@wildo-ai/saas-models 1.0.1

package/dist/esm/config/app-configuration-shared.shared.schemas.js

@@ -0,0 +1,219 @@
+/**
+ * Frontend Application Configuration Schemas
+ *
+ * Pure frontend configuration schemas that define what configuration
+ * the frontend applications expect to receive from backend endpoints.
+ *
+ * NOTE: OAuth2 providers are NOT configured here. OAuth2 is a protocol
+ * defined at the provider level in external-connectors, just like REST_API
+ * and HOOKS protocols. This configuration only enables/disables which
+ * external providers are available for SSO authentication.
+ */
+import { AvailableLanguage } from '@wildo-ai/presets-components-models';
+import { z } from 'zod';
+import { AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas.js';
+import { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas.js';
+import { DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas.js';
+import { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas.js';
+import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
+import { ValueMomentSchema } from './analytics-value-moments.shared.schemas.js';
+import { UserTypesConfigSchema, FrontendServicesConfigSchema, OrganizationTypesConfigSchema, OrgAuthMethodPolicy, } from './entity-identity-config.shared.schemas.js';
+/**
+ * Shared Password Policy Rules Schema
+ *
+ * Contains ONLY the validation rules that both frontend and backend need.
+ * The backend extends these rules with hashing config (argon2 params)
+ * via AppConfiguration_AuthSchema in app-config.backend.schemas.ts.
+ *
+ * Frontend uses these rules for:
+ * - Real-time password strength validation as user types
+ * - Password policy indicator in reset/registration forms
+ */
+export const PasswordPolicyRulesSchema = z.object({
+    minLength: z.number().min(6).max(128).default(8),
+    maxLength: z.number().min(8).max(256).default(128),
+    requireUppercase: z.boolean().default(true),
+    requireLowercase: z.boolean().default(true),
+    requireNumbers: z.boolean().default(true),
+    requireSpecialChars: z.boolean().default(false),
+    /** R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. */
+    expiryDays: z.number().min(0).default(0),
+});
+/**
+ * I18n label keys for password policy violations.
+ * Values match PasswordPolicyLabel in presets-components-models for frontend resolution.
+ * Labels support placeholders: policyMinLength → {minLength}, policyMaxLength → {maxLength}.
+ */
+export const PasswordPolicyViolationCode = {
+    MIN_LENGTH: 'policyMinLength',
+    MAX_LENGTH: 'policyMaxLength',
+    UPPERCASE: 'policyUppercase',
+    LOWERCASE: 'policyLowercase',
+    NUMBER: 'policyNumber',
+    SPECIAL_CHAR: 'policySpecialChar',
+};
+/**
+ * Global Auth Config — infrastructure + app-level only.
+ *
+ * Auth POLICY (authMethodsEnabled, mfaPolicy, registration, passwordPolicy,
+ * sessionDurationMinutes, lockoutPolicy, autoLinkByEmail, stepUpAuth,
+ * methodManagement) is now per-user-type on UserTypeAuthPolicySchema
+ * in entity-identity-config.shared.schemas.ts.
+ *
+ * This section retains only infrastructure and app-level settings that apply
+ * equally regardless of user type.
+ *
+ */
+export const AppConfiguration_Shared_AuthSchema = z.object({
+    // ─── INFRASTRUCTURE (stays on global auth) ────────────────────────────────
+    passkeyConfig: z.object({
+        rpName: z.string().min(1),
+        rpId: z.string().min(1),
+        maxPasskeysPerUser: z.number().min(1).max(50).default(10),
+    }),
+    ssoProviders: z.record(z.string(), z.object({
+        providerRef: z.string(),
+        enabled: z.boolean().default(true),
+        allowedDomains: z.array(z.string()).optional(),
+        displayName: z.string().optional(),
+        additionalScopes: z.array(z.string()).optional(),
+    })).default({}),
+    /** E-10, D-15: How much orgs can override user-type auth methods. */
+    orgAuthMethodPolicy: z.enum(OrgAuthMethodPolicy).default(OrgAuthMethodPolicy.RESTRICT_ONLY),
+    /** E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. */
+    expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),
+    /** E-4, D-2: Can a user authenticated via Org A SSO access Org B? */
+    crossOrgSSOAccess: z.boolean().default(true),
+    // W6.8: All per-user-type auth policy fields REMOVED.
+    // Use userTypes[t].auth.* instead (see entity-identity-config.shared.schemas.ts).
+    // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).
+});
+export const AppConfiguration_Shared_ComplianceSchema = z.object({
+    userProfileVisibility: z.enum(UserProfileVisibility).default(UserProfileVisibility.ORGANIZATION),
+    organizationProfileVisibility: z.enum(OrganizationProfileVisibility).default(OrganizationProfileVisibility.PRIVATE),
+});
+export const AppConfiguration_Shared_AppIdentity_Schema = z.object({
+    /** Technical app name — used as fallback when displayName is absent */
+    appName: z.string().min(1, { error: 'Application name is required' }),
+    /** Human-readable display name shown in UI and emails */
+    displayName: z.string().optional(),
+    /** Short description of the application */
+    description: z.string().optional(),
+    /** URL to the application logo (used in emails, login pages, etc.) */
+    logoUrl: z.string().url().optional(),
+    version: z.string().min(1, { error: 'Version is required' }),
+});
+export const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({
+    defaultLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),
+    enabledLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]),
+    fallbackLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),
+    autoDetectFromBrowser: z.boolean().default(true),
+    allowUserOverride: z.boolean().default(true),
+    allowOrganizationOverride: z.boolean().default(true),
+    enableLanguageSwitcher: z.boolean().default(true)
+});
+export const appConfiguration_Shared_RuntimeSchemaBuilder = (appTypeSchema) => {
+    return z.object({
+        endPoints: z.record(z.string(), z.object({
+            publicUrl: z.string().optional(),
+            internalUrl: z.string().optional(),
+        })),
+    });
+};
+export const AppConfiguration_Shared_RuntimeSchema = appConfiguration_Shared_RuntimeSchemaBuilder(AllSharedApplicationTypesSchema);
+// =====================================================
+// Analytics Configuration
+// =====================================================
+export var AnalyticsProviderType;
+(function (AnalyticsProviderType) {
+    AnalyticsProviderType["CONSOLE"] = "console";
+    AnalyticsProviderType["BACKEND_PROXY"] = "backend_proxy";
+})(AnalyticsProviderType || (AnalyticsProviderType = {}));
+/** Uses providerType (not "type") to avoid Mongoose reserved keyword conflict during Zod→Mongoose conversion. */
+export const AnalyticsProviderConfigSchema = z.object({
+    providerType: z.enum(AnalyticsProviderType),
+    config: z.record(z.string(), z.unknown()).optional(),
+});
+export const AutoInstrumentationConfigSchema = z.object({
+    /** Track page views (NAVIGATION_PANE_CHANGED events) */
+    pageViews: z.boolean().default(true),
+    /** Track resource operations (NOTIFY_RESOURCE_SUCCESS events) */
+    resourceOperations: z.boolean().default(true),
+    /** Track errors (ERROR_OCCURED events). Named 'trackErrors' to avoid Mongoose reserved 'errors' pathname. */
+    trackErrors: z.boolean().default(true),
+    /** Track feature gate hits (shown/blocked) — debounced per feature per session */
+    featureGate: z.boolean().default(true),
+    /** Track user lifecycle events (login, logout, status changes) */
+    userLifecycle: z.boolean().default(true),
+    /** Track notification events (NOTIFY_CUSTOM_* events) */
+    notifications: z.boolean().default(false),
+    /** Track hotkey usage */
+    hotkeys: z.boolean().default(false),
+});
+export const AnalyticsConfigSchema = z.object({
+    /** Master switch — false = no analytics at all, regardless of user consent */
+    enabled: z.boolean().default(false),
+    /** Registered analytics providers */
+    providers: z.array(AnalyticsProviderConfigSchema).default([]),
+    /** Minimum consent level required for analytics (defaults to ANALYTICS) */
+    requiredConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.ANALYTICS),
+    /**
+     * SINGLE DECLARATION SURFACE for all value moments.
+     * TTFV, aha moments, activation stages, and anti-patterns are all here,
+     * distinguished by their `role` field.
+     */
+    valueMoments: z.array(ValueMomentSchema).optional(),
+    /** Persistence and evaluation configuration */
+    persistence: z.object({
+        /** Persist achieved moments to localStorage (default: true) */
+        localStorage: z.boolean().default(true),
+        /** Sync achieved moments to backend (default: true) */
+        backendSync: z.boolean().default(true),
+        /**
+         * Backend evaluates RESOURCE_STATE signals + cronjob-originated events.
+         * When true, RESOURCE_STATE signals are evaluated by the backend engine (authoritative).
+         * When false, frontend does optimistic cached count queries.
+         */
+        backendEvaluation: z.boolean().default(true),
+    }).default({
+        localStorage: true,
+        backendSync: true,
+        backendEvaluation: true,
+    }),
+    /** Auto-instrumentation configuration */
+    autoInstrumentation: AutoInstrumentationConfigSchema.default({
+        pageViews: true,
+        resourceOperations: true,
+        trackErrors: true,
+        featureGate: true,
+        userLifecycle: true,
+        notifications: false,
+        hotkeys: false,
+    }),
+});
+// =====================================================
+// Main Shared App Configuration
+// =====================================================
+export const AppConfiguration_Shared_Schema = z.object({
+    appIdentity: AppConfiguration_Shared_AppIdentity_Schema,
+    appPreferences: z.object({
+        languages: AppConfiguration_Shared_AppPreferencesLanguage_Schema,
+    }),
+    apiJwtPublicKey: z.string().min(1, { error: 'API JWT public key is required' }),
+    runtime: AppConfiguration_Shared_RuntimeSchema,
+    auth: AppConfiguration_Shared_AuthSchema,
+    /** User types — required. No implicit defaults. */
+    userTypes: UserTypesConfigSchema,
+    /** Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. */
+    frontendServices: FrontendServicesConfigSchema,
+    /** Org typing. Optional — only for apps with typed organizations. */
+    organizationTypes: OrganizationTypesConfigSchema.optional(),
+    compliance: AppConfiguration_Shared_ComplianceSchema,
+    // Billing Configuration (optional: billing disabled by default)
+    billing: BillingConfigurationSchema.optional(),
+    // Analytics Configuration (optional: analytics disabled by default)
+    analytics: AnalyticsConfigSchema.optional(),
+    // Lifecycle Configuration (optional: lifecycle disabled by default)
+    lifecycle: LifecycleConfigSchema.optional(),
+});
+//# sourceMappingURL=app-configuration-shared.shared.schemas.js.map

package/dist/esm/config/app-configuration-shared.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-configuration-shared.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAC3I,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,8EAA8E;IAC9E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,mBAAmB;CACzB,CAAC;AAMX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzD,6EAA6E;IAE7E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF,YAAY,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACjD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjB,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC;IAE3F,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE5D,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE5C,sDAAsD;IACtD,kFAAkF;IAClF,8EAA8E;CAE/E,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC;IAChG,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;CAEpH,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACrE,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAC7D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACzG,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAsC,aAA2B,EAAE,EAAE;IAC/H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC,+BAA+B,CAAC,CAAC;AAInI,wDAAwD;AACxD,0BAA0B;AAC1B,wDAAwD;AAExD,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,wDAA+B,CAAA;AACjC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,6GAA6G;IAC7G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kEAAkE;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEnC,qCAAqC;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,2EAA2E;IAC3E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAEvF;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,+DAA+D;QAC/D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,yCAAyC;IACzC,mBAAmB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC,CAAC;AAGH,wDAAwD;AACxD,gCAAgC;AAChC,wDAAwD;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAErD,WAAW,EAAE,0CAA0C;IAEvD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,qDAAqD;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAE/E,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,mDAAmD;IACnD,SAAS,EAAE,qBAAqB;IAChC,0HAA0H;IAC1H,gBAAgB,EAAE,4BAA4B;IAC9C,qEAAqE;IACrE,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,wCAAwC;IAEpD,gEAAgE;IAChE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAE9C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAE5C,CAAC,CAAC"}

package/dist/esm/config/auth-config-resolution.shared.utils.d.ts

@@ -0,0 +1,28 @@
+/**
+ * W5.8: Auth Config Resolution — 3-tier merge with org overrides.
+ *
+ * Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).
+ * Multi-org: each org type override resolved independently, then most-restrictive across all.
+ *
+ * This is a pure function — no DI, no DB, no side effects.
+ */
+import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
+import { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas.js';
+import type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig } from './entity-identity-config.shared.schemas.js';
+type AuthMethodsMap = Partial<Record<AuthMethod, boolean | {
+    enabled: boolean;
+}>>;
+export interface AuthConfigResolutionInput {
+    userTypeAuth: UserTypeAuthPolicy;
+    orgOverrides: OrgTypeAuthOverrides[];
+    orgAuthMethodPolicy: OrgAuthMethodPolicy;
+    expandableOrgMethods?: AuthMethod[];
+}
+export interface ResolvedAuthConfig {
+    authMethodsEnabled: AuthMethodsMap;
+    mfaPolicy: MfaPolicyConfig;
+    passwordPolicy: PasswordPolicyConfig;
+}
+export declare function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig;
+export {};
+//# sourceMappingURL=auth-config-resolution.shared.utils.d.ts.map

package/dist/esm/config/auth-config-resolution.shared.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-config-resolution.shared.utils.d.ts","sourceRoot":"","sources":["../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/I,KAAK,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAAC;AAElF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,cAAc,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,oBAAoB,CAAC;CACtC;AAqOD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CAwBtF"}

package/dist/esm/config/auth-config-resolution.shared.utils.js

@@ -0,0 +1,211 @@
+/**
+ * W5.8: Auth Config Resolution — 3-tier merge with org overrides.
+ *
+ * Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).
+ * Multi-org: each org type override resolved independently, then most-restrictive across all.
+ *
+ * This is a pure function — no DI, no DB, no side effects.
+ */
+import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
+import { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas.js';
+function isMethodEnabled(value) {
+    if (value === undefined)
+        return false;
+    if (typeof value === 'boolean')
+        return value;
+    return value.enabled;
+}
+function getEnabledMethods(map) {
+    if (!map)
+        return new Set();
+    const result = new Set();
+    for (const [method, value] of Object.entries(map)) {
+        if (isMethodEnabled(value))
+            result.add(method);
+    }
+    return result;
+}
+function setToMethodsMap(methods) {
+    const result = {};
+    for (const method of Object.values(AuthMethod)) {
+        result[method] = methods.has(method);
+    }
+    return result;
+}
+// ─── Auth Methods Resolution ────────────────────────────────────────────────
+function resolveAuthMethodsSingle(userTypeMethods, orgOverride, policy, expandable) {
+    if (!orgOverride?.authMethodsEnabled)
+        return new Set(userTypeMethods);
+    const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);
+    switch (policy) {
+        case OrgAuthMethodPolicy.RESTRICT_ONLY:
+            return intersection(userTypeMethods, orgMethods);
+        case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {
+            const expandableSet = new Set(expandable);
+            const expansions = intersection(orgMethods, expandableSet);
+            return union(userTypeMethods, expansions);
+        }
+        case OrgAuthMethodPolicy.UNRESTRICTED:
+            return new Set(orgMethods);
+        default:
+            return new Set(userTypeMethods);
+    }
+}
+function resolveAuthMethodsMultiOrg(userTypeMethods, orgOverrides, policy, expandable) {
+    const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);
+    if (validOverrides.length === 0)
+        return new Set(userTypeMethods);
+    const perOrgResults = validOverrides.map(o => resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable));
+    if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {
+        // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.
+        // Each org may expand within the expandable set, but multi-org users only get
+        // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).
+        return perOrgResults.reduce((acc, set) => intersection(acc, set));
+    }
+    return perOrgResults.reduce((acc, set) => intersection(acc, set));
+}
+// ─── MFA Policy Resolution ─────────────────────────────────────────────────
+function resolveMfaPolicySingle(base, override) {
+    return {
+        requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),
+        requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),
+        acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),
+        enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),
+        passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),
+    };
+}
+function resolveMfaPolicyMultiOrg(base, orgOverrides) {
+    const mfaOverrides = orgOverrides
+        .map(o => o?.mfaPolicy)
+        .filter((p) => !!p);
+    if (mfaOverrides.length === 0)
+        return { ...base };
+    const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));
+    return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));
+}
+function mergeMfaMostRestrictive(a, b) {
+    return {
+        requireMFA: a.requireMFA || b.requireMFA,
+        requireStrongMFA: a.requireStrongMFA || b.requireStrongMFA,
+        acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),
+        enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),
+        passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,
+    };
+}
+// ─── Password Policy Resolution ─────────────────────────────────────────────
+function resolvePasswordPolicySingle(base, override) {
+    return {
+        minLength: mergeNumberHigherWins(base.minLength, override.minLength),
+        maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),
+        requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),
+        requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),
+        requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),
+        requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),
+        expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),
+    };
+}
+function resolvePasswordPolicyMultiOrg(base, orgOverrides) {
+    const pwOverrides = orgOverrides
+        .map(o => o?.passwordPolicy)
+        .filter((p) => !!p);
+    if (pwOverrides.length === 0)
+        return { ...base };
+    const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));
+    return normalizePasswordPolicyBounds(perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)));
+}
+function mergePasswordMostRestrictive(a, b) {
+    return normalizePasswordPolicyBounds({
+        minLength: Math.max(a.minLength, b.minLength),
+        maxLength: Math.min(a.maxLength, b.maxLength),
+        requireUppercase: a.requireUppercase || b.requireUppercase,
+        requireLowercase: a.requireLowercase || b.requireLowercase,
+        requireNumbers: a.requireNumbers || b.requireNumbers,
+        requireSpecialChars: a.requireSpecialChars || b.requireSpecialChars,
+        expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),
+    });
+}
+/**
+ * Independent higher-min / lower-max merges can cross when multiple org overrides
+ * conflict. Collapse that impossible range to an exact-length policy at the stricter
+ * minimum so downstream consumers always receive a valid password policy.
+ */
+function normalizePasswordPolicyBounds(policy) {
+    if (policy.maxLength >= policy.minLength) {
+        return policy;
+    }
+    return {
+        ...policy,
+        maxLength: policy.minLength,
+    };
+}
+// ─── Merge Primitives ───────────────────────────────────────────────────────
+function mergeBoolTrueWins(base, override) {
+    if (override === undefined)
+        return base;
+    return base || override;
+}
+function mergeBoolFalseWins(base, override) {
+    if (override === undefined)
+        return base;
+    return base && override;
+}
+function mergeNumberHigherWins(base, override) {
+    if (override === undefined)
+        return base;
+    return Math.max(base, override);
+}
+function mergeNumberLowerWins(base, override) {
+    if (override === undefined)
+        return base;
+    return Math.min(base, override);
+}
+function mergeExpiryDays(base, override) {
+    if (override === undefined)
+        return base;
+    if (base === 0 && override === 0)
+        return 0;
+    if (base === 0)
+        return override;
+    if (override === 0)
+        return base;
+    return Math.min(base, override);
+}
+function mergeArrayIntersection(a, b) {
+    if (a === undefined)
+        return b;
+    if (b === undefined)
+        return a;
+    const setB = new Set(b);
+    return a.filter(item => setB.has(item));
+}
+// ─── Set Helpers ────────────────────────────────────────────────────────────
+function intersection(a, b) {
+    const result = new Set();
+    for (const item of a) {
+        if (b.has(item))
+            result.add(item);
+    }
+    return result;
+}
+function union(a, b) {
+    return new Set([...a, ...b]);
+}
+// ─── Public API ─────────────────────────────────────────────────────────────
+export function resolveAuthConfig(input) {
+    const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;
+    if (!orgOverrides.length) {
+        return {
+            authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },
+            mfaPolicy: { ...userTypeAuth.mfaPolicy },
+            passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),
+        };
+    }
+    const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);
+    const resolvedMethods = resolveAuthMethodsMultiOrg(userTypeMethods, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods ?? []);
+    return {
+        authMethodsEnabled: setToMethodsMap(resolvedMethods),
+        mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),
+        passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),
+    };
+}
+//# sourceMappingURL=auth-config-resolution.shared.utils.js.map

package/dist/esm/config/auth-config-resolution.shared.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAkB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA+B;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;SAClF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;KACzF,CAAC;AACJ,CAAC"}

package/dist/esm/config/configuration-validation.shared.schemas.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Configuration Validation — shared contract for startup cross-checks.
+ *
+ * Used by both backend (ApplicationStartupConfigValidatorService) and
+ * frontend (future AppShellConfigValidatorService) to produce structured
+ * validation reports after registry initialization.
+ *
+ * Each validator returns ConfigurationValidationIssue[] and the runner
+ * collects, logs, and optionally throws on errors.
+ */
+export declare enum ConfigurationValidationSeverity {
+    ERROR = "ERROR",
+    WARNING = "WARNING"
+}
+export declare enum ConfigurationValidationDomain {
+    STORAGE = "STORAGE",
+    AUTH = "AUTH",
+    AGENTS = "AGENTS",
+    FRONTEND_SERVICES = "FRONTEND_SERVICES",
+    FEATURES = "FEATURES",
+    BILLING = "BILLING",
+    LIFECYCLE = "LIFECYCLE",
+    I18N = "I18N"
+}
+export interface ConfigurationValidationIssue {
+    severity: ConfigurationValidationSeverity;
+    domain: ConfigurationValidationDomain;
+    message: string;
+    context?: Record<string, unknown>;
+}
+export interface ConfigurationValidationResult {
+    issues: ConfigurationValidationIssue[];
+    valid: boolean;
+}
+export declare function buildValidationResult(issues: ConfigurationValidationIssue[]): ConfigurationValidationResult;
+export declare function issueError(domain: ConfigurationValidationDomain, message: string, context?: Record<string, unknown>): ConfigurationValidationIssue;
+export declare function issueWarning(domain: ConfigurationValidationDomain, message: string, context?: Record<string, unknown>): ConfigurationValidationIssue;
+//# sourceMappingURL=configuration-validation.shared.schemas.d.ts.map

package/dist/esm/config/configuration-validation.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-validation.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/configuration-validation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,oBAAY,+BAA+B;IACzC,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAMD,oBAAY,6BAA6B;IACvC,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,iBAAiB,sBAAsB;IACvC,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAMD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,+BAA+B,CAAC;IAC1C,MAAM,EAAE,6BAA6B,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAMD,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACvC,KAAK,EAAE,OAAO,CAAC;CAChB;AAMD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,4BAA4B,EAAE,GAAG,6BAA6B,CAK3G;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,6BAA6B,EACrC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,4BAA4B,CAE9B;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,6BAA6B,EACrC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,4BAA4B,CAE9B"}

package/dist/esm/config/configuration-validation.shared.schemas.js

@@ -0,0 +1,48 @@
+/**
+ * Configuration Validation — shared contract for startup cross-checks.
+ *
+ * Used by both backend (ApplicationStartupConfigValidatorService) and
+ * frontend (future AppShellConfigValidatorService) to produce structured
+ * validation reports after registry initialization.
+ *
+ * Each validator returns ConfigurationValidationIssue[] and the runner
+ * collects, logs, and optionally throws on errors.
+ */
+// ---------------------------------------------------------------------------
+// Issue severity
+// ---------------------------------------------------------------------------
+export var ConfigurationValidationSeverity;
+(function (ConfigurationValidationSeverity) {
+    ConfigurationValidationSeverity["ERROR"] = "ERROR";
+    ConfigurationValidationSeverity["WARNING"] = "WARNING";
+})(ConfigurationValidationSeverity || (ConfigurationValidationSeverity = {}));
+// ---------------------------------------------------------------------------
+// Validation domain — groups related cross-checks
+// ---------------------------------------------------------------------------
+export var ConfigurationValidationDomain;
+(function (ConfigurationValidationDomain) {
+    ConfigurationValidationDomain["STORAGE"] = "STORAGE";
+    ConfigurationValidationDomain["AUTH"] = "AUTH";
+    ConfigurationValidationDomain["AGENTS"] = "AGENTS";
+    ConfigurationValidationDomain["FRONTEND_SERVICES"] = "FRONTEND_SERVICES";
+    ConfigurationValidationDomain["FEATURES"] = "FEATURES";
+    ConfigurationValidationDomain["BILLING"] = "BILLING";
+    ConfigurationValidationDomain["LIFECYCLE"] = "LIFECYCLE";
+    ConfigurationValidationDomain["I18N"] = "I18N";
+})(ConfigurationValidationDomain || (ConfigurationValidationDomain = {}));
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+export function buildValidationResult(issues) {
+    return {
+        issues,
+        valid: issues.every((i) => i.severity !== ConfigurationValidationSeverity.ERROR),
+    };
+}
+export function issueError(domain, message, context) {
+    return { severity: ConfigurationValidationSeverity.ERROR, domain, message, context };
+}
+export function issueWarning(domain, message, context) {
+    return { severity: ConfigurationValidationSeverity.WARNING, domain, message, context };
+}
+//# sourceMappingURL=configuration-validation.shared.schemas.js.map

package/dist/esm/config/configuration-validation.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-validation.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/configuration-validation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAN,IAAY,+BAGX;AAHD,WAAY,+BAA+B;IACzC,kDAAe,CAAA;IACf,sDAAmB,CAAA;AACrB,CAAC,EAHW,+BAA+B,KAA/B,+BAA+B,QAG1C;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,CAAN,IAAY,6BASX;AATD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,8CAAa,CAAA;IACb,kDAAiB,CAAA;IACjB,wEAAuC,CAAA;IACvC,sDAAqB,CAAA;IACrB,oDAAmB,CAAA;IACnB,wDAAuB,CAAA;IACvB,8CAAa,CAAA;AACf,CAAC,EATW,6BAA6B,KAA7B,6BAA6B,QASxC;AAsBD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,UAAU,qBAAqB,CAAC,MAAsC;IAC1E,OAAO;QACL,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,+BAA+B,CAAC,KAAK,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAqC,EACrC,OAAe,EACf,OAAiC;IAEjC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAqC,EACrC,OAAe,EACf,OAAiC;IAEjC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACzF,CAAC"}