@wildo-ai/saas-models 1.0.1

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts

@@ -0,0 +1,402 @@
+/**
+ * Entity & Identity Configuration Schemas
+ *
+ * Top-level config sections: userTypes, frontendServices, organizationTypes.
+ * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).
+ *
+ * Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.
+ * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.
+ *
+ * See:
+ *   - target-configuration-type.md §2b (UserTypeAuthPolicy)
+ *   - entity-identity-architecture-analysis.md §4.2
+ */
+import { z } from 'zod';
+import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
+import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+/** R-1: Single discriminant replacing enabled/invitationOnly/selfRegistration. */
+export declare enum RegistrationMode {
+    OPEN = "open",
+    INVITATION_ONLY = "invitation_only",
+    ADMIN_ONLY = "admin_only",
+    DISABLED = "disabled"
+}
+/** D-19: Email verification timing. */
+export declare enum EmailVerificationMode {
+    REQUIRED_BEFORE_ACCESS = "required_before_access",
+    DEFERRED = "deferred"
+}
+/** E-10, D-15: How much orgs can override user-type auth methods. */
+export declare enum OrgAuthMethodPolicy {
+    RESTRICT_ONLY = "restrict_only",
+    EXPAND_WITHIN_SET = "expand_within_set",
+    UNRESTRICTED = "unrestricted"
+}
+export declare const AuthMethodExpandedConfigSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;
+export declare const MfaPolicyConfigSchema: z.ZodObject<{
+    requireMFA: z.ZodDefault<z.ZodBoolean>;
+    requireStrongMFA: z.ZodDefault<z.ZodBoolean>;
+    acceptableMFAMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+    enrollmentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
+    passkeyExemptFromMFA: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;
+/** R-1: Registration with mode discriminant. No more enabled/invitationOnly/selfRegistration booleans. */
+export declare const RegistrationConfigSchema: z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<typeof RegistrationMode>>;
+    allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+    requirePasswordOnRegister: z.ZodDefault<z.ZodBoolean>;
+    emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
+    blockForSSODomains: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;
+/**
+ * Password policy — includes expiryDays (R-8, moved from flat auth field).
+ * Defined here (not in app-configuration-shared) to avoid circular dependency.
+ * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.
+ */
+export declare const PasswordPolicyConfigSchema: z.ZodObject<{
+    minLength: z.ZodDefault<z.ZodNumber>;
+    maxLength: z.ZodDefault<z.ZodNumber>;
+    requireUppercase: z.ZodDefault<z.ZodBoolean>;
+    requireLowercase: z.ZodDefault<z.ZodBoolean>;
+    requireNumbers: z.ZodDefault<z.ZodBoolean>;
+    requireSpecialChars: z.ZodDefault<z.ZodBoolean>;
+    expiryDays: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;
+/** E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. */
+export declare const StepUpAuthConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    maxAgeSeconds: z.ZodDefault<z.ZodNumber>;
+    methods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;
+export declare const LockoutPolicyConfigSchema: z.ZodObject<{
+    maxLoginAttempts: z.ZodDefault<z.ZodNumber>;
+    lockoutDurationMinutes: z.ZodDefault<z.ZodNumber>;
+    progressiveLockout: z.ZodDefault<z.ZodBoolean>;
+    maxProgressiveLockoutHours: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;
+export declare const MethodManagementConfigSchema: z.ZodObject<{
+    allowUserMethodRemoval: z.ZodDefault<z.ZodBoolean>;
+    requireReauthForMethodChanges: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;
+/**
+ * The complete auth policy for a user type. Every user type MUST define this.
+ * There are no global auth defaults — this IS the auth config.
+ *
+ * Zod .default() values enable omission in config input files, but the
+ * resolved runtime type has all fields present (no optionals for policy fields).
+ *
+ * See target-configuration-type.md §2b for full specification.
+ */
+export declare const UserTypeAuthPolicySchema: z.ZodObject<{
+    authMethodsEnabled: z.ZodDefault<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+        enabled: z.ZodBoolean;
+    }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+    mfaPolicy: z.ZodDefault<z.ZodObject<{
+        requireMFA: z.ZodDefault<z.ZodBoolean>;
+        requireStrongMFA: z.ZodDefault<z.ZodBoolean>;
+        acceptableMFAMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+        enrollmentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
+        passkeyExemptFromMFA: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    registration: z.ZodDefault<z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<typeof RegistrationMode>>;
+        allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+        requirePasswordOnRegister: z.ZodDefault<z.ZodBoolean>;
+        emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
+        blockForSSODomains: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    passwordPolicy: z.ZodDefault<z.ZodObject<{
+        minLength: z.ZodDefault<z.ZodNumber>;
+        maxLength: z.ZodDefault<z.ZodNumber>;
+        requireUppercase: z.ZodDefault<z.ZodBoolean>;
+        requireLowercase: z.ZodDefault<z.ZodBoolean>;
+        requireNumbers: z.ZodDefault<z.ZodBoolean>;
+        requireSpecialChars: z.ZodDefault<z.ZodBoolean>;
+        expiryDays: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    sessionDurationMinutes: z.ZodDefault<z.ZodNumber>;
+    maxConcurrentSessions: z.ZodOptional<z.ZodNumber>;
+    lockoutPolicy: z.ZodDefault<z.ZodObject<{
+        maxLoginAttempts: z.ZodDefault<z.ZodNumber>;
+        lockoutDurationMinutes: z.ZodDefault<z.ZodNumber>;
+        progressiveLockout: z.ZodDefault<z.ZodBoolean>;
+        maxProgressiveLockoutHours: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    autoLinkByEmail: z.ZodDefault<z.ZodBoolean>;
+    stepUpAuth: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxAgeSeconds: z.ZodDefault<z.ZodNumber>;
+        methods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    methodManagement: z.ZodDefault<z.ZodObject<{
+        allowUserMethodRemoval: z.ZodDefault<z.ZodBoolean>;
+        requireReauthForMethodChanges: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    anonymousSessionsEnabled: z.ZodOptional<z.ZodBoolean>;
+    oneOffSessionAllowed: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;
+export declare const UserTypeDefinitionSchema: z.ZodObject<{
+    auth: z.ZodObject<{
+        authMethodsEnabled: z.ZodDefault<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+        mfaPolicy: z.ZodDefault<z.ZodObject<{
+            requireMFA: z.ZodDefault<z.ZodBoolean>;
+            requireStrongMFA: z.ZodDefault<z.ZodBoolean>;
+            acceptableMFAMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+            enrollmentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
+            passkeyExemptFromMFA: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        registration: z.ZodDefault<z.ZodObject<{
+            mode: z.ZodDefault<z.ZodEnum<typeof RegistrationMode>>;
+            allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+            requirePasswordOnRegister: z.ZodDefault<z.ZodBoolean>;
+            emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
+            blockForSSODomains: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        passwordPolicy: z.ZodDefault<z.ZodObject<{
+            minLength: z.ZodDefault<z.ZodNumber>;
+            maxLength: z.ZodDefault<z.ZodNumber>;
+            requireUppercase: z.ZodDefault<z.ZodBoolean>;
+            requireLowercase: z.ZodDefault<z.ZodBoolean>;
+            requireNumbers: z.ZodDefault<z.ZodBoolean>;
+            requireSpecialChars: z.ZodDefault<z.ZodBoolean>;
+            expiryDays: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        sessionDurationMinutes: z.ZodDefault<z.ZodNumber>;
+        maxConcurrentSessions: z.ZodOptional<z.ZodNumber>;
+        lockoutPolicy: z.ZodDefault<z.ZodObject<{
+            maxLoginAttempts: z.ZodDefault<z.ZodNumber>;
+            lockoutDurationMinutes: z.ZodDefault<z.ZodNumber>;
+            progressiveLockout: z.ZodDefault<z.ZodBoolean>;
+            maxProgressiveLockoutHours: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        autoLinkByEmail: z.ZodDefault<z.ZodBoolean>;
+        stepUpAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            maxAgeSeconds: z.ZodDefault<z.ZodNumber>;
+            methods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        methodManagement: z.ZodDefault<z.ZodObject<{
+            allowUserMethodRemoval: z.ZodDefault<z.ZodBoolean>;
+            requireReauthForMethodChanges: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        anonymousSessionsEnabled: z.ZodOptional<z.ZodBoolean>;
+        oneOffSessionAllowed: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip, core.$ZodObjectExtra>;
+    uniqueIdentifier: z.ZodDefault<z.ZodString>;
+    defaultAppRoles: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodString]>>>;
+    requiresOrgMembership: z.ZodOptional<z.ZodObject<{
+        orgTypes: z.ZodArray<z.ZodString>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;
+export declare const FrontendServiceUserManagementEntrySchema: z.ZodObject<{
+    register: z.ZodBoolean;
+    auth: z.ZodBoolean;
+    isDefault: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;
+export declare const FrontendServiceDefinitionSchema: z.ZodObject<{
+    usersManagement: z.ZodRecord<z.ZodString, z.ZodObject<{
+        register: z.ZodBoolean;
+        auth: z.ZodBoolean;
+        isDefault: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;
+export declare const OrgCreationPolicySchema: z.ZodObject<{
+    createOnUserTypeRegistration: z.ZodArray<z.ZodString>;
+    orgNameSource: z.ZodEnum<{
+        auto: "auto";
+        ask: "ask";
+        onboarding: "onboarding";
+    }>;
+    defaultOwnerRole: z.ZodDefault<z.ZodString>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;
+/** D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. */
+export declare const OrgTypeAuthOverridesSchema: z.ZodOptional<z.ZodObject<{
+    authMethodsEnabled: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+        enabled: z.ZodBoolean;
+    }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+    mfaPolicy: z.ZodOptional<z.ZodObject<{
+        requireMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        requireStrongMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        acceptableMFAMethods: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+        enrollmentGracePeriodDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        passkeyExemptFromMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    passwordPolicy: z.ZodOptional<z.ZodObject<{
+        minLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        maxLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        requireUppercase: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        requireLowercase: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        requireNumbers: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip, core.$ZodObjectExtra>>;
+export type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;
+/** G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). */
+export declare const OrgScimProvisioningSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;
+export declare const OrganizationTypeDefinitionSchema: z.ZodObject<{
+    userTypes: z.ZodArray<z.ZodString>;
+    availableOrgRoles: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>, z.ZodString]>>>;
+    defaultMemberRole: z.ZodDefault<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>, z.ZodString]>>;
+    authOverrides: z.ZodOptional<z.ZodObject<{
+        authMethodsEnabled: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+        mfaPolicy: z.ZodOptional<z.ZodObject<{
+            requireMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            requireStrongMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            acceptableMFAMethods: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+            enrollmentGracePeriodDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            passkeyExemptFromMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        passwordPolicy: z.ZodOptional<z.ZodObject<{
+            minLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            maxLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            requireUppercase: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            requireLowercase: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            requireNumbers: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    scimProvisioning: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    creationPolicy: z.ZodOptional<z.ZodObject<{
+        createOnUserTypeRegistration: z.ZodArray<z.ZodString>;
+        orgNameSource: z.ZodEnum<{
+            auto: "auto";
+            ask: "ask";
+            onboarding: "onboarding";
+        }>;
+        defaultOwnerRole: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;
+export declare const UserTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    auth: z.ZodObject<{
+        authMethodsEnabled: z.ZodDefault<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+        mfaPolicy: z.ZodDefault<z.ZodObject<{
+            requireMFA: z.ZodDefault<z.ZodBoolean>;
+            requireStrongMFA: z.ZodDefault<z.ZodBoolean>;
+            acceptableMFAMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+            enrollmentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
+            passkeyExemptFromMFA: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        registration: z.ZodDefault<z.ZodObject<{
+            mode: z.ZodDefault<z.ZodEnum<typeof RegistrationMode>>;
+            allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+            requirePasswordOnRegister: z.ZodDefault<z.ZodBoolean>;
+            emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
+            blockForSSODomains: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        passwordPolicy: z.ZodDefault<z.ZodObject<{
+            minLength: z.ZodDefault<z.ZodNumber>;
+            maxLength: z.ZodDefault<z.ZodNumber>;
+            requireUppercase: z.ZodDefault<z.ZodBoolean>;
+            requireLowercase: z.ZodDefault<z.ZodBoolean>;
+            requireNumbers: z.ZodDefault<z.ZodBoolean>;
+            requireSpecialChars: z.ZodDefault<z.ZodBoolean>;
+            expiryDays: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        sessionDurationMinutes: z.ZodDefault<z.ZodNumber>;
+        maxConcurrentSessions: z.ZodOptional<z.ZodNumber>;
+        lockoutPolicy: z.ZodDefault<z.ZodObject<{
+            maxLoginAttempts: z.ZodDefault<z.ZodNumber>;
+            lockoutDurationMinutes: z.ZodDefault<z.ZodNumber>;
+            progressiveLockout: z.ZodDefault<z.ZodBoolean>;
+            maxProgressiveLockoutHours: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        autoLinkByEmail: z.ZodDefault<z.ZodBoolean>;
+        stepUpAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            maxAgeSeconds: z.ZodDefault<z.ZodNumber>;
+            methods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        methodManagement: z.ZodDefault<z.ZodObject<{
+            allowUserMethodRemoval: z.ZodDefault<z.ZodBoolean>;
+            requireReauthForMethodChanges: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        anonymousSessionsEnabled: z.ZodOptional<z.ZodBoolean>;
+        oneOffSessionAllowed: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip, core.$ZodObjectExtra>;
+    uniqueIdentifier: z.ZodDefault<z.ZodString>;
+    defaultAppRoles: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodString]>>>;
+    requiresOrgMembership: z.ZodOptional<z.ZodObject<{
+        orgTypes: z.ZodArray<z.ZodString>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip, core.$ZodObjectExtra>>;
+export type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;
+export declare const FrontendServicesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    usersManagement: z.ZodRecord<z.ZodString, z.ZodObject<{
+        register: z.ZodBoolean;
+        auth: z.ZodBoolean;
+        isDefault: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip, core.$ZodObjectExtra>>;
+export type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;
+export declare const OrganizationTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    userTypes: z.ZodArray<z.ZodString>;
+    availableOrgRoles: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>, z.ZodString]>>>;
+    defaultMemberRole: z.ZodDefault<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>, z.ZodString]>>;
+    authOverrides: z.ZodOptional<z.ZodObject<{
+        authMethodsEnabled: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strip, core.$ZodObjectExtra>]>>>;
+        mfaPolicy: z.ZodOptional<z.ZodObject<{
+            requireMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            requireStrongMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            acceptableMFAMethods: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+            enrollmentGracePeriodDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            passkeyExemptFromMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+        passwordPolicy: z.ZodOptional<z.ZodObject<{
+            minLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            maxLength: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            requireUppercase: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            requireLowercase: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            requireNumbers: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    scimProvisioning: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    creationPolicy: z.ZodOptional<z.ZodObject<{
+        createOnUserTypeRegistration: z.ZodArray<z.ZodString>;
+        orgNameSource: z.ZodEnum<{
+            auto: "auto";
+            ask: "ask";
+            onboarding: "onboarding";
+        }>;
+        defaultOwnerRole: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip, core.$ZodObjectExtra>>;
+export type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;
+//# sourceMappingURL=entity-identity-config.shared.schemas.d.ts.map

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AAIjG,kFAAkF;AAClF,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;uCAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAUtF,eAAO,MAAM,qBAAqB;;;;;;uCAUhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,0GAA0G;AAC1G,eAAO,MAAM,wBAAwB;;;;;;uCAUnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;uCASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;uCAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;uCAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;uCAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAmEnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAanC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;uCAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G,eAAO,MAAM,+BAA+B;;;;;;uCAE1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF,eAAO,MAAM,uBAAuB;;;;;;;;uCAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;wCAI1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB;;;uCAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAoB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAI1F,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAAiD,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;wCAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAAyD,CAAC;AACpG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/esm/config/entity-identity-config.shared.schemas.js

@@ -0,0 +1,228 @@
+/**
+ * Entity & Identity Configuration Schemas
+ *
+ * Top-level config sections: userTypes, frontendServices, organizationTypes.
+ * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).
+ *
+ * Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.
+ * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.
+ *
+ * See:
+ *   - target-configuration-type.md §2b (UserTypeAuthPolicy)
+ *   - entity-identity-architecture-analysis.md §4.2
+ */
+import { z } from 'zod';
+import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
+import { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas.js';
+// ─── Enums ──────────────────────────────────────────────────────────────────
+/** R-1: Single discriminant replacing enabled/invitationOnly/selfRegistration. */
+export var RegistrationMode;
+(function (RegistrationMode) {
+    RegistrationMode["OPEN"] = "open";
+    RegistrationMode["INVITATION_ONLY"] = "invitation_only";
+    RegistrationMode["ADMIN_ONLY"] = "admin_only";
+    RegistrationMode["DISABLED"] = "disabled";
+})(RegistrationMode || (RegistrationMode = {}));
+/** D-19: Email verification timing. */
+export var EmailVerificationMode;
+(function (EmailVerificationMode) {
+    EmailVerificationMode["REQUIRED_BEFORE_ACCESS"] = "required_before_access";
+    EmailVerificationMode["DEFERRED"] = "deferred";
+})(EmailVerificationMode || (EmailVerificationMode = {}));
+/** E-10, D-15: How much orgs can override user-type auth methods. */
+export var OrgAuthMethodPolicy;
+(function (OrgAuthMethodPolicy) {
+    OrgAuthMethodPolicy["RESTRICT_ONLY"] = "restrict_only";
+    OrgAuthMethodPolicy["EXPAND_WITHIN_SET"] = "expand_within_set";
+    OrgAuthMethodPolicy["UNRESTRICTED"] = "unrestricted";
+})(OrgAuthMethodPolicy || (OrgAuthMethodPolicy = {}));
+// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────
+export const AuthMethodExpandedConfigSchema = z.object({
+    enabled: z.boolean(),
+});
+/**
+ * authMethodsEnabled value: boolean shorthand OR expanded config.
+ * Shorthand: PASSWORD: true → normalized at runtime to { enabled: true }.
+ */
+const AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);
+// ─── Policy Sub-Types ───────────────────────────────────────────────────────
+export const MfaPolicyConfigSchema = z.object({
+    requireMFA: z.boolean().default(false),
+    /** D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. */
+    requireStrongMFA: z.boolean().default(false),
+    /** Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. */
+    acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),
+    /** D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. */
+    enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),
+    /** C-5 migration: moves from AuthPolicyBase to config. Passkey IS multi-factor. */
+    passkeyExemptFromMFA: z.boolean().default(true),
+});
+/** R-1: Registration with mode discriminant. No more enabled/invitationOnly/selfRegistration booleans. */
+export const RegistrationConfigSchema = z.object({
+    mode: z.enum(RegistrationMode).default(RegistrationMode.OPEN),
+    /** D-6: Only listed methods allowed for first-time registration. Relevant when mode='open'. */
+    allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),
+    /** D-7: false enables passkey-only or magic-link-only registration. Relevant when mode='open'. */
+    requirePasswordOnRegister: z.boolean().default(true),
+    /** D-19: 'deferred' gives immediate access, verify later. */
+    emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),
+    /** R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. */
+    blockForSSODomains: z.boolean().default(false),
+});
+/**
+ * Password policy — includes expiryDays (R-8, moved from flat auth field).
+ * Defined here (not in app-configuration-shared) to avoid circular dependency.
+ * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.
+ */
+export const PasswordPolicyConfigSchema = z.object({
+    minLength: z.number().min(6).max(128).default(8),
+    maxLength: z.number().min(8).max(256).default(128),
+    requireUppercase: z.boolean().default(true),
+    requireLowercase: z.boolean().default(true),
+    requireNumbers: z.boolean().default(true),
+    requireSpecialChars: z.boolean().default(false),
+    /** R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). */
+    expiryDays: z.number().min(0).default(0),
+});
+/** E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. */
+export const StepUpAuthConfigSchema = z.object({
+    enabled: z.boolean().default(false),
+    maxAgeSeconds: z.number().min(60).max(3600).default(300),
+    methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),
+});
+export const LockoutPolicyConfigSchema = z.object({
+    maxLoginAttempts: z.number().min(3).max(20).default(5),
+    lockoutDurationMinutes: z.number().min(1).max(1440).default(30),
+    /** W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. */
+    progressiveLockout: z.boolean().default(false),
+    /** W2.3: cap for progressive lockout duration in hours. */
+    maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),
+});
+export const MethodManagementConfigSchema = z.object({
+    allowUserMethodRemoval: z.boolean().default(true),
+    requireReauthForMethodChanges: z.boolean().default(false),
+});
+// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────
+/**
+ * The complete auth policy for a user type. Every user type MUST define this.
+ * There are no global auth defaults — this IS the auth config.
+ *
+ * Zod .default() values enable omission in config input files, but the
+ * resolved runtime type has all fields present (no optionals for policy fields).
+ *
+ * See target-configuration-type.md §2b for full specification.
+ */
+export const UserTypeAuthPolicySchema = z.object({
+    /** E-1, D-20: Opt-in semantics — absent method = disabled. */
+    authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).default({ [AuthMethod.PASSWORD]: true }),
+    /** E-2: MFA enforcement for this user type. */
+    mfaPolicy: MfaPolicyConfigSchema.default({
+        requireMFA: false,
+        requireStrongMFA: false,
+        enrollmentGracePeriodDays: 0,
+        passkeyExemptFromMFA: true,
+    }),
+    /** E-3, R-1: Registration with mode discriminant. */
+    registration: RegistrationConfigSchema.default({
+        mode: RegistrationMode.OPEN,
+        allowedMethods: [AuthMethod.PASSWORD],
+        requirePasswordOnRegister: true,
+        emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,
+        blockForSSODomains: false,
+    }),
+    /** E-7, R-8: Password strength + expiry. */
+    passwordPolicy: PasswordPolicyConfigSchema.default({
+        minLength: 8,
+        maxLength: 128,
+        requireUppercase: true,
+        requireLowercase: true,
+        requireNumbers: true,
+        requireSpecialChars: false,
+        expiryDays: 0,
+    }),
+    /** E-8: Session duration for this user type. */
+    sessionDurationMinutes: z.number().min(1).max(1440).default(30),
+    /** E-8, G-2: undefined = unlimited. */
+    maxConcurrentSessions: z.number().min(1).optional(),
+    /** G-1: Per-user-type lockout. Backend-only. */
+    lockoutPolicy: LockoutPolicyConfigSchema.default({
+        maxLoginAttempts: 5,
+        lockoutDurationMinutes: 30,
+        progressiveLockout: false,
+        maxProgressiveLockoutHours: 24,
+    }),
+    /** G-8: Consumer=true (convenience), Admin=false (security). */
+    autoLinkByEmail: z.boolean().default(true),
+    /** E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). */
+    stepUpAuth: StepUpAuthConfigSchema.optional(),
+    methodManagement: MethodManagementConfigSchema.default({
+        allowUserMethodRemoval: true,
+        requireReauthForMethodChanges: false,
+    }),
+    /** W7.3a: Enables anonymous session support for this user type. When true,
+     *  unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.
+     *  On login/register for this user type, anonymous resources are transposed to the authenticated user. */
+    anonymousSessionsEnabled: z.boolean().optional(),
+    /** W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. */
+    oneOffSessionAllowed: z.boolean().optional(),
+});
+// ─── User Type Definition ───────────────────────────────────────────────────
+export const UserTypeDefinitionSchema = z.object({
+    /** REQUIRED — the complete auth policy for this user type. Not an override of global. */
+    auth: UserTypeAuthPolicySchema,
+    /** DEFERRED: Only 'email' supported. Accepts any string; engine warns if !== 'email'. */
+    uniqueIdentifier: z.string().default('email'),
+    defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),
+    /** D-10: When set, user type auto-revoked when user leaves last org of matching type. */
+    requiresOrgMembership: z.object({
+        orgTypes: z.array(z.string()).min(1),
+    }).optional(),
+});
+// ─── Frontend Service Identity ──────────────────────────────────────────────
+export const FrontendServiceUserManagementEntrySchema = z.object({
+    register: z.boolean(),
+    auth: z.boolean(),
+    isDefault: z.boolean().optional(),
+});
+export const FrontendServiceDefinitionSchema = z.object({
+    usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),
+});
+// ─── Organization Type ──────────────────────────────────────────────────────
+export const OrgCreationPolicySchema = z.object({
+    createOnUserTypeRegistration: z.array(z.string()).min(1),
+    orgNameSource: z.enum(['ask', 'auto', 'onboarding']),
+    defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),
+});
+/** D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. */
+export const OrgTypeAuthOverridesSchema = z.object({
+    authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),
+    mfaPolicy: MfaPolicyConfigSchema.partial().optional(),
+    passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),
+}).optional();
+/** G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). */
+export const OrgScimProvisioningSchema = z.object({
+    enabled: z.boolean().default(false),
+    syncFrequencyHours: z.number().min(1).max(720).default(24),
+});
+export const OrganizationTypeDefinitionSchema = z.object({
+    /** D-10: User types auto-granted when joining this org type. */
+    userTypes: z.array(z.string()).min(1),
+    availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([
+        CORE_ORG_ROLES.ORG_OWNER,
+        CORE_ORG_ROLES.ORG_ADMIN,
+        CORE_ORG_ROLES.ORG_MEMBER,
+    ]),
+    /** R-5: Moved from registration.defaultOrgRole. */
+    defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),
+    /** D-15: Most-restrictive-wins on top of user type auth policy. */
+    authOverrides: OrgTypeAuthOverridesSchema,
+    /** G-4: SCIM provisioning toggle per org type. */
+    scimProvisioning: OrgScimProvisioningSchema.optional(),
+    creationPolicy: OrgCreationPolicySchema.optional(),
+});
+// ─── Top-Level Config Sections ──────────────────────────────────────────────
+export const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);
+export const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);
+export const OrganizationTypesConfigSchema = z.record(z.string(), OrganizationTypeDefinitionSchema);
+//# sourceMappingURL=entity-identity-config.shared.schemas.js.map