RegistrationMode>>;
+        }, z.core.$strip>>;
+        registration: z.ZodObject<{
+            mode: z.ZodEnum<typeof RegistrationMode>;
+            /**
+             * Only acquisition methods with a complete public-signup implementation are accepted.
+             * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
+             * end-to-end registration flow; declaring them here would otherwise advertise a path
+             * the runtime cannot execute.
+            */
             allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
-            requirePasswordOnRegister: z.ZodDefault<z.ZodBoolean>;
+            /** D-19: 'deferred' gives immediate access, verify later. */
             emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
+            /** R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. */
             blockForSSODomains: z.ZodDefault<z.ZodBoolean>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strict>;
         passwordPolicy: z.ZodDefault<z.ZodObject<{
             minLength: z.ZodDefault<z.ZodNumber>;
             maxLength: z.ZodDefault<z.ZodNumber>;
@@ -322,7 +387,7 @@ export declare const UserTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject
             requireNumbers: z.ZodDefault<z.ZodBoolean>;
             requireSpecialChars: z.ZodDefault<z.ZodBoolean>;
             expiryDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
         sessionDurationMinutes: z.ZodDefault<z.ZodNumber>;
         maxConcurrentSessions: z.ZodOptional<z.ZodNumber>;
         lockoutPolicy: z.ZodDefault<z.ZodObject<{
@@ -330,34 +395,36 @@ export declare const UserTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject
             lockoutDurationMinutes: z.ZodDefault<z.ZodNumber>;
             progressiveLockout: z.ZodDefault<z.ZodBoolean>;
             maxProgressiveLockoutHours: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
         autoLinkByEmail: z.ZodDefault<z.ZodBoolean>;
         stepUpAuth: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
             maxAgeSeconds: z.ZodDefault<z.ZodNumber>;
             methods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
         methodManagement: z.ZodDefault<z.ZodObject<{
             allowUserMethodRemoval: z.ZodDefault<z.ZodBoolean>;
             requireReauthForMethodChanges: z.ZodDefault<z.ZodBoolean>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
         anonymousSessionsEnabled: z.ZodOptional<z.ZodBoolean>;
         oneOffSessionAllowed: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
+        oneOffSessionMaxDurationMinutes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
     uniqueIdentifier: z.ZodDefault<z.ZodString>;
     defaultAppRoles: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodString]>>>;
     requiresOrgMembership: z.ZodOptional<z.ZodObject<{
         orgTypes: z.ZodArray<z.ZodString>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>>;
 export type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;
 export declare const FrontendServicesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     usersManagement: z.ZodRecord<z.ZodString, z.ZodObject<{
         register: z.ZodBoolean;
         auth: z.ZodBoolean;
         isDefault: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
+    frontendType: z.ZodOptional<z.ZodEnum<typeof AppFrontendType>>;
+}, z.core.$strip>>;
 export type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;
 export declare const OrganizationTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     userTypes: z.ZodArray<z.ZodString>;
@@ -366,14 +433,14 @@ export declare const OrganizationTypesConfigSchema: z.ZodRecord<z.ZodString, z.Z
     authOverrides: z.ZodOptional<z.ZodObject<{
         authMethodsEnabled: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
             enabled: z.ZodBoolean;
-        }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+        }, z.core.$strip>]>>>;
         mfaPolicy: z.ZodOptional<z.ZodObject<{
             requireMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             requireStrongMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             acceptableMFAMethods: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
             enrollmentGracePeriodDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
             passkeyExemptFromMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
         passwordPolicy: z.ZodOptional<z.ZodObject<{
             minLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
             maxLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
@@ -382,21 +449,33 @@ export declare const OrganizationTypesConfigSchema: z.ZodRecord<z.ZodString, z.Z
             requireNumbers: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
-        }, z.core.$strip, core.$ZodObjectExtra>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     scimProvisioning: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
     creationPolicy: z.ZodOptional<z.ZodObject<{
         createOnUserTypeRegistration: z.ZodArray<z.ZodString>;
-        orgNameSource: z.ZodEnum<{
-            auto: "auto";
-            ask: "ask";
-            onboarding: "onboarding";
-        }>;
+        orgNameSource: z.ZodEnum<typeof OrganizationNameSource>;
         defaultOwnerRole: z.ZodDefault<z.ZodString>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>>;
 export type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;
+export interface OrganizationTypeRegistrationCreationMatch<TDefinition extends {
+    readonly creationPolicy?: OrgCreationPolicy;
+} = OrganizationTypeDefinition> {
+    readonly organizationType: string;
+    readonly definition: TDefinition;
+}
+/**
+ * Canonical matching rule for registration-derived organization creation.
+ *
+ * The schema rejects more than one match for a user type. Returning all
+ * matches is intentional defensive behavior for stale/unparsed runtime input:
+ * callers can fail closed instead of selecting record insertion order.
+ */
+export declare function findOrganizationTypeRegistrationCreationMatches<TDefinition extends {
+    readonly creationPolicy?: OrgCreationPolicy;
+}>(organizationTypes: Readonly<Record<string, TDefinition>> | undefined, registeredUserType: string): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[];
 //# sourceMappingURL=entity-identity-config.shared.schemas.d.ts.map

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AAIjG,kFAAkF;AAClF,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;uCAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAUtF,eAAO,MAAM,qBAAqB;;;;;;uCAUhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,0GAA0G;AAC1G,eAAO,MAAM,wBAAwB;;;;;;uCAUnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;uCASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;uCAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;uCAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;uCAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAmEnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAanC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;uCAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,+BAA+B;;;;;;uCAE1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF,eAAO,MAAM,uBAAuB;;;;;;;;uCAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;wCAI1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB;;;uCAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAoB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAI1F,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAAiD,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;wCAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAAyD,CAAC;AACpG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}
+{"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAIrE,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAUtF,eAAO,MAAM,qBAAqB;;;;;;iBAUhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;IAEnC;;;;;MAKE;;IAEF,6DAA6D;;IAE7D,yFAAyF;;kBAyBzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;QAzFnC;;;;;UAKE;;QAEF,6DAA6D;;QAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsJzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;YApKnC;;;;;cAKE;;YAEF,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwKzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF,gFAAgF;AAChF,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;kBAI1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAI1F,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;YA3QhC;;;;;cAKE;;YAEF,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkQR,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA8BtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE"}