npm - @wildo-ai/saas-models - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/saas-models 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (588) hide show

package/dist/esm/config/entity-identity-config.shared.schemas.js CHANGED Viewed

@@ -84,18 +84,39 @@ export const RegistrationConfigSchema = z.strictObject({
     mode: z.enum(RegistrationMode),
     /**
      * Only acquisition methods with a complete public-signup implementation are accepted.
-     * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-     * end-to-end registration flow; declaring them here would otherwise advertise a path
-     * the runtime cannot execute.
-    */
+     *
+     * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+     * registration in #463; before that they were authentication and enrollment methods only, and
+     * declaring one here was refused because it would have advertised a path the runtime could not
+     * execute.
+     *
+     * A password-less signup creates the account with NO credential and proves the address by a magic
+     * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+     * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+     * nothing. See `registerUser`.
+     */
     allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),
     /** D-19: 'deferred' gives immediate access, verify later. */
     emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),
     /** R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. */
     blockForSSODomains: z.boolean().default(false),
 }).superRefine((registration, ctx) => {
-    const unsupportedMethods = registration.allowedMethods.filter((method) => method !== AuthMethod.PASSWORD
-        && method !== AuthMethod.EXTERNAL_OAUTH2);
+    /*
+     * The set with a public-signup implementation. It is enumerated rather than open because the
+     * failure this refusal prevents is silent: a method listed here is ADVERTISED to a registrant, and
+     * one the runtime cannot execute fails after they have committed to it.
+     *
+     * MAGIC_LINK and PASSKEY joined in #463. Anything else — SSO, an MFA factor — is an authentication
+     * or enrollment method that has no way to CREATE an account from an anonymous caller, and adding it
+     * here means building that flow first, not widening this list.
+     */
+    const publiclyRegisterableMethods = [
+        AuthMethod.PASSWORD,
+        AuthMethod.EXTERNAL_OAUTH2,
+        AuthMethod.MAGIC_LINK,
+        AuthMethod.PASSKEY,
+    ];
+    const unsupportedMethods = registration.allowedMethods.filter((method) => !publiclyRegisterableMethods.includes(method));
     if (unsupportedMethods.length > 0) {
         ctx.addIssue({
             code: 'custom',
@@ -179,7 +200,14 @@ export const UserTypeAuthPolicySchema = z.object({
     }),
     /** E-8: Session duration for this user type. */
     sessionDurationMinutes: z.number().min(1).max(1440).default(30),
-    /** E-8, G-2: undefined = unlimited. */
+    /**
+     * E-8, G-2: the cap on simultaneous refresh chains for this user type.
+     *
+     * Leaving it undefined does NOT mean unlimited. The token issuer falls back to
+     * `DEFAULT_MAX_CONCURRENT_SESSIONS` (10) and evicts the oldest chain beyond it, so a user type
+     * that declares nothing is still capped. There is no value that disables the cap; declare the
+     * number you want.
+     */
     maxConcurrentSessions: z.number().min(1).optional(),
     /** G-1: Per-user-type lockout. Backend-only. */
     lockoutPolicy: LockoutPolicyConfigSchema.default({
@@ -250,7 +278,41 @@ export const FrontendServiceDefinitionSchema = z.object({
     frontendType: z.enum(AppFrontendType).optional(),
 });
 // ─── Organization Type ──────────────────────────────────────────────────────
-/** How a registration-derived organization obtains its initial display name. */
+/**
+ * @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer
+ *
+ * An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles
+ * exist inside it, whether it can come into existence through sign-up, and how hard it is for its
+ * members to prove who they are. Declared as `organizationTypes` in the application configuration.
+ *
+ * ## A type only self-creates if it says so
+ *
+ * `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a
+ * tenant of this type into existence. A type an administrator creates simply omits the policy — and
+ * a user type may match AT MOST ONE organization type, which the schema enforces rather than
+ * resolving by record order.
+ *
+ * `orgNameSource` decides where that tenant's first display name comes from: `ASK` during
+ * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who
+ * the registrant becomes.
+ *
+ * ## `authOverrides` tightens, and can never loosen
+ *
+ * A tenant may restrict how its own members authenticate, on four axes and no others — enabled
+ * methods, MFA policy, password policy and re-authentication freshness. Session length, lockout and
+ * registration are NOT organization-overridable.
+ *
+ * Every axis is most-restrictive-wins on top of the user type, so an organization can subtract but
+ * never add. Two directions worth stating because they differ: for step-up, `enabled` is an OR
+ * (either side turning it on wins) while `maxAgeSeconds` is a MIN (the shorter window wins), and
+ * `methods` intersects — an organization can withdraw an acceptable re-authentication method and
+ * never introduce one the user type does not already allow.
+ *
+ * When a person belongs to SEVERAL organizations the sets intersect across all of them, so belonging
+ * to a permissive tenant never restores what a strict one removed.
+ *
+ * How a registration-derived organization obtains its initial display name.
+ */
 export var OrganizationNameSource;
 (function (OrganizationNameSource) {
     OrganizationNameSource["ASK"] = "ask";
@@ -267,6 +329,21 @@ export const OrgTypeAuthOverridesSchema = z.object({
     authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),
     mfaPolicy: MfaPolicyConfigSchema.partial().optional(),
     passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),
+    /**
+     * Re-authentication freshness, added 2026-09-09 (#527).
+     *
+     * The other three overrides and this one answer ONE question — how hard is it for this tenant's
+     * members to prove who they are — and until now a tenant could tighten three of them. An
+     * organisation that requires MFA and a 16-character password could still have a member mutate a
+     * sensitive resource on an eight-hour-old session, because the app-wide default said so.
+     *
+     * Most-restrictive-wins like its siblings, but the two fields move in OPPOSITE arithmetic
+     * directions and that is worth stating rather than inferring: `enabled` is an OR (either side
+     * turning step-up ON wins) while `maxAgeSeconds` is a MIN (the shorter window wins). `methods`
+     * intersects, so an organisation can withdraw an acceptable re-authentication method but never
+     * introduce one the user type does not already allow.
+     */
+    stepUpAuth: StepUpAuthConfigSchema.partial().optional(),
 }).optional();
 /** G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). */
 export const OrgScimProvisioningSchema = z.object({
@@ -289,6 +366,7 @@ export const OrganizationTypeDefinitionSchema = z.object({
     scimProvisioning: OrgScimProvisioningSchema.optional(),
     creationPolicy: OrgCreationPolicySchema.optional(),
 });
+/** @wildo_source:part:end saas.models.config.organization-types */
 // ─── Top-Level Config Sections ──────────────────────────────────────────────
 export const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);
 export const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);

package/dist/esm/config/entity-identity-config.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,6EAA2C,CAAA;IAC3C,uEAAqC,CAAA;IACrC,2EAAyC,CAAA;IACzC,2DAAyB,CAAA;IACzB,6FAA2D,CAAA;AAC7D,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0EAAiD,CAAA;IACjD,8CAAqB,CAAA;AACvB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9B;;;;;MAKE;IACF,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACnC,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,KAAK,UAAU,CAAC,QAAQ;WAC3B,MAAM,KAAK,UAAU,CAAC,eAAe,CAC3C,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;WACxC,YAAY,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1D,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,4FAA4F;IAC5F,YAAY,EAAE,wBAAwB;IAEtC,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D,uCAAuC;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,KAAK;KACrC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C;;;;;;mHAM+G;IAC/G,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,+EAA+E;AAE/E,gFAAgF;AAChF,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,qCAAW,CAAA;IACX,uCAAa,CAAA;IACb,mDAAyB,CAAA;AAC3B,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC;KACpD,WAAW,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;IACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,iBAAiB,CAClB,EAAE,CAAC;QACF,MAAM,mBAAmB,GACvB,UAAU,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,gBAAgB;wBAChB,gBAAgB;wBAChB,8BAA8B;wBAC9B,KAAK;qBACN;oBACD,OAAO,EACL,cAAc,QAAQ,sCAAsC;0BAC1D,IAAI,aAAa,0CAA0C;0BAC3D,8DAA8D;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAYL;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAK7D,iBAAoE,EACpE,kBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAC9D,kBAAkB,CACnB,CACF;SACA,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC,CAAC;AACR,CAAC","sourcesContent":["/*\n Entity & Identity Configuration Schemas\n \n Top-level config sections: userTypes, frontendServices, organizationTypes.\n * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).\n \n Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.\n * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.\n \n See:\n * - target-configuration-type.md §2b (UserTypeAuthPolicy)\n * - entity-identity-architecture-analysis.md §4.2\n /\n\nimport { z } from 'zod';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { AppFrontendType } from './app-frontend-type.shared.schemas';\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\n/* Canonical registration-policy discriminant. /\nexport enum RegistrationMode {\n OPEN = 'open',\n INVITATION_ONLY = 'invitation_only',\n ADMIN_ONLY = 'admin_only',\n DISABLED = 'disabled',\n}\n\n/\n Semantically distinct ways in which a user can acquire a user type.\n \n Keep these channels separate even when two currently share the same mode matrix: the actor,\n * user intent, and security boundary differ, and future policy can evolve one without silently\n * changing the others.\n /\nexport enum RegistrationAcquisitionChannel {\n PUBLIC_SELF_SERVICE = 'public_self_service',\n SOCIAL_OAUTH_JIT = 'social_oauth_jit',\n ENTERPRISE_SSO_JIT = 'enterprise_sso_jit',\n INVITATION = 'invitation',\n ADMINISTRATIVE_PROVISIONING = 'administrative_provisioning',\n}\n\n/* D-19: Email verification timing. /\nexport enum EmailVerificationMode {\n REQUIRED_BEFORE_ACCESS = 'required_before_access',\n DEFERRED = 'deferred',\n}\n\n/* E-10, D-15: How much orgs can override user-type auth methods. /\nexport enum OrgAuthMethodPolicy {\n RESTRICT_ONLY = 'restrict_only',\n EXPAND_WITHIN_SET = 'expand_within_set',\n UNRESTRICTED = 'unrestricted',\n}\n\n// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────\n\nexport const AuthMethodExpandedConfigSchema = z.object({\n enabled: z.boolean(),\n});\nexport type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;\n\n/\n authMethodsEnabled value: boolean shorthand OR expanded config.\n * Shorthand: PASSWORD: true → normalized at runtime to { enabled: true }.\n /\nconst AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);\n\n// ─── Policy Sub-Types ───────────────────────────────────────────────────────\n\nexport const MfaPolicyConfigSchema = z.object({\n requireMFA: z.boolean().default(false),\n /* D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n /* Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. /\n acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),\n /* D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. /\n enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),\n /* C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. /\n passkeyExemptFromMFA: z.boolean().default(true),\n});\nexport type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;\n\n/\n Registration policy for one user type.\n \n Every user type must author this object explicitly. Acquisition policy is security\n * configuration, so omission must never silently become open registration.\n /\nexport const RegistrationConfigSchema = z.strictObject({\n mode: z.enum(RegistrationMode),\n /\n Only acquisition methods with a complete public-signup implementation are accepted.\n * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an\n * end-to-end registration flow; declaring them here would otherwise advertise a path\n * the runtime cannot execute.\n /\n allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n /* D-19: 'deferred' gives immediate access, verify later. /\n emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),\n /* R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. /\n blockForSSODomains: z.boolean().default(false),\n}).superRefine((registration, ctx) => {\n const unsupportedMethods = registration.allowedMethods.filter(\n (method) =>\n method !== AuthMethod.PASSWORD\n && method !== AuthMethod.EXTERNAL_OAUTH2,\n );\n if (unsupportedMethods.length > 0) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,\n });\n }\n if (\n registration.mode === RegistrationMode.OPEN\n && registration.allowedMethods.length === 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: 'Open registration requires at least one supported acquisition method',\n });\n }\n});\nexport type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;\n\n/\n Password policy — includes expiryDays (R-8, moved from flat auth field).\n * Defined here (not in app-configuration-shared) to avoid circular dependency.\n * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.\n /\nexport const PasswordPolicyConfigSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /* R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). /\n expiryDays: z.number().min(0).default(0),\n});\nexport type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;\n\n/* E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. /\nexport const StepUpAuthConfigSchema = z.object({\n enabled: z.boolean().default(false),\n maxAgeSeconds: z.number().min(60).max(3600).default(300),\n methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n});\nexport type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;\n\nexport const LockoutPolicyConfigSchema = z.object({\n maxLoginAttempts: z.number().min(3).max(20).default(5),\n lockoutDurationMinutes: z.number().min(1).max(1440).default(30),\n /* W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. /\n progressiveLockout: z.boolean().default(false),\n /* W2.3: cap for progressive lockout duration in hours. /\n maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),\n});\nexport type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;\n\nexport const MethodManagementConfigSchema = z.object({\n allowUserMethodRemoval: z.boolean().default(true),\n requireReauthForMethodChanges: z.boolean().default(false),\n});\nexport type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;\n\n// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────\n\n/\n The complete auth policy for a user type. Every user type MUST define this.\n * There are no global auth defaults — this IS the auth config.\n \n Zod .default() values enable omission in config input files, but the\n * resolved runtime type has all fields present (no optionals for policy fields).\n \n See target-configuration-type.md §2b for full specification.\n /\nexport const UserTypeAuthPolicySchema = z.object({\n /* E-1, D-20: Opt-in semantics — absent method = disabled. /\n authMethodsEnabled: z.partialRecord(\n z.enum(AuthMethod),\n AuthMethodValueSchema,\n ).default({ [AuthMethod.PASSWORD]: true }),\n\n /* E-2: MFA enforcement for this user type. /\n mfaPolicy: MfaPolicyConfigSchema.default({\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n }),\n\n /* E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. /\n registration: RegistrationConfigSchema,\n\n /* E-7, R-8: Password strength + expiry. /\n passwordPolicy: PasswordPolicyConfigSchema.default({\n minLength: 8,\n maxLength: 128,\n requireUppercase: true,\n requireLowercase: true,\n requireNumbers: true,\n requireSpecialChars: false,\n expiryDays: 0,\n }),\n\n /* E-8: Session duration for this user type. /\n sessionDurationMinutes: z.number().min(1).max(1440).default(30),\n\n /* E-8, G-2: undefined = unlimited. /\n maxConcurrentSessions: z.number().min(1).optional(),\n\n /* G-1: Per-user-type lockout. Backend-only. /\n lockoutPolicy: LockoutPolicyConfigSchema.default({\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n }),\n\n /* G-8: Consumer=true (convenience), Admin=false (security). /\n autoLinkByEmail: z.boolean().default(true),\n\n /* E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). /\n stepUpAuth: StepUpAuthConfigSchema.optional(),\n\n methodManagement: MethodManagementConfigSchema.default({\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: false,\n }),\n\n /* W7.3a: Enables anonymous session support for this user type. When true,\n * unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.\n * On login/register for this user type, anonymous resources are transposed to the authenticated user. /\n anonymousSessionsEnabled: z.boolean().optional(),\n\n /* W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. /\n oneOffSessionAllowed: z.boolean().optional(),\n\n /* revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted\n * for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide\n * absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is\n * bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,\n * the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The\n * ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap\n * enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). /\n oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),\n});\nexport type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;\n\n// ─── User Type Definition ───────────────────────────────────────────────────\n\nexport const UserTypeDefinitionSchema = z.object({\n /* REQUIRED — the complete auth policy for this user type. Not an override of global. /\n auth: UserTypeAuthPolicySchema,\n\n /* DEFERRED: Only 'email' supported. Accepts any string; engine warns if !== 'email'. /\n uniqueIdentifier: z.string().default('email'),\n\n defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),\n\n /* D-10: When set, user type auto-revoked when user leaves last org of matching type. /\n requiresOrgMembership: z.object({\n orgTypes: z.array(z.string()).min(1),\n }).optional(),\n});\nexport type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;\n\n// ─── Frontend Service Identity ──────────────────────────────────────────────\n\nexport const FrontendServiceUserManagementEntrySchema = z.object({\n register: z.boolean(),\n auth: z.boolean(),\n isDefault: z.boolean().optional(),\n});\nexport type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;\n\n/\n Backend-runtime view of one frontend service.\n \n Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`\n * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.\n \n - `usersManagement` — auth-policy bindings per user type (legacy field;\n * present since the original auth identity model).\n * - `frontendType` — the runtime kind declared in\n * `wildo.saas.config.ts → services[name].frontendType`. Currently\n * informational on the backend; reserved for `frontendType`-conditioned\n * policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The\n * full taxonomy + the \"no native variants\" decision live in\n * `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT\n * duplicate that explanation here.\n /\nexport const FrontendServiceDefinitionSchema = z.object({\n usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),\n frontendType: z.enum(AppFrontendType).optional(),\n});\nexport type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;\n\n// ─── Organization Type ──────────────────────────────────────────────────────\n\n/* How a registration-derived organization obtains its initial display name. /\nexport enum OrganizationNameSource {\n ASK = 'ask',\n AUTO = 'auto',\n ONBOARDING = 'onboarding',\n}\n\nexport const OrgCreationPolicySchema = z.object({\n createOnUserTypeRegistration: z.array(z.string()).min(1),\n orgNameSource: z.enum(OrganizationNameSource),\n defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),\n});\nexport type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;\n\n/* D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. /\nexport const OrgTypeAuthOverridesSchema = z.object({\n authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),\n mfaPolicy: MfaPolicyConfigSchema.partial().optional(),\n passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),\n}).optional();\nexport type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;\n\n/* G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). /\nexport const OrgScimProvisioningSchema = z.object({\n enabled: z.boolean().default(false),\n syncFrequencyHours: z.number().min(1).max(720).default(24),\n});\nexport type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;\n\nexport const OrganizationTypeDefinitionSchema = z.object({\n /* D-10: User types auto-granted when joining this org type. /\n userTypes: z.array(z.string()).min(1),\n\n availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n CORE_ORG_ROLES.ORG_MEMBER,\n ]),\n\n /* R-5: Moved from registration.defaultOrgRole. /\n defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),\n\n /* D-15: Most-restrictive-wins on top of user type auth policy. /\n authOverrides: OrgTypeAuthOverridesSchema,\n\n /* G-4: SCIM provisioning toggle per org type. /\n scimProvisioning: OrgScimProvisioningSchema.optional(),\n\n creationPolicy: OrgCreationPolicySchema.optional(),\n});\nexport type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;\n\n// ─── Top-Level Config Sections ──────────────────────────────────────────────\n\nexport const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);\nexport type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;\n\nexport const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);\nexport type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;\n\nexport const OrganizationTypesConfigSchema = z\n .record(z.string(), OrganizationTypeDefinitionSchema)\n .superRefine((organizationTypes, ctx) => {\n const ownerByRegisteredUserType = new Map<string, string>();\n for (const [organizationType, definition] of Object.entries(\n organizationTypes,\n )) {\n const registeredUserTypes =\n definition.creationPolicy?.createOnUserTypeRegistration ?? [];\n registeredUserTypes.forEach((userType, index) => {\n const existingOwner = ownerByRegisteredUserType.get(userType);\n if (existingOwner !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: [\n organizationType,\n 'creationPolicy',\n 'createOnUserTypeRegistration',\n index,\n ],\n message:\n `User type '${userType}' already creates organization type `\n + `'${existingOwner}' during registration; one registration `\n + 'cannot implicitly choose between multiple organization types',\n });\n return;\n }\n ownerByRegisteredUserType.set(userType, organizationType);\n });\n }\n });\nexport type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;\n\nexport interface OrganizationTypeRegistrationCreationMatch<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n } = OrganizationTypeDefinition,\n> {\n readonly organizationType: string;\n readonly definition: TDefinition;\n}\n\n/\n Canonical matching rule for registration-derived organization creation.\n \n The schema rejects more than one match for a user type. Returning all\n * matches is intentional defensive behavior for stale/unparsed runtime input:\n * callers can fail closed instead of selecting record insertion order.\n */\nexport function findOrganizationTypeRegistrationCreationMatches<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n },\n>(\n organizationTypes: Readonly<Record<string, TDefinition>> \| undefined,\n registeredUserType: string,\n): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[] {\n if (!organizationTypes) return [];\n return Object.entries(organizationTypes)\n .filter(([, definition]) =>\n definition.creationPolicy?.createOnUserTypeRegistration.includes(\n registeredUserType,\n ),\n )\n .map(([organizationType, definition]) => ({\n organizationType,\n definition,\n }));\n}\n"]}
1	+ {"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,6EAA2C,CAAA;IAC3C,uEAAqC,CAAA;IACrC,2EAAyC,CAAA;IACzC,2DAAyB,CAAA;IACzB,6FAA2D,CAAA;AAC7D,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0EAAiD,CAAA;IACjD,8CAAqB,CAAA;AACvB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACnC;;;;;;;;OAQG;IACH,MAAM,2BAA2B,GAA0B;QACzD,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,OAAO;KACnB,CAAC;IACF,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC1D,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;WACxC,YAAY,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1D,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,4FAA4F;IAC5F,YAAY,EAAE,wBAAwB;IAEtC,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,KAAK;KACrC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C;;;;;;mHAM+G;IAC/G,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,qCAAW,CAAA;IACX,uCAAa,CAAA;IACb,mDAAyB,CAAA;AAC3B,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/D;;;;;;;;;;;;;OAaG;IACH,UAAU,EAAE,sBAAsB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEH,mEAAmE;AAEnE,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC;KACpD,WAAW,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;IACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,iBAAiB,CAClB,EAAE,CAAC;QACF,MAAM,mBAAmB,GACvB,UAAU,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,gBAAgB;wBAChB,gBAAgB;wBAChB,8BAA8B;wBAC9B,KAAK;qBACN;oBACD,OAAO,EACL,cAAc,QAAQ,sCAAsC;0BAC1D,IAAI,aAAa,0CAA0C;0BAC3D,8DAA8D;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAYL;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAK7D,iBAAoE,EACpE,kBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAC9D,kBAAkB,CACnB,CACF;SACA,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC,CAAC;AACR,CAAC","sourcesContent":["/*\n Entity & Identity Configuration Schemas\n \n Top-level config sections: userTypes, frontendServices, organizationTypes.\n * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).\n \n Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.\n * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.\n \n See:\n * - target-configuration-type.md §2b (UserTypeAuthPolicy)\n * - entity-identity-architecture-analysis.md §4.2\n /\n\nimport { z } from 'zod';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { AppFrontendType } from './app-frontend-type.shared.schemas';\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\n/* Canonical registration-policy discriminant. /\nexport enum RegistrationMode {\n OPEN = 'open',\n INVITATION_ONLY = 'invitation_only',\n ADMIN_ONLY = 'admin_only',\n DISABLED = 'disabled',\n}\n\n/\n Semantically distinct ways in which a user can acquire a user type.\n \n Keep these channels separate even when two currently share the same mode matrix: the actor,\n * user intent, and security boundary differ, and future policy can evolve one without silently\n * changing the others.\n /\nexport enum RegistrationAcquisitionChannel {\n PUBLIC_SELF_SERVICE = 'public_self_service',\n SOCIAL_OAUTH_JIT = 'social_oauth_jit',\n ENTERPRISE_SSO_JIT = 'enterprise_sso_jit',\n INVITATION = 'invitation',\n ADMINISTRATIVE_PROVISIONING = 'administrative_provisioning',\n}\n\n/* D-19: Email verification timing. /\nexport enum EmailVerificationMode {\n REQUIRED_BEFORE_ACCESS = 'required_before_access',\n DEFERRED = 'deferred',\n}\n\n/* E-10, D-15: How much orgs can override user-type auth methods. /\nexport enum OrgAuthMethodPolicy {\n RESTRICT_ONLY = 'restrict_only',\n EXPAND_WITHIN_SET = 'expand_within_set',\n UNRESTRICTED = 'unrestricted',\n}\n\n// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────\n\nexport const AuthMethodExpandedConfigSchema = z.object({\n enabled: z.boolean(),\n});\nexport type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;\n\n/\n authMethodsEnabled value: boolean shorthand OR expanded config.\n * Shorthand: PASSWORD: true → normalized at runtime to { enabled: true }.\n /\nconst AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);\n\n// ─── Policy Sub-Types ───────────────────────────────────────────────────────\n\nexport const MfaPolicyConfigSchema = z.object({\n requireMFA: z.boolean().default(false),\n /* D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n /* Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. /\n acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),\n /* D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. /\n enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),\n /* C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. /\n passkeyExemptFromMFA: z.boolean().default(true),\n});\nexport type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;\n\n/\n Registration policy for one user type.\n \n Every user type must author this object explicitly. Acquisition policy is security\n * configuration, so omission must never silently become open registration.\n /\nexport const RegistrationConfigSchema = z.strictObject({\n mode: z.enum(RegistrationMode),\n /\n Only acquisition methods with a complete public-signup implementation are accepted.\n \n PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public\n * registration in #463; before that they were authentication and enrollment methods only, and\n * declaring one here was refused because it would have advertised a path the runtime could not\n * execute.\n \n A password-less signup creates the account with NO credential and proves the address by a magic\n * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —\n * \"access now, verify later\" is not a state the runtime can produce for a registrant who holds\n * nothing. See `registerUser`.\n /\n allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n /* D-19: 'deferred' gives immediate access, verify later. /\n emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),\n /* R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. /\n blockForSSODomains: z.boolean().default(false),\n}).superRefine((registration, ctx) => {\n /\n * The set with a public-signup implementation. It is enumerated rather than open because the\n * failure this refusal prevents is silent: a method listed here is ADVERTISED to a registrant, and\n * one the runtime cannot execute fails after they have committed to it.\n \n MAGIC_LINK and PASSKEY joined in #463. Anything else — SSO, an MFA factor — is an authentication\n * or enrollment method that has no way to CREATE an account from an anonymous caller, and adding it\n * here means building that flow first, not widening this list.\n /\n const publiclyRegisterableMethods: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.EXTERNAL_OAUTH2,\n AuthMethod.MAGIC_LINK,\n AuthMethod.PASSKEY,\n ];\n const unsupportedMethods = registration.allowedMethods.filter(\n (method) => !publiclyRegisterableMethods.includes(method),\n );\n if (unsupportedMethods.length > 0) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,\n });\n }\n if (\n registration.mode === RegistrationMode.OPEN\n && registration.allowedMethods.length === 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: 'Open registration requires at least one supported acquisition method',\n });\n }\n});\nexport type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;\n\n/\n Password policy — includes expiryDays (R-8, moved from flat auth field).\n * Defined here (not in app-configuration-shared) to avoid circular dependency.\n * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.\n /\nexport const PasswordPolicyConfigSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /* R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). /\n expiryDays: z.number().min(0).default(0),\n});\nexport type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;\n\n/* E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. /\nexport const StepUpAuthConfigSchema = z.object({\n enabled: z.boolean().default(false),\n maxAgeSeconds: z.number().min(60).max(3600).default(300),\n methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n});\nexport type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;\n\nexport const LockoutPolicyConfigSchema = z.object({\n maxLoginAttempts: z.number().min(3).max(20).default(5),\n lockoutDurationMinutes: z.number().min(1).max(1440).default(30),\n /* W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. /\n progressiveLockout: z.boolean().default(false),\n /* W2.3: cap for progressive lockout duration in hours. /\n maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),\n});\nexport type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;\n\nexport const MethodManagementConfigSchema = z.object({\n allowUserMethodRemoval: z.boolean().default(true),\n requireReauthForMethodChanges: z.boolean().default(false),\n});\nexport type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;\n\n// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────\n\n/\n The complete auth policy for a user type. Every user type MUST define this.\n * There are no global auth defaults — this IS the auth config.\n \n Zod .default() values enable omission in config input files, but the\n * resolved runtime type has all fields present (no optionals for policy fields).\n \n See target-configuration-type.md §2b for full specification.\n /\nexport const UserTypeAuthPolicySchema = z.object({\n /* E-1, D-20: Opt-in semantics — absent method = disabled. /\n authMethodsEnabled: z.partialRecord(\n z.enum(AuthMethod),\n AuthMethodValueSchema,\n ).default({ [AuthMethod.PASSWORD]: true }),\n\n /* E-2: MFA enforcement for this user type. /\n mfaPolicy: MfaPolicyConfigSchema.default({\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n }),\n\n /* E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. /\n registration: RegistrationConfigSchema,\n\n /* E-7, R-8: Password strength + expiry. /\n passwordPolicy: PasswordPolicyConfigSchema.default({\n minLength: 8,\n maxLength: 128,\n requireUppercase: true,\n requireLowercase: true,\n requireNumbers: true,\n requireSpecialChars: false,\n expiryDays: 0,\n }),\n\n /* E-8: Session duration for this user type. /\n sessionDurationMinutes: z.number().min(1).max(1440).default(30),\n\n /\n E-8, G-2: the cap on simultaneous refresh chains for this user type.\n \n Leaving it undefined does NOT mean unlimited. The token issuer falls back to\n * `DEFAULT_MAX_CONCURRENT_SESSIONS` (10) and evicts the oldest chain beyond it, so a user type\n * that declares nothing is still capped. There is no value that disables the cap; declare the\n * number you want.\n /\n maxConcurrentSessions: z.number().min(1).optional(),\n\n /* G-1: Per-user-type lockout. Backend-only. /\n lockoutPolicy: LockoutPolicyConfigSchema.default({\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n }),\n\n /* G-8: Consumer=true (convenience), Admin=false (security). /\n autoLinkByEmail: z.boolean().default(true),\n\n /* E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). /\n stepUpAuth: StepUpAuthConfigSchema.optional(),\n\n methodManagement: MethodManagementConfigSchema.default({\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: false,\n }),\n\n /* W7.3a: Enables anonymous session support for this user type. When true,\n * unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.\n * On login/register for this user type, anonymous resources are transposed to the authenticated user. /\n anonymousSessionsEnabled: z.boolean().optional(),\n\n /* W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. /\n oneOffSessionAllowed: z.boolean().optional(),\n\n /* revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted\n * for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide\n * absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is\n * bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,\n * the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The\n * ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap\n * enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). /\n oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),\n});\nexport type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;\n\n// ─── User Type Definition ───────────────────────────────────────────────────\n\nexport const UserTypeDefinitionSchema = z.object({\n /* REQUIRED — the complete auth policy for this user type. Not an override of global. /\n auth: UserTypeAuthPolicySchema,\n\n /* DEFERRED: Only 'email' supported. Accepts any string; engine warns if !== 'email'. /\n uniqueIdentifier: z.string().default('email'),\n\n defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),\n\n /* D-10: When set, user type auto-revoked when user leaves last org of matching type. /\n requiresOrgMembership: z.object({\n orgTypes: z.array(z.string()).min(1),\n }).optional(),\n});\nexport type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;\n\n// ─── Frontend Service Identity ──────────────────────────────────────────────\n\nexport const FrontendServiceUserManagementEntrySchema = z.object({\n register: z.boolean(),\n auth: z.boolean(),\n isDefault: z.boolean().optional(),\n});\nexport type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;\n\n/\n Backend-runtime view of one frontend service.\n \n Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`\n * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.\n \n - `usersManagement` — auth-policy bindings per user type (legacy field;\n * present since the original auth identity model).\n * - `frontendType` — the runtime kind declared in\n * `wildo.saas.config.ts → services[name].frontendType`. Currently\n * informational on the backend; reserved for `frontendType`-conditioned\n * policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The\n * full taxonomy + the \"no native variants\" decision live in\n * `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT\n * duplicate that explanation here.\n /\nexport const FrontendServiceDefinitionSchema = z.object({\n usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),\n frontendType: z.enum(AppFrontendType).optional(),\n});\nexport type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;\n\n// ─── Organization Type ──────────────────────────────────────────────────────\n\n/\n @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer\n \n An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles\n * exist inside it, whether it can come into existence through sign-up, and how hard it is for its\n * members to prove who they are. Declared as `organizationTypes` in the application configuration.\n \n ## A type only self-creates if it says so\n \n `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a\n * tenant of this type into existence. A type an administrator creates simply omits the policy — and\n * a user type may match AT MOST ONE organization type, which the schema enforces rather than\n * resolving by record order.\n \n `orgNameSource` decides where that tenant's first display name comes from: `ASK` during\n * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who\n * the registrant becomes.\n \n ## `authOverrides` tightens, and can never loosen\n \n A tenant may restrict how its own members authenticate, on four axes and no others — enabled\n * methods, MFA policy, password policy and re-authentication freshness. Session length, lockout and\n * registration are NOT organization-overridable.\n \n Every axis is most-restrictive-wins on top of the user type, so an organization can subtract but\n * never add. Two directions worth stating because they differ: for step-up, `enabled` is an OR\n * (either side turning it on wins) while `maxAgeSeconds` is a MIN (the shorter window wins), and\n * `methods` intersects — an organization can withdraw an acceptable re-authentication method and\n * never introduce one the user type does not already allow.\n \n When a person belongs to SEVERAL organizations the sets intersect across all of them, so belonging\n * to a permissive tenant never restores what a strict one removed.\n \n How a registration-derived organization obtains its initial display name.\n /\nexport enum OrganizationNameSource {\n ASK = 'ask',\n AUTO = 'auto',\n ONBOARDING = 'onboarding',\n}\n\nexport const OrgCreationPolicySchema = z.object({\n createOnUserTypeRegistration: z.array(z.string()).min(1),\n orgNameSource: z.enum(OrganizationNameSource),\n defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),\n});\nexport type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;\n\n/* D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. /\nexport const OrgTypeAuthOverridesSchema = z.object({\n authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),\n mfaPolicy: MfaPolicyConfigSchema.partial().optional(),\n passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),\n /\n Re-authentication freshness, added 2026-09-09 (#527).\n \n The other three overrides and this one answer ONE question — how hard is it for this tenant's\n * members to prove who they are — and until now a tenant could tighten three of them. An\n * organisation that requires MFA and a 16-character password could still have a member mutate a\n * sensitive resource on an eight-hour-old session, because the app-wide default said so.\n \n Most-restrictive-wins like its siblings, but the two fields move in OPPOSITE arithmetic\n * directions and that is worth stating rather than inferring: `enabled` is an OR (either side\n * turning step-up ON wins) while `maxAgeSeconds` is a MIN (the shorter window wins). `methods`\n * intersects, so an organisation can withdraw an acceptable re-authentication method but never\n * introduce one the user type does not already allow.\n /\n stepUpAuth: StepUpAuthConfigSchema.partial().optional(),\n}).optional();\nexport type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;\n\n/* G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). /\nexport const OrgScimProvisioningSchema = z.object({\n enabled: z.boolean().default(false),\n syncFrequencyHours: z.number().min(1).max(720).default(24),\n});\nexport type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;\n\nexport const OrganizationTypeDefinitionSchema = z.object({\n /* D-10: User types auto-granted when joining this org type. /\n userTypes: z.array(z.string()).min(1),\n\n availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n CORE_ORG_ROLES.ORG_MEMBER,\n ]),\n\n /* R-5: Moved from registration.defaultOrgRole. /\n defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),\n\n /* D-15: Most-restrictive-wins on top of user type auth policy. /\n authOverrides: OrgTypeAuthOverridesSchema,\n\n /* G-4: SCIM provisioning toggle per org type. /\n scimProvisioning: OrgScimProvisioningSchema.optional(),\n\n creationPolicy: OrgCreationPolicySchema.optional(),\n});\nexport type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;\n/* @wildo_source:part:end saas.models.config.organization-types /\n\n// ─── Top-Level Config Sections ──────────────────────────────────────────────\n\nexport const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);\nexport type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;\n\nexport const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);\nexport type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;\n\nexport const OrganizationTypesConfigSchema = z\n .record(z.string(), OrganizationTypeDefinitionSchema)\n .superRefine((organizationTypes, ctx) => {\n const ownerByRegisteredUserType = new Map<string, string>();\n for (const [organizationType, definition] of Object.entries(\n organizationTypes,\n )) {\n const registeredUserTypes =\n definition.creationPolicy?.createOnUserTypeRegistration ?? [];\n registeredUserTypes.forEach((userType, index) => {\n const existingOwner = ownerByRegisteredUserType.get(userType);\n if (existingOwner !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: [\n organizationType,\n 'creationPolicy',\n 'createOnUserTypeRegistration',\n index,\n ],\n message:\n `User type '${userType}' already creates organization type `\n + `'${existingOwner}' during registration; one registration `\n + 'cannot implicitly choose between multiple organization types',\n });\n return;\n }\n ownerByRegisteredUserType.set(userType, organizationType);\n });\n }\n });\nexport type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;\n\nexport interface OrganizationTypeRegistrationCreationMatch<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n } = OrganizationTypeDefinition,\n> {\n readonly organizationType: string;\n readonly definition: TDefinition;\n}\n\n/\n Canonical matching rule for registration-derived organization creation.\n \n The schema rejects more than one match for a user type. Returning all\n * matches is intentional defensive behavior for stale/unparsed runtime input:\n * callers can fail closed instead of selecting record insertion order.\n */\nexport function findOrganizationTypeRegistrationCreationMatches<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n },\n>(\n organizationTypes: Readonly<Record<string, TDefinition>> \| undefined,\n registeredUserType: string,\n): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[] {\n if (!organizationTypes) return [];\n return Object.entries(organizationTypes)\n .filter(([, definition]) =>\n definition.creationPolicy?.createOnUserTypeRegistration.includes(\n registeredUserType,\n ),\n )\n .map(([organizationType, definition]) => ({\n organizationType,\n definition,\n }));\n}\n"]}

package/dist/esm/config/frontend/chart-definition.shared.schemas.d.ts CHANGED Viewed

@@ -74,8 +74,8 @@ export declare const ChartSeriesStyleSchema: z.ZodObject<{
     markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
         type: z.ZodOptional<z.ZodEnum<{
             max: "max";
-            min: "min";
             average: "average";
+            min: "min";
         }>>;
         yValue: z.ZodOptional<z.ZodNumber>;
         xValue: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
@@ -90,8 +90,8 @@ export declare const ChartSeriesStyleSchema: z.ZodObject<{
     markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
         type: z.ZodOptional<z.ZodEnum<{
             max: "max";
-            min: "min";
             average: "average";
+            min: "min";
         }>>;
         label: z.ZodOptional<z.ZodString>;
         symbol: z.ZodOptional<z.ZodEnum<{
@@ -156,8 +156,8 @@ export declare const ChartSeriesDefinitionSchema: z.ZodObject<{
         markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
                 max: "max";
-                min: "min";
                 average: "average";
+                min: "min";
             }>>;
             yValue: z.ZodOptional<z.ZodNumber>;
             xValue: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
@@ -172,8 +172,8 @@ export declare const ChartSeriesDefinitionSchema: z.ZodObject<{
         markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
                 max: "max";
-                min: "min";
                 average: "average";
+                min: "min";
             }>>;
             label: z.ZodOptional<z.ZodString>;
             symbol: z.ZodOptional<z.ZodEnum<{
@@ -240,8 +240,8 @@ export declare const ChartSeriesSchema: z.ZodObject<{
         markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
                 max: "max";
-                min: "min";
                 average: "average";
+                min: "min";
             }>>;
             yValue: z.ZodOptional<z.ZodNumber>;
             xValue: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
@@ -256,8 +256,8 @@ export declare const ChartSeriesSchema: z.ZodObject<{
         markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
                 max: "max";
-                min: "min";
                 average: "average";
+                min: "min";
             }>>;
             label: z.ZodOptional<z.ZodString>;
             symbol: z.ZodOptional<z.ZodEnum<{
@@ -605,8 +605,8 @@ export type ChartTypeConfig_Heatmap = z.infer<typeof ChartTypeConfig_HeatmapSche
 export declare const ChartTypeConfig_SankeySchema: z.ZodObject<{
     emphasisFocus: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        self: "self";
         adjacency: "adjacency";
+        self: "self";
     }>>;
     nodeWidth: z.ZodOptional<z.ZodNumber>;
     nodeGap: z.ZodOptional<z.ZodNumber>;
@@ -817,8 +817,8 @@ export declare const ChartTypeConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$loose>, z.ZodObject<{
     emphasisFocus: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        self: "self";
         adjacency: "adjacency";
+        self: "self";
     }>>;
     nodeWidth: z.ZodOptional<z.ZodNumber>;
     nodeGap: z.ZodOptional<z.ZodNumber>;
@@ -1024,8 +1024,8 @@ export declare const ChartViewOptionsSchema: z.ZodObject<{
     }, z.core.$loose>, z.ZodObject<{
         emphasisFocus: z.ZodOptional<z.ZodEnum<{
             none: "none";
-            self: "self";
             adjacency: "adjacency";
+            self: "self";
         }>>;
         nodeWidth: z.ZodOptional<z.ZodNumber>;
         nodeGap: z.ZodOptional<z.ZodNumber>;
@@ -1212,8 +1212,8 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
             markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 type: z.ZodOptional<z.ZodEnum<{
                     max: "max";
-                    min: "min";
                     average: "average";
+                    min: "min";
                 }>>;
                 yValue: z.ZodOptional<z.ZodNumber>;
                 xValue: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
@@ -1228,8 +1228,8 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
             markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 type: z.ZodOptional<z.ZodEnum<{
                     max: "max";
-                    min: "min";
                     average: "average";
+                    min: "min";
                 }>>;
                 label: z.ZodOptional<z.ZodString>;
                 symbol: z.ZodOptional<z.ZodEnum<{
@@ -1510,8 +1510,8 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
     }, z.core.$loose>, z.ZodObject<{
         emphasisFocus: z.ZodOptional<z.ZodEnum<{
             none: "none";
-            self: "self";
             adjacency: "adjacency";
+            self: "self";
         }>>;
         nodeWidth: z.ZodOptional<z.ZodNumber>;
         nodeGap: z.ZodOptional<z.ZodNumber>;

package/dist/esm/config/frontend/navigation.shared.schemas.d.ts CHANGED Viewed

@@ -37,6 +37,8 @@ import { CoreResourceOperation } from '../../resources/resources.shared.core.def
  * `push` behavior depends on the zone's `contentModel`:
  * - In `single` zones: stack-based (new content on top, back pops)
  * - In `tabbed` zones: opens a new tab (or activates existing for same resource)
+ *
+ * @wildo_source:part:start saas.models.navigation.transition-vocabulary facet:layer:shared facet:family:navigation-config
  */
 export declare enum NavigationTransition {
     /**
@@ -124,6 +126,7 @@ export declare enum NavigationTransition {
      */
     PROMOTE = "promote"
 }
+/** @wildo_source:part:end saas.models.navigation.transition-vocabulary */
 /**
  * Named layout zones — configurable structural areas WHERE content lives.
  *
@@ -136,6 +139,8 @@ export declare enum NavigationTransition {
  * Note: `overlay` is NOT a named zone — it's an implicit layer always available.
  * Overlay is a runtime destination, not a configurable zone. See `NavigationZone`
  * in the frontend runtime types for the full set including overlay.
+ *
+ * @wildo_source:part:start saas.models.navigation.surface-vocabulary facet:layer:shared facet:family:navigation-config
  */
 export declare enum NavigationZoneName {
     /** Main content area. Lists, root-level reads, primary workspace. Always exists. */
@@ -198,7 +203,10 @@ export declare enum ResponsiveCollapseMode {
      */
     OVERLAY = "overlay"
 }
+/** @wildo_source:part:end saas.models.navigation.surface-vocabulary */
 /**
+ * @wildo_source:part:start saas.models.navigation.zone-declaration facet:layer:shared facet:family:navigation-config
+ *
  * What happens when a zone's last content is dismissed.
  * Only meaningful for secondary and companion zones (primary never empties,
  * overlay auto-dismisses by definition).
@@ -217,7 +225,10 @@ export declare enum ZoneEmptyBehavior {
      */
     EMPTY_STATE = "emptyState"
 }
+/** @wildo_source:part:end saas.models.navigation.zone-declaration */
 /**
+ * @wildo_source:part:start saas.models.navigation.surface-vocabulary facet:layer:shared facet:family:navigation-config
+ *
  * Visual presentation for overlay transitions.
  * Determines how floating content renders above the layout.
  */
@@ -259,6 +270,7 @@ export declare enum SplitAppearance {
      */
     DRAWER = "drawer"
 }
+/** @wildo_source:part:end saas.models.navigation.surface-vocabulary */
 /**
  * A value that is either a plain `T` (applies at all viewports) or a
  * viewport-keyed partial record for per-breakpoint control.
@@ -375,6 +387,26 @@ export declare const ZoneAppearanceSchema: z.ZodObject<{
     overlay: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<typeof OverlayAppearance>, z.ZodRecord<z.ZodEnum<typeof ViewportBreakpoint> & z.core.$partial, z.ZodEnum<typeof OverlayAppearance>>]>>;
 }, z.core.$strip>;
 export type ZoneAppearance = z.infer<typeof ZoneAppearanceSchema>;
+/**
+ * @wildo_source:part:start saas.models.navigation.zone-declaration facet:layer:shared facet:family:navigation-config
+ *
+ * How much of its zone a DESTINATION's content occupies.
+ *
+ * The primary zone caps and centres its content at `var(--content-max-width, 80rem)` and gives it no
+ * definite-height ancestor. That is correct for almost everything a zone hosts — a form, a list, a
+ * settings page stretched across a 2560px monitor is unreadable — and wrong for content whose whole
+ * value is the space it occupies. Until this enum existed there was no way to tell the two apart, so
+ * a canvas had to hand-roll a viewport fraction (`h-[70vh]`), which sizes against the WINDOW rather
+ * than the container and therefore ignores whatever chrome sits above it.
+ *
+ * Declared per DESTINATION rather than per zone: the same primary zone hosts a list that wants the
+ * cap, a detail page that caps itself, and a graph that wants neither.
+ *
+ * Width and height are separable on purpose. A wide data table wants the cap gone and its natural
+ * height; collapsing both into one boolean would merge two meanings, and two independent booleans
+ * would make "full height, still capped at 80rem" representable — a combination nothing wants and
+ * someone would eventually author by accident.
+ */
 /**
  * Full zone configuration.
  *
@@ -409,6 +441,7 @@ export declare const ZoneConfigSchema: z.ZodObject<{
     responsiveCollapse: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<typeof ResponsiveCollapseMode>, z.ZodRecord<z.ZodEnum<typeof ViewportBreakpoint> & z.core.$partial, z.ZodEnum<typeof ResponsiveCollapseMode>>]>>;
 }, z.core.$strip>;
 export type ZoneConfig = z.infer<typeof ZoneConfigSchema>;
+/** @wildo_source:part:end saas.models.navigation.zone-declaration */
 /**
  * App-level navigation configuration: from OUTSIDE the zone system.
  *

package/dist/esm/config/frontend/navigation.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"navigation.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/config/frontend/navigation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAO1F~~;;;;;;;;;;;;;GAaG~~;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,IAAI,SAAS;IACb;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;OAKG;IACH,KAAK,UAAU;IACf;;;;;OAKG;IACH,OAAO,YAAY;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,OAAO,YAAY;IACnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,YAAY;CACpB;~~AAED;;;;;;;;;;;;GAYG~~;AACH,oBAAY,kBAAkB;IAC5B,oFAAoF;IACpF,OAAO,YAAY;IACnB;;;;OAIG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;GAMG;AACH,oBAAY,0BAA0B;IACpC;;;;;OAKG;IACH,MAAM,WAAW;IACjB;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;GAMG;AACH,oBAAY,sBAAsB;IAChC;;;;OAIG;IACH,IAAI,SAAS;IACb;;;;OAIG;IACH,OAAO,YAAY;CACpB;~~AAED;;;;GAIG~~;AACH,oBAAY,iBAAiB;IAC3B;;;;OAIG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,WAAW,eAAe;CAC3B;~~AAED;;;GAGG~~;AACH,oBAAY,iBAAiB;IAC3B;;;;OAIG;IACH,MAAM,WAAW;IACjB;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;OAIG;IACH,MAAM,WAAW;CAClB;AAED;;;GAGG;AACH,oBAAY,eAAe;IACzB;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;OAIG;IACH,MAAM,WAAW;CAClB;~~AAMD~~;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,oGAQ9E;AAOD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB;;;;iBA0BlC,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;mBAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAOtE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,+HAA+H;AAC/H,eAAO,MAAM,qBAAqB,EAGlB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB;;;iBAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;iBA0D3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;~~AAO1D~~;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAGlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAOxE;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;iBAqBrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;iBA+B5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAO5D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAOtE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH;;;;;;;;;;;;;;GAcG;AACH,oBAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;;OAKG;IACH,KAAK,UAAU;IACf;;;;;OAKG;IACH,IAAI,SAAS;CACd;AAED,qGAAqG;AACrG,eAAO,MAAM,wCAAwC,EAAE,6BAAqE,CAAC;AAE7H;;;GAGG;AACH,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,6BAA6B,GAAG,SAAS,GAAG,OAAO,CAG7G;AAED,yEAAyE;AACzE,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,6BAA6B,GAAG,SAAS,GAAG,OAAO,CAG/G;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmDjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,2DAA2D"}
1	+ {"version":3,"file":"navigation.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/config/frontend/navigation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAO1F;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,IAAI,SAAS;IACb;;;;OAIG;IACH,OAAO,YAAY;IACnB;;;;;OAKG;IACH,KAAK,UAAU;IACf;;;;;OAKG;IACH,OAAO,YAAY;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,OAAO,YAAY;IACnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,YAAY;CACpB;AACD,0EAA0E;AAE1E;;;;;;;;;;;;;;GAcG;AACH,oBAAY,kBAAkB;IAC5B,oFAAoF;IACpF,OAAO,YAAY;IACnB;;;;OAIG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;GAMG;AACH,oBAAY,0BAA0B;IACpC;;;;;OAKG;IACH,MAAM,WAAW;IACjB;;;;;OAKG;IACH,MAAM,WAAW;CAClB;AAED;;;;;;GAMG;AACH,oBAAY,sBAAsB;IAChC;;;;OAIG;IACH,IAAI,SAAS;IACb;;;;OAIG;IACH,OAAO,YAAY;CACpB;AACD,uEAAuE;AAEvE;;;;;;GAMG;AACH,oBAAY,iBAAiB;IAC3B;;;;OAIG;IACH,QAAQ,aAAa;IACrB;;;;OAIG;IACH,WAAW,eAAe;CAC3B;AACD,qEAAqE;AAErE;;;;;GAKG;AACH,oBAAY,iBAAiB;IAC3B;;;;OAIG;IACH,MAAM,WAAW;IACjB;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;OAIG;IACH,MAAM,WAAW;CAClB;AAED;;;GAGG;AACH,oBAAY,eAAe;IACzB;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;OAIG;IACH,MAAM,WAAW;CAClB;AACD,uEAAuE;AAMvE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,oGAQ9E;AAOD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB;;;;iBA0BlC,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;mBAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAOtE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,+HAA+H;AAC/H,eAAO,MAAM,qBAAqB,EAGlB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB;;;iBAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;iBA0D3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,qEAAqE;AAOrE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAGlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAOxE;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;iBAqBrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;iBA+B5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAO5D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAOtE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH;;;;;;;;;;;;;;GAcG;AACH,oBAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;;OAKG;IACH,KAAK,UAAU;IACf;;;;;OAKG;IACH,IAAI,SAAS;CACd;AAED,qGAAqG;AACrG,eAAO,MAAM,wCAAwC,EAAE,6BAAqE,CAAC;AAE7H;;;GAGG;AACH,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,6BAA6B,GAAG,SAAS,GAAG,OAAO,CAG7G;AAED,yEAAyE;AACzE,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,6BAA6B,GAAG,SAAS,GAAG,OAAO,CAG/G;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmDjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,2DAA2D"}

package/dist/esm/config/frontend/navigation.shared.schemas.js CHANGED Viewed

@@ -40,6 +40,8 @@ import { CoreResourceOperation } from '../../resources/resources.shared.core.def
  * `push` behavior depends on the zone's `contentModel`:
  * - In `single` zones: stack-based (new content on top, back pops)
  * - In `tabbed` zones: opens a new tab (or activates existing for same resource)
+ *
+ * @wildo_source:part:start saas.models.navigation.transition-vocabulary facet:layer:shared facet:family:navigation-config
  */
 export var NavigationTransition;
 (function (NavigationTransition) {
@@ -128,6 +130,7 @@ export var NavigationTransition;
      */
     NavigationTransition["PROMOTE"] = "promote";
 })(NavigationTransition || (NavigationTransition = {}));
+/** @wildo_source:part:end saas.models.navigation.transition-vocabulary */
 /**
  * Named layout zones — configurable structural areas WHERE content lives.
  *
@@ -140,6 +143,8 @@ export var NavigationTransition;
  * Note: `overlay` is NOT a named zone — it's an implicit layer always available.
  * Overlay is a runtime destination, not a configurable zone. See `NavigationZone`
  * in the frontend runtime types for the full set including overlay.
+ *
+ * @wildo_source:part:start saas.models.navigation.surface-vocabulary facet:layer:shared facet:family:navigation-config
  */
 export var NavigationZoneName;
 (function (NavigationZoneName) {
@@ -205,7 +210,10 @@ export var ResponsiveCollapseMode;
      */
     ResponsiveCollapseMode["OVERLAY"] = "overlay";
 })(ResponsiveCollapseMode || (ResponsiveCollapseMode = {}));
+/** @wildo_source:part:end saas.models.navigation.surface-vocabulary */
 /**
+ * @wildo_source:part:start saas.models.navigation.zone-declaration facet:layer:shared facet:family:navigation-config
+ *
  * What happens when a zone's last content is dismissed.
  * Only meaningful for secondary and companion zones (primary never empties,
  * overlay auto-dismisses by definition).
@@ -225,7 +233,10 @@ export var ZoneEmptyBehavior;
      */
     ZoneEmptyBehavior["EMPTY_STATE"] = "emptyState";
 })(ZoneEmptyBehavior || (ZoneEmptyBehavior = {}));
+/** @wildo_source:part:end saas.models.navigation.zone-declaration */
 /**
+ * @wildo_source:part:start saas.models.navigation.surface-vocabulary facet:layer:shared facet:family:navigation-config
+ *
  * Visual presentation for overlay transitions.
  * Determines how floating content renders above the layout.
  */
@@ -397,6 +408,26 @@ export const ZoneAppearanceSchema = z.object({
     /** How overlay content renders. Default: `OverlayAppearance.DIALOG` (centered modal). */
     overlay: viewportDiscriminatedSchema(z.enum(OverlayAppearance)).optional(),
 });
+/**
+ * @wildo_source:part:start saas.models.navigation.zone-declaration facet:layer:shared facet:family:navigation-config
+ *
+ * How much of its zone a DESTINATION's content occupies.
+ *
+ * The primary zone caps and centres its content at `var(--content-max-width, 80rem)` and gives it no
+ * definite-height ancestor. That is correct for almost everything a zone hosts — a form, a list, a
+ * settings page stretched across a 2560px monitor is unreadable — and wrong for content whose whole
+ * value is the space it occupies. Until this enum existed there was no way to tell the two apart, so
+ * a canvas had to hand-roll a viewport fraction (`h-[70vh]`), which sizes against the WINDOW rather
+ * than the container and therefore ignores whatever chrome sits above it.
+ *
+ * Declared per DESTINATION rather than per zone: the same primary zone hosts a list that wants the
+ * cap, a detail page that caps itself, and a graph that wants neither.
+ *
+ * Width and height are separable on purpose. A wide data table wants the cap gone and its natural
+ * height; collapsing both into one boolean would merge two meanings, and two independent booleans
+ * would make "full height, still capped at 80rem" representable — a combination nothing wants and
+ * someone would eventually author by accident.
+ */
 /**
  * Full zone configuration.
  *
@@ -461,6 +492,7 @@ export const ZoneConfigSchema = z.object({
      */
     responsiveCollapse: viewportDiscriminatedSchema(z.enum(ResponsiveCollapseMode)).optional(),
 });
+/** @wildo_source:part:end saas.models.navigation.zone-declaration */
 // ════════════════════════════════════════════════════════════════
 // App-Level & From-Overlay Configuration
 // ════════════════════════════════════════════════════════════════