npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.6 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1399) hide show

package/dist/esm/config/auth-config-resolution.shared.utils.d.ts CHANGED Viewed

@@ -1,8 +1,8 @@
 /**
  * W5.8: Auth Config Resolution — 3-tier merge with org overrides.
  *
- * Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).
- * Multi-org: each org type override resolved independently, then most-restrictive across all.
+ * Resolution order: User Type (base) → Org Type authOverrides (login-method mode; other axes restrictive).
+ * Multi-org: explicit method overrides resolve independently and intersect; other axes merge restrictively.
  *
  * This is a pure function — no DI, no DB, no side effects.
  */
@@ -31,6 +31,26 @@ export interface ResolvedAuthConfig {
     stepUpAuth: StepUpAuthConfig | undefined;
 }
 export declare function getEnabledMethods(map: AuthMethodsMap | undefined): Set<AuthMethod>;
+/**
+ * The enabled methods a person can reach by SAYING WHO THEY ARE — the set the identifier step exists
+ * to serve.
+ *
+ * Derived, and total over the factor vocabulary: it is `getEnabledMethods` intersected with
+ * `AuthUtils.getFirstFactorMethods()`, which is the same pair of questions the backend asks when it
+ * answers `/auth/identify` (`_getAvailableFirstFactorMethods` walks that list and keeps the methods
+ * `authMethodsEnabled` admits). So a method added to the vocabulary tomorrow is classified by the map
+ * rather than by a list somebody has to remember to extend.
+ *
+ * A caller decides whether to OFFER the identifier step by asking whether this set is non-empty —
+ * never by asking whether one particular method is enabled. Gating it on `PASSWORD` is what hid the
+ * email field from a user type that signs in by magic link (#1219), for which the email address is the
+ * only thing the sign-in needs.
+ *
+ * Note what this does NOT answer: whether a given user can present a given method. That is per-user
+ * and belongs to the identify response; this is a question about the resolved POLICY, answerable
+ * before anyone has typed anything.
+ */
+export declare function getEnabledFirstFactorMethods(map: AuthMethodsMap | undefined): Set<AuthMethod>;
 /**
  * Auth methods that establish a LOCAL first-factor credential — a way into the account that does
  * NOT go through the organization's external identity provider. For an org whose users are
@@ -54,12 +74,64 @@ export declare const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMet
 /**
  * AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every
  * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies
- * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity
+ * this whenever the user holds an identity link for any ACTIVELY directory-managed org — whatever their
+ * membership's status there, since a deprovisioned or removed member keeps the block (#1151) — so the org's identity
  * posture wins over authored config — the same most-restrictive direction as the org-override merge.
  * This is the "one authority axis, derived" step: every first-factor login gate and every
  * credential-creation gate that reads the effective policy then honors directory management
  * automatically, without each site re-deriving it.
  */
 export declare function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap;
+/**
+ * The policy shape {@link resolveAcceptedSecondFactorMethods} needs. Structural rather than
+ * `UserTypeAuthPolicy` so a caller holding a partially-resolved policy — the orchestrator's
+ * fallback, a session snapshot, an authored config being validated at startup — can ask the same
+ * question without first assembling a whole policy object.
+ */
+export interface SecondFactorPolicyInput {
+    authMethodsEnabled?: AuthMethodsMap;
+    mfaPolicy?: {
+        acceptableMFAMethods?: AuthMethod[];
+        requireStrongMFA?: boolean;
+    };
+}
+/**
+ * The second-factor methods THIS policy accepts at a challenge, derived totally over the auth-method
+ * vocabulary.
+ *
+ * ```
+ * vocabulary (AUTH_METHOD_FACTOR_MAP: SECOND_ONLY | FIRST_OR_SECOND | ANY)
+ *   ∩ authMethodsEnabled
+ *   ∩ acceptableMFAMethods            (when authored non-empty — it NARROWS, never replaces)
+ *   − always-available                (when requireStrongMFA)
+ * ```
+ *
+ * **This function exists because the offer and the acceptance had drifted apart.** The challenge
+ * resolver intersected `acceptableMFAMethods`; the two sites that computed which methods to OFFER
+ * for enrollment filtered on `authMethodsEnabled` alone. So a policy enabling SMS OTP as a login
+ * method while accepting only `[TOTP, PASSKEY]` for MFA offered the user a phone enrollment the
+ * challenge would then refuse — an application could send someone to set up a factor it had already
+ * decided not to take. Both sides now read this, so they cannot disagree: the invariant is
+ * unbypassable rather than applied N times.
+ *
+ * **`requireStrongMFA` asks `isStrongSecondFactor`, which reads the method's CHANNEL.** It used to
+ * be expressed as "drop the always-available ones", on the reasoning that a factor needing no
+ * enrolment rides an address the account already proved and is therefore not an independent
+ * possession proof. That reached the right answer through a property that only coincides with the one
+ * it meant, and #1246 replaced the proxy with the thing itself. The resulting set is unchanged.
+ */
+export declare function resolveAcceptedSecondFactorMethods(policy: SecondFactorPolicyInput | undefined): AuthMethod[];
+/**
+ * The second-factor methods THIS policy accepts **and** that a user can actually enroll — the
+ * accepted set minus the ones that need no enrollment.
+ *
+ * This is what an enrollment surface offers. Listing an always-available factor there would render
+ * a setup step for something already set up, so the subtraction is semantic rather than cosmetic.
+ *
+ * An empty result is meaningful and not a bug: it means every factor the policy accepts is already
+ * available to this user, so there is nothing to enroll. (An empty ACCEPTED set is the real
+ * deadlock, and `application-startup-config-validator` refuses that at boot.)
+ */
+export declare function resolveEnrollableSecondFactorMethods(policy: SecondFactorPolicyInput | undefined): AuthMethod[];
 export declare function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig;
 //# sourceMappingURL=auth-config-resolution.shared.utils.d.ts.map

package/dist/esm/config/auth-config-resolution.shared.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-config-resolution.shared.utils.d.ts","sourceRoot":"","sources":["~~../../../~~src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"~~AAAA~~;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,~~EAAE~~,MAAM,2DAA2D,CAAC;~~AACvF~~,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAEjK,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAAC;AAEzF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,cAAc,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC1C;AAQD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAOlF;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,UAAU,EAK1E,CAAC;AAEF~~;;;;;;;;GAQG~~;AACH,wBAAgB,mCAAmC,CAAC,kBAAkB,EAAE,cAAc,GAAG,cAAc,CAMtG;~~AA8OD~~,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CA0BtF"}
1	+ {"version":3,"file":"auth-config-resolution.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAwB,MAAM,2DAA2D,CAAC;AAE7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAEjK,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAAC;AAEzF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,cAAc,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC1C;AAQD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAOlF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAG7F;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,UAAU,EAK1E,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,mCAAmC,CAAC,kBAAkB,EAAE,cAAc,GAAG,cAAc,CAMtG;AAID;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC,SAAS,CAAC,EAAE;QACV,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;QACpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,EAAE,CAqB5G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,EAAE,CAG9G;AAkPD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CA0BtF"}

package/dist/esm/config/auth-config-resolution.shared.utils.js CHANGED Viewed

@@ -1,12 +1,14 @@
+import { ExternalAssuranceEnforcement } from '../external-providers/provider-authentication-assurance.shared.schemas.js';
 /**
  * W5.8: Auth Config Resolution — 3-tier merge with org overrides.
  *
- * Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).
- * Multi-org: each org type override resolved independently, then most-restrictive across all.
+ * Resolution order: User Type (base) → Org Type authOverrides (login-method mode; other axes restrictive).
+ * Multi-org: explicit method overrides resolve independently and intersect; other axes merge restrictively.
  *
  * This is a pure function — no DI, no DB, no side effects.
  */
-import { AuthMethod } from '../security/authentications/authentication.shared.schemas.js';
+import { AuthMethod, isStrongSecondFactor } from '../security/authentications/authentication.shared.schemas.js';
+import { AuthUtils } from '../security/authentications/authentication.shared.utils.js';
 import { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas.js';
 function isMethodEnabled(value) {
     if (value === undefined)
@@ -25,6 +27,29 @@ export function getEnabledMethods(map) {
     }
     return result;
 }
+/**
+ * The enabled methods a person can reach by SAYING WHO THEY ARE — the set the identifier step exists
+ * to serve.
+ *
+ * Derived, and total over the factor vocabulary: it is `getEnabledMethods` intersected with
+ * `AuthUtils.getFirstFactorMethods()`, which is the same pair of questions the backend asks when it
+ * answers `/auth/identify` (`_getAvailableFirstFactorMethods` walks that list and keeps the methods
+ * `authMethodsEnabled` admits). So a method added to the vocabulary tomorrow is classified by the map
+ * rather than by a list somebody has to remember to extend.
+ *
+ * A caller decides whether to OFFER the identifier step by asking whether this set is non-empty —
+ * never by asking whether one particular method is enabled. Gating it on `PASSWORD` is what hid the
+ * email field from a user type that signs in by magic link (#1219), for which the email address is the
+ * only thing the sign-in needs.
+ *
+ * Note what this does NOT answer: whether a given user can present a given method. That is per-user
+ * and belongs to the identify response; this is a question about the resolved POLICY, answerable
+ * before anyone has typed anything.
+ */
+export function getEnabledFirstFactorMethods(map) {
+    const enabled = getEnabledMethods(map);
+    return new Set(AuthUtils.getFirstFactorMethods().filter((method) => enabled.has(method)));
+}
 function setToMethodsMap(methods) {
     const result = {};
     for (const method of Object.values(AuthMethod)) {
@@ -61,7 +86,8 @@ export const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS = [
 /**
  * AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every
  * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies
- * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity
+ * this whenever the user holds an identity link for any ACTIVELY directory-managed org — whatever their
+ * membership's status there, since a deprovisioned or removed member keeps the block (#1151) — so the org's identity
  * posture wins over authored config — the same most-restrictive direction as the org-override merge.
  * This is the "one authority axis, derived" step: every first-factor login gate and every
  * credential-creation gate that reads the effective policy then honors directory management
@@ -74,6 +100,65 @@ export function disableDirectoryIncompatibleMethods(authMethodsEnabled) {
     }
     return result;
 }
+/**
+ * The second-factor methods THIS policy accepts at a challenge, derived totally over the auth-method
+ * vocabulary.
+ *
+ * ```
+ * vocabulary (AUTH_METHOD_FACTOR_MAP: SECOND_ONLY | FIRST_OR_SECOND | ANY)
+ *   ∩ authMethodsEnabled
+ *   ∩ acceptableMFAMethods            (when authored non-empty — it NARROWS, never replaces)
+ *   − always-available                (when requireStrongMFA)
+ * ```
+ *
+ * **This function exists because the offer and the acceptance had drifted apart.** The challenge
+ * resolver intersected `acceptableMFAMethods`; the two sites that computed which methods to OFFER
+ * for enrollment filtered on `authMethodsEnabled` alone. So a policy enabling SMS OTP as a login
+ * method while accepting only `[TOTP, PASSKEY]` for MFA offered the user a phone enrollment the
+ * challenge would then refuse — an application could send someone to set up a factor it had already
+ * decided not to take. Both sides now read this, so they cannot disagree: the invariant is
+ * unbypassable rather than applied N times.
+ *
+ * **`requireStrongMFA` asks `isStrongSecondFactor`, which reads the method's CHANNEL.** It used to
+ * be expressed as "drop the always-available ones", on the reasoning that a factor needing no
+ * enrolment rides an address the account already proved and is therefore not an independent
+ * possession proof. That reached the right answer through a property that only coincides with the one
+ * it meant, and #1246 replaced the proxy with the thing itself. The resulting set is unchanged.
+ */
+export function resolveAcceptedSecondFactorMethods(policy) {
+    const enabled = getEnabledMethods(policy?.authMethodsEnabled);
+    const acceptable = policy?.mfaPolicy?.acceptableMFAMethods ?? [];
+    const acceptableSet = acceptable.length > 0 ? new Set(acceptable) : undefined;
+    /*
+     * `requireStrongMFA` now asks the method what it PROVES (#1246), instead of standing on the
+     * enrolment proxy. The set is identical today — `EMAIL_OTP` is the only second factor on the email
+     * channel and the only always-available one — but the two properties merely coincide: a second
+     * always-available factor on another channel would have been dropped for no reason, and a weak
+     * factor that did need enrolment would have passed. `isStrongSecondFactor` carries the reasoning
+     * and the citation.
+     */
+    const excluded = policy?.mfaPolicy?.requireStrongMFA
+        ? new Set(AuthUtils.getSecondFactorMethods().filter((method) => !isStrongSecondFactor(method)))
+        : undefined;
+    return AuthUtils.getSecondFactorMethods().filter((method) => enabled.has(method)
+        && (!acceptableSet || acceptableSet.has(method))
+        && (!excluded || !excluded.has(method)));
+}
+/**
+ * The second-factor methods THIS policy accepts **and** that a user can actually enroll — the
+ * accepted set minus the ones that need no enrollment.
+ *
+ * This is what an enrollment surface offers. Listing an always-available factor there would render
+ * a setup step for something already set up, so the subtraction is semantic rather than cosmetic.
+ *
+ * An empty result is meaningful and not a bug: it means every factor the policy accepts is already
+ * available to this user, so there is nothing to enroll. (An empty ACCEPTED set is the real
+ * deadlock, and `application-startup-config-validator` refuses that at boot.)
+ */
+export function resolveEnrollableSecondFactorMethods(policy) {
+    const alwaysAvailable = new Set(AuthUtils.getAlwaysAvailableSecondFactorMethods());
+    return resolveAcceptedSecondFactorMethods(policy).filter((method) => !alwaysAvailable.has(method));
+}
 // ─── Auth Methods Resolution ────────────────────────────────────────────────
 function resolveAuthMethodsSingle(userTypeMethods, orgOverride, policy, expandable) {
     if (!orgOverride?.authMethodsEnabled)
@@ -109,6 +194,8 @@ function resolveAuthMethodsMultiOrg(userTypeMethods, orgOverrides, policy, expan
 // ─── MFA Policy Resolution ─────────────────────────────────────────────────
 function resolveMfaPolicySingle(base, override) {
     return {
+        externalAssuranceEnforcement: base.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT || override.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT
+            ? ExternalAssuranceEnforcement.STRICT : ExternalAssuranceEnforcement.WARN,
         requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),
         requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),
         acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),
@@ -127,6 +214,8 @@ function resolveMfaPolicyMultiOrg(base, orgOverrides) {
 }
 function mergeMfaMostRestrictive(a, b) {
     return {
+        externalAssuranceEnforcement: a.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT || b.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT
+            ? ExternalAssuranceEnforcement.STRICT : ExternalAssuranceEnforcement.WARN,
         requireMFA: a.requireMFA || b.requireMFA,
         requireStrongMFA: a.requireStrongMFA || b.requireStrongMFA,
         acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),

package/dist/esm/config/auth-config-resolution.shared.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAyB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,mBAAmB,CAAC,IAAsB,EAAE,QAAmC;IACtF,OAAO;QACL,+FAA+F;QAC/F,+EAA+E;QAC/E,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,4FAA4F;QAC5F,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC;QAC/E,wFAAwF;QACxF,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAkC,EAClC,YAAoC;IAEpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,eAAe,GAAG,YAAY;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAErD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;QACjC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAC3D,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO;KACvE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YACjF,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;QACxF,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC;KACzE,CAAC;AACJ,CAAC","sourcesContent":["/*\n W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n \n Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).\n * Multi-org: each org type override resolved independently, then most-restrictive across all.\n \n This is a pure function — no DI, no DB, no side effects.\n /\n\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig, StepUpAuthConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean \| { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n userTypeAuth: UserTypeAuthPolicy;\n orgOverrides: OrgTypeAuthOverrides[];\n orgAuthMethodPolicy: OrgAuthMethodPolicy;\n expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n authMethodsEnabled: AuthMethodsMap;\n mfaPolicy: MfaPolicyConfig;\n passwordPolicy: PasswordPolicyConfig;\n /\n Re-authentication freshness (#527). `undefined` when the user type declares no step-up policy —\n * an organisation cannot introduce step-up for a user type that has none, because there is no base\n * to be more restrictive THAN, and inventing one would let a tenant enable a gate the application\n * never configured.\n /\n stepUpAuth: StepUpAuthConfig \| undefined;\n}\n\nfunction isMethodEnabled(value: boolean \| { enabled: boolean } \| undefined): boolean {\n if (value === undefined) return false;\n if (typeof value === 'boolean') return value;\n return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap \| undefined): Set<AuthMethod> {\n if (!map) return new Set();\n const result = new Set<AuthMethod>();\n for (const [method, value] of Object.entries(map)) {\n if (isMethodEnabled(value)) result.add(method as AuthMethod);\n }\n return result;\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n const result: AuthMethodsMap = {};\n for (const method of Object.values(AuthMethod)) {\n result[method] = methods.has(method);\n }\n return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/\n Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n \n `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n /\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.PASSKEY,\n AuthMethod.MAGIC_LINK,\n AuthMethod.SMS_OTP,\n];\n\n/\n AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n /\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n const result: AuthMethodsMap = { ...authMethodsEnabled };\n for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n result[method] = false;\n }\n return result;\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n userTypeMethods: Set<AuthMethod>,\n orgOverride: OrgTypeAuthOverrides,\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n switch (policy) {\n case OrgAuthMethodPolicy.RESTRICT_ONLY:\n return intersection(userTypeMethods, orgMethods);\n\n case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n const expandableSet = new Set(expandable);\n const expansions = intersection(orgMethods, expandableSet);\n return union(userTypeMethods, expansions);\n }\n\n case OrgAuthMethodPolicy.UNRESTRICTED:\n return new Set(orgMethods);\n\n default:\n return new Set(userTypeMethods);\n }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n userTypeMethods: Set<AuthMethod>,\n orgOverrides: OrgTypeAuthOverrides[],\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n const perOrgResults = validOverrides.map(o =>\n resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n );\n\n if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n // Each org may expand within the expandable set, but multi-org users only get\n // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n }\n\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n base: MfaPolicyConfig,\n override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n return {\n requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n base: MfaPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n const mfaOverrides = orgOverrides\n .map(o => o?.mfaPolicy)\n .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n if (mfaOverrides.length === 0) return { ...base };\n\n const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n return {\n requireMFA: a.requireMFA \|\| b.requireMFA,\n requireStrongMFA: a.requireStrongMFA \|\| b.requireStrongMFA,\n acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n };\n}\n\n// ─── Step-Up Auth Resolution ────────────────────────────────────────────────\n\nfunction resolveStepUpSingle(base: StepUpAuthConfig, override: Partial<StepUpAuthConfig>): StepUpAuthConfig {\n return {\n // Either side turning step-up ON wins: an organisation may require re-authentication where the\n // application does not, and may never switch off one the application requires.\n enabled: base.enabled \|\| (override.enabled ?? false),\n // The SHORTER window wins — the opposite arithmetic to `enabled`, same direction of intent.\n maxAgeSeconds: mergeNumberLowerWins(base.maxAgeSeconds, override.maxAgeSeconds),\n // Intersection: an organisation may WITHDRAW an acceptable method, never introduce one.\n methods: mergeArrayIntersection(base.methods, override.methods) ?? base.methods,\n };\n}\n\nfunction resolveStepUpMultiOrg(\n base: StepUpAuthConfig \| undefined,\n orgOverrides: OrgTypeAuthOverrides[],\n): StepUpAuthConfig \| undefined {\n if (base === undefined) return undefined;\n const stepUpOverrides = orgOverrides\n .map(o => o?.stepUpAuth)\n .filter((p): p is Partial<StepUpAuthConfig> => !!p);\n if (stepUpOverrides.length === 0) return { ...base };\n\n const perOrgResults = stepUpOverrides.map(o => resolveStepUpSingle(base, o));\n return perOrgResults.reduce((acc, r) => ({\n enabled: acc.enabled \|\| r.enabled,\n maxAgeSeconds: Math.min(acc.maxAgeSeconds, r.maxAgeSeconds),\n methods: mergeArrayIntersection(acc.methods, r.methods) ?? acc.methods,\n }));\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n base: PasswordPolicyConfig,\n override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n return {\n minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n base: PasswordPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n const pwOverrides = orgOverrides\n .map(o => o?.passwordPolicy)\n .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n if (pwOverrides.length === 0) return { ...base };\n\n const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n return normalizePasswordPolicyBounds(\n perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n return normalizePasswordPolicyBounds({\n minLength: Math.max(a.minLength, b.minLength),\n maxLength: Math.min(a.maxLength, b.maxLength),\n requireUppercase: a.requireUppercase \|\| b.requireUppercase,\n requireLowercase: a.requireLowercase \|\| b.requireLowercase,\n requireNumbers: a.requireNumbers \|\| b.requireNumbers,\n requireSpecialChars: a.requireSpecialChars \|\| b.requireSpecialChars,\n expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n });\n}\n\n/\n Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n if (policy.maxLength >= policy.minLength) {\n return policy;\n }\n\n return {\n ...policy,\n maxLength: policy.minLength,\n };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base \|\| override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n if (base === 0 && override === 0) return 0;\n if (base === 0) return override;\n if (override === 0) return base;\n return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] \| undefined, b: T[] \| undefined): T[] \| undefined {\n if (a === undefined) return b;\n if (b === undefined) return a;\n const setB = new Set(b);\n return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n const result = new Set<T>();\n for (const item of a) {\n if (b.has(item)) result.add(item);\n }\n return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n if (!orgOverrides.length) {\n return {\n authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n mfaPolicy: { ...userTypeAuth.mfaPolicy },\n passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n stepUpAuth: userTypeAuth.stepUpAuth ? { ...userTypeAuth.stepUpAuth } : undefined,\n };\n }\n\n const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n const resolvedMethods = resolveAuthMethodsMultiOrg(\n userTypeMethods,\n orgOverrides,\n orgAuthMethodPolicy,\n expandableOrgMethods ?? [],\n );\n\n return {\n authMethodsEnabled: setToMethodsMap(resolvedMethods),\n mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n stepUpAuth: resolveStepUpMultiOrg(userTypeAuth.stepUpAuth, orgOverrides),\n };\n}\n"]}
1	+ {"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAyB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAA+B;IAC1E,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAA2C;IAC5F,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,EAAE,SAAS,EAAE,oBAAoB,IAAI,EAAE,CAAC;IACjE,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E;;;;;;;OAOG;IACH,MAAM,QAAQ,GAAG,MAAM,EAAE,SAAS,EAAE,gBAAgB;QAClD,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,SAAS,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAC9C,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;WAC1B,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;WAC7C,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oCAAoC,CAAC,MAA2C;IAC9F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,qCAAqC,EAAE,CAAC,CAAC;IACnF,OAAO,kCAAkC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,4BAA4B,EAAE,IAAI,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM,IAAI,QAAQ,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM;YACtL,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,IAAI;QAC3E,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,4BAA4B,EAAE,CAAC,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM,IAAI,CAAC,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM;YAC5K,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,IAAI;QAC3E,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,mBAAmB,CAAC,IAAsB,EAAE,QAAmC;IACtF,OAAO;QACL,+FAA+F;QAC/F,+EAA+E;QAC/E,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,4FAA4F;QAC5F,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC;QAC/E,wFAAwF;QACxF,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAkC,EAClC,YAAoC;IAEpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,eAAe,GAAG,YAAY;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAErD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;QACjC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAC3D,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO;KACvE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YACjF,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;QACxF,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC;KACzE,CAAC;AACJ,CAAC","sourcesContent":["import { ExternalAssuranceEnforcement } from '../external-providers/provider-authentication-assurance.shared.schemas';\n/*\n W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n \n Resolution order: User Type (base) → Org Type authOverrides (login-method mode; other axes restrictive).\n * Multi-org: explicit method overrides resolve independently and intersect; other axes merge restrictively.\n \n This is a pure function — no DI, no DB, no side effects.\n /\n\nimport { AuthMethod, isStrongSecondFactor } from '../security/authentications/authentication.shared.schemas';\nimport { AuthUtils } from '../security/authentications/authentication.shared.utils';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig, StepUpAuthConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean \| { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n userTypeAuth: UserTypeAuthPolicy;\n orgOverrides: OrgTypeAuthOverrides[];\n orgAuthMethodPolicy: OrgAuthMethodPolicy;\n expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n authMethodsEnabled: AuthMethodsMap;\n mfaPolicy: MfaPolicyConfig;\n passwordPolicy: PasswordPolicyConfig;\n /\n Re-authentication freshness (#527). `undefined` when the user type declares no step-up policy —\n * an organisation cannot introduce step-up for a user type that has none, because there is no base\n * to be more restrictive THAN, and inventing one would let a tenant enable a gate the application\n * never configured.\n /\n stepUpAuth: StepUpAuthConfig \| undefined;\n}\n\nfunction isMethodEnabled(value: boolean \| { enabled: boolean } \| undefined): boolean {\n if (value === undefined) return false;\n if (typeof value === 'boolean') return value;\n return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap \| undefined): Set<AuthMethod> {\n if (!map) return new Set();\n const result = new Set<AuthMethod>();\n for (const [method, value] of Object.entries(map)) {\n if (isMethodEnabled(value)) result.add(method as AuthMethod);\n }\n return result;\n}\n\n/\n The enabled methods a person can reach by SAYING WHO THEY ARE — the set the identifier step exists\n * to serve.\n \n Derived, and total over the factor vocabulary: it is `getEnabledMethods` intersected with\n * `AuthUtils.getFirstFactorMethods()`, which is the same pair of questions the backend asks when it\n * answers `/auth/identify` (`_getAvailableFirstFactorMethods` walks that list and keeps the methods\n * `authMethodsEnabled` admits). So a method added to the vocabulary tomorrow is classified by the map\n * rather than by a list somebody has to remember to extend.\n \n A caller decides whether to OFFER the identifier step by asking whether this set is non-empty —\n * never by asking whether one particular method is enabled. Gating it on `PASSWORD` is what hid the\n * email field from a user type that signs in by magic link (#1219), for which the email address is the\n * only thing the sign-in needs.\n \n Note what this does NOT answer: whether a given user can present a given method. That is per-user\n * and belongs to the identify response; this is a question about the resolved POLICY, answerable\n * before anyone has typed anything.\n /\nexport function getEnabledFirstFactorMethods(map: AuthMethodsMap \| undefined): Set<AuthMethod> {\n const enabled = getEnabledMethods(map);\n return new Set(AuthUtils.getFirstFactorMethods().filter((method) => enabled.has(method)));\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n const result: AuthMethodsMap = {};\n for (const method of Object.values(AuthMethod)) {\n result[method] = methods.has(method);\n }\n return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/\n Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n \n `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n /\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.PASSKEY,\n AuthMethod.MAGIC_LINK,\n AuthMethod.SMS_OTP,\n];\n\n/\n AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user holds an identity link for any ACTIVELY directory-managed org — whatever their\n * membership's status there, since a deprovisioned or removed member keeps the block (#1151) — so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n /\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n const result: AuthMethodsMap = { ...authMethodsEnabled };\n for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n result[method] = false;\n }\n return result;\n}\n\n// ─── Second-factor set resolution (THE one rule) ─────────────────────────────\n\n/\n The policy shape {@link resolveAcceptedSecondFactorMethods} needs. Structural rather than\n * `UserTypeAuthPolicy` so a caller holding a partially-resolved policy — the orchestrator's\n * fallback, a session snapshot, an authored config being validated at startup — can ask the same\n * question without first assembling a whole policy object.\n /\nexport interface SecondFactorPolicyInput {\n authMethodsEnabled?: AuthMethodsMap;\n mfaPolicy?: {\n acceptableMFAMethods?: AuthMethod[];\n requireStrongMFA?: boolean;\n };\n}\n\n/\n The second-factor methods THIS policy accepts at a challenge, derived totally over the auth-method\n * vocabulary.\n \n ```\n * vocabulary (AUTH_METHOD_FACTOR_MAP: SECOND_ONLY \| FIRST_OR_SECOND \| ANY)\n * ∩ authMethodsEnabled\n * ∩ acceptableMFAMethods (when authored non-empty — it NARROWS, never replaces)\n * − always-available (when requireStrongMFA)\n * ```\n \n This function exists because the offer and the acceptance had drifted apart. The challenge\n * resolver intersected `acceptableMFAMethods`; the two sites that computed which methods to OFFER\n * for enrollment filtered on `authMethodsEnabled` alone. So a policy enabling SMS OTP as a login\n * method while accepting only `[TOTP, PASSKEY]` for MFA offered the user a phone enrollment the\n * challenge would then refuse — an application could send someone to set up a factor it had already\n * decided not to take. Both sides now read this, so they cannot disagree: the invariant is\n * unbypassable rather than applied N times.\n \n `requireStrongMFA` asks `isStrongSecondFactor`, which reads the method's CHANNEL. It used to\n * be expressed as \"drop the always-available ones\", on the reasoning that a factor needing no\n * enrolment rides an address the account already proved and is therefore not an independent\n * possession proof. That reached the right answer through a property that only coincides with the one\n * it meant, and #1246 replaced the proxy with the thing itself. The resulting set is unchanged.\n /\nexport function resolveAcceptedSecondFactorMethods(policy: SecondFactorPolicyInput \| undefined): AuthMethod[] {\n const enabled = getEnabledMethods(policy?.authMethodsEnabled);\n const acceptable = policy?.mfaPolicy?.acceptableMFAMethods ?? [];\n const acceptableSet = acceptable.length > 0 ? new Set(acceptable) : undefined;\n /\n * `requireStrongMFA` now asks the method what it PROVES (#1246), instead of standing on the\n * enrolment proxy. The set is identical today — `EMAIL_OTP` is the only second factor on the email\n * channel and the only always-available one — but the two properties merely coincide: a second\n * always-available factor on another channel would have been dropped for no reason, and a weak\n * factor that did need enrolment would have passed. `isStrongSecondFactor` carries the reasoning\n * and the citation.\n /\n const excluded = policy?.mfaPolicy?.requireStrongMFA\n ? new Set(AuthUtils.getSecondFactorMethods().filter((method) => !isStrongSecondFactor(method)))\n : undefined;\n\n return AuthUtils.getSecondFactorMethods().filter(\n (method) => enabled.has(method)\n && (!acceptableSet \|\| acceptableSet.has(method))\n && (!excluded \|\| !excluded.has(method)),\n );\n}\n\n/\n The second-factor methods THIS policy accepts and that a user can actually enroll — the\n * accepted set minus the ones that need no enrollment.\n \n This is what an enrollment surface offers. Listing an always-available factor there would render\n * a setup step for something already set up, so the subtraction is semantic rather than cosmetic.\n \n An empty result is meaningful and not a bug: it means every factor the policy accepts is already\n * available to this user, so there is nothing to enroll. (An empty ACCEPTED set is the real\n * deadlock, and `application-startup-config-validator` refuses that at boot.)\n /\nexport function resolveEnrollableSecondFactorMethods(policy: SecondFactorPolicyInput \| undefined): AuthMethod[] {\n const alwaysAvailable = new Set(AuthUtils.getAlwaysAvailableSecondFactorMethods());\n return resolveAcceptedSecondFactorMethods(policy).filter((method) => !alwaysAvailable.has(method));\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n userTypeMethods: Set<AuthMethod>,\n orgOverride: OrgTypeAuthOverrides,\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n switch (policy) {\n case OrgAuthMethodPolicy.RESTRICT_ONLY:\n return intersection(userTypeMethods, orgMethods);\n\n case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n const expandableSet = new Set(expandable);\n const expansions = intersection(orgMethods, expandableSet);\n return union(userTypeMethods, expansions);\n }\n\n case OrgAuthMethodPolicy.UNRESTRICTED:\n return new Set(orgMethods);\n\n default:\n return new Set(userTypeMethods);\n }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n userTypeMethods: Set<AuthMethod>,\n orgOverrides: OrgTypeAuthOverrides[],\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n const perOrgResults = validOverrides.map(o =>\n resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n );\n\n if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n // Each org may expand within the expandable set, but multi-org users only get\n // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n }\n\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n base: MfaPolicyConfig,\n override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n return {\n externalAssuranceEnforcement: base.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT \|\| override.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT\n ? ExternalAssuranceEnforcement.STRICT : ExternalAssuranceEnforcement.WARN,\n requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n base: MfaPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n const mfaOverrides = orgOverrides\n .map(o => o?.mfaPolicy)\n .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n if (mfaOverrides.length === 0) return { ...base };\n\n const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n return {\n externalAssuranceEnforcement: a.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT \|\| b.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT\n ? ExternalAssuranceEnforcement.STRICT : ExternalAssuranceEnforcement.WARN,\n requireMFA: a.requireMFA \|\| b.requireMFA,\n requireStrongMFA: a.requireStrongMFA \|\| b.requireStrongMFA,\n acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n };\n}\n\n// ─── Step-Up Auth Resolution ────────────────────────────────────────────────\n\nfunction resolveStepUpSingle(base: StepUpAuthConfig, override: Partial<StepUpAuthConfig>): StepUpAuthConfig {\n return {\n // Either side turning step-up ON wins: an organisation may require re-authentication where the\n // application does not, and may never switch off one the application requires.\n enabled: base.enabled \|\| (override.enabled ?? false),\n // The SHORTER window wins — the opposite arithmetic to `enabled`, same direction of intent.\n maxAgeSeconds: mergeNumberLowerWins(base.maxAgeSeconds, override.maxAgeSeconds),\n // Intersection: an organisation may WITHDRAW an acceptable method, never introduce one.\n methods: mergeArrayIntersection(base.methods, override.methods) ?? base.methods,\n };\n}\n\nfunction resolveStepUpMultiOrg(\n base: StepUpAuthConfig \| undefined,\n orgOverrides: OrgTypeAuthOverrides[],\n): StepUpAuthConfig \| undefined {\n if (base === undefined) return undefined;\n const stepUpOverrides = orgOverrides\n .map(o => o?.stepUpAuth)\n .filter((p): p is Partial<StepUpAuthConfig> => !!p);\n if (stepUpOverrides.length === 0) return { ...base };\n\n const perOrgResults = stepUpOverrides.map(o => resolveStepUpSingle(base, o));\n return perOrgResults.reduce((acc, r) => ({\n enabled: acc.enabled \|\| r.enabled,\n maxAgeSeconds: Math.min(acc.maxAgeSeconds, r.maxAgeSeconds),\n methods: mergeArrayIntersection(acc.methods, r.methods) ?? acc.methods,\n }));\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n base: PasswordPolicyConfig,\n override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n return {\n minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n base: PasswordPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n const pwOverrides = orgOverrides\n .map(o => o?.passwordPolicy)\n .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n if (pwOverrides.length === 0) return { ...base };\n\n const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n return normalizePasswordPolicyBounds(\n perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n return normalizePasswordPolicyBounds({\n minLength: Math.max(a.minLength, b.minLength),\n maxLength: Math.min(a.maxLength, b.maxLength),\n requireUppercase: a.requireUppercase \|\| b.requireUppercase,\n requireLowercase: a.requireLowercase \|\| b.requireLowercase,\n requireNumbers: a.requireNumbers \|\| b.requireNumbers,\n requireSpecialChars: a.requireSpecialChars \|\| b.requireSpecialChars,\n expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n });\n}\n\n/\n Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n if (policy.maxLength >= policy.minLength) {\n return policy;\n }\n\n return {\n ...policy,\n maxLength: policy.minLength,\n };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base \|\| override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n if (base === 0 && override === 0) return 0;\n if (base === 0) return override;\n if (override === 0) return base;\n return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] \| undefined, b: T[] \| undefined): T[] \| undefined {\n if (a === undefined) return b;\n if (b === undefined) return a;\n const setB = new Set(b);\n return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n const result = new Set<T>();\n for (const item of a) {\n if (b.has(item)) result.add(item);\n }\n return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n if (!orgOverrides.length) {\n return {\n authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n mfaPolicy: { ...userTypeAuth.mfaPolicy },\n passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n stepUpAuth: userTypeAuth.stepUpAuth ? { ...userTypeAuth.stepUpAuth } : undefined,\n };\n }\n\n const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n const resolvedMethods = resolveAuthMethodsMultiOrg(\n userTypeMethods,\n orgOverrides,\n orgAuthMethodPolicy,\n expandableOrgMethods ?? [],\n );\n\n return {\n authMethodsEnabled: setToMethodsMap(resolvedMethods),\n mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n stepUpAuth: resolveStepUpMultiOrg(userTypeAuth.stepUpAuth, orgOverrides),\n };\n}\n"]}

package/dist/esm/config/brand-assets.shared.schemas.d.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import '@wildo-ai/zod-decorators';
 /**
  * RUNTIME brand-asset representation — the servable projection of the
  * authored/generated brand identity, importable by every runtime consumer
@@ -49,11 +50,11 @@ export declare enum BrandAssetFormat {
     WEBP = "WEBP"
 }
 declare const _RuntimeBrandAssetSchema: z.ZodObject<{
-    composition: z.ZodEnum<typeof BrandAssetComposition>;
-    theme: z.ZodEnum<typeof BrandAssetTheme>;
-    purpose: z.ZodEnum<typeof BrandAssetPurpose>;
+    composition: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof BrandAssetComposition>>;
+    theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof BrandAssetTheme>>;
+    purpose: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof BrandAssetPurpose>>;
     url: z.ZodString;
-    format: z.ZodEnum<typeof BrandAssetFormat>;
+    format: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof BrandAssetFormat>>;
     width: z.ZodOptional<z.ZodNumber>;
     height: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;

package/dist/esm/config/brand-assets.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"brand-assets.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;~~AAExB~~;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAED,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,UAAU,eAAe;CAC1B;AAED,oBAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,MAAM,WAAW;IACjB,mFAAmF;IACnF,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,oBAAY,gBAAgB;IAC1B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;~~AAED~~,QAAA,MAAM,wBAAwB;;;;;;;;iBAS5B,CAAC;AACH,eAAO,MAAM,uBAAuB,EAAE,OAAO,wBAAmD,CAAC;AACjG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,qBAAqB,CAAC;IACnC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,KAAK,EAAE,eAAe,GACrB,iBAAiB,GAAG,SAAS,CAsB/B"}
1	+ {"version":3,"file":"brand-assets.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAED,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,UAAU,eAAe;CAC1B;AAED,oBAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,MAAM,WAAW;IACjB,mFAAmF;IACnF,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,oBAAY,gBAAgB;IAC1B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AASD,QAAA,MAAM,wBAAwB;;;;;;;;iBAS5B,CAAC;AACH,eAAO,MAAM,uBAAuB,EAAE,OAAO,wBAAmD,CAAC;AACjG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,qBAAqB,CAAC;IACnC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,KAAK,EAAE,eAAe,GACrB,iBAAiB,GAAG,SAAS,CAsB/B"}

package/dist/esm/config/brand-assets.shared.schemas.js CHANGED Viewed

@@ -1,4 +1,7 @@
 import { z } from 'zod';
+// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —
+// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.
+import '@wildo-ai/zod-decorators';
 /**
  * RUNTIME brand-asset representation — the servable projection of the
  * authored/generated brand identity, importable by every runtime consumer
@@ -52,13 +55,20 @@ export var BrandAssetFormat;
     BrandAssetFormat["ICO"] = "ICO";
     BrandAssetFormat["WEBP"] = "WEBP";
 })(BrandAssetFormat || (BrandAssetFormat = {}));
+/*
+ * Each vocabulary is DECLARED under the same name as its authoring counterpart in
+ * `@wildo-ai/saas-specifications` (`BrandAssetConfig`), so a surface that words a runtime asset reads the
+ * same `system_enums.<name>` block as the brand document does (#966). Measured 2026-09-13: no label walk
+ * reaches this schema today (it lives in application configuration, not in a resource or an aspect), so
+ * the declaration costs nothing and keeps the first such surface from rendering raw.
+ */
 const _RuntimeBrandAssetSchema = z.object({
-    composition: z.enum(BrandAssetComposition),
-    theme: z.enum(BrandAssetTheme),
-    purpose: z.enum(BrandAssetPurpose),
+    composition: z.enum(BrandAssetComposition).systemEnum('BrandAssetComposition'),
+    theme: z.enum(BrandAssetTheme).systemEnum('BrandAssetTheme'),
+    purpose: z.enum(BrandAssetPurpose).systemEnum('BrandAssetPurpose'),
     /** A servable URL or app-relative path for the asset file. */
     url: z.string().min(1),
-    format: z.enum(BrandAssetFormat),
+    format: z.enum(BrandAssetFormat).systemEnum('BrandAssetFormat'),
     width: z.number().int().positive().optional(),
     height: z.number().int().positive().optional(),
 });

package/dist/esm/config/brand-assets.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"brand-assets.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;~~AAExB~~;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,8CAAqB,CAAA;IACrB,0CAAiB,CAAA;AACnB,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,sCAAmB,CAAA;IACnB,gCAAa,CAAA;IACb,kCAAe,CAAA;IACf,4CAAyB,CAAA;AAC3B,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED,MAAM,CAAN,IAAY,iBAeX;AAfD,WAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,sCAAiB,CAAA;IACjB,mFAAmF;IACnF,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;IACnB,0DAAqC,CAAA;IACrC,oDAA+B,CAAA;IAC/B,0CAAqB,CAAA;IACrB,oCAAe,CAAA;AACjB,CAAC,EAfW,iBAAiB,KAAjB,iBAAiB,QAe5B;AAED,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,+BAAW,CAAA;IACX,+BAAW,CAAA;IACX,+BAAW,CAAA;IACX,iCAAa,CAAA;AACf,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;~~IAC1C~~,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;~~IAC9B~~,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;~~IAClC~~,8DAA8D;IAC9D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;~~IAChC~~,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAoC,wBAAwB,CAAC;AAUjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA2B,EAC3B,KAAsB;IAEtB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC;IAE3D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CACzF,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAC3G,CAAC;IACF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,CAAC,OAAO,CAC7H,CAAC;IACF,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAElD,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,CAAC,OAAO,CACtF,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/*\n RUNTIME brand-asset representation — the servable projection of the\n * authored/generated brand identity, importable by every runtime consumer\n * (app shell, org branding, email, auth, website, docs).\n \n WHY A RUNTIME SIBLING: the authoring/spec `BrandAssetConfig` lives in\n * `@wildo-ai/saas-specifications`, which sits BELOW `saas-models` in the\n * dependency graph — runtime consumers (this package and above) cannot import\n * it. This is the runtime counterpart the companion PROJECTS the generated\n * brand manifest into: a flat list of `(composition × theme × purpose) → url`\n * entries a consumer resolves against by the axes it cares about (the app-shell\n * header asks for `(LOCKUP, DEFAULT)`, the favicon for `(SYMBOL, DEFAULT,\n * FAVICON)`). Enum VALUES are kept identical to the spec enums so the\n * companion's projection is a value-preserving map — a value present in one\n * enum and not the other makes `projectResolvedAssets` throw, by design.\n /\nexport enum BrandAssetComposition {\n SYMBOL = 'SYMBOL',\n WORDMARK = 'WORDMARK',\n LOCKUP = 'LOCKUP',\n}\n\nexport enum BrandAssetTheme {\n DEFAULT = 'DEFAULT',\n DARK = 'DARK',\n LIGHT = 'LIGHT',\n MONOCHROME = 'MONOCHROME',\n}\n\nexport enum BrandAssetPurpose {\n /\n Full-resolution generated source — print, high-DPI export, re-derivation.\n * Reachable ONLY by an exact {@link resolveBrandAsset} query: it is\n * deliberately absent from every fallback rung, so no consumer is ever handed\n * an unbounded file it did not ask for. A UI surface wants {@link PRIMARY}.\n /\n MASTER = 'MASTER',\n /* The base DISPLAY form of a (composition, theme) — what a UI surface renders. /\n PRIMARY = 'PRIMARY',\n FAVICON = 'FAVICON',\n APPLE_TOUCH_ICON = 'APPLE_TOUCH_ICON',\n MASKABLE_ICON = 'MASKABLE_ICON',\n OG_IMAGE = 'OG_IMAGE',\n EMAIL = 'EMAIL',\n}\n\nexport enum BrandAssetFormat {\n PNG = 'PNG',\n SVG = 'SVG',\n ICO = 'ICO',\n WEBP = 'WEBP',\n}\n\nconst _RuntimeBrandAssetSchema = z.object({\n composition: z.enum(BrandAssetComposition),\n theme: z.enum(BrandAssetTheme),\n purpose: z.enum(BrandAssetPurpose),\n /* A servable URL or app-relative path for the asset file. /\n url: z.string().min(1),\n format: z.enum(BrandAssetFormat),\n width: z.number().int().positive().optional(),\n height: z.number().int().positive().optional(),\n});\nexport const RuntimeBrandAssetSchema: typeof _RuntimeBrandAssetSchema = _RuntimeBrandAssetSchema;\nexport type RuntimeBrandAsset = z.infer<typeof _RuntimeBrandAssetSchema>;\n\n/* A resolution query — composition is required; theme/purpose default sensibly. /\nexport interface BrandAssetQuery {\n composition: BrandAssetComposition;\n theme?: BrandAssetTheme;\n purpose?: BrandAssetPurpose;\n}\n\n/\n Resolves the best runtime brand asset for a query, with graceful fallbacks so\n * a consumer always gets something when a specific variant was not generated:\n \n 1. exact `(composition, theme, purpose)` match, else\n * 2. same `(composition, purpose)` at `theme: DEFAULT`, else\n * 3. same `composition` at `(DEFAULT, PRIMARY)`, else\n * 4. any `(DEFAULT, PRIMARY)` asset, else `undefined`.\n \n NOTE RUNGS 3 AND 4 BOTH TARGET `PRIMARY`: it is the universal last-resort, so\n * whatever occupies it is what every unresolved query in the system degrades to.\n * That is why {@link BrandAssetPurpose.MASTER} exists as a separate slot and\n * appears on NO rung here — the full-resolution source must be asked for by an\n * exact query (rung 1) and can never be handed to a consumer by a fallback.\n * Keep it that way when editing the ladder.\n \n Returns `undefined` when the list is empty (no brand generated yet) — the\n * caller keeps its existing fallback (e.g. a placeholder or the legacy URL).\n */\nexport function resolveBrandAsset(\n assets: RuntimeBrandAsset[],\n query: BrandAssetQuery,\n): RuntimeBrandAsset \| undefined {\n const theme = query.theme ?? BrandAssetTheme.DEFAULT;\n const purpose = query.purpose ?? BrandAssetPurpose.PRIMARY;\n\n const exact = assets.find(\n (a) => a.composition === query.composition && a.theme === theme && a.purpose === purpose,\n );\n if (exact) return exact;\n\n const themeFallback = assets.find(\n (a) => a.composition === query.composition && a.theme === BrandAssetTheme.DEFAULT && a.purpose === purpose,\n );\n if (themeFallback) return themeFallback;\n\n const compositionPrimary = assets.find(\n (a) => a.composition === query.composition && a.theme === BrandAssetTheme.DEFAULT && a.purpose === BrandAssetPurpose.PRIMARY,\n );\n if (compositionPrimary) return compositionPrimary;\n\n return assets.find(\n (a) => a.theme === BrandAssetTheme.DEFAULT && a.purpose === BrandAssetPurpose.PRIMARY,\n );\n}\n"]}
1	+ {"version":3,"file":"brand-assets.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,8CAAqB,CAAA;IACrB,0CAAiB,CAAA;AACnB,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,sCAAmB,CAAA;IACnB,gCAAa,CAAA;IACb,kCAAe,CAAA;IACf,4CAAyB,CAAA;AAC3B,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED,MAAM,CAAN,IAAY,iBAeX;AAfD,WAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,sCAAiB,CAAA;IACjB,mFAAmF;IACnF,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;IACnB,0DAAqC,CAAA;IACrC,oDAA+B,CAAA;IAC/B,0CAAqB,CAAA;IACrB,oCAAe,CAAA;AACjB,CAAC,EAfW,iBAAiB,KAAjB,iBAAiB,QAe5B;AAED,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,+BAAW,CAAA;IACX,+BAAW,CAAA;IACX,+BAAW,CAAA;IACX,iCAAa,CAAA;AACf,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC;IAC9E,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAClE,8DAA8D;IAC9D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC;IAC/D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAoC,wBAAwB,CAAC;AAUjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA2B,EAC3B,KAAsB;IAEtB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC;IAE3D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CACzF,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAC3G,CAAC;IACF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,CAAC,OAAO,CAC7H,CAAC;IACF,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAElD,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,CAAC,OAAO,CACtF,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\n\n/*\n RUNTIME brand-asset representation — the servable projection of the\n * authored/generated brand identity, importable by every runtime consumer\n * (app shell, org branding, email, auth, website, docs).\n \n WHY A RUNTIME SIBLING: the authoring/spec `BrandAssetConfig` lives in\n * `@wildo-ai/saas-specifications`, which sits BELOW `saas-models` in the\n * dependency graph — runtime consumers (this package and above) cannot import\n * it. This is the runtime counterpart the companion PROJECTS the generated\n * brand manifest into: a flat list of `(composition × theme × purpose) → url`\n * entries a consumer resolves against by the axes it cares about (the app-shell\n * header asks for `(LOCKUP, DEFAULT)`, the favicon for `(SYMBOL, DEFAULT,\n * FAVICON)`). Enum VALUES are kept identical to the spec enums so the\n * companion's projection is a value-preserving map — a value present in one\n * enum and not the other makes `projectResolvedAssets` throw, by design.\n /\nexport enum BrandAssetComposition {\n SYMBOL = 'SYMBOL',\n WORDMARK = 'WORDMARK',\n LOCKUP = 'LOCKUP',\n}\n\nexport enum BrandAssetTheme {\n DEFAULT = 'DEFAULT',\n DARK = 'DARK',\n LIGHT = 'LIGHT',\n MONOCHROME = 'MONOCHROME',\n}\n\nexport enum BrandAssetPurpose {\n /\n Full-resolution generated source — print, high-DPI export, re-derivation.\n * Reachable ONLY by an exact {@link resolveBrandAsset} query: it is\n * deliberately absent from every fallback rung, so no consumer is ever handed\n * an unbounded file it did not ask for. A UI surface wants {@link PRIMARY}.\n /\n MASTER = 'MASTER',\n /* The base DISPLAY form of a (composition, theme) — what a UI surface renders. /\n PRIMARY = 'PRIMARY',\n FAVICON = 'FAVICON',\n APPLE_TOUCH_ICON = 'APPLE_TOUCH_ICON',\n MASKABLE_ICON = 'MASKABLE_ICON',\n OG_IMAGE = 'OG_IMAGE',\n EMAIL = 'EMAIL',\n}\n\nexport enum BrandAssetFormat {\n PNG = 'PNG',\n SVG = 'SVG',\n ICO = 'ICO',\n WEBP = 'WEBP',\n}\n\n/\n * Each vocabulary is DECLARED under the same name as its authoring counterpart in\n * `@wildo-ai/saas-specifications` (`BrandAssetConfig`), so a surface that words a runtime asset reads the\n * same `system_enums.<name>` block as the brand document does (#966). Measured 2026-09-13: no label walk\n * reaches this schema today (it lives in application configuration, not in a resource or an aspect), so\n * the declaration costs nothing and keeps the first such surface from rendering raw.\n /\nconst _RuntimeBrandAssetSchema = z.object({\n composition: z.enum(BrandAssetComposition).systemEnum('BrandAssetComposition'),\n theme: z.enum(BrandAssetTheme).systemEnum('BrandAssetTheme'),\n purpose: z.enum(BrandAssetPurpose).systemEnum('BrandAssetPurpose'),\n /* A servable URL or app-relative path for the asset file. /\n url: z.string().min(1),\n format: z.enum(BrandAssetFormat).systemEnum('BrandAssetFormat'),\n width: z.number().int().positive().optional(),\n height: z.number().int().positive().optional(),\n});\nexport const RuntimeBrandAssetSchema: typeof _RuntimeBrandAssetSchema = _RuntimeBrandAssetSchema;\nexport type RuntimeBrandAsset = z.infer<typeof _RuntimeBrandAssetSchema>;\n\n/* A resolution query — composition is required; theme/purpose default sensibly. /\nexport interface BrandAssetQuery {\n composition: BrandAssetComposition;\n theme?: BrandAssetTheme;\n purpose?: BrandAssetPurpose;\n}\n\n/\n Resolves the best runtime brand asset for a query, with graceful fallbacks so\n * a consumer always gets something when a specific variant was not generated:\n \n 1. exact `(composition, theme, purpose)` match, else\n * 2. same `(composition, purpose)` at `theme: DEFAULT`, else\n * 3. same `composition` at `(DEFAULT, PRIMARY)`, else\n * 4. any `(DEFAULT, PRIMARY)` asset, else `undefined`.\n \n NOTE RUNGS 3 AND 4 BOTH TARGET `PRIMARY`: it is the universal last-resort, so\n * whatever occupies it is what every unresolved query in the system degrades to.\n * That is why {@link BrandAssetPurpose.MASTER} exists as a separate slot and\n * appears on NO rung here — the full-resolution source must be asked for by an\n * exact query (rung 1) and can never be handed to a consumer by a fallback.\n * Keep it that way when editing the ladder.\n \n Returns `undefined` when the list is empty (no brand generated yet) — the\n * caller keeps its existing fallback (e.g. a placeholder or the legacy URL).\n */\nexport function resolveBrandAsset(\n assets: RuntimeBrandAsset[],\n query: BrandAssetQuery,\n): RuntimeBrandAsset \| undefined {\n const theme = query.theme ?? BrandAssetTheme.DEFAULT;\n const purpose = query.purpose ?? BrandAssetPurpose.PRIMARY;\n\n const exact = assets.find(\n (a) => a.composition === query.composition && a.theme === theme && a.purpose === purpose,\n );\n if (exact) return exact;\n\n const themeFallback = assets.find(\n (a) => a.composition === query.composition && a.theme === BrandAssetTheme.DEFAULT && a.purpose === purpose,\n );\n if (themeFallback) return themeFallback;\n\n const compositionPrimary = assets.find(\n (a) => a.composition === query.composition && a.theme === BrandAssetTheme.DEFAULT && a.purpose === BrandAssetPurpose.PRIMARY,\n );\n if (compositionPrimary) return compositionPrimary;\n\n return assets.find(\n (a) => a.theme === BrandAssetTheme.DEFAULT && a.purpose === BrandAssetPurpose.PRIMARY,\n );\n}\n"]}