@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/config/app-configuration-shared.shared.schemas.js

@@ -11,14 +11,24 @@
  */
 import { AvailableLanguage } from '@wildo-ai/presets-components-models';
 import { z } from 'zod';
+// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —
+// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.
+import '@wildo-ai/zod-decorators';
 import { AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas.js';
 import { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas.js';
 import { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas.js';
-import { ClientInstanceIdScope, DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas.js';
+import { ClientInstanceIdScope, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas.js';
+import { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared.js';
+import { ServiceConsentRequirementSchema } from '../compliance/privacy/operator-compliance-identity.shared.schemas.js';
 import { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas.js';
 import { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas.js';
 import { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas.js';
+import { ReviewCalendarSchema } from '../flows-actors/review-deadlines.shared.schemas.js';
+import { GovernedDocumentApprovalGate, GovernedDocumentInteractionSurfaceSchema } from '../compliance/documents/governed-document-interactions.shared.schemas.js';
+import { GovernedDocumentAcceptanceMode, GovernedDocumentPublicDocumentSchema } from '../compliance/documents/governed-documents.shared.schemas.js';
 import { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas.js';
+import { ApplicationRetentionScheduleSchema } from '../compliance/privacy/retention-schedule.shared.schemas.js';
+import { SubjectDataRecipientsDeclarationSchema } from '../compliance/privacy/subject-data-recipients.shared.schemas.js';
 import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
 import { ValueMomentSchema } from './analytics-value-moments.shared.schemas.js';
 import { UserTypesConfigSchema, FrontendServicesConfigSchema, OrganizationTypesConfigSchema, OrgAuthMethodPolicy, } from './entity-identity-config.shared.schemas.js';
@@ -34,11 +44,26 @@ import { UserTypesConfigSchema, FrontendServicesConfigSchema, OrganizationTypesC
  * - Password policy indicator in reset/registration forms
  */
 export const PasswordPolicyRulesSchema = z.object({
-    minLength: z.number().min(6).max(128).default(8),
+    /**
+     * The shortest password an application may REQUIRE, and the shortest it may ACCEPT.
+     *
+     * The floor is 8, not 6, because the standard states it as an obligation on the verifier:
+     * "Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length."
+     * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).
+     * A schema that admitted 6 let an application declare a policy the standard forbids — quietly,
+     * since nothing downstream re-checked the declared value.
+     *
+     * The DEFAULT is 15 because the same section continues: "Verifiers and CSPs SHOULD require
+     * passwords to be a minimum of 15 characters in length."
+     * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).
+     * A framework's default is the answer every application that expresses no opinion receives, so it
+     * takes the SHOULD; the floor only has to stop an application going below the SHALL.
+     */
+    minLength: z.number().min(8).max(128).default(15),
     maxLength: z.number().min(8).max(256).default(128),
-    requireUppercase: z.boolean().default(true),
-    requireLowercase: z.boolean().default(true),
-    requireNumbers: z.boolean().default(true),
+    requireUppercase: z.boolean().default(false),
+    requireLowercase: z.boolean().default(false),
+    requireNumbers: z.boolean().default(false),
     requireSpecialChars: z.boolean().default(false),
     /**
      * R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),
@@ -62,6 +87,13 @@ export const PasswordPolicyViolationCode = {
     LOWERCASE: 'policyLowercase',
     NUMBER: 'policyNumber',
     SPECIAL_CHAR: 'policySpecialChar',
+    /**
+     * The password is a known common guess, the application's own name, or the user's own email local
+     * part. The check that NIST SP 800-63B-4 §3.1.1.2 asks for in place of the composition rules above
+     * — which the same section forbids, and which is why `UPPERCASE`, `LOWERCASE`, `NUMBER` and
+     * `SPECIAL_CHAR` now default to unenforced while this one always runs.
+     */
+    BLOCKLISTED: 'policyBlocklisted',
 };
 /**
  * Global Auth Config — infrastructure + app-level only.
@@ -99,7 +131,20 @@ export const AppConfiguration_Shared_AuthSchema = z.object({
     /** E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. */
     expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),
     /** E-4, D-2: Can a user authenticated via Org A SSO access Org B? */
-    crossOrgSSOAccess: z.boolean().default(true),
+    /**
+     * May a user who authenticated through ONE organization's identity provider reach ANOTHER
+     * organization through SSO?
+     *
+     * Defaults to `false` (#1223). It defaulted to `true`, and both readers tested for an explicit
+     * `false`, so an application silently permitted cross-tenant SSO reach unless it knew to write the
+     * flag — a tenancy boundary decided by an omission. Neither dogfood application wrote it.
+     *
+     * `false` is the fail-closed answer and the one a multi-tenant application almost always wants: an
+     * identity proven to Acme's provider says nothing about whether that person belongs at Globex. An
+     * application that genuinely wants the reach — a group of organizations sharing one directory —
+     * writes `true`, which is a statement a reviewer can find.
+     */
+    crossOrgSSOAccess: z.boolean().default(false),
     // W6.8: All per-user-type auth policy fields REMOVED.
     // Use userTypes[t].auth.* instead (see entity-identity-config.shared.schemas.ts).
     // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).
@@ -121,6 +166,202 @@ export const AppConfiguration_Shared_ComplianceSchema = z.object({
      * obligations attached to each non-`DISABLED` member.
      */
     clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),
+    /**
+     * The governed-document releases in force for this application — **empty unless authored**.
+     *
+     * ## What this closes
+     *
+     * The compliance lane could COMPOSE a release (`composeGovernedDocumentRelease`) and had nowhere
+     * to put it that the running application could see. Measured 2026-09-12: no package in either
+     * example app depends on its own `specifications` package, whose only exports are `.` and
+     * `./companion` — so a composed release reached the companion and the repository and never the
+     * runtime. Issue #54 asks for a record of which terms release a user accepted; nothing could
+     * resolve which release that was.
+     *
+     * ## Why HERE, on the shared payload
+     *
+     * The same reason as {@link ClientInstanceIdScope} above: both halves of the mechanism must obey
+     * ONE authored value. The frontend decides whether to render a consent control and what it is
+     * consenting to; the backend independently decides what may be recorded and composes the record.
+     * Two gates, one source.
+     *
+     * ## Why the SURFACE and not the release
+     *
+     * This payload reaches an unauthenticated browser. A full release additionally carries
+     * `governanceScope` and `approvalDecisions` — internal custody detail
+     * `projectGovernedDocumentPublicRelease` already withholds from public consumers. It happens that
+     * `composeGovernedDocumentInteraction` reads neither, so the browser-safe slice is exactly the
+     * slice the mechanism needs; see {@link GovernedDocumentInteractionSurfaceSchema}. Author it with
+     * `projectGovernedDocumentInteractionSurface(release)` so the release file stays the one source.
+     *
+     * `.default([])` rather than required, and that is not politeness: this schema parses a PERSISTED
+     * application-config document, and a required field would refuse every document written before
+     * today — the 2026-08-27 failure recorded in `staleness-presents-as-a-logic-defect.md`.
+     */
+    governedDocumentReleases: z.array(GovernedDocumentInteractionSurfaceSchema).default([]),
+    /**
+     * The governed documents this application SERVES as public pages — `/privacy`, `/terms`. Issue #168.
+     * Each entry is either a RELEASED document (a recorded release's public projection, carrying the text
+     * it was recorded with) or, for a public document that has never been released, its latest
+     * UNRELEASED_DRAFT, which the page marks as a draft. Issue #968.
+     *
+     * ## Why this is separate from `governedDocumentReleases`
+     *
+     * They answer different questions about the same underlying release, and the schemas already say
+     * so: the interaction surface is what a CONSENT control needs (`approvalState`, plus
+     * `allowedInteractionKinds` for what MAY be accepted), while a public page needs to ROUTE and
+     * DISPLAY (title, sections, clauses, effective date, version) AND, since #1258 Step 5, know
+     * whether it may record a `NOTICE_DELIVERED` for the release it is showing — which is what
+     * `allowedInteractionKinds` also answers here, for a different verb. Merging the two payloads
+     * would put document PROSE into the payload every registration form receives, which is what this
+     * split exists to prevent; a field two surfaces both need for their own reasons is not that,
+     * and it appears on each projection on its own terms rather than one borrowing the other's copy.
+     * Neither is typed by hand: `wildo config document-releases` writes both into the application's
+     * `governed-document-releases.generated.ts` from its recorded releases (and, for this one, its
+     * landed drafts), so the release stays the one source.
+     *
+     * ## Why the prose is safe to put in an unauthenticated payload
+     *
+     * Because it is what the page exists to show. Both halves are the deliberately-narrow public
+     * projections — `governanceScope` and `approvalDecisions` never appear, and `bodyMarkdown` is
+     * rendered as TEXT, never as raw HTML. The surface carries no internal custody detail at all.
+     *
+     * `.default([])` for the same reason as its neighbour: this parses a PERSISTED configuration
+     * document, and a required field would refuse every document written before today.
+     */
+    publicDocuments: z.array(GovernedDocumentPublicDocumentSchema).default([]),
+    /**
+     * How the registration form asks a person to accept the documents above (#1258).
+     *
+     * See {@link GovernedDocumentAcceptanceMode} for what each member changes and the enforceability
+     * position it takes. It is read by `Auth_Register`, which is why it is on the SHARED payload: the
+     * decision is the application's and the form is the only thing that can carry it out.
+     *
+     * ## Why it defaults to the STRONGEST shape rather than the one this rule's prose leads with
+     *
+     * `EXPLICIT_CHECKBOX` is what registration already did before this field existed, and a default is
+     * what every application that declares nothing receives — so any other default would silently move
+     * shipped applications to a weaker acceptance posture on an engine upgrade, without anyone deciding
+     * to. An operator who wants the lighter "by registering you agree" shape says so, once, here.
+     *
+     * ## Why it is declared rather than derived
+     *
+     * `derive-before-you-ask.md` asks what already decides this, and nothing does: the release declares
+     * WHAT may be accepted (`allowedInteractionKinds`) and the public document declares what it SAYS,
+     * but neither carries how hard the operator wants to be asked. It is a liability posture — the one
+     * class `settled-questions-are-not-decisions.md` keeps with the operator — so it is a typed,
+     * committed, diffable declaration rather than a question or a guess.
+     *
+     * `.default(...)` rather than optional or required, for the reason its two neighbours give: this
+     * schema parses a PERSISTED application-config document, and a required field would refuse every
+     * document written before today.
+     */
+    governedDocumentAcceptanceMode: z.enum(GovernedDocumentAcceptanceMode).default(GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX),
+    /**
+     * Whether this application shows, and asks people to accept, governed documents nobody has
+     * approved (#1565). See {@link GovernedDocumentApprovalGate} for what each member changes.
+     *
+     * ONE member rather than an option on each surface, because the public page and the acceptance
+     * surfaces must never be armed separately: armed on the page alone, `/terms` answers "unavailable"
+     * while sign-up asks people to accept those same terms. Every surface reads it through
+     * `requiresApprovedGovernedDocuments`.
+     *
+     * Defaults to UNARMED, the posture while an application is being built
+     * (`.claude/rules/one-source-of-truth.md` D5). Arming it is part of Gate 3's membership test.
+     *
+     * `.default(...)` for the reason its neighbours give: this schema parses a PERSISTED
+     * application-config document, and a required field would refuse every document written before
+     * today.
+     */
+    governedDocumentApprovalGate: z.enum(GovernedDocumentApprovalGate).default(GovernedDocumentApprovalGate.UNARMED),
+    /**
+     * The purposes a signed-in person must grant before the application renders any of its routes —
+     * the RUNTIME half of `operatorComplianceIdentity.serviceConsentRequirement` (#453).
+     *
+     * Declared once, in `wildo.saas.config.ts`, and projected here by `wildo config service-consent`
+     * into `backend-api/src/service-consent-requirement.generated.ts`, which `saas-config.backend.ts`
+     * composes — the `governedDocumentReleases` precedent, so there is never a second hand-copied source.
+     *
+     * Enforced on BOTH tiers. The backend refuses every user-initiated operation except the person's own
+     * context and preferences until every required purpose is granted — one gate,
+     * `AuthorizationsBackendService.assertServiceConsentRequirementMet`, reached from each entry point a person
+     * can initiate work through: `authorizeInController` (REST, MCP tools, queued operations, WebSocket rows,
+     * agent tool calls), `authorizeInProgrammaticSurface` (retrieval), `authorizeOperationRolesOnly` (WebSocket
+     * scope subscriptions), the manual-controller context (charts, analytics, features, flows-actors, provider
+     * operations and connections), the WebSocket badge reads, the A2A task reads (`tasks/get`, `ListTasks`,
+     * `tasks/resubscribe`, `tasks/pushNotificationConfig/*`), and every A2A or WebSocket conversational turn,
+     * started or resumed after an approval. Authentication endpoints are not resource operations and stay open,
+     * as does cancelling an A2A task the person already started; updates the server pushes on its own are not
+     * held back. `AppLayout_AuthenticatedRoute` shows the consent gate where the
+     * person grants them. On the SHARED config because the frontend reads it. It carries no personal data and no
+     * lawful-basis detail, so it is safe in the payload every signed-in browser receives.
+     *
+     * OPTIONAL, and absent means the application declared nothing — nothing is gated. That is the same
+     * observable behaviour as a declared empty set, and deliberately so: a runtime must never block a
+     * person on a requirement nobody stated. The DISTINCTION between the two lives where it matters, in
+     * the declaration and the documents composed from it.
+     */
+    serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),
+    /**
+     * Every purpose declared by at least one resource operation's `consentGate` (#1462, following
+     * #1258 Step 3), so the application-tier consent-gate PROMPT can offer to grant it.
+     *
+     * DERIVED, never authored — this is not a declaration site. A resource operation declares
+     * `consentGate: { purpose, refusal?, timing? }` in its OWN `*.resources-config.ts`
+     * (`ResourceOperationConsentGateDeclaration`), which is where the decision belongs: a capability's
+     * consent posture is expressed beside the capability, not restated a second time here for the
+     * frontend to read. This field is the engine scanning every resource's every operation once, at
+     * boot, and recording the SET of purposes at least one of them named — `wildo config`-generated
+     * fields read `wildo.saas.config.ts`, which does not see per-operation declarations scattered
+     * across the app, so that pattern does not fit here; this is populated by
+     * `ResourcesRegistryBackendService.initialize()` calling back into `AppConfigurationService` the
+     * moment the registry — and therefore every operation's declared purpose — is fully built.
+     *
+     * `applicationAskedConsentPurposes` unions this with `requiredPurposes` and the analytics purpose
+     * to decide `optionalPurposes` on `ConsentGateState` — the same generic PROMPT that already offers
+     * ANALYTICS, now also offering whatever a capability declared. It does not distinguish `timing`
+     * (`ON_USE` / `FIRST_SESSION` / …): no per-capability or per-session prompt surface exists yet to
+     * honour those distinctly, so every declared purpose is offered by the one surface that does exist,
+     * which is strictly better than the alternative — refusing a capability with no way at all to grant
+     * what it asks for.
+     *
+     * OPTIONAL and defaults to the empty array on any config resolved before this field existed, which
+     * is the same observable behaviour as declaring no `consentGate` anywhere (R12).
+     */
+    capabilityDeclaredConsentPurposes: z.enum(ConsentPurpose).array().default([]),
+    /**
+     * The application's declared retention schedule — the RUNTIME half of `dataRetention` in
+     * `wildo.saas.config.ts` (#1613).
+     *
+     * Declared once, in `wildo.saas.config.ts`, and projected here by `wildo config data-retention` into
+     * `backend-api/src/data-retention.generated.ts`, which `saas-config.backend.ts` composes — the
+     * `serviceConsentRequirement` precedent, so the period a privacy notice states and the period the
+     * retention sweep enforces are one value, never a hand-copied pair.
+     *
+     * Read at every sweep run, never cached per row, so a period change applies on the next run with no
+     * backfill. It also single-sources two older horizons: `auditTrail.archiveAfterDays` derives from
+     * `AUDIT_LOGS` and `tenantTeardown.retentionWindowDays` from `RESOURCE_DATA` when unset, and startup
+     * refuses a value that disagrees with the schedule.
+     *
+     * OPTIONAL and partial exactly like the declaration: an absent class is UNDECIDED, and the sweep
+     * deletes nothing for a resource bound to an undeclared class. On the shared config because a period
+     * is what the application already publishes in its privacy notice; it carries no personal data.
+     */
+    dataRetention: ApplicationRetentionScheduleSchema.optional(),
+    /**
+     * Who else holds a data subject's personal data — every recipient the application's declared flows reach, with the
+     * legal identity its processor register adopted, the categories each flow carries and the erasure stance (#1710).
+     *
+     * DERIVED, never authored: `wildo config subject-data-recipients` runs the one design-time derivation and writes
+     * `backend-api/src/subject-data-recipients.generated.ts`, which `saas-config.backend.ts` composes here — the
+     * `dataRetention` precedent. A subject export lists these recipients (Art. 15(1)(c)); a subject erasure reports an
+     * outcome for each (Art. 19). See `subject-data-recipients.shared.schemas.ts`.
+     *
+     * OPTIONAL, and absent is NOT DECLARED rather than "no recipient": an export says so, and an erasure carries one
+     * UNMEASURED outcome naming it. On the shared config because it states what the privacy notice already publishes
+     * — vendor identities and categories, never a person's data.
+     */
+    subjectDataRecipients: SubjectDataRecipientsDeclarationSchema.optional(),
 });
 export const AppConfiguration_Shared_AppIdentity_Schema = z.object({
     /** Technical app name — used as fallback when displayName is absent */
@@ -212,8 +453,18 @@ export const AnalyticsConfigSchema = z.object({
     enabled: z.boolean().default(false),
     /** Registered analytics providers */
     providers: z.array(AnalyticsProviderConfigSchema).default([]),
-    /** Minimum consent level required for analytics (defaults to ANALYTICS) */
-    requiredConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.ANALYTICS),
+    /**
+     * Whether analytics rests on the person's consent to `ConsentPurpose.ANALYTICS` (default `true`).
+     *
+     * A boolean rather than a purpose, because analytics has exactly one purpose by definition. `false`
+     * is a claim that analytics here is not consent-based — anonymised measurement under a documented
+     * legitimate interest — and the lawful basis for that belongs in `operatorComplianceIdentity`.
+     *
+     * Replaces `requiredConsent: DataProcessingConsent`, a minimum LEVEL on an ordered scale that
+     * implied a person who agreed to marketing had agreed to analytics (#534). `requiredConsent: NONE`
+     * is `requiresConsent: false`; every other value is `true`.
+     */
+    requiresConsent: z.boolean().default(true),
     /**
      * SINGLE DECLARATION SURFACE for all value moments.
      * TTFV, aha moments, activation stages, and anti-patterns are all here,
@@ -282,8 +533,32 @@ export const AppConfiguration_Shared_Schema = z.object({
     userTypes: UserTypesConfigSchema,
     /** Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. */
     frontendServices: FrontendServicesConfigSchema,
-    /** Org typing. Optional — only for apps with typed organizations. */
+    /**
+     * Org typing. MANDATORY for a running application, optional in this schema (#1032, 2026-09-14).
+     *
+     * Every organization carries a type naming an entry here, and a member of an organization whose type
+     * resolves to nothing cannot sign in, so an application with none is refused at startup. The schema
+     * stays optional because it also parses configuration that predates the field, and the door that
+     * writes the field has to be able to read that configuration first. It used to say "only for apps with
+     * typed organizations"; every application has organizations.
+     */
     organizationTypes: OrganizationTypesConfigSchema.optional(),
+    /**
+     * The organization role table's keys a membership may hold (#1921): the core organization roles plus the
+     * application's custom organization roles, as the running backend's authorization service holds them, less the roles
+     * no membership may hold: the handler-only roles (`INBOUND_HANDLER_ONLY_ROLES`) and the delegated capability roles a
+     * live grant alone confers (`DELEGATED_CAPABILITY_ROLES`). What a role picker
+     * (`StringEditMode.ORGANIZATION_ROLE`) offers; each role's words come from the `roles` label tree.
+     *
+     * RUNTIME-DERIVED, like `appIdentity.applicationId`: an application does not author it here — it declares custom
+     * roles in its shared modules, and the backend publishes the merged table on `/application-config`. Custom roles are
+     * application-wide, so every organization of the application has the same table.
+     *
+     * Safe to publish: role KEYS are vocabulary, not authority — the same keys already ship in the public `roles` label
+     * bundle, and holding a role is decided server-side against the membership, never against knowing its name.
+     * OPTIONAL so a backend that predates it keeps loading; a picker without it degrades to a text input.
+     */
+    organizationRoles: z.array(z.string().min(1)).optional(),
     compliance: AppConfiguration_Shared_ComplianceSchema,
     // Billing Configuration (optional: billing disabled by default)
     billing: BillingConfigurationSchema.optional(),
@@ -297,6 +572,11 @@ export const AppConfiguration_Shared_Schema = z.object({
     // See TenantTeardownConfigSchema for why this is NOT folded into `lifecycle` (which is the USER
     // lifecycle and is disabled by default).
     tenantTeardown: TenantTeardownConfigSchema.optional(),
+    // Review calendar (#1628, optional): the application's business hours and holidays, in one time zone.
+    // Read only by pending human decisions whose gate counts a CLAIM or DECISION clock on the CALENDAR basis;
+    // a gate asking for that basis in an application declaring none is refused at startup. One calendar per
+    // application, never per tenant — see ReviewCalendarSchema.
+    reviewCalendar: ReviewCalendarSchema.optional(),
     // Data-Seeding Configuration (optional: when omitted, the engine-owned
     // `data-seeding:scheduled-rerun` batch uses the manifest's built-in
     // minute-tick default cron — see DataSeedingConfigSchema for the full

package/dist/esm/config/app-configuration-shared.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-configuration-shared.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAClK,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,mBAAmB;CACzB,CAAC;AAMX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzD,6EAA6E;IAE7E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF;;;;;;;;OAQG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjB,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC;IAE3F,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE5D,qEAAqE;IACrE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE5C,sDAAsD;IACtD,kFAAkF;IAClF,8EAA8E;CAE/E,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC;IAChG,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAEnH;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC;CAE7F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACrE,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACzG,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAsC,aAA2B,EAAE,EAAE;IAC/H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC,+BAA+B,CAAC,CAAC;AAInI,wDAAwD;AACxD,0BAA0B;AAC1B,wDAAwD;AAExD,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,wDAA+B,CAAA;AACjC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,6GAA6G;IAC7G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kEAAkE;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEnC,qCAAqC;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,2EAA2E;IAC3E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAEvF;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,+DAA+D;QAC/D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,yCAAyC;IACzC,mBAAmB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC,CAAC;AAGH,wDAAwD;AACxD,gCAAgC;AAChC,wDAAwD;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAErD,WAAW,EAAE,0CAA0C;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAExD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,qDAAqD;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAE/E,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,mDAAmD;IACnD,SAAS,EAAE,qBAAqB;IAChC,0HAA0H;IAC1H,gBAAgB,EAAE,4BAA4B;IAC9C,qEAAqE;IACrE,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,wCAAwC;IAEpD,gEAAgE;IAChE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAE9C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,yCAAyC;IACzC,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAErD,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,4DAA4D;IAC5D,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAE/C,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAE9C,CAAC,CAAC","sourcesContent":["/**\n * Frontend Application Configuration Schemas\n *\n * Pure frontend configuration schemas that define what configuration\n * the frontend applications expect to receive from backend endpoints.\n *\n * NOTE: OAuth2 providers are NOT configured here. OAuth2 is a protocol\n * defined at the provider level in external-connectors, just like REST_API\n * and HOOKS protocols. This configuration only enables/disables which\n * external providers are available for SSO authentication.\n */\n\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models';\nimport { z } from 'zod';\nimport { AllSharedApplicationTypes, AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas';\nimport { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas';\nimport { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas';\nimport { ClientInstanceIdScope, DataProcessingConsent, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas';\nimport { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas';\nimport { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas';\nimport { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas';\nimport { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { ValueMomentSchema } from './analytics-value-moments.shared.schemas';\nimport {\n  UserTypesConfigSchema,\n  FrontendServicesConfigSchema,\n  OrganizationTypesConfigSchema,\n  OrgAuthMethodPolicy,\n} from './entity-identity-config.shared.schemas';\n\n\n\n/**\n * Shared Password Policy Rules Schema\n *\n * Contains ONLY the validation rules that both frontend and backend need.\n * The backend extends these rules with hashing config (argon2 params)\n * via AppConfiguration_AuthSchema in app-config.backend.schemas.ts.\n *\n * Frontend uses these rules for:\n * - Real-time password strength validation as user types\n * - Password policy indicator in reset/registration forms\n */\n\n\nexport const PasswordPolicyRulesSchema = z.object({\n  minLength: z.number().min(6).max(128).default(8),\n  maxLength: z.number().min(8).max(256).default(128),\n  requireUppercase: z.boolean().default(true),\n  requireLowercase: z.boolean().default(true),\n  requireNumbers: z.boolean().default(true),\n  requireSpecialChars: z.boolean().default(false),\n  /**\n   * R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),\n   * NOT used in the client-side password pre-check — but it IS a field of this shared schema and\n   * therefore ships wherever the schema is serialized (e.g. `AuthInvitationInfoResponse.passwordPolicy`).\n   * Non-secret. (Corrected from the prior \"Backend-only\" which wrongly implied it is never serialized.)\n   * NOTE: `PasswordPolicyConfigSchema` (entity-identity-config) must stay field-identical to this schema\n   * — the invitation response `.parse()` silently strips any field present there but absent here.\n   */\n  expiryDays: z.number().min(0).default(0),\n});\n\nexport type PasswordPolicyRules = z.infer<typeof PasswordPolicyRulesSchema>;\n\n/**\n * I18n label keys for password policy violations.\n * Values match PasswordPolicyLabel in presets-components-models for frontend resolution.\n * Labels support placeholders: policyMinLength → {minLength}, policyMaxLength → {maxLength}.\n */\nexport const PasswordPolicyViolationCode = {\n  MIN_LENGTH: 'policyMinLength',\n  MAX_LENGTH: 'policyMaxLength',\n  UPPERCASE: 'policyUppercase',\n  LOWERCASE: 'policyLowercase',\n  NUMBER: 'policyNumber',\n  SPECIAL_CHAR: 'policySpecialChar',\n} as const;\n\nexport type PasswordPolicyViolationCode = (typeof PasswordPolicyViolationCode)[keyof typeof PasswordPolicyViolationCode];\n\n\n\n/**\n * Global Auth Config — infrastructure + app-level only.\n *\n * Auth POLICY (authMethodsEnabled, mfaPolicy, registration, passwordPolicy,\n * sessionDurationMinutes, lockoutPolicy, autoLinkByEmail, stepUpAuth,\n * methodManagement) is now per-user-type on UserTypeAuthPolicySchema\n * in entity-identity-config.shared.schemas.ts.\n *\n * This section retains only infrastructure and app-level settings that apply\n * equally regardless of user type.\n *\n */\nexport const AppConfiguration_Shared_AuthSchema = z.object({\n\n  // ─── INFRASTRUCTURE (stays on global auth) ────────────────────────────────\n\n  passkeyConfig: z.object({\n    rpName: z.string().min(1),\n    rpId: z.string().min(1),\n    maxPasskeysPerUser: z.number().min(1).max(50).default(10),\n  }),\n\n  /**\n   * Minimal frontend-facing social OAuth2 projection.\n   *\n   * Backend runtime still owns the full backend-private\n   * `auth.socialOAuth2Providers` authoring shape\n   * (enabled flags, scopes, allowed domains, secrets-related semantics). The\n   * shared `/application-config` payload only needs the enabled public provider\n   * refs plus an optional app-authored display-name override.\n   */\n  socialOAuth2Providers: z.record(\n    z.string(),\n    z.object({\n      displayName: z.string().optional(),\n    })).default({}),\n\n  /** E-10, D-15: How much orgs can override user-type auth methods. */\n  orgAuthMethodPolicy: z.enum(OrgAuthMethodPolicy).default(OrgAuthMethodPolicy.RESTRICT_ONLY),\n\n  /** E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. */\n  expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),\n\n  /** E-4, D-2: Can a user authenticated via Org A SSO access Org B? */\n  crossOrgSSOAccess: z.boolean().default(true),\n\n  // W6.8: All per-user-type auth policy fields REMOVED.\n  // Use userTypes[t].auth.* instead (see entity-identity-config.shared.schemas.ts).\n  // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).\n\n});\n\n\n\n\nexport const AppConfiguration_Shared_ComplianceSchema = z.object({\n  userProfileVisibility: z.enum(UserProfileVisibility).default(UserProfileVisibility.ORGANIZATION),\n  organizationProfileVisibility: z.enum(OrganizationProfileVisibility).default(OrganizationProfileVisibility.PRIVATE),\n\n  /**\n   * Client-install identification policy (`clientInstanceId`) — **OFF unless authored**.\n   *\n   * Lives on `compliance` because it is a privacy decision, not an observability knob, and lives on\n   * the SHARED config because both halves of the mechanism must obey ONE authored value: the\n   * frontend decides whether to mint/store/send the id, and the backend independently decides\n   * whether to ingest and record it. Two gates, one source — an application that never opts in is\n   * protected even if some client sends the header anyway.\n   *\n   * Defaults to {@link ClientInstanceIdScope.DISABLED} so the privacy-preserving posture is the one\n   * you get by doing nothing. See the enum's JSDoc for the ePrivacy/GDPR/NIST reasoning and the\n   * obligations attached to each non-`DISABLED` member.\n   */\n  clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),\n\n});\n\n\n\nexport const AppConfiguration_Shared_AppIdentity_Schema = z.object({\n  /** Technical app name — used as fallback when displayName is absent */\n  appName: z.string().min(1, { error: 'Application name is required' }),\n  /** Human-readable display name shown in UI and emails */\n  displayName: z.string().optional(),\n  /** Short description of the application */\n  description: z.string().optional(),\n  version: z.string().min(1, { error: 'Version is required' }),\n  /**\n   * The application's own id — the scope an APPLICATION-scoped resource's WebSocket room is keyed on.\n   *\n   * ## Why the client needs it, measured rather than argued\n   *\n   * `deriveResourceScopeRoomQualifiers` yields the `app` room only when `applicationId` is present in\n   * the context it is handed, and a read's context is built from the URL's contextual parameters —\n   * which never carry one, because an application id is AMBIENT rather than addressed. Nothing else\n   * published it either: the access token's claims carry `userId` and no `applicationId`, and this\n   * very object carried only `appName`/`displayName`/`version`.\n   *\n   * The consequence was silent. On 2026-09-03 the workbench subscribed to `org` and `user` for an\n   * APPLICATION-scoped resource and was confirmed in both, while the companion published that\n   * resource's changes to the `app` room. Correct producer, confirmed subscriber, different rooms,\n   * zero frames delivered (issue #283).\n   *\n   * ## Why it is safe to publish here\n   *\n   * It is an IDENTIFIER, not a credential: it names which application this deployment is, it grants\n   * nothing, and every authenticated request already acts within it. The room name a client must\n   * compute is derived from it, so a client that may subscribe at all must be able to name it —\n   * authorization for that room is decided server-side against the SUBSCRIBED RESOURCE, never\n   * against possession of this value (issue #247).\n   *\n   * OPTIONAL because a deployment that predates this field must keep loading. A consumer that does\n   * not find it degrades to the previous behaviour — it derives whatever rooms its parameters imply\n   * and does not hear the application-room push — rather than failing.\n   */\n  applicationId: z.string().min(1).optional(),\n});\n\n\nexport const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({\n  defaultLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n  enabledLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]),\n  fallbackLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n  autoDetectFromBrowser: z.boolean().default(true),\n  allowUserOverride: z.boolean().default(true),\n  allowOrganizationOverride: z.boolean().default(true),\n  enableLanguageSwitcher: z.boolean().default(true)\n});\n\n\nexport const appConfiguration_Shared_RuntimeSchemaBuilder = <T extends AllSharedApplicationTypes>(appTypeSchema: z.ZodType<T>) => {\n  return z.object({\n    endPoints: z.record(z.string(), z.object({\n      publicUrl: z.string().optional(),\n      internalUrl: z.string().optional(),\n    })),\n  })\n}\n\nexport const AppConfiguration_Shared_RuntimeSchema = appConfiguration_Shared_RuntimeSchemaBuilder(AllSharedApplicationTypesSchema);\n\n\n\n// =====================================================\n// Analytics Configuration\n// =====================================================\n\nexport enum AnalyticsProviderType {\n  CONSOLE = 'console',\n  BACKEND_PROXY = 'backend_proxy',\n}\n\n/** Uses providerType (not \"type\") to avoid Mongoose reserved keyword conflict during Zod→Mongoose conversion. */\nexport const AnalyticsProviderConfigSchema = z.object({\n  providerType: z.enum(AnalyticsProviderType),\n  config: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport const AutoInstrumentationConfigSchema = z.object({\n  /** Track page views (NAVIGATION_PANE_CHANGED events) */\n  pageViews: z.boolean().default(true),\n  /** Track resource operations (NOTIFY_RESOURCE_SUCCESS events) */\n  resourceOperations: z.boolean().default(true),\n  /** Track errors (ERROR_OCCURED events). Named 'trackErrors' to avoid Mongoose reserved 'errors' pathname. */\n  trackErrors: z.boolean().default(true),\n  /** Track feature gate hits (shown/blocked) — debounced per feature per session */\n  featureGate: z.boolean().default(true),\n  /** Track user lifecycle events (login, logout, status changes) */\n  userLifecycle: z.boolean().default(true),\n  /** Track notification events (NOTIFY_CUSTOM_* events) */\n  notifications: z.boolean().default(false),\n  /** Track hotkey usage */\n  hotkeys: z.boolean().default(false),\n});\n\nexport const AnalyticsConfigSchema = z.object({\n  /** Master switch — false = no analytics at all, regardless of user consent */\n  enabled: z.boolean().default(false),\n\n  /** Registered analytics providers */\n  providers: z.array(AnalyticsProviderConfigSchema).default([]),\n\n  /** Minimum consent level required for analytics (defaults to ANALYTICS) */\n  requiredConsent: z.enum(DataProcessingConsent).default(DataProcessingConsent.ANALYTICS),\n\n  /**\n   * SINGLE DECLARATION SURFACE for all value moments.\n   * TTFV, aha moments, activation stages, and anti-patterns are all here,\n   * distinguished by their `role` field.\n   */\n  valueMoments: z.array(ValueMomentSchema).optional(),\n\n  /** Persistence and evaluation configuration */\n  persistence: z.object({\n    /** Persist achieved moments to localStorage (default: true) */\n    localStorage: z.boolean().default(true),\n    /** Sync achieved moments to backend (default: true) */\n    backendSync: z.boolean().default(true),\n    /**\n     * Backend evaluates RESOURCE_STATE signals + cronjob-originated events.\n     * When true, RESOURCE_STATE signals are evaluated by the backend engine (authoritative).\n     * When false, frontend does optimistic cached count queries.\n     */\n    backendEvaluation: z.boolean().default(true),\n  }).default({\n    localStorage: true,\n    backendSync: true,\n    backendEvaluation: true,\n  }),\n\n  /** Auto-instrumentation configuration */\n  autoInstrumentation: AutoInstrumentationConfigSchema.default({\n    pageViews: true,\n    resourceOperations: true,\n    trackErrors: true,\n    featureGate: true,\n    userLifecycle: true,\n    notifications: false,\n    hotkeys: false,\n  }),\n});\n\n\n// =====================================================\n// Main Shared App Configuration\n// =====================================================\n\nexport const AppConfiguration_Shared_Schema = z.object({\n\n  appIdentity: AppConfiguration_Shared_AppIdentity_Schema,\n\n  /**\n   * The generated brand assets — the runtime projection of the brand identity\n   * an app's build-time logo step produces. THE single source of truth every\n   * logo/favicon/brand-image consumer resolves against via `resolveBrandAsset`\n   * (by composition × theme × purpose). Empty/absent until a brand is\n   * generated; consumers fall back to a placeholder.\n   *\n   * MOVED OFF `appIdentity` (2026-07): brand assets are app-authored,\n   * BUILD-TIME content (a CLI generates them from a spec SSOT and writes a\n   * `backend-api/src/brand-assets.generated.ts` the backend config composes),\n   * NOT platform-declaration identity. `appIdentity` is\n   * platform-declaration-materialized and boundary-blocked for backend\n   * authoring (`AppConfiguration_BackendAuthored` Omits `appIdentity`, and the\n   * `applyBackendConfig` inspector rejects it), so a backend-authorable slot is\n   * required. This top-level `brandAssets` is that slot — it is present on both\n   * the frontend shared payload (here) and the backend-authored managed config\n   * (`_AppConfiguration_AppManagedConfiguration_Schema`).\n   */\n  brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n\n  appPreferences: z.object({\n    languages: AppConfiguration_Shared_AppPreferencesLanguage_Schema,\n  }),\n  apiJwtPublicKey: z.string().min(1, { error: 'API JWT public key is required' }),\n\n  runtime: AppConfiguration_Shared_RuntimeSchema,\n  auth: AppConfiguration_Shared_AuthSchema,\n  /** User types — required. No implicit defaults. */\n  userTypes: UserTypesConfigSchema,\n  /** Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. */\n  frontendServices: FrontendServicesConfigSchema,\n  /** Org typing. Optional — only for apps with typed organizations. */\n  organizationTypes: OrganizationTypesConfigSchema.optional(),\n  compliance: AppConfiguration_Shared_ComplianceSchema,\n\n  // Billing Configuration (optional: billing disabled by default)\n  billing: BillingConfigurationSchema.optional(),\n\n  // Analytics Configuration (optional: analytics disabled by default)\n  analytics: AnalyticsConfigSchema.optional(),\n\n  // Lifecycle Configuration (optional: lifecycle disabled by default)\n  lifecycle: LifecycleConfigSchema.optional(),\n\n  // Tenant-Teardown Configuration (optional: every field defaults, so omitting the block yields a\n  // working 30-day retention window purged nightly). Holds the operator-tunable retention window,\n  // purge cron and per-run batch size consumed by the engine-owned `organization-purge` batch.\n  // See TenantTeardownConfigSchema for why this is NOT folded into `lifecycle` (which is the USER\n  // lifecycle and is disabled by default).\n  tenantTeardown: TenantTeardownConfigSchema.optional(),\n\n  // Data-Seeding Configuration (optional: when omitted, the engine-owned\n  // `data-seeding:scheduled-rerun` batch uses the manifest's built-in\n  // minute-tick default cron — see DataSeedingConfigSchema for the full\n  // rationale on why operators rarely need to override this).\n  dataSeeding: DataSeedingConfigSchema.optional(),\n\n  // Audit-Trail Configuration (optional: when omitted, NO archival runs and\n  // audit records are retained in the primary AUDIT_LOGS store indefinitely).\n  // Holds the operator-tunable archival horizon (`archiveAfterDays`) consumed\n  // by the engine-owned `compliance:audit-logs-archive` batch. Records are\n  // never deleted (AUDIT_LOGS is immutable, G5) — see AuditTrailConfigSchema.\n  auditTrail: AuditTrailConfigSchema.optional(),\n\n});\n\n\nexport type AppConfiguration_Shared_Compliance = z.infer<typeof AppConfiguration_Shared_ComplianceSchema>;\nexport type AppConfiguration_Shared_AppIdentity = z.infer<typeof AppConfiguration_Shared_AppIdentity_Schema>;\nexport type AppConfiguration_Shared_AppPreferencesLanguage = z.infer<typeof AppConfiguration_Shared_AppPreferencesLanguage_Schema>;\nexport type AnalyticsProviderConfig = z.infer<typeof AnalyticsProviderConfigSchema>;\nexport type AppConfiguration_Shared_Runtime = z.infer<typeof AppConfiguration_Shared_RuntimeSchema>;\nexport type AutoInstrumentationConfig = z.infer<typeof AutoInstrumentationConfigSchema>;\nexport type AnalyticsConfig = z.infer<typeof AnalyticsConfigSchema>;\nexport type AppConfiguration_Shared_Auth = z.infer<typeof AppConfiguration_Shared_AuthSchema>;\nexport type AppConfiguration_Shared = z.infer<typeof AppConfiguration_Shared_Schema>;\n"]}
+{"version":3,"file":"app-configuration-shared.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAA6B,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAC3I,OAAO,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mEAAmE,CAAC;AACpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,wCAAwC,EAAE,MAAM,uEAAuE,CAAC;AAC/J,OAAO,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,2DAA2D,CAAC;AACjJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,yDAAyD,CAAC;AAC7G,OAAO,EAAE,sCAAsC,EAAE,MAAM,8DAA8D,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD;;;;;;;;;;;;;;OAcG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,mBAAmB;IACjC;;;;;OAKG;IACH,WAAW,EAAE,mBAAmB;CACxB,CAAC;AAMX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzD,6EAA6E;IAE7E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF;;;;;;;;OAQG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjB,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC;IAE3F,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE5D,qEAAqE;IACrE;;;;;;;;;;;;OAYG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE7C,sDAAsD;IACtD,kFAAkF;IAClF,8EAA8E;CAE/E,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC;IAChG,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAEnH;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC;IAE5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE1E;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,8BAA8B,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC;IAEhI;;;;;;;;;;;;;;;OAeG;IACH,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,OAAO,CAAC;IAEhH;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAErE;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,iCAAiC,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAE5D;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,sCAAsC,CAAC,QAAQ,EAAE;CAEzE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACrE,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACzG,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAsC,aAA2B,EAAE,EAAE;IAC/H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC,+BAA+B,CAAC,CAAC;AAInI,wDAAwD;AACxD,0BAA0B;AAC1B,wDAAwD;AAExD,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,wDAA+B,CAAA;AACjC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,6GAA6G;IAC7G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kEAAkE;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEnC,qCAAqC;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D;;;;;;;;;;OAUG;IACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,+DAA+D;QAC/D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,yCAAyC;IACzC,mBAAmB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC,CAAC;AAGH,wDAAwD;AACxD,gCAAgC;AAChC,wDAAwD;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAErD,WAAW,EAAE,0CAA0C;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAExD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,qDAAqD;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAE/E,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,mDAAmD;IACnD,SAAS,EAAE,qBAAqB;IAChC,0HAA0H;IAC1H,gBAAgB,EAAE,4BAA4B;IAC9C;;;;;;;;OAQG;IACH,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,UAAU,EAAE,wCAAwC;IAEpD,gEAAgE;IAChE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAE9C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,yCAAyC;IACzC,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAErD,sGAAsG;IACtG,0GAA0G;IAC1G,wGAAwG;IACxG,4DAA4D;IAC5D,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAE/C,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,4DAA4D;IAC5D,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAE/C,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAE9C,CAAC,CAAC","sourcesContent":["/**\n * Frontend Application Configuration Schemas\n *\n * Pure frontend configuration schemas that define what configuration\n * the frontend applications expect to receive from backend endpoints.\n *\n * NOTE: OAuth2 providers are NOT configured here. OAuth2 is a protocol\n * defined at the provider level in external-connectors, just like REST_API\n * and HOOKS protocols. This configuration only enables/disables which\n * external providers are available for SSO authentication.\n */\n\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models';\nimport { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { AllSharedApplicationTypes, AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas';\nimport { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas';\nimport { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas';\nimport { ClientInstanceIdScope, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas';\nimport { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';\nimport { ServiceConsentRequirementSchema } from '../compliance/privacy/operator-compliance-identity.shared.schemas';\nimport { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas';\nimport { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas';\nimport { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas';\nimport { ReviewCalendarSchema } from '../flows-actors/review-deadlines.shared.schemas';\nimport { GovernedDocumentApprovalGate, GovernedDocumentInteractionSurfaceSchema } from '../compliance/documents/governed-document-interactions.shared.schemas';\nimport { GovernedDocumentAcceptanceMode, GovernedDocumentPublicDocumentSchema } from '../compliance/documents/governed-documents.shared.schemas';\nimport { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas';\nimport { ApplicationRetentionScheduleSchema } from '../compliance/privacy/retention-schedule.shared.schemas';\nimport { SubjectDataRecipientsDeclarationSchema } from '../compliance/privacy/subject-data-recipients.shared.schemas';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { ValueMomentSchema } from './analytics-value-moments.shared.schemas';\nimport {\n  UserTypesConfigSchema,\n  FrontendServicesConfigSchema,\n  OrganizationTypesConfigSchema,\n  OrgAuthMethodPolicy,\n} from './entity-identity-config.shared.schemas';\n\n\n\n/**\n * Shared Password Policy Rules Schema\n *\n * Contains ONLY the validation rules that both frontend and backend need.\n * The backend extends these rules with hashing config (argon2 params)\n * via AppConfiguration_AuthSchema in app-config.backend.schemas.ts.\n *\n * Frontend uses these rules for:\n * - Real-time password strength validation as user types\n * - Password policy indicator in reset/registration forms\n */\n\n\nexport const PasswordPolicyRulesSchema = z.object({\n  /**\n   * The shortest password an application may REQUIRE, and the shortest it may ACCEPT.\n   *\n   * The floor is 8, not 6, because the standard states it as an obligation on the verifier:\n   * \"Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length.\"\n   * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).\n   * A schema that admitted 6 let an application declare a policy the standard forbids — quietly,\n   * since nothing downstream re-checked the declared value.\n   *\n   * The DEFAULT is 15 because the same section continues: \"Verifiers and CSPs SHOULD require\n   * passwords to be a minimum of 15 characters in length.\"\n   * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).\n   * A framework's default is the answer every application that expresses no opinion receives, so it\n   * takes the SHOULD; the floor only has to stop an application going below the SHALL.\n   */\n  minLength: z.number().min(8).max(128).default(15),\n  maxLength: z.number().min(8).max(256).default(128),\n  requireUppercase: z.boolean().default(false),\n  requireLowercase: z.boolean().default(false),\n  requireNumbers: z.boolean().default(false),\n  requireSpecialChars: z.boolean().default(false),\n  /**\n   * R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),\n   * NOT used in the client-side password pre-check — but it IS a field of this shared schema and\n   * therefore ships wherever the schema is serialized (e.g. `AuthInvitationInfoResponse.passwordPolicy`).\n   * Non-secret. (Corrected from the prior \"Backend-only\" which wrongly implied it is never serialized.)\n   * NOTE: `PasswordPolicyConfigSchema` (entity-identity-config) must stay field-identical to this schema\n   * — the invitation response `.parse()` silently strips any field present there but absent here.\n   */\n  expiryDays: z.number().min(0).default(0),\n});\n\nexport type PasswordPolicyRules = z.infer<typeof PasswordPolicyRulesSchema>;\n\n/**\n * I18n label keys for password policy violations.\n * Values match PasswordPolicyLabel in presets-components-models for frontend resolution.\n * Labels support placeholders: policyMinLength → {minLength}, policyMaxLength → {maxLength}.\n */\nexport const PasswordPolicyViolationCode = {\n  MIN_LENGTH: 'policyMinLength',\n  MAX_LENGTH: 'policyMaxLength',\n  UPPERCASE: 'policyUppercase',\n  LOWERCASE: 'policyLowercase',\n  NUMBER: 'policyNumber',\n  SPECIAL_CHAR: 'policySpecialChar',\n  /**\n   * The password is a known common guess, the application's own name, or the user's own email local\n   * part. The check that NIST SP 800-63B-4 §3.1.1.2 asks for in place of the composition rules above\n   * — which the same section forbids, and which is why `UPPERCASE`, `LOWERCASE`, `NUMBER` and\n   * `SPECIAL_CHAR` now default to unenforced while this one always runs.\n   */\n  BLOCKLISTED: 'policyBlocklisted',\n} as const;\n\nexport type PasswordPolicyViolationCode = (typeof PasswordPolicyViolationCode)[keyof typeof PasswordPolicyViolationCode];\n\n\n\n/**\n * Global Auth Config — infrastructure + app-level only.\n *\n * Auth POLICY (authMethodsEnabled, mfaPolicy, registration, passwordPolicy,\n * sessionDurationMinutes, lockoutPolicy, autoLinkByEmail, stepUpAuth,\n * methodManagement) is now per-user-type on UserTypeAuthPolicySchema\n * in entity-identity-config.shared.schemas.ts.\n *\n * This section retains only infrastructure and app-level settings that apply\n * equally regardless of user type.\n *\n */\nexport const AppConfiguration_Shared_AuthSchema = z.object({\n\n  // ─── INFRASTRUCTURE (stays on global auth) ────────────────────────────────\n\n  passkeyConfig: z.object({\n    rpName: z.string().min(1),\n    rpId: z.string().min(1),\n    maxPasskeysPerUser: z.number().min(1).max(50).default(10),\n  }),\n\n  /**\n   * Minimal frontend-facing social OAuth2 projection.\n   *\n   * Backend runtime still owns the full backend-private\n   * `auth.socialOAuth2Providers` authoring shape\n   * (enabled flags, scopes, allowed domains, secrets-related semantics). The\n   * shared `/application-config` payload only needs the enabled public provider\n   * refs plus an optional app-authored display-name override.\n   */\n  socialOAuth2Providers: z.record(\n    z.string(),\n    z.object({\n      displayName: z.string().optional(),\n    })).default({}),\n\n  /** E-10, D-15: How much orgs can override user-type auth methods. */\n  orgAuthMethodPolicy: z.enum(OrgAuthMethodPolicy).default(OrgAuthMethodPolicy.RESTRICT_ONLY),\n\n  /** E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. */\n  expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),\n\n  /** E-4, D-2: Can a user authenticated via Org A SSO access Org B? */\n  /**\n   * May a user who authenticated through ONE organization's identity provider reach ANOTHER\n   * organization through SSO?\n   *\n   * Defaults to `false` (#1223). It defaulted to `true`, and both readers tested for an explicit\n   * `false`, so an application silently permitted cross-tenant SSO reach unless it knew to write the\n   * flag — a tenancy boundary decided by an omission. Neither dogfood application wrote it.\n   *\n   * `false` is the fail-closed answer and the one a multi-tenant application almost always wants: an\n   * identity proven to Acme's provider says nothing about whether that person belongs at Globex. An\n   * application that genuinely wants the reach — a group of organizations sharing one directory —\n   * writes `true`, which is a statement a reviewer can find.\n   */\n  crossOrgSSOAccess: z.boolean().default(false),\n\n  // W6.8: All per-user-type auth policy fields REMOVED.\n  // Use userTypes[t].auth.* instead (see entity-identity-config.shared.schemas.ts).\n  // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).\n\n});\n\n\n\n\nexport const AppConfiguration_Shared_ComplianceSchema = z.object({\n  userProfileVisibility: z.enum(UserProfileVisibility).default(UserProfileVisibility.ORGANIZATION),\n  organizationProfileVisibility: z.enum(OrganizationProfileVisibility).default(OrganizationProfileVisibility.PRIVATE),\n\n  /**\n   * Client-install identification policy (`clientInstanceId`) — **OFF unless authored**.\n   *\n   * Lives on `compliance` because it is a privacy decision, not an observability knob, and lives on\n   * the SHARED config because both halves of the mechanism must obey ONE authored value: the\n   * frontend decides whether to mint/store/send the id, and the backend independently decides\n   * whether to ingest and record it. Two gates, one source — an application that never opts in is\n   * protected even if some client sends the header anyway.\n   *\n   * Defaults to {@link ClientInstanceIdScope.DISABLED} so the privacy-preserving posture is the one\n   * you get by doing nothing. See the enum's JSDoc for the ePrivacy/GDPR/NIST reasoning and the\n   * obligations attached to each non-`DISABLED` member.\n   */\n  clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),\n\n  /**\n   * The governed-document releases in force for this application — **empty unless authored**.\n   *\n   * ## What this closes\n   *\n   * The compliance lane could COMPOSE a release (`composeGovernedDocumentRelease`) and had nowhere\n   * to put it that the running application could see. Measured 2026-09-12: no package in either\n   * example app depends on its own `specifications` package, whose only exports are `.` and\n   * `./companion` — so a composed release reached the companion and the repository and never the\n   * runtime. Issue #54 asks for a record of which terms release a user accepted; nothing could\n   * resolve which release that was.\n   *\n   * ## Why HERE, on the shared payload\n   *\n   * The same reason as {@link ClientInstanceIdScope} above: both halves of the mechanism must obey\n   * ONE authored value. The frontend decides whether to render a consent control and what it is\n   * consenting to; the backend independently decides what may be recorded and composes the record.\n   * Two gates, one source.\n   *\n   * ## Why the SURFACE and not the release\n   *\n   * This payload reaches an unauthenticated browser. A full release additionally carries\n   * `governanceScope` and `approvalDecisions` — internal custody detail\n   * `projectGovernedDocumentPublicRelease` already withholds from public consumers. It happens that\n   * `composeGovernedDocumentInteraction` reads neither, so the browser-safe slice is exactly the\n   * slice the mechanism needs; see {@link GovernedDocumentInteractionSurfaceSchema}. Author it with\n   * `projectGovernedDocumentInteractionSurface(release)` so the release file stays the one source.\n   *\n   * `.default([])` rather than required, and that is not politeness: this schema parses a PERSISTED\n   * application-config document, and a required field would refuse every document written before\n   * today — the 2026-08-27 failure recorded in `staleness-presents-as-a-logic-defect.md`.\n   */\n  governedDocumentReleases: z.array(GovernedDocumentInteractionSurfaceSchema).default([]),\n\n  /**\n   * The governed documents this application SERVES as public pages — `/privacy`, `/terms`. Issue #168.\n   * Each entry is either a RELEASED document (a recorded release's public projection, carrying the text\n   * it was recorded with) or, for a public document that has never been released, its latest\n   * UNRELEASED_DRAFT, which the page marks as a draft. Issue #968.\n   *\n   * ## Why this is separate from `governedDocumentReleases`\n   *\n   * They answer different questions about the same underlying release, and the schemas already say\n   * so: the interaction surface is what a CONSENT control needs (`approvalState`, plus\n   * `allowedInteractionKinds` for what MAY be accepted), while a public page needs to ROUTE and\n   * DISPLAY (title, sections, clauses, effective date, version) AND, since #1258 Step 5, know\n   * whether it may record a `NOTICE_DELIVERED` for the release it is showing — which is what\n   * `allowedInteractionKinds` also answers here, for a different verb. Merging the two payloads\n   * would put document PROSE into the payload every registration form receives, which is what this\n   * split exists to prevent; a field two surfaces both need for their own reasons is not that,\n   * and it appears on each projection on its own terms rather than one borrowing the other's copy.\n   * Neither is typed by hand: `wildo config document-releases` writes both into the application's\n   * `governed-document-releases.generated.ts` from its recorded releases (and, for this one, its\n   * landed drafts), so the release stays the one source.\n   *\n   * ## Why the prose is safe to put in an unauthenticated payload\n   *\n   * Because it is what the page exists to show. Both halves are the deliberately-narrow public\n   * projections — `governanceScope` and `approvalDecisions` never appear, and `bodyMarkdown` is\n   * rendered as TEXT, never as raw HTML. The surface carries no internal custody detail at all.\n   *\n   * `.default([])` for the same reason as its neighbour: this parses a PERSISTED configuration\n   * document, and a required field would refuse every document written before today.\n   */\n  publicDocuments: z.array(GovernedDocumentPublicDocumentSchema).default([]),\n\n  /**\n   * How the registration form asks a person to accept the documents above (#1258).\n   *\n   * See {@link GovernedDocumentAcceptanceMode} for what each member changes and the enforceability\n   * position it takes. It is read by `Auth_Register`, which is why it is on the SHARED payload: the\n   * decision is the application's and the form is the only thing that can carry it out.\n   *\n   * ## Why it defaults to the STRONGEST shape rather than the one this rule's prose leads with\n   *\n   * `EXPLICIT_CHECKBOX` is what registration already did before this field existed, and a default is\n   * what every application that declares nothing receives — so any other default would silently move\n   * shipped applications to a weaker acceptance posture on an engine upgrade, without anyone deciding\n   * to. An operator who wants the lighter \"by registering you agree\" shape says so, once, here.\n   *\n   * ## Why it is declared rather than derived\n   *\n   * `derive-before-you-ask.md` asks what already decides this, and nothing does: the release declares\n   * WHAT may be accepted (`allowedInteractionKinds`) and the public document declares what it SAYS,\n   * but neither carries how hard the operator wants to be asked. It is a liability posture — the one\n   * class `settled-questions-are-not-decisions.md` keeps with the operator — so it is a typed,\n   * committed, diffable declaration rather than a question or a guess.\n   *\n   * `.default(...)` rather than optional or required, for the reason its two neighbours give: this\n   * schema parses a PERSISTED application-config document, and a required field would refuse every\n   * document written before today.\n   */\n  governedDocumentAcceptanceMode: z.enum(GovernedDocumentAcceptanceMode).default(GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX),\n\n  /**\n   * Whether this application shows, and asks people to accept, governed documents nobody has\n   * approved (#1565). See {@link GovernedDocumentApprovalGate} for what each member changes.\n   *\n   * ONE member rather than an option on each surface, because the public page and the acceptance\n   * surfaces must never be armed separately: armed on the page alone, `/terms` answers \"unavailable\"\n   * while sign-up asks people to accept those same terms. Every surface reads it through\n   * `requiresApprovedGovernedDocuments`.\n   *\n   * Defaults to UNARMED, the posture while an application is being built\n   * (`.claude/rules/one-source-of-truth.md` D5). Arming it is part of Gate 3's membership test.\n   *\n   * `.default(...)` for the reason its neighbours give: this schema parses a PERSISTED\n   * application-config document, and a required field would refuse every document written before\n   * today.\n   */\n  governedDocumentApprovalGate: z.enum(GovernedDocumentApprovalGate).default(GovernedDocumentApprovalGate.UNARMED),\n\n  /**\n   * The purposes a signed-in person must grant before the application renders any of its routes —\n   * the RUNTIME half of `operatorComplianceIdentity.serviceConsentRequirement` (#453).\n   *\n   * Declared once, in `wildo.saas.config.ts`, and projected here by `wildo config service-consent`\n   * into `backend-api/src/service-consent-requirement.generated.ts`, which `saas-config.backend.ts`\n   * composes — the `governedDocumentReleases` precedent, so there is never a second hand-copied source.\n   *\n   * Enforced on BOTH tiers. The backend refuses every user-initiated operation except the person's own\n   * context and preferences until every required purpose is granted — one gate,\n   * `AuthorizationsBackendService.assertServiceConsentRequirementMet`, reached from each entry point a person\n   * can initiate work through: `authorizeInController` (REST, MCP tools, queued operations, WebSocket rows,\n   * agent tool calls), `authorizeInProgrammaticSurface` (retrieval), `authorizeOperationRolesOnly` (WebSocket\n   * scope subscriptions), the manual-controller context (charts, analytics, features, flows-actors, provider\n   * operations and connections), the WebSocket badge reads, the A2A task reads (`tasks/get`, `ListTasks`,\n   * `tasks/resubscribe`, `tasks/pushNotificationConfig/*`), and every A2A or WebSocket conversational turn,\n   * started or resumed after an approval. Authentication endpoints are not resource operations and stay open,\n   * as does cancelling an A2A task the person already started; updates the server pushes on its own are not\n   * held back. `AppLayout_AuthenticatedRoute` shows the consent gate where the\n   * person grants them. On the SHARED config because the frontend reads it. It carries no personal data and no\n   * lawful-basis detail, so it is safe in the payload every signed-in browser receives.\n   *\n   * OPTIONAL, and absent means the application declared nothing — nothing is gated. That is the same\n   * observable behaviour as a declared empty set, and deliberately so: a runtime must never block a\n   * person on a requirement nobody stated. The DISTINCTION between the two lives where it matters, in\n   * the declaration and the documents composed from it.\n   */\n  serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n\n  /**\n   * Every purpose declared by at least one resource operation's `consentGate` (#1462, following\n   * #1258 Step 3), so the application-tier consent-gate PROMPT can offer to grant it.\n   *\n   * DERIVED, never authored — this is not a declaration site. A resource operation declares\n   * `consentGate: { purpose, refusal?, timing? }` in its OWN `*.resources-config.ts`\n   * (`ResourceOperationConsentGateDeclaration`), which is where the decision belongs: a capability's\n   * consent posture is expressed beside the capability, not restated a second time here for the\n   * frontend to read. This field is the engine scanning every resource's every operation once, at\n   * boot, and recording the SET of purposes at least one of them named — `wildo config`-generated\n   * fields read `wildo.saas.config.ts`, which does not see per-operation declarations scattered\n   * across the app, so that pattern does not fit here; this is populated by\n   * `ResourcesRegistryBackendService.initialize()` calling back into `AppConfigurationService` the\n   * moment the registry — and therefore every operation's declared purpose — is fully built.\n   *\n   * `applicationAskedConsentPurposes` unions this with `requiredPurposes` and the analytics purpose\n   * to decide `optionalPurposes` on `ConsentGateState` — the same generic PROMPT that already offers\n   * ANALYTICS, now also offering whatever a capability declared. It does not distinguish `timing`\n   * (`ON_USE` / `FIRST_SESSION` / …): no per-capability or per-session prompt surface exists yet to\n   * honour those distinctly, so every declared purpose is offered by the one surface that does exist,\n   * which is strictly better than the alternative — refusing a capability with no way at all to grant\n   * what it asks for.\n   *\n   * OPTIONAL and defaults to the empty array on any config resolved before this field existed, which\n   * is the same observable behaviour as declaring no `consentGate` anywhere (R12).\n   */\n  capabilityDeclaredConsentPurposes: z.enum(ConsentPurpose).array().default([]),\n\n  /**\n   * The application's declared retention schedule — the RUNTIME half of `dataRetention` in\n   * `wildo.saas.config.ts` (#1613).\n   *\n   * Declared once, in `wildo.saas.config.ts`, and projected here by `wildo config data-retention` into\n   * `backend-api/src/data-retention.generated.ts`, which `saas-config.backend.ts` composes — the\n   * `serviceConsentRequirement` precedent, so the period a privacy notice states and the period the\n   * retention sweep enforces are one value, never a hand-copied pair.\n   *\n   * Read at every sweep run, never cached per row, so a period change applies on the next run with no\n   * backfill. It also single-sources two older horizons: `auditTrail.archiveAfterDays` derives from\n   * `AUDIT_LOGS` and `tenantTeardown.retentionWindowDays` from `RESOURCE_DATA` when unset, and startup\n   * refuses a value that disagrees with the schedule.\n   *\n   * OPTIONAL and partial exactly like the declaration: an absent class is UNDECIDED, and the sweep\n   * deletes nothing for a resource bound to an undeclared class. On the shared config because a period\n   * is what the application already publishes in its privacy notice; it carries no personal data.\n   */\n  dataRetention: ApplicationRetentionScheduleSchema.optional(),\n\n  /**\n   * Who else holds a data subject's personal data — every recipient the application's declared flows reach, with the\n   * legal identity its processor register adopted, the categories each flow carries and the erasure stance (#1710).\n   *\n   * DERIVED, never authored: `wildo config subject-data-recipients` runs the one design-time derivation and writes\n   * `backend-api/src/subject-data-recipients.generated.ts`, which `saas-config.backend.ts` composes here — the\n   * `dataRetention` precedent. A subject export lists these recipients (Art. 15(1)(c)); a subject erasure reports an\n   * outcome for each (Art. 19). See `subject-data-recipients.shared.schemas.ts`.\n   *\n   * OPTIONAL, and absent is NOT DECLARED rather than \"no recipient\": an export says so, and an erasure carries one\n   * UNMEASURED outcome naming it. On the shared config because it states what the privacy notice already publishes\n   * — vendor identities and categories, never a person's data.\n   */\n  subjectDataRecipients: SubjectDataRecipientsDeclarationSchema.optional(),\n\n});\n\n\n\nexport const AppConfiguration_Shared_AppIdentity_Schema = z.object({\n  /** Technical app name — used as fallback when displayName is absent */\n  appName: z.string().min(1, { error: 'Application name is required' }),\n  /** Human-readable display name shown in UI and emails */\n  displayName: z.string().optional(),\n  /** Short description of the application */\n  description: z.string().optional(),\n  version: z.string().min(1, { error: 'Version is required' }),\n  /**\n   * The application's own id — the scope an APPLICATION-scoped resource's WebSocket room is keyed on.\n   *\n   * ## Why the client needs it, measured rather than argued\n   *\n   * `deriveResourceScopeRoomQualifiers` yields the `app` room only when `applicationId` is present in\n   * the context it is handed, and a read's context is built from the URL's contextual parameters —\n   * which never carry one, because an application id is AMBIENT rather than addressed. Nothing else\n   * published it either: the access token's claims carry `userId` and no `applicationId`, and this\n   * very object carried only `appName`/`displayName`/`version`.\n   *\n   * The consequence was silent. On 2026-09-03 the workbench subscribed to `org` and `user` for an\n   * APPLICATION-scoped resource and was confirmed in both, while the companion published that\n   * resource's changes to the `app` room. Correct producer, confirmed subscriber, different rooms,\n   * zero frames delivered (issue #283).\n   *\n   * ## Why it is safe to publish here\n   *\n   * It is an IDENTIFIER, not a credential: it names which application this deployment is, it grants\n   * nothing, and every authenticated request already acts within it. The room name a client must\n   * compute is derived from it, so a client that may subscribe at all must be able to name it —\n   * authorization for that room is decided server-side against the SUBSCRIBED RESOURCE, never\n   * against possession of this value (issue #247).\n   *\n   * OPTIONAL because a deployment that predates this field must keep loading. A consumer that does\n   * not find it degrades to the previous behaviour — it derives whatever rooms its parameters imply\n   * and does not hear the application-room push — rather than failing.\n   */\n  applicationId: z.string().min(1).optional(),\n});\n\n\nexport const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({\n  defaultLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n  enabledLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]),\n  fallbackLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n  autoDetectFromBrowser: z.boolean().default(true),\n  allowUserOverride: z.boolean().default(true),\n  allowOrganizationOverride: z.boolean().default(true),\n  enableLanguageSwitcher: z.boolean().default(true)\n});\n\n\nexport const appConfiguration_Shared_RuntimeSchemaBuilder = <T extends AllSharedApplicationTypes>(appTypeSchema: z.ZodType<T>) => {\n  return z.object({\n    endPoints: z.record(z.string(), z.object({\n      publicUrl: z.string().optional(),\n      internalUrl: z.string().optional(),\n    })),\n  })\n}\n\nexport const AppConfiguration_Shared_RuntimeSchema = appConfiguration_Shared_RuntimeSchemaBuilder(AllSharedApplicationTypesSchema);\n\n\n\n// =====================================================\n// Analytics Configuration\n// =====================================================\n\nexport enum AnalyticsProviderType {\n  CONSOLE = 'console',\n  BACKEND_PROXY = 'backend_proxy',\n}\n\n/** Uses providerType (not \"type\") to avoid Mongoose reserved keyword conflict during Zod→Mongoose conversion. */\nexport const AnalyticsProviderConfigSchema = z.object({\n  providerType: z.enum(AnalyticsProviderType),\n  config: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport const AutoInstrumentationConfigSchema = z.object({\n  /** Track page views (NAVIGATION_PANE_CHANGED events) */\n  pageViews: z.boolean().default(true),\n  /** Track resource operations (NOTIFY_RESOURCE_SUCCESS events) */\n  resourceOperations: z.boolean().default(true),\n  /** Track errors (ERROR_OCCURED events). Named 'trackErrors' to avoid Mongoose reserved 'errors' pathname. */\n  trackErrors: z.boolean().default(true),\n  /** Track feature gate hits (shown/blocked) — debounced per feature per session */\n  featureGate: z.boolean().default(true),\n  /** Track user lifecycle events (login, logout, status changes) */\n  userLifecycle: z.boolean().default(true),\n  /** Track notification events (NOTIFY_CUSTOM_* events) */\n  notifications: z.boolean().default(false),\n  /** Track hotkey usage */\n  hotkeys: z.boolean().default(false),\n});\n\nexport const AnalyticsConfigSchema = z.object({\n  /** Master switch — false = no analytics at all, regardless of user consent */\n  enabled: z.boolean().default(false),\n\n  /** Registered analytics providers */\n  providers: z.array(AnalyticsProviderConfigSchema).default([]),\n\n  /**\n   * Whether analytics rests on the person's consent to `ConsentPurpose.ANALYTICS` (default `true`).\n   *\n   * A boolean rather than a purpose, because analytics has exactly one purpose by definition. `false`\n   * is a claim that analytics here is not consent-based — anonymised measurement under a documented\n   * legitimate interest — and the lawful basis for that belongs in `operatorComplianceIdentity`.\n   *\n   * Replaces `requiredConsent: DataProcessingConsent`, a minimum LEVEL on an ordered scale that\n   * implied a person who agreed to marketing had agreed to analytics (#534). `requiredConsent: NONE`\n   * is `requiresConsent: false`; every other value is `true`.\n   */\n  requiresConsent: z.boolean().default(true),\n\n  /**\n   * SINGLE DECLARATION SURFACE for all value moments.\n   * TTFV, aha moments, activation stages, and anti-patterns are all here,\n   * distinguished by their `role` field.\n   */\n  valueMoments: z.array(ValueMomentSchema).optional(),\n\n  /** Persistence and evaluation configuration */\n  persistence: z.object({\n    /** Persist achieved moments to localStorage (default: true) */\n    localStorage: z.boolean().default(true),\n    /** Sync achieved moments to backend (default: true) */\n    backendSync: z.boolean().default(true),\n    /**\n     * Backend evaluates RESOURCE_STATE signals + cronjob-originated events.\n     * When true, RESOURCE_STATE signals are evaluated by the backend engine (authoritative).\n     * When false, frontend does optimistic cached count queries.\n     */\n    backendEvaluation: z.boolean().default(true),\n  }).default({\n    localStorage: true,\n    backendSync: true,\n    backendEvaluation: true,\n  }),\n\n  /** Auto-instrumentation configuration */\n  autoInstrumentation: AutoInstrumentationConfigSchema.default({\n    pageViews: true,\n    resourceOperations: true,\n    trackErrors: true,\n    featureGate: true,\n    userLifecycle: true,\n    notifications: false,\n    hotkeys: false,\n  }),\n});\n\n\n// =====================================================\n// Main Shared App Configuration\n// =====================================================\n\nexport const AppConfiguration_Shared_Schema = z.object({\n\n  appIdentity: AppConfiguration_Shared_AppIdentity_Schema,\n\n  /**\n   * The generated brand assets — the runtime projection of the brand identity\n   * an app's build-time logo step produces. THE single source of truth every\n   * logo/favicon/brand-image consumer resolves against via `resolveBrandAsset`\n   * (by composition × theme × purpose). Empty/absent until a brand is\n   * generated; consumers fall back to a placeholder.\n   *\n   * MOVED OFF `appIdentity` (2026-07): brand assets are app-authored,\n   * BUILD-TIME content (a CLI generates them from a spec SSOT and writes a\n   * `backend-api/src/brand-assets.generated.ts` the backend config composes),\n   * NOT platform-declaration identity. `appIdentity` is\n   * platform-declaration-materialized and boundary-blocked for backend\n   * authoring (`AppConfiguration_BackendAuthored` Omits `appIdentity`, and the\n   * `applyBackendConfig` inspector rejects it), so a backend-authorable slot is\n   * required. This top-level `brandAssets` is that slot — it is present on both\n   * the frontend shared payload (here) and the backend-authored managed config\n   * (`_AppConfiguration_AppManagedConfiguration_Schema`).\n   */\n  brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n\n  appPreferences: z.object({\n    languages: AppConfiguration_Shared_AppPreferencesLanguage_Schema,\n  }),\n  apiJwtPublicKey: z.string().min(1, { error: 'API JWT public key is required' }),\n\n  runtime: AppConfiguration_Shared_RuntimeSchema,\n  auth: AppConfiguration_Shared_AuthSchema,\n  /** User types — required. No implicit defaults. */\n  userTypes: UserTypesConfigSchema,\n  /** Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. */\n  frontendServices: FrontendServicesConfigSchema,\n  /**\n   * Org typing. MANDATORY for a running application, optional in this schema (#1032, 2026-09-14).\n   *\n   * Every organization carries a type naming an entry here, and a member of an organization whose type\n   * resolves to nothing cannot sign in, so an application with none is refused at startup. The schema\n   * stays optional because it also parses configuration that predates the field, and the door that\n   * writes the field has to be able to read that configuration first. It used to say \"only for apps with\n   * typed organizations\"; every application has organizations.\n   */\n  organizationTypes: OrganizationTypesConfigSchema.optional(),\n  /**\n   * The organization role table's keys a membership may hold (#1921): the core organization roles plus the\n   * application's custom organization roles, as the running backend's authorization service holds them, less the roles\n   * no membership may hold: the handler-only roles (`INBOUND_HANDLER_ONLY_ROLES`) and the delegated capability roles a\n   * live grant alone confers (`DELEGATED_CAPABILITY_ROLES`). What a role picker\n   * (`StringEditMode.ORGANIZATION_ROLE`) offers; each role's words come from the `roles` label tree.\n   *\n   * RUNTIME-DERIVED, like `appIdentity.applicationId`: an application does not author it here — it declares custom\n   * roles in its shared modules, and the backend publishes the merged table on `/application-config`. Custom roles are\n   * application-wide, so every organization of the application has the same table.\n   *\n   * Safe to publish: role KEYS are vocabulary, not authority — the same keys already ship in the public `roles` label\n   * bundle, and holding a role is decided server-side against the membership, never against knowing its name.\n   * OPTIONAL so a backend that predates it keeps loading; a picker without it degrades to a text input.\n   */\n  organizationRoles: z.array(z.string().min(1)).optional(),\n  compliance: AppConfiguration_Shared_ComplianceSchema,\n\n  // Billing Configuration (optional: billing disabled by default)\n  billing: BillingConfigurationSchema.optional(),\n\n  // Analytics Configuration (optional: analytics disabled by default)\n  analytics: AnalyticsConfigSchema.optional(),\n\n  // Lifecycle Configuration (optional: lifecycle disabled by default)\n  lifecycle: LifecycleConfigSchema.optional(),\n\n  // Tenant-Teardown Configuration (optional: every field defaults, so omitting the block yields a\n  // working 30-day retention window purged nightly). Holds the operator-tunable retention window,\n  // purge cron and per-run batch size consumed by the engine-owned `organization-purge` batch.\n  // See TenantTeardownConfigSchema for why this is NOT folded into `lifecycle` (which is the USER\n  // lifecycle and is disabled by default).\n  tenantTeardown: TenantTeardownConfigSchema.optional(),\n\n  // Review calendar (#1628, optional): the application's business hours and holidays, in one time zone.\n  // Read only by pending human decisions whose gate counts a CLAIM or DECISION clock on the CALENDAR basis;\n  // a gate asking for that basis in an application declaring none is refused at startup. One calendar per\n  // application, never per tenant — see ReviewCalendarSchema.\n  reviewCalendar: ReviewCalendarSchema.optional(),\n\n  // Data-Seeding Configuration (optional: when omitted, the engine-owned\n  // `data-seeding:scheduled-rerun` batch uses the manifest's built-in\n  // minute-tick default cron — see DataSeedingConfigSchema for the full\n  // rationale on why operators rarely need to override this).\n  dataSeeding: DataSeedingConfigSchema.optional(),\n\n  // Audit-Trail Configuration (optional: when omitted, NO archival runs and\n  // audit records are retained in the primary AUDIT_LOGS store indefinitely).\n  // Holds the operator-tunable archival horizon (`archiveAfterDays`) consumed\n  // by the engine-owned `compliance:audit-logs-archive` batch. Records are\n  // never deleted (AUDIT_LOGS is immutable, G5) — see AuditTrailConfigSchema.\n  auditTrail: AuditTrailConfigSchema.optional(),\n\n});\n\n\nexport type AppConfiguration_Shared_Compliance = z.infer<typeof AppConfiguration_Shared_ComplianceSchema>;\nexport type AppConfiguration_Shared_AppIdentity = z.infer<typeof AppConfiguration_Shared_AppIdentity_Schema>;\nexport type AppConfiguration_Shared_AppPreferencesLanguage = z.infer<typeof AppConfiguration_Shared_AppPreferencesLanguage_Schema>;\nexport type AnalyticsProviderConfig = z.infer<typeof AnalyticsProviderConfigSchema>;\nexport type AppConfiguration_Shared_Runtime = z.infer<typeof AppConfiguration_Shared_RuntimeSchema>;\nexport type AutoInstrumentationConfig = z.infer<typeof AutoInstrumentationConfigSchema>;\nexport type AnalyticsConfig = z.infer<typeof AnalyticsConfigSchema>;\nexport type AppConfiguration_Shared_Auth = z.infer<typeof AppConfiguration_Shared_AuthSchema>;\nexport type AppConfiguration_Shared = z.infer<typeof AppConfiguration_Shared_Schema>;\n"]}