npm - @wildo-ai/saas-models - Versions diffs - 1.1.2 → 1.1.3 - Mend

@wildo-ai/saas-models 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (410) hide show

package/dist/esm/config/entity-identity-config.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,6EAA2C,CAAA;IAC3C,uEAAqC,CAAA;IACrC,2EAAyC,CAAA;IACzC,2DAAyB,CAAA;IACzB,6FAA2D,CAAA;AAC7D,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0EAAiD,CAAA;IACjD,8CAAqB,CAAA;AACvB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9B;;;;;MAKE;IACF,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACnC,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,KAAK,UAAU,CAAC,QAAQ;WAC3B,MAAM,KAAK,UAAU,CAAC,eAAe,CAC3C,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;WACxC,YAAY,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1D,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,4FAA4F;IAC5F,YAAY,EAAE,wBAAwB;IAEtC,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D,uCAAuC;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,KAAK;KACrC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C;;;;;;mHAM+G;IAC/G,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,+EAA+E;AAE/E,gFAAgF;AAChF,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,qCAAW,CAAA;IACX,uCAAa,CAAA;IACb,mDAAyB,CAAA;AAC3B,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC;KACpD,WAAW,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;IACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,iBAAiB,CAClB,EAAE,CAAC;QACF,MAAM,mBAAmB,GACvB,UAAU,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,gBAAgB;wBAChB,gBAAgB;wBAChB,8BAA8B;wBAC9B,KAAK;qBACN;oBACD,OAAO,EACL,cAAc,QAAQ,sCAAsC;0BAC1D,IAAI,aAAa,0CAA0C;0BAC3D,8DAA8D;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAYL;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAK7D,iBAAoE,EACpE,kBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAC9D,kBAAkB,CACnB,CACF;SACA,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC,CAAC;AACR,CAAC","sourcesContent":["/*\n Entity & Identity Configuration Schemas\n \n Top-level config sections: userTypes, frontendServices, organizationTypes.\n * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).\n \n Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.\n * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.\n \n See:\n * - target-configuration-type.md §2b (UserTypeAuthPolicy)\n * - entity-identity-architecture-analysis.md §4.2\n /\n\nimport { z } from 'zod';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { AppFrontendType } from './app-frontend-type.shared.schemas';\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\n/* Canonical registration-policy discriminant. /\nexport enum RegistrationMode {\n OPEN = 'open',\n INVITATION_ONLY = 'invitation_only',\n ADMIN_ONLY = 'admin_only',\n DISABLED = 'disabled',\n}\n\n/\n Semantically distinct ways in which a user can acquire a user type.\n \n Keep these channels separate even when two currently share the same mode matrix: the actor,\n * user intent, and security boundary differ, and future policy can evolve one without silently\n * changing the others.\n /\nexport enum RegistrationAcquisitionChannel {\n PUBLIC_SELF_SERVICE = 'public_self_service',\n SOCIAL_OAUTH_JIT = 'social_oauth_jit',\n ENTERPRISE_SSO_JIT = 'enterprise_sso_jit',\n INVITATION = 'invitation',\n ADMINISTRATIVE_PROVISIONING = 'administrative_provisioning',\n}\n\n/* D-19: Email verification timing. /\nexport enum EmailVerificationMode {\n REQUIRED_BEFORE_ACCESS = 'required_before_access',\n DEFERRED = 'deferred',\n}\n\n/* E-10, D-15: How much orgs can override user-type auth methods. /\nexport enum OrgAuthMethodPolicy {\n RESTRICT_ONLY = 'restrict_only',\n EXPAND_WITHIN_SET = 'expand_within_set',\n UNRESTRICTED = 'unrestricted',\n}\n\n// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────\n\nexport const AuthMethodExpandedConfigSchema = z.object({\n enabled: z.boolean(),\n});\nexport type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;\n\n/\n authMethodsEnabled value: boolean shorthand OR expanded config.\n * Shorthand: PASSWORD: true → normalized at runtime to { enabled: true }.\n /\nconst AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);\n\n// ─── Policy Sub-Types ───────────────────────────────────────────────────────\n\nexport const MfaPolicyConfigSchema = z.object({\n requireMFA: z.boolean().default(false),\n /* D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n /* Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. /\n acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),\n /* D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. /\n enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),\n /* C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. /\n passkeyExemptFromMFA: z.boolean().default(true),\n});\nexport type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;\n\n/\n Registration policy for one user type.\n \n Every user type must author this object explicitly. Acquisition policy is security\n * configuration, so omission must never silently become open registration.\n /\nexport const RegistrationConfigSchema = z.strictObject({\n mode: z.enum(RegistrationMode),\n /\n Only acquisition methods with a complete public-signup implementation are accepted.\n * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an\n * end-to-end registration flow; declaring them here would otherwise advertise a path\n * the runtime cannot execute.\n /\n allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n /* D-19: 'deferred' gives immediate access, verify later. /\n emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),\n /* R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. /\n blockForSSODomains: z.boolean().default(false),\n}).superRefine((registration, ctx) => {\n const unsupportedMethods = registration.allowedMethods.filter(\n (method) =>\n method !== AuthMethod.PASSWORD\n && method !== AuthMethod.EXTERNAL_OAUTH2,\n );\n if (unsupportedMethods.length > 0) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,\n });\n }\n if (\n registration.mode === RegistrationMode.OPEN\n && registration.allowedMethods.length === 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: 'Open registration requires at least one supported acquisition method',\n });\n }\n});\nexport type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;\n\n/\n Password policy — includes expiryDays (R-8, moved from flat auth field).\n * Defined here (not in app-configuration-shared) to avoid circular dependency.\n * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.\n /\nexport const PasswordPolicyConfigSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /* R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). /\n expiryDays: z.number().min(0).default(0),\n});\nexport type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;\n\n/* E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. /\nexport const StepUpAuthConfigSchema = z.object({\n enabled: z.boolean().default(false),\n maxAgeSeconds: z.number().min(60).max(3600).default(300),\n methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n});\nexport type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;\n\nexport const LockoutPolicyConfigSchema = z.object({\n maxLoginAttempts: z.number().min(3).max(20).default(5),\n lockoutDurationMinutes: z.number().min(1).max(1440).default(30),\n /* W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. /\n progressiveLockout: z.boolean().default(false),\n /* W2.3: cap for progressive lockout duration in hours. /\n maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),\n});\nexport type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;\n\nexport const MethodManagementConfigSchema = z.object({\n allowUserMethodRemoval: z.boolean().default(true),\n requireReauthForMethodChanges: z.boolean().default(false),\n});\nexport type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;\n\n// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────\n\n/\n The complete auth policy for a user type. Every user type MUST define this.\n * There are no global auth defaults — this IS the auth config.\n \n Zod .default() values enable omission in config input files, but the\n * resolved runtime type has all fields present (no optionals for policy fields).\n \n See target-configuration-type.md §2b for full specification.\n /\nexport const UserTypeAuthPolicySchema = z.object({\n /* E-1, D-20: Opt-in semantics — absent method = disabled. /\n authMethodsEnabled: z.partialRecord(\n z.enum(AuthMethod),\n AuthMethodValueSchema,\n ).default({ [AuthMethod.PASSWORD]: true }),\n\n /* E-2: MFA enforcement for this user type. /\n mfaPolicy: MfaPolicyConfigSchema.default({\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n }),\n\n /* E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. /\n registration: RegistrationConfigSchema,\n\n /* E-7, R-8: Password strength + expiry. /\n passwordPolicy: PasswordPolicyConfigSchema.default({\n minLength: 8,\n maxLength: 128,\n requireUppercase: true,\n requireLowercase: true,\n requireNumbers: true,\n requireSpecialChars: false,\n expiryDays: 0,\n }),\n\n /* E-8: Session duration for this user type. /\n sessionDurationMinutes: z.number().min(1).max(1440).default(30),\n\n /* E-8, G-2: undefined = unlimited. /\n maxConcurrentSessions: z.number().min(1).optional(),\n\n /* G-1: Per-user-type lockout. Backend-only. /\n lockoutPolicy: LockoutPolicyConfigSchema.default({\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n }),\n\n /* G-8: Consumer=true (convenience), Admin=false (security). /\n autoLinkByEmail: z.boolean().default(true),\n\n /* E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). /\n stepUpAuth: StepUpAuthConfigSchema.optional(),\n\n methodManagement: MethodManagementConfigSchema.default({\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: false,\n }),\n\n /* W7.3a: Enables anonymous session support for this user type. When true,\n * unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.\n * On login/register for this user type, anonymous resources are transposed to the authenticated user. /\n anonymousSessionsEnabled: z.boolean().optional(),\n\n /* W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. /\n oneOffSessionAllowed: z.boolean().optional(),\n\n /* revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted\n * for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide\n * absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is\n * bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,\n * the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The\n * ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap\n * enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). /\n oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),\n});\nexport type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;\n\n// ─── User Type Definition ───────────────────────────────────────────────────\n\nexport const UserTypeDefinitionSchema = z.object({\n /* REQUIRED — the complete auth policy for this user type. Not an override of global. /\n auth: UserTypeAuthPolicySchema,\n\n /* DEFERRED: Only 'email' supported. Accepts any string; engine warns if !== 'email'. /\n uniqueIdentifier: z.string().default('email'),\n\n defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),\n\n /* D-10: When set, user type auto-revoked when user leaves last org of matching type. /\n requiresOrgMembership: z.object({\n orgTypes: z.array(z.string()).min(1),\n }).optional(),\n});\nexport type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;\n\n// ─── Frontend Service Identity ──────────────────────────────────────────────\n\nexport const FrontendServiceUserManagementEntrySchema = z.object({\n register: z.boolean(),\n auth: z.boolean(),\n isDefault: z.boolean().optional(),\n});\nexport type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;\n\n/\n Backend-runtime view of one frontend service.\n \n Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`\n * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.\n \n - `usersManagement` — auth-policy bindings per user type (legacy field;\n * present since the original auth identity model).\n * - `frontendType` — the runtime kind declared in\n * `wildo.saas.config.ts → services[name].frontendType`. Currently\n * informational on the backend; reserved for `frontendType`-conditioned\n * policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The\n * full taxonomy + the \"no native variants\" decision live in\n * `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT\n * duplicate that explanation here.\n /\nexport const FrontendServiceDefinitionSchema = z.object({\n usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),\n frontendType: z.enum(AppFrontendType).optional(),\n});\nexport type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;\n\n// ─── Organization Type ──────────────────────────────────────────────────────\n\n/* How a registration-derived organization obtains its initial display name. /\nexport enum OrganizationNameSource {\n ASK = 'ask',\n AUTO = 'auto',\n ONBOARDING = 'onboarding',\n}\n\nexport const OrgCreationPolicySchema = z.object({\n createOnUserTypeRegistration: z.array(z.string()).min(1),\n orgNameSource: z.enum(OrganizationNameSource),\n defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),\n});\nexport type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;\n\n/* D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. /\nexport const OrgTypeAuthOverridesSchema = z.object({\n authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),\n mfaPolicy: MfaPolicyConfigSchema.partial().optional(),\n passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),\n}).optional();\nexport type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;\n\n/* G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). /\nexport const OrgScimProvisioningSchema = z.object({\n enabled: z.boolean().default(false),\n syncFrequencyHours: z.number().min(1).max(720).default(24),\n});\nexport type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;\n\nexport const OrganizationTypeDefinitionSchema = z.object({\n /* D-10: User types auto-granted when joining this org type. /\n userTypes: z.array(z.string()).min(1),\n\n availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n CORE_ORG_ROLES.ORG_MEMBER,\n ]),\n\n /* R-5: Moved from registration.defaultOrgRole. /\n defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),\n\n /* D-15: Most-restrictive-wins on top of user type auth policy. /\n authOverrides: OrgTypeAuthOverridesSchema,\n\n /* G-4: SCIM provisioning toggle per org type. /\n scimProvisioning: OrgScimProvisioningSchema.optional(),\n\n creationPolicy: OrgCreationPolicySchema.optional(),\n});\nexport type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;\n\n// ─── Top-Level Config Sections ──────────────────────────────────────────────\n\nexport const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);\nexport type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;\n\nexport const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);\nexport type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;\n\nexport const OrganizationTypesConfigSchema = z\n .record(z.string(), OrganizationTypeDefinitionSchema)\n .superRefine((organizationTypes, ctx) => {\n const ownerByRegisteredUserType = new Map<string, string>();\n for (const [organizationType, definition] of Object.entries(\n organizationTypes,\n )) {\n const registeredUserTypes =\n definition.creationPolicy?.createOnUserTypeRegistration ?? [];\n registeredUserTypes.forEach((userType, index) => {\n const existingOwner = ownerByRegisteredUserType.get(userType);\n if (existingOwner !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: [\n organizationType,\n 'creationPolicy',\n 'createOnUserTypeRegistration',\n index,\n ],\n message:\n `User type '${userType}' already creates organization type `\n + `'${existingOwner}' during registration; one registration `\n + 'cannot implicitly choose between multiple organization types',\n });\n return;\n }\n ownerByRegisteredUserType.set(userType, organizationType);\n });\n }\n });\nexport type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;\n\nexport interface OrganizationTypeRegistrationCreationMatch<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n } = OrganizationTypeDefinition,\n> {\n readonly organizationType: string;\n readonly definition: TDefinition;\n}\n\n/\n Canonical matching rule for registration-derived organization creation.\n \n The schema rejects more than one match for a user type. Returning all\n * matches is intentional defensive behavior for stale/unparsed runtime input:\n * callers can fail closed instead of selecting record insertion order.\n */\nexport function findOrganizationTypeRegistrationCreationMatches<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n },\n>(\n organizationTypes: Readonly<Record<string, TDefinition>> \| undefined,\n registeredUserType: string,\n): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[] {\n if (!organizationTypes) return [];\n return Object.entries(organizationTypes)\n .filter(([, definition]) =>\n definition.creationPolicy?.createOnUserTypeRegistration.includes(\n registeredUserType,\n ),\n )\n .map(([organizationType, definition]) => ({\n organizationType,\n definition,\n }));\n}\n"]}
1	+ {"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,6EAA2C,CAAA;IAC3C,uEAAqC,CAAA;IACrC,2EAAyC,CAAA;IACzC,2DAAyB,CAAA;IACzB,6FAA2D,CAAA;AAC7D,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0EAAiD,CAAA;IACjD,8CAAqB,CAAA;AACvB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACnC;;;;;;;;OAQG;IACH,MAAM,2BAA2B,GAA0B;QACzD,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,OAAO;KACnB,CAAC;IACF,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC1D,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;WACxC,YAAY,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1D,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,4FAA4F;IAC5F,YAAY,EAAE,wBAAwB;IAEtC,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,KAAK;KACrC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C;;;;;;mHAM+G;IAC/G,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,qCAAW,CAAA;IACX,uCAAa,CAAA;IACb,mDAAyB,CAAA;AAC3B,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/D;;;;;;;;;;;;;OAaG;IACH,UAAU,EAAE,sBAAsB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEH,mEAAmE;AAEnE,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC;KACpD,WAAW,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;IACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,iBAAiB,CAClB,EAAE,CAAC;QACF,MAAM,mBAAmB,GACvB,UAAU,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,gBAAgB;wBAChB,gBAAgB;wBAChB,8BAA8B;wBAC9B,KAAK;qBACN;oBACD,OAAO,EACL,cAAc,QAAQ,sCAAsC;0BAC1D,IAAI,aAAa,0CAA0C;0BAC3D,8DAA8D;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAYL;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAK7D,iBAAoE,EACpE,kBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAC9D,kBAAkB,CACnB,CACF;SACA,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC,CAAC;AACR,CAAC","sourcesContent":["/*\n Entity & Identity Configuration Schemas\n \n Top-level config sections: userTypes, frontendServices, organizationTypes.\n * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).\n \n Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.\n * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.\n \n See:\n * - target-configuration-type.md §2b (UserTypeAuthPolicy)\n * - entity-identity-architecture-analysis.md §4.2\n /\n\nimport { z } from 'zod';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { AppFrontendType } from './app-frontend-type.shared.schemas';\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\n/* Canonical registration-policy discriminant. /\nexport enum RegistrationMode {\n OPEN = 'open',\n INVITATION_ONLY = 'invitation_only',\n ADMIN_ONLY = 'admin_only',\n DISABLED = 'disabled',\n}\n\n/\n Semantically distinct ways in which a user can acquire a user type.\n \n Keep these channels separate even when two currently share the same mode matrix: the actor,\n * user intent, and security boundary differ, and future policy can evolve one without silently\n * changing the others.\n /\nexport enum RegistrationAcquisitionChannel {\n PUBLIC_SELF_SERVICE = 'public_self_service',\n SOCIAL_OAUTH_JIT = 'social_oauth_jit',\n ENTERPRISE_SSO_JIT = 'enterprise_sso_jit',\n INVITATION = 'invitation',\n ADMINISTRATIVE_PROVISIONING = 'administrative_provisioning',\n}\n\n/* D-19: Email verification timing. /\nexport enum EmailVerificationMode {\n REQUIRED_BEFORE_ACCESS = 'required_before_access',\n DEFERRED = 'deferred',\n}\n\n/* E-10, D-15: How much orgs can override user-type auth methods. /\nexport enum OrgAuthMethodPolicy {\n RESTRICT_ONLY = 'restrict_only',\n EXPAND_WITHIN_SET = 'expand_within_set',\n UNRESTRICTED = 'unrestricted',\n}\n\n// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────\n\nexport const AuthMethodExpandedConfigSchema = z.object({\n enabled: z.boolean(),\n});\nexport type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;\n\n/\n authMethodsEnabled value: boolean shorthand OR expanded config.\n * Shorthand: PASSWORD: true → normalized at runtime to { enabled: true }.\n /\nconst AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);\n\n// ─── Policy Sub-Types ───────────────────────────────────────────────────────\n\nexport const MfaPolicyConfigSchema = z.object({\n requireMFA: z.boolean().default(false),\n /* D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n /* Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. /\n acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),\n /* D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. /\n enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),\n /* C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. /\n passkeyExemptFromMFA: z.boolean().default(true),\n});\nexport type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;\n\n/\n Registration policy for one user type.\n \n Every user type must author this object explicitly. Acquisition policy is security\n * configuration, so omission must never silently become open registration.\n /\nexport const RegistrationConfigSchema = z.strictObject({\n mode: z.enum(RegistrationMode),\n /\n Only acquisition methods with a complete public-signup implementation are accepted.\n \n PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public\n * registration in #463; before that they were authentication and enrollment methods only, and\n * declaring one here was refused because it would have advertised a path the runtime could not\n * execute.\n \n A password-less signup creates the account with NO credential and proves the address by a magic\n * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —\n * \"access now, verify later\" is not a state the runtime can produce for a registrant who holds\n * nothing. See `registerUser`.\n /\n allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n /* D-19: 'deferred' gives immediate access, verify later. /\n emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),\n /* R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. /\n blockForSSODomains: z.boolean().default(false),\n}).superRefine((registration, ctx) => {\n /\n * The set with a public-signup implementation. It is enumerated rather than open because the\n * failure this refusal prevents is silent: a method listed here is ADVERTISED to a registrant, and\n * one the runtime cannot execute fails after they have committed to it.\n \n MAGIC_LINK and PASSKEY joined in #463. Anything else — SSO, an MFA factor — is an authentication\n * or enrollment method that has no way to CREATE an account from an anonymous caller, and adding it\n * here means building that flow first, not widening this list.\n /\n const publiclyRegisterableMethods: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.EXTERNAL_OAUTH2,\n AuthMethod.MAGIC_LINK,\n AuthMethod.PASSKEY,\n ];\n const unsupportedMethods = registration.allowedMethods.filter(\n (method) => !publiclyRegisterableMethods.includes(method),\n );\n if (unsupportedMethods.length > 0) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,\n });\n }\n if (\n registration.mode === RegistrationMode.OPEN\n && registration.allowedMethods.length === 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: 'Open registration requires at least one supported acquisition method',\n });\n }\n});\nexport type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;\n\n/\n Password policy — includes expiryDays (R-8, moved from flat auth field).\n * Defined here (not in app-configuration-shared) to avoid circular dependency.\n * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.\n /\nexport const PasswordPolicyConfigSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /* R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). /\n expiryDays: z.number().min(0).default(0),\n});\nexport type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;\n\n/* E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. /\nexport const StepUpAuthConfigSchema = z.object({\n enabled: z.boolean().default(false),\n maxAgeSeconds: z.number().min(60).max(3600).default(300),\n methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n});\nexport type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;\n\nexport const LockoutPolicyConfigSchema = z.object({\n maxLoginAttempts: z.number().min(3).max(20).default(5),\n lockoutDurationMinutes: z.number().min(1).max(1440).default(30),\n /* W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. /\n progressiveLockout: z.boolean().default(false),\n /* W2.3: cap for progressive lockout duration in hours. /\n maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),\n});\nexport type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;\n\nexport const MethodManagementConfigSchema = z.object({\n allowUserMethodRemoval: z.boolean().default(true),\n requireReauthForMethodChanges: z.boolean().default(false),\n});\nexport type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;\n\n// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────\n\n/\n The complete auth policy for a user type. Every user type MUST define this.\n * There are no global auth defaults — this IS the auth config.\n \n Zod .default() values enable omission in config input files, but the\n * resolved runtime type has all fields present (no optionals for policy fields).\n \n See target-configuration-type.md §2b for full specification.\n /\nexport const UserTypeAuthPolicySchema = z.object({\n /* E-1, D-20: Opt-in semantics — absent method = disabled. /\n authMethodsEnabled: z.partialRecord(\n z.enum(AuthMethod),\n AuthMethodValueSchema,\n ).default({ [AuthMethod.PASSWORD]: true }),\n\n /* E-2: MFA enforcement for this user type. /\n mfaPolicy: MfaPolicyConfigSchema.default({\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n }),\n\n /* E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. /\n registration: RegistrationConfigSchema,\n\n /* E-7, R-8: Password strength + expiry. /\n passwordPolicy: PasswordPolicyConfigSchema.default({\n minLength: 8,\n maxLength: 128,\n requireUppercase: true,\n requireLowercase: true,\n requireNumbers: true,\n requireSpecialChars: false,\n expiryDays: 0,\n }),\n\n /* E-8: Session duration for this user type. /\n sessionDurationMinutes: z.number().min(1).max(1440).default(30),\n\n /\n E-8, G-2: the cap on simultaneous refresh chains for this user type.\n \n Leaving it undefined does NOT mean unlimited. The token issuer falls back to\n * `DEFAULT_MAX_CONCURRENT_SESSIONS` (10) and evicts the oldest chain beyond it, so a user type\n * that declares nothing is still capped. There is no value that disables the cap; declare the\n * number you want.\n /\n maxConcurrentSessions: z.number().min(1).optional(),\n\n /* G-1: Per-user-type lockout. Backend-only. /\n lockoutPolicy: LockoutPolicyConfigSchema.default({\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n }),\n\n /* G-8: Consumer=true (convenience), Admin=false (security). /\n autoLinkByEmail: z.boolean().default(true),\n\n /* E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). /\n stepUpAuth: StepUpAuthConfigSchema.optional(),\n\n methodManagement: MethodManagementConfigSchema.default({\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: false,\n }),\n\n /* W7.3a: Enables anonymous session support for this user type. When true,\n * unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.\n * On login/register for this user type, anonymous resources are transposed to the authenticated user. /\n anonymousSessionsEnabled: z.boolean().optional(),\n\n /* W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. /\n oneOffSessionAllowed: z.boolean().optional(),\n\n /* revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted\n * for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide\n * absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is\n * bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,\n * the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The\n * ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap\n * enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). /\n oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),\n});\nexport type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;\n\n// ─── User Type Definition ───────────────────────────────────────────────────\n\nexport const UserTypeDefinitionSchema = z.object({\n /* REQUIRED — the complete auth policy for this user type. Not an override of global. /\n auth: UserTypeAuthPolicySchema,\n\n /* DEFERRED: Only 'email' supported. Accepts any string; engine warns if !== 'email'. /\n uniqueIdentifier: z.string().default('email'),\n\n defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),\n\n /* D-10: When set, user type auto-revoked when user leaves last org of matching type. /\n requiresOrgMembership: z.object({\n orgTypes: z.array(z.string()).min(1),\n }).optional(),\n});\nexport type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;\n\n// ─── Frontend Service Identity ──────────────────────────────────────────────\n\nexport const FrontendServiceUserManagementEntrySchema = z.object({\n register: z.boolean(),\n auth: z.boolean(),\n isDefault: z.boolean().optional(),\n});\nexport type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;\n\n/\n Backend-runtime view of one frontend service.\n \n Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`\n * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.\n \n - `usersManagement` — auth-policy bindings per user type (legacy field;\n * present since the original auth identity model).\n * - `frontendType` — the runtime kind declared in\n * `wildo.saas.config.ts → services[name].frontendType`. Currently\n * informational on the backend; reserved for `frontendType`-conditioned\n * policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The\n * full taxonomy + the \"no native variants\" decision live in\n * `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT\n * duplicate that explanation here.\n /\nexport const FrontendServiceDefinitionSchema = z.object({\n usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),\n frontendType: z.enum(AppFrontendType).optional(),\n});\nexport type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;\n\n// ─── Organization Type ──────────────────────────────────────────────────────\n\n/\n @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer\n \n An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles\n * exist inside it, whether it can come into existence through sign-up, and how hard it is for its\n * members to prove who they are. Declared as `organizationTypes` in the application configuration.\n \n ## A type only self-creates if it says so\n \n `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a\n * tenant of this type into existence. A type an administrator creates simply omits the policy — and\n * a user type may match AT MOST ONE organization type, which the schema enforces rather than\n * resolving by record order.\n \n `orgNameSource` decides where that tenant's first display name comes from: `ASK` during\n * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who\n * the registrant becomes.\n \n ## `authOverrides` tightens, and can never loosen\n \n A tenant may restrict how its own members authenticate, on four axes and no others — enabled\n * methods, MFA policy, password policy and re-authentication freshness. Session length, lockout and\n * registration are NOT organization-overridable.\n \n Every axis is most-restrictive-wins on top of the user type, so an organization can subtract but\n * never add. Two directions worth stating because they differ: for step-up, `enabled` is an OR\n * (either side turning it on wins) while `maxAgeSeconds` is a MIN (the shorter window wins), and\n * `methods` intersects — an organization can withdraw an acceptable re-authentication method and\n * never introduce one the user type does not already allow.\n \n When a person belongs to SEVERAL organizations the sets intersect across all of them, so belonging\n * to a permissive tenant never restores what a strict one removed.\n \n How a registration-derived organization obtains its initial display name.\n /\nexport enum OrganizationNameSource {\n ASK = 'ask',\n AUTO = 'auto',\n ONBOARDING = 'onboarding',\n}\n\nexport const OrgCreationPolicySchema = z.object({\n createOnUserTypeRegistration: z.array(z.string()).min(1),\n orgNameSource: z.enum(OrganizationNameSource),\n defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),\n});\nexport type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;\n\n/* D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. /\nexport const OrgTypeAuthOverridesSchema = z.object({\n authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),\n mfaPolicy: MfaPolicyConfigSchema.partial().optional(),\n passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),\n /\n Re-authentication freshness, added 2026-09-09 (#527).\n \n The other three overrides and this one answer ONE question — how hard is it for this tenant's\n * members to prove who they are — and until now a tenant could tighten three of them. An\n * organisation that requires MFA and a 16-character password could still have a member mutate a\n * sensitive resource on an eight-hour-old session, because the app-wide default said so.\n \n Most-restrictive-wins like its siblings, but the two fields move in OPPOSITE arithmetic\n * directions and that is worth stating rather than inferring: `enabled` is an OR (either side\n * turning step-up ON wins) while `maxAgeSeconds` is a MIN (the shorter window wins). `methods`\n * intersects, so an organisation can withdraw an acceptable re-authentication method but never\n * introduce one the user type does not already allow.\n /\n stepUpAuth: StepUpAuthConfigSchema.partial().optional(),\n}).optional();\nexport type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;\n\n/* G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). /\nexport const OrgScimProvisioningSchema = z.object({\n enabled: z.boolean().default(false),\n syncFrequencyHours: z.number().min(1).max(720).default(24),\n});\nexport type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;\n\nexport const OrganizationTypeDefinitionSchema = z.object({\n /* D-10: User types auto-granted when joining this org type. /\n userTypes: z.array(z.string()).min(1),\n\n availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n CORE_ORG_ROLES.ORG_MEMBER,\n ]),\n\n /* R-5: Moved from registration.defaultOrgRole. /\n defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),\n\n /* D-15: Most-restrictive-wins on top of user type auth policy. /\n authOverrides: OrgTypeAuthOverridesSchema,\n\n /* G-4: SCIM provisioning toggle per org type. /\n scimProvisioning: OrgScimProvisioningSchema.optional(),\n\n creationPolicy: OrgCreationPolicySchema.optional(),\n});\nexport type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;\n/* @wildo_source:part:end saas.models.config.organization-types /\n\n// ─── Top-Level Config Sections ──────────────────────────────────────────────\n\nexport const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);\nexport type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;\n\nexport const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);\nexport type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;\n\nexport const OrganizationTypesConfigSchema = z\n .record(z.string(), OrganizationTypeDefinitionSchema)\n .superRefine((organizationTypes, ctx) => {\n const ownerByRegisteredUserType = new Map<string, string>();\n for (const [organizationType, definition] of Object.entries(\n organizationTypes,\n )) {\n const registeredUserTypes =\n definition.creationPolicy?.createOnUserTypeRegistration ?? [];\n registeredUserTypes.forEach((userType, index) => {\n const existingOwner = ownerByRegisteredUserType.get(userType);\n if (existingOwner !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: [\n organizationType,\n 'creationPolicy',\n 'createOnUserTypeRegistration',\n index,\n ],\n message:\n `User type '${userType}' already creates organization type `\n + `'${existingOwner}' during registration; one registration `\n + 'cannot implicitly choose between multiple organization types',\n });\n return;\n }\n ownerByRegisteredUserType.set(userType, organizationType);\n });\n }\n });\nexport type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;\n\nexport interface OrganizationTypeRegistrationCreationMatch<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n } = OrganizationTypeDefinition,\n> {\n readonly organizationType: string;\n readonly definition: TDefinition;\n}\n\n/\n Canonical matching rule for registration-derived organization creation.\n \n The schema rejects more than one match for a user type. Returning all\n * matches is intentional defensive behavior for stale/unparsed runtime input:\n * callers can fail closed instead of selecting record insertion order.\n */\nexport function findOrganizationTypeRegistrationCreationMatches<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n },\n>(\n organizationTypes: Readonly<Record<string, TDefinition>> \| undefined,\n registeredUserType: string,\n): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[] {\n if (!organizationTypes) return [];\n return Object.entries(organizationTypes)\n .filter(([, definition]) =>\n definition.creationPolicy?.createOnUserTypeRegistration.includes(\n registeredUserType,\n ),\n )\n .map(([organizationType, definition]) => ({\n organizationType,\n definition,\n }));\n}\n"]}

package/dist/esm/config/frontend/chart-definition.shared.schemas.d.ts CHANGED Viewed

@@ -74,8 +74,8 @@ export declare const ChartSeriesStyleSchema: z.ZodObject<{
     markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
         type: z.ZodOptional<z.ZodEnum<{
             max: "max";
-            min: "min";
             average: "average";
+            min: "min";
         }>>;
         yValue: z.ZodOptional<z.ZodNumber>;
         xValue: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
@@ -90,8 +90,8 @@ export declare const ChartSeriesStyleSchema: z.ZodObject<{
     markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
         type: z.ZodOptional<z.ZodEnum<{
             max: "max";
-            min: "min";
             average: "average";
+            min: "min";
         }>>;
         label: z.ZodOptional<z.ZodString>;
         symbol: z.ZodOptional<z.ZodEnum<{
@@ -156,8 +156,8 @@ export declare const ChartSeriesDefinitionSchema: z.ZodObject<{
         markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
                 max: "max";
-                min: "min";
                 average: "average";
+                min: "min";
             }>>;
             yValue: z.ZodOptional<z.ZodNumber>;
             xValue: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
@@ -172,8 +172,8 @@ export declare const ChartSeriesDefinitionSchema: z.ZodObject<{
         markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
                 max: "max";
-                min: "min";
                 average: "average";
+                min: "min";
             }>>;
             label: z.ZodOptional<z.ZodString>;
             symbol: z.ZodOptional<z.ZodEnum<{
@@ -240,8 +240,8 @@ export declare const ChartSeriesSchema: z.ZodObject<{
         markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
                 max: "max";
-                min: "min";
                 average: "average";
+                min: "min";
             }>>;
             yValue: z.ZodOptional<z.ZodNumber>;
             xValue: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
@@ -256,8 +256,8 @@ export declare const ChartSeriesSchema: z.ZodObject<{
         markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
                 max: "max";
-                min: "min";
                 average: "average";
+                min: "min";
             }>>;
             label: z.ZodOptional<z.ZodString>;
             symbol: z.ZodOptional<z.ZodEnum<{
@@ -605,8 +605,8 @@ export type ChartTypeConfig_Heatmap = z.infer<typeof ChartTypeConfig_HeatmapSche
 export declare const ChartTypeConfig_SankeySchema: z.ZodObject<{
     emphasisFocus: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        self: "self";
         adjacency: "adjacency";
+        self: "self";
     }>>;
     nodeWidth: z.ZodOptional<z.ZodNumber>;
     nodeGap: z.ZodOptional<z.ZodNumber>;
@@ -817,8 +817,8 @@ export declare const ChartTypeConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$loose>, z.ZodObject<{
     emphasisFocus: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        self: "self";
         adjacency: "adjacency";
+        self: "self";
     }>>;
     nodeWidth: z.ZodOptional<z.ZodNumber>;
     nodeGap: z.ZodOptional<z.ZodNumber>;
@@ -1024,8 +1024,8 @@ export declare const ChartViewOptionsSchema: z.ZodObject<{
     }, z.core.$loose>, z.ZodObject<{
         emphasisFocus: z.ZodOptional<z.ZodEnum<{
             none: "none";
-            self: "self";
             adjacency: "adjacency";
+            self: "self";
         }>>;
         nodeWidth: z.ZodOptional<z.ZodNumber>;
         nodeGap: z.ZodOptional<z.ZodNumber>;
@@ -1212,8 +1212,8 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
             markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 type: z.ZodOptional<z.ZodEnum<{
                     max: "max";
-                    min: "min";
                     average: "average";
+                    min: "min";
                 }>>;
                 yValue: z.ZodOptional<z.ZodNumber>;
                 xValue: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
@@ -1228,8 +1228,8 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
             markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 type: z.ZodOptional<z.ZodEnum<{
                     max: "max";
-                    min: "min";
                     average: "average";
+                    min: "min";
                 }>>;
                 label: z.ZodOptional<z.ZodString>;
                 symbol: z.ZodOptional<z.ZodEnum<{
@@ -1510,8 +1510,8 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
     }, z.core.$loose>, z.ZodObject<{
         emphasisFocus: z.ZodOptional<z.ZodEnum<{
             none: "none";
-            self: "self";
             adjacency: "adjacency";
+            self: "self";
         }>>;
         nodeWidth: z.ZodOptional<z.ZodNumber>;
         nodeGap: z.ZodOptional<z.ZodNumber>;

package/dist/esm/errors/errors.custom-message-ref.shared.definitions.d.ts CHANGED Viewed

@@ -113,6 +113,17 @@ export declare enum ErrorCustomMessageReference {
     CROSS_ORG_SSO_BLOCKED = "cross_org_sso_blocked",
     APP_CONFIGURATION_UNAUTHORIZED = "app_configuration_unauthorized",
     APP_CONFIGURATION_NOT_INITIALIZED = "app_configuration_not_initialized",
+    /**
+     * An invitation could not be accepted because no user type resolved for the organization being
+     * joined — so no auth policy could be fetched and NO method could be enabled.
+     *
+     * Distinct from `AUTHENTICATION_METHOD_NOT_SUPPORTED` on purpose, and the distinction is the whole
+     * point: an unresolvable policy makes the enabled-method set EMPTY, so every method fails
+     * identically and reporting it as a method problem sends the reader to the auth configuration —
+     * which is typically present and correct. The cause is one level up, in
+     * `organizationTypes[<org type>].userTypes`, and nothing in a method-shaped error points there.
+     */
+    INVITATION_ORGANIZATION_TYPE_UNRESOLVED = "invitation_organization_type_unresolved",
     FRONTEND_FORM_READ_OPERATION_NOT_AVAILABLE = "frontend_form_read_operation_not_available",
     FRONTEND_NAVIGATION_INVALID_URL_PARAMETERS = "frontend_navigation_invalid_url_parameters",
     FRONTEND_NAVIGATION_MISSING_REQUIRED_PARAMETERS = "frontend_navigation_missing_required_parameters",
@@ -409,6 +420,23 @@ export declare enum ErrorCustomMessageReference {
      * Raised as `ErrorType.VALIDATION` (400) — the payload is internally inconsistent, not unauthorized.
      */
     BILLING_PRICE_PRODUCT_MISMATCH = "billing_price_product_mismatch",
+    /**
+     * A purchase named a product that has been RETIRED from the code catalogue.
+     *
+     * `Product.isActive` was the declared off-boarding path — `assertNoBillingAccountDependents`'s own
+     * comment calls the soft retire "the product off-boarding path" — and until 2026-09-09 no purchase
+     * path consulted it. `readProductByKey` returned an inactive product exactly like an active one, so
+     * a product could be withdrawn and still be bought, granting entitlements frozen at whatever the
+     * last catalogue sync wrote.
+     *
+     * Raised as `ErrorType.CONFLICT` (409), not 400 and not 404: the request is well-formed and the
+     * caller is authorized, and the product genuinely exists — what forbids the purchase is the
+     * catalogue's current STATE. A 404 would additionally be a lie to any existing subscriber, whose
+     * subscription still points at this very row.
+     *
+     * Never raised for a REMOVE_ADDON: a customer holding a retired add-on must be able to drop it.
+     */
+    BILLING_PRODUCT_RETIRED = "billing_product_retired",
     BILLING_SCOPE_NOT_ENABLED = "billing_scope_not_enabled",
     /**
      * Hard removal of a billing account was refused because retained financial children

package/dist/esm/errors/errors.custom-message-ref.shared.definitions.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"errors.custom-message-ref.shared.definitions.d.ts","sourceRoot":"","sources":["../../../../src/errors/errors.custom-message-ref.shared.definitions.ts"],"names":[],"mappings":"AAGA,oBAAY,2BAA2B;IACrC,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,gBAAgB,qBAAqB;IACrC,OAAO,YAAY;IACnB,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAG/B,qCAAqC,0CAA0C;IAC/E,+BAA+B,oCAAoC;IAEnE,+BAA+B,oCAAoC;IACnE,2CAA2C,gDAAgD;IAE3F,oCAAoC,yCAAyC;IAC7E,yCAAyC,8CAA8C;IACvF,sCAAsC,2CAA2C;IACjF,qCAAqC,0CAA0C;IAE/E,6BAA6B,kCAAkC;IAG/D,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,4BAA4B,iCAAiC;IAC7D,gCAAgC,qCAAqC;IACrE,wBAAwB,6BAA6B;IAErD,kCAAkC,uCAAuC;IACzE,sCAAsC,2CAA2C;IACjF,4BAA4B,iCAAiC;IAC7D,iCAAiC,sCAAsC;IACvE,mCAAmC,wCAAwC;IAC3E,uCAAuC,4CAA4C;IAEnF,uCAAuC,4CAA4C;IAEnF,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,6BAA6B,kCAAkC;IAE/D,uBAAuB,4BAA4B;IACnD,sBAAsB,2BAA2B;IACjD,2BAA2B,gCAAgC;IAE3D,sCAAsC,2CAA2C;IACjF,8BAA8B,mCAAmC;IACjE,gCAAgC,qCAAqC;IAErE,wCAAwC,6CAA6C;IACrF,sCAAsC,2CAA2C;IAEjF,gDAAgD,qDAAqD;IAErG,qCAAqC,0CAA0C;IAC/E,uCAAuC,4CAA4C;IAEnF,iCAAiC,sCAAsC;IAEvE,uCAAuC,4CAA4C;IACnF,sCAAsC,2CAA2C;IACjF,gCAAgC,qCAAqC;IAErE,gCAAgC,qCAAqC;IACrE,gCAAgC,qCAAqC;IACrE,4BAA4B,iCAAiC;IAC7D,mCAAmC,wCAAwC;IAE3E,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,2BAA2B,gCAAgC;IAC3D,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,sBAAsB,2BAA2B;IACjD,oBAAoB,yBAAyB;IAE7C,mBAAmB,wBAAwB;IAE3C,wDAAwD,6DAA6D;IACrH,iBAAiB,sBAAsB;IACvC,uBAAuB,4BAA4B;IACnD,2CAA2C,gDAAgD;IAC3F,6CAA6C,kDAAkD;IAC/F,iDAAiD,sDAAsD;IACvG,6BAA6B,kCAAkC;IAC/D,+BAA+B,oCAAoC;IACnE,qCAAqC,0CAA0C;IAE/E,8BAA8B,mCAAmC;IACjE,6BAA6B,kCAAkC;IAE/D,4BAA4B,iCAAiC;IAE7D,yCAAyC,8CAA8C;IAEvF,oCAAoC,yCAAyC;IAC7E,yCAAyC,8CAA8C;IACvF,wCAAwC,6CAA6C;IAErF,0BAA0B,+BAA+B;IACzD,0BAA0B,+BAA+B;IAEzD,+BAA+B,oCAAoC;IAEnE,6BAA6B,kCAAkC;IAC/D,8BAA8B,mCAAmC;IAEjE,kCAAkC,uCAAuC;IACzE,yCAAyC,8CAA8C;IACvF,uCAAuC,4CAA4C;IAGnF,8BAA8B,mCAAmC;IACjE,8BAA8B,mCAAmC;IACjE,6BAA6B,kCAAkC;IAC/D,2BAA2B,gCAAgC;IAC3D,4FAA4F;IAC5F,2BAA2B,gCAAgC;IAC3D,6BAA6B,kCAAkC;IAC/D,mCAAmC,wCAAwC;IAC3E,oHAAoH;IACpH,+BAA+B,oCAAoC;IACnE,mGAAmG;IACnG,iCAAiC,sCAAsC;IACvE,8BAA8B,mCAAmC;IACjE,wGAAwG;IACxG,gBAAgB,qBAAqB;IACrC,8GAA8G;IAC9G,qBAAqB,0BAA0B;IAE/C,8BAA8B,mCAAmC;IACjE,iCAAiC,sCAAsC;~~IAIvE~~,0CAA0C,+CAA+C;IAGzF,0CAA0C,+CAA+C;IACzF,+CAA+C,oDAAoD;IACnG,+CAA+C,oDAAoD;IAGnG,qCAAqC,0CAA0C;IAC/E,4CAA4C,iDAAiD;IAC7F,0CAA0C,+CAA+C;IACzF,yCAAyC,8CAA8C;IACvF,uCAAuC,4CAA4C;IACnF,0CAA0C,+CAA+C;IACzF,iCAAiC,sCAAsC;IACvE,4CAA4C,iDAAiD;IAG7F,yBAAyB,8BAA8B;IAGvD,6BAA6B,kCAAkC;IAC/D,4CAA4C,iDAAiD;IAC7F,kCAAkC,uCAAuC;IAGzE,mCAAmC,wCAAwC;IAC3E,gCAAgC,qCAAqC;IACrE,8BAA8B,mCAAmC;IAGjE,2BAA2B,gCAAgC;IAC3D,gBAAgB,qBAAqB;IAGrC,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IAEnE,+GAA+G;IAC/G,oCAAoC,yCAAyC;IAG7E,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAC7C,oBAAoB,yBAAyB;IAC7C,oBAAoB,yBAAyB;IAC7C,2BAA2B,gCAAgC;IAE3D,oBAAoB,yBAAyB;IAC7C,WAAW,gBAAgB;IAC3B,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,4BAA4B,iCAAiC;IAC7D,aAAa,kBAAkB;IAC/B,qBAAqB,0BAA0B;IAC/C,aAAa,kBAAkB;IAE/B,+BAA+B,oCAAoC;IACnE,+BAA+B,oCAAoC;IACnE,0BAA0B,+BAA+B;IAEzD,4BAA4B,iCAAiC;IAC7D,6BAA6B,kCAAkC;IAC/D,uBAAuB,4BAA4B;IAGnD,qBAAqB,0BAA0B;IAC/C,sBAAsB,2BAA2B;IACjD,oBAAoB,yBAAyB;IAG7C,0BAA0B,+BAA+B;IACzD,wBAAwB,6BAA6B;IACrD,iCAAiC,sCAAsC;IACvE,wBAAwB,6BAA6B;IACrD,8BAA8B,mCAAmC;IACjE,iCAAiC,sCAAsC;IACvE,2CAA2C,gDAAgD;IAC3F,+BAA+B,oCAAoC;IACnE,sCAAsC,2CAA2C;IACjF,8HAA8H;IAC9H,iCAAiC,sCAAsC;IACvE,8FAA8F;IAC9F,sCAAsC,2CAA2C;IACjF,wJAAwJ;IACxJ,qCAAqC,0CAA0C;IAC/E,oFAAoF;IACpF,2BAA2B,gCAAgC;IAC3D,4FAA4F;IAC5F,uBAAuB,4BAA4B;IACnD,sGAAsG;IACtG,oCAAoC,yCAAyC;IAG7E,sJAAsJ;IACtJ,kCAAkC,uCAAuC;IACzE,oJAAoJ;IACpJ,4CAA4C,iDAAiD;IAC7F;;;;;;;;;;;;;;OAcG;IACH,0BAA0B,+BAA+B;IACzD,wFAAwF;IACxF,kCAAkC,uCAAuC;IACzE,0HAA0H;IAC1H,uCAAuC,4CAA4C;IACnF,iGAAiG;IACjG,qBAAqB,0BAA0B;IAC/C,+FAA+F;IAC/F,4BAA4B,iCAAiC;IAC7D,oTAAoT;IACpT,uBAAuB,4BAA4B;IACnD,4DAA4D;IAC5D,8BAA8B,mCAAmC;IACjE,+FAA+F;IAC/F,mBAAmB,wBAAwB;IAC3C,uEAAuE;IACvE,8BAA8B,mCAAmC;IAGjE,wEAAwE;IACxE,oCAAoC,yCAAyC;IAC7E,kEAAkE;IAClE,kCAAkC,uCAAuC;IACzE,gFAAgF;IAChF,gCAAgC,qCAAqC;IACrE,mFAAmF;IACnF,uCAAuC,4CAA4C;IACnF,yFAAyF;IACzF,2BAA2B,gCAAgC;IAC3D,uDAAuD;IACvD,+BAA+B,oCAAoC;IACnE,iDAAiD;IACjD,8BAA8B,mCAAmC;IACjE,6EAA6E;IAC7E,+BAA+B,oCAAoC;IACnE,4DAA4D;IAC5D,qCAAqC,0CAA0C;IAC/E,mEAAmE;IACnE,8BAA8B,mCAAmC;IACjE;;;;;;OAMG;IACH,oCAAoC,yCAAyC;IAG7E,0EAA0E;IAC1E,4BAA4B,iCAAiC;IAC7D,sDAAsD;IACtD,gBAAgB,qBAAqB;IACrC,iEAAiE;IACjE,yBAAyB,8BAA8B;IACvD,6CAA6C;IAC7C,qBAAqB,0BAA0B;IAC/C,wEAAwE;IACxE,4BAA4B,iCAAiC;IAG7D,yCAAyC;IACzC,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,gCAAgC,qCAAqC;IACrE;;;;;;;;;;OAUG;IACH,+BAA+B,oCAAoC;IACnE;;;;;;OAMG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mCAAmC,wCAAwC;IAC3E;;;;;;;;;;;OAWG;IACH,6BAA6B,kCAAkC;IAC/D;;;;;;;;;OASG;IACH,wBAAwB,6BAA6B;IACrD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,4BAA4B;IACnD,+DAA+D;IAC/D,gCAAgC,qCAAqC;IAGrE,qDAAqD;IACrD,yBAAyB,8BAA8B;IAGvD,uBAAuB,4BAA4B;IACnD,yBAAyB,8BAA8B;IACvD,4BAA4B,iCAAiC;IAC7D,8BAA8B,mCAAmC;IACjE,8BAA8B,mCAAmC;IACjE,gCAAgC,qCAAqC;IACrE,yBAAyB,8BAA8B;IACvD,yBAAyB,8BAA8B;IACvD,uBAAuB,4BAA4B;IACnD,4BAA4B,iCAAiC;IAC7D,0BAA0B,+BAA+B;IACzD,iCAAiC,sCAAsC;IACvE,0BAA0B,+BAA+B;IACzD,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D,kCAAkC,uCAAuC;IACzE,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAC7D,6BAA6B,kCAAkC;IAC/D,yBAAyB,8BAA8B;IACvD,8BAA8B,mCAAmC;IACjE;;;;;;;;;;OAUG;IACH,8BAA8B,mCAAmC;IACjE,yBAAyB,8BAA8B;IACvD;;;;;;;;;;;OAWG;IACH,8BAA8B,mCAAmC;IAGjE,sBAAsB,2BAA2B;IACjD,sBAAsB,2BAA2B;IACjD,sBAAsB,2BAA2B;IACjD,oBAAoB,yBAAyB;IAC7C,YAAY,iBAAiB;IAC7B,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,sBAAsB,2BAA2B;IACjD,oBAAoB,yBAAyB;IAC7C,2BAA2B,gCAAgC;IAC3D,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,qBAAqB,0BAA0B;IAC/C,yBAAyB,8BAA8B;IACvD,2BAA2B,gCAAgC;IAC3D,0BAA0B,+BAA+B;IACzD,8BAA8B,mCAAmC;IACjE,kBAAkB,uBAAuB;IACzC,gBAAgB,qBAAqB;IACrC,yBAAyB,8BAA8B;IACvD,wHAAwH;IACxH,kBAAkB,uBAAuB;IAGzC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;IAC3C,gCAAgC,qCAAqC;IACrE,+BAA+B,oCAAoC;IACnE,qCAAqC,0CAA0C;IAC/E,8BAA8B,mCAAmC;IACjE,oIAAoI;IACpI,yBAAyB,8BAA8B;IACvD,2JAA2J;IAC3J,4BAA4B,iCAAiC;IAC7D,4GAA4G;IAC5G,0BAA0B,+BAA+B;IACzD,yGAAyG;IACzG,sCAAsC,2CAA2C;IAGjF,iFAAiF;IACjF,0BAA0B,+BAA+B;IACzD,qEAAqE;IACrE,wBAAwB,6BAA6B;IACrD,8EAA8E;IAC9E,6BAA6B,kCAAkC;IAC/D,8DAA8D;IAC9D,oCAAoC,yCAAyC;IAC7E,4EAA4E;IAC5E,2BAA2B,gCAAgC;IAC3D,4FAA4F;IAC5F,wBAAwB,6BAA6B;IACrD,qFAAqF;IACrF,gCAAgC,qCAAqC;IACrE,kFAAkF;IAClF,iCAAiC,sCAAsC;IACvE,iEAAiE;IACjE,uBAAuB,4BAA4B;IACnD,0CAA0C;IAC1C,gBAAgB,qBAAqB;IACrC,2CAA2C;IAC3C,iBAAiB,sBAAsB;IACvC,yCAAyC;IACzC,eAAe,oBAAoB;IACnC,6CAA6C;IAC7C,kBAAkB,uBAAuB;IACzC,0CAA0C;IAC1C,gBAAgB,qBAAqB;IACrC,qEAAqE;IACrE,iCAAiC,sCAAsC;IAGvE,kHAAkH;IAClH,mCAAmC,wCAAwC;IAC3E,2EAA2E;IAC3E,wBAAwB,6BAA6B;IACrD,iEAAiE;IACjE,wBAAwB,6BAA6B;IAGrD,8FAA8F;IAC9F,2CAA2C,gDAAgD;IAC3F,uFAAuF;IACvF,0CAA0C,+CAA+C;IACzF,gEAAgE;IAChE,0BAA0B,+BAA+B;IACzD,mEAAmE;IACnE,yBAAyB,8BAA8B;IACvD,8EAA8E;IAC9E,wBAAwB,6BAA6B;IACrD,sEAAsE;IACtE,0BAA0B,+BAA+B;IACzD,kFAAkF;IAClF,2CAA2C,gDAAgD;IAC3F,6FAA6F;IAC7F,4BAA4B,iCAAiC;IAG7D,8DAA8D;IAC9D,cAAc,mBAAmB;IACjC,uEAAuE;IACvE,8BAA8B,mCAAmC;IACjE,6EAA6E;IAC7E,gJAAgJ;IAChJ,iBAAiB,sBAAsB;IACvC,iKAAiK;IACjK,qBAAqB,0BAA0B;IAC/C,sDAAsD;IACtD,mBAAmB,wBAAwB;IAC3C,qCAAqC;IACrC,oBAAoB,yBAAyB;IAC7C,8CAA8C;IAC9C,kBAAkB,uBAAuB;IACzC,+DAA+D;IAC/D,4BAA4B,iCAAiC;IAC7D,sEAAsE;IACtE,0BAA0B,+BAA+B;IACzD,uDAAuD;IACvD,yBAAyB,8BAA8B;IACvD,8CAA8C;IAC9C,0BAA0B,+BAA+B;IACzD,kDAAkD;IAClD,mBAAmB,wBAAwB;IAC3C,+EAA+E;IAC/E,mBAAmB,wBAAwB;IAC3C,6EAA6E;IAC7E,iCAAiC,sCAAsC;IACvE,wFAAwF;IACxF,0BAA0B,+BAA+B;IACzD,gGAAgG;IAChG,wBAAwB,6BAA6B;IACrD,oGAAoG;IACpG,4BAA4B,iCAAiC;IAC7D,4EAA4E;IAC5E,iCAAiC,sCAAsC;IACvE,kFAAkF;IAClF,sBAAsB,2BAA2B;IACjD,yGAAyG;IACzG,6BAA6B,kCAAkC;IAC/D,yEAAyE;IACzE,6BAA6B,kCAAkC;IAC/D,6EAA6E;IAC7E,4BAA4B,iCAAiC;IAC7D,kEAAkE;IAClE,qCAAqC,0CAA0C;IAC/E;;;;;;;;OAQG;IACH,2BAA2B,gCAAgC;IAC3D,4DAA4D;IAC5D,yBAAyB,8BAA8B;IACvD,gDAAgD;IAChD,0BAA0B,+BAA+B;IACzD,yEAAyE;IACzE,mCAAmC,wCAAwC;IAC3E,0DAA0D;IAC1D,wBAAwB,6BAA6B;IACrD,kFAAkF;IAClF,0BAA0B,+BAA+B;IACzD,qEAAqE;IACrE,4BAA4B,iCAAiC;IAE7D,mFAAmF;IACnF,mCAAmC,wCAAwC;CAC5E"}
1	+ {"version":3,"file":"errors.custom-message-ref.shared.definitions.d.ts","sourceRoot":"","sources":["../../../../src/errors/errors.custom-message-ref.shared.definitions.ts"],"names":[],"mappings":"AAGA,oBAAY,2BAA2B;IACrC,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,gBAAgB,qBAAqB;IACrC,OAAO,YAAY;IACnB,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAG/B,qCAAqC,0CAA0C;IAC/E,+BAA+B,oCAAoC;IAEnE,+BAA+B,oCAAoC;IACnE,2CAA2C,gDAAgD;IAE3F,oCAAoC,yCAAyC;IAC7E,yCAAyC,8CAA8C;IACvF,sCAAsC,2CAA2C;IACjF,qCAAqC,0CAA0C;IAE/E,6BAA6B,kCAAkC;IAG/D,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,4BAA4B,iCAAiC;IAC7D,gCAAgC,qCAAqC;IACrE,wBAAwB,6BAA6B;IAErD,kCAAkC,uCAAuC;IACzE,sCAAsC,2CAA2C;IACjF,4BAA4B,iCAAiC;IAC7D,iCAAiC,sCAAsC;IACvE,mCAAmC,wCAAwC;IAC3E,uCAAuC,4CAA4C;IAEnF,uCAAuC,4CAA4C;IAEnF,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,6BAA6B,kCAAkC;IAE/D,uBAAuB,4BAA4B;IACnD,sBAAsB,2BAA2B;IACjD,2BAA2B,gCAAgC;IAE3D,sCAAsC,2CAA2C;IACjF,8BAA8B,mCAAmC;IACjE,gCAAgC,qCAAqC;IAErE,wCAAwC,6CAA6C;IACrF,sCAAsC,2CAA2C;IAEjF,gDAAgD,qDAAqD;IAErG,qCAAqC,0CAA0C;IAC/E,uCAAuC,4CAA4C;IAEnF,iCAAiC,sCAAsC;IAEvE,uCAAuC,4CAA4C;IACnF,sCAAsC,2CAA2C;IACjF,gCAAgC,qCAAqC;IAErE,gCAAgC,qCAAqC;IACrE,gCAAgC,qCAAqC;IACrE,4BAA4B,iCAAiC;IAC7D,mCAAmC,wCAAwC;IAE3E,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,2BAA2B,gCAAgC;IAC3D,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,sBAAsB,2BAA2B;IACjD,oBAAoB,yBAAyB;IAE7C,mBAAmB,wBAAwB;IAE3C,wDAAwD,6DAA6D;IACrH,iBAAiB,sBAAsB;IACvC,uBAAuB,4BAA4B;IACnD,2CAA2C,gDAAgD;IAC3F,6CAA6C,kDAAkD;IAC/F,iDAAiD,sDAAsD;IACvG,6BAA6B,kCAAkC;IAC/D,+BAA+B,oCAAoC;IACnE,qCAAqC,0CAA0C;IAE/E,8BAA8B,mCAAmC;IACjE,6BAA6B,kCAAkC;IAE/D,4BAA4B,iCAAiC;IAE7D,yCAAyC,8CAA8C;IAEvF,oCAAoC,yCAAyC;IAC7E,yCAAyC,8CAA8C;IACvF,wCAAwC,6CAA6C;IAErF,0BAA0B,+BAA+B;IACzD,0BAA0B,+BAA+B;IAEzD,+BAA+B,oCAAoC;IAEnE,6BAA6B,kCAAkC;IAC/D,8BAA8B,mCAAmC;IAEjE,kCAAkC,uCAAuC;IACzE,yCAAyC,8CAA8C;IACvF,uCAAuC,4CAA4C;IAGnF,8BAA8B,mCAAmC;IACjE,8BAA8B,mCAAmC;IACjE,6BAA6B,kCAAkC;IAC/D,2BAA2B,gCAAgC;IAC3D,4FAA4F;IAC5F,2BAA2B,gCAAgC;IAC3D,6BAA6B,kCAAkC;IAC/D,mCAAmC,wCAAwC;IAC3E,oHAAoH;IACpH,+BAA+B,oCAAoC;IACnE,mGAAmG;IACnG,iCAAiC,sCAAsC;IACvE,8BAA8B,mCAAmC;IACjE,wGAAwG;IACxG,gBAAgB,qBAAqB;IACrC,8GAA8G;IAC9G,qBAAqB,0BAA0B;IAE/C,8BAA8B,mCAAmC;IACjE,iCAAiC,sCAAsC;IACvE;;;;;;;;;OASG;IACH,uCAAuC,4CAA4C;IAInF,0CAA0C,+CAA+C;IAGzF,0CAA0C,+CAA+C;IACzF,+CAA+C,oDAAoD;IACnG,+CAA+C,oDAAoD;IAGnG,qCAAqC,0CAA0C;IAC/E,4CAA4C,iDAAiD;IAC7F,0CAA0C,+CAA+C;IACzF,yCAAyC,8CAA8C;IACvF,uCAAuC,4CAA4C;IACnF,0CAA0C,+CAA+C;IACzF,iCAAiC,sCAAsC;IACvE,4CAA4C,iDAAiD;IAG7F,yBAAyB,8BAA8B;IAGvD,6BAA6B,kCAAkC;IAC/D,4CAA4C,iDAAiD;IAC7F,kCAAkC,uCAAuC;IAGzE,mCAAmC,wCAAwC;IAC3E,gCAAgC,qCAAqC;IACrE,8BAA8B,mCAAmC;IAGjE,2BAA2B,gCAAgC;IAC3D,gBAAgB,qBAAqB;IAGrC,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,+BAA+B,oCAAoC;IAEnE,+GAA+G;IAC/G,oCAAoC,yCAAyC;IAG7E,uBAAuB,4BAA4B;IACnD,oBAAoB,yBAAyB;IAC7C,oBAAoB,yBAAyB;IAC7C,oBAAoB,yBAAyB;IAC7C,2BAA2B,gCAAgC;IAE3D,oBAAoB,yBAAyB;IAC7C,WAAW,gBAAgB;IAC3B,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,0BAA0B,+BAA+B;IACzD,4BAA4B,iCAAiC;IAC7D,aAAa,kBAAkB;IAC/B,qBAAqB,0BAA0B;IAC/C,aAAa,kBAAkB;IAE/B,+BAA+B,oCAAoC;IACnE,+BAA+B,oCAAoC;IACnE,0BAA0B,+BAA+B;IAEzD,4BAA4B,iCAAiC;IAC7D,6BAA6B,kCAAkC;IAC/D,uBAAuB,4BAA4B;IAGnD,qBAAqB,0BAA0B;IAC/C,sBAAsB,2BAA2B;IACjD,oBAAoB,yBAAyB;IAG7C,0BAA0B,+BAA+B;IACzD,wBAAwB,6BAA6B;IACrD,iCAAiC,sCAAsC;IACvE,wBAAwB,6BAA6B;IACrD,8BAA8B,mCAAmC;IACjE,iCAAiC,sCAAsC;IACvE,2CAA2C,gDAAgD;IAC3F,+BAA+B,oCAAoC;IACnE,sCAAsC,2CAA2C;IACjF,8HAA8H;IAC9H,iCAAiC,sCAAsC;IACvE,8FAA8F;IAC9F,sCAAsC,2CAA2C;IACjF,wJAAwJ;IACxJ,qCAAqC,0CAA0C;IAC/E,oFAAoF;IACpF,2BAA2B,gCAAgC;IAC3D,4FAA4F;IAC5F,uBAAuB,4BAA4B;IACnD,sGAAsG;IACtG,oCAAoC,yCAAyC;IAG7E,sJAAsJ;IACtJ,kCAAkC,uCAAuC;IACzE,oJAAoJ;IACpJ,4CAA4C,iDAAiD;IAC7F;;;;;;;;;;;;;;OAcG;IACH,0BAA0B,+BAA+B;IACzD,wFAAwF;IACxF,kCAAkC,uCAAuC;IACzE,0HAA0H;IAC1H,uCAAuC,4CAA4C;IACnF,iGAAiG;IACjG,qBAAqB,0BAA0B;IAC/C,+FAA+F;IAC/F,4BAA4B,iCAAiC;IAC7D,oTAAoT;IACpT,uBAAuB,4BAA4B;IACnD,4DAA4D;IAC5D,8BAA8B,mCAAmC;IACjE,+FAA+F;IAC/F,mBAAmB,wBAAwB;IAC3C,uEAAuE;IACvE,8BAA8B,mCAAmC;IAGjE,wEAAwE;IACxE,oCAAoC,yCAAyC;IAC7E,kEAAkE;IAClE,kCAAkC,uCAAuC;IACzE,gFAAgF;IAChF,gCAAgC,qCAAqC;IACrE,mFAAmF;IACnF,uCAAuC,4CAA4C;IACnF,yFAAyF;IACzF,2BAA2B,gCAAgC;IAC3D,uDAAuD;IACvD,+BAA+B,oCAAoC;IACnE,iDAAiD;IACjD,8BAA8B,mCAAmC;IACjE,6EAA6E;IAC7E,+BAA+B,oCAAoC;IACnE,4DAA4D;IAC5D,qCAAqC,0CAA0C;IAC/E,mEAAmE;IACnE,8BAA8B,mCAAmC;IACjE;;;;;;OAMG;IACH,oCAAoC,yCAAyC;IAG7E,0EAA0E;IAC1E,4BAA4B,iCAAiC;IAC7D,sDAAsD;IACtD,gBAAgB,qBAAqB;IACrC,iEAAiE;IACjE,yBAAyB,8BAA8B;IACvD,6CAA6C;IAC7C,qBAAqB,0BAA0B;IAC/C,wEAAwE;IACxE,4BAA4B,iCAAiC;IAG7D,yCAAyC;IACzC,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,gCAAgC,qCAAqC;IACrE;;;;;;;;;;OAUG;IACH,+BAA+B,oCAAoC;IACnE;;;;;;OAMG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mCAAmC,wCAAwC;IAC3E;;;;;;;;;;;OAWG;IACH,6BAA6B,kCAAkC;IAC/D;;;;;;;;;OASG;IACH,wBAAwB,6BAA6B;IACrD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,4BAA4B;IACnD,+DAA+D;IAC/D,gCAAgC,qCAAqC;IAGrE,qDAAqD;IACrD,yBAAyB,8BAA8B;IAGvD,uBAAuB,4BAA4B;IACnD,yBAAyB,8BAA8B;IACvD,4BAA4B,iCAAiC;IAC7D,8BAA8B,mCAAmC;IACjE,8BAA8B,mCAAmC;IACjE,gCAAgC,qCAAqC;IACrE,yBAAyB,8BAA8B;IACvD,yBAAyB,8BAA8B;IACvD,uBAAuB,4BAA4B;IACnD,4BAA4B,iCAAiC;IAC7D,0BAA0B,+BAA+B;IACzD,iCAAiC,sCAAsC;IACvE,0BAA0B,+BAA+B;IACzD,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D,kCAAkC,uCAAuC;IACzE,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAC7D,6BAA6B,kCAAkC;IAC/D,yBAAyB,8BAA8B;IACvD,8BAA8B,mCAAmC;IACjE;;;;;;;;;;OAUG;IACH,8BAA8B,mCAAmC;IACjE;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,4BAA4B;IACnD,yBAAyB,8BAA8B;IACvD;;;;;;;;;;;OAWG;IACH,8BAA8B,mCAAmC;IAGjE,sBAAsB,2BAA2B;IACjD,sBAAsB,2BAA2B;IACjD,sBAAsB,2BAA2B;IACjD,oBAAoB,yBAAyB;IAC7C,YAAY,iBAAiB;IAC7B,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,sBAAsB,2BAA2B;IACjD,oBAAoB,yBAAyB;IAC7C,2BAA2B,gCAAgC;IAC3D,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,qBAAqB,0BAA0B;IAC/C,yBAAyB,8BAA8B;IACvD,2BAA2B,gCAAgC;IAC3D,0BAA0B,+BAA+B;IACzD,8BAA8B,mCAAmC;IACjE,kBAAkB,uBAAuB;IACzC,gBAAgB,qBAAqB;IACrC,yBAAyB,8BAA8B;IACvD,wHAAwH;IACxH,kBAAkB,uBAAuB;IAGzC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;IAC3C,gCAAgC,qCAAqC;IACrE,+BAA+B,oCAAoC;IACnE,qCAAqC,0CAA0C;IAC/E,8BAA8B,mCAAmC;IACjE,oIAAoI;IACpI,yBAAyB,8BAA8B;IACvD,2JAA2J;IAC3J,4BAA4B,iCAAiC;IAC7D,4GAA4G;IAC5G,0BAA0B,+BAA+B;IACzD,yGAAyG;IACzG,sCAAsC,2CAA2C;IAGjF,iFAAiF;IACjF,0BAA0B,+BAA+B;IACzD,qEAAqE;IACrE,wBAAwB,6BAA6B;IACrD,8EAA8E;IAC9E,6BAA6B,kCAAkC;IAC/D,8DAA8D;IAC9D,oCAAoC,yCAAyC;IAC7E,4EAA4E;IAC5E,2BAA2B,gCAAgC;IAC3D,4FAA4F;IAC5F,wBAAwB,6BAA6B;IACrD,qFAAqF;IACrF,gCAAgC,qCAAqC;IACrE,kFAAkF;IAClF,iCAAiC,sCAAsC;IACvE,iEAAiE;IACjE,uBAAuB,4BAA4B;IACnD,0CAA0C;IAC1C,gBAAgB,qBAAqB;IACrC,2CAA2C;IAC3C,iBAAiB,sBAAsB;IACvC,yCAAyC;IACzC,eAAe,oBAAoB;IACnC,6CAA6C;IAC7C,kBAAkB,uBAAuB;IACzC,0CAA0C;IAC1C,gBAAgB,qBAAqB;IACrC,qEAAqE;IACrE,iCAAiC,sCAAsC;IAGvE,kHAAkH;IAClH,mCAAmC,wCAAwC;IAC3E,2EAA2E;IAC3E,wBAAwB,6BAA6B;IACrD,iEAAiE;IACjE,wBAAwB,6BAA6B;IAGrD,8FAA8F;IAC9F,2CAA2C,gDAAgD;IAC3F,uFAAuF;IACvF,0CAA0C,+CAA+C;IACzF,gEAAgE;IAChE,0BAA0B,+BAA+B;IACzD,mEAAmE;IACnE,yBAAyB,8BAA8B;IACvD,8EAA8E;IAC9E,wBAAwB,6BAA6B;IACrD,sEAAsE;IACtE,0BAA0B,+BAA+B;IACzD,kFAAkF;IAClF,2CAA2C,gDAAgD;IAC3F,6FAA6F;IAC7F,4BAA4B,iCAAiC;IAG7D,8DAA8D;IAC9D,cAAc,mBAAmB;IACjC,uEAAuE;IACvE,8BAA8B,mCAAmC;IACjE,6EAA6E;IAC7E,gJAAgJ;IAChJ,iBAAiB,sBAAsB;IACvC,iKAAiK;IACjK,qBAAqB,0BAA0B;IAC/C,sDAAsD;IACtD,mBAAmB,wBAAwB;IAC3C,qCAAqC;IACrC,oBAAoB,yBAAyB;IAC7C,8CAA8C;IAC9C,kBAAkB,uBAAuB;IACzC,+DAA+D;IAC/D,4BAA4B,iCAAiC;IAC7D,sEAAsE;IACtE,0BAA0B,+BAA+B;IACzD,uDAAuD;IACvD,yBAAyB,8BAA8B;IACvD,8CAA8C;IAC9C,0BAA0B,+BAA+B;IACzD,kDAAkD;IAClD,mBAAmB,wBAAwB;IAC3C,+EAA+E;IAC/E,mBAAmB,wBAAwB;IAC3C,6EAA6E;IAC7E,iCAAiC,sCAAsC;IACvE,wFAAwF;IACxF,0BAA0B,+BAA+B;IACzD,gGAAgG;IAChG,wBAAwB,6BAA6B;IACrD,oGAAoG;IACpG,4BAA4B,iCAAiC;IAC7D,4EAA4E;IAC5E,iCAAiC,sCAAsC;IACvE,kFAAkF;IAClF,sBAAsB,2BAA2B;IACjD,yGAAyG;IACzG,6BAA6B,kCAAkC;IAC/D,yEAAyE;IACzE,6BAA6B,kCAAkC;IAC/D,6EAA6E;IAC7E,4BAA4B,iCAAiC;IAC7D,kEAAkE;IAClE,qCAAqC,0CAA0C;IAC/E;;;;;;;;OAQG;IACH,2BAA2B,gCAAgC;IAC3D,4DAA4D;IAC5D,yBAAyB,8BAA8B;IACvD,gDAAgD;IAChD,0BAA0B,+BAA+B;IACzD,yEAAyE;IACzE,mCAAmC,wCAAwC;IAC3E,0DAA0D;IAC1D,wBAAwB,6BAA6B;IACrD,kFAAkF;IAClF,0BAA0B,+BAA+B;IACzD,qEAAqE;IACrE,4BAA4B,iCAAiC;IAE7D,mFAAmF;IACnF,mCAAmC,wCAAwC;CAC5E"}

package/dist/esm/errors/errors.custom-message-ref.shared.definitions.js CHANGED Viewed

@@ -117,6 +117,17 @@ export var ErrorCustomMessageReference;
     ErrorCustomMessageReference["CROSS_ORG_SSO_BLOCKED"] = "cross_org_sso_blocked";
     ErrorCustomMessageReference["APP_CONFIGURATION_UNAUTHORIZED"] = "app_configuration_unauthorized";
     ErrorCustomMessageReference["APP_CONFIGURATION_NOT_INITIALIZED"] = "app_configuration_not_initialized";
+    /**
+     * An invitation could not be accepted because no user type resolved for the organization being
+     * joined — so no auth policy could be fetched and NO method could be enabled.
+     *
+     * Distinct from `AUTHENTICATION_METHOD_NOT_SUPPORTED` on purpose, and the distinction is the whole
+     * point: an unresolvable policy makes the enabled-method set EMPTY, so every method fails
+     * identically and reporting it as a method problem sends the reader to the auth configuration —
+     * which is typically present and correct. The cause is one level up, in
+     * `organizationTypes[<org type>].userTypes`, and nothing in a method-shaped error points there.
+     */
+    ErrorCustomMessageReference["INVITATION_ORGANIZATION_TYPE_UNRESOLVED"] = "invitation_organization_type_unresolved";
     // Frontend form errors
     ErrorCustomMessageReference["FRONTEND_FORM_READ_OPERATION_NOT_AVAILABLE"] = "frontend_form_read_operation_not_available";
     // Frontend navigation errors
@@ -430,6 +441,23 @@ export var ErrorCustomMessageReference;
      * Raised as `ErrorType.VALIDATION` (400) — the payload is internally inconsistent, not unauthorized.
      */
     ErrorCustomMessageReference["BILLING_PRICE_PRODUCT_MISMATCH"] = "billing_price_product_mismatch";
+    /**
+     * A purchase named a product that has been RETIRED from the code catalogue.
+     *
+     * `Product.isActive` was the declared off-boarding path — `assertNoBillingAccountDependents`'s own
+     * comment calls the soft retire "the product off-boarding path" — and until 2026-09-09 no purchase
+     * path consulted it. `readProductByKey` returned an inactive product exactly like an active one, so
+     * a product could be withdrawn and still be bought, granting entitlements frozen at whatever the
+     * last catalogue sync wrote.
+     *
+     * Raised as `ErrorType.CONFLICT` (409), not 400 and not 404: the request is well-formed and the
+     * caller is authorized, and the product genuinely exists — what forbids the purchase is the
+     * catalogue's current STATE. A 404 would additionally be a lie to any existing subscriber, whose
+     * subscription still points at this very row.
+     *
+     * Never raised for a REMOVE_ADDON: a customer holding a retired add-on must be able to drop it.
+     */
+    ErrorCustomMessageReference["BILLING_PRODUCT_RETIRED"] = "billing_product_retired";
     ErrorCustomMessageReference["BILLING_SCOPE_NOT_ENABLED"] = "billing_scope_not_enabled";
     /**
      * Hard removal of a billing account was refused because retained financial children