@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/config/entity-identity-config.shared.schemas.js

@@ -15,8 +15,9 @@ import { z } from 'zod';
 import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
 import { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
 import { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas.js';
+import { AppFrontendType } from './app-frontend-type.shared.schemas.js';
 // ─── Enums ──────────────────────────────────────────────────────────────────
-/** R-1: Single discriminant replacing enabled/invitationOnly/selfRegistration. */
+/** Canonical registration-policy discriminant. */
 export var RegistrationMode;
 (function (RegistrationMode) {
     RegistrationMode["OPEN"] = "open";
@@ -24,6 +25,21 @@ export var RegistrationMode;
     RegistrationMode["ADMIN_ONLY"] = "admin_only";
     RegistrationMode["DISABLED"] = "disabled";
 })(RegistrationMode || (RegistrationMode = {}));
+/**
+ * Semantically distinct ways in which a user can acquire a user type.
+ *
+ * Keep these channels separate even when two currently share the same mode matrix: the actor,
+ * user intent, and security boundary differ, and future policy can evolve one without silently
+ * changing the others.
+ */
+export var RegistrationAcquisitionChannel;
+(function (RegistrationAcquisitionChannel) {
+    RegistrationAcquisitionChannel["PUBLIC_SELF_SERVICE"] = "public_self_service";
+    RegistrationAcquisitionChannel["SOCIAL_OAUTH_JIT"] = "social_oauth_jit";
+    RegistrationAcquisitionChannel["ENTERPRISE_SSO_JIT"] = "enterprise_sso_jit";
+    RegistrationAcquisitionChannel["INVITATION"] = "invitation";
+    RegistrationAcquisitionChannel["ADMINISTRATIVE_PROVISIONING"] = "administrative_provisioning";
+})(RegistrationAcquisitionChannel || (RegistrationAcquisitionChannel = {}));
 /** D-19: Email verification timing. */
 export var EmailVerificationMode;
 (function (EmailVerificationMode) {
@@ -55,20 +71,46 @@ export const MfaPolicyConfigSchema = z.object({
     acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),
     /** D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. */
     enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),
-    /** C-5 migration: moves from AuthPolicyBase to config. Passkey IS multi-factor. */
+    /** C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. */
     passkeyExemptFromMFA: z.boolean().default(true),
 });
-/** R-1: Registration with mode discriminant. No more enabled/invitationOnly/selfRegistration booleans. */
-export const RegistrationConfigSchema = z.object({
-    mode: z.enum(RegistrationMode).default(RegistrationMode.OPEN),
-    /** D-6: Only listed methods allowed for first-time registration. Relevant when mode='open'. */
+/**
+ * Registration policy for one user type.
+ *
+ * Every user type must author this object explicitly. Acquisition policy is security
+ * configuration, so omission must never silently become open registration.
+ */
+export const RegistrationConfigSchema = z.strictObject({
+    mode: z.enum(RegistrationMode),
+    /**
+     * Only acquisition methods with a complete public-signup implementation are accepted.
+     * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
+     * end-to-end registration flow; declaring them here would otherwise advertise a path
+     * the runtime cannot execute.
+    */
     allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),
-    /** D-7: false enables passkey-only or magic-link-only registration. Relevant when mode='open'. */
-    requirePasswordOnRegister: z.boolean().default(true),
     /** D-19: 'deferred' gives immediate access, verify later. */
     emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),
     /** R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. */
     blockForSSODomains: z.boolean().default(false),
+}).superRefine((registration, ctx) => {
+    const unsupportedMethods = registration.allowedMethods.filter((method) => method !== AuthMethod.PASSWORD
+        && method !== AuthMethod.EXTERNAL_OAUTH2);
+    if (unsupportedMethods.length > 0) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['allowedMethods'],
+            message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,
+        });
+    }
+    if (registration.mode === RegistrationMode.OPEN
+        && registration.allowedMethods.length === 0) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['allowedMethods'],
+            message: 'Open registration requires at least one supported acquisition method',
+        });
+    }
 });
 /**
  * Password policy — includes expiryDays (R-8, moved from flat auth field).
@@ -123,14 +165,8 @@ export const UserTypeAuthPolicySchema = z.object({
         enrollmentGracePeriodDays: 0,
         passkeyExemptFromMFA: true,
     }),
-    /** E-3, R-1: Registration with mode discriminant. */
-    registration: RegistrationConfigSchema.default({
-        mode: RegistrationMode.OPEN,
-        allowedMethods: [AuthMethod.PASSWORD],
-        requirePasswordOnRegister: true,
-        emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,
-        blockForSSODomains: false,
-    }),
+    /** E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. */
+    registration: RegistrationConfigSchema,
     /** E-7, R-8: Password strength + expiry. */
     passwordPolicy: PasswordPolicyConfigSchema.default({
         minLength: 8,
@@ -166,6 +202,14 @@ export const UserTypeAuthPolicySchema = z.object({
     anonymousSessionsEnabled: z.boolean().optional(),
     /** W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. */
     oneOffSessionAllowed: z.boolean().optional(),
+    /** revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted
+     *  for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide
+     *  absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is
+     *  bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,
+     *  the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The
+     *  ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap
+     *  enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). */
+    oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),
 });
 // ─── User Type Definition ───────────────────────────────────────────────────
 export const UserTypeDefinitionSchema = z.object({
@@ -185,13 +229,37 @@ export const FrontendServiceUserManagementEntrySchema = z.object({
     auth: z.boolean(),
     isDefault: z.boolean().optional(),
 });
+/**
+ * Backend-runtime view of one frontend service.
+ *
+ * Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`
+ * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.
+ *
+ * - `usersManagement` — auth-policy bindings per user type (legacy field;
+ *   present since the original auth identity model).
+ * - `frontendType` — the runtime kind declared in
+ *   `wildo.saas.config.ts → services[name].frontendType`. Currently
+ *   informational on the backend; reserved for `frontendType`-conditioned
+ *   policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The
+ *   full taxonomy + the "no native variants" decision live in
+ *   `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT
+ *   duplicate that explanation here.
+ */
 export const FrontendServiceDefinitionSchema = z.object({
     usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),
+    frontendType: z.enum(AppFrontendType).optional(),
 });
 // ─── Organization Type ──────────────────────────────────────────────────────
+/** How a registration-derived organization obtains its initial display name. */
+export var OrganizationNameSource;
+(function (OrganizationNameSource) {
+    OrganizationNameSource["ASK"] = "ask";
+    OrganizationNameSource["AUTO"] = "auto";
+    OrganizationNameSource["ONBOARDING"] = "onboarding";
+})(OrganizationNameSource || (OrganizationNameSource = {}));
 export const OrgCreationPolicySchema = z.object({
     createOnUserTypeRegistration: z.array(z.string()).min(1),
-    orgNameSource: z.enum(['ask', 'auto', 'onboarding']),
+    orgNameSource: z.enum(OrganizationNameSource),
     defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),
 });
 /** D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. */
@@ -224,5 +292,48 @@ export const OrganizationTypeDefinitionSchema = z.object({
 // ─── Top-Level Config Sections ──────────────────────────────────────────────
 export const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);
 export const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);
-export const OrganizationTypesConfigSchema = z.record(z.string(), OrganizationTypeDefinitionSchema);
-//# sourceMappingURL=entity-identity-config.shared.schemas.js.map
+export const OrganizationTypesConfigSchema = z
+    .record(z.string(), OrganizationTypeDefinitionSchema)
+    .superRefine((organizationTypes, ctx) => {
+    const ownerByRegisteredUserType = new Map();
+    for (const [organizationType, definition] of Object.entries(organizationTypes)) {
+        const registeredUserTypes = definition.creationPolicy?.createOnUserTypeRegistration ?? [];
+        registeredUserTypes.forEach((userType, index) => {
+            const existingOwner = ownerByRegisteredUserType.get(userType);
+            if (existingOwner !== undefined) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [
+                        organizationType,
+                        'creationPolicy',
+                        'createOnUserTypeRegistration',
+                        index,
+                    ],
+                    message: `User type '${userType}' already creates organization type `
+                        + `'${existingOwner}' during registration; one registration `
+                        + 'cannot implicitly choose between multiple organization types',
+                });
+                return;
+            }
+            ownerByRegisteredUserType.set(userType, organizationType);
+        });
+    }
+});
+/**
+ * Canonical matching rule for registration-derived organization creation.
+ *
+ * The schema rejects more than one match for a user type. Returning all
+ * matches is intentional defensive behavior for stale/unparsed runtime input:
+ * callers can fail closed instead of selecting record insertion order.
+ */
+export function findOrganizationTypeRegistrationCreationMatches(organizationTypes, registeredUserType) {
+    if (!organizationTypes)
+        return [];
+    return Object.entries(organizationTypes)
+        .filter(([, definition]) => definition.creationPolicy?.createOnUserTypeRegistration.includes(registeredUserType))
+        .map(([organizationType, definition]) => ({
+        organizationType,
+        definition,
+    }));
+}
+//# sourceMappingURL=entity-identity-config.shared.schemas.js.map

package/dist/esm/config/entity-identity-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjG,+EAA+E;AAE/E,kFAAkF;AAClF,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0EAAiD,CAAA;IACjD,8CAAqB,CAAA;AACvB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,mFAAmF;IACnF,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH,0GAA0G;AAC1G,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC;IAC7D,+FAA+F;IAC/F,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,kGAAkG;IAClG,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1D,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,qDAAqD;IACrD,YAAY,EAAE,wBAAwB,CAAC,OAAO,CAAC;QAC7C,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,cAAc,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QACrC,yBAAyB,EAAE,IAAI;QAC/B,iBAAiB,EAAE,qBAAqB,CAAC,sBAAsB;QAC/D,kBAAkB,EAAE,KAAK;KAC1B,CAAC;IAEF,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D,uCAAuC;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,KAAK;KACrC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;CAChF,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC,CAAC"}
+{"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,6EAA2C,CAAA;IAC3C,uEAAqC,CAAA;IACrC,2EAAyC,CAAA;IACzC,2DAAyB,CAAA;IACzB,6FAA2D,CAAA;AAC7D,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0EAAiD,CAAA;IACjD,8CAAqB,CAAA;AACvB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9B;;;;;MAKE;IACF,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACnC,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,KAAK,UAAU,CAAC,QAAQ;WAC3B,MAAM,KAAK,UAAU,CAAC,eAAe,CAC3C,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;WACxC,YAAY,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1D,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,4FAA4F;IAC5F,YAAY,EAAE,wBAAwB;IAEtC,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D,uCAAuC;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,KAAK;KACrC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C;;;;;;mHAM+G;IAC/G,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,+EAA+E;AAE/E,gFAAgF;AAChF,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,qCAAW,CAAA;IACX,uCAAa,CAAA;IACb,mDAAyB,CAAA;AAC3B,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC;KACpD,WAAW,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;IACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,iBAAiB,CAClB,EAAE,CAAC;QACF,MAAM,mBAAmB,GACvB,UAAU,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,gBAAgB;wBAChB,gBAAgB;wBAChB,8BAA8B;wBAC9B,KAAK;qBACN;oBACD,OAAO,EACL,cAAc,QAAQ,sCAAsC;0BAC1D,IAAI,aAAa,0CAA0C;0BAC3D,8DAA8D;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAYL;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAK7D,iBAAoE,EACpE,kBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAC9D,kBAAkB,CACnB,CACF;SACA,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC,CAAC;AACR,CAAC","sourcesContent":["/**\n * Entity & Identity Configuration Schemas\n *\n * Top-level config sections: userTypes, frontendServices, organizationTypes.\n * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).\n *\n * Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.\n * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.\n *\n * See:\n *   - target-configuration-type.md §2b (UserTypeAuthPolicy)\n *   - entity-identity-architecture-analysis.md §4.2\n */\n\nimport { z } from 'zod';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { AppFrontendType } from './app-frontend-type.shared.schemas';\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\n/** Canonical registration-policy discriminant. */\nexport enum RegistrationMode {\n  OPEN = 'open',\n  INVITATION_ONLY = 'invitation_only',\n  ADMIN_ONLY = 'admin_only',\n  DISABLED = 'disabled',\n}\n\n/**\n * Semantically distinct ways in which a user can acquire a user type.\n *\n * Keep these channels separate even when two currently share the same mode matrix: the actor,\n * user intent, and security boundary differ, and future policy can evolve one without silently\n * changing the others.\n */\nexport enum RegistrationAcquisitionChannel {\n  PUBLIC_SELF_SERVICE = 'public_self_service',\n  SOCIAL_OAUTH_JIT = 'social_oauth_jit',\n  ENTERPRISE_SSO_JIT = 'enterprise_sso_jit',\n  INVITATION = 'invitation',\n  ADMINISTRATIVE_PROVISIONING = 'administrative_provisioning',\n}\n\n/** D-19: Email verification timing. */\nexport enum EmailVerificationMode {\n  REQUIRED_BEFORE_ACCESS = 'required_before_access',\n  DEFERRED = 'deferred',\n}\n\n/** E-10, D-15: How much orgs can override user-type auth methods. */\nexport enum OrgAuthMethodPolicy {\n  RESTRICT_ONLY = 'restrict_only',\n  EXPAND_WITHIN_SET = 'expand_within_set',\n  UNRESTRICTED = 'unrestricted',\n}\n\n// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────\n\nexport const AuthMethodExpandedConfigSchema = z.object({\n  enabled: z.boolean(),\n});\nexport type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;\n\n/**\n * authMethodsEnabled value: boolean shorthand OR expanded config.\n * Shorthand: PASSWORD: true → normalized at runtime to { enabled: true }.\n */\nconst AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);\n\n// ─── Policy Sub-Types ───────────────────────────────────────────────────────\n\nexport const MfaPolicyConfigSchema = z.object({\n  requireMFA: z.boolean().default(false),\n  /** D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. */\n  requireStrongMFA: z.boolean().default(false),\n  /** Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. */\n  acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),\n  /** D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. */\n  enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),\n  /** C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. */\n  passkeyExemptFromMFA: z.boolean().default(true),\n});\nexport type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;\n\n/**\n * Registration policy for one user type.\n *\n * Every user type must author this object explicitly. Acquisition policy is security\n * configuration, so omission must never silently become open registration.\n */\nexport const RegistrationConfigSchema = z.strictObject({\n  mode: z.enum(RegistrationMode),\n  /**\n   * Only acquisition methods with a complete public-signup implementation are accepted.\n   * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an\n   * end-to-end registration flow; declaring them here would otherwise advertise a path\n   * the runtime cannot execute.\n  */\n  allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n  /** D-19: 'deferred' gives immediate access, verify later. */\n  emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),\n  /** R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. */\n  blockForSSODomains: z.boolean().default(false),\n}).superRefine((registration, ctx) => {\n  const unsupportedMethods = registration.allowedMethods.filter(\n    (method) =>\n      method !== AuthMethod.PASSWORD\n      && method !== AuthMethod.EXTERNAL_OAUTH2,\n  );\n  if (unsupportedMethods.length > 0) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['allowedMethods'],\n      message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,\n    });\n  }\n  if (\n    registration.mode === RegistrationMode.OPEN\n    && registration.allowedMethods.length === 0\n  ) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['allowedMethods'],\n      message: 'Open registration requires at least one supported acquisition method',\n    });\n  }\n});\nexport type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;\n\n/**\n * Password policy — includes expiryDays (R-8, moved from flat auth field).\n * Defined here (not in app-configuration-shared) to avoid circular dependency.\n * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.\n */\nexport const PasswordPolicyConfigSchema = z.object({\n  minLength: z.number().min(6).max(128).default(8),\n  maxLength: z.number().min(8).max(256).default(128),\n  requireUppercase: z.boolean().default(true),\n  requireLowercase: z.boolean().default(true),\n  requireNumbers: z.boolean().default(true),\n  requireSpecialChars: z.boolean().default(false),\n  /** R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). */\n  expiryDays: z.number().min(0).default(0),\n});\nexport type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;\n\n/** E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. */\nexport const StepUpAuthConfigSchema = z.object({\n  enabled: z.boolean().default(false),\n  maxAgeSeconds: z.number().min(60).max(3600).default(300),\n  methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n});\nexport type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;\n\nexport const LockoutPolicyConfigSchema = z.object({\n  maxLoginAttempts: z.number().min(3).max(20).default(5),\n  lockoutDurationMinutes: z.number().min(1).max(1440).default(30),\n  /** W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. */\n  progressiveLockout: z.boolean().default(false),\n  /** W2.3: cap for progressive lockout duration in hours. */\n  maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),\n});\nexport type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;\n\nexport const MethodManagementConfigSchema = z.object({\n  allowUserMethodRemoval: z.boolean().default(true),\n  requireReauthForMethodChanges: z.boolean().default(false),\n});\nexport type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;\n\n// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────\n\n/**\n * The complete auth policy for a user type. Every user type MUST define this.\n * There are no global auth defaults — this IS the auth config.\n *\n * Zod .default() values enable omission in config input files, but the\n * resolved runtime type has all fields present (no optionals for policy fields).\n *\n * See target-configuration-type.md §2b for full specification.\n */\nexport const UserTypeAuthPolicySchema = z.object({\n  /** E-1, D-20: Opt-in semantics — absent method = disabled. */\n  authMethodsEnabled: z.partialRecord(\n    z.enum(AuthMethod),\n    AuthMethodValueSchema,\n  ).default({ [AuthMethod.PASSWORD]: true }),\n\n  /** E-2: MFA enforcement for this user type. */\n  mfaPolicy: MfaPolicyConfigSchema.default({\n    requireMFA: false,\n    requireStrongMFA: false,\n    enrollmentGracePeriodDays: 0,\n    passkeyExemptFromMFA: true,\n  }),\n\n  /** E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. */\n  registration: RegistrationConfigSchema,\n\n  /** E-7, R-8: Password strength + expiry. */\n  passwordPolicy: PasswordPolicyConfigSchema.default({\n    minLength: 8,\n    maxLength: 128,\n    requireUppercase: true,\n    requireLowercase: true,\n    requireNumbers: true,\n    requireSpecialChars: false,\n    expiryDays: 0,\n  }),\n\n  /** E-8: Session duration for this user type. */\n  sessionDurationMinutes: z.number().min(1).max(1440).default(30),\n\n  /** E-8, G-2: undefined = unlimited. */\n  maxConcurrentSessions: z.number().min(1).optional(),\n\n  /** G-1: Per-user-type lockout. Backend-only. */\n  lockoutPolicy: LockoutPolicyConfigSchema.default({\n    maxLoginAttempts: 5,\n    lockoutDurationMinutes: 30,\n    progressiveLockout: false,\n    maxProgressiveLockoutHours: 24,\n  }),\n\n  /** G-8: Consumer=true (convenience), Admin=false (security). */\n  autoLinkByEmail: z.boolean().default(true),\n\n  /** E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). */\n  stepUpAuth: StepUpAuthConfigSchema.optional(),\n\n  methodManagement: MethodManagementConfigSchema.default({\n    allowUserMethodRemoval: true,\n    requireReauthForMethodChanges: false,\n  }),\n\n  /** W7.3a: Enables anonymous session support for this user type. When true,\n   *  unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.\n   *  On login/register for this user type, anonymous resources are transposed to the authenticated user. */\n  anonymousSessionsEnabled: z.boolean().optional(),\n\n  /** W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. */\n  oneOffSessionAllowed: z.boolean().optional(),\n\n  /** revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted\n   *  for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide\n   *  absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is\n   *  bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,\n   *  the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The\n   *  ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap\n   *  enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). */\n  oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),\n});\nexport type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;\n\n// ─── User Type Definition ───────────────────────────────────────────────────\n\nexport const UserTypeDefinitionSchema = z.object({\n  /** REQUIRED — the complete auth policy for this user type. Not an override of global. */\n  auth: UserTypeAuthPolicySchema,\n\n  /** DEFERRED: Only 'email' supported. Accepts any string; engine warns if !== 'email'. */\n  uniqueIdentifier: z.string().default('email'),\n\n  defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),\n\n  /** D-10: When set, user type auto-revoked when user leaves last org of matching type. */\n  requiresOrgMembership: z.object({\n    orgTypes: z.array(z.string()).min(1),\n  }).optional(),\n});\nexport type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;\n\n// ─── Frontend Service Identity ──────────────────────────────────────────────\n\nexport const FrontendServiceUserManagementEntrySchema = z.object({\n  register: z.boolean(),\n  auth: z.boolean(),\n  isDefault: z.boolean().optional(),\n});\nexport type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;\n\n/**\n * Backend-runtime view of one frontend service.\n *\n * Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`\n * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.\n *\n * - `usersManagement` — auth-policy bindings per user type (legacy field;\n *   present since the original auth identity model).\n * - `frontendType` — the runtime kind declared in\n *   `wildo.saas.config.ts → services[name].frontendType`. Currently\n *   informational on the backend; reserved for `frontendType`-conditioned\n *   policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The\n *   full taxonomy + the \"no native variants\" decision live in\n *   `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT\n *   duplicate that explanation here.\n */\nexport const FrontendServiceDefinitionSchema = z.object({\n  usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),\n  frontendType: z.enum(AppFrontendType).optional(),\n});\nexport type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;\n\n// ─── Organization Type ──────────────────────────────────────────────────────\n\n/** How a registration-derived organization obtains its initial display name. */\nexport enum OrganizationNameSource {\n  ASK = 'ask',\n  AUTO = 'auto',\n  ONBOARDING = 'onboarding',\n}\n\nexport const OrgCreationPolicySchema = z.object({\n  createOnUserTypeRegistration: z.array(z.string()).min(1),\n  orgNameSource: z.enum(OrganizationNameSource),\n  defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),\n});\nexport type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;\n\n/** D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. */\nexport const OrgTypeAuthOverridesSchema = z.object({\n  authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),\n  mfaPolicy: MfaPolicyConfigSchema.partial().optional(),\n  passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),\n}).optional();\nexport type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;\n\n/** G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). */\nexport const OrgScimProvisioningSchema = z.object({\n  enabled: z.boolean().default(false),\n  syncFrequencyHours: z.number().min(1).max(720).default(24),\n});\nexport type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;\n\nexport const OrganizationTypeDefinitionSchema = z.object({\n  /** D-10: User types auto-granted when joining this org type. */\n  userTypes: z.array(z.string()).min(1),\n\n  availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([\n    CORE_ORG_ROLES.ORG_OWNER,\n    CORE_ORG_ROLES.ORG_ADMIN,\n    CORE_ORG_ROLES.ORG_MEMBER,\n  ]),\n\n  /** R-5: Moved from registration.defaultOrgRole. */\n  defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),\n\n  /** D-15: Most-restrictive-wins on top of user type auth policy. */\n  authOverrides: OrgTypeAuthOverridesSchema,\n\n  /** G-4: SCIM provisioning toggle per org type. */\n  scimProvisioning: OrgScimProvisioningSchema.optional(),\n\n  creationPolicy: OrgCreationPolicySchema.optional(),\n});\nexport type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;\n\n// ─── Top-Level Config Sections ──────────────────────────────────────────────\n\nexport const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);\nexport type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;\n\nexport const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);\nexport type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;\n\nexport const OrganizationTypesConfigSchema = z\n  .record(z.string(), OrganizationTypeDefinitionSchema)\n  .superRefine((organizationTypes, ctx) => {\n    const ownerByRegisteredUserType = new Map<string, string>();\n    for (const [organizationType, definition] of Object.entries(\n      organizationTypes,\n    )) {\n      const registeredUserTypes =\n        definition.creationPolicy?.createOnUserTypeRegistration ?? [];\n      registeredUserTypes.forEach((userType, index) => {\n        const existingOwner = ownerByRegisteredUserType.get(userType);\n        if (existingOwner !== undefined) {\n          ctx.addIssue({\n            code: 'custom',\n            path: [\n              organizationType,\n              'creationPolicy',\n              'createOnUserTypeRegistration',\n              index,\n            ],\n            message:\n              `User type '${userType}' already creates organization type `\n              + `'${existingOwner}' during registration; one registration `\n              + 'cannot implicitly choose between multiple organization types',\n          });\n          return;\n        }\n        ownerByRegisteredUserType.set(userType, organizationType);\n      });\n    }\n  });\nexport type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;\n\nexport interface OrganizationTypeRegistrationCreationMatch<\n  TDefinition extends {\n    readonly creationPolicy?: OrgCreationPolicy;\n  } = OrganizationTypeDefinition,\n> {\n  readonly organizationType: string;\n  readonly definition: TDefinition;\n}\n\n/**\n * Canonical matching rule for registration-derived organization creation.\n *\n * The schema rejects more than one match for a user type. Returning all\n * matches is intentional defensive behavior for stale/unparsed runtime input:\n * callers can fail closed instead of selecting record insertion order.\n */\nexport function findOrganizationTypeRegistrationCreationMatches<\n  TDefinition extends {\n    readonly creationPolicy?: OrgCreationPolicy;\n  },\n>(\n  organizationTypes: Readonly<Record<string, TDefinition>> | undefined,\n  registeredUserType: string,\n): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[] {\n  if (!organizationTypes) return [];\n  return Object.entries(organizationTypes)\n    .filter(([, definition]) =>\n      definition.creationPolicy?.createOnUserTypeRegistration.includes(\n        registeredUserType,\n      ),\n    )\n    .map(([organizationType, definition]) => ({\n      organizationType,\n      definition,\n    }));\n}\n"]}