npm - @wildo-ai/saas-models - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/saas-models 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (588) hide show

package/dist/esm/config/app-configuration-shared.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-configuration-shared.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAClK,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,mBAAmB;CACzB,CAAC;AAMX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzD,6EAA6E;IAE7E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF;;;;;;;;OAQG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjB,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC;IAE3F,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE5D,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE5C,sDAAsD;IACtD,kFAAkF;IAClF,8EAA8E;CAE/E,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC;IAChG,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAEnH;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC;CAE7F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACrE,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAC7D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACzG,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAsC,aAA2B,EAAE,EAAE;IAC/H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC,+BAA+B,CAAC,CAAC;AAInI,wDAAwD;AACxD,0BAA0B;AAC1B,wDAAwD;AAExD,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,wDAA+B,CAAA;AACjC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,6GAA6G;IAC7G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kEAAkE;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEnC,qCAAqC;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,2EAA2E;IAC3E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAEvF;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,+DAA+D;QAC/D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,yCAAyC;IACzC,mBAAmB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC,CAAC;AAGH,wDAAwD;AACxD,gCAAgC;AAChC,wDAAwD;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAErD,WAAW,EAAE,0CAA0C;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAExD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,qDAAqD;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAE/E,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,mDAAmD;IACnD,SAAS,EAAE,qBAAqB;IAChC,0HAA0H;IAC1H,gBAAgB,EAAE,4BAA4B;IAC9C,qEAAqE;IACrE,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,wCAAwC;IAEpD,gEAAgE;IAChE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAE9C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,yCAAyC;IACzC,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAErD,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,4DAA4D;IAC5D,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAE/C,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAE9C,CAAC,CAAC","sourcesContent":["/*\n Frontend Application Configuration Schemas\n \n Pure frontend configuration schemas that define what configuration\n * the frontend applications expect to receive from backend endpoints.\n \n NOTE: OAuth2 providers are NOT configured here. OAuth2 is a protocol\n * defined at the provider level in external-connectors, just like REST_API\n * and HOOKS protocols. This configuration only enables/disables which\n * external providers are available for SSO authentication.\n /\n\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models';\nimport { z } from 'zod';\nimport { AllSharedApplicationTypes, AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas';\nimport { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas';\nimport { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas';\nimport { ClientInstanceIdScope, DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas';\nimport { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas';\nimport { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas';\nimport { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas';\nimport { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { ValueMomentSchema } from './analytics-value-moments.shared.schemas';\nimport {\n UserTypesConfigSchema,\n FrontendServicesConfigSchema,\n OrganizationTypesConfigSchema,\n OrgAuthMethodPolicy,\n} from './entity-identity-config.shared.schemas';\n\n\n\n/\n Shared Password Policy Rules Schema\n \n Contains ONLY the validation rules that both frontend and backend need.\n * The backend extends these rules with hashing config (argon2 params)\n * via AppConfiguration_AuthSchema in app-config.backend.schemas.ts.\n \n Frontend uses these rules for:\n * - Real-time password strength validation as user types\n * - Password policy indicator in reset/registration forms\n /\n\n\nexport const PasswordPolicyRulesSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /\n R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),\n * NOT used in the client-side password pre-check — but it IS a field of this shared schema and\n * therefore ships wherever the schema is serialized (e.g. `AuthInvitationInfoResponse.passwordPolicy`).\n * Non-secret. (Corrected from the prior \"Backend-only\" which wrongly implied it is never serialized.)\n * NOTE: `PasswordPolicyConfigSchema` (entity-identity-config) must stay field-identical to this schema\n * — the invitation response `.parse()` silently strips any field present there but absent here.\n /\n expiryDays: z.number().min(0).default(0),\n});\n\nexport type PasswordPolicyRules = z.infer<typeof PasswordPolicyRulesSchema>;\n\n/\n I18n label keys for password policy violations.\n * Values match PasswordPolicyLabel in presets-components-models for frontend resolution.\n * Labels support placeholders: policyMinLength → {minLength}, policyMaxLength → {maxLength}.\n /\nexport const PasswordPolicyViolationCode = {\n MIN_LENGTH: 'policyMinLength',\n MAX_LENGTH: 'policyMaxLength',\n UPPERCASE: 'policyUppercase',\n LOWERCASE: 'policyLowercase',\n NUMBER: 'policyNumber',\n SPECIAL_CHAR: 'policySpecialChar',\n} as const;\n\nexport type PasswordPolicyViolationCode = (typeof PasswordPolicyViolationCode)[keyof typeof PasswordPolicyViolationCode];\n\n\n\n/\n Global Auth Config — infrastructure + app-level only.\n \n Auth POLICY (authMethodsEnabled, mfaPolicy, registration, passwordPolicy,\n * sessionDurationMinutes, lockoutPolicy, autoLinkByEmail, stepUpAuth,\n * methodManagement) is now per-user-type on UserTypeAuthPolicySchema\n * in entity-identity-config.shared.schemas.ts.\n \n This section retains only infrastructure and app-level settings that apply\n * equally regardless of user type.\n \n /\nexport const AppConfiguration_Shared_AuthSchema = z.object({\n\n // ─── INFRASTRUCTURE (stays on global auth) ────────────────────────────────\n\n passkeyConfig: z.object({\n rpName: z.string().min(1),\n rpId: z.string().min(1),\n maxPasskeysPerUser: z.number().min(1).max(50).default(10),\n }),\n\n /*\n Minimal frontend-facing social OAuth2 projection.\n \n Backend runtime still owns the full backend-private\n * `auth.socialOAuth2Providers` authoring shape\n * (enabled flags, scopes, allowed domains, secrets-related semantics). The\n * shared `/application-config` payload only needs the enabled public provider\n * refs plus an optional app-authored display-name override.\n /\n socialOAuth2Providers: z.record(\n z.string(),\n z.object({\n displayName: z.string().optional(),\n })).default({}),\n\n /* E-10, D-15: How much orgs can override user-type auth methods. /\n orgAuthMethodPolicy: z.enum(OrgAuthMethodPolicy).default(OrgAuthMethodPolicy.RESTRICT_ONLY),\n\n /* E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. /\n expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),\n\n /* E-4, D-2: Can a user authenticated via Org A SSO access Org B? /\n crossOrgSSOAccess: z.boolean().default(true),\n\n // W6.8: All per-user-type auth policy fields REMOVED.\n // Use userTypes[t].auth. instead (see entity-identity-config.shared.schemas.ts).\n // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).\n\n});\n\n\n\n\nexport const AppConfiguration_Shared_ComplianceSchema = z.object({\n userProfileVisibility: z.enum(UserProfileVisibility).default(UserProfileVisibility.ORGANIZATION),\n organizationProfileVisibility: z.enum(OrganizationProfileVisibility).default(OrganizationProfileVisibility.PRIVATE),\n\n /*\n Client-install identification policy (`clientInstanceId`) — OFF unless authored.\n \n Lives on `compliance` because it is a privacy decision, not an observability knob, and lives on\n * the SHARED config because both halves of the mechanism must obey ONE authored value: the\n * frontend decides whether to mint/store/send the id, and the backend independently decides\n * whether to ingest and record it. Two gates, one source — an application that never opts in is\n * protected even if some client sends the header anyway.\n \n Defaults to {@link ClientInstanceIdScope.DISABLED} so the privacy-preserving posture is the one\n * you get by doing nothing. See the enum's JSDoc for the ePrivacy/GDPR/NIST reasoning and the\n * obligations attached to each non-`DISABLED` member.\n /\n clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),\n\n});\n\n\n\nexport const AppConfiguration_Shared_AppIdentity_Schema = z.object({\n /* Technical app name — used as fallback when displayName is absent /\n appName: z.string().min(1, { error: 'Application name is required' }),\n /* Human-readable display name shown in UI and emails /\n displayName: z.string().optional(),\n /* Short description of the application /\n description: z.string().optional(),\n version: z.string().min(1, { error: 'Version is required' }),\n});\n\n\nexport const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({\n defaultLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n enabledLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]),\n fallbackLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n autoDetectFromBrowser: z.boolean().default(true),\n allowUserOverride: z.boolean().default(true),\n allowOrganizationOverride: z.boolean().default(true),\n enableLanguageSwitcher: z.boolean().default(true)\n});\n\n\nexport const appConfiguration_Shared_RuntimeSchemaBuilder = <T extends AllSharedApplicationTypes>(appTypeSchema: z.ZodType<T>) => {\n return z.object({\n endPoints: z.record(z.string(), z.object({\n publicUrl: z.string().optional(),\n internalUrl: z.string().optional(),\n })),\n })\n}\n\nexport const AppConfiguration_Shared_RuntimeSchema = appConfiguration_Shared_RuntimeSchemaBuilder(AllSharedApplicationTypesSchema);\n\n\n\n// =====================================================\n// Analytics Configuration\n// =====================================================\n\nexport enum AnalyticsProviderType {\n CONSOLE = 'console',\n BACKEND_PROXY = 'backend_proxy',\n}\n\n/* Uses providerType (not \"type\") to avoid Mongoose reserved keyword conflict during Zod→Mongoose conversion. /\nexport const AnalyticsProviderConfigSchema = z.object({\n providerType: z.enum(AnalyticsProviderType),\n config: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport const AutoInstrumentationConfigSchema = z.object({\n /* Track page views (NAVIGATION_PANE_CHANGED events) /\n pageViews: z.boolean().default(true),\n /* Track resource operations (NOTIFY_RESOURCE_SUCCESS events) /\n resourceOperations: z.boolean().default(true),\n /* Track errors (ERROR_OCCURED events). Named 'trackErrors' to avoid Mongoose reserved 'errors' pathname. /\n trackErrors: z.boolean().default(true),\n /* Track feature gate hits (shown/blocked) — debounced per feature per session /\n featureGate: z.boolean().default(true),\n /* Track user lifecycle events (login, logout, status changes) /\n userLifecycle: z.boolean().default(true),\n /* Track notification events (NOTIFY_CUSTOM_* events) /\n notifications: z.boolean().default(false),\n /* Track hotkey usage /\n hotkeys: z.boolean().default(false),\n});\n\nexport const AnalyticsConfigSchema = z.object({\n /* Master switch — false = no analytics at all, regardless of user consent /\n enabled: z.boolean().default(false),\n\n /* Registered analytics providers /\n providers: z.array(AnalyticsProviderConfigSchema).default([]),\n\n /* Minimum consent level required for analytics (defaults to ANALYTICS) /\n requiredConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.ANALYTICS),\n\n /\n SINGLE DECLARATION SURFACE for all value moments.\n * TTFV, aha moments, activation stages, and anti-patterns are all here,\n * distinguished by their `role` field.\n /\n valueMoments: z.array(ValueMomentSchema).optional(),\n\n /* Persistence and evaluation configuration /\n persistence: z.object({\n /* Persist achieved moments to localStorage (default: true) /\n localStorage: z.boolean().default(true),\n /* Sync achieved moments to backend (default: true) /\n backendSync: z.boolean().default(true),\n /\n Backend evaluates RESOURCE_STATE signals + cronjob-originated events.\n * When true, RESOURCE_STATE signals are evaluated by the backend engine (authoritative).\n * When false, frontend does optimistic cached count queries.\n /\n backendEvaluation: z.boolean().default(true),\n }).default({\n localStorage: true,\n backendSync: true,\n backendEvaluation: true,\n }),\n\n /* Auto-instrumentation configuration /\n autoInstrumentation: AutoInstrumentationConfigSchema.default({\n pageViews: true,\n resourceOperations: true,\n trackErrors: true,\n featureGate: true,\n userLifecycle: true,\n notifications: false,\n hotkeys: false,\n }),\n});\n\n\n// =====================================================\n// Main Shared App Configuration\n// =====================================================\n\nexport const AppConfiguration_Shared_Schema = z.object({\n\n appIdentity: AppConfiguration_Shared_AppIdentity_Schema,\n\n /\n The generated brand assets — the runtime projection of the brand identity\n * an app's build-time logo step produces. THE single source of truth every\n * logo/favicon/brand-image consumer resolves against via `resolveBrandAsset`\n * (by composition × theme × purpose). Empty/absent until a brand is\n * generated; consumers fall back to a placeholder.\n \n MOVED OFF `appIdentity` (2026-07): brand assets are app-authored,\n * BUILD-TIME content (a CLI generates them from a spec SSOT and writes a\n * `backend-api/src/brand-assets.generated.ts` the backend config composes),\n * NOT platform-declaration identity. `appIdentity` is\n * platform-declaration-materialized and boundary-blocked for backend\n * authoring (`AppConfiguration_BackendAuthored` Omits `appIdentity`, and the\n * `applyBackendConfig` inspector rejects it), so a backend-authorable slot is\n * required. This top-level `brandAssets` is that slot — it is present on both\n * the frontend shared payload (here) and the backend-authored managed config\n * (`_AppConfiguration_AppManagedConfiguration_Schema`).\n /\n brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n\n appPreferences: z.object({\n languages: AppConfiguration_Shared_AppPreferencesLanguage_Schema,\n }),\n apiJwtPublicKey: z.string().min(1, { error: 'API JWT public key is required' }),\n\n runtime: AppConfiguration_Shared_RuntimeSchema,\n auth: AppConfiguration_Shared_AuthSchema,\n /* User types — required. No implicit defaults. /\n userTypes: UserTypesConfigSchema,\n /* Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. /\n frontendServices: FrontendServicesConfigSchema,\n /* Org typing. Optional — only for apps with typed organizations. */\n organizationTypes: OrganizationTypesConfigSchema.optional(),\n compliance: AppConfiguration_Shared_ComplianceSchema,\n\n // Billing Configuration (optional: billing disabled by default)\n billing: BillingConfigurationSchema.optional(),\n\n // Analytics Configuration (optional: analytics disabled by default)\n analytics: AnalyticsConfigSchema.optional(),\n\n // Lifecycle Configuration (optional: lifecycle disabled by default)\n lifecycle: LifecycleConfigSchema.optional(),\n\n // Tenant-Teardown Configuration (optional: every field defaults, so omitting the block yields a\n // working 30-day retention window purged nightly). Holds the operator-tunable retention window,\n // purge cron and per-run batch size consumed by the engine-owned `organization-purge` batch.\n // See TenantTeardownConfigSchema for why this is NOT folded into `lifecycle` (which is the USER\n // lifecycle and is disabled by default).\n tenantTeardown: TenantTeardownConfigSchema.optional(),\n\n // Data-Seeding Configuration (optional: when omitted, the engine-owned\n // `data-seeding:scheduled-rerun` batch uses the manifest's built-in\n // minute-tick default cron — see DataSeedingConfigSchema for the full\n // rationale on why operators rarely need to override this).\n dataSeeding: DataSeedingConfigSchema.optional(),\n\n // Audit-Trail Configuration (optional: when omitted, NO archival runs and\n // audit records are retained in the primary AUDIT_LOGS store indefinitely).\n // Holds the operator-tunable archival horizon (`archiveAfterDays`) consumed\n // by the engine-owned `compliance:audit-logs-archive` batch. Records are\n // never deleted (AUDIT_LOGS is immutable, G5) — see AuditTrailConfigSchema.\n auditTrail: AuditTrailConfigSchema.optional(),\n\n});\n\n\nexport type AppConfiguration_Shared_Compliance = z.infer<typeof AppConfiguration_Shared_ComplianceSchema>;\nexport type AppConfiguration_Shared_AppIdentity = z.infer<typeof AppConfiguration_Shared_AppIdentity_Schema>;\nexport type AppConfiguration_Shared_AppPreferencesLanguage = z.infer<typeof AppConfiguration_Shared_AppPreferencesLanguage_Schema>;\nexport type AnalyticsProviderConfig = z.infer<typeof AnalyticsProviderConfigSchema>;\nexport type AppConfiguration_Shared_Runtime = z.infer<typeof AppConfiguration_Shared_RuntimeSchema>;\nexport type AutoInstrumentationConfig = z.infer<typeof AutoInstrumentationConfigSchema>;\nexport type AnalyticsConfig = z.infer<typeof AnalyticsConfigSchema>;\nexport type AppConfiguration_Shared_Auth = z.infer<typeof AppConfiguration_Shared_AuthSchema>;\nexport type AppConfiguration_Shared = z.infer<typeof AppConfiguration_Shared_Schema>;\n"]}
1	+ {"version":3,"file":"app-configuration-shared.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAClK,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,mBAAmB;CACzB,CAAC;AAMX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzD,6EAA6E;IAE7E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF;;;;;;;;OAQG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjB,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC;IAE3F,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE5D,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE5C,sDAAsD;IACtD,kFAAkF;IAClF,8EAA8E;CAE/E,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC;IAChG,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAEnH;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC;CAE7F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACrE,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACzG,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAsC,aAA2B,EAAE,EAAE;IAC/H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC,+BAA+B,CAAC,CAAC;AAInI,wDAAwD;AACxD,0BAA0B;AAC1B,wDAAwD;AAExD,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,wDAA+B,CAAA;AACjC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,6GAA6G;IAC7G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kEAAkE;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEnC,qCAAqC;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,2EAA2E;IAC3E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAEvF;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,+DAA+D;QAC/D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,yCAAyC;IACzC,mBAAmB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC,CAAC;AAGH,wDAAwD;AACxD,gCAAgC;AAChC,wDAAwD;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAErD,WAAW,EAAE,0CAA0C;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAExD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,qDAAqD;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAE/E,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,mDAAmD;IACnD,SAAS,EAAE,qBAAqB;IAChC,0HAA0H;IAC1H,gBAAgB,EAAE,4BAA4B;IAC9C,qEAAqE;IACrE,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,wCAAwC;IAEpD,gEAAgE;IAChE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAE9C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,yCAAyC;IACzC,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAErD,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,4DAA4D;IAC5D,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAE/C,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAE9C,CAAC,CAAC","sourcesContent":["/*\n Frontend Application Configuration Schemas\n \n Pure frontend configuration schemas that define what configuration\n * the frontend applications expect to receive from backend endpoints.\n \n NOTE: OAuth2 providers are NOT configured here. OAuth2 is a protocol\n * defined at the provider level in external-connectors, just like REST_API\n * and HOOKS protocols. This configuration only enables/disables which\n * external providers are available for SSO authentication.\n /\n\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models';\nimport { z } from 'zod';\nimport { AllSharedApplicationTypes, AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas';\nimport { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas';\nimport { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas';\nimport { ClientInstanceIdScope, DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas';\nimport { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas';\nimport { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas';\nimport { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas';\nimport { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { ValueMomentSchema } from './analytics-value-moments.shared.schemas';\nimport {\n UserTypesConfigSchema,\n FrontendServicesConfigSchema,\n OrganizationTypesConfigSchema,\n OrgAuthMethodPolicy,\n} from './entity-identity-config.shared.schemas';\n\n\n\n/\n Shared Password Policy Rules Schema\n \n Contains ONLY the validation rules that both frontend and backend need.\n * The backend extends these rules with hashing config (argon2 params)\n * via AppConfiguration_AuthSchema in app-config.backend.schemas.ts.\n \n Frontend uses these rules for:\n * - Real-time password strength validation as user types\n * - Password policy indicator in reset/registration forms\n /\n\n\nexport const PasswordPolicyRulesSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /\n R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),\n * NOT used in the client-side password pre-check — but it IS a field of this shared schema and\n * therefore ships wherever the schema is serialized (e.g. `AuthInvitationInfoResponse.passwordPolicy`).\n * Non-secret. (Corrected from the prior \"Backend-only\" which wrongly implied it is never serialized.)\n * NOTE: `PasswordPolicyConfigSchema` (entity-identity-config) must stay field-identical to this schema\n * — the invitation response `.parse()` silently strips any field present there but absent here.\n /\n expiryDays: z.number().min(0).default(0),\n});\n\nexport type PasswordPolicyRules = z.infer<typeof PasswordPolicyRulesSchema>;\n\n/\n I18n label keys for password policy violations.\n * Values match PasswordPolicyLabel in presets-components-models for frontend resolution.\n * Labels support placeholders: policyMinLength → {minLength}, policyMaxLength → {maxLength}.\n /\nexport const PasswordPolicyViolationCode = {\n MIN_LENGTH: 'policyMinLength',\n MAX_LENGTH: 'policyMaxLength',\n UPPERCASE: 'policyUppercase',\n LOWERCASE: 'policyLowercase',\n NUMBER: 'policyNumber',\n SPECIAL_CHAR: 'policySpecialChar',\n} as const;\n\nexport type PasswordPolicyViolationCode = (typeof PasswordPolicyViolationCode)[keyof typeof PasswordPolicyViolationCode];\n\n\n\n/\n Global Auth Config — infrastructure + app-level only.\n \n Auth POLICY (authMethodsEnabled, mfaPolicy, registration, passwordPolicy,\n * sessionDurationMinutes, lockoutPolicy, autoLinkByEmail, stepUpAuth,\n * methodManagement) is now per-user-type on UserTypeAuthPolicySchema\n * in entity-identity-config.shared.schemas.ts.\n \n This section retains only infrastructure and app-level settings that apply\n * equally regardless of user type.\n \n /\nexport const AppConfiguration_Shared_AuthSchema = z.object({\n\n // ─── INFRASTRUCTURE (stays on global auth) ────────────────────────────────\n\n passkeyConfig: z.object({\n rpName: z.string().min(1),\n rpId: z.string().min(1),\n maxPasskeysPerUser: z.number().min(1).max(50).default(10),\n }),\n\n /*\n Minimal frontend-facing social OAuth2 projection.\n \n Backend runtime still owns the full backend-private\n * `auth.socialOAuth2Providers` authoring shape\n * (enabled flags, scopes, allowed domains, secrets-related semantics). The\n * shared `/application-config` payload only needs the enabled public provider\n * refs plus an optional app-authored display-name override.\n /\n socialOAuth2Providers: z.record(\n z.string(),\n z.object({\n displayName: z.string().optional(),\n })).default({}),\n\n /* E-10, D-15: How much orgs can override user-type auth methods. /\n orgAuthMethodPolicy: z.enum(OrgAuthMethodPolicy).default(OrgAuthMethodPolicy.RESTRICT_ONLY),\n\n /* E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. /\n expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),\n\n /* E-4, D-2: Can a user authenticated via Org A SSO access Org B? /\n crossOrgSSOAccess: z.boolean().default(true),\n\n // W6.8: All per-user-type auth policy fields REMOVED.\n // Use userTypes[t].auth. instead (see entity-identity-config.shared.schemas.ts).\n // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).\n\n});\n\n\n\n\nexport const AppConfiguration_Shared_ComplianceSchema = z.object({\n userProfileVisibility: z.enum(UserProfileVisibility).default(UserProfileVisibility.ORGANIZATION),\n organizationProfileVisibility: z.enum(OrganizationProfileVisibility).default(OrganizationProfileVisibility.PRIVATE),\n\n /*\n Client-install identification policy (`clientInstanceId`) — OFF unless authored.\n \n Lives on `compliance` because it is a privacy decision, not an observability knob, and lives on\n * the SHARED config because both halves of the mechanism must obey ONE authored value: the\n * frontend decides whether to mint/store/send the id, and the backend independently decides\n * whether to ingest and record it. Two gates, one source — an application that never opts in is\n * protected even if some client sends the header anyway.\n \n Defaults to {@link ClientInstanceIdScope.DISABLED} so the privacy-preserving posture is the one\n * you get by doing nothing. See the enum's JSDoc for the ePrivacy/GDPR/NIST reasoning and the\n * obligations attached to each non-`DISABLED` member.\n /\n clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),\n\n});\n\n\n\nexport const AppConfiguration_Shared_AppIdentity_Schema = z.object({\n /* Technical app name — used as fallback when displayName is absent /\n appName: z.string().min(1, { error: 'Application name is required' }),\n /* Human-readable display name shown in UI and emails /\n displayName: z.string().optional(),\n /* Short description of the application /\n description: z.string().optional(),\n version: z.string().min(1, { error: 'Version is required' }),\n /\n The application's own id — the scope an APPLICATION-scoped resource's WebSocket room is keyed on.\n \n ## Why the client needs it, measured rather than argued\n \n `deriveResourceScopeRoomQualifiers` yields the `app` room only when `applicationId` is present in\n * the context it is handed, and a read's context is built from the URL's contextual parameters —\n * which never carry one, because an application id is AMBIENT rather than addressed. Nothing else\n * published it either: the access token's claims carry `userId` and no `applicationId`, and this\n * very object carried only `appName`/`displayName`/`version`.\n \n The consequence was silent. On 2026-09-03 the workbench subscribed to `org` and `user` for an\n * APPLICATION-scoped resource and was confirmed in both, while the companion published that\n * resource's changes to the `app` room. Correct producer, confirmed subscriber, different rooms,\n * zero frames delivered (issue #283).\n \n ## Why it is safe to publish here\n \n It is an IDENTIFIER, not a credential: it names which application this deployment is, it grants\n * nothing, and every authenticated request already acts within it. The room name a client must\n * compute is derived from it, so a client that may subscribe at all must be able to name it —\n * authorization for that room is decided server-side against the SUBSCRIBED RESOURCE, never\n * against possession of this value (issue #247).\n \n OPTIONAL because a deployment that predates this field must keep loading. A consumer that does\n * not find it degrades to the previous behaviour — it derives whatever rooms its parameters imply\n * and does not hear the application-room push — rather than failing.\n /\n applicationId: z.string().min(1).optional(),\n});\n\n\nexport const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({\n defaultLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n enabledLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]),\n fallbackLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n autoDetectFromBrowser: z.boolean().default(true),\n allowUserOverride: z.boolean().default(true),\n allowOrganizationOverride: z.boolean().default(true),\n enableLanguageSwitcher: z.boolean().default(true)\n});\n\n\nexport const appConfiguration_Shared_RuntimeSchemaBuilder = <T extends AllSharedApplicationTypes>(appTypeSchema: z.ZodType<T>) => {\n return z.object({\n endPoints: z.record(z.string(), z.object({\n publicUrl: z.string().optional(),\n internalUrl: z.string().optional(),\n })),\n })\n}\n\nexport const AppConfiguration_Shared_RuntimeSchema = appConfiguration_Shared_RuntimeSchemaBuilder(AllSharedApplicationTypesSchema);\n\n\n\n// =====================================================\n// Analytics Configuration\n// =====================================================\n\nexport enum AnalyticsProviderType {\n CONSOLE = 'console',\n BACKEND_PROXY = 'backend_proxy',\n}\n\n/* Uses providerType (not \"type\") to avoid Mongoose reserved keyword conflict during Zod→Mongoose conversion. /\nexport const AnalyticsProviderConfigSchema = z.object({\n providerType: z.enum(AnalyticsProviderType),\n config: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport const AutoInstrumentationConfigSchema = z.object({\n /* Track page views (NAVIGATION_PANE_CHANGED events) /\n pageViews: z.boolean().default(true),\n /* Track resource operations (NOTIFY_RESOURCE_SUCCESS events) /\n resourceOperations: z.boolean().default(true),\n /* Track errors (ERROR_OCCURED events). Named 'trackErrors' to avoid Mongoose reserved 'errors' pathname. /\n trackErrors: z.boolean().default(true),\n /* Track feature gate hits (shown/blocked) — debounced per feature per session /\n featureGate: z.boolean().default(true),\n /* Track user lifecycle events (login, logout, status changes) /\n userLifecycle: z.boolean().default(true),\n /* Track notification events (NOTIFY_CUSTOM_* events) /\n notifications: z.boolean().default(false),\n /* Track hotkey usage /\n hotkeys: z.boolean().default(false),\n});\n\nexport const AnalyticsConfigSchema = z.object({\n /* Master switch — false = no analytics at all, regardless of user consent /\n enabled: z.boolean().default(false),\n\n /* Registered analytics providers /\n providers: z.array(AnalyticsProviderConfigSchema).default([]),\n\n /* Minimum consent level required for analytics (defaults to ANALYTICS) /\n requiredConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.ANALYTICS),\n\n /\n SINGLE DECLARATION SURFACE for all value moments.\n * TTFV, aha moments, activation stages, and anti-patterns are all here,\n * distinguished by their `role` field.\n /\n valueMoments: z.array(ValueMomentSchema).optional(),\n\n /* Persistence and evaluation configuration /\n persistence: z.object({\n /* Persist achieved moments to localStorage (default: true) /\n localStorage: z.boolean().default(true),\n /* Sync achieved moments to backend (default: true) /\n backendSync: z.boolean().default(true),\n /\n Backend evaluates RESOURCE_STATE signals + cronjob-originated events.\n * When true, RESOURCE_STATE signals are evaluated by the backend engine (authoritative).\n * When false, frontend does optimistic cached count queries.\n /\n backendEvaluation: z.boolean().default(true),\n }).default({\n localStorage: true,\n backendSync: true,\n backendEvaluation: true,\n }),\n\n /* Auto-instrumentation configuration /\n autoInstrumentation: AutoInstrumentationConfigSchema.default({\n pageViews: true,\n resourceOperations: true,\n trackErrors: true,\n featureGate: true,\n userLifecycle: true,\n notifications: false,\n hotkeys: false,\n }),\n});\n\n\n// =====================================================\n// Main Shared App Configuration\n// =====================================================\n\nexport const AppConfiguration_Shared_Schema = z.object({\n\n appIdentity: AppConfiguration_Shared_AppIdentity_Schema,\n\n /\n The generated brand assets — the runtime projection of the brand identity\n * an app's build-time logo step produces. THE single source of truth every\n * logo/favicon/brand-image consumer resolves against via `resolveBrandAsset`\n * (by composition × theme × purpose). Empty/absent until a brand is\n * generated; consumers fall back to a placeholder.\n \n MOVED OFF `appIdentity` (2026-07): brand assets are app-authored,\n * BUILD-TIME content (a CLI generates them from a spec SSOT and writes a\n * `backend-api/src/brand-assets.generated.ts` the backend config composes),\n * NOT platform-declaration identity. `appIdentity` is\n * platform-declaration-materialized and boundary-blocked for backend\n * authoring (`AppConfiguration_BackendAuthored` Omits `appIdentity`, and the\n * `applyBackendConfig` inspector rejects it), so a backend-authorable slot is\n * required. This top-level `brandAssets` is that slot — it is present on both\n * the frontend shared payload (here) and the backend-authored managed config\n * (`_AppConfiguration_AppManagedConfiguration_Schema`).\n /\n brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n\n appPreferences: z.object({\n languages: AppConfiguration_Shared_AppPreferencesLanguage_Schema,\n }),\n apiJwtPublicKey: z.string().min(1, { error: 'API JWT public key is required' }),\n\n runtime: AppConfiguration_Shared_RuntimeSchema,\n auth: AppConfiguration_Shared_AuthSchema,\n /* User types — required. No implicit defaults. /\n userTypes: UserTypesConfigSchema,\n /* Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. /\n frontendServices: FrontendServicesConfigSchema,\n /* Org typing. Optional — only for apps with typed organizations. */\n organizationTypes: OrganizationTypesConfigSchema.optional(),\n compliance: AppConfiguration_Shared_ComplianceSchema,\n\n // Billing Configuration (optional: billing disabled by default)\n billing: BillingConfigurationSchema.optional(),\n\n // Analytics Configuration (optional: analytics disabled by default)\n analytics: AnalyticsConfigSchema.optional(),\n\n // Lifecycle Configuration (optional: lifecycle disabled by default)\n lifecycle: LifecycleConfigSchema.optional(),\n\n // Tenant-Teardown Configuration (optional: every field defaults, so omitting the block yields a\n // working 30-day retention window purged nightly). Holds the operator-tunable retention window,\n // purge cron and per-run batch size consumed by the engine-owned `organization-purge` batch.\n // See TenantTeardownConfigSchema for why this is NOT folded into `lifecycle` (which is the USER\n // lifecycle and is disabled by default).\n tenantTeardown: TenantTeardownConfigSchema.optional(),\n\n // Data-Seeding Configuration (optional: when omitted, the engine-owned\n // `data-seeding:scheduled-rerun` batch uses the manifest's built-in\n // minute-tick default cron — see DataSeedingConfigSchema for the full\n // rationale on why operators rarely need to override this).\n dataSeeding: DataSeedingConfigSchema.optional(),\n\n // Audit-Trail Configuration (optional: when omitted, NO archival runs and\n // audit records are retained in the primary AUDIT_LOGS store indefinitely).\n // Holds the operator-tunable archival horizon (`archiveAfterDays`) consumed\n // by the engine-owned `compliance:audit-logs-archive` batch. Records are\n // never deleted (AUDIT_LOGS is immutable, G5) — see AuditTrailConfigSchema.\n auditTrail: AuditTrailConfigSchema.optional(),\n\n});\n\n\nexport type AppConfiguration_Shared_Compliance = z.infer<typeof AppConfiguration_Shared_ComplianceSchema>;\nexport type AppConfiguration_Shared_AppIdentity = z.infer<typeof AppConfiguration_Shared_AppIdentity_Schema>;\nexport type AppConfiguration_Shared_AppPreferencesLanguage = z.infer<typeof AppConfiguration_Shared_AppPreferencesLanguage_Schema>;\nexport type AnalyticsProviderConfig = z.infer<typeof AnalyticsProviderConfigSchema>;\nexport type AppConfiguration_Shared_Runtime = z.infer<typeof AppConfiguration_Shared_RuntimeSchema>;\nexport type AutoInstrumentationConfig = z.infer<typeof AutoInstrumentationConfigSchema>;\nexport type AnalyticsConfig = z.infer<typeof AnalyticsConfigSchema>;\nexport type AppConfiguration_Shared_Auth = z.infer<typeof AppConfiguration_Shared_AuthSchema>;\nexport type AppConfiguration_Shared = z.infer<typeof AppConfiguration_Shared_Schema>;\n"]}

package/dist/esm/config/auth-config-resolution.shared.utils.d.ts CHANGED Viewed

@@ -8,7 +8,7 @@
  */
 import { AuthMethod } from '../security/authentications/authentication.shared.schemas';
 import { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';
-import type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig } from './entity-identity-config.shared.schemas';
+import type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig, StepUpAuthConfig } from './entity-identity-config.shared.schemas';
 export type AuthMethodsMap = Partial<Record<AuthMethod, boolean | {
     enabled: boolean;
 }>>;
@@ -22,6 +22,13 @@ export interface ResolvedAuthConfig {
     authMethodsEnabled: AuthMethodsMap;
     mfaPolicy: MfaPolicyConfig;
     passwordPolicy: PasswordPolicyConfig;
+    /**
+     * Re-authentication freshness (#527). `undefined` when the user type declares no step-up policy —
+     * an organisation cannot introduce step-up for a user type that has none, because there is no base
+     * to be more restrictive THAN, and inventing one would let a tenant enable a gate the application
+     * never configured.
+     */
+    stepUpAuth: StepUpAuthConfig | undefined;
 }
 export declare function getEnabledMethods(map: AuthMethodsMap | undefined): Set<AuthMethod>;
 /**

package/dist/esm/config/auth-config-resolution.shared.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-config-resolution.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;~~AAE/I~~,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAAC;AAEzF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,cAAc,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,oBAAoB,CAAC;~~CACtC~~;AAQD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAOlF;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,UAAU,EAK1E,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,kBAAkB,EAAE,cAAc,GAAG,cAAc,CAMtG;~~AA8MD~~,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,~~CAwBtF~~"}
1	+ {"version":3,"file":"auth-config-resolution.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAEjK,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAAC;AAEzF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,cAAc,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC1C;AAQD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAOlF;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,UAAU,EAK1E,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,kBAAkB,EAAE,cAAc,GAAG,cAAc,CAMtG;AA8OD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CA0BtF"}

package/dist/esm/config/auth-config-resolution.shared.utils.js CHANGED Viewed

@@ -134,6 +134,33 @@ function mergeMfaMostRestrictive(a, b) {
         passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,
     };
 }
+// ─── Step-Up Auth Resolution ────────────────────────────────────────────────
+function resolveStepUpSingle(base, override) {
+    return {
+        // Either side turning step-up ON wins: an organisation may require re-authentication where the
+        // application does not, and may never switch off one the application requires.
+        enabled: base.enabled || (override.enabled ?? false),
+        // The SHORTER window wins — the opposite arithmetic to `enabled`, same direction of intent.
+        maxAgeSeconds: mergeNumberLowerWins(base.maxAgeSeconds, override.maxAgeSeconds),
+        // Intersection: an organisation may WITHDRAW an acceptable method, never introduce one.
+        methods: mergeArrayIntersection(base.methods, override.methods) ?? base.methods,
+    };
+}
+function resolveStepUpMultiOrg(base, orgOverrides) {
+    if (base === undefined)
+        return undefined;
+    const stepUpOverrides = orgOverrides
+        .map(o => o?.stepUpAuth)
+        .filter((p) => !!p);
+    if (stepUpOverrides.length === 0)
+        return { ...base };
+    const perOrgResults = stepUpOverrides.map(o => resolveStepUpSingle(base, o));
+    return perOrgResults.reduce((acc, r) => ({
+        enabled: acc.enabled || r.enabled,
+        maxAgeSeconds: Math.min(acc.maxAgeSeconds, r.maxAgeSeconds),
+        methods: mergeArrayIntersection(acc.methods, r.methods) ?? acc.methods,
+    }));
+}
 // ─── Password Policy Resolution ─────────────────────────────────────────────
 function resolvePasswordPolicySingle(base, override) {
     return {
@@ -240,6 +267,7 @@ export function resolveAuthConfig(input) {
             authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },
             mfaPolicy: { ...userTypeAuth.mfaPolicy },
             passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),
+            stepUpAuth: userTypeAuth.stepUpAuth ? { ...userTypeAuth.stepUpAuth } : undefined,
         };
     }
     const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);
@@ -248,6 +276,7 @@ export function resolveAuthConfig(input) {
         authMethodsEnabled: setToMethodsMap(resolvedMethods),
         mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),
         passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),
+        stepUpAuth: resolveStepUpMultiOrg(userTypeAuth.stepUpAuth, orgOverrides),
     };
 }
 //# sourceMappingURL=auth-config-resolution.shared.utils.js.map

package/dist/esm/config/auth-config-resolution.shared.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAkB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;SAClF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;KACzF,CAAC;AACJ,CAAC","sourcesContent":["/*\n W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n \n Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).\n * Multi-org: each org type override resolved independently, then most-restrictive across all.\n \n This is a pure function — no DI, no DB, no side effects.\n /\n\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean \| { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n userTypeAuth: UserTypeAuthPolicy;\n orgOverrides: OrgTypeAuthOverrides[];\n orgAuthMethodPolicy: OrgAuthMethodPolicy;\n expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n authMethodsEnabled: AuthMethodsMap;\n mfaPolicy: MfaPolicyConfig;\n passwordPolicy: PasswordPolicyConfig;\n}\n\nfunction isMethodEnabled(value: boolean \| { enabled: boolean } \| undefined): boolean {\n if (value === undefined) return false;\n if (typeof value === 'boolean') return value;\n return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap \| undefined): Set<AuthMethod> {\n if (!map) return new Set();\n const result = new Set<AuthMethod>();\n for (const [method, value] of Object.entries(map)) {\n if (isMethodEnabled(value)) result.add(method as AuthMethod);\n }\n return result;\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n const result: AuthMethodsMap = {};\n for (const method of Object.values(AuthMethod)) {\n result[method] = methods.has(method);\n }\n return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/\n Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n \n `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n /\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.PASSKEY,\n AuthMethod.MAGIC_LINK,\n AuthMethod.SMS_OTP,\n];\n\n/\n AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n /\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n const result: AuthMethodsMap = { ...authMethodsEnabled };\n for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n result[method] = false;\n }\n return result;\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n userTypeMethods: Set<AuthMethod>,\n orgOverride: OrgTypeAuthOverrides,\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n switch (policy) {\n case OrgAuthMethodPolicy.RESTRICT_ONLY:\n return intersection(userTypeMethods, orgMethods);\n\n case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n const expandableSet = new Set(expandable);\n const expansions = intersection(orgMethods, expandableSet);\n return union(userTypeMethods, expansions);\n }\n\n case OrgAuthMethodPolicy.UNRESTRICTED:\n return new Set(orgMethods);\n\n default:\n return new Set(userTypeMethods);\n }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n userTypeMethods: Set<AuthMethod>,\n orgOverrides: OrgTypeAuthOverrides[],\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n const perOrgResults = validOverrides.map(o =>\n resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n );\n\n if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n // Each org may expand within the expandable set, but multi-org users only get\n // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n }\n\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n base: MfaPolicyConfig,\n override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n return {\n requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n base: MfaPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n const mfaOverrides = orgOverrides\n .map(o => o?.mfaPolicy)\n .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n if (mfaOverrides.length === 0) return { ...base };\n\n const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n return {\n requireMFA: a.requireMFA \|\| b.requireMFA,\n requireStrongMFA: a.requireStrongMFA \|\| b.requireStrongMFA,\n acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n };\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n base: PasswordPolicyConfig,\n override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n return {\n minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n base: PasswordPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n const pwOverrides = orgOverrides\n .map(o => o?.passwordPolicy)\n .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n if (pwOverrides.length === 0) return { ...base };\n\n const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n return normalizePasswordPolicyBounds(\n perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n return normalizePasswordPolicyBounds({\n minLength: Math.max(a.minLength, b.minLength),\n maxLength: Math.min(a.maxLength, b.maxLength),\n requireUppercase: a.requireUppercase \|\| b.requireUppercase,\n requireLowercase: a.requireLowercase \|\| b.requireLowercase,\n requireNumbers: a.requireNumbers \|\| b.requireNumbers,\n requireSpecialChars: a.requireSpecialChars \|\| b.requireSpecialChars,\n expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n });\n}\n\n/\n Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n if (policy.maxLength >= policy.minLength) {\n return policy;\n }\n\n return {\n ...policy,\n maxLength: policy.minLength,\n };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base \|\| override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n if (base === 0 && override === 0) return 0;\n if (base === 0) return override;\n if (override === 0) return base;\n return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] \| undefined, b: T[] \| undefined): T[] \| undefined {\n if (a === undefined) return b;\n if (b === undefined) return a;\n const setB = new Set(b);\n return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n const result = new Set<T>();\n for (const item of a) {\n if (b.has(item)) result.add(item);\n }\n return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n if (!orgOverrides.length) {\n return {\n authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n mfaPolicy: { ...userTypeAuth.mfaPolicy },\n passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n };\n }\n\n const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n const resolvedMethods = resolveAuthMethodsMultiOrg(\n userTypeMethods,\n orgOverrides,\n orgAuthMethodPolicy,\n expandableOrgMethods ?? [],\n );\n\n return {\n authMethodsEnabled: setToMethodsMap(resolvedMethods),\n mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n };\n}\n"]}
1	+ {"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAyB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,mBAAmB,CAAC,IAAsB,EAAE,QAAmC;IACtF,OAAO;QACL,+FAA+F;QAC/F,+EAA+E;QAC/E,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,4FAA4F;QAC5F,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC;QAC/E,wFAAwF;QACxF,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAkC,EAClC,YAAoC;IAEpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,eAAe,GAAG,YAAY;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAErD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;QACjC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAC3D,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO;KACvE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YACjF,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;QACxF,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC;KACzE,CAAC;AACJ,CAAC","sourcesContent":["/*\n W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n \n Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).\n * Multi-org: each org type override resolved independently, then most-restrictive across all.\n \n This is a pure function — no DI, no DB, no side effects.\n /\n\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig, StepUpAuthConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean \| { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n userTypeAuth: UserTypeAuthPolicy;\n orgOverrides: OrgTypeAuthOverrides[];\n orgAuthMethodPolicy: OrgAuthMethodPolicy;\n expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n authMethodsEnabled: AuthMethodsMap;\n mfaPolicy: MfaPolicyConfig;\n passwordPolicy: PasswordPolicyConfig;\n /\n Re-authentication freshness (#527). `undefined` when the user type declares no step-up policy —\n * an organisation cannot introduce step-up for a user type that has none, because there is no base\n * to be more restrictive THAN, and inventing one would let a tenant enable a gate the application\n * never configured.\n /\n stepUpAuth: StepUpAuthConfig \| undefined;\n}\n\nfunction isMethodEnabled(value: boolean \| { enabled: boolean } \| undefined): boolean {\n if (value === undefined) return false;\n if (typeof value === 'boolean') return value;\n return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap \| undefined): Set<AuthMethod> {\n if (!map) return new Set();\n const result = new Set<AuthMethod>();\n for (const [method, value] of Object.entries(map)) {\n if (isMethodEnabled(value)) result.add(method as AuthMethod);\n }\n return result;\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n const result: AuthMethodsMap = {};\n for (const method of Object.values(AuthMethod)) {\n result[method] = methods.has(method);\n }\n return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/\n Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n \n `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n /\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.PASSKEY,\n AuthMethod.MAGIC_LINK,\n AuthMethod.SMS_OTP,\n];\n\n/\n AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n /\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n const result: AuthMethodsMap = { ...authMethodsEnabled };\n for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n result[method] = false;\n }\n return result;\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n userTypeMethods: Set<AuthMethod>,\n orgOverride: OrgTypeAuthOverrides,\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n switch (policy) {\n case OrgAuthMethodPolicy.RESTRICT_ONLY:\n return intersection(userTypeMethods, orgMethods);\n\n case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n const expandableSet = new Set(expandable);\n const expansions = intersection(orgMethods, expandableSet);\n return union(userTypeMethods, expansions);\n }\n\n case OrgAuthMethodPolicy.UNRESTRICTED:\n return new Set(orgMethods);\n\n default:\n return new Set(userTypeMethods);\n }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n userTypeMethods: Set<AuthMethod>,\n orgOverrides: OrgTypeAuthOverrides[],\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n const perOrgResults = validOverrides.map(o =>\n resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n );\n\n if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n // Each org may expand within the expandable set, but multi-org users only get\n // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n }\n\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n base: MfaPolicyConfig,\n override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n return {\n requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n base: MfaPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n const mfaOverrides = orgOverrides\n .map(o => o?.mfaPolicy)\n .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n if (mfaOverrides.length === 0) return { ...base };\n\n const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n return {\n requireMFA: a.requireMFA \|\| b.requireMFA,\n requireStrongMFA: a.requireStrongMFA \|\| b.requireStrongMFA,\n acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n };\n}\n\n// ─── Step-Up Auth Resolution ────────────────────────────────────────────────\n\nfunction resolveStepUpSingle(base: StepUpAuthConfig, override: Partial<StepUpAuthConfig>): StepUpAuthConfig {\n return {\n // Either side turning step-up ON wins: an organisation may require re-authentication where the\n // application does not, and may never switch off one the application requires.\n enabled: base.enabled \|\| (override.enabled ?? false),\n // The SHORTER window wins — the opposite arithmetic to `enabled`, same direction of intent.\n maxAgeSeconds: mergeNumberLowerWins(base.maxAgeSeconds, override.maxAgeSeconds),\n // Intersection: an organisation may WITHDRAW an acceptable method, never introduce one.\n methods: mergeArrayIntersection(base.methods, override.methods) ?? base.methods,\n };\n}\n\nfunction resolveStepUpMultiOrg(\n base: StepUpAuthConfig \| undefined,\n orgOverrides: OrgTypeAuthOverrides[],\n): StepUpAuthConfig \| undefined {\n if (base === undefined) return undefined;\n const stepUpOverrides = orgOverrides\n .map(o => o?.stepUpAuth)\n .filter((p): p is Partial<StepUpAuthConfig> => !!p);\n if (stepUpOverrides.length === 0) return { ...base };\n\n const perOrgResults = stepUpOverrides.map(o => resolveStepUpSingle(base, o));\n return perOrgResults.reduce((acc, r) => ({\n enabled: acc.enabled \|\| r.enabled,\n maxAgeSeconds: Math.min(acc.maxAgeSeconds, r.maxAgeSeconds),\n methods: mergeArrayIntersection(acc.methods, r.methods) ?? acc.methods,\n }));\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n base: PasswordPolicyConfig,\n override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n return {\n minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n base: PasswordPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n const pwOverrides = orgOverrides\n .map(o => o?.passwordPolicy)\n .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n if (pwOverrides.length === 0) return { ...base };\n\n const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n return normalizePasswordPolicyBounds(\n perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n return normalizePasswordPolicyBounds({\n minLength: Math.max(a.minLength, b.minLength),\n maxLength: Math.min(a.maxLength, b.maxLength),\n requireUppercase: a.requireUppercase \|\| b.requireUppercase,\n requireLowercase: a.requireLowercase \|\| b.requireLowercase,\n requireNumbers: a.requireNumbers \|\| b.requireNumbers,\n requireSpecialChars: a.requireSpecialChars \|\| b.requireSpecialChars,\n expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n });\n}\n\n/\n Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n if (policy.maxLength >= policy.minLength) {\n return policy;\n }\n\n return {\n ...policy,\n maxLength: policy.minLength,\n };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base \|\| override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n if (base === 0 && override === 0) return 0;\n if (base === 0) return override;\n if (override === 0) return base;\n return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] \| undefined, b: T[] \| undefined): T[] \| undefined {\n if (a === undefined) return b;\n if (b === undefined) return a;\n const setB = new Set(b);\n return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n const result = new Set<T>();\n for (const item of a) {\n if (b.has(item)) result.add(item);\n }\n return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n if (!orgOverrides.length) {\n return {\n authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n mfaPolicy: { ...userTypeAuth.mfaPolicy },\n passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n stepUpAuth: userTypeAuth.stepUpAuth ? { ...userTypeAuth.stepUpAuth } : undefined,\n };\n }\n\n const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n const resolvedMethods = resolveAuthMethodsMultiOrg(\n userTypeMethods,\n orgOverrides,\n orgAuthMethodPolicy,\n expandableOrgMethods ?? [],\n );\n\n return {\n authMethodsEnabled: setToMethodsMap(resolvedMethods),\n mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n stepUpAuth: resolveStepUpMultiOrg(userTypeAuth.stepUpAuth, orgOverrides),\n };\n}\n"]}

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts CHANGED Viewed

@@ -70,10 +70,17 @@ export declare const RegistrationConfigSchema: z.ZodObject<{
     mode: z.ZodEnum<typeof RegistrationMode>;
     /**
      * Only acquisition methods with a complete public-signup implementation are accepted.
-     * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-     * end-to-end registration flow; declaring them here would otherwise advertise a path
-     * the runtime cannot execute.
-    */
+     *
+     * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+     * registration in #463; before that they were authentication and enrollment methods only, and
+     * declaring one here was refused because it would have advertised a path the runtime could not
+     * execute.
+     *
+     * A password-less signup creates the account with NO credential and proves the address by a magic
+     * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+     * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+     * nothing. See `registerUser`.
+     */
     allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
     /** D-19: 'deferred' gives immediate access, verify later. */
     emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -139,10 +146,17 @@ export declare const UserTypeAuthPolicySchema: z.ZodObject<{
         mode: z.ZodEnum<typeof RegistrationMode>;
         /**
          * Only acquisition methods with a complete public-signup implementation are accepted.
-         * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-         * end-to-end registration flow; declaring them here would otherwise advertise a path
-         * the runtime cannot execute.
-        */
+         *
+         * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+         * registration in #463; before that they were authentication and enrollment methods only, and
+         * declaring one here was refused because it would have advertised a path the runtime could not
+         * execute.
+         *
+         * A password-less signup creates the account with NO credential and proves the address by a magic
+         * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+         * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+         * nothing. See `registerUser`.
+         */
         allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
         /** D-19: 'deferred' gives immediate access, verify later. */
         emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -197,10 +211,17 @@ export declare const UserTypeDefinitionSchema: z.ZodObject<{
             mode: z.ZodEnum<typeof RegistrationMode>;
             /**
              * Only acquisition methods with a complete public-signup implementation are accepted.
-             * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-             * end-to-end registration flow; declaring them here would otherwise advertise a path
-             * the runtime cannot execute.
-            */
+             *
+             * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+             * registration in #463; before that they were authentication and enrollment methods only, and
+             * declaring one here was refused because it would have advertised a path the runtime could not
+             * execute.
+             *
+             * A password-less signup creates the account with NO credential and proves the address by a magic
+             * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+             * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+             * nothing. See `registerUser`.
+             */
             allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
             /** D-19: 'deferred' gives immediate access, verify later. */
             emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -276,7 +297,41 @@ export declare const FrontendServiceDefinitionSchema: z.ZodObject<{
     frontendType: z.ZodOptional<z.ZodEnum<typeof AppFrontendType>>;
 }, z.core.$strip>;
 export type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;
-/** How a registration-derived organization obtains its initial display name. */
+/**
+ * @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer
+ *
+ * An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles
+ * exist inside it, whether it can come into existence through sign-up, and how hard it is for its
+ * members to prove who they are. Declared as `organizationTypes` in the application configuration.
+ *
+ * ## A type only self-creates if it says so
+ *
+ * `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a
+ * tenant of this type into existence. A type an administrator creates simply omits the policy — and
+ * a user type may match AT MOST ONE organization type, which the schema enforces rather than
+ * resolving by record order.
+ *
+ * `orgNameSource` decides where that tenant's first display name comes from: `ASK` during
+ * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who
+ * the registrant becomes.
+ *
+ * ## `authOverrides` tightens, and can never loosen
+ *
+ * A tenant may restrict how its own members authenticate, on four axes and no others — enabled
+ * methods, MFA policy, password policy and re-authentication freshness. Session length, lockout and
+ * registration are NOT organization-overridable.
+ *
+ * Every axis is most-restrictive-wins on top of the user type, so an organization can subtract but
+ * never add. Two directions worth stating because they differ: for step-up, `enabled` is an OR
+ * (either side turning it on wins) while `maxAgeSeconds` is a MIN (the shorter window wins), and
+ * `methods` intersects — an organization can withdraw an acceptable re-authentication method and
+ * never introduce one the user type does not already allow.
+ *
+ * When a person belongs to SEVERAL organizations the sets intersect across all of them, so belonging
+ * to a permissive tenant never restores what a strict one removed.
+ *
+ * How a registration-derived organization obtains its initial display name.
+ */
 export declare enum OrganizationNameSource {
     ASK = "ask",
     AUTO = "auto",
@@ -309,6 +364,11 @@ export declare const OrgTypeAuthOverridesSchema: z.ZodOptional<z.ZodObject<{
         requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
         expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
     }, z.core.$strip>>;
+    stepUpAuth: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>>;
 export type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;
 /** G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). */
@@ -341,6 +401,11 @@ export declare const OrganizationTypeDefinitionSchema: z.ZodObject<{
             requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         }, z.core.$strip>>;
+        stepUpAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     scimProvisioning: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -353,6 +418,7 @@ export declare const OrganizationTypeDefinitionSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;
+/** @wildo_source:part:end saas.models.config.organization-types */
 export declare const UserTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     auth: z.ZodObject<{
         authMethodsEnabled: z.ZodDefault<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
@@ -369,10 +435,17 @@ export declare const UserTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject
             mode: z.ZodEnum<typeof RegistrationMode>;
             /**
              * Only acquisition methods with a complete public-signup implementation are accepted.
-             * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-             * end-to-end registration flow; declaring them here would otherwise advertise a path
-             * the runtime cannot execute.
-            */
+             *
+             * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+             * registration in #463; before that they were authentication and enrollment methods only, and
+             * declaring one here was refused because it would have advertised a path the runtime could not
+             * execute.
+             *
+             * A password-less signup creates the account with NO credential and proves the address by a magic
+             * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+             * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+             * nothing. See `registerUser`.
+             */
             allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
             /** D-19: 'deferred' gives immediate access, verify later. */
             emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -450,6 +523,11 @@ export declare const OrganizationTypesConfigSchema: z.ZodRecord<z.ZodString, z.Z
             requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         }, z.core.$strip>>;
+        stepUpAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     scimProvisioning: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAIrE,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAUtF,eAAO,MAAM,qBAAqB;;;;;;iBAUhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;IAEnC~~;;;;;MAKE~~;;~~IAEF~~,6DAA6D;;IAE7D,yFAAyF;;~~kBAyBzF~~,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;~~QAzFnC;;;;;UAKE~~;;~~QAEF~~,6DAA6D;;QAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBAsJzF~~,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;~~YApKnC;;;;;cAKE~~;;~~YAEF~~,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBAwKzF~~,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF~~,gFAAgF~~;~~AAChF~~,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B~~;;;;;;;;;;;;;;;;;;;;kBAI1B~~,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBAoB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;~~AAI1F~~,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;~~YA3QhC;;;;;cAKE~~;;~~YAEF~~,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~kBAkQR~~,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~kBA8BtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE"}
1	+ {"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAIrE,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAUtF,eAAO,MAAM,qBAAqB;;;;;;iBAUhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;IAEnC;;;;;;;;;;;;OAYG;;IAEH,6DAA6D;;IAE7D,yFAAyF;;kBAsCzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;QA7GnC;;;;;;;;;;;;WAYG;;QAEH,6DAA6D;;QAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0KzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;YA/LnC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4LzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;kBAmB1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,mEAAmE;AAInE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;YAxVhC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwUR,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA8BtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE"}