npm - @wildo-ai/saas-models - Versions diffs - 1.1.8 → 1.1.10 - Mend

@wildo-ai/saas-models 1.1.8 → 1.1.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (951) hide show

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,gEAAgE,CAAC;AAUtH,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,4BAA4B;IACtC,2BAA2B;IAC3B,YAAY,iBAAiB;IAC7B,6EAA6E;IAC7E,UAAU,eAAe;CAC1B;AACD,6DAA6D;AAE7D,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AActF,eAAO,MAAM,qBAAqB;;;;;;;iBAYhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB;;IAEnC;;;;;;;;;;;;OAYG;;IAEH,6DAA6D;;IAE7D,yFAAyF;;IAEzF;;;;;;;;;;;;;;;;;;;OAmBG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;;;;;;;;;;IAEH,yGAAyG;;kBA0FzG,CAAC;AACH,6DAA6D;AAC7D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,GAAG,IAAI,GAAG,SAAS,GACnF,4BAA4B,CAE9B;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBAwCrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAiBvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;QAlQnC;;;;;;;;;;;;WAYG;;QAEH,6DAA6D;;QAE7D,yFAAyF;;QAEzF;;;;;;;;;;;;;;;;;;;WAmBG;;QAEH;;;;;;;;;;;;;;;;WAgBG;;;;;;;;;;;QAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsRzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;YApVnC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkTzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,8GAA8G;AAC9G,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmB1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0J3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,mEAAmE;AAInE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;YAnpBhC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0lBxB,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwFtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE;AAED;;;GAGG;AACH,oBAAY,sCAAsC;IAChD,0HAA0H;IAC1H,sBAAsB,2BAA2B;IACjD,kHAAkH;IAClH,yBAAyB,8BAA8B;IACvD,mIAAmI;IACnI,4BAA4B,iCAAiC;CAC9D;AAED;;;;;;;;GAQG;AACH,oBAAY,iCAAiC;IAC3C,gEAAgE;IAChE,OAAO,YAAY;IACnB,6BAA6B;IAC7B,IAAI,SAAS;IACb,qFAAqF;IACrF,SAAS,cAAc;CACxB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,OAAO,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,IAAI,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAW9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,wCAAwC,CACtD,iBAAiB,EACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GACpG,SAAS,EACb,2BAA2B,EAAE,SAAS,MAAM,EAAE,GAC7C,0BAA0B,CAU5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oCAAoC,CAClD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAC7H,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,CAGR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uCAAuC,CACrD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,GAC3F,0BAA0B,CAM5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GAC/D,0BAA0B,CAE5B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yCAAyC,CACvD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAClG,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,0BAA0B,CAS5B"}
1	+ {"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,gEAAgE,CAAC;AAUtH,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,4BAA4B;IACtC,2BAA2B;IAC3B,YAAY,iBAAiB;IAC7B,6EAA6E;IAC7E,UAAU,eAAe;CAC1B;AACD,6DAA6D;AAE7D,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AActF,eAAO,MAAM,qBAAqB;;;;;;;iBAYhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB;;IAEnC;;;;;;;;;;;;OAYG;;IAEH,6DAA6D;;IAE7D,yFAAyF;;IAEzF;;;;;;;;;;;;;;;;;;;OAmBG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;;;;;;;;;;IAEH,yGAAyG;;kBA0FzG,CAAC;AACH,6DAA6D;AAC7D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,GAAG,IAAI,GAAG,SAAS,GACnF,4BAA4B,CAE9B;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBAwCrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAiBvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;QAlQnC;;;;;;;;;;;;WAYG;;QAEH,6DAA6D;;QAE7D,yFAAyF;;QAEzF;;;;;;;;;;;;;;;;;;;WAmBG;;QAEH;;;;;;;;;;;;;;;;WAgBG;;;;;;;;;;;QAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsRzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;YApVnC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkTzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,8GAA8G;AAC9G,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmB1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0J3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,mEAAmE;AAInE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;YAnpBhC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0lBxB,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwFtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE;AAED;;;GAGG;AACH,oBAAY,sCAAsC;IAChD,0HAA0H;IAC1H,sBAAsB,2BAA2B;IACjD,kHAAkH;IAClH,yBAAyB,8BAA8B;IACvD,mIAAmI;IACnI,4BAA4B,iCAAiC;CAC9D;AAED;;;;;;;;GAQG;AACH,oBAAY,iCAAiC;IAC3C,gEAAgE;IAChE,OAAO,YAAY;IACnB,6BAA6B;IAC7B,IAAI,SAAS;IACb,qFAAqF;IACrF,SAAS,cAAc;CACxB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,OAAO,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,IAAI,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAW9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,wCAAwC,CACtD,iBAAiB,EACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GACpG,SAAS,EACb,2BAA2B,EAAE,SAAS,MAAM,EAAE,GAC7C,0BAA0B,CAU5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oCAAoC,CAClD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAC7H,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,CAGR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uCAAuC,CACrD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,GAC3F,0BAA0B,CAM5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GAC/D,0BAA0B,CAE5B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yCAAyC,CACvD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAClG,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,0BAA0B,CAS5B"}

package/dist/esm/config/entity-identity-config.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,oCAAoC,EAAE,MAAM,gEAAgE,CAAC;AACtH,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAC;AACnG,OAAO,EAAE,6CAA6C,EAAE,MAAM,oEAAoE,CAAC;AACnI,OAAO,EACL,8BAA8B,EAC9B,6CAA6C,GAC9C,MAAM,sCAAsC,CAAC;AAE9C,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,6EAA2C,CAAA;IAC3C,uEAAqC,CAAA;IACrC,2EAAyC,CAAA;IACzC,2DAAyB,CAAA;IACzB,6FAA2D,CAAA;AAC7D,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,4BAKX;AALD,WAAY,4BAA4B;IACtC,2BAA2B;IAC3B,6DAA6B,CAAA;IAC7B,6EAA6E;IAC7E,yDAAyB,CAAA;AAC3B,CAAC,EALW,4BAA4B,KAA5B,4BAA4B,QAKvC;AACD,6DAA6D;AAE7D,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAmBX;AAnBD,WAAY,qBAAqB;IAC/B;;;;OAIG;IACH,0EAAiD,CAAA;IACjD;;;;;;;;;;OAUG;IACH,8CAAqB,CAAA;AACvB,CAAC,EAnBW,qBAAqB,KAArB,qBAAqB,QAmBhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,gKAAgK;IAChK,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;IAC7E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;;;;;;;;;;;;;OAgBG;IACH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IAC9E,yGAAyG;IACzG,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACnC;;;;OAIG;IACH,IACE,YAAY,CAAC,uBAAuB,KAAK,4BAA4B,CAAC,UAAU;WAC7E,CAAC,YAAY,CAAC,0BAA0B,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAC7D,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,4BAA4B,CAAC;YACpC,OAAO,EACL,6GAA6G;kBAC3G,yGAAyG;kBACzG,0FAA0F;SAC/F,CAAC,CAAC;IACL,CAAC;IACD,CAAC,YAAY,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,IAAI,GAAG,CAAC,4BAA4B,EAAE,KAAK,CAAwB,CAAC;QAC1E,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,aAAa,CAAC;gBAC9B,OAAO,EACL,qBAAqB,QAAQ,CAAC,EAAE,kEAAkE;sBAChG,0EAA0E;aAC/E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,6CAA6C,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;gBACvB,OAAO,EACL,qBAAqB,QAAQ,CAAC,EAAE,UAAU,QAAQ,CAAC,IAAI,kDAAkD;sBACvG,4BAA4B,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;aAC7F,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,2BAA2B,GAA0B;QACzD,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,OAAO;KACnB,CAAC;IACF,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC1D,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;WACxC,YAAY,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,UAAU,mCAAmC,CACjD,YAAoF;IAEpF,OAAO,YAAY,EAAE,uBAAuB,IAAI,4BAA4B,CAAC,YAAY,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD;;;;;;;;;;;;;;;OAeG;IACH;;;;;;;;;;;;;;OAcG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD;;;;;;;;;;;;;OAaG;IACH,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACzD,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,4FAA4F;IAC5F,YAAY,EAAE,wBAAwB;IAEtC,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,KAAK;QACvB,gBAAgB,EAAE,KAAK;QACvB,cAAc,EAAE,KAAK;QACrB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,IAAI;KACpC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C;;;;;;mHAM+G;IAC/G,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,qCAAW,CAAA;IACX,uCAAa,CAAA;IACb,mDAAyB,CAAA;AAC3B,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,8GAA8G;AAC9G,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/D;;;;;;;;;;;;;OAaG;IACH,UAAU,EAAE,sBAAsB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyDG;IACH,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;QACzB,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACvC,CAAC,CAAC,QAAQ,EAAE;IAEb;;;;;;;;;;;;;;;;;;OAkBG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC;QAChC,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;QACrF;;;;WAIG;QACH,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC,QAAQ,EAAE;QACxH;;;;;;;WAOG;QACH,uBAAuB,EAAE,gCAAgC,CAAC,QAAQ,EAAE;KACrE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,mEAAmE;AAEnE,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC;KACpD,WAAW,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;IACtC,8GAA8G;IAC9G,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,OAAO,CAAC;gBACf,OAAO,EAAE,0BAA0B,OAAO,uEAAuE;sBAC7G,oGAAoG;aACzG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,4FAA4F;kBAC1F,0EAA0E;SAC/E,CAAC,CAAC;IACL,CAAC;IACD;;;;;;;;;OASG;IACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACvD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,KAAK,IAAI,CAAC;SAC/D,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAEjD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAE,EAAE,iBAAiB,CAAC;YAC/C,OAAO,EACL,sBAAsB,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC;kBAC9G,2FAA2F;kBAC3F,wGAAwG;SAC7G,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,gBAAgB,IAAI,gBAAgB,EAAE,CAAC;QAChD,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,cAAc,KAAK,SAAS;YAAE,SAAS;QAChF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;YAC1C,OAAO,EACL,sBAAsB,gBAAgB,2DAA2D;kBAC/F,gGAAgG;kBAChG,oFAAoF;kBACpF,8HAA8H;SACnI,CAAC,CAAC;IACL,CAAC;IAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,iBAAiB,CAClB,EAAE,CAAC;QACF,MAAM,mBAAmB,GACvB,UAAU,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,gBAAgB;wBAChB,gBAAgB;wBAChB,8BAA8B;wBAC9B,KAAK;qBACN;oBACD,OAAO,EACL,cAAc,QAAQ,sCAAsC;0BAC1D,IAAI,aAAa,0CAA0C;0BAC3D,8DAA8D;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAYL;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAK7D,iBAAoE,EACpE,kBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAC9D,kBAAkB,CACnB,CACF;SACA,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,0HAA0H;IAC1H,2FAAiD,CAAA;IACjD,kHAAkH;IAClH,iGAAuD,CAAA;IACvD,mIAAmI;IACnI,uGAA6D,CAAA;AAC/D,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,iCAOX;AAPD,WAAY,iCAAiC;IAC3C,gEAAgE;IAChE,wDAAmB,CAAA;IACnB,6BAA6B;IAC7B,kDAAa,CAAA;IACb,qFAAqF;IACrF,4DAAuB,CAAA;AACzB,CAAC,EAPW,iCAAiC,KAAjC,iCAAiC,QAO5C;AAOD,MAAM,oBAAoB,GAAG,CAAC,UAA6B,EAA8B,EAAE;IACzF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,iCAAiC,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAiC,CAAC,IAAI,EAAE;QACrD,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAiC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3E,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,wCAAwC,CACtD,iBAEa,EACb,2BAA8C;IAE9C,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;SACzD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAExH,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC;IACxG,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,oBAAoB,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,oBAAoB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oCAAoC,CAClD,iBAA6H,EAC7H,gBAAoC;IAEpC,MAAM,QAAQ,GAAG,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IACpG,OAAO,QAAQ,EAAE,cAAc,EAAE,gBAAgB,IAAI,cAAc,CAAC,SAAS,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uCAAuC,CACrD,iBAA4F;IAE5F,OAAO,oBAAoB,CACzB,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,KAAK,IAAI,CAAC;SAC/D,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CACjD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,iBAAgE;IAEhE,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yCAAyC,CACvD,iBAAkG,EAClG,eAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,iCAAiC,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,oBAAoB,CACzB,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;SACxG,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CACjD,CAAC;AACJ,CAAC","sourcesContent":["/*\n Entity & Identity Configuration Schemas\n \n Top-level config sections: userTypes, frontendServices, organizationTypes.\n * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).\n \n Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.\n * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.\n \n See:\n * - target-configuration-type.md §2b (UserTypeAuthPolicy)\n * - entity-identity-architecture-analysis.md §4.2\n /\n\nimport { z } from 'zod';\nimport { ExternalAssuranceEnforcement } from '../external-providers/provider-authentication-assurance.shared.schemas';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { AppFrontendType } from './app-frontend-type.shared.schemas';\nimport { isLabelKeySegment } from '../i18n/application-config-vocabulary.shared';\nimport { ServiceProviderExpertAdmissionPolicy } from '../organizations/service-provider-relationships.shared.schemas';\nimport { ReviewDeadlinesDeclarationSchema } from '../flows-actors/review-deadlines.shared.schemas';\nimport { SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS } from '../organizations/service-provider-capability-grants.shared.schemas';\nimport {\n OnboardingSurveyQuestionSchema,\n SURVEY_QUESTION_TYPES_WHOSE_ANSWER_IS_A_VALUE,\n} from './frontend/onboarding.shared.schemas';\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\n/* Canonical registration-policy discriminant. /\nexport enum RegistrationMode {\n OPEN = 'open',\n INVITATION_ONLY = 'invitation_only',\n ADMIN_ONLY = 'admin_only',\n DISABLED = 'disabled',\n}\n\n/\n Semantically distinct ways in which a user can acquire a user type.\n \n Keep these channels separate even when two currently share the same mode matrix: the actor,\n * user intent, and security boundary differ, and future policy can evolve one without silently\n * changing the others.\n /\nexport enum RegistrationAcquisitionChannel {\n PUBLIC_SELF_SERVICE = 'public_self_service',\n SOCIAL_OAUTH_JIT = 'social_oauth_jit',\n ENTERPRISE_SSO_JIT = 'enterprise_sso_jit',\n INVITATION = 'invitation',\n ADMINISTRATIVE_PROVISIONING = 'administrative_provisioning',\n}\n\n/\n @wildo_source:part:start saas.models.config.registration facet:layer:shared facet:audience:app-developer\n \n WHEN a user type asks a person for their first and last name (#1374). Declared as\n * `userTypes.<type>.auth.registration.profileNamesCollectedAt`.\n \n - `REGISTRATION` (the default) — on the sign-up form.\n * - `ONBOARDING` — after the person has confirmed their address and credential. The sign-up form leaves the names\n * out; the account is created without a profile, and the first sign-in stops at the onboarding screen, which asks\n * for the names before the account can be used. A person who closes the tab is asked again at their next\n * sign-in: whether the names are owed is worked out from the account (does it have a profile yet?), never\n * remembered in the session.\n \n `ONBOARDING` cannot be combined with `additionalProfileQuestions`: those answers are saved WITH the profile, and\n * at sign-up there is no profile to save them into. The configuration is refused rather than silently discarding\n * them — ask those questions at `REGISTRATION`, or move them to an in-app guidance survey.\n /\nexport enum ProfileNamesCollectionMoment {\n /* On the sign-up form. /\n REGISTRATION = 'registration',\n /* At the onboarding screen, after the address and credential are proven. /\n ONBOARDING = 'onboarding',\n}\n/* @wildo_source:part:end saas.models.config.registration /\n\n/* D-19: Email verification timing. /\nexport enum EmailVerificationMode {\n /\n The account is created pending verification and the emailed link is the only continuation. The\n * registration answer for a new address is the same acknowledgement an already-registered address\n * receives, so `POST /auth/register` does not reveal which addresses have accounts (#1010).\n /\n REQUIRED_BEFORE_ACCESS = 'required_before_access',\n /\n The account is created ACTIVE and a new registrant is signed in (or sent to enrollment / onboarding)\n * by the registration answer itself.\n \n This mode reveals whether an address is registered, by construction. A new address receives a\n * session and tokens; an already-registered address can only receive the acknowledgement, because\n * answering it with a session would sign a stranger into someone else's account. No response shaping\n * can hide that difference, so choosing this mode accepts account enumeration through registration.\n * Choose `REQUIRED_BEFORE_ACCESS` where that matters. (Password-less registration never honours this\n * mode, and stays indistinguishable.)\n /\n DEFERRED = 'deferred',\n}\n\n/* E-10, D-15: How much orgs can override user-type auth methods. /\nexport enum OrgAuthMethodPolicy {\n RESTRICT_ONLY = 'restrict_only',\n EXPAND_WITHIN_SET = 'expand_within_set',\n UNRESTRICTED = 'unrestricted',\n}\n\n// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────\n\nexport const AuthMethodExpandedConfigSchema = z.object({\n enabled: z.boolean(),\n});\nexport type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;\n\n/\n authMethodsEnabled value: boolean shorthand OR expanded config.\n \n NOTHING REWRITES THE STORED SHAPE — the two forms are normalized on READ, by `getEnabledMethods`, and every reader\n * must go through it. This comment said \"normalized at runtime to { enabled: true }\", which reads as a guarantee that a\n * consumer may test the value for truthiness; there is no such normalizer, an object is truthy whatever it says, and\n * two backend readers did exactly that and admitted a method declared `{ enabled: false }`.\n /\nconst AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);\n\n// ─── Policy Sub-Types ───────────────────────────────────────────────────────\n\nexport const MfaPolicyConfigSchema = z.object({\n /* Missing/insufficient social-login assurance warns by default. STRICT refuses before session issuance. Enterprise SSO delegates MFA to its configured IdP. /\n externalAssuranceEnforcement: z.enum(ExternalAssuranceEnforcement).optional(),\n requireMFA: z.boolean().default(false),\n /* D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n /* Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. /\n acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),\n /* D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. /\n enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),\n /* C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. /\n passkeyExemptFromMFA: z.boolean().default(true),\n});\nexport type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;\n\n/\n Registration policy for one user type.\n \n Every user type must author this object explicitly. Acquisition policy is security\n * configuration, so omission must never silently become open registration.\n /\n/* @wildo_source:part:start saas.models.config.registration /\nexport const RegistrationConfigSchema = z.strictObject({\n mode: z.enum(RegistrationMode),\n /\n Only acquisition methods with a complete public-signup implementation are accepted.\n \n PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public\n * registration in #463; before that they were authentication and enrollment methods only, and\n * declaring one here was refused because it would have advertised a path the runtime could not\n * execute.\n \n A password-less signup creates the account with NO credential and proves the address by a magic\n * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —\n * \"access now, verify later\" is not a state the runtime can produce for a registrant who holds\n * nothing. See `registerUser`.\n /\n allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n /* D-19: 'deferred' gives immediate access, verify later. /\n emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),\n /* R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. /\n blockForSSODomains: z.boolean().default(false),\n /\n The email domains that may sign themselves up, when an application wants to restrict that (#1222).\n \n OMITTED means no restriction, which is the correct default for a public application and the only\n * honest reading of an unauthored field — an empty ARRAY would mean \"nobody may register\", a state\n * an application expresses through `registration.mode` instead.\n \n ## Distinct from `blockForSSODomains`, which answers the opposite question\n \n `blockForSSODomains` is a DENY derived from another tenant's declaration: it refuses signup for a\n * domain somebody else has claimed and put behind their identity provider. This is an ALLOW the\n * application states about itself: only these domains may sign up here. An internal tool restricting\n * signup to its own company has no SSO-enforced domain to key on and could not express that at all —\n * enterprise provisioning had such a control and public signup, the one anonymous surface, had none.\n \n Compared case-insensitively against the address's domain part, whole-string: `acme.com` does not\n * admit `notacme.com` and does not admit `sub.acme.com`. Subdomains are a separate decision an\n * application makes by listing them, because a wildcard that quietly admits every subdomain of a\n * domain the application does not fully control is the failure this control exists to prevent.\n /\n allowedEmailDomains: z.array(z.string().min(1)).optional(),\n /\n Extra profile questions this user type is asked AT SIGN-UP, beyond the name and email (#1371).\n \n Each is a survey question — `id`, `type`, `required`, `bindToField` — the same declaration an in-app guidance\n * survey uses, so one question can be moved between sign-up and a later survey without rewriting it.\n \n `bindToField` names a field of the person's USER PROFILE, which is where the answer is saved. The account does\n * not exist while the form is open, so the answers travel with the sign-up request and are saved when the\n * profile is created.\n \n Refused when the configuration is loaded:\n * - a question with no `bindToField` — its answer would be collected and thrown away;\n * - a choice-type question — its answer is an option key rather than a value, so the profile would store the key;\n * - any question when `profileNamesCollectedAt` is `ONBOARDING` — there is no profile at sign-up to save into.\n \n Optional; absent and empty mean the same thing.\n /\n additionalProfileQuestions: z.array(OnboardingSurveyQuestionSchema).optional(),\n /* When the person's first and last name are asked (#1374). See {@link ProfileNamesCollectionMoment}. /\n profileNamesCollectedAt: z.enum(ProfileNamesCollectionMoment).optional(),\n}).superRefine((registration, ctx) => {\n /\n * Sign-up answers are saved with the profile, and the profile is created from the names: with the names asked at\n * onboarding there is no profile at sign-up, so every answer would be discarded. Refused rather than tolerated —\n * a configuration that collects answers and throws them away is worse than one that cannot be written.\n /\n if (\n registration.profileNamesCollectedAt === ProfileNamesCollectionMoment.ONBOARDING\n && (registration.additionalProfileQuestions?.length ?? 0) > 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['additionalProfileQuestions'],\n message:\n 'sign-up profile questions are written with the profile row, which is created from the first and last name; '\n + 'with profileNamesCollectedAt ONBOARDING there is no row at sign-up, so the answers would be discarded. '\n + 'Collect the names at REGISTRATION, or move these questions to an in-app guidance survey.',\n });\n }\n (registration.additionalProfileQuestions ?? []).forEach((question, index) => {\n const path = ['additionalProfileQuestions', index] as (string \| number)[];\n if (!question.bindToField) {\n ctx.addIssue({\n code: 'custom',\n path: [...path, 'bindToField'],\n message:\n `sign-up question \"${question.id}\" declares no bindToField, so its answer would be collected and `\n + 'discarded. Name the user-profile field it fills, or remove the question.',\n });\n }\n if (!SURVEY_QUESTION_TYPES_WHOSE_ANSWER_IS_A_VALUE.includes(question.type)) {\n ctx.addIssue({\n code: 'custom',\n path: [...path, 'type'],\n message:\n `sign-up question \"${question.id}\" is a ${question.type} question, whose answer is an option ref rather `\n + `than a value. Use one of ${SURVEY_QUESTION_TYPES_WHOSE_ANSWER_IS_A_VALUE.join(' / ')}.`,\n });\n }\n });\n /\n * The set with a public-signup implementation. It is enumerated rather than open because the\n * failure this refusal prevents is silent: a method listed here is ADVERTISED to a registrant, and\n * one the runtime cannot execute fails after they have committed to it.\n \n MAGIC_LINK and PASSKEY joined in #463. Anything else — SSO, an MFA factor — is an authentication\n * or enrollment method that has no way to CREATE an account from an anonymous caller, and adding it\n * here means building that flow first, not widening this list.\n \n ## This list reaches PUBLIC SELF-SERVICE SIGNUP, and nothing else (#1222)\n \n The scope follows from the sentence above: the question it answers only arises when an ANONYMOUS\n * caller is creating an account for themselves. So it does NOT govern invitation acceptance (the\n * caller holds an invitation token and the account already exists), SCIM or enterprise provisioning,\n * or the administrative member-create door. Those paths are governed by `authMethodsEnabled` alone —\n * a credential the sign-in doors refuse is useless however it was created.\n \n Recorded because the reach was got wrong in both directions at once: invitation acceptance applied\n * this list to PASSWORD only, while self-registration checked it and never checked\n * `authMethodsEnabled`. The second was the one with a cost — an application listing MAGIC_LINK here\n * while withdrawing it from the doors created ACTIVE accounts that could never sign in.\n /\n const publiclyRegisterableMethods: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.EXTERNAL_OAUTH2,\n AuthMethod.MAGIC_LINK,\n AuthMethod.PASSKEY,\n ];\n const unsupportedMethods = registration.allowedMethods.filter(\n (method) => !publiclyRegisterableMethods.includes(method),\n );\n if (unsupportedMethods.length > 0) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,\n });\n }\n if (\n registration.mode === RegistrationMode.OPEN\n && registration.allowedMethods.length === 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: 'Open registration requires at least one supported acquisition method',\n });\n }\n});\n/* @wildo_source:part:end saas.models.config.registration /\nexport type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;\n\n/\n The ONE reading of when a user type's names are collected (#1374): the declared moment, else `REGISTRATION` —\n * the behaviour every user type had before the moment could be declared.\n /\nexport function resolveProfileNamesCollectionMoment(\n registration: Pick<RegistrationConfig, 'profileNamesCollectedAt'> \| null \| undefined,\n): ProfileNamesCollectionMoment {\n return registration?.profileNamesCollectedAt ?? ProfileNamesCollectionMoment.REGISTRATION;\n}\n\n/\n Password policy — includes expiryDays (R-8, moved from flat auth field).\n * Defined here (not in app-configuration-shared) to avoid circular dependency.\n * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.\n /\nexport const PasswordPolicyConfigSchema = z.object({\n /\n Length is the whole of the length requirement, and the composition flags default OFF (#1249).\n \n > \"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of\n * > different character types) for passwords.\"\n \n spec-cite: NIST SP 800-63B-4 §3.1.1.2 \"Password Verifiers\"\n * (https://pages.nist.gov/800-63-4/sp800-63b.html). §3.1.1.1 sets the floor at eight characters and\n * asks verifiers to require fifteen, which is where this default now sits.\n \n The flags REMAIN authorable, because an application under a regulator that mandates character\n * mixtures must be able to say so; what changed is which way they point when nobody has decided.\n * Appendix A.3 is why: \"a user who might have chosen 'password' as their password would be\n * relatively likely to choose 'Password1' if required to include an uppercase letter and a number\".\n * The rule that replaces them is the blocklist — see `assertPasswordNotBlocklisted`.\n /\n /\n The shortest password an application may REQUIRE, and the shortest it may ACCEPT.\n \n The floor is 8, not 6, because the standard states it as an obligation on the verifier:\n * \"Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length.\"\n * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).\n * A schema that admitted 6 let an application declare a policy the standard forbids — quietly,\n * since nothing downstream re-checked the declared value.\n \n The DEFAULT is 15 because the same section continues: \"Verifiers and CSPs SHOULD require\n * passwords to be a minimum of 15 characters in length.\"\n * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).\n * A framework's default is the answer every application that expresses no opinion receives, so it\n * takes the SHOULD; the floor only has to stop an application going below the SHALL.\n /\n minLength: z.number().min(8).max(128).default(15),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(false),\n requireLowercase: z.boolean().default(false),\n requireNumbers: z.boolean().default(false),\n requireSpecialChars: z.boolean().default(false),\n /* R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). /\n expiryDays: z.number().min(0).default(0),\n});\nexport type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;\n\n/* E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. /\nexport const StepUpAuthConfigSchema = z.object({\n enabled: z.boolean().default(false),\n maxAgeSeconds: z.number().min(60).max(3600).default(300),\n methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n});\nexport type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;\n\nexport const LockoutPolicyConfigSchema = z.object({\n maxLoginAttempts: z.number().min(3).max(20).default(5),\n lockoutDurationMinutes: z.number().min(1).max(1440).default(30),\n /* W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. /\n progressiveLockout: z.boolean().default(false),\n /* W2.3: cap for progressive lockout duration in hours. /\n maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),\n});\nexport type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;\n\nexport const MethodManagementConfigSchema = z.object({\n allowUserMethodRemoval: z.boolean().default(true),\n /\n Whether adding or removing an authenticator requires the person to re-prove who they are first.\n \n ON by default, because NIST SP 800-63B-4 Sec. 4.1.2 requires it when an authenticator is bound to an\n * existing account: binding is how a stolen session becomes access that survives a password reset.\n * spec-cite: NIST SP 800-63B-4 Sec. 4.1.2 (Post-Enrollment Binding), fetched 2026-09-20 from\n * https://pages.nist.gov/800-63-4/sp800-63b/events/\n \n It never asks during enrollment at sign-in or registration, where the person has just authenticated,\n * and it never asks an account that holds nothing a re-authentication could check (no password,\n * verified TOTP or passkey) — that is how an invited or email-link-only account gets its FIRST\n * authenticator. The proof itself is collected by the shared step-up dialog, so no screen has to know\n * this setting exists. Setting it to `false` is a declared deviation from the SHALL above.\n /\n requireReauthForMethodChanges: z.boolean().default(true),\n});\nexport type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;\n\n// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────\n\n/\n The complete auth policy for a user type. Every user type MUST define this.\n * There are no global auth defaults — this IS the auth config.\n \n Zod .default() values enable omission in config input files, but the\n * resolved runtime type has all fields present (no optionals for policy fields).\n \n See target-configuration-type.md §2b for full specification.\n /\nexport const UserTypeAuthPolicySchema = z.object({\n /* E-1, D-20: Opt-in semantics — absent method = disabled. /\n authMethodsEnabled: z.partialRecord(\n z.enum(AuthMethod),\n AuthMethodValueSchema,\n ).default({ [AuthMethod.PASSWORD]: true }),\n\n /* E-2: MFA enforcement for this user type. /\n mfaPolicy: MfaPolicyConfigSchema.default({\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n }),\n\n /* E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. /\n registration: RegistrationConfigSchema,\n\n /* E-7, R-8: Password strength + expiry. /\n passwordPolicy: PasswordPolicyConfigSchema.default({\n minLength: 15,\n maxLength: 128,\n requireUppercase: false,\n requireLowercase: false,\n requireNumbers: false,\n requireSpecialChars: false,\n expiryDays: 0,\n }),\n\n /* E-8: Session duration for this user type. /\n sessionDurationMinutes: z.number().min(1).max(1440).default(30),\n\n /\n E-8, G-2: the cap on simultaneous refresh chains for this user type.\n \n Leaving it undefined does NOT mean unlimited. The token issuer falls back to\n * `DEFAULT_MAX_CONCURRENT_SESSIONS` (10) and evicts the oldest chain beyond it, so a user type\n * that declares nothing is still capped. There is no value that disables the cap; declare the\n * number you want.\n /\n maxConcurrentSessions: z.number().min(1).optional(),\n\n /* G-1: Per-user-type lockout. Backend-only. /\n lockoutPolicy: LockoutPolicyConfigSchema.default({\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n }),\n\n /* G-8: Consumer=true (convenience), Admin=false (security). /\n autoLinkByEmail: z.boolean().default(true),\n\n /* E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). /\n stepUpAuth: StepUpAuthConfigSchema.optional(),\n\n methodManagement: MethodManagementConfigSchema.default({\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: true,\n }),\n\n /* W7.3a: Enables anonymous session support for this user type. When true,\n * unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.\n * On login/register for this user type, anonymous resources are transposed to the authenticated user. /\n anonymousSessionsEnabled: z.boolean().optional(),\n\n /* W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. /\n oneOffSessionAllowed: z.boolean().optional(),\n\n /* revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted\n * for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide\n * absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is\n * bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,\n * the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The\n * ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap\n * enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). /\n oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),\n});\nexport type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;\n\n// ─── User Type Definition ───────────────────────────────────────────────────\n\nexport const UserTypeDefinitionSchema = z.object({\n /* REQUIRED — the complete auth policy for this user type. Not an override of global. /\n auth: UserTypeAuthPolicySchema,\n\n /\n * `uniqueIdentifier` was REMOVED (#1224). It accepted any string, supported only `'email'`, and its\n * ONLY reader was a startup warning saying the value \"will be treated as email\" — so an application\n * could declare a different identifier, be told at boot that it would be ignored, and have it\n * ignored. A field whose whole runtime behaviour is to announce that it does nothing is a promise\n * the framework cannot keep.\n \n Removed rather than implemented, because implementing it is not a knob: every identity surface\n * here is keyed on an email address — `findUserByEmail`, the anti-enumeration acknowledgements, the\n * magic-link and password-reset token subjects, the per-email lockout bucket, the invitation join.\n * A second identifier kind is a feature with its own design, and it starts by naming which of those\n * surfaces change, not by re-adding this field.\n /\n defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),\n\n /* D-10: When set, user type auto-revoked when user leaves last org of matching type. /\n requiresOrgMembership: z.object({\n orgTypes: z.array(z.string()).min(1),\n }).optional(),\n});\nexport type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;\n\n// ─── Frontend Service Identity ──────────────────────────────────────────────\n\nexport const FrontendServiceUserManagementEntrySchema = z.object({\n register: z.boolean(),\n auth: z.boolean(),\n isDefault: z.boolean().optional(),\n});\nexport type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;\n\n/\n Backend-runtime view of one frontend service.\n \n Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`\n * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.\n \n - `usersManagement` — auth-policy bindings per user type (legacy field;\n * present since the original auth identity model).\n * - `frontendType` — the runtime kind declared in\n * `wildo.saas.config.ts → services[name].frontendType`. Currently\n * informational on the backend; reserved for `frontendType`-conditioned\n * policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The\n * full taxonomy + the \"no native variants\" decision live in\n * `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT\n * duplicate that explanation here.\n /\nexport const FrontendServiceDefinitionSchema = z.object({\n usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),\n frontendType: z.enum(AppFrontendType).optional(),\n});\nexport type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;\n\n// ─── Organization Type ──────────────────────────────────────────────────────\n\n/\n @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer\n \n An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles\n * exist inside it, whether it can come into existence through sign-up, and how hard it is for its\n * members to prove who they are. Declared as `organizationTypes` in `wildo.saas.config.ts` — never in the backend\n * configuration, because the platform reads it to type the organization it seeds for the first administrator.\n \n ## At least one type, and every organization carries one\n \n The map may not be empty, and an organization's `type` is required and must name an entry in it. A member of an\n * organization whose type names nothing here cannot sign in: the type is where that tenant's authentication\n * restrictions live, and \"could not tell\" is never read as \"no restrictions\".\n \n The first administrator's organization is typed by derivation, never by a separate setting: it gets the one\n * declared type whose `userTypes` include every one of `bootstrap.firstAdmin.userTypes`, and the configuration is\n * refused when none or several do. An organization whose stored type resolves to nothing — none stored, or one this\n * declaration no longer carries — is typed at startup when exactly one type is declared, and the value it replaced is\n * recorded; with several, the application refuses to start and names them. A member who reaches sign-in anyway is\n * refused with `authentication_organization_policy_unresolved`, never let through with no restrictions.\n \n ## A type only self-creates if it says so\n \n `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a\n * tenant of this type into existence. A type an administrator creates simply omits the policy — and\n * a user type may match AT MOST ONE organization type, which the schema enforces rather than\n * resolving by record order.\n \n `orgNameSource` decides where that tenant's first display name comes from: `ASK` during\n * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who\n * the registrant becomes.\n \n ## `authOverrides`: method choices and restrictive security requirements\n \n Organizations may override enabled methods, MFA, password policy and step-up freshness.\n * Session length, lockout and registration are not organization-overridable.\n \n Enabled login methods follow the application's `auth.orgAuthMethodPolicy`: RESTRICT_ONLY intersects\n * with the user type's methods; EXPAND_WITHIN_SET adds only methods allowed by\n * `auth.expandableOrgMethods`; UNRESTRICTED uses the organization's enabled set. Across organizations\n * with explicit `authMethodsEnabled` overrides, the resolved sets intersect, including in expansion\n * mode. An organization without that override does not participate in this method-set intersection.\n \n The other axes remain most-restrictive-wins: MFA requirements cannot be removed, password\n * requirements cannot be weakened, and step-up `enabled` is OR, `maxAgeSeconds` is MIN and\n * `methods` intersects. Expanding login methods does not expand accepted step-up methods.\n \n How a registration-derived organization obtains its initial display name.\n /\nexport enum OrganizationNameSource {\n ASK = 'ask',\n AUTO = 'auto',\n ONBOARDING = 'onboarding',\n}\n\nexport const OrgCreationPolicySchema = z.object({\n createOnUserTypeRegistration: z.array(z.string()).min(1),\n orgNameSource: z.enum(OrganizationNameSource),\n defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),\n});\nexport type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;\n\n/* Org overrides: login methods follow the application mode; MFA, password and step-up remain restrictive. /\nexport const OrgTypeAuthOverridesSchema = z.object({\n authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),\n mfaPolicy: MfaPolicyConfigSchema.partial().optional(),\n passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),\n /\n Re-authentication freshness, added 2026-09-09 (#527).\n \n The other three overrides and this one answer ONE question — how hard is it for this tenant's\n * members to prove who they are — and until now a tenant could tighten three of them. An\n * organisation that requires MFA and a 16-character password could still have a member mutate a\n * sensitive resource on an eight-hour-old session, because the app-wide default said so.\n \n Most-restrictive-wins like its siblings, but the two fields move in OPPOSITE arithmetic\n * directions and that is worth stating rather than inferring: `enabled` is an OR (either side\n * turning step-up ON wins) while `maxAgeSeconds` is a MIN (the shorter window wins). `methods`\n * intersects, so an organisation can withdraw an acceptable re-authentication method but never\n * introduce one the user type does not already allow.\n /\n stepUpAuth: StepUpAuthConfigSchema.partial().optional(),\n}).optional();\nexport type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;\n\n/\n G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled).\n \n `syncFrequencyHours` was REMOVED here (#1224): no production code read it — the gate consults only\n * `.enabled` — so an application could set a sync cadence and nothing would schedule anything.\n \n It is NOT the per-connection field of the same name, which is live: that one is on\n * `sso-config.shared.schemas.ts` and is surfaced in the administration view. Two fields, one name, one\n * of them decorative, is also why this went unnoticed — a search for the name found a reader.\n /\nexport const OrgScimProvisioningSchema = z.object({\n enabled: z.boolean().default(false),\n});\nexport type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;\n\nexport const OrganizationTypeDefinitionSchema = z.object({\n /* D-10: User types auto-granted when joining this org type. /\n userTypes: z.array(z.string()).min(1),\n\n availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n CORE_ORG_ROLES.ORG_MEMBER,\n ]),\n\n /* R-5: Moved from registration.defaultOrgRole. /\n defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),\n\n /* D-15: Most-restrictive-wins on top of user type auth policy. /\n authOverrides: OrgTypeAuthOverridesSchema,\n\n /* G-4: SCIM provisioning toggle per org type. /\n scimProvisioning: OrgScimProvisioningSchema.optional(),\n\n creationPolicy: OrgCreationPolicySchema.optional(),\n\n /\n This type's organization OPERATES the application — the corporate in an internal tool, the suite\n * vendor in a product that extends an existing suite.\n \n ## What it is for\n \n Some applications are not sold to many tenants. They are built FOR one organization, which runs\n * them and owns the data in them — and that organization's systems (an ERP, a CRM, a directory) are\n * the systems of record the application reads. The framework needs to be able to name that\n * organization before it can say whose rows the remote data is, and an application had no way to\n * say it: a type carries `userTypes`, roles, auth overrides and a creation policy, none of which\n * means \"this one runs the place\".\n \n Declare it on exactly ONE type, and at most one organization of that type may exist. Everything\n * downstream that must belong to the operator — not to a customer — resolves through it.\n \n ```ts\n * organizationTypes: {\n * company: { ownsApplication: true, userTypes: ['member'] }, // the operator; no creationPolicy\n * workspace: { userTypes: ['member'], creationPolicy: { … } }, // tenants that sign themselves up\n * }\n * ```\n \n ## The three rules, and why each exists\n \n - At most one type may carry it. Two would make \"the organization that owns the application\"\n * a choice, and the framework does not choose between declarations by record order.\n * - A marked type may NOT declare a `creationPolicy`. A creation policy is how a type comes\n * into existence when somebody signs up, so a marked type with one would produce a new owner per\n * registrant. The two statements contradict each other, and the contradiction is refused where it\n * is written rather than discovered as a second owner.\n * - Its `userTypes` must cover `bootstrap.firstAdmin.userTypes`. The organization the platform\n * seeds for the first administrator IS the owner organization, so a type that does not grant the\n * administrator what they are would seed them into an organization contradicting their identity.\n \n ## What it is NOT\n \n Not the platform's own `WILDO_OWNER_ORGANIZATION` (`@wildo-ai/platform-config-lib`), which is the\n * organization that owns Wildo's applications inside apps-manager and which no application\n * backend ever reads. This marker is an APPLICATION-level statement about one of the application's\n * own tenants. Conflating them would make Wildo the owner of every customer's internal tool.\n \n Not a claim about privilege either: members of the owner organization hold exactly the roles the\n * type grants them. What the marker decides is OWNERSHIP of data, not authority over people.\n \n ## Adding it to an application that is already running\n \n An organization's `type` is creation-time identity, so an existing organization cannot be\n * re-typed by an update. The paired door is `organizations.promoteToOwnerOrganization`: a\n * super-administrator who is a MEMBER of the target organization promotes it, with a justification,\n * and the promotion is audited. Declare the type, run `wildo config reapply-declaration`, then\n * promote. Declaring a second type on an application whose organizations are not all typed yet is\n * refused at boot — boot once with the single type so every row is typed, then add the marked one.\n \n `z.literal(true)` rather than `z.boolean()`: `ownsApplication: false` would be a way of writing\n * down a fact that is already true of every type that omits it, and two spellings of the same\n * statement is how a declaration comes to disagree with itself.\n /\n ownsApplication: z.literal(true).optional(),\n\n /\n This type's organizations are SERVICE FIRMS whose experts work inside client organizations (#1597).\n \n Declaring it lets an organization of this type enter service-provider relationships with\n * organizations of the listed client types. A relationship is always the client's to accept, scope and\n * end; the firm assigns which of its members serve it, and each assigned expert receives a membership\n * in the client carrying the relationship's role — re-checked on every request.\n \n ```ts\n * organizationTypes: {\n * workspace: {\n * userTypes: ['member'],\n * availableOrgRoles: ['ORG_OWNER', 'ORG_ADMIN', 'ORG_MEMBER', 'ORG_SERVICE_PROVIDER'],\n * servesAsProvider: {\n * clientOrganizationTypes: ['workspace'],\n * providerRoles: ['ORG_SERVICE_PROVIDER'],\n * defaultProviderRole: 'ORG_SERVICE_PROVIDER',\n * },\n * },\n * }\n * ```\n \n Startup refuses:\n * - a provider role that leads up to `ORG_ADMIN` — a relationship never confers administration of the\n * client (a narrow, time-bound delegation is a separate mechanism);\n * - a provider role that a client type does not list in its `availableOrgRoles`;\n * - a `defaultProviderRole` that is not one of `providerRoles`, and a client type that is not declared.\n \n The core `ORG_SERVICE_PROVIDER` role (inherits `ORG_MEMBER`) is the usual choice.\n /\n servesAsProvider: z.object({\n clientOrganizationTypes: z.array(z.string().min(1)).min(1),\n providerRoles: z.array(z.string().min(1)).min(1),\n defaultProviderRole: z.string().min(1),\n }).optional(),\n\n /\n How organizations of this type, as CLIENTS of a service firm, admit the firm's experts by default (#1612).\n \n Each relationship carries its own `expertAdmissionPolicy`, chosen by the client when it proposes or accepts and\n * changed later by a client administrator; this is only where that choice STARTS when the client makes none —\n * for instance a firm's proposal the client has not accepted yet. The relationship's value always wins. It sits\n * on the CLIENT type because the client owns the choice: a firm's type never decides who enters another tenant.\n \n ```ts\n * organizationTypes: {\n * lawClient: {\n * // …\n * acceptsServiceProviders: { defaultExpertAdmissionPolicy: ServiceProviderExpertAdmissionPolicy.CLIENT_APPROVES_EACH_EXPERT },\n * },\n * }\n * ```\n \n Absent: every expert a firm assigns is admitted (`RELATIONSHIP_APPROVES_ASSIGNED_EXPERTS`), the #1597 behaviour.\n /\n acceptsServiceProviders: z.object({\n defaultExpertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy).optional(),\n /\n The longest, in days, an organization of this type may lend a service firm a SECURITY-CRITICAL administrative\n * capability (SSO/SCIM, API keys, access-grant approval — #1631). Lowers the framework's 30-day cap; it can never\n * raise it. Ordinary capabilities keep their two-year maximum.\n /\n securityCriticalCapabilityMaxDays: z.number().int().min(1).max(SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS).optional(),\n /\n When a client's pending approval of one of a firm's experts lapses, and who is reminded before it does (#1909) —\n * #1628's deadline declaration, on this plane: `lapseAfter` (ISO-8601, e.g. `'P14D'`), a `decision` target with\n * an optional `warnBefore`, and NOTIFY `rules`. There is no `claim`, no REASSIGN and no `pauseStates`: the\n * approval is routed to the client's administrators as a group, offers only an answer, and startup refuses a\n * declaration asking for more. Absent: the framework defaults every human decision gets (a 24-hour lapse, a\n * reminder to the administrators at three quarters of it). A lapsed approval admits nobody; the firm assigns again.\n /\n expertApprovalDeadlines: ReviewDeadlinesDeclarationSchema.optional(),\n }).optional(),\n});\nexport type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;\n/* @wildo_source:part:end saas.models.config.organization-types /\n\n// ─── Top-Level Config Sections ──────────────────────────────────────────────\n\nexport const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);\nexport type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;\n\nexport const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);\nexport type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;\n\n/\n The application's organization types — at least ONE, always.\n \n ## Why an empty map is refused (#1032, decided 2026-09-14)\n \n Every organization carries a `type`, and that type must name an entry here. The authentication\n * policy resolver refuses a member whose organization's type it cannot resolve, because a type is\n * where an organization's authentication restrictions live and \"could not tell\" must never read as\n * \"no restrictions\". An application declaring no types therefore could not have a single\n * organization anybody can sign in through — including the one the platform seeds for its first\n * administrator. It used to be optional, and the platform seeded that organization with no type at\n * all, which is how every administrator came to be locked out once the resolver fail-closed.\n \n Authored in `wildo.saas.config.ts` (not the backend config) so the platform, which seeds the first\n * organization, can read it.\n \n A type key is letters, digits, `_` and `-` only (#1851): it is also the last segment of its label key,\n * `system_enums.OrganizationType.<type>`, and the label tree is addressed by dotted path. A dotted key would name a\n * label nobody could resolve, so the type would show its raw key for ever with nothing reporting why, and a key\n * `acme.eu` beside `acme` would need `acme` to be both a word and a branch. The reviewers' reason codes refuse a dot\n * for the same reason (`AgentWorkReasonCodeSchema`); both test it with `isLabelKeySegment`.\n /\nexport const OrganizationTypesConfigSchema = z\n .record(z.string(), OrganizationTypeDefinitionSchema)\n .superRefine((organizationTypes, ctx) => {\n // Checked here rather than as a record-key schema, whose failure Zod reports only as \"Invalid key in record\".\n for (const typeKey of Object.keys(organizationTypes)) {\n if (!isLabelKeySegment(typeKey)) {\n ctx.addIssue({\n code: 'custom',\n path: [typeKey],\n message: `Organization type key \"${typeKey}\" may contain only letters, digits, \"_\" and \"-\": it is also the last `\n + 'segment of its label key, system_enums.OrganizationType.<type>, which is addressed by dotted path.',\n });\n }\n }\n if (Object.keys(organizationTypes).length === 0) {\n ctx.addIssue({\n code: 'custom',\n path: [],\n message:\n 'At least one organization type must be declared: every organization carries a type, and a '\n + 'member of an organization whose type names no entry here cannot sign in.',\n });\n }\n /\n * At most ONE type may declare `ownsApplication`, and a type that declares it may not also be\n * created on registration.\n \n Both refusals live here for the same reason the `ownerByRegisteredUserType` map below does:\n * they are statements ABOUT THE MAP, not about any one entry, so a per-entry refine could not\n * see them. And both are contradictions in the declaration rather than states of the world —\n * refusing them where the file is loaded turns a would-be second owner organization into an\n * authoring error nobody can commit.\n /\n const markedOwnerTypes = Object.entries(organizationTypes)\n .filter(([, definition]) => definition.ownsApplication === true)\n .map(([organizationType]) => organizationType);\n\n if (markedOwnerTypes.length > 1) {\n ctx.addIssue({\n code: 'custom',\n path: [markedOwnerTypes[1]!, 'ownsApplication'],\n message:\n `Organization types ${markedOwnerTypes.map((type) => `'${type}'`).join(', ')} all declare \\`ownsApplication\\`, `\n + 'but an application is owned by exactly one organization, so at most one type may say so. '\n + 'Keep the marker on the type whose organization operates the application and remove it from the others.',\n });\n }\n\n for (const organizationType of markedOwnerTypes) {\n if (organizationTypes[organizationType]?.creationPolicy === undefined) continue;\n ctx.addIssue({\n code: 'custom',\n path: [organizationType, 'creationPolicy'],\n message:\n `Organization type '${organizationType}' declares \\`ownsApplication\\` and a \\`creationPolicy\\`. `\n + 'A creation policy makes a new organization of this type every time a matching user registers, '\n + 'which would produce one owner organization per registrant; at most one may exist. '\n + 'Keep the marker and drop the creation policy, or move the policy to a separate type for the tenants that sign themselves up.',\n });\n }\n\n const ownerByRegisteredUserType = new Map<string, string>();\n for (const [organizationType, definition] of Object.entries(\n organizationTypes,\n )) {\n const registeredUserTypes =\n definition.creationPolicy?.createOnUserTypeRegistration ?? [];\n registeredUserTypes.forEach((userType, index) => {\n const existingOwner = ownerByRegisteredUserType.get(userType);\n if (existingOwner !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: [\n organizationType,\n 'creationPolicy',\n 'createOnUserTypeRegistration',\n index,\n ],\n message:\n `User type '${userType}' already creates organization type `\n + `'${existingOwner}' during registration; one registration `\n + 'cannot implicitly choose between multiple organization types',\n });\n return;\n }\n ownerByRegisteredUserType.set(userType, organizationType);\n });\n }\n });\nexport type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;\n\nexport interface OrganizationTypeRegistrationCreationMatch<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n } = OrganizationTypeDefinition,\n> {\n readonly organizationType: string;\n readonly definition: TDefinition;\n}\n\n/\n Canonical matching rule for registration-derived organization creation.\n \n The schema rejects more than one match for a user type. Returning all\n * matches is intentional defensive behavior for stale/unparsed runtime input:\n * callers can fail closed instead of selecting record insertion order.\n /\nexport function findOrganizationTypeRegistrationCreationMatches<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n },\n>(\n organizationTypes: Readonly<Record<string, TDefinition>> \| undefined,\n registeredUserType: string,\n): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[] {\n if (!organizationTypes) return [];\n return Object.entries(organizationTypes)\n .filter(([, definition]) =>\n definition.creationPolicy?.createOnUserTypeRegistration.includes(\n registeredUserType,\n ),\n )\n .map(([organizationType, definition]) => ({\n organizationType,\n definition,\n }));\n}\n\n/\n Why an organization yields no authentication policy — the log-side split of\n * `ErrorCustomMessageReference.AUTHENTICATION_ORGANIZATION_POLICY_UNRESOLVED` (#1036). Three states, three remedies.\n /\nexport enum OrganizationAuthPolicyUnresolvedReason {\n /* A membership names an organization that cannot be found. Remedy: remove the membership or restore the organization. /\n ORGANIZATION_NOT_FOUND = 'organization_not_found',\n /* The organization carries no type. The engine types such organizations at startup when one type is declared. /\n ORGANIZATION_TYPE_MISSING = 'organization_type_missing',\n /* The organization's type names no declared organization type. Remedy: declare it again, or restart so the engine re-types it. /\n ORGANIZATION_TYPE_UNDECLARED = 'organization_type_undeclared',\n}\n\n/\n Why an organization type could, or could not, be derived — the vocabulary both derivations below\n * answer in.\n \n A closed vocabulary rather than `string \| undefined`, because the two refusals have different\n * remedies and a caller has to be able to name them: NONE means the declaration offers nothing that\n * fits (declare a type), AMBIGUOUS means it offers several and the framework will not choose between\n * them by record order (narrow the declaration).\n /\nexport enum OrganizationTypeDerivationOutcome {\n /* Exactly one declared type fits; it is `organizationType`. /\n DERIVED = 'DERIVED',\n /* No declared type fits. /\n NONE = 'NONE',\n /* More than one declared type fits; they are `candidates`, in declaration order. /\n AMBIGUOUS = 'AMBIGUOUS',\n}\n\nexport type OrganizationTypeDerivation =\n \| { readonly outcome: OrganizationTypeDerivationOutcome.DERIVED; readonly organizationType: string }\n \| { readonly outcome: OrganizationTypeDerivationOutcome.NONE }\n \| { readonly outcome: OrganizationTypeDerivationOutcome.AMBIGUOUS; readonly candidates: readonly string[] };\n\nconst deriveFromCandidates = (candidates: readonly string[]): OrganizationTypeDerivation => {\n if (candidates.length === 1) {\n return { outcome: OrganizationTypeDerivationOutcome.DERIVED, organizationType: candidates[0]! };\n }\n return candidates.length === 0\n ? { outcome: OrganizationTypeDerivationOutcome.NONE }\n : { outcome: OrganizationTypeDerivationOutcome.AMBIGUOUS, candidates };\n};\n\n/\n The type of the organization the platform seeds for an application's first administrator.\n \n DERIVED, never authored: it is the declared organization type whose `userTypes` include every one of\n * `bootstrap.firstAdmin.userTypes`. An organization type's `userTypes` are what a member of it is\n * granted, so a type that does not cover the administrator's user types would seed them into an\n * organization that contradicts who they are. Asking the application author to restate the answer\n * would be a second copy of a fact the declaration already holds.\n \n Refuses rather than guesses when several types fit — record order is not a decision.\n \n ## The owner marker DECIDES, when one of the fitting types carries it\n \n `ownsApplication` says which organization operates the application, and the organization the\n * platform seeds for the first administrator IS that organization. So when a fitting type is marked,\n * the answer is not ambiguous — it is declared, and reading anything else would seed the operator's\n * own administrator into a customer-shaped tenant.\n \n This is not a tie-break bolted onto a refusal; without it, an application with a marker would\n * usually be REFUSED. The natural shape of a case-1 declaration is a marked `company` for the\n * operator beside an unmarked `workspace` for the tenants that sign themselves up, and both\n * ordinarily grant the same user types — so both cover the first administrator and `AMBIGUOUS` would\n * fire on every such application. `AMBIGUOUS` keeps its whole meaning for the unmarked case: several\n * types fit and NOTHING in the declaration says which, so record order is all that is left and record\n * order is not a decision.\n \n Several MARKED types are still ambiguous, and deliberately so. The configuration schema refuses a\n * second marker, so this can only be reached from a declaration that arrived by another route (a\n * stored configuration written before the rule, an unparsed runtime input) — exactly the case where\n * choosing would be a guess dressed as a derivation.\n /\nexport function deriveFirstAdministratorOrganizationType(\n organizationTypes:\n \| Readonly<Record<string, { readonly userTypes: readonly string[]; readonly ownsApplication?: true }>>\n \| undefined,\n firstAdministratorUserTypes: readonly string[],\n): OrganizationTypeDerivation {\n const fittingTypes = Object.entries(organizationTypes ?? {})\n .filter(([, definition]) => firstAdministratorUserTypes.every((userType) => definition.userTypes.includes(userType)));\n\n const markedFittingTypes = fittingTypes.filter(([, definition]) => definition.ownsApplication === true);\n if (markedFittingTypes.length > 0) {\n return deriveFromCandidates(markedFittingTypes.map(([organizationType]) => organizationType));\n }\n\n return deriveFromCandidates(fittingTypes.map(([organizationType]) => organizationType));\n}\n\n/\n The role that OWNS a newly-created organization of a given type.\n \n ONE resolution for every door that founds a tenant, because a tenant founded without an owner is\n * the stranded state `administrative-continuity-floors.md` exists to prevent, and it is reached by\n * whichever door forgot — not by the ones that remembered.\n \n There are THREE such doors and they are in two packages, which is why this is a function rather\n * than a convention: self-service `organizations.create`, the organization derived when a user of a\n * declaring type registers, and the platform seeding an application's FIRST organization for its\n * first administrator. The first two already resolved it identically and said so in a comment — \"the\n SAME resolution registration uses, so the two creation paths cannot disagree\"* — while the third\n * hard-coded `ORG_ADMIN` and gave every freshly created application an ownerless first tenant, which\n * its own boot report then reported at CRITICAL forever (#436 established the invariant and fixed two\n * of its three call sites; `invariant-call-site-enumeration.md`).\n \n `ORG_OWNER` is the answer when the type declares no `creationPolicy` or no `defaultOwnerRole` —\n * the same default `OrgCreationPolicySchema` carries, restated here because the seeding lanes reach\n * types that never passed through that parse (a platform-supplied declaration, a stored\n * configuration). An application that wants a differently-named founding role declares it once, on\n * the type, and all three doors follow.\n /\nexport function resolveOrganizationFoundingOwnerRole(\n organizationTypes: Readonly<Record<string, { readonly creationPolicy?: { readonly defaultOwnerRole?: string } }>> \| undefined,\n organizationType: string \| undefined,\n): string {\n const declared = organizationType === undefined ? undefined : organizationTypes?.[organizationType];\n return declared?.creationPolicy?.defaultOwnerRole ?? CORE_ORG_ROLES.ORG_OWNER;\n}\n\n/\n Which declared organization type OWNS the application, if any.\n \n The one reader of {@link OrganizationTypeDefinition.ownsApplication}, so every surface that needs\n * \"the owner type\" asks the same question of the same declaration rather than re-typing the filter.\n \n `NONE` is an ordinary, correct answer and the default for every application: most applications are\n * sold to many tenants and no organization operates them. Only a case-1 application — an internal\n * tool, or a product extending a suite the operator already runs — declares one.\n \n `AMBIGUOUS` is unreachable from a configuration the schema parsed (a second marker is refused\n * there), and is returned rather than resolved for the same reason the derivation above does it: a\n * declaration that reached a runtime by another route must not have its contradiction silently\n * decided. Callers fail closed on it; nothing is the owner until an operator repairs the declaration.\n /\nexport function resolveApplicationOwnerOrganizationType(\n organizationTypes: Readonly<Record<string, { readonly ownsApplication?: true }>> \| undefined,\n): OrganizationTypeDerivation {\n return deriveFromCandidates(\n Object.entries(organizationTypes ?? {})\n .filter(([, definition]) => definition.ownsApplication === true)\n .map(([organizationType]) => organizationType),\n );\n}\n\n/\n The type an EXISTING untyped organization receives when the application declares exactly one.\n \n The narrowest of the three derivations here: it reads only the declaration, so it answers for an\n * organization about which nothing at all is known. With several declared types it refuses, and the\n * caller falls through to {@link deriveOrganizationTypeFromMemberUserTypes}, which asks the\n * organization itself.\n /\nexport function deriveSoleOrganizationType(\n organizationTypes: Readonly<Record<string, unknown>> \| undefined,\n): OrganizationTypeDerivation {\n return deriveFromCandidates(Object.keys(organizationTypes ?? {}));\n}\n\n/\n The type an EXISTING untyped organization receives, read from the user types its own members hold.\n \n ## Why an existing organization is not silent about its type\n \n {@link deriveSoleOrganizationType} used to be the only answer for an existing organization, on the\n * reasoning that one \"carries no record of which user types it was meant for\". Its MEMBERS carry\n * exactly that record: an organization type's `userTypes` are what a member of it is granted, so a\n * type that does not cover every user type the organization's members actually hold is a type this\n * organization cannot be. When that leaves exactly one candidate, nothing is guessed — it is the same\n * coverage test {@link deriveFirstAdministratorOrganizationType} already applies to the\n * first-administrator organization, asked of the members instead of the declaration.\n \n ## Why an empty `memberUserTypes` is NONE rather than a match\n \n `every` over an empty set is vacuously true, so an organization with no members to read would match\n * every declared type and, against a single-type declaration, would derive one. That would not be a\n * derivation from the organization — it would be {@link deriveSoleOrganizationType} wearing this\n * function's name, reached without reading anything. Absence of a signal is NONE.\n \n @param memberUserTypes The union of the user types held by the organization's members. The caller\n * decides which memberships count; it is the one judgement this function does not make.\n */\nexport function deriveOrganizationTypeFromMemberUserTypes(\n organizationTypes: Readonly<Record<string, { readonly userTypes: readonly string[] }>> \| undefined,\n memberUserTypes: readonly string[],\n): OrganizationTypeDerivation {\n if (memberUserTypes.length === 0) {\n return { outcome: OrganizationTypeDerivationOutcome.NONE };\n }\n return deriveFromCandidates(\n Object.entries(organizationTypes ?? {})\n .filter(([, definition]) => memberUserTypes.every((userType) => definition.userTypes.includes(userType)))\n .map(([organizationType]) => organizationType),\n );\n}\n"]}
1	+ {"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,oCAAoC,EAAE,MAAM,gEAAgE,CAAC;AACtH,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAC;AACnG,OAAO,EAAE,6CAA6C,EAAE,MAAM,oEAAoE,CAAC;AACnI,OAAO,EACL,8BAA8B,EAC9B,6CAA6C,GAC9C,MAAM,sCAAsC,CAAC;AAE9C,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,6EAA2C,CAAA;IAC3C,uEAAqC,CAAA;IACrC,2EAAyC,CAAA;IACzC,2DAAyB,CAAA;IACzB,6FAA2D,CAAA;AAC7D,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,4BAKX;AALD,WAAY,4BAA4B;IACtC,2BAA2B;IAC3B,6DAA6B,CAAA;IAC7B,6EAA6E;IAC7E,yDAAyB,CAAA;AAC3B,CAAC,EALW,4BAA4B,KAA5B,4BAA4B,QAKvC;AACD,6DAA6D;AAE7D,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAmBX;AAnBD,WAAY,qBAAqB;IAC/B;;;;OAIG;IACH,0EAAiD,CAAA;IACjD;;;;;;;;;;OAUG;IACH,8CAAqB,CAAA;AACvB,CAAC,EAnBW,qBAAqB,KAArB,qBAAqB,QAmBhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,gKAAgK;IAChK,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;IAC7E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;;;;;;;;;;;;;OAgBG;IACH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IAC9E,yGAAyG;IACzG,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACnC;;;;OAIG;IACH,IACE,YAAY,CAAC,uBAAuB,KAAK,4BAA4B,CAAC,UAAU;WAC7E,CAAC,YAAY,CAAC,0BAA0B,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAC7D,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,4BAA4B,CAAC;YACpC,OAAO,EACL,6GAA6G;kBAC3G,yGAAyG;kBACzG,0FAA0F;SAC/F,CAAC,CAAC;IACL,CAAC;IACD,CAAC,YAAY,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,IAAI,GAAG,CAAC,4BAA4B,EAAE,KAAK,CAAwB,CAAC;QAC1E,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,aAAa,CAAC;gBAC9B,OAAO,EACL,qBAAqB,QAAQ,CAAC,EAAE,kEAAkE;sBAChG,0EAA0E;aAC/E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,6CAA6C,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC;gBACvB,OAAO,EACL,qBAAqB,QAAQ,CAAC,EAAE,UAAU,QAAQ,CAAC,IAAI,kDAAkD;sBACvG,4BAA4B,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;aAC7F,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,2BAA2B,GAA0B;QACzD,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,OAAO;KACnB,CAAC;IACF,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC1D,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;WACxC,YAAY,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,UAAU,mCAAmC,CACjD,YAAoF;IAEpF,OAAO,YAAY,EAAE,uBAAuB,IAAI,4BAA4B,CAAC,YAAY,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD;;;;;;;;;;;;;;;OAeG;IACH;;;;;;;;;;;;;;OAcG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD;;;;;;;;;;;;;OAaG;IACH,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACzD,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,4FAA4F;IAC5F,YAAY,EAAE,wBAAwB;IAEtC,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,KAAK;QACvB,gBAAgB,EAAE,KAAK;QACvB,cAAc,EAAE,KAAK;QACrB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,IAAI;KACpC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C;;;;;;mHAM+G;IAC/G,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,qCAAW,CAAA;IACX,uCAAa,CAAA;IACb,mDAAyB,CAAA;AAC3B,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,8GAA8G;AAC9G,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/D;;;;;;;;;;;;;OAaG;IACH,UAAU,EAAE,sBAAsB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyDG;IACH,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;QACzB,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACvC,CAAC,CAAC,QAAQ,EAAE;IAEb;;;;;;;;;;;;;;;;;;OAkBG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC;QAChC,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;QACrF;;;;WAIG;QACH,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC,QAAQ,EAAE;QACxH;;;;;;;WAOG;QACH,uBAAuB,EAAE,gCAAgC,CAAC,QAAQ,EAAE;KACrE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,mEAAmE;AAEnE,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC;KACpD,WAAW,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;IACtC,8GAA8G;IAC9G,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,OAAO,CAAC;gBACf,OAAO,EAAE,0BAA0B,OAAO,uEAAuE;sBAC7G,oGAAoG;aACzG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,4FAA4F;kBAC1F,0EAA0E;SAC/E,CAAC,CAAC;IACL,CAAC;IACD;;;;;;;;;OASG;IACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACvD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,KAAK,IAAI,CAAC;SAC/D,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAEjD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAE,EAAE,iBAAiB,CAAC;YAC/C,OAAO,EACL,sBAAsB,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC;kBAC9G,2FAA2F;kBAC3F,wGAAwG;SAC7G,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,gBAAgB,IAAI,gBAAgB,EAAE,CAAC;QAChD,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,cAAc,KAAK,SAAS;YAAE,SAAS;QAChF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;YAC1C,OAAO,EACL,sBAAsB,gBAAgB,2DAA2D;kBAC/F,gGAAgG;kBAChG,oFAAoF;kBACpF,8HAA8H;SACnI,CAAC,CAAC;IACL,CAAC;IAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,iBAAiB,CAClB,EAAE,CAAC;QACF,MAAM,mBAAmB,GACvB,UAAU,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,gBAAgB;wBAChB,gBAAgB;wBAChB,8BAA8B;wBAC9B,KAAK;qBACN;oBACD,OAAO,EACL,cAAc,QAAQ,sCAAsC;0BAC1D,IAAI,aAAa,0CAA0C;0BAC3D,8DAA8D;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAYL;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAK7D,iBAAoE,EACpE,kBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAC9D,kBAAkB,CACnB,CACF;SACA,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,sCAOX;AAPD,WAAY,sCAAsC;IAChD,0HAA0H;IAC1H,2FAAiD,CAAA;IACjD,kHAAkH;IAClH,iGAAuD,CAAA;IACvD,mIAAmI;IACnI,uGAA6D,CAAA;AAC/D,CAAC,EAPW,sCAAsC,KAAtC,sCAAsC,QAOjD;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,iCAOX;AAPD,WAAY,iCAAiC;IAC3C,gEAAgE;IAChE,wDAAmB,CAAA;IACnB,6BAA6B;IAC7B,kDAAa,CAAA;IACb,qFAAqF;IACrF,4DAAuB,CAAA;AACzB,CAAC,EAPW,iCAAiC,KAAjC,iCAAiC,QAO5C;AAOD,MAAM,oBAAoB,GAAG,CAAC,UAA6B,EAA8B,EAAE;IACzF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,iCAAiC,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAiC,CAAC,IAAI,EAAE;QACrD,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAiC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3E,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,wCAAwC,CACtD,iBAEa,EACb,2BAA8C;IAE9C,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;SACzD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAExH,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC;IACxG,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,oBAAoB,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,oBAAoB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oCAAoC,CAClD,iBAA6H,EAC7H,gBAAoC;IAEpC,MAAM,QAAQ,GAAG,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IACpG,OAAO,QAAQ,EAAE,cAAc,EAAE,gBAAgB,IAAI,cAAc,CAAC,SAAS,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uCAAuC,CACrD,iBAA4F;IAE5F,OAAO,oBAAoB,CACzB,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,KAAK,IAAI,CAAC;SAC/D,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CACjD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,iBAAgE;IAEhE,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yCAAyC,CACvD,iBAAkG,EAClG,eAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,iCAAiC,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,oBAAoB,CACzB,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;SACxG,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CACjD,CAAC;AACJ,CAAC","sourcesContent":["/*\n Entity & Identity Configuration Schemas\n \n Top-level config sections: userTypes, frontendServices, organizationTypes.\n * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).\n \n Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.\n * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.\n \n See:\n * - target-configuration-type.md §2b (UserTypeAuthPolicy)\n * - entity-identity-architecture-analysis.md §4.2\n /\n\nimport { z } from 'zod';\nimport { ExternalAssuranceEnforcement } from '../external-providers/provider-authentication-assurance.shared.schemas';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { AppFrontendType } from './app-frontend-type.shared.schemas';\nimport { isLabelKeySegment } from '../i18n/application-config-vocabulary.shared';\nimport { ServiceProviderExpertAdmissionPolicy } from '../organizations/service-provider-relationships.shared.schemas';\nimport { ReviewDeadlinesDeclarationSchema } from '../flows-actors/review-deadlines.shared.schemas';\nimport { SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS } from '../organizations/service-provider-capability-grants.shared.schemas';\nimport {\n OnboardingSurveyQuestionSchema,\n SURVEY_QUESTION_TYPES_WHOSE_ANSWER_IS_A_VALUE,\n} from './frontend/onboarding.shared.schemas';\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\n/* Canonical registration-policy discriminant. /\nexport enum RegistrationMode {\n OPEN = 'open',\n INVITATION_ONLY = 'invitation_only',\n ADMIN_ONLY = 'admin_only',\n DISABLED = 'disabled',\n}\n\n/\n Semantically distinct ways in which a user can acquire a user type.\n \n Keep these channels separate even when two currently share the same mode matrix: the actor,\n * user intent, and security boundary differ, and future policy can evolve one without silently\n * changing the others.\n /\nexport enum RegistrationAcquisitionChannel {\n PUBLIC_SELF_SERVICE = 'public_self_service',\n SOCIAL_OAUTH_JIT = 'social_oauth_jit',\n ENTERPRISE_SSO_JIT = 'enterprise_sso_jit',\n INVITATION = 'invitation',\n ADMINISTRATIVE_PROVISIONING = 'administrative_provisioning',\n}\n\n/\n @wildo_source:part:start saas.models.config.registration facet:layer:shared facet:audience:app-developer\n \n WHEN a user type asks a person for their first and last name (#1374). Declared as\n * `userTypes.<type>.auth.registration.profileNamesCollectedAt`.\n \n - `REGISTRATION` (the default) — on the sign-up form.\n * - `ONBOARDING` — after the person has confirmed their address and credential. The sign-up form leaves the names\n * out; the account is created without a profile, and the first sign-in stops at the onboarding screen, which asks\n * for the names before the account can be used. A person who closes the tab is asked again at their next\n * sign-in: whether the names are owed is worked out from the account (does it have a profile yet?), never\n * remembered in the session.\n \n `ONBOARDING` cannot be combined with `additionalProfileQuestions`: those answers are saved WITH the profile, and\n * at sign-up there is no profile to save them into. The configuration is refused rather than silently discarding\n * them — ask those questions at `REGISTRATION`, or move them to an in-app guidance survey.\n /\nexport enum ProfileNamesCollectionMoment {\n /* On the sign-up form. /\n REGISTRATION = 'registration',\n /* At the onboarding screen, after the address and credential are proven. /\n ONBOARDING = 'onboarding',\n}\n/* @wildo_source:part:end saas.models.config.registration /\n\n/* D-19: Email verification timing. /\nexport enum EmailVerificationMode {\n /\n The account is created pending verification and the emailed link is the only continuation. The\n * registration answer for a new address is the same acknowledgement an already-registered address\n * receives, so `POST /auth/register` does not reveal which addresses have accounts (#1010).\n /\n REQUIRED_BEFORE_ACCESS = 'required_before_access',\n /\n The account is created ACTIVE and a new registrant is signed in (or sent to enrollment / onboarding)\n * by the registration answer itself.\n \n This mode reveals whether an address is registered, by construction. A new address receives a\n * session and tokens; an already-registered address can only receive the acknowledgement, because\n * answering it with a session would sign a stranger into someone else's account. No response shaping\n * can hide that difference, so choosing this mode accepts account enumeration through registration.\n * Choose `REQUIRED_BEFORE_ACCESS` where that matters. (Password-less registration never honours this\n * mode, and stays indistinguishable.)\n /\n DEFERRED = 'deferred',\n}\n\n/* E-10, D-15: How much orgs can override user-type auth methods. /\nexport enum OrgAuthMethodPolicy {\n RESTRICT_ONLY = 'restrict_only',\n EXPAND_WITHIN_SET = 'expand_within_set',\n UNRESTRICTED = 'unrestricted',\n}\n\n// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────\n\nexport const AuthMethodExpandedConfigSchema = z.object({\n enabled: z.boolean(),\n});\nexport type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;\n\n/\n authMethodsEnabled value: boolean shorthand OR expanded config.\n \n NOTHING REWRITES THE STORED SHAPE — the two forms are normalized on READ, by `getEnabledMethods`, and every reader\n * must go through it. This comment said \"normalized at runtime to { enabled: true }\", which reads as a guarantee that a\n * consumer may test the value for truthiness; there is no such normalizer, an object is truthy whatever it says, and\n * two backend readers did exactly that and admitted a method declared `{ enabled: false }`.\n /\nconst AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);\n\n// ─── Policy Sub-Types ───────────────────────────────────────────────────────\n\nexport const MfaPolicyConfigSchema = z.object({\n /* Missing/insufficient social-login assurance warns by default. STRICT refuses before session issuance. Enterprise SSO delegates MFA to its configured IdP. /\n externalAssuranceEnforcement: z.enum(ExternalAssuranceEnforcement).optional(),\n requireMFA: z.boolean().default(false),\n /* D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n /* Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. /\n acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),\n /* D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. /\n enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),\n /* C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. /\n passkeyExemptFromMFA: z.boolean().default(true),\n});\nexport type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;\n\n/\n Registration policy for one user type.\n \n Every user type must author this object explicitly. Acquisition policy is security\n * configuration, so omission must never silently become open registration.\n /\n/* @wildo_source:part:start saas.models.config.registration /\nexport const RegistrationConfigSchema = z.strictObject({\n mode: z.enum(RegistrationMode),\n /\n Only acquisition methods with a complete public-signup implementation are accepted.\n \n PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public\n * registration in #463; before that they were authentication and enrollment methods only, and\n * declaring one here was refused because it would have advertised a path the runtime could not\n * execute.\n \n A password-less signup creates the account with NO credential and proves the address by a magic\n * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —\n * \"access now, verify later\" is not a state the runtime can produce for a registrant who holds\n * nothing. See `registerUser`.\n /\n allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n /* D-19: 'deferred' gives immediate access, verify later. /\n emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),\n /* R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. /\n blockForSSODomains: z.boolean().default(false),\n /\n The email domains that may sign themselves up, when an application wants to restrict that (#1222).\n \n OMITTED means no restriction, which is the correct default for a public application and the only\n * honest reading of an unauthored field — an empty ARRAY would mean \"nobody may register\", a state\n * an application expresses through `registration.mode` instead.\n \n ## Distinct from `blockForSSODomains`, which answers the opposite question\n \n `blockForSSODomains` is a DENY derived from another tenant's declaration: it refuses signup for a\n * domain somebody else has claimed and put behind their identity provider. This is an ALLOW the\n * application states about itself: only these domains may sign up here. An internal tool restricting\n * signup to its own company has no SSO-enforced domain to key on and could not express that at all —\n * enterprise provisioning had such a control and public signup, the one anonymous surface, had none.\n \n Compared case-insensitively against the address's domain part, whole-string: `acme.com` does not\n * admit `notacme.com` and does not admit `sub.acme.com`. Subdomains are a separate decision an\n * application makes by listing them, because a wildcard that quietly admits every subdomain of a\n * domain the application does not fully control is the failure this control exists to prevent.\n /\n allowedEmailDomains: z.array(z.string().min(1)).optional(),\n /\n Extra profile questions this user type is asked AT SIGN-UP, beyond the name and email (#1371).\n \n Each is a survey question — `id`, `type`, `required`, `bindToField` — the same declaration an in-app guidance\n * survey uses, so one question can be moved between sign-up and a later survey without rewriting it.\n \n `bindToField` names a field of the person's USER PROFILE, which is where the answer is saved. The account does\n * not exist while the form is open, so the answers travel with the sign-up request and are saved when the\n * profile is created.\n \n Refused when the configuration is loaded:\n * - a question with no `bindToField` — its answer would be collected and thrown away;\n * - a choice-type question — its answer is an option key rather than a value, so the profile would store the key;\n * - any question when `profileNamesCollectedAt` is `ONBOARDING` — there is no profile at sign-up to save into.\n \n Optional; absent and empty mean the same thing.\n /\n additionalProfileQuestions: z.array(OnboardingSurveyQuestionSchema).optional(),\n /* When the person's first and last name are asked (#1374). See {@link ProfileNamesCollectionMoment}. /\n profileNamesCollectedAt: z.enum(ProfileNamesCollectionMoment).optional(),\n}).superRefine((registration, ctx) => {\n /\n * Sign-up answers are saved with the profile, and the profile is created from the names: with the names asked at\n * onboarding there is no profile at sign-up, so every answer would be discarded. Refused rather than tolerated —\n * a configuration that collects answers and throws them away is worse than one that cannot be written.\n /\n if (\n registration.profileNamesCollectedAt === ProfileNamesCollectionMoment.ONBOARDING\n && (registration.additionalProfileQuestions?.length ?? 0) > 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['additionalProfileQuestions'],\n message:\n 'sign-up profile questions are written with the profile row, which is created from the first and last name; '\n + 'with profileNamesCollectedAt ONBOARDING there is no row at sign-up, so the answers would be discarded. '\n + 'Collect the names at REGISTRATION, or move these questions to an in-app guidance survey.',\n });\n }\n (registration.additionalProfileQuestions ?? []).forEach((question, index) => {\n const path = ['additionalProfileQuestions', index] as (string \| number)[];\n if (!question.bindToField) {\n ctx.addIssue({\n code: 'custom',\n path: [...path, 'bindToField'],\n message:\n `sign-up question \"${question.id}\" declares no bindToField, so its answer would be collected and `\n + 'discarded. Name the user-profile field it fills, or remove the question.',\n });\n }\n if (!SURVEY_QUESTION_TYPES_WHOSE_ANSWER_IS_A_VALUE.includes(question.type)) {\n ctx.addIssue({\n code: 'custom',\n path: [...path, 'type'],\n message:\n `sign-up question \"${question.id}\" is a ${question.type} question, whose answer is an option ref rather `\n + `than a value. Use one of ${SURVEY_QUESTION_TYPES_WHOSE_ANSWER_IS_A_VALUE.join(' / ')}.`,\n });\n }\n });\n /\n * The set with a public-signup implementation. It is enumerated rather than open because the\n * failure this refusal prevents is silent: a method listed here is ADVERTISED to a registrant, and\n * one the runtime cannot execute fails after they have committed to it.\n \n MAGIC_LINK and PASSKEY joined in #463. Anything else — SSO, an MFA factor — is an authentication\n * or enrollment method that has no way to CREATE an account from an anonymous caller, and adding it\n * here means building that flow first, not widening this list.\n \n ## This list reaches PUBLIC SELF-SERVICE SIGNUP, and nothing else (#1222)\n \n The scope follows from the sentence above: the question it answers only arises when an ANONYMOUS\n * caller is creating an account for themselves. So it does NOT govern invitation acceptance (the\n * caller holds an invitation token and the account already exists), SCIM or enterprise provisioning,\n * or the administrative member-create door. Those paths are governed by `authMethodsEnabled` alone —\n * a credential the sign-in doors refuse is useless however it was created.\n \n Recorded because the reach was got wrong in both directions at once: invitation acceptance applied\n * this list to PASSWORD only, while self-registration checked it and never checked\n * `authMethodsEnabled`. The second was the one with a cost — an application listing MAGIC_LINK here\n * while withdrawing it from the doors created ACTIVE accounts that could never sign in.\n /\n const publiclyRegisterableMethods: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.EXTERNAL_OAUTH2,\n AuthMethod.MAGIC_LINK,\n AuthMethod.PASSKEY,\n ];\n const unsupportedMethods = registration.allowedMethods.filter(\n (method) => !publiclyRegisterableMethods.includes(method),\n );\n if (unsupportedMethods.length > 0) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,\n });\n }\n if (\n registration.mode === RegistrationMode.OPEN\n && registration.allowedMethods.length === 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: 'Open registration requires at least one supported acquisition method',\n });\n }\n});\n/* @wildo_source:part:end saas.models.config.registration /\nexport type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;\n\n/\n The ONE reading of when a user type's names are collected (#1374): the declared moment, else `REGISTRATION` —\n * the behaviour every user type had before the moment could be declared.\n /\nexport function resolveProfileNamesCollectionMoment(\n registration: Pick<RegistrationConfig, 'profileNamesCollectedAt'> \| null \| undefined,\n): ProfileNamesCollectionMoment {\n return registration?.profileNamesCollectedAt ?? ProfileNamesCollectionMoment.REGISTRATION;\n}\n\n/\n Password policy — includes expiryDays (R-8, moved from flat auth field).\n * Defined here (not in app-configuration-shared) to avoid circular dependency.\n * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.\n /\nexport const PasswordPolicyConfigSchema = z.object({\n /\n Length is the whole of the length requirement, and the composition flags default OFF (#1249).\n \n > \"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of\n * > different character types) for passwords.\"\n \n spec-cite: NIST SP 800-63B-4 §3.1.1.2 \"Password Verifiers\"\n * (https://pages.nist.gov/800-63-4/sp800-63b.html). §3.1.1.1 sets the floor at eight characters and\n * asks verifiers to require fifteen, which is where this default now sits.\n \n The flags REMAIN authorable, because an application under a regulator that mandates character\n * mixtures must be able to say so; what changed is which way they point when nobody has decided.\n * Appendix A.3 is why: \"a user who might have chosen 'password' as their password would be\n * relatively likely to choose 'Password1' if required to include an uppercase letter and a number\".\n * The rule that replaces them is the blocklist — see `assertPasswordNotBlocklisted`.\n /\n /\n The shortest password an application may REQUIRE, and the shortest it may ACCEPT.\n \n The floor is 8, not 6, because the standard states it as an obligation on the verifier:\n * \"Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length.\"\n * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).\n * A schema that admitted 6 let an application declare a policy the standard forbids — quietly,\n * since nothing downstream re-checked the declared value.\n \n The DEFAULT is 15 because the same section continues: \"Verifiers and CSPs SHOULD require\n * passwords to be a minimum of 15 characters in length.\"\n * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).\n * A framework's default is the answer every application that expresses no opinion receives, so it\n * takes the SHOULD; the floor only has to stop an application going below the SHALL.\n /\n minLength: z.number().min(8).max(128).default(15),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(false),\n requireLowercase: z.boolean().default(false),\n requireNumbers: z.boolean().default(false),\n requireSpecialChars: z.boolean().default(false),\n /* R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). /\n expiryDays: z.number().min(0).default(0),\n});\nexport type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;\n\n/* E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. /\nexport const StepUpAuthConfigSchema = z.object({\n enabled: z.boolean().default(false),\n maxAgeSeconds: z.number().min(60).max(3600).default(300),\n methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n});\nexport type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;\n\nexport const LockoutPolicyConfigSchema = z.object({\n maxLoginAttempts: z.number().min(3).max(20).default(5),\n lockoutDurationMinutes: z.number().min(1).max(1440).default(30),\n /* W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. /\n progressiveLockout: z.boolean().default(false),\n /* W2.3: cap for progressive lockout duration in hours. /\n maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),\n});\nexport type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;\n\nexport const MethodManagementConfigSchema = z.object({\n allowUserMethodRemoval: z.boolean().default(true),\n /\n Whether adding or removing an authenticator requires the person to re-prove who they are first.\n \n ON by default, because NIST SP 800-63B-4 Sec. 4.1.2 requires it when an authenticator is bound to an\n * existing account: binding is how a stolen session becomes access that survives a password reset.\n * spec-cite: NIST SP 800-63B-4 Sec. 4.1.2 (Post-Enrollment Binding), fetched 2026-09-20 from\n * https://pages.nist.gov/800-63-4/sp800-63b/events/\n \n It never asks during enrollment at sign-in or registration, where the person has just authenticated,\n * and it never asks an account that holds nothing a re-authentication could check (no password,\n * verified TOTP or passkey) — that is how an invited or email-link-only account gets its FIRST\n * authenticator. The proof itself is collected by the shared step-up dialog, so no screen has to know\n * this setting exists. Setting it to `false` is a declared deviation from the SHALL above.\n /\n requireReauthForMethodChanges: z.boolean().default(true),\n});\nexport type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;\n\n// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────\n\n/\n The complete auth policy for a user type. Every user type MUST define this.\n * There are no global auth defaults — this IS the auth config.\n \n Zod .default() values enable omission in config input files, but the\n * resolved runtime type has all fields present (no optionals for policy fields).\n \n See target-configuration-type.md §2b for full specification.\n /\nexport const UserTypeAuthPolicySchema = z.object({\n /* E-1, D-20: Opt-in semantics — absent method = disabled. /\n authMethodsEnabled: z.partialRecord(\n z.enum(AuthMethod),\n AuthMethodValueSchema,\n ).default({ [AuthMethod.PASSWORD]: true }),\n\n /* E-2: MFA enforcement for this user type. /\n mfaPolicy: MfaPolicyConfigSchema.default({\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n }),\n\n /* E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. /\n registration: RegistrationConfigSchema,\n\n /* E-7, R-8: Password strength + expiry. /\n passwordPolicy: PasswordPolicyConfigSchema.default({\n minLength: 15,\n maxLength: 128,\n requireUppercase: false,\n requireLowercase: false,\n requireNumbers: false,\n requireSpecialChars: false,\n expiryDays: 0,\n }),\n\n /* E-8: Session duration for this user type. /\n sessionDurationMinutes: z.number().min(1).max(1440).default(30),\n\n /\n E-8, G-2: the cap on simultaneous refresh chains for this user type.\n \n Leaving it undefined does NOT mean unlimited. The token issuer falls back to\n * `DEFAULT_MAX_CONCURRENT_SESSIONS` (10) and evicts the oldest chain beyond it, so a user type\n * that declares nothing is still capped. There is no value that disables the cap; declare the\n * number you want.\n /\n maxConcurrentSessions: z.number().min(1).optional(),\n\n /* G-1: Per-user-type lockout. Backend-only. /\n lockoutPolicy: LockoutPolicyConfigSchema.default({\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n }),\n\n /* G-8: Consumer=true (convenience), Admin=false (security). /\n autoLinkByEmail: z.boolean().default(true),\n\n /* E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). /\n stepUpAuth: StepUpAuthConfigSchema.optional(),\n\n methodManagement: MethodManagementConfigSchema.default({\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: true,\n }),\n\n /* W7.3a: Enables anonymous session support for this user type. When true,\n * unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.\n * On login/register for this user type, anonymous resources are transposed to the authenticated user. /\n anonymousSessionsEnabled: z.boolean().optional(),\n\n /* W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. /\n oneOffSessionAllowed: z.boolean().optional(),\n\n /* revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted\n * for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide\n * absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is\n * bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,\n * the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The\n * ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap\n * enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). /\n oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),\n});\nexport type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;\n\n// ─── User Type Definition ───────────────────────────────────────────────────\n\nexport const UserTypeDefinitionSchema = z.object({\n /* REQUIRED — the complete auth policy for this user type. Not an override of global. /\n auth: UserTypeAuthPolicySchema,\n\n /\n * `uniqueIdentifier` was REMOVED (#1224). It accepted any string, supported only `'email'`, and its\n * ONLY reader was a startup warning saying the value \"will be treated as email\" — so an application\n * could declare a different identifier, be told at boot that it would be ignored, and have it\n * ignored. A field whose whole runtime behaviour is to announce that it does nothing is a promise\n * the framework cannot keep.\n \n Removed rather than implemented, because implementing it is not a knob: every identity surface\n * here is keyed on an email address — `findUserByEmail`, the anti-enumeration acknowledgements, the\n * magic-link and password-reset token subjects, the per-email lockout bucket, the invitation join.\n * A second identifier kind is a feature with its own design, and it starts by naming which of those\n * surfaces change, not by re-adding this field.\n /\n defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),\n\n /* D-10: When set, user type auto-revoked when user leaves last org of matching type. /\n requiresOrgMembership: z.object({\n orgTypes: z.array(z.string()).min(1),\n }).optional(),\n});\nexport type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;\n\n// ─── Frontend Service Identity ──────────────────────────────────────────────\n\nexport const FrontendServiceUserManagementEntrySchema = z.object({\n register: z.boolean(),\n auth: z.boolean(),\n isDefault: z.boolean().optional(),\n});\nexport type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;\n\n/\n Backend-runtime view of one frontend service.\n \n Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`\n * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.\n \n - `usersManagement` — auth-policy bindings per user type (legacy field;\n * present since the original auth identity model).\n * - `frontendType` — the runtime kind declared in\n * `wildo.saas.config.ts → services[name].frontendType`. Currently\n * informational on the backend; reserved for `frontendType`-conditioned\n * policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The\n * full taxonomy + the \"no native variants\" decision live in\n * `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT\n * duplicate that explanation here.\n /\nexport const FrontendServiceDefinitionSchema = z.object({\n usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),\n frontendType: z.enum(AppFrontendType).optional(),\n});\nexport type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;\n\n// ─── Organization Type ──────────────────────────────────────────────────────\n\n/\n @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer\n \n An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles\n * exist inside it, whether it can come into existence through sign-up, and how hard it is for its\n * members to prove who they are. Declared as `organizationTypes` in `wildo.saas.config.ts` — never in the backend\n * configuration, because the platform reads it to type the organization it seeds for the first administrator.\n \n ## At least one type, and every organization carries one\n \n The map may not be empty, and an organization's `type` is required and must name an entry in it. A member of an\n * organization whose type names nothing here cannot sign in: the type is where that tenant's authentication\n * restrictions live, and \"could not tell\" is never read as \"no restrictions\".\n \n The first administrator's organization is typed by derivation, never by a separate setting: it gets the one\n * declared type whose `userTypes` include every one of `bootstrap.firstAdmin.userTypes`, and the configuration is\n * refused when none or several do. An organization whose stored type resolves to nothing — none stored, or one this\n * declaration no longer carries — is typed at startup when exactly one type is declared, and the value it replaced is\n * recorded; with several, the application refuses to start and names them. A member who reaches sign-in anyway is\n * refused with `authentication_organization_policy_unresolved`, never let through with no restrictions.\n \n ## A type only self-creates if it says so\n \n `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a\n * tenant of this type into existence. A type an administrator creates simply omits the policy — and\n * a user type may match AT MOST ONE organization type, which the schema enforces rather than\n * resolving by record order.\n \n `orgNameSource` decides where that tenant's first display name comes from: `ASK` during\n * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who\n * the registrant becomes.\n \n ## `authOverrides`: method choices and restrictive security requirements\n \n Organizations may override enabled methods, MFA, password policy and step-up freshness.\n * Session length, lockout and registration are not organization-overridable.\n \n Enabled login methods follow the application's `auth.orgAuthMethodPolicy`: RESTRICT_ONLY intersects\n * with the user type's methods; EXPAND_WITHIN_SET adds only methods allowed by\n * `auth.expandableOrgMethods`; UNRESTRICTED uses the organization's enabled set. Across organizations\n * with explicit `authMethodsEnabled` overrides, the resolved sets intersect, including in expansion\n * mode. An organization without that override does not participate in this method-set intersection.\n \n The other axes remain most-restrictive-wins: MFA requirements cannot be removed, password\n * requirements cannot be weakened, and step-up `enabled` is OR, `maxAgeSeconds` is MIN and\n * `methods` intersects. Expanding login methods does not expand accepted step-up methods.\n \n How a registration-derived organization obtains its initial display name.\n /\nexport enum OrganizationNameSource {\n ASK = 'ask',\n AUTO = 'auto',\n ONBOARDING = 'onboarding',\n}\n\nexport const OrgCreationPolicySchema = z.object({\n createOnUserTypeRegistration: z.array(z.string()).min(1),\n orgNameSource: z.enum(OrganizationNameSource),\n defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),\n});\nexport type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;\n\n/* Org overrides: login methods follow the application mode; MFA, password and step-up remain restrictive. /\nexport const OrgTypeAuthOverridesSchema = z.object({\n authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),\n mfaPolicy: MfaPolicyConfigSchema.partial().optional(),\n passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),\n /\n Re-authentication freshness, added 2026-09-09 (#527).\n \n The other three overrides and this one answer ONE question — how hard is it for this tenant's\n * members to prove who they are — and until now a tenant could tighten three of them. An\n * organisation that requires MFA and a 16-character password could still have a member mutate a\n * sensitive resource on an eight-hour-old session, because the app-wide default said so.\n \n Most-restrictive-wins like its siblings, but the two fields move in OPPOSITE arithmetic\n * directions and that is worth stating rather than inferring: `enabled` is an OR (either side\n * turning step-up ON wins) while `maxAgeSeconds` is a MIN (the shorter window wins). `methods`\n * intersects, so an organisation can withdraw an acceptable re-authentication method but never\n * introduce one the user type does not already allow.\n /\n stepUpAuth: StepUpAuthConfigSchema.partial().optional(),\n}).optional();\nexport type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;\n\n/\n G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled).\n \n `syncFrequencyHours` was REMOVED here (#1224): no production code read it — the gate consults only\n * `.enabled` — so an application could set a sync cadence and nothing would schedule anything.\n \n It is NOT the per-connection field of the same name, which is live: that one is on\n * `sso-config.shared.schemas.ts` and is surfaced in the administration view. Two fields, one name, one\n * of them decorative, is also why this went unnoticed — a search for the name found a reader.\n /\nexport const OrgScimProvisioningSchema = z.object({\n enabled: z.boolean().default(false),\n});\nexport type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;\n\nexport const OrganizationTypeDefinitionSchema = z.object({\n /* D-10: User types auto-granted when joining this org type. /\n userTypes: z.array(z.string()).min(1),\n\n availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n CORE_ORG_ROLES.ORG_MEMBER,\n ]),\n\n /* R-5: Moved from registration.defaultOrgRole. /\n defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),\n\n /* D-15: Most-restrictive-wins on top of user type auth policy. /\n authOverrides: OrgTypeAuthOverridesSchema,\n\n /* G-4: SCIM provisioning toggle per org type. /\n scimProvisioning: OrgScimProvisioningSchema.optional(),\n\n creationPolicy: OrgCreationPolicySchema.optional(),\n\n /\n This type's organization OPERATES the application — the corporate in an internal tool, the suite\n * vendor in a product that extends an existing suite.\n \n ## What it is for\n \n Some applications are not sold to many tenants. They are built FOR one organization, which runs\n * them and owns the data in them — and that organization's systems (an ERP, a CRM, a directory) are\n * the systems of record the application reads. The framework needs to be able to name that\n * organization before it can say whose rows the remote data is, and an application had no way to\n * say it: a type carries `userTypes`, roles, auth overrides and a creation policy, none of which\n * means \"this one runs the place\".\n \n Declare it on exactly ONE type, and at most one organization of that type may exist. Everything\n * downstream that must belong to the operator — not to a customer — resolves through it.\n \n ```ts\n * organizationTypes: {\n * company: { ownsApplication: true, userTypes: ['member'] }, // the operator; no creationPolicy\n * workspace: { userTypes: ['member'], creationPolicy: { … } }, // tenants that sign themselves up\n * }\n * ```\n \n ## The three rules, and why each exists\n \n - At most one type may carry it. Two would make \"the organization that owns the application\"\n * a choice, and the framework does not choose between declarations by record order.\n * - A marked type may NOT declare a `creationPolicy`. A creation policy is how a type comes\n * into existence when somebody signs up, so a marked type with one would produce a new owner per\n * registrant. The two statements contradict each other, and the contradiction is refused where it\n * is written rather than discovered as a second owner.\n * - Its `userTypes` must cover `bootstrap.firstAdmin.userTypes`. The organization the platform\n * seeds for the first administrator IS the owner organization, so a type that does not grant the\n * administrator what they are would seed them into an organization contradicting their identity.\n \n ## What it is NOT\n \n Not the platform's own `WILDO_OWNER_ORGANIZATION` (`@wildo-ai/platform-config-lib`), which is the\n * organization that owns Wildo's applications inside apps-manager and which no application\n * backend ever reads. This marker is an APPLICATION-level statement about one of the application's\n * own tenants. Conflating them would make Wildo the owner of every customer's internal tool.\n \n Not a claim about privilege either: members of the owner organization hold exactly the roles the\n * type grants them. What the marker decides is OWNERSHIP of data, not authority over people.\n \n ## Adding it to an application that is already running\n \n An organization's `type` is creation-time identity, so an existing organization cannot be\n * re-typed by an update. The paired door is `organizations.promoteToOwnerOrganization`: a\n * super-administrator who is a MEMBER of the target organization promotes it, with a justification,\n * and the promotion is audited. Declare the type, run `wildo config reapply-declaration`, then\n * promote. Declaring a second type on an application whose organizations are not all typed yet is\n * refused at boot — boot once with the single type so every row is typed, then add the marked one.\n \n `z.literal(true)` rather than `z.boolean()`: `ownsApplication: false` would be a way of writing\n * down a fact that is already true of every type that omits it, and two spellings of the same\n * statement is how a declaration comes to disagree with itself.\n /\n ownsApplication: z.literal(true).optional(),\n\n /\n This type's organizations are SERVICE FIRMS whose experts work inside client organizations (#1597).\n \n Declaring it lets an organization of this type enter service-provider relationships with\n * organizations of the listed client types. A relationship is always the client's to accept, scope and\n * end; the firm assigns which of its members serve it, and each assigned expert receives a membership\n * in the client carrying the relationship's role — re-checked on every request.\n \n ```ts\n * organizationTypes: {\n * workspace: {\n * userTypes: ['member'],\n * availableOrgRoles: ['ORG_OWNER', 'ORG_ADMIN', 'ORG_MEMBER', 'ORG_SERVICE_PROVIDER'],\n * servesAsProvider: {\n * clientOrganizationTypes: ['workspace'],\n * providerRoles: ['ORG_SERVICE_PROVIDER'],\n * defaultProviderRole: 'ORG_SERVICE_PROVIDER',\n * },\n * },\n * }\n * ```\n \n Startup refuses:\n * - a provider role that leads up to `ORG_ADMIN` — a relationship never confers administration of the\n * client (a narrow, time-bound delegation is a separate mechanism);\n * - a provider role that a client type does not list in its `availableOrgRoles`;\n * - a `defaultProviderRole` that is not one of `providerRoles`, and a client type that is not declared.\n \n The core `ORG_SERVICE_PROVIDER` role (inherits `ORG_MEMBER`) is the usual choice.\n /\n servesAsProvider: z.object({\n clientOrganizationTypes: z.array(z.string().min(1)).min(1),\n providerRoles: z.array(z.string().min(1)).min(1),\n defaultProviderRole: z.string().min(1),\n }).optional(),\n\n /\n How organizations of this type, as CLIENTS of a service firm, admit the firm's experts by default (#1612).\n \n Each relationship carries its own `expertAdmissionPolicy`, chosen by the client when it proposes or accepts and\n * changed later by a client administrator; this is only where that choice STARTS when the client makes none —\n * for instance a firm's proposal the client has not accepted yet. The relationship's value always wins. It sits\n * on the CLIENT type because the client owns the choice: a firm's type never decides who enters another tenant.\n \n ```ts\n * organizationTypes: {\n * lawClient: {\n * // …\n * acceptsServiceProviders: { defaultExpertAdmissionPolicy: ServiceProviderExpertAdmissionPolicy.CLIENT_APPROVES_EACH_EXPERT },\n * },\n * }\n * ```\n \n Absent: every expert a firm assigns is admitted (`RELATIONSHIP_APPROVES_ASSIGNED_EXPERTS`), the #1597 behaviour.\n /\n acceptsServiceProviders: z.object({\n defaultExpertAdmissionPolicy: z.enum(ServiceProviderExpertAdmissionPolicy).optional(),\n /\n The longest, in days, an organization of this type may lend a service firm a SECURITY-CRITICAL administrative\n * capability (SSO/SCIM, API keys, access-grant approval — #1631). Lowers the framework's 30-day cap; it can never\n * raise it. Ordinary capabilities keep their two-year maximum.\n /\n securityCriticalCapabilityMaxDays: z.number().int().min(1).max(SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS).optional(),\n /\n When a client's pending approval of one of a firm's experts lapses, and who is reminded before it does (#1909) —\n * #1628's deadline declaration, on this plane: `lapseAfter` (ISO-8601, e.g. `'P14D'`), a `decision` target with\n * an optional `warnBefore`, and NOTIFY `rules`. There is no `claim`, no REASSIGN and no `pauseStates`: the\n * approval is routed to the client's administrators as a group, offers only an answer, and startup refuses a\n * declaration asking for more. Absent: the framework defaults every human decision gets (a 24-hour lapse, a\n * reminder to the administrators at three quarters of it). A lapsed approval admits nobody; the firm assigns again.\n /\n expertApprovalDeadlines: ReviewDeadlinesDeclarationSchema.optional(),\n }).optional(),\n});\nexport type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;\n/* @wildo_source:part:end saas.models.config.organization-types /\n\n// ─── Top-Level Config Sections ──────────────────────────────────────────────\n\nexport const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);\nexport type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;\n\nexport const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);\nexport type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;\n\n/\n The application's organization types — at least ONE, always.\n \n ## Why an empty map is refused (#1032, decided 2026-09-14)\n \n Every organization carries a `type`, and that type must name an entry here. The authentication\n * policy resolver refuses a member whose organization's type it cannot resolve, because a type is\n * where an organization's authentication restrictions live and \"could not tell\" must never read as\n * \"no restrictions\". An application declaring no types therefore could not have a single\n * organization anybody can sign in through — including the one the platform seeds for its first\n * administrator. It used to be optional, and the platform seeded that organization with no type at\n * all, which is how every administrator came to be locked out once the resolver fail-closed.\n \n Authored in `wildo.saas.config.ts` (not the backend config) so the platform, which seeds the first\n * organization, can read it.\n \n A type key is letters, digits, `_` and `-` only (#1851): it is also the last segment of its label key,\n * `system_enums.OrganizationType.<type>`, and the label tree is addressed by dotted path. A dotted key would name a\n * label nobody could resolve, so the type would show its raw key for ever with nothing reporting why, and a key\n * `acme.eu` beside `acme` would need `acme` to be both a word and a branch. The reviewers' reason codes refuse a dot\n * for the same reason (`AgentWorkReasonCodeSchema`); both test it with `isLabelKeySegment`.\n /\nexport const OrganizationTypesConfigSchema = z\n .record(z.string(), OrganizationTypeDefinitionSchema)\n .superRefine((organizationTypes, ctx) => {\n // Checked here rather than as a record-key schema, whose failure Zod reports only as \"Invalid key in record\".\n for (const typeKey of Object.keys(organizationTypes)) {\n if (!isLabelKeySegment(typeKey)) {\n ctx.addIssue({\n code: 'custom',\n path: [typeKey],\n message: `Organization type key \"${typeKey}\" may contain only letters, digits, \"_\" and \"-\": it is also the last `\n + 'segment of its label key, system_enums.OrganizationType.<type>, which is addressed by dotted path.',\n });\n }\n }\n if (Object.keys(organizationTypes).length === 0) {\n ctx.addIssue({\n code: 'custom',\n path: [],\n message:\n 'At least one organization type must be declared: every organization carries a type, and a '\n + 'member of an organization whose type names no entry here cannot sign in.',\n });\n }\n /\n * At most ONE type may declare `ownsApplication`, and a type that declares it may not also be\n * created on registration.\n \n Both refusals live here for the same reason the `ownerByRegisteredUserType` map below does:\n * they are statements ABOUT THE MAP, not about any one entry, so a per-entry refine could not\n * see them. And both are contradictions in the declaration rather than states of the world —\n * refusing them where the file is loaded turns a would-be second owner organization into an\n * authoring error nobody can commit.\n /\n const markedOwnerTypes = Object.entries(organizationTypes)\n .filter(([, definition]) => definition.ownsApplication === true)\n .map(([organizationType]) => organizationType);\n\n if (markedOwnerTypes.length > 1) {\n ctx.addIssue({\n code: 'custom',\n path: [markedOwnerTypes[1]!, 'ownsApplication'],\n message:\n `Organization types ${markedOwnerTypes.map((type) => `'${type}'`).join(', ')} all declare \\`ownsApplication\\`, `\n + 'but an application is owned by exactly one organization, so at most one type may say so. '\n + 'Keep the marker on the type whose organization operates the application and remove it from the others.',\n });\n }\n\n for (const organizationType of markedOwnerTypes) {\n if (organizationTypes[organizationType]?.creationPolicy === undefined) continue;\n ctx.addIssue({\n code: 'custom',\n path: [organizationType, 'creationPolicy'],\n message:\n `Organization type '${organizationType}' declares \\`ownsApplication\\` and a \\`creationPolicy\\`. `\n + 'A creation policy makes a new organization of this type every time a matching user registers, '\n + 'which would produce one owner organization per registrant; at most one may exist. '\n + 'Keep the marker and drop the creation policy, or move the policy to a separate type for the tenants that sign themselves up.',\n });\n }\n\n const ownerByRegisteredUserType = new Map<string, string>();\n for (const [organizationType, definition] of Object.entries(\n organizationTypes,\n )) {\n const registeredUserTypes =\n definition.creationPolicy?.createOnUserTypeRegistration ?? [];\n registeredUserTypes.forEach((userType, index) => {\n const existingOwner = ownerByRegisteredUserType.get(userType);\n if (existingOwner !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: [\n organizationType,\n 'creationPolicy',\n 'createOnUserTypeRegistration',\n index,\n ],\n message:\n `User type '${userType}' already creates organization type `\n + `'${existingOwner}' during registration; one registration `\n + 'cannot implicitly choose between multiple organization types',\n });\n return;\n }\n ownerByRegisteredUserType.set(userType, organizationType);\n });\n }\n });\nexport type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;\n\nexport interface OrganizationTypeRegistrationCreationMatch<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n } = OrganizationTypeDefinition,\n> {\n readonly organizationType: string;\n readonly definition: TDefinition;\n}\n\n/\n Canonical matching rule for registration-derived organization creation.\n \n The schema rejects more than one match for a user type. Returning all\n * matches is intentional defensive behavior for stale/unparsed runtime input:\n * callers can fail closed instead of selecting record insertion order.\n /\nexport function findOrganizationTypeRegistrationCreationMatches<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n },\n>(\n organizationTypes: Readonly<Record<string, TDefinition>> \| undefined,\n registeredUserType: string,\n): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[] {\n if (!organizationTypes) return [];\n return Object.entries(organizationTypes)\n .filter(([, definition]) =>\n definition.creationPolicy?.createOnUserTypeRegistration.includes(\n registeredUserType,\n ),\n )\n .map(([organizationType, definition]) => ({\n organizationType,\n definition,\n }));\n}\n\n/\n Why an organization yields no authentication policy — the log-side split of\n * `ErrorCustomMessageReference.AUTHENTICATION_ORGANIZATION_POLICY_UNRESOLVED` (#1036). Three states, three remedies.\n /\nexport enum OrganizationAuthPolicyUnresolvedReason {\n /* A membership names an organization that cannot be found. Remedy: remove the membership or restore the organization. /\n ORGANIZATION_NOT_FOUND = 'organization_not_found',\n /* The organization carries no type. The engine types such organizations at startup when one type is declared. /\n ORGANIZATION_TYPE_MISSING = 'organization_type_missing',\n /* The organization's type names no declared organization type. Remedy: declare it again, or restart so the engine re-types it. /\n ORGANIZATION_TYPE_UNDECLARED = 'organization_type_undeclared',\n}\n\n/\n Why an organization type could, or could not, be derived — the vocabulary both derivations below\n * answer in.\n \n A closed vocabulary rather than `string \| undefined`, because the two refusals have different\n * remedies and a caller has to be able to name them: NONE means the declaration offers nothing that\n * fits (declare a type), AMBIGUOUS means it offers several and the framework will not choose between\n * them by record order (narrow the declaration).\n /\nexport enum OrganizationTypeDerivationOutcome {\n /* Exactly one declared type fits; it is `organizationType`. /\n DERIVED = 'DERIVED',\n /* No declared type fits. /\n NONE = 'NONE',\n /* More than one declared type fits; they are `candidates`, in declaration order. /\n AMBIGUOUS = 'AMBIGUOUS',\n}\n\nexport type OrganizationTypeDerivation =\n \| { readonly outcome: OrganizationTypeDerivationOutcome.DERIVED; readonly organizationType: string }\n \| { readonly outcome: OrganizationTypeDerivationOutcome.NONE }\n \| { readonly outcome: OrganizationTypeDerivationOutcome.AMBIGUOUS; readonly candidates: readonly string[] };\n\nconst deriveFromCandidates = (candidates: readonly string[]): OrganizationTypeDerivation => {\n if (candidates.length === 1) {\n return { outcome: OrganizationTypeDerivationOutcome.DERIVED, organizationType: candidates[0]! };\n }\n return candidates.length === 0\n ? { outcome: OrganizationTypeDerivationOutcome.NONE }\n : { outcome: OrganizationTypeDerivationOutcome.AMBIGUOUS, candidates };\n};\n\n/\n The type of the organization the platform seeds for an application's first administrator.\n \n DERIVED, never authored: it is the declared organization type whose `userTypes` include every one of\n * `bootstrap.firstAdmin.userTypes`. An organization type's `userTypes` are what a member of it is\n * granted, so a type that does not cover the administrator's user types would seed them into an\n * organization that contradicts who they are. Asking the application author to restate the answer\n * would be a second copy of a fact the declaration already holds.\n \n Refuses rather than guesses when several types fit — record order is not a decision.\n \n ## The owner marker DECIDES, when one of the fitting types carries it\n \n `ownsApplication` says which organization operates the application, and the organization the\n * platform seeds for the first administrator IS that organization. So when a fitting type is marked,\n * the answer is not ambiguous — it is declared, and reading anything else would seed the operator's\n * own administrator into a customer-shaped tenant.\n \n This is not a tie-break bolted onto a refusal; without it, an application with a marker would\n * usually be REFUSED. The natural shape of a case-1 declaration is a marked `company` for the\n * operator beside an unmarked `workspace` for the tenants that sign themselves up, and both\n * ordinarily grant the same user types — so both cover the first administrator and `AMBIGUOUS` would\n * fire on every such application. `AMBIGUOUS` keeps its whole meaning for the unmarked case: several\n * types fit and NOTHING in the declaration says which, so record order is all that is left and record\n * order is not a decision.\n \n Several MARKED types are still ambiguous, and deliberately so. The configuration schema refuses a\n * second marker, so this can only be reached from a declaration that arrived by another route (a\n * stored configuration written before the rule, an unparsed runtime input) — exactly the case where\n * choosing would be a guess dressed as a derivation.\n /\nexport function deriveFirstAdministratorOrganizationType(\n organizationTypes:\n \| Readonly<Record<string, { readonly userTypes: readonly string[]; readonly ownsApplication?: true }>>\n \| undefined,\n firstAdministratorUserTypes: readonly string[],\n): OrganizationTypeDerivation {\n const fittingTypes = Object.entries(organizationTypes ?? {})\n .filter(([, definition]) => firstAdministratorUserTypes.every((userType) => definition.userTypes.includes(userType)));\n\n const markedFittingTypes = fittingTypes.filter(([, definition]) => definition.ownsApplication === true);\n if (markedFittingTypes.length > 0) {\n return deriveFromCandidates(markedFittingTypes.map(([organizationType]) => organizationType));\n }\n\n return deriveFromCandidates(fittingTypes.map(([organizationType]) => organizationType));\n}\n\n/\n The role that OWNS a newly-created organization of a given type.\n \n ONE resolution for every door that founds a tenant, because a tenant founded without an owner is\n * the stranded state `administrative-continuity-floors.md` exists to prevent, and it is reached by\n * whichever door forgot — not by the ones that remembered.\n \n There are THREE such doors and they are in two packages, which is why this is a function rather\n * than a convention: self-service `organizations.create`, the organization derived when a user of a\n * declaring type registers, and the platform seeding an application's FIRST organization for its\n * first administrator. The first two already resolved it identically and said so in a comment — \"the\n SAME resolution registration uses, so the two creation paths cannot disagree\"* — while the third\n * hard-coded `ORG_ADMIN` and gave every freshly created application an ownerless first tenant, which\n * its own boot report then reported at CRITICAL forever (#436 established the invariant and fixed two\n * of its three call sites; `invariant-call-site-enumeration.md`).\n \n `ORG_OWNER` is the answer when the type declares no `creationPolicy` or no `defaultOwnerRole` —\n * the same default `OrgCreationPolicySchema` carries, restated here because the seeding lanes reach\n * types that never passed through that parse (a platform-supplied declaration, a stored\n * configuration). An application that wants a differently-named founding role declares it once, on\n * the type, and all three doors follow.\n /\nexport function resolveOrganizationFoundingOwnerRole(\n organizationTypes: Readonly<Record<string, { readonly creationPolicy?: { readonly defaultOwnerRole?: string } }>> \| undefined,\n organizationType: string \| undefined,\n): string {\n const declared = organizationType === undefined ? undefined : organizationTypes?.[organizationType];\n return declared?.creationPolicy?.defaultOwnerRole ?? CORE_ORG_ROLES.ORG_OWNER;\n}\n\n/\n Which declared organization type OWNS the application, if any.\n \n The one reader of {@link OrganizationTypeDefinition.ownsApplication}, so every surface that needs\n * \"the owner type\" asks the same question of the same declaration rather than re-typing the filter.\n \n `NONE` is an ordinary, correct answer and the default for every application: most applications are\n * sold to many tenants and no organization operates them. Only a case-1 application — an internal\n * tool, or a product extending a suite the operator already runs — declares one.\n \n `AMBIGUOUS` is unreachable from a configuration the schema parsed (a second marker is refused\n * there), and is returned rather than resolved for the same reason the derivation above does it: a\n * declaration that reached a runtime by another route must not have its contradiction silently\n * decided. Callers fail closed on it; nothing is the owner until an operator repairs the declaration.\n /\nexport function resolveApplicationOwnerOrganizationType(\n organizationTypes: Readonly<Record<string, { readonly ownsApplication?: true }>> \| undefined,\n): OrganizationTypeDerivation {\n return deriveFromCandidates(\n Object.entries(organizationTypes ?? {})\n .filter(([, definition]) => definition.ownsApplication === true)\n .map(([organizationType]) => organizationType),\n );\n}\n\n/\n The type an EXISTING untyped organization receives when the application declares exactly one.\n \n The narrowest of the three derivations here: it reads only the declaration, so it answers for an\n * organization about which nothing at all is known. With several declared types it refuses, and the\n * caller falls through to {@link deriveOrganizationTypeFromMemberUserTypes}, which asks the\n * organization itself.\n /\nexport function deriveSoleOrganizationType(\n organizationTypes: Readonly<Record<string, unknown>> \| undefined,\n): OrganizationTypeDerivation {\n return deriveFromCandidates(Object.keys(organizationTypes ?? {}));\n}\n\n/\n The type an EXISTING untyped organization receives, read from the user types its own members hold.\n \n ## Why an existing organization is not silent about its type\n \n {@link deriveSoleOrganizationType} used to be the only answer for an existing organization, on the\n * reasoning that one \"carries no record of which user types it was meant for\". Its MEMBERS carry\n * exactly that record: an organization type's `userTypes` are what a member of it is granted, so a\n * type that does not cover every user type the organization's members actually hold is a type this\n * organization cannot be. When that leaves exactly one candidate, nothing is guessed — it is the same\n * coverage test {@link deriveFirstAdministratorOrganizationType} already applies to the\n * first-administrator organization, asked of the members instead of the declaration.\n \n ## Why an empty `memberUserTypes` is NONE rather than a match\n \n `every` over an empty set is vacuously true, so an organization with no members to read would match\n * every declared type and, against a single-type declaration, would derive one. That would not be a\n * derivation from the organization — it would be {@link deriveSoleOrganizationType} wearing this\n * function's name, reached without reading anything. Absence of a signal is NONE.\n \n @param memberUserTypes The union of the user types held by the organization's members. The caller\n * decides which memberships count; it is the one judgement this function does not make.\n */\nexport function deriveOrganizationTypeFromMemberUserTypes(\n organizationTypes: Readonly<Record<string, { readonly userTypes: readonly string[] }>> \| undefined,\n memberUserTypes: readonly string[],\n): OrganizationTypeDerivation {\n if (memberUserTypes.length === 0) {\n return { outcome: OrganizationTypeDerivationOutcome.NONE };\n }\n return deriveFromCandidates(\n Object.entries(organizationTypes ?? {})\n .filter(([, definition]) => memberUserTypes.every((userType) => definition.userTypes.includes(userType)))\n .map(([organizationType]) => organizationType),\n );\n}\n"]}

package/dist/esm/config/frontend/chart-definition.shared.schemas.d.ts CHANGED Viewed

@@ -73,8 +73,8 @@ export declare const ChartSeriesStyleSchema: z.ZodObject<{
     emphasisScale: z.ZodOptional<z.ZodBoolean>;
     markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
         type: z.ZodOptional<z.ZodEnum<{
-            max: "max";
             min: "min";
+            max: "max";
             average: "average";
         }>>;
         yValue: z.ZodOptional<z.ZodNumber>;
@@ -89,8 +89,8 @@ export declare const ChartSeriesStyleSchema: z.ZodObject<{
     }, z.core.$strip>>>;
     markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
         type: z.ZodOptional<z.ZodEnum<{
-            max: "max";
             min: "min";
+            max: "max";
             average: "average";
         }>>;
         label: z.ZodOptional<z.ZodString>;
@@ -155,8 +155,8 @@ export declare const ChartSeriesDefinitionSchema: z.ZodObject<{
         emphasisScale: z.ZodOptional<z.ZodBoolean>;
         markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
-                max: "max";
                 min: "min";
+                max: "max";
                 average: "average";
             }>>;
             yValue: z.ZodOptional<z.ZodNumber>;
@@ -171,8 +171,8 @@ export declare const ChartSeriesDefinitionSchema: z.ZodObject<{
         }, z.core.$strip>>>;
         markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
-                max: "max";
                 min: "min";
+                max: "max";
                 average: "average";
             }>>;
             label: z.ZodOptional<z.ZodString>;
@@ -239,8 +239,8 @@ export declare const ChartSeriesSchema: z.ZodObject<{
         emphasisScale: z.ZodOptional<z.ZodBoolean>;
         markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
-                max: "max";
                 min: "min";
+                max: "max";
                 average: "average";
             }>>;
             yValue: z.ZodOptional<z.ZodNumber>;
@@ -255,8 +255,8 @@ export declare const ChartSeriesSchema: z.ZodObject<{
         }, z.core.$strip>>>;
         markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
             type: z.ZodOptional<z.ZodEnum<{
-                max: "max";
                 min: "min";
+                max: "max";
                 average: "average";
             }>>;
             label: z.ZodOptional<z.ZodString>;
@@ -411,8 +411,8 @@ export declare const ChartAppearanceSchema: z.ZodObject<{
         formatter: z.ZodOptional<z.ZodString>;
         axisPointerType: z.ZodOptional<z.ZodEnum<{
             none: "none";
-            shadow: "shadow";
             line: "line";
+            shadow: "shadow";
             cross: "cross";
         }>>;
     }, z.core.$strip>>;
@@ -436,8 +436,8 @@ export declare const ChartAppearanceSchema: z.ZodObject<{
             slider: "slider";
         }>>>;
         axis: z.ZodOptional<z.ZodEnum<{
-            y: "y";
             both: "both";
+            y: "y";
             x: "x";
         }>>;
         start: z.ZodOptional<z.ZodNumber>;
@@ -605,8 +605,8 @@ export type ChartTypeConfig_Heatmap = z.infer<typeof ChartTypeConfig_HeatmapSche
 export declare const ChartTypeConfig_SankeySchema: z.ZodObject<{
     emphasisFocus: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        self: "self";
         adjacency: "adjacency";
+        self: "self";
     }>>;
     nodeWidth: z.ZodOptional<z.ZodNumber>;
     nodeGap: z.ZodOptional<z.ZodNumber>;
@@ -817,8 +817,8 @@ export declare const ChartTypeConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$loose>, z.ZodObject<{
     emphasisFocus: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        self: "self";
         adjacency: "adjacency";
+        self: "self";
     }>>;
     nodeWidth: z.ZodOptional<z.ZodNumber>;
     nodeGap: z.ZodOptional<z.ZodNumber>;
@@ -1024,8 +1024,8 @@ export declare const ChartViewOptionsSchema: z.ZodObject<{
     }, z.core.$loose>, z.ZodObject<{
         emphasisFocus: z.ZodOptional<z.ZodEnum<{
             none: "none";
-            self: "self";
             adjacency: "adjacency";
+            self: "self";
         }>>;
         nodeWidth: z.ZodOptional<z.ZodNumber>;
         nodeGap: z.ZodOptional<z.ZodNumber>;
@@ -1211,8 +1211,8 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
             emphasisScale: z.ZodOptional<z.ZodBoolean>;
             markLines: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 type: z.ZodOptional<z.ZodEnum<{
-                    max: "max";
                     min: "min";
+                    max: "max";
                     average: "average";
                 }>>;
                 yValue: z.ZodOptional<z.ZodNumber>;
@@ -1227,8 +1227,8 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
             }, z.core.$strip>>>;
             markPoints: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 type: z.ZodOptional<z.ZodEnum<{
-                    max: "max";
                     min: "min";
+                    max: "max";
                     average: "average";
                 }>>;
                 label: z.ZodOptional<z.ZodString>;
@@ -1342,8 +1342,8 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
             formatter: z.ZodOptional<z.ZodString>;
             axisPointerType: z.ZodOptional<z.ZodEnum<{
                 none: "none";
-                shadow: "shadow";
                 line: "line";
+                shadow: "shadow";
                 cross: "cross";
             }>>;
         }, z.core.$strip>>;
@@ -1367,8 +1367,8 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
                 slider: "slider";
             }>>>;
             axis: z.ZodOptional<z.ZodEnum<{
-                y: "y";
                 both: "both";
+                y: "y";
                 x: "x";
             }>>;
             start: z.ZodOptional<z.ZodNumber>;
@@ -1510,8 +1510,8 @@ export declare const ChartDefinitionSchema: z.ZodObject<{
     }, z.core.$loose>, z.ZodObject<{
         emphasisFocus: z.ZodOptional<z.ZodEnum<{
             none: "none";
-            self: "self";
             adjacency: "adjacency";
+            self: "self";
         }>>;
         nodeWidth: z.ZodOptional<z.ZodNumber>;
         nodeGap: z.ZodOptional<z.ZodNumber>;

package/dist/esm/config/frontend/chart-definition.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"chart-definition.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/config/frontend/chart-definition.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAEhF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAE9F;;oEAEoE;AAOpE,oBAAY,SAAS;IAEnB,GAAG,QAAQ;IACX,cAAc,mBAAmB;IACjC,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,SAAS,cAAc;IAGvB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IAGvB,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,OAAO,YAAY;IAGnB,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;IAGnB,KAAK,UAAU;IACf,QAAQ,aAAa;IAGrB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;IAGjB,QAAQ,aAAa;CACtB;AAID,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAKD,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuEjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAKtE,eAAO,MAAM,sBAAsB;;;;;iBASjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAKtE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8BtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAKhF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAK5D,oBAAY,mBAAmB;IAC7B,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,YAAY,iBAAiB;IAC7B,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,qBAAqB,iHAMhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,sBAAsB,2IAA8C,CAAC;AAElF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,mBAAmB,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAavG;AAED,oBAAY,2BAA2B;IACrC,MAAM,WAAW;CAClB;AAED,oBAAY,wBAAwB;IAClC,MAAM,WAAW;IACjB,EAAE,OAAO;IACT,qBAAqB,QAAQ;IAC7B,kBAAkB,QAAQ;CAC3B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAoBrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAC3C,CAAC,CAAC,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAgDzC;AA8LD;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE;IACzD,eAAe,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GAAG,gBAAgB,CAmCnB;AAID,eAAO,MAAM,wBAAwB;;iBAGnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsHhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAUpE,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;iBAoBrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,2EAA2E;AAC3E,eAAO,MAAM,yBAAyB;;;;;;;;;;;iBAoBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,mCAAmC;AACnC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;iBA0BpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,6CAA6C;AAC7C,eAAO,MAAM,6BAA6B;;;;;;;;;;;;iBAOxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,mBAAmB;AACnB,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAgCtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,qBAAqB;AACrB,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;iBAkBvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,mBAAmB;AACnB,eAAO,MAAM,2BAA2B;;;;;;;;;;;iBAetC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,uBAAuB;AACvB,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;iBAiBxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,qBAAqB;AACrB,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;iBAavC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,yBAAyB;AACzB,eAAO,MAAM,8BAA8B;;;;;;;;;;;iBAgBzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,6CAA6C;AAC7C,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8B7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,uBAAuB;AACvB,eAAO,MAAM,6BAA6B;;;;iBAOxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAIpF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAahC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AA2CpE;;;GAGG;AACH,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,IAChD,CAAC,SAAS,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC,SAAS,GAAG,oBAAoB,GAC/G,CAAC,SAAS,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC,cAAc,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,SAAS,GAAG,mBAAmB,GAC9I,CAAC,SAAS,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC,KAAK,GAAG,mBAAmB,GAC/D,CAAC,SAAS,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,uBAAuB,GACxE,CAAC,SAAS,SAAS,CAAC,KAAK,GAAG,qBAAqB,GACjD,CAAC,SAAS,SAAS,CAAC,MAAM,GAAG,sBAAsB,GACnD,CAAC,SAAS,SAAS,CAAC,KAAK,GAAG,qBAAqB,GACjD,CAAC,SAAS,SAAS,CAAC,OAAO,GAAG,uBAAuB,GACrD,CAAC,SAAS,SAAS,CAAC,MAAM,GAAG,sBAAsB,GACnD,CAAC,SAAS,SAAS,CAAC,QAAQ,GAAG,wBAAwB,GACvD,CAAC,SAAS,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,4BAA4B,GAC/E,CAAC,SAAS,SAAS,CAAC,OAAO,GAAG,uBAAuB,GACrD,CAAC,SAAS,SAAS,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GACpD,KAAK,CAAC;AAKR,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyKhC,CAAC;AAEH;;oEAEoE;AAEpE,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACzC,CAAC;CACH"}
1	+ {"version":3,"file":"chart-definition.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/frontend/chart-definition.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAEhF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAE9F;;oEAEoE;AAOpE,oBAAY,SAAS;IAEnB,GAAG,QAAQ;IACX,cAAc,mBAAmB;IACjC,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,SAAS,cAAc;IAGvB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IAGvB,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,OAAO,YAAY;IAGnB,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,OAAO,YAAY;IAGnB,KAAK,UAAU;IACf,QAAQ,aAAa;IAGrB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;IAGjB,QAAQ,aAAa;CACtB;AAID,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,IAAI,SAAS;CACd;AAKD,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuEjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAKtE,eAAO,MAAM,sBAAsB;;;;;iBASjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAKtE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8BtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAKhF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAK5D,oBAAY,mBAAmB;IAC7B,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,YAAY,iBAAiB;IAC7B,YAAY,iBAAiB;CAC9B;AAED,eAAO,MAAM,qBAAqB,iHAMhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,sBAAsB,2IAA8C,CAAC;AAElF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,mBAAmB,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAavG;AAED,oBAAY,2BAA2B;IACrC,MAAM,WAAW;CAClB;AAED,oBAAY,wBAAwB;IAClC,MAAM,WAAW;IACjB,EAAE,OAAO;IACT,qBAAqB,QAAQ;IAC7B,kBAAkB,QAAQ;CAC3B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAoBrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAC3C,CAAC,CAAC,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAgDzC;AA8LD;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE;IACzD,eAAe,EAAE,eAAe,CAAC;IACjC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GAAG,gBAAgB,CAmCnB;AAID,eAAO,MAAM,wBAAwB;;iBAGnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsHhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAUpE,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;iBAoBrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,2EAA2E;AAC3E,eAAO,MAAM,yBAAyB;;;;;;;;;;;iBAoBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,mCAAmC;AACnC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;iBA0BpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,6CAA6C;AAC7C,eAAO,MAAM,6BAA6B;;;;;;;;;;;;iBAOxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,mBAAmB;AACnB,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAgCtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,qBAAqB;AACrB,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;iBAkBvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,mBAAmB;AACnB,eAAO,MAAM,2BAA2B;;;;;;;;;;;iBAetC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,uBAAuB;AACvB,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;iBAiBxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,qBAAqB;AACrB,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;iBAavC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,yBAAyB;AACzB,eAAO,MAAM,8BAA8B;;;;;;;;;;;iBAgBzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,6CAA6C;AAC7C,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8B7C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,uBAAuB;AACvB,eAAO,MAAM,6BAA6B;;;;iBAOxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAIpF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAahC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AA2CpE;;;GAGG;AACH,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,IAChD,CAAC,SAAS,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC,SAAS,GAAG,oBAAoB,GAC/G,CAAC,SAAS,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC,cAAc,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,SAAS,GAAG,mBAAmB,GAC9I,CAAC,SAAS,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC,KAAK,GAAG,mBAAmB,GAC/D,CAAC,SAAS,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,uBAAuB,GACxE,CAAC,SAAS,SAAS,CAAC,KAAK,GAAG,qBAAqB,GACjD,CAAC,SAAS,SAAS,CAAC,MAAM,GAAG,sBAAsB,GACnD,CAAC,SAAS,SAAS,CAAC,KAAK,GAAG,qBAAqB,GACjD,CAAC,SAAS,SAAS,CAAC,OAAO,GAAG,uBAAuB,GACrD,CAAC,SAAS,SAAS,CAAC,MAAM,GAAG,sBAAsB,GACnD,CAAC,SAAS,SAAS,CAAC,QAAQ,GAAG,wBAAwB,GACvD,CAAC,SAAS,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,4BAA4B,GAC/E,CAAC,SAAS,SAAS,CAAC,OAAO,GAAG,uBAAuB,GACrD,CAAC,SAAS,SAAS,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GACpD,KAAK,CAAC;AAKR,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyKhC,CAAC;AAEH;;oEAEoE;AAEpE,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACzC,CAAC;CACH"}