npm - @wildo-ai/saas-models - Versions diffs - 1.1.3 → 1.1.4 - Mend

@wildo-ai/saas-models 1.1.3 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (496) hide show

package/dist/esm/config/analytics-value-moments.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"analytics-value-moments.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/analytics-value-moments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+IAA+I;AAC/I,MAAM,wBAAwB,GAAG;IAC/B,oBAAoB;IACpB,gBAAgB;IAChB,YAAY;IACZ,kBAAkB;IAClB,mBAAmB;IACnB,QAAQ;CACA,CAAC;AAEX,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAUX;AAVD,WAAY,kBAAkB;IAC5B,6CAAuB,CAAA;IACvB,+DAAyC,CAAA;IACzC,qCAAe,CAAA;IACf,+CAAyB,CAAA;IACzB,iDAA2B,CAAA;IAC3B,iEAA2C,CAAA;IAC3C,mDAA6B,CAAA;IAC7B,iDAA2B,CAAA;IAC3B,2DAAqC,CAAA;AACvC,CAAC,EAVW,kBAAkB,KAAlB,kBAAkB,QAU7B;AAED,mHAAmH;AACnH,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAuB,CAAC;AAEjE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,eAAwB,CAAC;AAE1E,2DAA2D;AAC3D,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,+CAAqB,CAAA;IACrB,6CAAmB,CAAA;AACrB,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED,0DAA0D;AAC1D,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,uDAAiC,CAAA;IACjC,qDAA+B,CAAA;IAC/B,uDAAiC,CAAA;IACjC,uDAAiC,CAAA;AACnC,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,qCAAqC,GAAG,2BAAoC,CAAC;AAE1F,mEAAmE;AAEnE,MAAM,CAAN,IAAY,eAMX;AAND,WAAY,eAAe;IACzB,4DAAyC,CAAA;IACzC,oDAAiC,CAAA;IACjC,4CAAyB,CAAA;IACzB,oDAAiC,CAAA;IACjC,gDAA6B,CAAA;AAC/B,CAAC,EANW,eAAe,KAAf,eAAe,QAM1B;AAED,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CACzD,CAAC;AAGF,2GAA2G;AAE3G,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC;IACzD,6DAA6D;IAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;IACrD,6BAA6B;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gCAAgC;IAChC,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C,oDAAoD;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC;IACjD,iEAAiE;IACjE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAC7C,mFAAmF;IACnF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;IACrD,gDAAgD;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC;IACnD,qFAAqF;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE;IAClE,mCAAmC;IACnC,+BAA+B;IAC/B,2BAA2B;IAC3B,+BAA+B;IAC/B,6BAA6B;CAC9B,CAAC,CAAC;AAGH,mEAAmE;AAEnE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,4DAA4D;IAC5D,8BAAW,CAAA;IACX,+CAA+C;IAC/C,8BAAW,CAAA;AACb,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,eASX;AATD,WAAY,eAAe;IACzB,qFAAqF;IACrF,gCAAa,CAAA;IACb,sDAAsD;IACtD,4CAAyB,CAAA;IACzB,+CAA+C;IAC/C,4CAAyB,CAAA;IACzB,uEAAuE;IACvE,gDAA6B,CAAA;AAC/B,CAAC,EATW,eAAe,KAAf,eAAe,QAS1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,sCAAsC;IACtC,iCAAa,CAAA;IACb,oCAAoC;IACpC,iDAA6B,CAAA;AAC/B,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,mEAAmE;AAEnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH,mEAAmE;AAEnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,gFAAgF;IAChF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IAE7B;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC;IAE9D,6CAA6C;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1C,4EAA4E;IAC5E,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC;IAE1D;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;OAIG;IACH,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC","sourcesContent":["/*\n Analytics Value Moment Schemas\n * \n * Defines value signals and value moments for the analytics system.\n * Value moments represent meaningful milestones in a user's journey\n * (TTFV, aha moments, activation stages, anti-patterns).\n /\n\nimport { z } from 'zod';\n\n/* Navigation content type values for VIEW_VISIT signals. Inlined here — canonical enum lives in saas-frontend-lib (navigation-v3.schemas). /\nconst NAVIGATION_CONTENT_TYPES = [\n 'resource_operation',\n 'composite_view',\n 'chart_view',\n 'full_custom_view',\n 'flows_actors_view',\n 'custom',\n] as const;\n\n// ─── Analytics Event Names (auto-instrumentation) ───────────────\n\n/\n Built-in analytics track event names used by auto-instrumentation.\n * App-custom events use arbitrary strings via track(name, properties).\n /\nexport enum AnalyticsEventName {\n PAGE_VIEW = 'page_view',\n RESOURCE_OPERATION = 'resource_operation',\n ERROR = 'error',\n USER_LOGIN = 'user_login',\n USER_LOGOUT = 'user_logout',\n USER_STATUS_CHANGED = 'user_status_changed',\n NOTIFICATION = 'notification',\n HOTKEY_USED = 'hotkey_used',\n FEATURE_ACCESSED = 'feature_accessed',\n}\n\n/* Event name prefix for value moments (TTFV, aha, activation). Anti-pattern uses ValueMomentRole.ANTI_PATTERN. /\nexport const VALUE_MOMENT_EVENT_PREFIX = 'value_moment' as const;\n\n/* Signal type value when ALL mode signals are completed. /\nexport const VALUE_MOMENT_SIGNAL_ALL_COMPLETED = 'all_completed' as const;\n\n/* Trigger source for ANALYTICS_MOMENT_ACHIEVED events. /\nexport enum AnalyticsTriggerSource {\n FRONTEND = 'frontend',\n BACKEND = 'backend',\n}\n\n/* Hotkey key values for HOTKEY_USED analytics events. /\nexport enum AnalyticsHotkeyKey {\n COMMAND_MENU = 'command_menu',\n SIDEBAR_TOGGLE = 'sidebar_toggle',\n NOTIFICATIONS = 'notifications',\n QUICK_SWITCHER = 'quick_switcher',\n SHORTCUTS_HELP = 'shortcuts_help',\n}\n\n/* Storage key prefix for achieved moments (suffixed with userId). /\nexport const ANALYTICS_ACHIEVED_STORAGE_KEY_PREFIX = 'wildo_analytics_achieved_' as const;\n\n// ─── Signal Types ───────────────────────────────────────────────\n\nexport enum ValueSignalType {\n RESOURCE_OPERATION = 'resource_operation',\n RESOURCE_STATE = 'resource_state',\n VIEW_VISIT = 'view_visit',\n FEATURE_ACCESS = 'feature_access',\n CUSTOM_EVENT = 'custom_event',\n}\n\n// ─── Primitive filter (shallow equality matching only) ──────────\n\n/\n Only primitive values supported — no nested objects or arrays.\n * The engine evaluates: Object.entries(filter).every(([k, v]) => resource[k] === v)\n /\nexport const ValueSignal_FilterSchema = z.record(\n z.string(),\n z.union([z.string(), z.number(), z.boolean(), z.null()])\n);\nexport type ValueSignal_Filter = z.infer<typeof ValueSignal_FilterSchema>;\n\n// ─── Signal variant schemas (discriminated union on `signalType` — avoids Mongoose reserved `type`) ─────\n\nconst ValueSignal_ResourceOperationSchema = z.object({\n signalType: z.literal(ValueSignalType.RESOURCE_OPERATION),\n /* Resource type identifier (e.g., 'PROJECTS', 'REPORTS') /\n resourceType: z.string().min(1),\n /* Operation identifier (e.g., CoreResourceOperation.CREATE) /\n operation: z.string().min(1),\n /\n Optional resource field filter. Only operations on resources matching this\n * filter count. Filter evaluation requires the NOTIFY_RESOURCE_SUCCESS event\n * to carry a `resultSummary` field.\n /\n filter: ValueSignal_FilterSchema.optional(),\n /\n Minimum occurrence count required. When omitted (or 1), the first matching event fires.\n * When > 1, the engine counts matching events and fires at the N-th occurrence.\n /\n threshold: z.number().min(1).optional(),\n});\n\nconst ValueSignal_ResourceStateSchema = z.object({\n signalType: z.literal(ValueSignalType.RESOURCE_STATE),\n /* Resource type to count /\n resourceType: z.string().min(1),\n /* Field filter for counting /\n filter: ValueSignal_FilterSchema.optional(),\n /* Minimum count required to satisfy this signal /\n threshold: z.number().min(1),\n});\n\nconst ValueSignal_ViewVisitSchema = z.object({\n signalType: z.literal(ValueSignalType.VIEW_VISIT),\n /* Navigation content type (e.g., COMPOSITE_VIEW, CHART_VIEW) /\n contentType: z.enum(NAVIGATION_CONTENT_TYPES),\n /* Specific view reference. If omitted, any view of this contentType qualifies. /\n viewRef: z.string().optional(),\n});\n\nconst ValueSignal_FeatureAccessSchema = z.object({\n signalType: z.literal(ValueSignalType.FEATURE_ACCESS),\n /* Feature identifier from FeatureDefinition /\n featureId: z.string().min(1),\n});\n\nconst ValueSignal_CustomEventSchema = z.object({\n signalType: z.literal(ValueSignalType.CUSTOM_EVENT),\n /* Custom event name (tracked via useAnalytics().track() or backend emitSignal()) /\n eventName: z.string().min(1),\n /* Threshold: number of occurrences before the signal fires. Default: 1 /\n threshold: z.number().min(1).optional(),\n});\n\nexport const ValueSignalSchema = z.discriminatedUnion('signalType', [\n ValueSignal_ResourceOperationSchema,\n ValueSignal_ResourceStateSchema,\n ValueSignal_ViewVisitSchema,\n ValueSignal_FeatureAccessSchema,\n ValueSignal_CustomEventSchema,\n]);\nexport type ValueSignal = z.infer<typeof ValueSignalSchema>;\n\n// ─── Value Moment Enums ─────────────────────────────────────────\n\n/\n @wildo_source:part:start saas.models.analytics.value-moments facet:layer:shared facet:audience:app-developer\n \n A VALUE MOMENT is something meaningful happening in a person's journey — first value reached, an\n * aha moment, an activation stage, or an anti-pattern worth noticing. An application declares them\n * as `analytics.valueMoments`, and reads `achievedMoments` from the analytics context to drive an\n * onboarding surface.\n \n ⚠️ They need the ANALYTICS capability enabled. `analytics.enabled` is a master switch —\n * `false` means no analytics at all, whatever a user consented to — so a declared value moment with\n * analytics off is evaluated by nothing and the surface reading `achievedMoments` renders empty.\n * Enabling analytics with an EMPTY provider list is how an application gets the internal progression\n * plane without telemetry leaving it.\n \n The `role` is the load-bearing field, because it changes three things at once — event naming,\n * whether the moment PERSISTS once achieved, and how the engine evaluates it. In particular\n * `ANTI_PATTERN` is deliberately NOT persisted and is the only role for which `cooldownMs` and\n * `beforeStage` mean anything: it is meant to re-fire while the behaviour continues and to stop\n * permanently once the person reaches the stage that makes it moot.\n /\nexport enum ValueMomentMode {\n /* ANY signal in the list triggers the moment (OR logic) /\n ANY = 'ANY',\n /* ALL signals must be achieved (AND logic) /\n ALL = 'ALL',\n}\n\n/\n Semantic role of a value moment.\n * Determines event naming, persistence behavior, and how the system treats the moment.\n /\nexport enum ValueMomentRole {\n /* Time to First Value — the primary metric. Exactly 0 or 1 per scope per config. /\n TTFV = 'ttfv',\n /* Aha moment — behavior correlated with retention /\n AHA_MOMENT = 'aha_moment',\n /* Activation stage — progression milestone /\n ACTIVATION = 'activation',\n /* Anti-pattern — negative signal correlated with churn/frustration /\n ANTI_PATTERN = 'anti_pattern',\n}\n\n/\n Scope entity for the value moment.\n * Determines whose journey is being measured and where achieved state is persisted.\n /\nexport enum ValueMomentScope {\n /* Per-user value moment (default) /\n USER = 'user',\n /* Per-organization value moment /\n ORGANIZATION = 'organization',\n}\n\n// ─── Value Moment Callback ──────────────────────────────────────\n\nexport const ValueMomentCallbackSchema = z.object({\n /\n Frontend: when true, emits FrontendEvents.ANALYTICS_MOMENT_ACHIEVED on achievement.\n * App-custom code subscribes and filters by momentIdentifier for custom reactions.\n /\n frontendEvent: z.boolean().default(false),\n /\n Backend: Registered handler identifier to invoke when achieved.\n * Handler resolved from a registry (similar to resource custom service implementations).\n /\n backendHandler: z.string().optional(),\n});\nexport type ValueMomentCallback = z.infer<typeof ValueMomentCallbackSchema>;\n\n// ─── Value Moment Definition ────────────────────────────────────\n\nexport const ValueMomentSchema = z.object({\n /* Unique identifier (used as analytics event name prefix + persistence key) /\n identifier: z.string().min(1),\n\n /\n Semantic role. Determines:\n * - Event naming: TTFV/AHA_MOMENT/ACTIVATION emit 'value_moment.{id}', ANTI_PATTERN emits 'anti_pattern.{id}'\n * - Persistence: TTFV/AHA_MOMENT/ACTIVATION are persisted once achieved. ANTI_PATTERN is NOT persisted.\n * - Engine behavior: ANTI_PATTERN uses cooldownMs + beforeStage.\n /\n role: z.enum(ValueMomentRole),\n\n /\n Scope entity. Determines whose journey is measured.\n * USER: per-user (default). ORGANIZATION: per-org.\n /\n scope: z.enum(ValueMomentScope).default(ValueMomentScope.USER),\n\n /* Signals that compose this value moment /\n signals: z.array(ValueSignalSchema).min(1),\n\n /* Composition mode: ANY = first signal wins, ALL = all signals required /\n mode: z.enum(ValueMomentMode).default(ValueMomentMode.ANY),\n\n /\n Prerequisite moment identifiers. This moment only starts evaluating\n * AFTER all prerequisite moments have been achieved.\n /\n requires: z.array(z.string()).optional(),\n\n /\n Inverse prerequisite: this moment only evaluates BEFORE the specified\n * stage(s) have been achieved. Once any beforeStage moment is achieved,\n * this moment is permanently suppressed. Primarily used for ANTI_PATTERN role.\n /\n beforeStage: z.array(z.string()).optional(),\n\n /\n Cooldown in milliseconds between re-firings (only meaningful for ANTI_PATTERN role).\n * Default: 300_000 (5 minutes) for ANTI_PATTERN, ignored for other roles.\n /\n cooldownMs: z.number().min(0).optional(),\n\n /\n Callback hooks triggered when the moment is achieved.\n * - frontendEvent: emits ANALYTICS_MOMENT_ACHIEVED on the EventBus\n * - backendHandler: invokes a registered handler\n /\n onAchieved: ValueMomentCallbackSchema.optional(),\n});\n/* @wildo_source:part:end saas.models.analytics.value-moments */\nexport type ValueMoment = z.infer<typeof ValueMomentSchema>;\n"]}
1	+ {"version":3,"file":"analytics-value-moments.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/analytics-value-moments.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+IAA+I;AAC/I,MAAM,wBAAwB,GAAG;IAC/B,oBAAoB;IACpB,gBAAgB;IAChB,YAAY;IACZ,kBAAkB;IAClB,mBAAmB;IACnB,QAAQ;CACA,CAAC;AAEX,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAUX;AAVD,WAAY,kBAAkB;IAC5B,6CAAuB,CAAA;IACvB,+DAAyC,CAAA;IACzC,qCAAe,CAAA;IACf,+CAAyB,CAAA;IACzB,iDAA2B,CAAA;IAC3B,iEAA2C,CAAA;IAC3C,mDAA6B,CAAA;IAC7B,iDAA2B,CAAA;IAC3B,2DAAqC,CAAA;AACvC,CAAC,EAVW,kBAAkB,KAAlB,kBAAkB,QAU7B;AAED,mHAAmH;AACnH,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAuB,CAAC;AAEjE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iCAAiC,GAAG,eAAwB,CAAC;AAE1E,2DAA2D;AAC3D,MAAM,CAAN,IAAY,sBAGX;AAHD,WAAY,sBAAsB;IAChC,+CAAqB,CAAA;IACrB,6CAAmB,CAAA;AACrB,CAAC,EAHW,sBAAsB,KAAtB,sBAAsB,QAGjC;AAED,0DAA0D;AAC1D,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,uDAAiC,CAAA;IACjC,qDAA+B,CAAA;IAC/B,uDAAiC,CAAA;IACjC,uDAAiC,CAAA;AACnC,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,qCAAqC,GAAG,2BAAoC,CAAC;AAE1F,mEAAmE;AAEnE,MAAM,CAAN,IAAY,eAMX;AAND,WAAY,eAAe;IACzB,4DAAyC,CAAA;IACzC,oDAAiC,CAAA;IACjC,4CAAyB,CAAA;IACzB,oDAAiC,CAAA;IACjC,gDAA6B,CAAA;AAC/B,CAAC,EANW,eAAe,KAAf,eAAe,QAM1B;AAED,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CACzD,CAAC;AAGF,2GAA2G;AAE3G,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,CAAC;IACzD,6DAA6D;IAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;IACrD,6BAA6B;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gCAAgC;IAChC,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C,oDAAoD;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC;IACjD,iEAAiE;IACjE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAC7C,mFAAmF;IACnF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;IACrD,gDAAgD;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC;IACnD,qFAAqF;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,2EAA2E;IAC3E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE;IAClE,mCAAmC;IACnC,+BAA+B;IAC/B,2BAA2B;IAC3B,+BAA+B;IAC/B,6BAA6B;CAC9B,CAAC,CAAC;AAGH,mEAAmE;AAEnE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,4DAA4D;IAC5D,8BAAW,CAAA;IACX,+CAA+C;IAC/C,8BAAW,CAAA;AACb,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,eASX;AATD,WAAY,eAAe;IACzB,qFAAqF;IACrF,gCAAa,CAAA;IACb,sDAAsD;IACtD,4CAAyB,CAAA;IACzB,+CAA+C;IAC/C,4CAAyB,CAAA;IACzB,uEAAuE;IACvE,gDAA6B,CAAA;AAC/B,CAAC,EATW,eAAe,KAAf,eAAe,QAS1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,sCAAsC;IACtC,iCAAa,CAAA;IACb,oCAAoC;IACpC,iDAA6B,CAAA;AAC/B,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,mEAAmE;AAEnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH,mEAAmE;AAEnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,gFAAgF;IAChF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IAE7B;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC;IAE9D,6CAA6C;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1C,4EAA4E;IAC5E,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC;IAE1D;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;OAIG;IACH,UAAU,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC","sourcesContent":["/*\n Analytics Value Moment Schemas\n * \n * Defines value signals and value moments for the analytics system.\n * Value moments represent meaningful milestones in a user's journey\n * (TTFV, aha moments, activation stages, anti-patterns).\n /\n\nimport { z } from 'zod';\n\n/* Navigation content type values for VIEW_VISIT signals. Inlined here — canonical enum lives in saas-frontend-lib (navigation-v3.schemas). /\nconst NAVIGATION_CONTENT_TYPES = [\n 'resource_operation',\n 'composite_view',\n 'chart_view',\n 'full_custom_view',\n 'flows_actors_view',\n 'custom',\n] as const;\n\n// ─── Analytics Event Names (auto-instrumentation) ───────────────\n\n/\n Built-in analytics track event names used by auto-instrumentation.\n * App-custom events use arbitrary strings via track(name, properties).\n /\nexport enum AnalyticsEventName {\n PAGE_VIEW = 'page_view',\n RESOURCE_OPERATION = 'resource_operation',\n ERROR = 'error',\n USER_LOGIN = 'user_login',\n USER_LOGOUT = 'user_logout',\n USER_STATUS_CHANGED = 'user_status_changed',\n NOTIFICATION = 'notification',\n HOTKEY_USED = 'hotkey_used',\n FEATURE_ACCESSED = 'feature_accessed',\n}\n\n/* Event name prefix for value moments (TTFV, aha, activation). Anti-pattern uses ValueMomentRole.ANTI_PATTERN. /\nexport const VALUE_MOMENT_EVENT_PREFIX = 'value_moment' as const;\n\n/* Signal type value when ALL mode signals are completed. /\nexport const VALUE_MOMENT_SIGNAL_ALL_COMPLETED = 'all_completed' as const;\n\n/* Trigger source for ANALYTICS_MOMENT_ACHIEVED events. /\nexport enum AnalyticsTriggerSource {\n FRONTEND = 'frontend',\n BACKEND = 'backend',\n}\n\n/* Hotkey key values for HOTKEY_USED analytics events. /\nexport enum AnalyticsHotkeyKey {\n COMMAND_MENU = 'command_menu',\n SIDEBAR_TOGGLE = 'sidebar_toggle',\n NOTIFICATIONS = 'notifications',\n QUICK_SWITCHER = 'quick_switcher',\n SHORTCUTS_HELP = 'shortcuts_help',\n}\n\n/* Storage key prefix for achieved moments (suffixed with userId). /\nexport const ANALYTICS_ACHIEVED_STORAGE_KEY_PREFIX = 'wildo_analytics_achieved_' as const;\n\n// ─── Signal Types ───────────────────────────────────────────────\n\nexport enum ValueSignalType {\n RESOURCE_OPERATION = 'resource_operation',\n RESOURCE_STATE = 'resource_state',\n VIEW_VISIT = 'view_visit',\n FEATURE_ACCESS = 'feature_access',\n CUSTOM_EVENT = 'custom_event',\n}\n\n// ─── Primitive filter (shallow equality matching only) ──────────\n\n/\n Only primitive values supported — no nested objects or arrays.\n * The engine evaluates: Object.entries(filter).every(([k, v]) => resource[k] === v)\n /\nexport const ValueSignal_FilterSchema = z.record(\n z.string(),\n z.union([z.string(), z.number(), z.boolean(), z.null()])\n);\nexport type ValueSignal_Filter = z.infer<typeof ValueSignal_FilterSchema>;\n\n// ─── Signal variant schemas (discriminated union on `signalType` — avoids Mongoose reserved `type`) ─────\n\nconst ValueSignal_ResourceOperationSchema = z.object({\n signalType: z.literal(ValueSignalType.RESOURCE_OPERATION),\n /* Resource type identifier (e.g., 'PROJECTS', 'REPORTS') /\n resourceType: z.string().min(1),\n /* Operation identifier (e.g., CoreResourceOperation.CREATE) /\n operation: z.string().min(1),\n /\n Optional resource field filter. Only operations on resources matching this\n * filter count. Filter evaluation requires the NOTIFY_RESOURCE_SUCCESS event\n * to carry a `resultSummary` field.\n /\n filter: ValueSignal_FilterSchema.optional(),\n /\n Minimum occurrence count required. When omitted (or 1), the first matching event fires.\n * When > 1, the engine counts matching events and fires at the N-th occurrence.\n /\n threshold: z.number().min(1).optional(),\n});\n\nconst ValueSignal_ResourceStateSchema = z.object({\n signalType: z.literal(ValueSignalType.RESOURCE_STATE),\n /* Resource type to count /\n resourceType: z.string().min(1),\n /* Field filter for counting /\n filter: ValueSignal_FilterSchema.optional(),\n /* Minimum count required to satisfy this signal /\n threshold: z.number().min(1),\n});\n\nconst ValueSignal_ViewVisitSchema = z.object({\n signalType: z.literal(ValueSignalType.VIEW_VISIT),\n /* Navigation content type (e.g., COMPOSITE_VIEW, CHART_VIEW) /\n contentType: z.enum(NAVIGATION_CONTENT_TYPES),\n /* Specific view reference. If omitted, any view of this contentType qualifies. /\n viewRef: z.string().optional(),\n});\n\nconst ValueSignal_FeatureAccessSchema = z.object({\n signalType: z.literal(ValueSignalType.FEATURE_ACCESS),\n /* Feature identifier from FeatureDefinition /\n featureId: z.string().min(1),\n});\n\nconst ValueSignal_CustomEventSchema = z.object({\n signalType: z.literal(ValueSignalType.CUSTOM_EVENT),\n /* Custom event name (tracked via useAnalytics().track() or backend emitSignal()) /\n eventName: z.string().min(1),\n /* Threshold: number of occurrences before the signal fires. Default: 1 /\n threshold: z.number().min(1).optional(),\n});\n\nexport const ValueSignalSchema = z.discriminatedUnion('signalType', [\n ValueSignal_ResourceOperationSchema,\n ValueSignal_ResourceStateSchema,\n ValueSignal_ViewVisitSchema,\n ValueSignal_FeatureAccessSchema,\n ValueSignal_CustomEventSchema,\n]);\nexport type ValueSignal = z.infer<typeof ValueSignalSchema>;\n\n// ─── Value Moment Enums ─────────────────────────────────────────\n\n/\n @wildo_source:part:start saas.models.analytics.value-moments facet:layer:shared facet:audience:app-developer\n \n A VALUE MOMENT is something meaningful happening in a person's journey — first value reached, an\n * aha moment, an activation stage, or an anti-pattern worth noticing. An application declares them\n * as `analytics.valueMoments`, and reads `achievedMoments` from the analytics context to drive an\n * onboarding surface.\n \n ⚠️ They need the ANALYTICS capability enabled. `analytics.enabled` is a master switch —\n * `false` means no analytics at all, whatever a user consented to — so a declared value moment with\n * analytics off is evaluated by nothing and the surface reading `achievedMoments` renders empty.\n * Enabling analytics with an EMPTY provider list is how an application gets the internal progression\n * plane without telemetry leaving it.\n \n The `role` is the load-bearing field, because it changes three things at once — event naming,\n * whether the moment PERSISTS once achieved, and how the engine evaluates it. In particular\n * `ANTI_PATTERN` is deliberately NOT persisted and is the only role for which `cooldownMs` and\n * `beforeStage` mean anything: it is meant to re-fire while the behaviour continues and to stop\n * permanently once the person reaches the stage that makes it moot.\n /\nexport enum ValueMomentMode {\n /* ANY signal in the list triggers the moment (OR logic) /\n ANY = 'ANY',\n /* ALL signals must be achieved (AND logic) /\n ALL = 'ALL',\n}\n\n/\n Semantic role of a value moment.\n * Determines event naming, persistence behavior, and how the system treats the moment.\n /\nexport enum ValueMomentRole {\n /* Time to First Value — the primary metric. Exactly 0 or 1 per scope per config. /\n TTFV = 'ttfv',\n /* Aha moment — behavior correlated with retention /\n AHA_MOMENT = 'aha_moment',\n /* Activation stage — progression milestone /\n ACTIVATION = 'activation',\n /* Anti-pattern — negative signal correlated with churn/frustration /\n ANTI_PATTERN = 'anti_pattern',\n}\n\n/\n Scope entity for the value moment.\n * Determines whose journey is being measured and where achieved state is persisted.\n /\nexport enum ValueMomentScope {\n /* Per-user value moment (default) /\n USER = 'user',\n /* Per-organization value moment /\n ORGANIZATION = 'organization',\n}\n\n// ─── Value Moment Callback ──────────────────────────────────────\n\nexport const ValueMomentCallbackSchema = z.object({\n /\n Frontend: when true, emits FrontendEvents.ANALYTICS_MOMENT_ACHIEVED on achievement.\n * App-custom code subscribes and filters by momentIdentifier for custom reactions.\n /\n frontendEvent: z.boolean().default(false),\n /\n Backend: Registered handler identifier to invoke when achieved.\n * Handler resolved from a registry (similar to resource custom service implementations).\n /\n backendHandler: z.string().optional(),\n});\nexport type ValueMomentCallback = z.infer<typeof ValueMomentCallbackSchema>;\n\n// ─── Value Moment Definition ────────────────────────────────────\n\nexport const ValueMomentSchema = z.object({\n /* Unique identifier (used as analytics event name prefix + persistence key) /\n identifier: z.string().min(1),\n\n /\n Semantic role. Determines:\n * - Event naming: TTFV/AHA_MOMENT/ACTIVATION emit 'value_moment.{id}', ANTI_PATTERN emits 'anti_pattern.{id}'\n * - Persistence: TTFV/AHA_MOMENT/ACTIVATION are persisted once achieved. ANTI_PATTERN is NOT persisted.\n * - Engine behavior: ANTI_PATTERN uses cooldownMs + beforeStage.\n /\n role: z.enum(ValueMomentRole),\n\n /\n Scope entity. Determines whose journey is measured.\n * USER: per-user (default). ORGANIZATION: per-org.\n /\n scope: z.enum(ValueMomentScope).default(ValueMomentScope.USER),\n\n /* Signals that compose this value moment /\n signals: z.array(ValueSignalSchema).min(1),\n\n /* Composition mode: ANY = first signal wins, ALL = all signals required /\n mode: z.enum(ValueMomentMode).default(ValueMomentMode.ANY),\n\n /\n Prerequisite moment identifiers. This moment only starts evaluating\n * AFTER all prerequisite moments have been achieved.\n /\n requires: z.array(z.string()).optional(),\n\n /\n Inverse prerequisite: this moment only evaluates BEFORE the specified\n * stage(s) have been achieved. Once any beforeStage moment is achieved,\n * this moment is permanently suppressed. Primarily used for ANTI_PATTERN role.\n /\n beforeStage: z.array(z.string()).optional(),\n\n /\n Cooldown in milliseconds between re-firings (only meaningful for ANTI_PATTERN role).\n * Default: 300_000 (5 minutes) for ANTI_PATTERN, ignored for other roles.\n /\n cooldownMs: z.number().min(0).optional(),\n\n /\n Callback hooks triggered when the moment is achieved.\n * - frontendEvent: emits ANALYTICS_MOMENT_ACHIEVED on the EventBus\n * - backendHandler: invokes a registered handler\n /\n onAchieved: ValueMomentCallbackSchema.optional(),\n});\n/* @wildo_source:part:end saas.models.analytics.value-moments */\nexport type ValueMoment = z.infer<typeof ValueMomentSchema>;\n"]}

package/dist/esm/config/app-configuration-shared.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"app-configuration-shared.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAmC,MAAM,6CAA6C,CAAC;AAGzH,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAKlK,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AAEvF,OAAO,EAIL,mBAAmB,EACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,eAAO,MAAM,yBAAyB;;;;;;;;iBAgBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;CAO9B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAIzH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAsC7C,CAAC;AAKH,eAAO,MAAM,wCAAwC;;;;iBAmBnD,CAAC;AAIH,eAAO,MAAM,0CAA0C;;;;;;iBAqCrD,CAAC;AAGH,eAAO,MAAM,qDAAqD;;;;;;;;iBAQhE,CAAC;AAGH,eAAO,MAAM,4CAA4C,GAAI,CAAC,SAAS,yBAAyB,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;;;;;iBAO5H,CAAA;AAED,eAAO,MAAM,qCAAqC;;;;;iBAAgF,CAAC;AAQnI,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,aAAa,kBAAkB;CAChC;AAED,iHAAiH;AACjH,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;iBAe1C,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6ChC,CAAC;AAOH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoEzC,CAAC;AAGH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC7G,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACnI,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
1	+ {"version":3,"file":"app-configuration-shared.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAmC,MAAM,6CAA6C,CAAC;AAGzH,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAKlK,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AAEvF,OAAO,EAIL,mBAAmB,EACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,eAAO,MAAM,yBAAyB;;;;;;;;iBAgBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;CAO9B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAIzH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;iBAsC7C,CAAC;AAKH,eAAO,MAAM,wCAAwC;;;;iBAmBnD,CAAC;AAIH,eAAO,MAAM,0CAA0C;;;;;;iBAqCrD,CAAC;AAGH,eAAO,MAAM,qDAAqD;;;;;;;;iBAQhE,CAAC;AAGH,eAAO,MAAM,4CAA4C,GAAI,CAAC,SAAS,yBAAyB,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;;;;;iBAO5H,CAAA;AAED,eAAO,MAAM,qCAAqC;;;;;iBAAgF,CAAC;AAQnI,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;IACnB,aAAa,kBAAkB;CAChC;AAED,iHAAiH;AACjH,eAAO,MAAM,6BAA6B;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;iBAe1C,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6ChC,CAAC;AAOH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoEzC,CAAC;AAGH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC7G,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qDAAqD,CAAC,CAAC;AACnI,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/esm/config/auth-config-resolution.shared.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-config-resolution.shared.utils.d.ts","sourceRoot":"","sources":["~~../../../../~~src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAEjK,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAAC;AAEzF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,cAAc,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC1C;AAQD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAOlF;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,UAAU,EAK1E,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,kBAAkB,EAAE,cAAc,GAAG,cAAc,CAMtG;AA8OD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CA0BtF"}
1	+ {"version":3,"file":"auth-config-resolution.shared.utils.d.ts","sourceRoot":"","sources":["../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAEjK,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAAC;AAEzF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,cAAc,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC1C;AAQD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAOlF;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,UAAU,EAK1E,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,kBAAkB,EAAE,cAAc,GAAG,cAAc,CAMtG;AA8OD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CA0BtF"}

package/dist/esm/config/auth-config-resolution.shared.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAyB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,mBAAmB,CAAC,IAAsB,EAAE,QAAmC;IACtF,OAAO;QACL,+FAA+F;QAC/F,+EAA+E;QAC/E,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,4FAA4F;QAC5F,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC;QAC/E,wFAAwF;QACxF,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAkC,EAClC,YAAoC;IAEpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,eAAe,GAAG,YAAY;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAErD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;QACjC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAC3D,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO;KACvE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YACjF,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;QACxF,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC;KACzE,CAAC;AACJ,CAAC","sourcesContent":["/*\n W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n \n Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).\n * Multi-org: each org type override resolved independently, then most-restrictive across all.\n \n This is a pure function — no DI, no DB, no side effects.\n /\n\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig, StepUpAuthConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean \| { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n userTypeAuth: UserTypeAuthPolicy;\n orgOverrides: OrgTypeAuthOverrides[];\n orgAuthMethodPolicy: OrgAuthMethodPolicy;\n expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n authMethodsEnabled: AuthMethodsMap;\n mfaPolicy: MfaPolicyConfig;\n passwordPolicy: PasswordPolicyConfig;\n /\n Re-authentication freshness (#527). `undefined` when the user type declares no step-up policy —\n * an organisation cannot introduce step-up for a user type that has none, because there is no base\n * to be more restrictive THAN, and inventing one would let a tenant enable a gate the application\n * never configured.\n /\n stepUpAuth: StepUpAuthConfig \| undefined;\n}\n\nfunction isMethodEnabled(value: boolean \| { enabled: boolean } \| undefined): boolean {\n if (value === undefined) return false;\n if (typeof value === 'boolean') return value;\n return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap \| undefined): Set<AuthMethod> {\n if (!map) return new Set();\n const result = new Set<AuthMethod>();\n for (const [method, value] of Object.entries(map)) {\n if (isMethodEnabled(value)) result.add(method as AuthMethod);\n }\n return result;\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n const result: AuthMethodsMap = {};\n for (const method of Object.values(AuthMethod)) {\n result[method] = methods.has(method);\n }\n return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/\n Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n \n `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n /\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.PASSKEY,\n AuthMethod.MAGIC_LINK,\n AuthMethod.SMS_OTP,\n];\n\n/\n AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n /\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n const result: AuthMethodsMap = { ...authMethodsEnabled };\n for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n result[method] = false;\n }\n return result;\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n userTypeMethods: Set<AuthMethod>,\n orgOverride: OrgTypeAuthOverrides,\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n switch (policy) {\n case OrgAuthMethodPolicy.RESTRICT_ONLY:\n return intersection(userTypeMethods, orgMethods);\n\n case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n const expandableSet = new Set(expandable);\n const expansions = intersection(orgMethods, expandableSet);\n return union(userTypeMethods, expansions);\n }\n\n case OrgAuthMethodPolicy.UNRESTRICTED:\n return new Set(orgMethods);\n\n default:\n return new Set(userTypeMethods);\n }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n userTypeMethods: Set<AuthMethod>,\n orgOverrides: OrgTypeAuthOverrides[],\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n const perOrgResults = validOverrides.map(o =>\n resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n );\n\n if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n // Each org may expand within the expandable set, but multi-org users only get\n // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n }\n\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n base: MfaPolicyConfig,\n override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n return {\n requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n base: MfaPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n const mfaOverrides = orgOverrides\n .map(o => o?.mfaPolicy)\n .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n if (mfaOverrides.length === 0) return { ...base };\n\n const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n return {\n requireMFA: a.requireMFA \|\| b.requireMFA,\n requireStrongMFA: a.requireStrongMFA \|\| b.requireStrongMFA,\n acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n };\n}\n\n// ─── Step-Up Auth Resolution ────────────────────────────────────────────────\n\nfunction resolveStepUpSingle(base: StepUpAuthConfig, override: Partial<StepUpAuthConfig>): StepUpAuthConfig {\n return {\n // Either side turning step-up ON wins: an organisation may require re-authentication where the\n // application does not, and may never switch off one the application requires.\n enabled: base.enabled \|\| (override.enabled ?? false),\n // The SHORTER window wins — the opposite arithmetic to `enabled`, same direction of intent.\n maxAgeSeconds: mergeNumberLowerWins(base.maxAgeSeconds, override.maxAgeSeconds),\n // Intersection: an organisation may WITHDRAW an acceptable method, never introduce one.\n methods: mergeArrayIntersection(base.methods, override.methods) ?? base.methods,\n };\n}\n\nfunction resolveStepUpMultiOrg(\n base: StepUpAuthConfig \| undefined,\n orgOverrides: OrgTypeAuthOverrides[],\n): StepUpAuthConfig \| undefined {\n if (base === undefined) return undefined;\n const stepUpOverrides = orgOverrides\n .map(o => o?.stepUpAuth)\n .filter((p): p is Partial<StepUpAuthConfig> => !!p);\n if (stepUpOverrides.length === 0) return { ...base };\n\n const perOrgResults = stepUpOverrides.map(o => resolveStepUpSingle(base, o));\n return perOrgResults.reduce((acc, r) => ({\n enabled: acc.enabled \|\| r.enabled,\n maxAgeSeconds: Math.min(acc.maxAgeSeconds, r.maxAgeSeconds),\n methods: mergeArrayIntersection(acc.methods, r.methods) ?? acc.methods,\n }));\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n base: PasswordPolicyConfig,\n override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n return {\n minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n base: PasswordPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n const pwOverrides = orgOverrides\n .map(o => o?.passwordPolicy)\n .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n if (pwOverrides.length === 0) return { ...base };\n\n const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n return normalizePasswordPolicyBounds(\n perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n return normalizePasswordPolicyBounds({\n minLength: Math.max(a.minLength, b.minLength),\n maxLength: Math.min(a.maxLength, b.maxLength),\n requireUppercase: a.requireUppercase \|\| b.requireUppercase,\n requireLowercase: a.requireLowercase \|\| b.requireLowercase,\n requireNumbers: a.requireNumbers \|\| b.requireNumbers,\n requireSpecialChars: a.requireSpecialChars \|\| b.requireSpecialChars,\n expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n });\n}\n\n/\n Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n if (policy.maxLength >= policy.minLength) {\n return policy;\n }\n\n return {\n ...policy,\n maxLength: policy.minLength,\n };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base \|\| override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n if (base === 0 && override === 0) return 0;\n if (base === 0) return override;\n if (override === 0) return base;\n return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] \| undefined, b: T[] \| undefined): T[] \| undefined {\n if (a === undefined) return b;\n if (b === undefined) return a;\n const setB = new Set(b);\n return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n const result = new Set<T>();\n for (const item of a) {\n if (b.has(item)) result.add(item);\n }\n return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n if (!orgOverrides.length) {\n return {\n authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n mfaPolicy: { ...userTypeAuth.mfaPolicy },\n passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n stepUpAuth: userTypeAuth.stepUpAuth ? { ...userTypeAuth.stepUpAuth } : undefined,\n };\n }\n\n const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n const resolvedMethods = resolveAuthMethodsMultiOrg(\n userTypeMethods,\n orgOverrides,\n orgAuthMethodPolicy,\n expandableOrgMethods ?? [],\n );\n\n return {\n authMethodsEnabled: setToMethodsMap(resolvedMethods),\n mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n stepUpAuth: resolveStepUpMultiOrg(userTypeAuth.stepUpAuth, orgOverrides),\n };\n}\n"]}
1	+ {"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAyB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,mBAAmB,CAAC,IAAsB,EAAE,QAAmC;IACtF,OAAO;QACL,+FAA+F;QAC/F,+EAA+E;QAC/E,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,4FAA4F;QAC5F,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC;QAC/E,wFAAwF;QACxF,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAkC,EAClC,YAAoC;IAEpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,eAAe,GAAG,YAAY;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAErD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;QACjC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAC3D,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO;KACvE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YACjF,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;QACxF,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC;KACzE,CAAC;AACJ,CAAC","sourcesContent":["/*\n W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n \n Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).\n * Multi-org: each org type override resolved independently, then most-restrictive across all.\n \n This is a pure function — no DI, no DB, no side effects.\n /\n\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig, StepUpAuthConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean \| { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n userTypeAuth: UserTypeAuthPolicy;\n orgOverrides: OrgTypeAuthOverrides[];\n orgAuthMethodPolicy: OrgAuthMethodPolicy;\n expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n authMethodsEnabled: AuthMethodsMap;\n mfaPolicy: MfaPolicyConfig;\n passwordPolicy: PasswordPolicyConfig;\n /\n Re-authentication freshness (#527). `undefined` when the user type declares no step-up policy —\n * an organisation cannot introduce step-up for a user type that has none, because there is no base\n * to be more restrictive THAN, and inventing one would let a tenant enable a gate the application\n * never configured.\n /\n stepUpAuth: StepUpAuthConfig \| undefined;\n}\n\nfunction isMethodEnabled(value: boolean \| { enabled: boolean } \| undefined): boolean {\n if (value === undefined) return false;\n if (typeof value === 'boolean') return value;\n return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap \| undefined): Set<AuthMethod> {\n if (!map) return new Set();\n const result = new Set<AuthMethod>();\n for (const [method, value] of Object.entries(map)) {\n if (isMethodEnabled(value)) result.add(method as AuthMethod);\n }\n return result;\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n const result: AuthMethodsMap = {};\n for (const method of Object.values(AuthMethod)) {\n result[method] = methods.has(method);\n }\n return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/\n Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n \n `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n /\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.PASSKEY,\n AuthMethod.MAGIC_LINK,\n AuthMethod.SMS_OTP,\n];\n\n/\n AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n /\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n const result: AuthMethodsMap = { ...authMethodsEnabled };\n for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n result[method] = false;\n }\n return result;\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n userTypeMethods: Set<AuthMethod>,\n orgOverride: OrgTypeAuthOverrides,\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n switch (policy) {\n case OrgAuthMethodPolicy.RESTRICT_ONLY:\n return intersection(userTypeMethods, orgMethods);\n\n case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n const expandableSet = new Set(expandable);\n const expansions = intersection(orgMethods, expandableSet);\n return union(userTypeMethods, expansions);\n }\n\n case OrgAuthMethodPolicy.UNRESTRICTED:\n return new Set(orgMethods);\n\n default:\n return new Set(userTypeMethods);\n }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n userTypeMethods: Set<AuthMethod>,\n orgOverrides: OrgTypeAuthOverrides[],\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n const perOrgResults = validOverrides.map(o =>\n resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n );\n\n if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n // Each org may expand within the expandable set, but multi-org users only get\n // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n }\n\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n base: MfaPolicyConfig,\n override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n return {\n requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n base: MfaPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n const mfaOverrides = orgOverrides\n .map(o => o?.mfaPolicy)\n .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n if (mfaOverrides.length === 0) return { ...base };\n\n const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n return {\n requireMFA: a.requireMFA \|\| b.requireMFA,\n requireStrongMFA: a.requireStrongMFA \|\| b.requireStrongMFA,\n acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n };\n}\n\n// ─── Step-Up Auth Resolution ────────────────────────────────────────────────\n\nfunction resolveStepUpSingle(base: StepUpAuthConfig, override: Partial<StepUpAuthConfig>): StepUpAuthConfig {\n return {\n // Either side turning step-up ON wins: an organisation may require re-authentication where the\n // application does not, and may never switch off one the application requires.\n enabled: base.enabled \|\| (override.enabled ?? false),\n // The SHORTER window wins — the opposite arithmetic to `enabled`, same direction of intent.\n maxAgeSeconds: mergeNumberLowerWins(base.maxAgeSeconds, override.maxAgeSeconds),\n // Intersection: an organisation may WITHDRAW an acceptable method, never introduce one.\n methods: mergeArrayIntersection(base.methods, override.methods) ?? base.methods,\n };\n}\n\nfunction resolveStepUpMultiOrg(\n base: StepUpAuthConfig \| undefined,\n orgOverrides: OrgTypeAuthOverrides[],\n): StepUpAuthConfig \| undefined {\n if (base === undefined) return undefined;\n const stepUpOverrides = orgOverrides\n .map(o => o?.stepUpAuth)\n .filter((p): p is Partial<StepUpAuthConfig> => !!p);\n if (stepUpOverrides.length === 0) return { ...base };\n\n const perOrgResults = stepUpOverrides.map(o => resolveStepUpSingle(base, o));\n return perOrgResults.reduce((acc, r) => ({\n enabled: acc.enabled \|\| r.enabled,\n maxAgeSeconds: Math.min(acc.maxAgeSeconds, r.maxAgeSeconds),\n methods: mergeArrayIntersection(acc.methods, r.methods) ?? acc.methods,\n }));\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n base: PasswordPolicyConfig,\n override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n return {\n minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n base: PasswordPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n const pwOverrides = orgOverrides\n .map(o => o?.passwordPolicy)\n .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n if (pwOverrides.length === 0) return { ...base };\n\n const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n return normalizePasswordPolicyBounds(\n perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n return normalizePasswordPolicyBounds({\n minLength: Math.max(a.minLength, b.minLength),\n maxLength: Math.min(a.maxLength, b.maxLength),\n requireUppercase: a.requireUppercase \|\| b.requireUppercase,\n requireLowercase: a.requireLowercase \|\| b.requireLowercase,\n requireNumbers: a.requireNumbers \|\| b.requireNumbers,\n requireSpecialChars: a.requireSpecialChars \|\| b.requireSpecialChars,\n expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n });\n}\n\n/\n Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n if (policy.maxLength >= policy.minLength) {\n return policy;\n }\n\n return {\n ...policy,\n maxLength: policy.minLength,\n };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base \|\| override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n if (base === 0 && override === 0) return 0;\n if (base === 0) return override;\n if (override === 0) return base;\n return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] \| undefined, b: T[] \| undefined): T[] \| undefined {\n if (a === undefined) return b;\n if (b === undefined) return a;\n const setB = new Set(b);\n return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n const result = new Set<T>();\n for (const item of a) {\n if (b.has(item)) result.add(item);\n }\n return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n if (!orgOverrides.length) {\n return {\n authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n mfaPolicy: { ...userTypeAuth.mfaPolicy },\n passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n stepUpAuth: userTypeAuth.stepUpAuth ? { ...userTypeAuth.stepUpAuth } : undefined,\n };\n }\n\n const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n const resolvedMethods = resolveAuthMethodsMultiOrg(\n userTypeMethods,\n orgOverrides,\n orgAuthMethodPolicy,\n expandableOrgMethods ?? [],\n );\n\n return {\n authMethodsEnabled: setToMethodsMap(resolvedMethods),\n mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n stepUpAuth: resolveStepUpMultiOrg(userTypeAuth.stepUpAuth, orgOverrides),\n };\n}\n"]}

package/dist/esm/config/brand-assets.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"brand-assets.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAED,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,UAAU,eAAe;CAC1B;AAED,oBAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,MAAM,WAAW;IACjB,mFAAmF;IACnF,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,oBAAY,gBAAgB;IAC1B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,QAAA,MAAM,wBAAwB;;;;;;;;iBAS5B,CAAC;AACH,eAAO,MAAM,uBAAuB,EAAE,OAAO,wBAAmD,CAAC;AACjG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,qBAAqB,CAAC;IACnC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,KAAK,EAAE,eAAe,GACrB,iBAAiB,GAAG,SAAS,CAsB/B"}
1	+ {"version":3,"file":"brand-assets.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAED,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,UAAU,eAAe;CAC1B;AAED,oBAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,MAAM,WAAW;IACjB,mFAAmF;IACnF,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,oBAAY,gBAAgB;IAC1B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,QAAA,MAAM,wBAAwB;;;;;;;;iBAS5B,CAAC;AACH,eAAO,MAAM,uBAAuB,EAAE,OAAO,wBAAmD,CAAC;AACjG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,qBAAqB,CAAC;IACnC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,KAAK,EAAE,eAAe,GACrB,iBAAiB,GAAG,SAAS,CAsB/B"}

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAIrE,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAUtF,eAAO,MAAM,qBAAqB;;;;;;iBAUhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;IAEnC;;;;;;;;;;;;OAYG;;IAEH,6DAA6D;;IAE7D,yFAAyF;;kBAsCzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;QA7GnC;;;;;;;;;;;;WAYG;;QAEH,6DAA6D;;QAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0KzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;YA/LnC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4LzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;kBAmB1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,mEAAmE;AAInE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;YAxVhC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwUR,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA8BtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE"}
1	+ {"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAIrE,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAUtF,eAAO,MAAM,qBAAqB;;;;;;iBAUhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;IAEnC;;;;;;;;;;;;OAYG;;IAEH,6DAA6D;;IAE7D,yFAAyF;;kBAsCzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;QA7GnC;;;;;;;;;;;;WAYG;;QAEH,6DAA6D;;QAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0KzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;YA/LnC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4LzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;kBAmB1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,mEAAmE;AAInE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;YAxVhC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwUR,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA8BtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE"}

package/dist/esm/config/entity-identity-config.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,6EAA2C,CAAA;IAC3C,uEAAqC,CAAA;IACrC,2EAAyC,CAAA;IACzC,2DAAyB,CAAA;IACzB,6FAA2D,CAAA;AAC7D,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0EAAiD,CAAA;IACjD,8CAAqB,CAAA;AACvB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACnC;;;;;;;;OAQG;IACH,MAAM,2BAA2B,GAA0B;QACzD,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,OAAO;KACnB,CAAC;IACF,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC1D,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;WACxC,YAAY,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1D,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,4FAA4F;IAC5F,YAAY,EAAE,wBAAwB;IAEtC,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,KAAK;KACrC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C;;;;;;mHAM+G;IAC/G,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,qCAAW,CAAA;IACX,uCAAa,CAAA;IACb,mDAAyB,CAAA;AAC3B,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/D;;;;;;;;;;;;;OAaG;IACH,UAAU,EAAE,sBAAsB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEH,mEAAmE;AAEnE,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC;KACpD,WAAW,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;IACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,iBAAiB,CAClB,EAAE,CAAC;QACF,MAAM,mBAAmB,GACvB,UAAU,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,gBAAgB;wBAChB,gBAAgB;wBAChB,8BAA8B;wBAC9B,KAAK;qBACN;oBACD,OAAO,EACL,cAAc,QAAQ,sCAAsC;0BAC1D,IAAI,aAAa,0CAA0C;0BAC3D,8DAA8D;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAYL;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAK7D,iBAAoE,EACpE,kBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAC9D,kBAAkB,CACnB,CACF;SACA,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC,CAAC;AACR,CAAC","sourcesContent":["/*\n Entity & Identity Configuration Schemas\n \n Top-level config sections: userTypes, frontendServices, organizationTypes.\n * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).\n \n Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.\n * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.\n \n See:\n * - target-configuration-type.md §2b (UserTypeAuthPolicy)\n * - entity-identity-architecture-analysis.md §4.2\n /\n\nimport { z } from 'zod';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { AppFrontendType } from './app-frontend-type.shared.schemas';\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\n/* Canonical registration-policy discriminant. /\nexport enum RegistrationMode {\n OPEN = 'open',\n INVITATION_ONLY = 'invitation_only',\n ADMIN_ONLY = 'admin_only',\n DISABLED = 'disabled',\n}\n\n/\n Semantically distinct ways in which a user can acquire a user type.\n \n Keep these channels separate even when two currently share the same mode matrix: the actor,\n * user intent, and security boundary differ, and future policy can evolve one without silently\n * changing the others.\n /\nexport enum RegistrationAcquisitionChannel {\n PUBLIC_SELF_SERVICE = 'public_self_service',\n SOCIAL_OAUTH_JIT = 'social_oauth_jit',\n ENTERPRISE_SSO_JIT = 'enterprise_sso_jit',\n INVITATION = 'invitation',\n ADMINISTRATIVE_PROVISIONING = 'administrative_provisioning',\n}\n\n/* D-19: Email verification timing. /\nexport enum EmailVerificationMode {\n REQUIRED_BEFORE_ACCESS = 'required_before_access',\n DEFERRED = 'deferred',\n}\n\n/* E-10, D-15: How much orgs can override user-type auth methods. /\nexport enum OrgAuthMethodPolicy {\n RESTRICT_ONLY = 'restrict_only',\n EXPAND_WITHIN_SET = 'expand_within_set',\n UNRESTRICTED = 'unrestricted',\n}\n\n// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────\n\nexport const AuthMethodExpandedConfigSchema = z.object({\n enabled: z.boolean(),\n});\nexport type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;\n\n/\n authMethodsEnabled value: boolean shorthand OR expanded config.\n * Shorthand: PASSWORD: true → normalized at runtime to { enabled: true }.\n /\nconst AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);\n\n// ─── Policy Sub-Types ───────────────────────────────────────────────────────\n\nexport const MfaPolicyConfigSchema = z.object({\n requireMFA: z.boolean().default(false),\n /* D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n /* Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. /\n acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),\n /* D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. /\n enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),\n /* C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. /\n passkeyExemptFromMFA: z.boolean().default(true),\n});\nexport type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;\n\n/\n Registration policy for one user type.\n \n Every user type must author this object explicitly. Acquisition policy is security\n * configuration, so omission must never silently become open registration.\n /\nexport const RegistrationConfigSchema = z.strictObject({\n mode: z.enum(RegistrationMode),\n /\n Only acquisition methods with a complete public-signup implementation are accepted.\n \n PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public\n * registration in #463; before that they were authentication and enrollment methods only, and\n * declaring one here was refused because it would have advertised a path the runtime could not\n * execute.\n \n A password-less signup creates the account with NO credential and proves the address by a magic\n * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —\n * \"access now, verify later\" is not a state the runtime can produce for a registrant who holds\n * nothing. See `registerUser`.\n /\n allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n /* D-19: 'deferred' gives immediate access, verify later. /\n emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),\n /* R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. /\n blockForSSODomains: z.boolean().default(false),\n}).superRefine((registration, ctx) => {\n /\n * The set with a public-signup implementation. It is enumerated rather than open because the\n * failure this refusal prevents is silent: a method listed here is ADVERTISED to a registrant, and\n * one the runtime cannot execute fails after they have committed to it.\n \n MAGIC_LINK and PASSKEY joined in #463. Anything else — SSO, an MFA factor — is an authentication\n * or enrollment method that has no way to CREATE an account from an anonymous caller, and adding it\n * here means building that flow first, not widening this list.\n /\n const publiclyRegisterableMethods: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.EXTERNAL_OAUTH2,\n AuthMethod.MAGIC_LINK,\n AuthMethod.PASSKEY,\n ];\n const unsupportedMethods = registration.allowedMethods.filter(\n (method) => !publiclyRegisterableMethods.includes(method),\n );\n if (unsupportedMethods.length > 0) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,\n });\n }\n if (\n registration.mode === RegistrationMode.OPEN\n && registration.allowedMethods.length === 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: 'Open registration requires at least one supported acquisition method',\n });\n }\n});\nexport type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;\n\n/\n Password policy — includes expiryDays (R-8, moved from flat auth field).\n * Defined here (not in app-configuration-shared) to avoid circular dependency.\n * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.\n /\nexport const PasswordPolicyConfigSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /* R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). /\n expiryDays: z.number().min(0).default(0),\n});\nexport type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;\n\n/* E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. /\nexport const StepUpAuthConfigSchema = z.object({\n enabled: z.boolean().default(false),\n maxAgeSeconds: z.number().min(60).max(3600).default(300),\n methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n});\nexport type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;\n\nexport const LockoutPolicyConfigSchema = z.object({\n maxLoginAttempts: z.number().min(3).max(20).default(5),\n lockoutDurationMinutes: z.number().min(1).max(1440).default(30),\n /* W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. /\n progressiveLockout: z.boolean().default(false),\n /* W2.3: cap for progressive lockout duration in hours. /\n maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),\n});\nexport type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;\n\nexport const MethodManagementConfigSchema = z.object({\n allowUserMethodRemoval: z.boolean().default(true),\n requireReauthForMethodChanges: z.boolean().default(false),\n});\nexport type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;\n\n// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────\n\n/\n The complete auth policy for a user type. Every user type MUST define this.\n * There are no global auth defaults — this IS the auth config.\n \n Zod .default() values enable omission in config input files, but the\n * resolved runtime type has all fields present (no optionals for policy fields).\n \n See target-configuration-type.md §2b for full specification.\n /\nexport const UserTypeAuthPolicySchema = z.object({\n /* E-1, D-20: Opt-in semantics — absent method = disabled. /\n authMethodsEnabled: z.partialRecord(\n z.enum(AuthMethod),\n AuthMethodValueSchema,\n ).default({ [AuthMethod.PASSWORD]: true }),\n\n /* E-2: MFA enforcement for this user type. /\n mfaPolicy: MfaPolicyConfigSchema.default({\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n }),\n\n /* E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. /\n registration: RegistrationConfigSchema,\n\n /* E-7, R-8: Password strength + expiry. /\n passwordPolicy: PasswordPolicyConfigSchema.default({\n minLength: 8,\n maxLength: 128,\n requireUppercase: true,\n requireLowercase: true,\n requireNumbers: true,\n requireSpecialChars: false,\n expiryDays: 0,\n }),\n\n /* E-8: Session duration for this user type. /\n sessionDurationMinutes: z.number().min(1).max(1440).default(30),\n\n /\n E-8, G-2: the cap on simultaneous refresh chains for this user type.\n \n Leaving it undefined does NOT mean unlimited. The token issuer falls back to\n * `DEFAULT_MAX_CONCURRENT_SESSIONS` (10) and evicts the oldest chain beyond it, so a user type\n * that declares nothing is still capped. There is no value that disables the cap; declare the\n * number you want.\n /\n maxConcurrentSessions: z.number().min(1).optional(),\n\n /* G-1: Per-user-type lockout. Backend-only. /\n lockoutPolicy: LockoutPolicyConfigSchema.default({\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n }),\n\n /* G-8: Consumer=true (convenience), Admin=false (security). /\n autoLinkByEmail: z.boolean().default(true),\n\n /* E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). /\n stepUpAuth: StepUpAuthConfigSchema.optional(),\n\n methodManagement: MethodManagementConfigSchema.default({\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: false,\n }),\n\n /* W7.3a: Enables anonymous session support for this user type. When true,\n * unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.\n * On login/register for this user type, anonymous resources are transposed to the authenticated user. /\n anonymousSessionsEnabled: z.boolean().optional(),\n\n /* W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. /\n oneOffSessionAllowed: z.boolean().optional(),\n\n /* revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted\n * for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide\n * absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is\n * bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,\n * the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The\n * ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap\n * enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). /\n oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),\n});\nexport type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;\n\n// ─── User Type Definition ───────────────────────────────────────────────────\n\nexport const UserTypeDefinitionSchema = z.object({\n /* REQUIRED — the complete auth policy for this user type. Not an override of global. /\n auth: UserTypeAuthPolicySchema,\n\n /* DEFERRED: Only 'email' supported. Accepts any string; engine warns if !== 'email'. /\n uniqueIdentifier: z.string().default('email'),\n\n defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),\n\n /* D-10: When set, user type auto-revoked when user leaves last org of matching type. /\n requiresOrgMembership: z.object({\n orgTypes: z.array(z.string()).min(1),\n }).optional(),\n});\nexport type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;\n\n// ─── Frontend Service Identity ──────────────────────────────────────────────\n\nexport const FrontendServiceUserManagementEntrySchema = z.object({\n register: z.boolean(),\n auth: z.boolean(),\n isDefault: z.boolean().optional(),\n});\nexport type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;\n\n/\n Backend-runtime view of one frontend service.\n \n Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`\n * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.\n \n - `usersManagement` — auth-policy bindings per user type (legacy field;\n * present since the original auth identity model).\n * - `frontendType` — the runtime kind declared in\n * `wildo.saas.config.ts → services[name].frontendType`. Currently\n * informational on the backend; reserved for `frontendType`-conditioned\n * policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The\n * full taxonomy + the \"no native variants\" decision live in\n * `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT\n * duplicate that explanation here.\n /\nexport const FrontendServiceDefinitionSchema = z.object({\n usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),\n frontendType: z.enum(AppFrontendType).optional(),\n});\nexport type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;\n\n// ─── Organization Type ──────────────────────────────────────────────────────\n\n/\n @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer\n \n An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles\n * exist inside it, whether it can come into existence through sign-up, and how hard it is for its\n * members to prove who they are. Declared as `organizationTypes` in the application configuration.\n \n ## A type only self-creates if it says so\n \n `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a\n * tenant of this type into existence. A type an administrator creates simply omits the policy — and\n * a user type may match AT MOST ONE organization type, which the schema enforces rather than\n * resolving by record order.\n \n `orgNameSource` decides where that tenant's first display name comes from: `ASK` during\n * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who\n * the registrant becomes.\n \n ## `authOverrides` tightens, and can never loosen\n \n A tenant may restrict how its own members authenticate, on four axes and no others — enabled\n * methods, MFA policy, password policy and re-authentication freshness. Session length, lockout and\n * registration are NOT organization-overridable.\n \n Every axis is most-restrictive-wins on top of the user type, so an organization can subtract but\n * never add. Two directions worth stating because they differ: for step-up, `enabled` is an OR\n * (either side turning it on wins) while `maxAgeSeconds` is a MIN (the shorter window wins), and\n * `methods` intersects — an organization can withdraw an acceptable re-authentication method and\n * never introduce one the user type does not already allow.\n \n When a person belongs to SEVERAL organizations the sets intersect across all of them, so belonging\n * to a permissive tenant never restores what a strict one removed.\n \n How a registration-derived organization obtains its initial display name.\n /\nexport enum OrganizationNameSource {\n ASK = 'ask',\n AUTO = 'auto',\n ONBOARDING = 'onboarding',\n}\n\nexport const OrgCreationPolicySchema = z.object({\n createOnUserTypeRegistration: z.array(z.string()).min(1),\n orgNameSource: z.enum(OrganizationNameSource),\n defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),\n});\nexport type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;\n\n/* D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. /\nexport const OrgTypeAuthOverridesSchema = z.object({\n authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),\n mfaPolicy: MfaPolicyConfigSchema.partial().optional(),\n passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),\n /\n Re-authentication freshness, added 2026-09-09 (#527).\n \n The other three overrides and this one answer ONE question — how hard is it for this tenant's\n * members to prove who they are — and until now a tenant could tighten three of them. An\n * organisation that requires MFA and a 16-character password could still have a member mutate a\n * sensitive resource on an eight-hour-old session, because the app-wide default said so.\n \n Most-restrictive-wins like its siblings, but the two fields move in OPPOSITE arithmetic\n * directions and that is worth stating rather than inferring: `enabled` is an OR (either side\n * turning step-up ON wins) while `maxAgeSeconds` is a MIN (the shorter window wins). `methods`\n * intersects, so an organisation can withdraw an acceptable re-authentication method but never\n * introduce one the user type does not already allow.\n /\n stepUpAuth: StepUpAuthConfigSchema.partial().optional(),\n}).optional();\nexport type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;\n\n/* G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). /\nexport const OrgScimProvisioningSchema = z.object({\n enabled: z.boolean().default(false),\n syncFrequencyHours: z.number().min(1).max(720).default(24),\n});\nexport type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;\n\nexport const OrganizationTypeDefinitionSchema = z.object({\n /* D-10: User types auto-granted when joining this org type. /\n userTypes: z.array(z.string()).min(1),\n\n availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n CORE_ORG_ROLES.ORG_MEMBER,\n ]),\n\n /* R-5: Moved from registration.defaultOrgRole. /\n defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),\n\n /* D-15: Most-restrictive-wins on top of user type auth policy. /\n authOverrides: OrgTypeAuthOverridesSchema,\n\n /* G-4: SCIM provisioning toggle per org type. /\n scimProvisioning: OrgScimProvisioningSchema.optional(),\n\n creationPolicy: OrgCreationPolicySchema.optional(),\n});\nexport type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;\n/* @wildo_source:part:end saas.models.config.organization-types /\n\n// ─── Top-Level Config Sections ──────────────────────────────────────────────\n\nexport const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);\nexport type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;\n\nexport const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);\nexport type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;\n\nexport const OrganizationTypesConfigSchema = z\n .record(z.string(), OrganizationTypeDefinitionSchema)\n .superRefine((organizationTypes, ctx) => {\n const ownerByRegisteredUserType = new Map<string, string>();\n for (const [organizationType, definition] of Object.entries(\n organizationTypes,\n )) {\n const registeredUserTypes =\n definition.creationPolicy?.createOnUserTypeRegistration ?? [];\n registeredUserTypes.forEach((userType, index) => {\n const existingOwner = ownerByRegisteredUserType.get(userType);\n if (existingOwner !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: [\n organizationType,\n 'creationPolicy',\n 'createOnUserTypeRegistration',\n index,\n ],\n message:\n `User type '${userType}' already creates organization type `\n + `'${existingOwner}' during registration; one registration `\n + 'cannot implicitly choose between multiple organization types',\n });\n return;\n }\n ownerByRegisteredUserType.set(userType, organizationType);\n });\n }\n });\nexport type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;\n\nexport interface OrganizationTypeRegistrationCreationMatch<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n } = OrganizationTypeDefinition,\n> {\n readonly organizationType: string;\n readonly definition: TDefinition;\n}\n\n/\n Canonical matching rule for registration-derived organization creation.\n \n The schema rejects more than one match for a user type. Returning all\n * matches is intentional defensive behavior for stale/unparsed runtime input:\n * callers can fail closed instead of selecting record insertion order.\n */\nexport function findOrganizationTypeRegistrationCreationMatches<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n },\n>(\n organizationTypes: Readonly<Record<string, TDefinition>> \| undefined,\n registeredUserType: string,\n): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[] {\n if (!organizationTypes) return [];\n return Object.entries(organizationTypes)\n .filter(([, definition]) =>\n definition.creationPolicy?.createOnUserTypeRegistration.includes(\n registeredUserType,\n ),\n )\n .map(([organizationType, definition]) => ({\n organizationType,\n definition,\n }));\n}\n"]}
1	+ {"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,6EAA2C,CAAA;IAC3C,uEAAqC,CAAA;IACrC,2EAAyC,CAAA;IACzC,2DAAyB,CAAA;IACzB,6FAA2D,CAAA;AAC7D,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0EAAiD,CAAA;IACjD,8CAAqB,CAAA;AACvB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACnC;;;;;;;;OAQG;IACH,MAAM,2BAA2B,GAA0B;QACzD,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,OAAO;KACnB,CAAC;IACF,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC1D,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;WACxC,YAAY,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1D,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,4FAA4F;IAC5F,YAAY,EAAE,wBAAwB;IAEtC,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,KAAK;KACrC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C;;;;;;mHAM+G;IAC/G,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,qCAAW,CAAA;IACX,uCAAa,CAAA;IACb,mDAAyB,CAAA;AAC3B,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/D;;;;;;;;;;;;;OAaG;IACH,UAAU,EAAE,sBAAsB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEH,mEAAmE;AAEnE,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC;KACpD,WAAW,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;IACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,iBAAiB,CAClB,EAAE,CAAC;QACF,MAAM,mBAAmB,GACvB,UAAU,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,gBAAgB;wBAChB,gBAAgB;wBAChB,8BAA8B;wBAC9B,KAAK;qBACN;oBACD,OAAO,EACL,cAAc,QAAQ,sCAAsC;0BAC1D,IAAI,aAAa,0CAA0C;0BAC3D,8DAA8D;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAYL;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAK7D,iBAAoE,EACpE,kBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAC9D,kBAAkB,CACnB,CACF;SACA,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC,CAAC;AACR,CAAC","sourcesContent":["/*\n Entity & Identity Configuration Schemas\n \n Top-level config sections: userTypes, frontendServices, organizationTypes.\n * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).\n \n Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.\n * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.\n \n See:\n * - target-configuration-type.md §2b (UserTypeAuthPolicy)\n * - entity-identity-architecture-analysis.md §4.2\n /\n\nimport { z } from 'zod';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { AppFrontendType } from './app-frontend-type.shared.schemas';\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\n/* Canonical registration-policy discriminant. /\nexport enum RegistrationMode {\n OPEN = 'open',\n INVITATION_ONLY = 'invitation_only',\n ADMIN_ONLY = 'admin_only',\n DISABLED = 'disabled',\n}\n\n/\n Semantically distinct ways in which a user can acquire a user type.\n \n Keep these channels separate even when two currently share the same mode matrix: the actor,\n * user intent, and security boundary differ, and future policy can evolve one without silently\n * changing the others.\n /\nexport enum RegistrationAcquisitionChannel {\n PUBLIC_SELF_SERVICE = 'public_self_service',\n SOCIAL_OAUTH_JIT = 'social_oauth_jit',\n ENTERPRISE_SSO_JIT = 'enterprise_sso_jit',\n INVITATION = 'invitation',\n ADMINISTRATIVE_PROVISIONING = 'administrative_provisioning',\n}\n\n/* D-19: Email verification timing. /\nexport enum EmailVerificationMode {\n REQUIRED_BEFORE_ACCESS = 'required_before_access',\n DEFERRED = 'deferred',\n}\n\n/* E-10, D-15: How much orgs can override user-type auth methods. /\nexport enum OrgAuthMethodPolicy {\n RESTRICT_ONLY = 'restrict_only',\n EXPAND_WITHIN_SET = 'expand_within_set',\n UNRESTRICTED = 'unrestricted',\n}\n\n// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────\n\nexport const AuthMethodExpandedConfigSchema = z.object({\n enabled: z.boolean(),\n});\nexport type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;\n\n/\n authMethodsEnabled value: boolean shorthand OR expanded config.\n * Shorthand: PASSWORD: true → normalized at runtime to { enabled: true }.\n /\nconst AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);\n\n// ─── Policy Sub-Types ───────────────────────────────────────────────────────\n\nexport const MfaPolicyConfigSchema = z.object({\n requireMFA: z.boolean().default(false),\n /* D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n /* Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. /\n acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),\n /* D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. /\n enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),\n /* C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. /\n passkeyExemptFromMFA: z.boolean().default(true),\n});\nexport type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;\n\n/\n Registration policy for one user type.\n \n Every user type must author this object explicitly. Acquisition policy is security\n * configuration, so omission must never silently become open registration.\n /\nexport const RegistrationConfigSchema = z.strictObject({\n mode: z.enum(RegistrationMode),\n /\n Only acquisition methods with a complete public-signup implementation are accepted.\n \n PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public\n * registration in #463; before that they were authentication and enrollment methods only, and\n * declaring one here was refused because it would have advertised a path the runtime could not\n * execute.\n \n A password-less signup creates the account with NO credential and proves the address by a magic\n * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —\n * \"access now, verify later\" is not a state the runtime can produce for a registrant who holds\n * nothing. See `registerUser`.\n /\n allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n /* D-19: 'deferred' gives immediate access, verify later. /\n emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),\n /* R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. /\n blockForSSODomains: z.boolean().default(false),\n}).superRefine((registration, ctx) => {\n /\n * The set with a public-signup implementation. It is enumerated rather than open because the\n * failure this refusal prevents is silent: a method listed here is ADVERTISED to a registrant, and\n * one the runtime cannot execute fails after they have committed to it.\n \n MAGIC_LINK and PASSKEY joined in #463. Anything else — SSO, an MFA factor — is an authentication\n * or enrollment method that has no way to CREATE an account from an anonymous caller, and adding it\n * here means building that flow first, not widening this list.\n /\n const publiclyRegisterableMethods: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.EXTERNAL_OAUTH2,\n AuthMethod.MAGIC_LINK,\n AuthMethod.PASSKEY,\n ];\n const unsupportedMethods = registration.allowedMethods.filter(\n (method) => !publiclyRegisterableMethods.includes(method),\n );\n if (unsupportedMethods.length > 0) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,\n });\n }\n if (\n registration.mode === RegistrationMode.OPEN\n && registration.allowedMethods.length === 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: 'Open registration requires at least one supported acquisition method',\n });\n }\n});\nexport type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;\n\n/\n Password policy — includes expiryDays (R-8, moved from flat auth field).\n * Defined here (not in app-configuration-shared) to avoid circular dependency.\n * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.\n /\nexport const PasswordPolicyConfigSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /* R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). /\n expiryDays: z.number().min(0).default(0),\n});\nexport type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;\n\n/* E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. /\nexport const StepUpAuthConfigSchema = z.object({\n enabled: z.boolean().default(false),\n maxAgeSeconds: z.number().min(60).max(3600).default(300),\n methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n});\nexport type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;\n\nexport const LockoutPolicyConfigSchema = z.object({\n maxLoginAttempts: z.number().min(3).max(20).default(5),\n lockoutDurationMinutes: z.number().min(1).max(1440).default(30),\n /* W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. /\n progressiveLockout: z.boolean().default(false),\n /* W2.3: cap for progressive lockout duration in hours. /\n maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),\n});\nexport type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;\n\nexport const MethodManagementConfigSchema = z.object({\n allowUserMethodRemoval: z.boolean().default(true),\n requireReauthForMethodChanges: z.boolean().default(false),\n});\nexport type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;\n\n// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────\n\n/\n The complete auth policy for a user type. Every user type MUST define this.\n * There are no global auth defaults — this IS the auth config.\n \n Zod .default() values enable omission in config input files, but the\n * resolved runtime type has all fields present (no optionals for policy fields).\n \n See target-configuration-type.md §2b for full specification.\n /\nexport const UserTypeAuthPolicySchema = z.object({\n /* E-1, D-20: Opt-in semantics — absent method = disabled. /\n authMethodsEnabled: z.partialRecord(\n z.enum(AuthMethod),\n AuthMethodValueSchema,\n ).default({ [AuthMethod.PASSWORD]: true }),\n\n /* E-2: MFA enforcement for this user type. /\n mfaPolicy: MfaPolicyConfigSchema.default({\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n }),\n\n /* E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. /\n registration: RegistrationConfigSchema,\n\n /* E-7, R-8: Password strength + expiry. /\n passwordPolicy: PasswordPolicyConfigSchema.default({\n minLength: 8,\n maxLength: 128,\n requireUppercase: true,\n requireLowercase: true,\n requireNumbers: true,\n requireSpecialChars: false,\n expiryDays: 0,\n }),\n\n /* E-8: Session duration for this user type. /\n sessionDurationMinutes: z.number().min(1).max(1440).default(30),\n\n /\n E-8, G-2: the cap on simultaneous refresh chains for this user type.\n \n Leaving it undefined does NOT mean unlimited. The token issuer falls back to\n * `DEFAULT_MAX_CONCURRENT_SESSIONS` (10) and evicts the oldest chain beyond it, so a user type\n * that declares nothing is still capped. There is no value that disables the cap; declare the\n * number you want.\n /\n maxConcurrentSessions: z.number().min(1).optional(),\n\n /* G-1: Per-user-type lockout. Backend-only. /\n lockoutPolicy: LockoutPolicyConfigSchema.default({\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n }),\n\n /* G-8: Consumer=true (convenience), Admin=false (security). /\n autoLinkByEmail: z.boolean().default(true),\n\n /* E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). /\n stepUpAuth: StepUpAuthConfigSchema.optional(),\n\n methodManagement: MethodManagementConfigSchema.default({\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: false,\n }),\n\n /* W7.3a: Enables anonymous session support for this user type. When true,\n * unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.\n * On login/register for this user type, anonymous resources are transposed to the authenticated user. /\n anonymousSessionsEnabled: z.boolean().optional(),\n\n /* W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. /\n oneOffSessionAllowed: z.boolean().optional(),\n\n /* revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted\n * for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide\n * absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is\n * bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,\n * the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The\n * ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap\n * enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). /\n oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),\n});\nexport type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;\n\n// ─── User Type Definition ───────────────────────────────────────────────────\n\nexport const UserTypeDefinitionSchema = z.object({\n /* REQUIRED — the complete auth policy for this user type. Not an override of global. /\n auth: UserTypeAuthPolicySchema,\n\n /* DEFERRED: Only 'email' supported. Accepts any string; engine warns if !== 'email'. /\n uniqueIdentifier: z.string().default('email'),\n\n defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),\n\n /* D-10: When set, user type auto-revoked when user leaves last org of matching type. /\n requiresOrgMembership: z.object({\n orgTypes: z.array(z.string()).min(1),\n }).optional(),\n});\nexport type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;\n\n// ─── Frontend Service Identity ──────────────────────────────────────────────\n\nexport const FrontendServiceUserManagementEntrySchema = z.object({\n register: z.boolean(),\n auth: z.boolean(),\n isDefault: z.boolean().optional(),\n});\nexport type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;\n\n/\n Backend-runtime view of one frontend service.\n \n Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`\n * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.\n \n - `usersManagement` — auth-policy bindings per user type (legacy field;\n * present since the original auth identity model).\n * - `frontendType` — the runtime kind declared in\n * `wildo.saas.config.ts → services[name].frontendType`. Currently\n * informational on the backend; reserved for `frontendType`-conditioned\n * policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The\n * full taxonomy + the \"no native variants\" decision live in\n * `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT\n * duplicate that explanation here.\n /\nexport const FrontendServiceDefinitionSchema = z.object({\n usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),\n frontendType: z.enum(AppFrontendType).optional(),\n});\nexport type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;\n\n// ─── Organization Type ──────────────────────────────────────────────────────\n\n/\n @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer\n \n An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles\n * exist inside it, whether it can come into existence through sign-up, and how hard it is for its\n * members to prove who they are. Declared as `organizationTypes` in the application configuration.\n \n ## A type only self-creates if it says so\n \n `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a\n * tenant of this type into existence. A type an administrator creates simply omits the policy — and\n * a user type may match AT MOST ONE organization type, which the schema enforces rather than\n * resolving by record order.\n \n `orgNameSource` decides where that tenant's first display name comes from: `ASK` during\n * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who\n * the registrant becomes.\n \n ## `authOverrides` tightens, and can never loosen\n \n A tenant may restrict how its own members authenticate, on four axes and no others — enabled\n * methods, MFA policy, password policy and re-authentication freshness. Session length, lockout and\n * registration are NOT organization-overridable.\n \n Every axis is most-restrictive-wins on top of the user type, so an organization can subtract but\n * never add. Two directions worth stating because they differ: for step-up, `enabled` is an OR\n * (either side turning it on wins) while `maxAgeSeconds` is a MIN (the shorter window wins), and\n * `methods` intersects — an organization can withdraw an acceptable re-authentication method and\n * never introduce one the user type does not already allow.\n \n When a person belongs to SEVERAL organizations the sets intersect across all of them, so belonging\n * to a permissive tenant never restores what a strict one removed.\n \n How a registration-derived organization obtains its initial display name.\n /\nexport enum OrganizationNameSource {\n ASK = 'ask',\n AUTO = 'auto',\n ONBOARDING = 'onboarding',\n}\n\nexport const OrgCreationPolicySchema = z.object({\n createOnUserTypeRegistration: z.array(z.string()).min(1),\n orgNameSource: z.enum(OrganizationNameSource),\n defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),\n});\nexport type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;\n\n/* D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. /\nexport const OrgTypeAuthOverridesSchema = z.object({\n authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),\n mfaPolicy: MfaPolicyConfigSchema.partial().optional(),\n passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),\n /\n Re-authentication freshness, added 2026-09-09 (#527).\n \n The other three overrides and this one answer ONE question — how hard is it for this tenant's\n * members to prove who they are — and until now a tenant could tighten three of them. An\n * organisation that requires MFA and a 16-character password could still have a member mutate a\n * sensitive resource on an eight-hour-old session, because the app-wide default said so.\n \n Most-restrictive-wins like its siblings, but the two fields move in OPPOSITE arithmetic\n * directions and that is worth stating rather than inferring: `enabled` is an OR (either side\n * turning step-up ON wins) while `maxAgeSeconds` is a MIN (the shorter window wins). `methods`\n * intersects, so an organisation can withdraw an acceptable re-authentication method but never\n * introduce one the user type does not already allow.\n /\n stepUpAuth: StepUpAuthConfigSchema.partial().optional(),\n}).optional();\nexport type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;\n\n/* G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). /\nexport const OrgScimProvisioningSchema = z.object({\n enabled: z.boolean().default(false),\n syncFrequencyHours: z.number().min(1).max(720).default(24),\n});\nexport type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;\n\nexport const OrganizationTypeDefinitionSchema = z.object({\n /* D-10: User types auto-granted when joining this org type. /\n userTypes: z.array(z.string()).min(1),\n\n availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n CORE_ORG_ROLES.ORG_MEMBER,\n ]),\n\n /* R-5: Moved from registration.defaultOrgRole. /\n defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),\n\n /* D-15: Most-restrictive-wins on top of user type auth policy. /\n authOverrides: OrgTypeAuthOverridesSchema,\n\n /* G-4: SCIM provisioning toggle per org type. /\n scimProvisioning: OrgScimProvisioningSchema.optional(),\n\n creationPolicy: OrgCreationPolicySchema.optional(),\n});\nexport type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;\n/* @wildo_source:part:end saas.models.config.organization-types /\n\n// ─── Top-Level Config Sections ──────────────────────────────────────────────\n\nexport const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);\nexport type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;\n\nexport const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);\nexport type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;\n\nexport const OrganizationTypesConfigSchema = z\n .record(z.string(), OrganizationTypeDefinitionSchema)\n .superRefine((organizationTypes, ctx) => {\n const ownerByRegisteredUserType = new Map<string, string>();\n for (const [organizationType, definition] of Object.entries(\n organizationTypes,\n )) {\n const registeredUserTypes =\n definition.creationPolicy?.createOnUserTypeRegistration ?? [];\n registeredUserTypes.forEach((userType, index) => {\n const existingOwner = ownerByRegisteredUserType.get(userType);\n if (existingOwner !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: [\n organizationType,\n 'creationPolicy',\n 'createOnUserTypeRegistration',\n index,\n ],\n message:\n `User type '${userType}' already creates organization type `\n + `'${existingOwner}' during registration; one registration `\n + 'cannot implicitly choose between multiple organization types',\n });\n return;\n }\n ownerByRegisteredUserType.set(userType, organizationType);\n });\n }\n });\nexport type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;\n\nexport interface OrganizationTypeRegistrationCreationMatch<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n } = OrganizationTypeDefinition,\n> {\n readonly organizationType: string;\n readonly definition: TDefinition;\n}\n\n/\n Canonical matching rule for registration-derived organization creation.\n \n The schema rejects more than one match for a user type. Returning all\n * matches is intentional defensive behavior for stale/unparsed runtime input:\n * callers can fail closed instead of selecting record insertion order.\n */\nexport function findOrganizationTypeRegistrationCreationMatches<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n },\n>(\n organizationTypes: Readonly<Record<string, TDefinition>> \| undefined,\n registeredUserType: string,\n): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[] {\n if (!organizationTypes) return [];\n return Object.entries(organizationTypes)\n .filter(([, definition]) =>\n definition.creationPolicy?.createOnUserTypeRegistration.includes(\n registeredUserType,\n ),\n )\n .map(([organizationType, definition]) => ({\n organizationType,\n definition,\n }));\n}\n"]}

package/dist/esm/config/frontend/chart-definition.shared.schemas.d.ts CHANGED Viewed

@@ -61,11 +61,11 @@ export declare const ChartSeriesStyleSchema: z.ZodObject<{
     }>>;
     showLabel: z.ZodOptional<z.ZodBoolean>;
     labelPosition: z.ZodOptional<z.ZodEnum<{
+        center: "center";
         left: "left";
         right: "right";
         top: "top";
         bottom: "bottom";
-        center: "center";
         inside: "inside";
         outside: "outside";
     }>>;
@@ -143,11 +143,11 @@ export declare const ChartSeriesDefinitionSchema: z.ZodObject<{
         }>>;
         showLabel: z.ZodOptional<z.ZodBoolean>;
         labelPosition: z.ZodOptional<z.ZodEnum<{
+            center: "center";
             left: "left";
             right: "right";
             top: "top";
             bottom: "bottom";
-            center: "center";
             inside: "inside";
             outside: "outside";
         }>>;
@@ -227,11 +227,11 @@ export declare const ChartSeriesSchema: z.ZodObject<{
         }>>;
         showLabel: z.ZodOptional<z.ZodBoolean>;
         labelPosition: z.ZodOptional<z.ZodEnum<{
+            center: "center";
             left: "left";
             right: "right";
             top: "top";
             bottom: "bottom";
-            center: "center";
             inside: "inside";
             outside: "outside";
         }>>;
@@ -375,10 +375,10 @@ export declare const ChartAppearanceSchema: z.ZodObject<{
         left: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
         top: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
         textAlign: z.ZodOptional<z.ZodEnum<{
+            center: "center";
             auto: "auto";
             left: "left";
             right: "right";
-            center: "center";
         }>>;
     }, z.core.$strip>>;
     animationDuration: z.ZodOptional<z.ZodNumber>;
@@ -556,9 +556,9 @@ export declare const ChartTypeConfig_FunnelSchema: z.ZodObject<{
         rightTop: "rightTop";
     }>>;
     funnelAlign: z.ZodOptional<z.ZodEnum<{
+        center: "center";
         left: "left";
         right: "right";
-        center: "center";
     }>>;
     showLabel: z.ZodOptional<z.ZodBoolean>;
     left: z.ZodOptional<z.ZodString>;
@@ -653,9 +653,9 @@ export declare const ChartTypeConfig_HierarchicalSchema: z.ZodObject<{
             radial: "radial";
         }>>;
         level2LabelAlign: z.ZodOptional<z.ZodEnum<{
+            center: "center";
             left: "left";
             right: "right";
-            center: "center";
         }>>;
         level3LabelPosition: z.ZodOptional<z.ZodEnum<{
             inside: "inside";
@@ -777,9 +777,9 @@ export declare const ChartTypeConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
         rightTop: "rightTop";
     }>>;
     funnelAlign: z.ZodOptional<z.ZodEnum<{
+        center: "center";
         left: "left";
         right: "right";
-        center: "center";
     }>>;
     showLabel: z.ZodOptional<z.ZodBoolean>;
     left: z.ZodOptional<z.ZodString>;
@@ -859,9 +859,9 @@ export declare const ChartTypeConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
             radial: "radial";
         }>>;
         level2LabelAlign: z.ZodOptional<z.ZodEnum<{
+            center: "center";
             left: "left";
             right: "right";
-            center: "center";
         }>>;
         level3LabelPosition: z.ZodOptional<z.ZodEnum<{
             inside: "inside";
@@ -984,9 +984,9 @@ export declare const ChartViewOptionsSchema: z.ZodObject<{
             rightTop: "rightTop";
         }>>;
         funnelAlign: z.ZodOptional<z.ZodEnum<{
+            center: "center";
             left: "left";
             right: "right";
-            center: "center";
         }>>;
         showLabel: z.ZodOptional<z.ZodBoolean>;
         left: z.ZodOptional<z.ZodString>;
@@ -1066,9 +1066,9 @@ export declare const ChartViewOptionsSchema: z.ZodObject<{
                 radial: "radial";
             }>>;
             level2LabelAlign: z.ZodOptional<z.ZodEnum<{
+                center: "center";
                 left: "left";
                 right: "right";
-                center: "center";
             }>>;
             level3LabelPosition: z.ZodOptional<z.ZodEnum<{
                 inside: "inside";
@@ -1199,11 +1199,11 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
             }>>;
             showLabel: z.ZodOptional<z.ZodBoolean>;
             labelPosition: z.ZodOptional<z.ZodEnum<{
+                center: "center";
                 left: "left";
                 right: "right";
                 top: "top";
                 bottom: "bottom";
-                center: "center";
                 inside: "inside";
                 outside: "outside";
             }>>;
@@ -1306,10 +1306,10 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
             left: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
             top: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
             textAlign: z.ZodOptional<z.ZodEnum<{
+                center: "center";
                 auto: "auto";
                 left: "left";
                 right: "right";
-                center: "center";
             }>>;
         }, z.core.$strip>>;
         animationDuration: z.ZodOptional<z.ZodNumber>;
@@ -1470,9 +1470,9 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
             rightTop: "rightTop";
         }>>;
         funnelAlign: z.ZodOptional<z.ZodEnum<{
+            center: "center";
             left: "left";
             right: "right";
-            center: "center";
         }>>;
         showLabel: z.ZodOptional<z.ZodBoolean>;
         left: z.ZodOptional<z.ZodString>;
@@ -1552,9 +1552,9 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
                 radial: "radial";
             }>>;
             level2LabelAlign: z.ZodOptional<z.ZodEnum<{
+                center: "center";
                 left: "left";
                 right: "right";
-                center: "center";
             }>>;
             level3LabelPosition: z.ZodOptional<z.ZodEnum<{
                 inside: "inside";