@wildo-ai/saas-models 1.1.9 → 1.1.10

package/dist/esm/config/app-configuration-shared.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-configuration-shared.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAA6B,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAC3I,OAAO,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mEAAmE,CAAC;AACpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,wCAAwC,EAAE,MAAM,uEAAuE,CAAC;AAC/J,OAAO,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,2DAA2D,CAAC;AACjJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,yDAAyD,CAAC;AAC7G,OAAO,EAAE,sCAAsC,EAAE,MAAM,8DAA8D,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD;;;;;;;;;;;;;;OAcG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,mBAAmB;IACjC;;;;;OAKG;IACH,WAAW,EAAE,mBAAmB;CACxB,CAAC;AAMX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzD,6EAA6E;IAE7E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF;;;;;;;;OAQG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjB,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC;IAE3F,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE5D,qEAAqE;IACrE;;;;;;;;;;;;OAYG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE7C,sDAAsD;IACtD,kFAAkF;IAClF,8EAA8E;CAE/E,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC;IAChG,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAEnH;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC;IAE5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE1E;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,8BAA8B,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC;IAEhI;;;;;;;;;;;;;;;OAeG;IACH,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,OAAO,CAAC;IAEhH;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAErE;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,iCAAiC,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAE5D;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,sCAAsC,CAAC,QAAQ,EAAE;CAEzE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACrE,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACzG,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAsC,aAA2B,EAAE,EAAE;IAC/H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC,+BAA+B,CAAC,CAAC;AAInI,wDAAwD;AACxD,0BAA0B;AAC1B,wDAAwD;AAExD,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,wDAA+B,CAAA;AACjC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,6GAA6G;IAC7G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kEAAkE;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEnC,qCAAqC;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D;;;;;;;;;;OAUG;IACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,+DAA+D;QAC/D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,yCAAyC;IACzC,mBAAmB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC,CAAC;AAGH,wDAAwD;AACxD,gCAAgC;AAChC,wDAAwD;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAErD,WAAW,EAAE,0CAA0C;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAExD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,qDAAqD;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAE/E,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,mDAAmD;IACnD,SAAS,EAAE,qBAAqB;IAChC,0HAA0H;IAC1H,gBAAgB,EAAE,4BAA4B;IAC9C;;;;;;;;OAQG;IACH,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,UAAU,EAAE,wCAAwC;IAEpD,gEAAgE;IAChE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAE9C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,yCAAyC;IACzC,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAErD,sGAAsG;IACtG,0GAA0G;IAC1G,wGAAwG;IACxG,4DAA4D;IAC5D,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAE/C,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,4DAA4D;IAC5D,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAE/C,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAE9C,CAAC,CAAC","sourcesContent":["/**\n * Frontend Application Configuration Schemas\n *\n * Pure frontend configuration schemas that define what configuration\n * the frontend applications expect to receive from backend endpoints.\n *\n * NOTE: OAuth2 providers are NOT configured here. OAuth2 is a protocol\n * defined at the provider level in external-connectors, just like REST_API\n * and HOOKS protocols. This configuration only enables/disables which\n * external providers are available for SSO authentication.\n */\n\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models';\nimport { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { AllSharedApplicationTypes, AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas';\nimport { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas';\nimport { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas';\nimport { ClientInstanceIdScope, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas';\nimport { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';\nimport { ServiceConsentRequirementSchema } from '../compliance/privacy/operator-compliance-identity.shared.schemas';\nimport { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas';\nimport { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas';\nimport { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas';\nimport { ReviewCalendarSchema } from '../flows-actors/review-deadlines.shared.schemas';\nimport { GovernedDocumentApprovalGate, GovernedDocumentInteractionSurfaceSchema } from '../compliance/documents/governed-document-interactions.shared.schemas';\nimport { GovernedDocumentAcceptanceMode, GovernedDocumentPublicDocumentSchema } from '../compliance/documents/governed-documents.shared.schemas';\nimport { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas';\nimport { ApplicationRetentionScheduleSchema } from '../compliance/privacy/retention-schedule.shared.schemas';\nimport { SubjectDataRecipientsDeclarationSchema } from '../compliance/privacy/subject-data-recipients.shared.schemas';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { ValueMomentSchema } from './analytics-value-moments.shared.schemas';\nimport {\n  UserTypesConfigSchema,\n  FrontendServicesConfigSchema,\n  OrganizationTypesConfigSchema,\n  OrgAuthMethodPolicy,\n} from './entity-identity-config.shared.schemas';\n\n\n\n/**\n * Shared Password Policy Rules Schema\n *\n * Contains ONLY the validation rules that both frontend and backend need.\n * The backend extends these rules with hashing config (argon2 params)\n * via AppConfiguration_AuthSchema in app-config.backend.schemas.ts.\n *\n * Frontend uses these rules for:\n * - Real-time password strength validation as user types\n * - Password policy indicator in reset/registration forms\n */\n\n\nexport const PasswordPolicyRulesSchema = z.object({\n  /**\n   * The shortest password an application may REQUIRE, and the shortest it may ACCEPT.\n   *\n   * The floor is 8, not 6, because the standard states it as an obligation on the verifier:\n   * \"Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length.\"\n   * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).\n   * A schema that admitted 6 let an application declare a policy the standard forbids — quietly,\n   * since nothing downstream re-checked the declared value.\n   *\n   * The DEFAULT is 15 because the same section continues: \"Verifiers and CSPs SHOULD require\n   * passwords to be a minimum of 15 characters in length.\"\n   * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).\n   * A framework's default is the answer every application that expresses no opinion receives, so it\n   * takes the SHOULD; the floor only has to stop an application going below the SHALL.\n   */\n  minLength: z.number().min(8).max(128).default(15),\n  maxLength: z.number().min(8).max(256).default(128),\n  requireUppercase: z.boolean().default(false),\n  requireLowercase: z.boolean().default(false),\n  requireNumbers: z.boolean().default(false),\n  requireSpecialChars: z.boolean().default(false),\n  /**\n   * R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),\n   * NOT used in the client-side password pre-check — but it IS a field of this shared schema and\n   * therefore ships wherever the schema is serialized (e.g. `AuthInvitationInfoResponse.passwordPolicy`).\n   * Non-secret. (Corrected from the prior \"Backend-only\" which wrongly implied it is never serialized.)\n   * NOTE: `PasswordPolicyConfigSchema` (entity-identity-config) must stay field-identical to this schema\n   * — the invitation response `.parse()` silently strips any field present there but absent here.\n   */\n  expiryDays: z.number().min(0).default(0),\n});\n\nexport type PasswordPolicyRules = z.infer<typeof PasswordPolicyRulesSchema>;\n\n/**\n * I18n label keys for password policy violations.\n * Values match PasswordPolicyLabel in presets-components-models for frontend resolution.\n * Labels support placeholders: policyMinLength → {minLength}, policyMaxLength → {maxLength}.\n */\nexport const PasswordPolicyViolationCode = {\n  MIN_LENGTH: 'policyMinLength',\n  MAX_LENGTH: 'policyMaxLength',\n  UPPERCASE: 'policyUppercase',\n  LOWERCASE: 'policyLowercase',\n  NUMBER: 'policyNumber',\n  SPECIAL_CHAR: 'policySpecialChar',\n  /**\n   * The password is a known common guess, the application's own name, or the user's own email local\n   * part. The check that NIST SP 800-63B-4 §3.1.1.2 asks for in place of the composition rules above\n   * — which the same section forbids, and which is why `UPPERCASE`, `LOWERCASE`, `NUMBER` and\n   * `SPECIAL_CHAR` now default to unenforced while this one always runs.\n   */\n  BLOCKLISTED: 'policyBlocklisted',\n} as const;\n\nexport type PasswordPolicyViolationCode = (typeof PasswordPolicyViolationCode)[keyof typeof PasswordPolicyViolationCode];\n\n\n\n/**\n * Global Auth Config — infrastructure + app-level only.\n *\n * Auth POLICY (authMethodsEnabled, mfaPolicy, registration, passwordPolicy,\n * sessionDurationMinutes, lockoutPolicy, autoLinkByEmail, stepUpAuth,\n * methodManagement) is now per-user-type on UserTypeAuthPolicySchema\n * in entity-identity-config.shared.schemas.ts.\n *\n * This section retains only infrastructure and app-level settings that apply\n * equally regardless of user type.\n *\n */\nexport const AppConfiguration_Shared_AuthSchema = z.object({\n\n  // ─── INFRASTRUCTURE (stays on global auth) ────────────────────────────────\n\n  passkeyConfig: z.object({\n    rpName: z.string().min(1),\n    rpId: z.string().min(1),\n    maxPasskeysPerUser: z.number().min(1).max(50).default(10),\n  }),\n\n  /**\n   * Minimal frontend-facing social OAuth2 projection.\n   *\n   * Backend runtime still owns the full backend-private\n   * `auth.socialOAuth2Providers` authoring shape\n   * (enabled flags, scopes, allowed domains, secrets-related semantics). The\n   * shared `/application-config` payload only needs the enabled public provider\n   * refs plus an optional app-authored display-name override.\n   */\n  socialOAuth2Providers: z.record(\n    z.string(),\n    z.object({\n      displayName: z.string().optional(),\n    })).default({}),\n\n  /** E-10, D-15: How much orgs can override user-type auth methods. */\n  orgAuthMethodPolicy: z.enum(OrgAuthMethodPolicy).default(OrgAuthMethodPolicy.RESTRICT_ONLY),\n\n  /** E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. */\n  expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),\n\n  /** E-4, D-2: Can a user authenticated via Org A SSO access Org B? */\n  /**\n   * May a user who authenticated through ONE organization's identity provider reach ANOTHER\n   * organization through SSO?\n   *\n   * Defaults to `false` (#1223). It defaulted to `true`, and both readers tested for an explicit\n   * `false`, so an application silently permitted cross-tenant SSO reach unless it knew to write the\n   * flag — a tenancy boundary decided by an omission. Neither dogfood application wrote it.\n   *\n   * `false` is the fail-closed answer and the one a multi-tenant application almost always wants: an\n   * identity proven to Acme's provider says nothing about whether that person belongs at Globex. An\n   * application that genuinely wants the reach — a group of organizations sharing one directory —\n   * writes `true`, which is a statement a reviewer can find.\n   */\n  crossOrgSSOAccess: z.boolean().default(false),\n\n  // W6.8: All per-user-type auth policy fields REMOVED.\n  // Use userTypes[t].auth.* instead (see entity-identity-config.shared.schemas.ts).\n  // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).\n\n});\n\n\n\n\nexport const AppConfiguration_Shared_ComplianceSchema = z.object({\n  userProfileVisibility: z.enum(UserProfileVisibility).default(UserProfileVisibility.ORGANIZATION),\n  organizationProfileVisibility: z.enum(OrganizationProfileVisibility).default(OrganizationProfileVisibility.PRIVATE),\n\n  /**\n   * Client-install identification policy (`clientInstanceId`) — **OFF unless authored**.\n   *\n   * Lives on `compliance` because it is a privacy decision, not an observability knob, and lives on\n   * the SHARED config because both halves of the mechanism must obey ONE authored value: the\n   * frontend decides whether to mint/store/send the id, and the backend independently decides\n   * whether to ingest and record it. Two gates, one source — an application that never opts in is\n   * protected even if some client sends the header anyway.\n   *\n   * Defaults to {@link ClientInstanceIdScope.DISABLED} so the privacy-preserving posture is the one\n   * you get by doing nothing. See the enum's JSDoc for the ePrivacy/GDPR/NIST reasoning and the\n   * obligations attached to each non-`DISABLED` member.\n   */\n  clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),\n\n  /**\n   * The governed-document releases in force for this application — **empty unless authored**.\n   *\n   * ## What this closes\n   *\n   * The compliance lane could COMPOSE a release (`composeGovernedDocumentRelease`) and had nowhere\n   * to put it that the running application could see. Measured 2026-09-12: no package in either\n   * example app depends on its own `specifications` package, whose only exports are `.` and\n   * `./companion` — so a composed release reached the companion and the repository and never the\n   * runtime. Issue #54 asks for a record of which terms release a user accepted; nothing could\n   * resolve which release that was.\n   *\n   * ## Why HERE, on the shared payload\n   *\n   * The same reason as {@link ClientInstanceIdScope} above: both halves of the mechanism must obey\n   * ONE authored value. The frontend decides whether to render a consent control and what it is\n   * consenting to; the backend independently decides what may be recorded and composes the record.\n   * Two gates, one source.\n   *\n   * ## Why the SURFACE and not the release\n   *\n   * This payload reaches an unauthenticated browser. A full release additionally carries\n   * `governanceScope` and `approvalDecisions` — internal custody detail\n   * `projectGovernedDocumentPublicRelease` already withholds from public consumers. It happens that\n   * `composeGovernedDocumentInteraction` reads neither, so the browser-safe slice is exactly the\n   * slice the mechanism needs; see {@link GovernedDocumentInteractionSurfaceSchema}. Author it with\n   * `projectGovernedDocumentInteractionSurface(release)` so the release file stays the one source.\n   *\n   * `.default([])` rather than required, and that is not politeness: this schema parses a PERSISTED\n   * application-config document, and a required field would refuse every document written before\n   * today — the 2026-08-27 failure recorded in `staleness-presents-as-a-logic-defect.md`.\n   */\n  governedDocumentReleases: z.array(GovernedDocumentInteractionSurfaceSchema).default([]),\n\n  /**\n   * The governed documents this application SERVES as public pages — `/privacy`, `/terms`. Issue #168.\n   * Each entry is either a RELEASED document (a recorded release's public projection, carrying the text\n   * it was recorded with) or, for a public document that has never been released, its latest\n   * UNRELEASED_DRAFT, which the page marks as a draft. Issue #968.\n   *\n   * ## Why this is separate from `governedDocumentReleases`\n   *\n   * They answer different questions about the same underlying release, and the schemas already say\n   * so: the interaction surface is what a CONSENT control needs (`approvalState`, plus\n   * `allowedInteractionKinds` for what MAY be accepted), while a public page needs to ROUTE and\n   * DISPLAY (title, sections, clauses, effective date, version) AND, since #1258 Step 5, know\n   * whether it may record a `NOTICE_DELIVERED` for the release it is showing — which is what\n   * `allowedInteractionKinds` also answers here, for a different verb. Merging the two payloads\n   * would put document PROSE into the payload every registration form receives, which is what this\n   * split exists to prevent; a field two surfaces both need for their own reasons is not that,\n   * and it appears on each projection on its own terms rather than one borrowing the other's copy.\n   * Neither is typed by hand: `wildo config document-releases` writes both into the application's\n   * `governed-document-releases.generated.ts` from its recorded releases (and, for this one, its\n   * landed drafts), so the release stays the one source.\n   *\n   * ## Why the prose is safe to put in an unauthenticated payload\n   *\n   * Because it is what the page exists to show. Both halves are the deliberately-narrow public\n   * projections — `governanceScope` and `approvalDecisions` never appear, and `bodyMarkdown` is\n   * rendered as TEXT, never as raw HTML. The surface carries no internal custody detail at all.\n   *\n   * `.default([])` for the same reason as its neighbour: this parses a PERSISTED configuration\n   * document, and a required field would refuse every document written before today.\n   */\n  publicDocuments: z.array(GovernedDocumentPublicDocumentSchema).default([]),\n\n  /**\n   * How the registration form asks a person to accept the documents above (#1258).\n   *\n   * See {@link GovernedDocumentAcceptanceMode} for what each member changes and the enforceability\n   * position it takes. It is read by `Auth_Register`, which is why it is on the SHARED payload: the\n   * decision is the application's and the form is the only thing that can carry it out.\n   *\n   * ## Why it defaults to the STRONGEST shape rather than the one this rule's prose leads with\n   *\n   * `EXPLICIT_CHECKBOX` is what registration already did before this field existed, and a default is\n   * what every application that declares nothing receives — so any other default would silently move\n   * shipped applications to a weaker acceptance posture on an engine upgrade, without anyone deciding\n   * to. An operator who wants the lighter \"by registering you agree\" shape says so, once, here.\n   *\n   * ## Why it is declared rather than derived\n   *\n   * `derive-before-you-ask.md` asks what already decides this, and nothing does: the release declares\n   * WHAT may be accepted (`allowedInteractionKinds`) and the public document declares what it SAYS,\n   * but neither carries how hard the operator wants to be asked. It is a liability posture — the one\n   * class `settled-questions-are-not-decisions.md` keeps with the operator — so it is a typed,\n   * committed, diffable declaration rather than a question or a guess.\n   *\n   * `.default(...)` rather than optional or required, for the reason its two neighbours give: this\n   * schema parses a PERSISTED application-config document, and a required field would refuse every\n   * document written before today.\n   */\n  governedDocumentAcceptanceMode: z.enum(GovernedDocumentAcceptanceMode).default(GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX),\n\n  /**\n   * Whether this application shows, and asks people to accept, governed documents nobody has\n   * approved (#1565). See {@link GovernedDocumentApprovalGate} for what each member changes.\n   *\n   * ONE member rather than an option on each surface, because the public page and the acceptance\n   * surfaces must never be armed separately: armed on the page alone, `/terms` answers \"unavailable\"\n   * while sign-up asks people to accept those same terms. Every surface reads it through\n   * `requiresApprovedGovernedDocuments`.\n   *\n   * Defaults to UNARMED, the posture while an application is being built\n   * (`.claude/rules/one-source-of-truth.md` D5). Arming it is part of Gate 3's membership test.\n   *\n   * `.default(...)` for the reason its neighbours give: this schema parses a PERSISTED\n   * application-config document, and a required field would refuse every document written before\n   * today.\n   */\n  governedDocumentApprovalGate: z.enum(GovernedDocumentApprovalGate).default(GovernedDocumentApprovalGate.UNARMED),\n\n  /**\n   * The purposes a signed-in person must grant before the application renders any of its routes —\n   * the RUNTIME half of `operatorComplianceIdentity.serviceConsentRequirement` (#453).\n   *\n   * Declared once, in `wildo.saas.config.ts`, and projected here by `wildo config service-consent`\n   * into `backend-api/src/service-consent-requirement.generated.ts`, which `saas-config.backend.ts`\n   * composes — the `governedDocumentReleases` precedent, so there is never a second hand-copied source.\n   *\n   * Enforced on BOTH tiers. The backend refuses every user-initiated operation except the person's own\n   * context and preferences until every required purpose is granted — one gate,\n   * `AuthorizationsBackendService.assertServiceConsentRequirementMet`, reached from each entry point a person\n   * can initiate work through: `authorizeInController` (REST, MCP tools, queued operations, WebSocket rows,\n   * agent tool calls), `authorizeInProgrammaticSurface` (retrieval), `authorizeOperationRolesOnly` (WebSocket\n   * scope subscriptions), the manual-controller context (charts, analytics, features, flows-actors, provider\n   * operations and connections), the WebSocket badge reads, the A2A task reads (`tasks/get`, `ListTasks`,\n   * `tasks/resubscribe`, `tasks/pushNotificationConfig/*`), and every A2A or WebSocket conversational turn,\n   * started or resumed after an approval. Authentication endpoints are not resource operations and stay open,\n   * as does cancelling an A2A task the person already started; updates the server pushes on its own are not\n   * held back. `AppLayout_AuthenticatedRoute` shows the consent gate where the\n   * person grants them. On the SHARED config because the frontend reads it. It carries no personal data and no\n   * lawful-basis detail, so it is safe in the payload every signed-in browser receives.\n   *\n   * OPTIONAL, and absent means the application declared nothing — nothing is gated. That is the same\n   * observable behaviour as a declared empty set, and deliberately so: a runtime must never block a\n   * person on a requirement nobody stated. The DISTINCTION between the two lives where it matters, in\n   * the declaration and the documents composed from it.\n   */\n  serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n\n  /**\n   * Every purpose declared by at least one resource operation's `consentGate` (#1462, following\n   * #1258 Step 3), so the application-tier consent-gate PROMPT can offer to grant it.\n   *\n   * DERIVED, never authored — this is not a declaration site. A resource operation declares\n   * `consentGate: { purpose, refusal?, timing? }` in its OWN `*.resources-config.ts`\n   * (`ResourceOperationConsentGateDeclaration`), which is where the decision belongs: a capability's\n   * consent posture is expressed beside the capability, not restated a second time here for the\n   * frontend to read. This field is the engine scanning every resource's every operation once, at\n   * boot, and recording the SET of purposes at least one of them named — `wildo config`-generated\n   * fields read `wildo.saas.config.ts`, which does not see per-operation declarations scattered\n   * across the app, so that pattern does not fit here; this is populated by\n   * `ResourcesRegistryBackendService.initialize()` calling back into `AppConfigurationService` the\n   * moment the registry — and therefore every operation's declared purpose — is fully built.\n   *\n   * `applicationAskedConsentPurposes` unions this with `requiredPurposes` and the analytics purpose\n   * to decide `optionalPurposes` on `ConsentGateState` — the same generic PROMPT that already offers\n   * ANALYTICS, now also offering whatever a capability declared. It does not distinguish `timing`\n   * (`ON_USE` / `FIRST_SESSION` / …): no per-capability or per-session prompt surface exists yet to\n   * honour those distinctly, so every declared purpose is offered by the one surface that does exist,\n   * which is strictly better than the alternative — refusing a capability with no way at all to grant\n   * what it asks for.\n   *\n   * OPTIONAL and defaults to the empty array on any config resolved before this field existed, which\n   * is the same observable behaviour as declaring no `consentGate` anywhere (R12).\n   */\n  capabilityDeclaredConsentPurposes: z.enum(ConsentPurpose).array().default([]),\n\n  /**\n   * The application's declared retention schedule — the RUNTIME half of `dataRetention` in\n   * `wildo.saas.config.ts` (#1613).\n   *\n   * Declared once, in `wildo.saas.config.ts`, and projected here by `wildo config data-retention` into\n   * `backend-api/src/data-retention.generated.ts`, which `saas-config.backend.ts` composes — the\n   * `serviceConsentRequirement` precedent, so the period a privacy notice states and the period the\n   * retention sweep enforces are one value, never a hand-copied pair.\n   *\n   * Read at every sweep run, never cached per row, so a period change applies on the next run with no\n   * backfill. It also single-sources two older horizons: `auditTrail.archiveAfterDays` derives from\n   * `AUDIT_LOGS` and `tenantTeardown.retentionWindowDays` from `RESOURCE_DATA` when unset, and startup\n   * refuses a value that disagrees with the schedule.\n   *\n   * OPTIONAL and partial exactly like the declaration: an absent class is UNDECIDED, and the sweep\n   * deletes nothing for a resource bound to an undeclared class. On the shared config because a period\n   * is what the application already publishes in its privacy notice; it carries no personal data.\n   */\n  dataRetention: ApplicationRetentionScheduleSchema.optional(),\n\n  /**\n   * Who else holds a data subject's personal data — every recipient the application's declared flows reach, with the\n   * legal identity its processor register adopted, the categories each flow carries and the erasure stance (#1710).\n   *\n   * DERIVED, never authored: `wildo config subject-data-recipients` runs the one design-time derivation and writes\n   * `backend-api/src/subject-data-recipients.generated.ts`, which `saas-config.backend.ts` composes here — the\n   * `dataRetention` precedent. A subject export lists these recipients (Art. 15(1)(c)); a subject erasure reports an\n   * outcome for each (Art. 19). See `subject-data-recipients.shared.schemas.ts`.\n   *\n   * OPTIONAL, and absent is NOT DECLARED rather than \"no recipient\": an export says so, and an erasure carries one\n   * UNMEASURED outcome naming it. On the shared config because it states what the privacy notice already publishes\n   * — vendor identities and categories, never a person's data.\n   */\n  subjectDataRecipients: SubjectDataRecipientsDeclarationSchema.optional(),\n\n});\n\n\n\nexport const AppConfiguration_Shared_AppIdentity_Schema = z.object({\n  /** Technical app name — used as fallback when displayName is absent */\n  appName: z.string().min(1, { error: 'Application name is required' }),\n  /** Human-readable display name shown in UI and emails */\n  displayName: z.string().optional(),\n  /** Short description of the application */\n  description: z.string().optional(),\n  version: z.string().min(1, { error: 'Version is required' }),\n  /**\n   * The application's own id — the scope an APPLICATION-scoped resource's WebSocket room is keyed on.\n   *\n   * ## Why the client needs it, measured rather than argued\n   *\n   * `deriveResourceScopeRoomQualifiers` yields the `app` room only when `applicationId` is present in\n   * the context it is handed, and a read's context is built from the URL's contextual parameters —\n   * which never carry one, because an application id is AMBIENT rather than addressed. Nothing else\n   * published it either: the access token's claims carry `userId` and no `applicationId`, and this\n   * very object carried only `appName`/`displayName`/`version`.\n   *\n   * The consequence was silent. On 2026-09-03 the workbench subscribed to `org` and `user` for an\n   * APPLICATION-scoped resource and was confirmed in both, while the companion published that\n   * resource's changes to the `app` room. Correct producer, confirmed subscriber, different rooms,\n   * zero frames delivered (issue #283).\n   *\n   * ## Why it is safe to publish here\n   *\n   * It is an IDENTIFIER, not a credential: it names which application this deployment is, it grants\n   * nothing, and every authenticated request already acts within it. The room name a client must\n   * compute is derived from it, so a client that may subscribe at all must be able to name it —\n   * authorization for that room is decided server-side against the SUBSCRIBED RESOURCE, never\n   * against possession of this value (issue #247).\n   *\n   * OPTIONAL because a deployment that predates this field must keep loading. A consumer that does\n   * not find it degrades to the previous behaviour — it derives whatever rooms its parameters imply\n   * and does not hear the application-room push — rather than failing.\n   */\n  applicationId: z.string().min(1).optional(),\n});\n\n\nexport const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({\n  defaultLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n  enabledLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]),\n  fallbackLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n  autoDetectFromBrowser: z.boolean().default(true),\n  allowUserOverride: z.boolean().default(true),\n  allowOrganizationOverride: z.boolean().default(true),\n  enableLanguageSwitcher: z.boolean().default(true)\n});\n\n\nexport const appConfiguration_Shared_RuntimeSchemaBuilder = <T extends AllSharedApplicationTypes>(appTypeSchema: z.ZodType<T>) => {\n  return z.object({\n    endPoints: z.record(z.string(), z.object({\n      publicUrl: z.string().optional(),\n      internalUrl: z.string().optional(),\n    })),\n  })\n}\n\nexport const AppConfiguration_Shared_RuntimeSchema = appConfiguration_Shared_RuntimeSchemaBuilder(AllSharedApplicationTypesSchema);\n\n\n\n// =====================================================\n// Analytics Configuration\n// =====================================================\n\nexport enum AnalyticsProviderType {\n  CONSOLE = 'console',\n  BACKEND_PROXY = 'backend_proxy',\n}\n\n/** Uses providerType (not \"type\") to avoid Mongoose reserved keyword conflict during Zod→Mongoose conversion. */\nexport const AnalyticsProviderConfigSchema = z.object({\n  providerType: z.enum(AnalyticsProviderType),\n  config: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport const AutoInstrumentationConfigSchema = z.object({\n  /** Track page views (NAVIGATION_PANE_CHANGED events) */\n  pageViews: z.boolean().default(true),\n  /** Track resource operations (NOTIFY_RESOURCE_SUCCESS events) */\n  resourceOperations: z.boolean().default(true),\n  /** Track errors (ERROR_OCCURED events). Named 'trackErrors' to avoid Mongoose reserved 'errors' pathname. */\n  trackErrors: z.boolean().default(true),\n  /** Track feature gate hits (shown/blocked) — debounced per feature per session */\n  featureGate: z.boolean().default(true),\n  /** Track user lifecycle events (login, logout, status changes) */\n  userLifecycle: z.boolean().default(true),\n  /** Track notification events (NOTIFY_CUSTOM_* events) */\n  notifications: z.boolean().default(false),\n  /** Track hotkey usage */\n  hotkeys: z.boolean().default(false),\n});\n\nexport const AnalyticsConfigSchema = z.object({\n  /** Master switch — false = no analytics at all, regardless of user consent */\n  enabled: z.boolean().default(false),\n\n  /** Registered analytics providers */\n  providers: z.array(AnalyticsProviderConfigSchema).default([]),\n\n  /**\n   * Whether analytics rests on the person's consent to `ConsentPurpose.ANALYTICS` (default `true`).\n   *\n   * A boolean rather than a purpose, because analytics has exactly one purpose by definition. `false`\n   * is a claim that analytics here is not consent-based — anonymised measurement under a documented\n   * legitimate interest — and the lawful basis for that belongs in `operatorComplianceIdentity`.\n   *\n   * Replaces `requiredConsent: DataProcessingConsent`, a minimum LEVEL on an ordered scale that\n   * implied a person who agreed to marketing had agreed to analytics (#534). `requiredConsent: NONE`\n   * is `requiresConsent: false`; every other value is `true`.\n   */\n  requiresConsent: z.boolean().default(true),\n\n  /**\n   * SINGLE DECLARATION SURFACE for all value moments.\n   * TTFV, aha moments, activation stages, and anti-patterns are all here,\n   * distinguished by their `role` field.\n   */\n  valueMoments: z.array(ValueMomentSchema).optional(),\n\n  /** Persistence and evaluation configuration */\n  persistence: z.object({\n    /** Persist achieved moments to localStorage (default: true) */\n    localStorage: z.boolean().default(true),\n    /** Sync achieved moments to backend (default: true) */\n    backendSync: z.boolean().default(true),\n    /**\n     * Backend evaluates RESOURCE_STATE signals + cronjob-originated events.\n     * When true, RESOURCE_STATE signals are evaluated by the backend engine (authoritative).\n     * When false, frontend does optimistic cached count queries.\n     */\n    backendEvaluation: z.boolean().default(true),\n  }).default({\n    localStorage: true,\n    backendSync: true,\n    backendEvaluation: true,\n  }),\n\n  /** Auto-instrumentation configuration */\n  autoInstrumentation: AutoInstrumentationConfigSchema.default({\n    pageViews: true,\n    resourceOperations: true,\n    trackErrors: true,\n    featureGate: true,\n    userLifecycle: true,\n    notifications: false,\n    hotkeys: false,\n  }),\n});\n\n\n// =====================================================\n// Main Shared App Configuration\n// =====================================================\n\nexport const AppConfiguration_Shared_Schema = z.object({\n\n  appIdentity: AppConfiguration_Shared_AppIdentity_Schema,\n\n  /**\n   * The generated brand assets — the runtime projection of the brand identity\n   * an app's build-time logo step produces. THE single source of truth every\n   * logo/favicon/brand-image consumer resolves against via `resolveBrandAsset`\n   * (by composition × theme × purpose). Empty/absent until a brand is\n   * generated; consumers fall back to a placeholder.\n   *\n   * MOVED OFF `appIdentity` (2026-07): brand assets are app-authored,\n   * BUILD-TIME content (a CLI generates them from a spec SSOT and writes a\n   * `backend-api/src/brand-assets.generated.ts` the backend config composes),\n   * NOT platform-declaration identity. `appIdentity` is\n   * platform-declaration-materialized and boundary-blocked for backend\n   * authoring (`AppConfiguration_BackendAuthored` Omits `appIdentity`, and the\n   * `applyBackendConfig` inspector rejects it), so a backend-authorable slot is\n   * required. This top-level `brandAssets` is that slot — it is present on both\n   * the frontend shared payload (here) and the backend-authored managed config\n   * (`_AppConfiguration_AppManagedConfiguration_Schema`).\n   */\n  brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n\n  appPreferences: z.object({\n    languages: AppConfiguration_Shared_AppPreferencesLanguage_Schema,\n  }),\n  apiJwtPublicKey: z.string().min(1, { error: 'API JWT public key is required' }),\n\n  runtime: AppConfiguration_Shared_RuntimeSchema,\n  auth: AppConfiguration_Shared_AuthSchema,\n  /** User types — required. No implicit defaults. */\n  userTypes: UserTypesConfigSchema,\n  /** Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. */\n  frontendServices: FrontendServicesConfigSchema,\n  /**\n   * Org typing. MANDATORY for a running application, optional in this schema (#1032, 2026-09-14).\n   *\n   * Every organization carries a type naming an entry here, and a member of an organization whose type\n   * resolves to nothing cannot sign in, so an application with none is refused at startup. The schema\n   * stays optional because it also parses configuration that predates the field, and the door that\n   * writes the field has to be able to read that configuration first. It used to say \"only for apps with\n   * typed organizations\"; every application has organizations.\n   */\n  organizationTypes: OrganizationTypesConfigSchema.optional(),\n  /**\n   * The organization role table's keys a membership may hold (#1921): the core organization roles plus the\n   * application's custom organization roles, as the running backend's authorization service holds them, less the roles\n   * no membership may hold: the handler-only roles (`INBOUND_HANDLER_ONLY_ROLES`) and the delegated capability roles a\n   * live grant alone confers (`DELEGATED_CAPABILITY_ROLES`). What a role picker\n   * (`StringEditMode.ORGANIZATION_ROLE`) offers; each role's words come from the `roles` label tree.\n   *\n   * RUNTIME-DERIVED, like `appIdentity.applicationId`: an application does not author it here — it declares custom\n   * roles in its shared modules, and the backend publishes the merged table on `/application-config`. Custom roles are\n   * application-wide, so every organization of the application has the same table.\n   *\n   * Safe to publish: role KEYS are vocabulary, not authority — the same keys already ship in the public `roles` label\n   * bundle, and holding a role is decided server-side against the membership, never against knowing its name.\n   * OPTIONAL so a backend that predates it keeps loading; a picker without it degrades to a text input.\n   */\n  organizationRoles: z.array(z.string().min(1)).optional(),\n  compliance: AppConfiguration_Shared_ComplianceSchema,\n\n  // Billing Configuration (optional: billing disabled by default)\n  billing: BillingConfigurationSchema.optional(),\n\n  // Analytics Configuration (optional: analytics disabled by default)\n  analytics: AnalyticsConfigSchema.optional(),\n\n  // Lifecycle Configuration (optional: lifecycle disabled by default)\n  lifecycle: LifecycleConfigSchema.optional(),\n\n  // Tenant-Teardown Configuration (optional: every field defaults, so omitting the block yields a\n  // working 30-day retention window purged nightly). Holds the operator-tunable retention window,\n  // purge cron and per-run batch size consumed by the engine-owned `organization-purge` batch.\n  // See TenantTeardownConfigSchema for why this is NOT folded into `lifecycle` (which is the USER\n  // lifecycle and is disabled by default).\n  tenantTeardown: TenantTeardownConfigSchema.optional(),\n\n  // Review calendar (#1628, optional): the application's business hours and holidays, in one time zone.\n  // Read only by pending human decisions whose gate counts a CLAIM or DECISION clock on the CALENDAR basis;\n  // a gate asking for that basis in an application declaring none is refused at startup. One calendar per\n  // application, never per tenant — see ReviewCalendarSchema.\n  reviewCalendar: ReviewCalendarSchema.optional(),\n\n  // Data-Seeding Configuration (optional: when omitted, the engine-owned\n  // `data-seeding:scheduled-rerun` batch uses the manifest's built-in\n  // minute-tick default cron — see DataSeedingConfigSchema for the full\n  // rationale on why operators rarely need to override this).\n  dataSeeding: DataSeedingConfigSchema.optional(),\n\n  // Audit-Trail Configuration (optional: when omitted, NO archival runs and\n  // audit records are retained in the primary AUDIT_LOGS store indefinitely).\n  // Holds the operator-tunable archival horizon (`archiveAfterDays`) consumed\n  // by the engine-owned `compliance:audit-logs-archive` batch. Records are\n  // never deleted (AUDIT_LOGS is immutable, G5) — see AuditTrailConfigSchema.\n  auditTrail: AuditTrailConfigSchema.optional(),\n\n});\n\n\nexport type AppConfiguration_Shared_Compliance = z.infer<typeof AppConfiguration_Shared_ComplianceSchema>;\nexport type AppConfiguration_Shared_AppIdentity = z.infer<typeof AppConfiguration_Shared_AppIdentity_Schema>;\nexport type AppConfiguration_Shared_AppPreferencesLanguage = z.infer<typeof AppConfiguration_Shared_AppPreferencesLanguage_Schema>;\nexport type AnalyticsProviderConfig = z.infer<typeof AnalyticsProviderConfigSchema>;\nexport type AppConfiguration_Shared_Runtime = z.infer<typeof AppConfiguration_Shared_RuntimeSchema>;\nexport type AutoInstrumentationConfig = z.infer<typeof AutoInstrumentationConfigSchema>;\nexport type AnalyticsConfig = z.infer<typeof AnalyticsConfigSchema>;\nexport type AppConfiguration_Shared_Auth = z.infer<typeof AppConfiguration_Shared_AuthSchema>;\nexport type AppConfiguration_Shared = z.infer<typeof AppConfiguration_Shared_Schema>;\n"]}
+{"version":3,"file":"app-configuration-shared.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/app-configuration-shared.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAA6B,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAC3I,OAAO,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mEAAmE,CAAC;AACpH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,wCAAwC,EAAE,MAAM,uEAAuE,CAAC;AAC/J,OAAO,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,MAAM,2DAA2D,CAAC;AACjJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,yDAAyD,CAAC;AAC7G,OAAO,EAAE,sCAAsC,EAAE,MAAM,8DAA8D,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,yCAAyC,CAAC;AAIjD;;;;;;;;;;GAUG;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD;;;;;;;;;;;;;;OAcG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,mBAAmB;IACjC;;;;;OAKG;IACH,WAAW,EAAE,mBAAmB;CACxB,CAAC;AAMX;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAEzD,6EAA6E;IAE7E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1D,CAAC;IAEF;;;;;;;;OAQG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAC7B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjB,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAAC;IAE3F,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE5D,qEAAqE;IACrE;;;;;;;;;;;;OAYG;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAE7C,sDAAsD;IACtD,kFAAkF;IAClF,8EAA8E;CAE/E,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC;IAChG,6BAA6B,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAEnH;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC;IAE5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE1E;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,8BAA8B,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC;IAEhI;;;;;;;;;;;;;;;OAeG;IACH,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,OAAO,CAAC;IAEhH;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,yBAAyB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAErE;;;;;;;;OAQG;IACH,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEzC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,iCAAiC,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7E;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAE5D;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,sCAAsC,CAAC,QAAQ,EAAE;CAEzE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACrE,yDAAyD;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qDAAqD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxG,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACzG,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAsC,aAA2B,EAAE,EAAE;IAC/H,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,4CAA4C,CAAC,+BAA+B,CAAC,CAAC;AAInI,wDAAwD;AACxD,0BAA0B;AAC1B,wDAAwD;AAExD,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,wDAA+B,CAAA;AACjC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,iHAAiH;AACjH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,wDAAwD;IACxD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,6GAA6G;IAC7G,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,kEAAkE;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,yDAAyD;IACzD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEnC,qCAAqC;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D;;;;;;;;;;OAUG;IACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,+DAA+D;QAC/D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC;;;;WAIG;QACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7C,CAAC,CAAC,OAAO,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,yCAAyC;IACzC,mBAAmB,EAAE,+BAA+B,CAAC,OAAO,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,IAAI;QACxB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,KAAK;KACf,CAAC;CACH,CAAC,CAAC;AAGH,wDAAwD;AACxD,gCAAgC;AAChC,wDAAwD;AAExD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAErD,WAAW,EAAE,0CAA0C;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAExD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,qDAAqD;KACjE,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;IAE/E,OAAO,EAAE,qCAAqC;IAC9C,IAAI,EAAE,kCAAkC;IACxC,mDAAmD;IACnD,SAAS,EAAE,qBAAqB;IAChC,0HAA0H;IAC1H,gBAAgB,EAAE,4BAA4B;IAC9C;;;;;;;;OAQG;IACH,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC3D;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,UAAU,EAAE,wCAAwC;IAEpD,gEAAgE;IAChE,OAAO,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAE9C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,oEAAoE;IACpE,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAE3C,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,yCAAyC;IACzC,cAAc,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAErD,sGAAsG;IACtG,0GAA0G;IAC1G,wGAAwG;IACxG,4DAA4D;IAC5D,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAE/C,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,4DAA4D;IAC5D,WAAW,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAE/C,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAE9C,CAAC,CAAC","sourcesContent":["/**\n * Frontend Application Configuration Schemas\n *\n * Pure frontend configuration schemas that define what configuration\n * the frontend applications expect to receive from backend endpoints.\n *\n * NOTE: OAuth2 providers are NOT configured here. OAuth2 is a protocol\n * defined at the provider level in external-connectors, just like REST_API\n * and HOOKS protocols. This configuration only enables/disables which\n * external providers are available for SSO authentication.\n */\n\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models';\nimport { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { AllSharedApplicationTypes, AllSharedApplicationTypesSchema } from '../applications/applications.shared.schemas';\nimport { BillingConfigurationSchema } from '../billing/billing-configuration.shared.schemas';\nimport { RuntimeBrandAssetSchema } from './brand-assets.shared.schemas';\nimport { ClientInstanceIdScope, OrganizationProfileVisibility, UserProfileVisibility } from '../compliance/privacy/privacy.shared.schemas';\nimport { ConsentPurpose } from '../compliance/privacy/consent-purposes.shared';\nimport { ServiceConsentRequirementSchema } from '../compliance/privacy/operator-compliance-identity.shared.schemas';\nimport { LegalNoticeSchema } from '../compliance/privacy/legal-notice.shared';\nimport { DataSeedingConfigSchema } from '../data-seeding/data-seeding-config.shared.schemas';\nimport { LifecycleConfigSchema } from '../guidance/lifecycle-config.shared.schemas';\nimport { TenantTeardownConfigSchema } from '../organizations/tenant-teardown-config.shared.schemas';\nimport { ReviewCalendarSchema } from '../flows-actors/review-deadlines.shared.schemas';\nimport { GovernedDocumentApprovalGate, GovernedDocumentInteractionSurfaceSchema } from '../compliance/documents/governed-document-interactions.shared.schemas';\nimport { GovernedDocumentAcceptanceMode, GovernedDocumentPublicDocumentSchema } from '../compliance/documents/governed-documents.shared.schemas';\nimport { AuditTrailConfigSchema } from '../compliance/audit-trails/audit-trail-config.shared.schemas';\nimport { ApplicationRetentionScheduleSchema } from '../compliance/privacy/retention-schedule.shared.schemas';\nimport { SubjectDataRecipientsDeclarationSchema } from '../compliance/privacy/subject-data-recipients.shared.schemas';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { ValueMomentSchema } from './analytics-value-moments.shared.schemas';\nimport {\n  UserTypesConfigSchema,\n  FrontendServicesConfigSchema,\n  OrganizationTypesConfigSchema,\n  OrgAuthMethodPolicy,\n} from './entity-identity-config.shared.schemas';\n\n\n\n/**\n * Shared Password Policy Rules Schema\n *\n * Contains ONLY the validation rules that both frontend and backend need.\n * The backend extends these rules with hashing config (argon2 params)\n * via AppConfiguration_AuthSchema in app-config.backend.schemas.ts.\n *\n * Frontend uses these rules for:\n * - Real-time password strength validation as user types\n * - Password policy indicator in reset/registration forms\n */\n\n\nexport const PasswordPolicyRulesSchema = z.object({\n  /**\n   * The shortest password an application may REQUIRE, and the shortest it may ACCEPT.\n   *\n   * The floor is 8, not 6, because the standard states it as an obligation on the verifier:\n   * \"Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length.\"\n   * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).\n   * A schema that admitted 6 let an application declare a policy the standard forbids — quietly,\n   * since nothing downstream re-checked the declared value.\n   *\n   * The DEFAULT is 15 because the same section continues: \"Verifiers and CSPs SHOULD require\n   * passwords to be a minimum of 15 characters in length.\"\n   * spec-cite: NIST SP 800-63B-4 §3.1.1.1 (https://pages.nist.gov/800-63-4/sp800-63b.html).\n   * A framework's default is the answer every application that expresses no opinion receives, so it\n   * takes the SHOULD; the floor only has to stop an application going below the SHALL.\n   */\n  minLength: z.number().min(8).max(128).default(15),\n  maxLength: z.number().min(8).max(256).default(128),\n  requireUppercase: z.boolean().default(false),\n  requireLowercase: z.boolean().default(false),\n  requireNumbers: z.boolean().default(false),\n  requireSpecialChars: z.boolean().default(false),\n  /**\n   * R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-ENFORCED (checked at login),\n   * NOT used in the client-side password pre-check — but it IS a field of this shared schema and\n   * therefore ships wherever the schema is serialized (e.g. `AuthInvitationInfoResponse.passwordPolicy`).\n   * Non-secret. (Corrected from the prior \"Backend-only\" which wrongly implied it is never serialized.)\n   * NOTE: `PasswordPolicyConfigSchema` (entity-identity-config) must stay field-identical to this schema\n   * — the invitation response `.parse()` silently strips any field present there but absent here.\n   */\n  expiryDays: z.number().min(0).default(0),\n});\n\nexport type PasswordPolicyRules = z.infer<typeof PasswordPolicyRulesSchema>;\n\n/**\n * I18n label keys for password policy violations.\n * Values match PasswordPolicyLabel in presets-components-models for frontend resolution.\n * Labels support placeholders: policyMinLength → {minLength}, policyMaxLength → {maxLength}.\n */\nexport const PasswordPolicyViolationCode = {\n  MIN_LENGTH: 'policyMinLength',\n  MAX_LENGTH: 'policyMaxLength',\n  UPPERCASE: 'policyUppercase',\n  LOWERCASE: 'policyLowercase',\n  NUMBER: 'policyNumber',\n  SPECIAL_CHAR: 'policySpecialChar',\n  /**\n   * The password is a known common guess, the application's own name, or the user's own email local\n   * part. The check that NIST SP 800-63B-4 §3.1.1.2 asks for in place of the composition rules above\n   * — which the same section forbids, and which is why `UPPERCASE`, `LOWERCASE`, `NUMBER` and\n   * `SPECIAL_CHAR` now default to unenforced while this one always runs.\n   */\n  BLOCKLISTED: 'policyBlocklisted',\n} as const;\n\nexport type PasswordPolicyViolationCode = (typeof PasswordPolicyViolationCode)[keyof typeof PasswordPolicyViolationCode];\n\n\n\n/**\n * Global Auth Config — infrastructure + app-level only.\n *\n * Auth POLICY (authMethodsEnabled, mfaPolicy, registration, passwordPolicy,\n * sessionDurationMinutes, lockoutPolicy, autoLinkByEmail, stepUpAuth,\n * methodManagement) is now per-user-type on UserTypeAuthPolicySchema\n * in entity-identity-config.shared.schemas.ts.\n *\n * This section retains only infrastructure and app-level settings that apply\n * equally regardless of user type.\n *\n */\nexport const AppConfiguration_Shared_AuthSchema = z.object({\n\n  // ─── INFRASTRUCTURE (stays on global auth) ────────────────────────────────\n\n  passkeyConfig: z.object({\n    rpName: z.string().min(1),\n    rpId: z.string().min(1),\n    maxPasskeysPerUser: z.number().min(1).max(50).default(10),\n  }),\n\n  /**\n   * Minimal frontend-facing social OAuth2 projection.\n   *\n   * Backend runtime still owns the full backend-private\n   * `auth.socialOAuth2Providers` authoring shape\n   * (enabled flags, scopes, allowed domains, secrets-related semantics). The\n   * shared `/application-config` payload only needs the enabled public provider\n   * refs plus an optional app-authored display-name override.\n   */\n  socialOAuth2Providers: z.record(\n    z.string(),\n    z.object({\n      displayName: z.string().optional(),\n    })).default({}),\n\n  /** E-10, D-15: How much orgs can override user-type auth methods. */\n  orgAuthMethodPolicy: z.enum(OrgAuthMethodPolicy).default(OrgAuthMethodPolicy.RESTRICT_ONLY),\n\n  /** E-10: Only when orgAuthMethodPolicy is 'expand_within_set'. */\n  expandableOrgMethods: z.array(z.enum(AuthMethod)).optional(),\n\n  /** E-4, D-2: Can a user authenticated via Org A SSO access Org B? */\n  /**\n   * May a user who authenticated through ONE organization's identity provider reach ANOTHER\n   * organization through SSO?\n   *\n   * Defaults to `false` (#1223). It defaulted to `true`, and both readers tested for an explicit\n   * `false`, so an application silently permitted cross-tenant SSO reach unless it knew to write the\n   * flag — a tenancy boundary decided by an omission. Neither dogfood application wrote it.\n   *\n   * `false` is the fail-closed answer and the one a multi-tenant application almost always wants: an\n   * identity proven to Acme's provider says nothing about whether that person belongs at Globex. An\n   * application that genuinely wants the reach — a group of organizations sharing one directory —\n   * writes `true`, which is a statement a reviewer can find.\n   */\n  crossOrgSSOAccess: z.boolean().default(false),\n\n  // W6.8: All per-user-type auth policy fields REMOVED.\n  // Use userTypes[t].auth.* instead (see entity-identity-config.shared.schemas.ts).\n  // W7.3a: anonymousSessionsEnabled is per-userType (UserTypeAuthPolicySchema).\n\n});\n\n\n\n\nexport const AppConfiguration_Shared_ComplianceSchema = z.object({\n  userProfileVisibility: z.enum(UserProfileVisibility).default(UserProfileVisibility.ORGANIZATION),\n  organizationProfileVisibility: z.enum(OrganizationProfileVisibility).default(OrganizationProfileVisibility.PRIVATE),\n\n  /**\n   * Client-install identification policy (`clientInstanceId`) — **OFF unless authored**.\n   *\n   * Lives on `compliance` because it is a privacy decision, not an observability knob, and lives on\n   * the SHARED config because both halves of the mechanism must obey ONE authored value: the\n   * frontend decides whether to mint/store/send the id, and the backend independently decides\n   * whether to ingest and record it. Two gates, one source — an application that never opts in is\n   * protected even if some client sends the header anyway.\n   *\n   * Defaults to {@link ClientInstanceIdScope.DISABLED} so the privacy-preserving posture is the one\n   * you get by doing nothing. See the enum's JSDoc for the ePrivacy/GDPR/NIST reasoning and the\n   * obligations attached to each non-`DISABLED` member.\n   */\n  clientInstanceIdScope: z.enum(ClientInstanceIdScope).default(ClientInstanceIdScope.DISABLED),\n\n  /**\n   * The governed-document releases in force for this application — **empty unless authored**.\n   *\n   * ## What this closes\n   *\n   * The compliance lane could COMPOSE a release (`composeGovernedDocumentRelease`) and had nowhere\n   * to put it that the running application could see. Measured 2026-09-12: no package in either\n   * example app depends on its own `specifications` package, whose only exports are `.` and\n   * `./companion` — so a composed release reached the companion and the repository and never the\n   * runtime. Issue #54 asks for a record of which terms release a user accepted; nothing could\n   * resolve which release that was.\n   *\n   * ## Why HERE, on the shared payload\n   *\n   * The same reason as {@link ClientInstanceIdScope} above: both halves of the mechanism must obey\n   * ONE authored value. The frontend decides whether to render a consent control and what it is\n   * consenting to; the backend independently decides what may be recorded and composes the record.\n   * Two gates, one source.\n   *\n   * ## Why the SURFACE and not the release\n   *\n   * This payload reaches an unauthenticated browser. A full release additionally carries\n   * `governanceScope` and `approvalDecisions` — internal custody detail\n   * `projectGovernedDocumentPublicRelease` already withholds from public consumers. It happens that\n   * `composeGovernedDocumentInteraction` reads neither, so the browser-safe slice is exactly the\n   * slice the mechanism needs; see {@link GovernedDocumentInteractionSurfaceSchema}. Author it with\n   * `projectGovernedDocumentInteractionSurface(release)` so the release file stays the one source.\n   *\n   * `.default([])` rather than required, and that is not politeness: this schema parses a PERSISTED\n   * application-config document, and a required field would refuse every document written before\n   * today — the 2026-08-27 failure recorded in `staleness-presents-as-a-logic-defect.md`.\n   */\n  governedDocumentReleases: z.array(GovernedDocumentInteractionSurfaceSchema).default([]),\n\n  /**\n   * The governed documents this application SERVES as public pages — `/privacy`, `/terms`. Issue #168.\n   * Each entry is either a RELEASED document (a recorded release's public projection, carrying the text\n   * it was recorded with) or, for a public document that has never been released, its latest\n   * UNRELEASED_DRAFT, which the page marks as a draft. Issue #968.\n   *\n   * ## Why this is separate from `governedDocumentReleases`\n   *\n   * They answer different questions about the same underlying release, and the schemas already say\n   * so: the interaction surface is what a CONSENT control needs (`approvalState`, plus\n   * `allowedInteractionKinds` for what MAY be accepted), while a public page needs to ROUTE and\n   * DISPLAY (title, sections, clauses, effective date, version) AND, since #1258 Step 5, know\n   * whether it may record a `NOTICE_DELIVERED` for the release it is showing — which is what\n   * `allowedInteractionKinds` also answers here, for a different verb. Merging the two payloads\n   * would put document PROSE into the payload every registration form receives, which is what this\n   * split exists to prevent; a field two surfaces both need for their own reasons is not that,\n   * and it appears on each projection on its own terms rather than one borrowing the other's copy.\n   * Neither is typed by hand: `wildo config document-releases` writes both into the application's\n   * `governed-document-releases.generated.ts` from its recorded releases (and, for this one, its\n   * landed drafts), so the release stays the one source.\n   *\n   * ## Why the prose is safe to put in an unauthenticated payload\n   *\n   * Because it is what the page exists to show. Both halves are the deliberately-narrow public\n   * projections — `governanceScope` and `approvalDecisions` never appear, and `bodyMarkdown` is\n   * rendered as TEXT, never as raw HTML. The surface carries no internal custody detail at all.\n   *\n   * `.default([])` for the same reason as its neighbour: this parses a PERSISTED configuration\n   * document, and a required field would refuse every document written before today.\n   */\n  publicDocuments: z.array(GovernedDocumentPublicDocumentSchema).default([]),\n\n  /**\n   * How the registration form asks a person to accept the documents above (#1258).\n   *\n   * See {@link GovernedDocumentAcceptanceMode} for what each member changes and the enforceability\n   * position it takes. It is read by `Auth_Register`, which is why it is on the SHARED payload: the\n   * decision is the application's and the form is the only thing that can carry it out.\n   *\n   * ## Why it defaults to the STRONGEST shape rather than the one this rule's prose leads with\n   *\n   * `EXPLICIT_CHECKBOX` is what registration already did before this field existed, and a default is\n   * what every application that declares nothing receives — so any other default would silently move\n   * shipped applications to a weaker acceptance posture on an engine upgrade, without anyone deciding\n   * to. An operator who wants the lighter \"by registering you agree\" shape says so, once, here.\n   *\n   * ## Why it is declared rather than derived\n   *\n   * `derive-before-you-ask.md` asks what already decides this, and nothing does: the release declares\n   * WHAT may be accepted (`allowedInteractionKinds`) and the public document declares what it SAYS,\n   * but neither carries how hard the operator wants to be asked. It is a liability posture — the one\n   * class `settled-questions-are-not-decisions.md` keeps with the operator — so it is a typed,\n   * committed, diffable declaration rather than a question or a guess.\n   *\n   * `.default(...)` rather than optional or required, for the reason its two neighbours give: this\n   * schema parses a PERSISTED application-config document, and a required field would refuse every\n   * document written before today.\n   */\n  governedDocumentAcceptanceMode: z.enum(GovernedDocumentAcceptanceMode).default(GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX),\n\n  /**\n   * Whether this application shows, and asks people to accept, governed documents nobody has\n   * approved (#1565). See {@link GovernedDocumentApprovalGate} for what each member changes.\n   *\n   * ONE member rather than an option on each surface, because the public page and the acceptance\n   * surfaces must never be armed separately: armed on the page alone, `/terms` answers \"unavailable\"\n   * while sign-up asks people to accept those same terms. Every surface reads it through\n   * `requiresApprovedGovernedDocuments`.\n   *\n   * Defaults to UNARMED, the posture while an application is being built\n   * (`.claude/rules/one-source-of-truth.md` D5). Arming it is part of Gate 3's membership test.\n   *\n   * `.default(...)` for the reason its neighbours give: this schema parses a PERSISTED\n   * application-config document, and a required field would refuse every document written before\n   * today.\n   */\n  governedDocumentApprovalGate: z.enum(GovernedDocumentApprovalGate).default(GovernedDocumentApprovalGate.UNARMED),\n\n  /**\n   * The purposes a signed-in person must grant before the application renders any of its routes —\n   * the RUNTIME half of `operatorComplianceIdentity.serviceConsentRequirement` (#453).\n   *\n   * Declared once, in `wildo.saas.config.ts`, and projected here by `wildo config service-consent`\n   * into `backend-api/src/service-consent-requirement.generated.ts`, which `saas-config.backend.ts`\n   * composes — the `governedDocumentReleases` precedent, so there is never a second hand-copied source.\n   *\n   * Enforced on BOTH tiers. The backend refuses every user-initiated operation except the person's own\n   * context and preferences until every required purpose is granted — one gate,\n   * `AuthorizationsBackendService.assertServiceConsentRequirementMet`, reached from each entry point a person\n   * can initiate work through: `authorizeInController` (REST, MCP tools, queued operations, WebSocket rows,\n   * agent tool calls), `authorizeInProgrammaticSurface` (retrieval), `authorizeOperationRolesOnly` (WebSocket\n   * scope subscriptions), the manual-controller context (charts, analytics, features, flows-actors, provider\n   * operations and connections), the WebSocket badge reads, the A2A task reads (`tasks/get`, `ListTasks`,\n   * `tasks/resubscribe`, `tasks/pushNotificationConfig/*`), and every A2A or WebSocket conversational turn,\n   * started or resumed after an approval. Authentication endpoints are not resource operations and stay open,\n   * as does cancelling an A2A task the person already started; updates the server pushes on its own are not\n   * held back. `AppLayout_AuthenticatedRoute` shows the consent gate where the\n   * person grants them. On the SHARED config because the frontend reads it. It carries no personal data and no\n   * lawful-basis detail, so it is safe in the payload every signed-in browser receives.\n   *\n   * OPTIONAL, and absent means the application declared nothing — nothing is gated. That is the same\n   * observable behaviour as a declared empty set, and deliberately so: a runtime must never block a\n   * person on a requirement nobody stated. The DISTINCTION between the two lives where it matters, in\n   * the declaration and the documents composed from it.\n   */\n  serviceConsentRequirement: ServiceConsentRequirementSchema.optional(),\n\n  /**\n   * The legal notice (imprint) the application serves at `/legal-notice` (#2588): the operator's declared identity\n   * particulars, present only when the operator is established where a legal notice is owed (the EU and EEA under\n   * Directive 2000/31/EC Art. 5, the UK under SI 2002/2013 reg. 6, Switzerland under UWG Art. 3 Abs. 1 Bst. s; see `legalNoticeOwed`). Written by `wildo config legal-notice` from `operatorComplianceIdentity`, like\n   * `serviceConsentRequirement` above, so the page renders the declaration rather than a hand-kept copy.\n   * spec-cite: Directive 2000/31/EC Art. 5(1); SI 2002/2013 reg. 6(1); UWG (SR 241) Art. 3 Abs. 1 Bst. s\n   *\n   * Optional: absent means no notice is owed (or the establishment is undeclared), and the page says so.\n   */\n  legalNotice: LegalNoticeSchema.optional(),\n\n  /**\n   * Every purpose declared by at least one resource operation's `consentGate` (#1462, following\n   * #1258 Step 3), so the application-tier consent-gate PROMPT can offer to grant it.\n   *\n   * DERIVED, never authored — this is not a declaration site. A resource operation declares\n   * `consentGate: { purpose, refusal?, timing? }` in its OWN `*.resources-config.ts`\n   * (`ResourceOperationConsentGateDeclaration`), which is where the decision belongs: a capability's\n   * consent posture is expressed beside the capability, not restated a second time here for the\n   * frontend to read. This field is the engine scanning every resource's every operation once, at\n   * boot, and recording the SET of purposes at least one of them named — `wildo config`-generated\n   * fields read `wildo.saas.config.ts`, which does not see per-operation declarations scattered\n   * across the app, so that pattern does not fit here; this is populated by\n   * `ResourcesRegistryBackendService.initialize()` calling back into `AppConfigurationService` the\n   * moment the registry — and therefore every operation's declared purpose — is fully built.\n   *\n   * `applicationAskedConsentPurposes` unions this with `requiredPurposes` and the analytics purpose\n   * to decide `optionalPurposes` on `ConsentGateState` — the same generic PROMPT that already offers\n   * ANALYTICS, now also offering whatever a capability declared. It does not distinguish `timing`\n   * (`ON_USE` / `FIRST_SESSION` / …): no per-capability or per-session prompt surface exists yet to\n   * honour those distinctly, so every declared purpose is offered by the one surface that does exist,\n   * which is strictly better than the alternative — refusing a capability with no way at all to grant\n   * what it asks for.\n   *\n   * OPTIONAL and defaults to the empty array on any config resolved before this field existed, which\n   * is the same observable behaviour as declaring no `consentGate` anywhere (R12).\n   */\n  capabilityDeclaredConsentPurposes: z.enum(ConsentPurpose).array().default([]),\n\n  /**\n   * The application's declared retention schedule — the RUNTIME half of `dataRetention` in\n   * `wildo.saas.config.ts` (#1613).\n   *\n   * Declared once, in `wildo.saas.config.ts`, and projected here by `wildo config data-retention` into\n   * `backend-api/src/data-retention.generated.ts`, which `saas-config.backend.ts` composes — the\n   * `serviceConsentRequirement` precedent, so the period a privacy notice states and the period the\n   * retention sweep enforces are one value, never a hand-copied pair.\n   *\n   * Read at every sweep run, never cached per row, so a period change applies on the next run with no\n   * backfill. It also single-sources two older horizons: `auditTrail.archiveAfterDays` derives from\n   * `AUDIT_LOGS` and `tenantTeardown.retentionWindowDays` from `RESOURCE_DATA` when unset, and startup\n   * refuses a value that disagrees with the schedule.\n   *\n   * OPTIONAL and partial exactly like the declaration: an absent class is UNDECIDED, and the sweep\n   * deletes nothing for a resource bound to an undeclared class. On the shared config because a period\n   * is what the application already publishes in its privacy notice; it carries no personal data.\n   */\n  dataRetention: ApplicationRetentionScheduleSchema.optional(),\n\n  /**\n   * Who else holds a data subject's personal data — every recipient the application's declared flows reach, with the\n   * legal identity its processor register adopted, the categories each flow carries and the erasure stance (#1710).\n   *\n   * DERIVED, never authored: `wildo config subject-data-recipients` runs the one design-time derivation and writes\n   * `backend-api/src/subject-data-recipients.generated.ts`, which `saas-config.backend.ts` composes here — the\n   * `dataRetention` precedent. A subject export lists these recipients (Art. 15(1)(c)); a subject erasure reports an\n   * outcome for each (Art. 19). See `subject-data-recipients.shared.schemas.ts`.\n   *\n   * OPTIONAL, and absent is NOT DECLARED rather than \"no recipient\": an export says so, and an erasure carries one\n   * UNMEASURED outcome naming it. On the shared config because it states what the privacy notice already publishes\n   * — vendor identities and categories, never a person's data.\n   */\n  subjectDataRecipients: SubjectDataRecipientsDeclarationSchema.optional(),\n\n});\n\n\n\nexport const AppConfiguration_Shared_AppIdentity_Schema = z.object({\n  /** Technical app name — used as fallback when displayName is absent */\n  appName: z.string().min(1, { error: 'Application name is required' }),\n  /** Human-readable display name shown in UI and emails */\n  displayName: z.string().optional(),\n  /** Short description of the application */\n  description: z.string().optional(),\n  version: z.string().min(1, { error: 'Version is required' }),\n  /**\n   * The application's own id — the scope an APPLICATION-scoped resource's WebSocket room is keyed on.\n   *\n   * ## Why the client needs it, measured rather than argued\n   *\n   * `deriveResourceScopeRoomQualifiers` yields the `app` room only when `applicationId` is present in\n   * the context it is handed, and a read's context is built from the URL's contextual parameters —\n   * which never carry one, because an application id is AMBIENT rather than addressed. Nothing else\n   * published it either: the access token's claims carry `userId` and no `applicationId`, and this\n   * very object carried only `appName`/`displayName`/`version`.\n   *\n   * The consequence was silent. On 2026-09-03 the workbench subscribed to `org` and `user` for an\n   * APPLICATION-scoped resource and was confirmed in both, while the companion published that\n   * resource's changes to the `app` room. Correct producer, confirmed subscriber, different rooms,\n   * zero frames delivered (issue #283).\n   *\n   * ## Why it is safe to publish here\n   *\n   * It is an IDENTIFIER, not a credential: it names which application this deployment is, it grants\n   * nothing, and every authenticated request already acts within it. The room name a client must\n   * compute is derived from it, so a client that may subscribe at all must be able to name it —\n   * authorization for that room is decided server-side against the SUBSCRIBED RESOURCE, never\n   * against possession of this value (issue #247).\n   *\n   * OPTIONAL because a deployment that predates this field must keep loading. A consumer that does\n   * not find it degrades to the previous behaviour — it derives whatever rooms its parameters imply\n   * and does not hear the application-room push — rather than failing.\n   */\n  applicationId: z.string().min(1).optional(),\n});\n\n\nexport const AppConfiguration_Shared_AppPreferencesLanguage_Schema = z.object({\n  defaultLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n  enabledLanguages: z.array(z.enum(AvailableLanguage).systemEnum('AvailableLanguage')).default([AvailableLanguage.EN]),\n  fallbackLanguage: z.enum(AvailableLanguage).systemEnum('AvailableLanguage').default(AvailableLanguage.EN),\n  autoDetectFromBrowser: z.boolean().default(true),\n  allowUserOverride: z.boolean().default(true),\n  allowOrganizationOverride: z.boolean().default(true),\n  enableLanguageSwitcher: z.boolean().default(true)\n});\n\n\nexport const appConfiguration_Shared_RuntimeSchemaBuilder = <T extends AllSharedApplicationTypes>(appTypeSchema: z.ZodType<T>) => {\n  return z.object({\n    endPoints: z.record(z.string(), z.object({\n      publicUrl: z.string().optional(),\n      internalUrl: z.string().optional(),\n    })),\n  })\n}\n\nexport const AppConfiguration_Shared_RuntimeSchema = appConfiguration_Shared_RuntimeSchemaBuilder(AllSharedApplicationTypesSchema);\n\n\n\n// =====================================================\n// Analytics Configuration\n// =====================================================\n\nexport enum AnalyticsProviderType {\n  CONSOLE = 'console',\n  BACKEND_PROXY = 'backend_proxy',\n}\n\n/** Uses providerType (not \"type\") to avoid Mongoose reserved keyword conflict during Zod→Mongoose conversion. */\nexport const AnalyticsProviderConfigSchema = z.object({\n  providerType: z.enum(AnalyticsProviderType),\n  config: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport const AutoInstrumentationConfigSchema = z.object({\n  /** Track page views (NAVIGATION_PANE_CHANGED events) */\n  pageViews: z.boolean().default(true),\n  /** Track resource operations (NOTIFY_RESOURCE_SUCCESS events) */\n  resourceOperations: z.boolean().default(true),\n  /** Track errors (ERROR_OCCURED events). Named 'trackErrors' to avoid Mongoose reserved 'errors' pathname. */\n  trackErrors: z.boolean().default(true),\n  /** Track feature gate hits (shown/blocked) — debounced per feature per session */\n  featureGate: z.boolean().default(true),\n  /** Track user lifecycle events (login, logout, status changes) */\n  userLifecycle: z.boolean().default(true),\n  /** Track notification events (NOTIFY_CUSTOM_* events) */\n  notifications: z.boolean().default(false),\n  /** Track hotkey usage */\n  hotkeys: z.boolean().default(false),\n});\n\nexport const AnalyticsConfigSchema = z.object({\n  /** Master switch — false = no analytics at all, regardless of user consent */\n  enabled: z.boolean().default(false),\n\n  /** Registered analytics providers */\n  providers: z.array(AnalyticsProviderConfigSchema).default([]),\n\n  /**\n   * Whether analytics rests on the person's consent to `ConsentPurpose.ANALYTICS` (default `true`).\n   *\n   * A boolean rather than a purpose, because analytics has exactly one purpose by definition. `false`\n   * is a claim that analytics here is not consent-based — anonymised measurement under a documented\n   * legitimate interest — and the lawful basis for that belongs in `operatorComplianceIdentity`.\n   *\n   * Replaces `requiredConsent: DataProcessingConsent`, a minimum LEVEL on an ordered scale that\n   * implied a person who agreed to marketing had agreed to analytics (#534). `requiredConsent: NONE`\n   * is `requiresConsent: false`; every other value is `true`.\n   */\n  requiresConsent: z.boolean().default(true),\n\n  /**\n   * SINGLE DECLARATION SURFACE for all value moments.\n   * TTFV, aha moments, activation stages, and anti-patterns are all here,\n   * distinguished by their `role` field.\n   */\n  valueMoments: z.array(ValueMomentSchema).optional(),\n\n  /** Persistence and evaluation configuration */\n  persistence: z.object({\n    /** Persist achieved moments to localStorage (default: true) */\n    localStorage: z.boolean().default(true),\n    /** Sync achieved moments to backend (default: true) */\n    backendSync: z.boolean().default(true),\n    /**\n     * Backend evaluates RESOURCE_STATE signals + cronjob-originated events.\n     * When true, RESOURCE_STATE signals are evaluated by the backend engine (authoritative).\n     * When false, frontend does optimistic cached count queries.\n     */\n    backendEvaluation: z.boolean().default(true),\n  }).default({\n    localStorage: true,\n    backendSync: true,\n    backendEvaluation: true,\n  }),\n\n  /** Auto-instrumentation configuration */\n  autoInstrumentation: AutoInstrumentationConfigSchema.default({\n    pageViews: true,\n    resourceOperations: true,\n    trackErrors: true,\n    featureGate: true,\n    userLifecycle: true,\n    notifications: false,\n    hotkeys: false,\n  }),\n});\n\n\n// =====================================================\n// Main Shared App Configuration\n// =====================================================\n\nexport const AppConfiguration_Shared_Schema = z.object({\n\n  appIdentity: AppConfiguration_Shared_AppIdentity_Schema,\n\n  /**\n   * The generated brand assets — the runtime projection of the brand identity\n   * an app's build-time logo step produces. THE single source of truth every\n   * logo/favicon/brand-image consumer resolves against via `resolveBrandAsset`\n   * (by composition × theme × purpose). Empty/absent until a brand is\n   * generated; consumers fall back to a placeholder.\n   *\n   * MOVED OFF `appIdentity` (2026-07): brand assets are app-authored,\n   * BUILD-TIME content (a CLI generates them from a spec SSOT and writes a\n   * `backend-api/src/brand-assets.generated.ts` the backend config composes),\n   * NOT platform-declaration identity. `appIdentity` is\n   * platform-declaration-materialized and boundary-blocked for backend\n   * authoring (`AppConfiguration_BackendAuthored` Omits `appIdentity`, and the\n   * `applyBackendConfig` inspector rejects it), so a backend-authorable slot is\n   * required. This top-level `brandAssets` is that slot — it is present on both\n   * the frontend shared payload (here) and the backend-authored managed config\n   * (`_AppConfiguration_AppManagedConfiguration_Schema`).\n   */\n  brandAssets: z.array(RuntimeBrandAssetSchema).optional(),\n\n  appPreferences: z.object({\n    languages: AppConfiguration_Shared_AppPreferencesLanguage_Schema,\n  }),\n  apiJwtPublicKey: z.string().min(1, { error: 'API JWT public key is required' }),\n\n  runtime: AppConfiguration_Shared_RuntimeSchema,\n  auth: AppConfiguration_Shared_AuthSchema,\n  /** User types — required. No implicit defaults. */\n  userTypes: UserTypesConfigSchema,\n  /** Maps frontend service identities to user types. Required for user-type resolution from the active frontend surface. */\n  frontendServices: FrontendServicesConfigSchema,\n  /**\n   * Org typing. MANDATORY for a running application, optional in this schema (#1032, 2026-09-14).\n   *\n   * Every organization carries a type naming an entry here, and a member of an organization whose type\n   * resolves to nothing cannot sign in, so an application with none is refused at startup. The schema\n   * stays optional because it also parses configuration that predates the field, and the door that\n   * writes the field has to be able to read that configuration first. It used to say \"only for apps with\n   * typed organizations\"; every application has organizations.\n   */\n  organizationTypes: OrganizationTypesConfigSchema.optional(),\n  /**\n   * The organization role table's keys a membership may hold (#1921): the core organization roles plus the\n   * application's custom organization roles, as the running backend's authorization service holds them, less the roles\n   * no membership may hold: the handler-only roles (`INBOUND_HANDLER_ONLY_ROLES`) and the delegated capability roles a\n   * live grant alone confers (`DELEGATED_CAPABILITY_ROLES`). What a role picker\n   * (`StringEditMode.ORGANIZATION_ROLE`) offers; each role's words come from the `roles` label tree.\n   *\n   * RUNTIME-DERIVED, like `appIdentity.applicationId`: an application does not author it here — it declares custom\n   * roles in its shared modules, and the backend publishes the merged table on `/application-config`. Custom roles are\n   * application-wide, so every organization of the application has the same table.\n   *\n   * Safe to publish: role KEYS are vocabulary, not authority — the same keys already ship in the public `roles` label\n   * bundle, and holding a role is decided server-side against the membership, never against knowing its name.\n   * OPTIONAL so a backend that predates it keeps loading; a picker without it degrades to a text input.\n   */\n  organizationRoles: z.array(z.string().min(1)).optional(),\n  compliance: AppConfiguration_Shared_ComplianceSchema,\n\n  // Billing Configuration (optional: billing disabled by default)\n  billing: BillingConfigurationSchema.optional(),\n\n  // Analytics Configuration (optional: analytics disabled by default)\n  analytics: AnalyticsConfigSchema.optional(),\n\n  // Lifecycle Configuration (optional: lifecycle disabled by default)\n  lifecycle: LifecycleConfigSchema.optional(),\n\n  // Tenant-Teardown Configuration (optional: every field defaults, so omitting the block yields a\n  // working 30-day retention window purged nightly). Holds the operator-tunable retention window,\n  // purge cron and per-run batch size consumed by the engine-owned `organization-purge` batch.\n  // See TenantTeardownConfigSchema for why this is NOT folded into `lifecycle` (which is the USER\n  // lifecycle and is disabled by default).\n  tenantTeardown: TenantTeardownConfigSchema.optional(),\n\n  // Review calendar (#1628, optional): the application's business hours and holidays, in one time zone.\n  // Read only by pending human decisions whose gate counts a CLAIM or DECISION clock on the CALENDAR basis;\n  // a gate asking for that basis in an application declaring none is refused at startup. One calendar per\n  // application, never per tenant — see ReviewCalendarSchema.\n  reviewCalendar: ReviewCalendarSchema.optional(),\n\n  // Data-Seeding Configuration (optional: when omitted, the engine-owned\n  // `data-seeding:scheduled-rerun` batch uses the manifest's built-in\n  // minute-tick default cron — see DataSeedingConfigSchema for the full\n  // rationale on why operators rarely need to override this).\n  dataSeeding: DataSeedingConfigSchema.optional(),\n\n  // Audit-Trail Configuration (optional: when omitted, NO archival runs and\n  // audit records are retained in the primary AUDIT_LOGS store indefinitely).\n  // Holds the operator-tunable archival horizon (`archiveAfterDays`) consumed\n  // by the engine-owned `compliance:audit-logs-archive` batch. Records are\n  // never deleted (AUDIT_LOGS is immutable, G5) — see AuditTrailConfigSchema.\n  auditTrail: AuditTrailConfigSchema.optional(),\n\n});\n\n\nexport type AppConfiguration_Shared_Compliance = z.infer<typeof AppConfiguration_Shared_ComplianceSchema>;\nexport type AppConfiguration_Shared_AppIdentity = z.infer<typeof AppConfiguration_Shared_AppIdentity_Schema>;\nexport type AppConfiguration_Shared_AppPreferencesLanguage = z.infer<typeof AppConfiguration_Shared_AppPreferencesLanguage_Schema>;\nexport type AnalyticsProviderConfig = z.infer<typeof AnalyticsProviderConfigSchema>;\nexport type AppConfiguration_Shared_Runtime = z.infer<typeof AppConfiguration_Shared_RuntimeSchema>;\nexport type AutoInstrumentationConfig = z.infer<typeof AutoInstrumentationConfigSchema>;\nexport type AnalyticsConfig = z.infer<typeof AnalyticsConfigSchema>;\nexport type AppConfiguration_Shared_Auth = z.infer<typeof AppConfiguration_Shared_AuthSchema>;\nexport type AppConfiguration_Shared = z.infer<typeof AppConfiguration_Shared_Schema>;\n"]}

package/dist/esm/config/app-frontend-type.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-frontend-type.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/app-frontend-type.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,oBAAY,eAAe;IACzB,QAAQ,aAAa;IACrB,cAAc,mBAAmB;IACjC,QAAQ,aAAa;CACtB"}
+{"version":3,"file":"app-frontend-type.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/app-frontend-type.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,oBAAY,eAAe;IACzB,QAAQ,aAAa;IACrB,cAAc,mBAAmB;IACjC,QAAQ,aAAa;CACtB"}

package/dist/esm/config/app-frontend-type.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-frontend-type.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/app-frontend-type.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,wCAAqB,CAAA;IACrB,oDAAiC,CAAA;IACjC,wCAAqB,CAAA;AACvB,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B","sourcesContent":["/**\n * Runtime-kind taxonomy for a frontend service.\n *\n * The taxonomy is intentionally narrow — it captures *what the frontend\n * runs* (React SPA vs Docusaurus SSG vs static marketing bundle), NOT\n * what audience it targets or where it lives on the registrable root.\n * Those concerns are modelled elsewhere:\n *\n * - **Audience / positioning** (admin console, customer app, internal\n *   staff tool, etc.) is a branding concern, not a runtime concern.\n *   Two services with `frontendType: SAAS_APP` can coexist in the same\n *   project and point at different audiences — the framework does not\n *   need to know.\n * - **Public hostname** (`app.example.com` vs `dev.example.com` vs\n *   apex) is authored explicitly, per-environment, in\n *   `infra.serviceHosts`. Never derived from `frontendType` or from\n *   the service key.\n *\n * Why the 3 kinds are genuinely distinct and NOT collapsible:\n *\n * - `SAAS_APP` — React SPA built with Vite, served from\n *   `saas-frontend-lib`, owns an authenticated session\n *   (`AuthSessionContext`, `PersistentSessionTokenStorage`), is the\n *   primary user surface. Cross-frontend handoff uses it as the\n *   source-of-session.\n * - `STATIC_WEBSITE` — Marketing / landing surface, anonymous-first,\n *   no session ownership, may expose an anonymous-session seam for\n *   lead attribution but never an authenticated one.\n * - `TECH_DOC` — Docusaurus-built static site with embedded auth\n *   awareness. Different runtime (SSG vs SPA), different session role\n *   (receiver via `Auth_OneOffSession` + `EphemeralSessionTokenStorage`,\n *   never owner).\n *\n * --------------------------------------------------------------------------\n * NO NATIVE / WEBVIEW VARIANTS — permanent, locked design decision\n * --------------------------------------------------------------------------\n *\n * The taxonomy intentionally has NO native-shell variant (no\n * `CAPACITOR_APP`, `ELECTRON_APP`, `IOS_NATIVE`, `ANDROID_NATIVE`, etc.)\n * and NO `nativeShell` decorator on any of the three kinds above. The\n * engine targets browser-rendered surfaces exclusively. This is a\n * product decision, not an oversight:\n *\n * - The framework's value proposition is sharing TypeScript across\n *   stacks (config, models, schemas, services). Native runtimes break\n *   that property — Capacitor / Electron WebViews bring their own\n *   storage, deep-link, scheme, and credential constraints that would\n *   force the framework to fork concepts (cookie vs body refresh,\n *   browser vs native channel detection, secure-storage adapters,\n *   `cordova:` / `app://` CSP allowances). Each fork would compound\n *   maintenance debt for zero shared-TS gain.\n * - Apps that need a native shell can always wrap a `SAAS_APP` URL in\n *   their own native container — that is a downstream packaging concern,\n *   not a framework concern.\n *\n * Removed end-to-end on 2026-04-13 (per\n * `.cursor/plans/cross-frontend-handoff-shells-removal.md`):\n *\n * - `NativeShellSchema` (`engine/saas-models/src/config/native-shell.shared.schemas.ts`)\n *   and the `nativeShell` field on every service-definition schema\n *   (`AppServiceDefinitionSchema`, `FrontendServiceDefinitionSchema`,\n *   `AdminAppManagedDeclarationSchema.frontendServices[]`).\n * - `POST /auth/native-token/exchange` route, `AUTH_NATIVE_TOKEN_EXCHANGE`\n *   manual-route enum entry, and `NativeTokenExchangeRequestSchema` /\n *   `NativeTokenExchangeResponseSchema` DTOs.\n * - `AuthenticationOrchestratorBackendService.handleNativeSDKFirstFactor`,\n *   `OAuth2AuthenticationBackendService.exchangeNativeToken`, and\n *   `OAuth2Provider_ConfigurationSchema.nativeClientIds`.\n * - `NativeSessionTokenStorageAdapter` interface,\n *   `AuthSessionContext.handleNativeTokenExchange` /\n *   `initiateNativeSignIn` methods, and the `auth:native-exchange:<ip>`\n *   rate-limit policy.\n * - `CrossFrontendHandoffErrorCode` entries\n *   `TARGET_NATIVE_SHELL_NOT_DECLARED` and\n *   `TARGET_NATIVE_SHELL_SELECTOR_REQUIRED`, the\n *   `targetNativeShell` request field, and the corresponding audit-log\n *   payload field.\n *\n * Do NOT re-introduce any of the above. Re-opening this design needs an\n * explicit user-level decision, NOT a developer-level convenience patch.\n *\n * @wildo-bundle-budget\n *   This file is registered in `../public-runtime/index.ts` and MUST\n *   stay side-effect-free (no imports beyond what the enum needs —\n *   currently zero). Adding any import that triggers\n *   `initZodDecorators()` or pulls a heavy schema graph would silently\n *   break the public-runtime boundary tests.\n */\nexport enum AppFrontendType {\n  SAAS_APP = 'saas-app',\n  STATIC_WEBSITE = 'static-website',\n  TECH_DOC = 'tech-doc',\n}\n"]}
+{"version":3,"file":"app-frontend-type.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/app-frontend-type.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,wCAAqB,CAAA;IACrB,oDAAiC,CAAA;IACjC,wCAAqB,CAAA;AACvB,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B","sourcesContent":["/**\n * Runtime-kind taxonomy for a frontend service.\n *\n * The taxonomy is intentionally narrow — it captures *what the frontend\n * runs* (React SPA vs Docusaurus SSG vs static marketing bundle), NOT\n * what audience it targets or where it lives on the registrable root.\n * Those concerns are modelled elsewhere:\n *\n * - **Audience / positioning** (admin console, customer app, internal\n *   staff tool, etc.) is a branding concern, not a runtime concern.\n *   Two services with `frontendType: SAAS_APP` can coexist in the same\n *   project and point at different audiences — the framework does not\n *   need to know.\n * - **Public hostname** (`app.example.com` vs `dev.example.com` vs\n *   apex) is authored explicitly, per-environment, in\n *   `infra.serviceHosts`. Never derived from `frontendType` or from\n *   the service key.\n *\n * Why the 3 kinds are genuinely distinct and NOT collapsible:\n *\n * - `SAAS_APP` — React SPA built with Vite, served from\n *   `saas-frontend-lib`, owns an authenticated session\n *   (`AuthSessionContext`, `PersistentSessionTokenStorage`), is the\n *   primary user surface. Cross-frontend handoff uses it as the\n *   source-of-session.\n * - `STATIC_WEBSITE` — Marketing / landing surface, anonymous-first,\n *   no session ownership, may expose an anonymous-session seam for\n *   lead attribution but never an authenticated one.\n * - `TECH_DOC` — Docusaurus-built static site with embedded auth\n *   awareness. Different runtime (SSG vs SPA), different session role\n *   (receiver via `Auth_OneOffSession` + `EphemeralSessionTokenStorage`,\n *   never owner).\n *\n * --------------------------------------------------------------------------\n * NO NATIVE / WEBVIEW VARIANTS — permanent, locked design decision\n * --------------------------------------------------------------------------\n *\n * The taxonomy intentionally has NO native-shell variant (no\n * `CAPACITOR_APP`, `ELECTRON_APP`, `IOS_NATIVE`, `ANDROID_NATIVE`, etc.)\n * and NO `nativeShell` decorator on any of the three kinds above. The\n * engine targets browser-rendered surfaces exclusively. This is a\n * product decision, not an oversight:\n *\n * - The framework's value proposition is sharing TypeScript across\n *   stacks (config, models, schemas, services). Native runtimes break\n *   that property — Capacitor / Electron WebViews bring their own\n *   storage, deep-link, scheme, and credential constraints that would\n *   force the framework to fork concepts (cookie vs body refresh,\n *   browser vs native channel detection, secure-storage adapters,\n *   `cordova:` / `app://` CSP allowances). Each fork would compound\n *   maintenance debt for zero shared-TS gain.\n * - Apps that need a native shell can always wrap a `SAAS_APP` URL in\n *   their own native container — that is a downstream packaging concern,\n *   not a framework concern.\n *\n * Removed end-to-end on 2026-04-13 (per\n * `.cursor/plans/cross-frontend-handoff-shells-removal.md`):\n *\n * - `NativeShellSchema` (`engine/saas-models/src/config/native-shell.shared.schemas.ts`)\n *   and the `nativeShell` field on every service-definition schema\n *   (`AppServiceDefinitionSchema`, `FrontendServiceDefinitionSchema`,\n *   `AdminAppManagedDeclarationSchema.frontendServices[]`).\n * - `POST /auth/native-token/exchange` route, `AUTH_NATIVE_TOKEN_EXCHANGE`\n *   manual-route enum entry, and `NativeTokenExchangeRequestSchema` /\n *   `NativeTokenExchangeResponseSchema` DTOs.\n * - `AuthenticationOrchestratorBackendService.handleNativeSDKFirstFactor`,\n *   `OAuth2AuthenticationBackendService.exchangeNativeToken`, and\n *   `OAuth2Provider_ConfigurationSchema.nativeClientIds`.\n * - `NativeSessionTokenStorageAdapter` interface,\n *   `AuthSessionContext.handleNativeTokenExchange` /\n *   `initiateNativeSignIn` methods, and the `auth:native-exchange:<ip>`\n *   rate-limit policy.\n * - `CrossFrontendHandoffErrorCode` entries\n *   `TARGET_NATIVE_SHELL_NOT_DECLARED` and\n *   `TARGET_NATIVE_SHELL_SELECTOR_REQUIRED`, the\n *   `targetNativeShell` request field, and the corresponding audit-log\n *   payload field.\n *\n * Do NOT re-introduce any of the above. Re-opening this design needs an\n * explicit user-level decision, NOT a developer-level convenience patch.\n *\n * @wildo-bundle-budget\n *   This file is registered in `../public-runtime/index.ts` and MUST\n *   stay side-effect-free (no imports beyond what the enum needs —\n *   currently zero). Adding any import that triggers\n *   `initZodDecorators()` or pulls a heavy schema graph would silently\n *   break the public-runtime boundary tests.\n */\nexport enum AppFrontendType {\n  SAAS_APP = 'saas-app',\n  STATIC_WEBSITE = 'static-website',\n  TECH_DOC = 'tech-doc',\n}\n"]}

package/dist/esm/config/auth-config-resolution.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config-resolution.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAwB,MAAM,2DAA2D,CAAC;AAE7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAEjK,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAAC;AAEzF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,cAAc,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC1C;AAQD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAOlF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAG7F;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,UAAU,EAK1E,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,mCAAmC,CAAC,kBAAkB,EAAE,cAAc,GAAG,cAAc,CAMtG;AAID;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC,SAAS,CAAC,EAAE;QACV,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;QACpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,EAAE,CAqB5G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,EAAE,CAG9G;AAkPD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CA0BtF"}
+{"version":3,"file":"auth-config-resolution.shared.utils.d.ts","sourceRoot":"","sources":["../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAwB,MAAM,2DAA2D,CAAC;AAE7G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAEjK,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAAC;AAEzF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,kBAAkB,CAAC;IACjC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,cAAc,CAAC;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC1C;AAQD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAOlF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAG7F;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,UAAU,EAK1E,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,mCAAmC,CAAC,kBAAkB,EAAE,cAAc,GAAG,cAAc,CAMtG;AAID;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC,SAAS,CAAC,EAAE;QACV,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;QACpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,EAAE,CAqB5G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,EAAE,CAG9G;AAkPD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CA0BtF"}

package/dist/esm/config/auth-config-resolution.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAyB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAA+B;IAC1E,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAA2C;IAC5F,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,EAAE,SAAS,EAAE,oBAAoB,IAAI,EAAE,CAAC;IACjE,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E;;;;;;;OAOG;IACH,MAAM,QAAQ,GAAG,MAAM,EAAE,SAAS,EAAE,gBAAgB;QAClD,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,SAAS,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAC9C,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;WAC1B,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;WAC7C,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oCAAoC,CAAC,MAA2C;IAC9F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,qCAAqC,EAAE,CAAC,CAAC;IACnF,OAAO,kCAAkC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,4BAA4B,EAAE,IAAI,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM,IAAI,QAAQ,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM;YACtL,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,IAAI;QAC3E,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,4BAA4B,EAAE,CAAC,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM,IAAI,CAAC,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM;YAC5K,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,IAAI;QAC3E,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,mBAAmB,CAAC,IAAsB,EAAE,QAAmC;IACtF,OAAO;QACL,+FAA+F;QAC/F,+EAA+E;QAC/E,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,4FAA4F;QAC5F,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC;QAC/E,wFAAwF;QACxF,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAkC,EAClC,YAAoC;IAEpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,eAAe,GAAG,YAAY;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAErD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;QACjC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAC3D,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO;KACvE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YACjF,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;QACxF,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC;KACzE,CAAC;AACJ,CAAC","sourcesContent":["import { ExternalAssuranceEnforcement } from '../external-providers/provider-authentication-assurance.shared.schemas';\n/**\n * W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n *\n * Resolution order: User Type (base) → Org Type authOverrides (login-method mode; other axes restrictive).\n * Multi-org: explicit method overrides resolve independently and intersect; other axes merge restrictively.\n *\n * This is a pure function — no DI, no DB, no side effects.\n */\n\nimport { AuthMethod, isStrongSecondFactor } from '../security/authentications/authentication.shared.schemas';\nimport { AuthUtils } from '../security/authentications/authentication.shared.utils';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig, StepUpAuthConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean | { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n  userTypeAuth: UserTypeAuthPolicy;\n  orgOverrides: OrgTypeAuthOverrides[];\n  orgAuthMethodPolicy: OrgAuthMethodPolicy;\n  expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n  authMethodsEnabled: AuthMethodsMap;\n  mfaPolicy: MfaPolicyConfig;\n  passwordPolicy: PasswordPolicyConfig;\n  /**\n   * Re-authentication freshness (#527). `undefined` when the user type declares no step-up policy —\n   * an organisation cannot introduce step-up for a user type that has none, because there is no base\n   * to be more restrictive THAN, and inventing one would let a tenant enable a gate the application\n   * never configured.\n   */\n  stepUpAuth: StepUpAuthConfig | undefined;\n}\n\nfunction isMethodEnabled(value: boolean | { enabled: boolean } | undefined): boolean {\n  if (value === undefined) return false;\n  if (typeof value === 'boolean') return value;\n  return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap | undefined): Set<AuthMethod> {\n  if (!map) return new Set();\n  const result = new Set<AuthMethod>();\n  for (const [method, value] of Object.entries(map)) {\n    if (isMethodEnabled(value)) result.add(method as AuthMethod);\n  }\n  return result;\n}\n\n/**\n * The enabled methods a person can reach by SAYING WHO THEY ARE — the set the identifier step exists\n * to serve.\n *\n * Derived, and total over the factor vocabulary: it is `getEnabledMethods` intersected with\n * `AuthUtils.getFirstFactorMethods()`, which is the same pair of questions the backend asks when it\n * answers `/auth/identify` (`_getAvailableFirstFactorMethods` walks that list and keeps the methods\n * `authMethodsEnabled` admits). So a method added to the vocabulary tomorrow is classified by the map\n * rather than by a list somebody has to remember to extend.\n *\n * A caller decides whether to OFFER the identifier step by asking whether this set is non-empty —\n * never by asking whether one particular method is enabled. Gating it on `PASSWORD` is what hid the\n * email field from a user type that signs in by magic link (#1219), for which the email address is the\n * only thing the sign-in needs.\n *\n * Note what this does NOT answer: whether a given user can present a given method. That is per-user\n * and belongs to the identify response; this is a question about the resolved POLICY, answerable\n * before anyone has typed anything.\n */\nexport function getEnabledFirstFactorMethods(map: AuthMethodsMap | undefined): Set<AuthMethod> {\n  const enabled = getEnabledMethods(map);\n  return new Set(AuthUtils.getFirstFactorMethods().filter((method) => enabled.has(method)));\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n  const result: AuthMethodsMap = {};\n  for (const method of Object.values(AuthMethod)) {\n    result[method] = methods.has(method);\n  }\n  return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/**\n * Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n *\n * `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n */\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n  AuthMethod.PASSWORD,\n  AuthMethod.PASSKEY,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.SMS_OTP,\n];\n\n/**\n * AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user holds an identity link for any ACTIVELY directory-managed org — whatever their\n * membership's status there, since a deprovisioned or removed member keeps the block (#1151) — so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n */\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n  const result: AuthMethodsMap = { ...authMethodsEnabled };\n  for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n    result[method] = false;\n  }\n  return result;\n}\n\n// ─── Second-factor set resolution (THE one rule) ─────────────────────────────\n\n/**\n * The policy shape {@link resolveAcceptedSecondFactorMethods} needs. Structural rather than\n * `UserTypeAuthPolicy` so a caller holding a partially-resolved policy — the orchestrator's\n * fallback, a session snapshot, an authored config being validated at startup — can ask the same\n * question without first assembling a whole policy object.\n */\nexport interface SecondFactorPolicyInput {\n  authMethodsEnabled?: AuthMethodsMap;\n  mfaPolicy?: {\n    acceptableMFAMethods?: AuthMethod[];\n    requireStrongMFA?: boolean;\n  };\n}\n\n/**\n * The second-factor methods THIS policy accepts at a challenge, derived totally over the auth-method\n * vocabulary.\n *\n * ```\n * vocabulary (AUTH_METHOD_FACTOR_MAP: SECOND_ONLY | FIRST_OR_SECOND | ANY)\n *   ∩ authMethodsEnabled\n *   ∩ acceptableMFAMethods            (when authored non-empty — it NARROWS, never replaces)\n *   − always-available                (when requireStrongMFA)\n * ```\n *\n * **This function exists because the offer and the acceptance had drifted apart.** The challenge\n * resolver intersected `acceptableMFAMethods`; the two sites that computed which methods to OFFER\n * for enrollment filtered on `authMethodsEnabled` alone. So a policy enabling SMS OTP as a login\n * method while accepting only `[TOTP, PASSKEY]` for MFA offered the user a phone enrollment the\n * challenge would then refuse — an application could send someone to set up a factor it had already\n * decided not to take. Both sides now read this, so they cannot disagree: the invariant is\n * unbypassable rather than applied N times.\n *\n * **`requireStrongMFA` asks `isStrongSecondFactor`, which reads the method's CHANNEL.** It used to\n * be expressed as \"drop the always-available ones\", on the reasoning that a factor needing no\n * enrolment rides an address the account already proved and is therefore not an independent\n * possession proof. That reached the right answer through a property that only coincides with the one\n * it meant, and #1246 replaced the proxy with the thing itself. The resulting set is unchanged.\n */\nexport function resolveAcceptedSecondFactorMethods(policy: SecondFactorPolicyInput | undefined): AuthMethod[] {\n  const enabled = getEnabledMethods(policy?.authMethodsEnabled);\n  const acceptable = policy?.mfaPolicy?.acceptableMFAMethods ?? [];\n  const acceptableSet = acceptable.length > 0 ? new Set(acceptable) : undefined;\n  /*\n   * `requireStrongMFA` now asks the method what it PROVES (#1246), instead of standing on the\n   * enrolment proxy. The set is identical today — `EMAIL_OTP` is the only second factor on the email\n   * channel and the only always-available one — but the two properties merely coincide: a second\n   * always-available factor on another channel would have been dropped for no reason, and a weak\n   * factor that did need enrolment would have passed. `isStrongSecondFactor` carries the reasoning\n   * and the citation.\n   */\n  const excluded = policy?.mfaPolicy?.requireStrongMFA\n    ? new Set(AuthUtils.getSecondFactorMethods().filter((method) => !isStrongSecondFactor(method)))\n    : undefined;\n\n  return AuthUtils.getSecondFactorMethods().filter(\n    (method) => enabled.has(method)\n      && (!acceptableSet || acceptableSet.has(method))\n      && (!excluded || !excluded.has(method)),\n  );\n}\n\n/**\n * The second-factor methods THIS policy accepts **and** that a user can actually enroll — the\n * accepted set minus the ones that need no enrollment.\n *\n * This is what an enrollment surface offers. Listing an always-available factor there would render\n * a setup step for something already set up, so the subtraction is semantic rather than cosmetic.\n *\n * An empty result is meaningful and not a bug: it means every factor the policy accepts is already\n * available to this user, so there is nothing to enroll. (An empty ACCEPTED set is the real\n * deadlock, and `application-startup-config-validator` refuses that at boot.)\n */\nexport function resolveEnrollableSecondFactorMethods(policy: SecondFactorPolicyInput | undefined): AuthMethod[] {\n  const alwaysAvailable = new Set(AuthUtils.getAlwaysAvailableSecondFactorMethods());\n  return resolveAcceptedSecondFactorMethods(policy).filter((method) => !alwaysAvailable.has(method));\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n  userTypeMethods: Set<AuthMethod>,\n  orgOverride: OrgTypeAuthOverrides,\n  policy: OrgAuthMethodPolicy,\n  expandable: AuthMethod[],\n): Set<AuthMethod> {\n  if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n  const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n  switch (policy) {\n    case OrgAuthMethodPolicy.RESTRICT_ONLY:\n      return intersection(userTypeMethods, orgMethods);\n\n    case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n      const expandableSet = new Set(expandable);\n      const expansions = intersection(orgMethods, expandableSet);\n      return union(userTypeMethods, expansions);\n    }\n\n    case OrgAuthMethodPolicy.UNRESTRICTED:\n      return new Set(orgMethods);\n\n    default:\n      return new Set(userTypeMethods);\n  }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n  userTypeMethods: Set<AuthMethod>,\n  orgOverrides: OrgTypeAuthOverrides[],\n  policy: OrgAuthMethodPolicy,\n  expandable: AuthMethod[],\n): Set<AuthMethod> {\n  const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n  if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n  const perOrgResults = validOverrides.map(o =>\n    resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n  );\n\n  if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n    // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n    // Each org may expand within the expandable set, but multi-org users only get\n    // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n    return perOrgResults.reduce((acc, set) => intersection(acc, set));\n  }\n\n  return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n  base: MfaPolicyConfig,\n  override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n  return {\n    externalAssuranceEnforcement: base.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT || override.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT\n      ? ExternalAssuranceEnforcement.STRICT : ExternalAssuranceEnforcement.WARN,\n    requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n    requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n    acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n    enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n    passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n  };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n  base: MfaPolicyConfig,\n  orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n  const mfaOverrides = orgOverrides\n    .map(o => o?.mfaPolicy)\n    .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n  if (mfaOverrides.length === 0) return { ...base };\n\n  const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n  return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n  return {\n    externalAssuranceEnforcement: a.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT || b.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT\n      ? ExternalAssuranceEnforcement.STRICT : ExternalAssuranceEnforcement.WARN,\n    requireMFA: a.requireMFA || b.requireMFA,\n    requireStrongMFA: a.requireStrongMFA || b.requireStrongMFA,\n    acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n    enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n    passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n  };\n}\n\n// ─── Step-Up Auth Resolution ────────────────────────────────────────────────\n\nfunction resolveStepUpSingle(base: StepUpAuthConfig, override: Partial<StepUpAuthConfig>): StepUpAuthConfig {\n  return {\n    // Either side turning step-up ON wins: an organisation may require re-authentication where the\n    // application does not, and may never switch off one the application requires.\n    enabled: base.enabled || (override.enabled ?? false),\n    // The SHORTER window wins — the opposite arithmetic to `enabled`, same direction of intent.\n    maxAgeSeconds: mergeNumberLowerWins(base.maxAgeSeconds, override.maxAgeSeconds),\n    // Intersection: an organisation may WITHDRAW an acceptable method, never introduce one.\n    methods: mergeArrayIntersection(base.methods, override.methods) ?? base.methods,\n  };\n}\n\nfunction resolveStepUpMultiOrg(\n  base: StepUpAuthConfig | undefined,\n  orgOverrides: OrgTypeAuthOverrides[],\n): StepUpAuthConfig | undefined {\n  if (base === undefined) return undefined;\n  const stepUpOverrides = orgOverrides\n    .map(o => o?.stepUpAuth)\n    .filter((p): p is Partial<StepUpAuthConfig> => !!p);\n  if (stepUpOverrides.length === 0) return { ...base };\n\n  const perOrgResults = stepUpOverrides.map(o => resolveStepUpSingle(base, o));\n  return perOrgResults.reduce((acc, r) => ({\n    enabled: acc.enabled || r.enabled,\n    maxAgeSeconds: Math.min(acc.maxAgeSeconds, r.maxAgeSeconds),\n    methods: mergeArrayIntersection(acc.methods, r.methods) ?? acc.methods,\n  }));\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n  base: PasswordPolicyConfig,\n  override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n  return {\n    minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n    maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n    requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n    requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n    requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n    requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n    expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n  };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n  base: PasswordPolicyConfig,\n  orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n  const pwOverrides = orgOverrides\n    .map(o => o?.passwordPolicy)\n    .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n  if (pwOverrides.length === 0) return { ...base };\n\n  const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n  return normalizePasswordPolicyBounds(\n    perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n  );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n  return normalizePasswordPolicyBounds({\n    minLength: Math.max(a.minLength, b.minLength),\n    maxLength: Math.min(a.maxLength, b.maxLength),\n    requireUppercase: a.requireUppercase || b.requireUppercase,\n    requireLowercase: a.requireLowercase || b.requireLowercase,\n    requireNumbers: a.requireNumbers || b.requireNumbers,\n    requireSpecialChars: a.requireSpecialChars || b.requireSpecialChars,\n    expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n  });\n}\n\n/**\n * Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n  if (policy.maxLength >= policy.minLength) {\n    return policy;\n  }\n\n  return {\n    ...policy,\n    maxLength: policy.minLength,\n  };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean | undefined): boolean {\n  if (override === undefined) return base;\n  return base || override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean | undefined): boolean {\n  if (override === undefined) return base;\n  return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  if (base === 0 && override === 0) return 0;\n  if (base === 0) return override;\n  if (override === 0) return base;\n  return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] | undefined, b: T[] | undefined): T[] | undefined {\n  if (a === undefined) return b;\n  if (b === undefined) return a;\n  const setB = new Set(b);\n  return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n  const result = new Set<T>();\n  for (const item of a) {\n    if (b.has(item)) result.add(item);\n  }\n  return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n  return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n  const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n  if (!orgOverrides.length) {\n    return {\n      authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n      mfaPolicy: { ...userTypeAuth.mfaPolicy },\n      passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n      stepUpAuth: userTypeAuth.stepUpAuth ? { ...userTypeAuth.stepUpAuth } : undefined,\n    };\n  }\n\n  const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n  const resolvedMethods = resolveAuthMethodsMultiOrg(\n    userTypeMethods,\n    orgOverrides,\n    orgAuthMethodPolicy,\n    expandableOrgMethods ?? [],\n  );\n\n  return {\n    authMethodsEnabled: setToMethodsMap(resolvedMethods),\n    mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n    passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n    stepUpAuth: resolveStepUpMultiOrg(userTypeAuth.stepUpAuth, orgOverrides),\n  };\n}\n"]}
+{"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,2DAA2D,CAAC;AAC7G,OAAO,EAAE,SAAS,EAAE,MAAM,yDAAyD,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAyB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAA+B;IAC1E,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAA2C;IAC5F,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,EAAE,SAAS,EAAE,oBAAoB,IAAI,EAAE,CAAC;IACjE,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E;;;;;;;OAOG;IACH,MAAM,QAAQ,GAAG,MAAM,EAAE,SAAS,EAAE,gBAAgB;QAClD,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,SAAS,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAC9C,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;WAC1B,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;WAC7C,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oCAAoC,CAAC,MAA2C;IAC9F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,qCAAqC,EAAE,CAAC,CAAC;IACnF,OAAO,kCAAkC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,4BAA4B,EAAE,IAAI,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM,IAAI,QAAQ,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM;YACtL,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,IAAI;QAC3E,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,4BAA4B,EAAE,CAAC,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM,IAAI,CAAC,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,MAAM;YAC5K,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,IAAI;QAC3E,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,mBAAmB,CAAC,IAAsB,EAAE,QAAmC;IACtF,OAAO;QACL,+FAA+F;QAC/F,+EAA+E;QAC/E,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,4FAA4F;QAC5F,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC;QAC/E,wFAAwF;QACxF,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAkC,EAClC,YAAoC;IAEpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,eAAe,GAAG,YAAY;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAErD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;QACjC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAC3D,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO;KACvE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YACjF,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;QACxF,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC;KACzE,CAAC;AACJ,CAAC","sourcesContent":["import { ExternalAssuranceEnforcement } from '../external-providers/provider-authentication-assurance.shared.schemas';\n/**\n * W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n *\n * Resolution order: User Type (base) → Org Type authOverrides (login-method mode; other axes restrictive).\n * Multi-org: explicit method overrides resolve independently and intersect; other axes merge restrictively.\n *\n * This is a pure function — no DI, no DB, no side effects.\n */\n\nimport { AuthMethod, isStrongSecondFactor } from '../security/authentications/authentication.shared.schemas';\nimport { AuthUtils } from '../security/authentications/authentication.shared.utils';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig, StepUpAuthConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean | { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n  userTypeAuth: UserTypeAuthPolicy;\n  orgOverrides: OrgTypeAuthOverrides[];\n  orgAuthMethodPolicy: OrgAuthMethodPolicy;\n  expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n  authMethodsEnabled: AuthMethodsMap;\n  mfaPolicy: MfaPolicyConfig;\n  passwordPolicy: PasswordPolicyConfig;\n  /**\n   * Re-authentication freshness (#527). `undefined` when the user type declares no step-up policy —\n   * an organisation cannot introduce step-up for a user type that has none, because there is no base\n   * to be more restrictive THAN, and inventing one would let a tenant enable a gate the application\n   * never configured.\n   */\n  stepUpAuth: StepUpAuthConfig | undefined;\n}\n\nfunction isMethodEnabled(value: boolean | { enabled: boolean } | undefined): boolean {\n  if (value === undefined) return false;\n  if (typeof value === 'boolean') return value;\n  return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap | undefined): Set<AuthMethod> {\n  if (!map) return new Set();\n  const result = new Set<AuthMethod>();\n  for (const [method, value] of Object.entries(map)) {\n    if (isMethodEnabled(value)) result.add(method as AuthMethod);\n  }\n  return result;\n}\n\n/**\n * The enabled methods a person can reach by SAYING WHO THEY ARE — the set the identifier step exists\n * to serve.\n *\n * Derived, and total over the factor vocabulary: it is `getEnabledMethods` intersected with\n * `AuthUtils.getFirstFactorMethods()`, which is the same pair of questions the backend asks when it\n * answers `/auth/identify` (`_getAvailableFirstFactorMethods` walks that list and keeps the methods\n * `authMethodsEnabled` admits). So a method added to the vocabulary tomorrow is classified by the map\n * rather than by a list somebody has to remember to extend.\n *\n * A caller decides whether to OFFER the identifier step by asking whether this set is non-empty —\n * never by asking whether one particular method is enabled. Gating it on `PASSWORD` is what hid the\n * email field from a user type that signs in by magic link (#1219), for which the email address is the\n * only thing the sign-in needs.\n *\n * Note what this does NOT answer: whether a given user can present a given method. That is per-user\n * and belongs to the identify response; this is a question about the resolved POLICY, answerable\n * before anyone has typed anything.\n */\nexport function getEnabledFirstFactorMethods(map: AuthMethodsMap | undefined): Set<AuthMethod> {\n  const enabled = getEnabledMethods(map);\n  return new Set(AuthUtils.getFirstFactorMethods().filter((method) => enabled.has(method)));\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n  const result: AuthMethodsMap = {};\n  for (const method of Object.values(AuthMethod)) {\n    result[method] = methods.has(method);\n  }\n  return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/**\n * Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n *\n * `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n */\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n  AuthMethod.PASSWORD,\n  AuthMethod.PASSKEY,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.SMS_OTP,\n];\n\n/**\n * AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user holds an identity link for any ACTIVELY directory-managed org — whatever their\n * membership's status there, since a deprovisioned or removed member keeps the block (#1151) — so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n */\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n  const result: AuthMethodsMap = { ...authMethodsEnabled };\n  for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n    result[method] = false;\n  }\n  return result;\n}\n\n// ─── Second-factor set resolution (THE one rule) ─────────────────────────────\n\n/**\n * The policy shape {@link resolveAcceptedSecondFactorMethods} needs. Structural rather than\n * `UserTypeAuthPolicy` so a caller holding a partially-resolved policy — the orchestrator's\n * fallback, a session snapshot, an authored config being validated at startup — can ask the same\n * question without first assembling a whole policy object.\n */\nexport interface SecondFactorPolicyInput {\n  authMethodsEnabled?: AuthMethodsMap;\n  mfaPolicy?: {\n    acceptableMFAMethods?: AuthMethod[];\n    requireStrongMFA?: boolean;\n  };\n}\n\n/**\n * The second-factor methods THIS policy accepts at a challenge, derived totally over the auth-method\n * vocabulary.\n *\n * ```\n * vocabulary (AUTH_METHOD_FACTOR_MAP: SECOND_ONLY | FIRST_OR_SECOND | ANY)\n *   ∩ authMethodsEnabled\n *   ∩ acceptableMFAMethods            (when authored non-empty — it NARROWS, never replaces)\n *   − always-available                (when requireStrongMFA)\n * ```\n *\n * **This function exists because the offer and the acceptance had drifted apart.** The challenge\n * resolver intersected `acceptableMFAMethods`; the two sites that computed which methods to OFFER\n * for enrollment filtered on `authMethodsEnabled` alone. So a policy enabling SMS OTP as a login\n * method while accepting only `[TOTP, PASSKEY]` for MFA offered the user a phone enrollment the\n * challenge would then refuse — an application could send someone to set up a factor it had already\n * decided not to take. Both sides now read this, so they cannot disagree: the invariant is\n * unbypassable rather than applied N times.\n *\n * **`requireStrongMFA` asks `isStrongSecondFactor`, which reads the method's CHANNEL.** It used to\n * be expressed as \"drop the always-available ones\", on the reasoning that a factor needing no\n * enrolment rides an address the account already proved and is therefore not an independent\n * possession proof. That reached the right answer through a property that only coincides with the one\n * it meant, and #1246 replaced the proxy with the thing itself. The resulting set is unchanged.\n */\nexport function resolveAcceptedSecondFactorMethods(policy: SecondFactorPolicyInput | undefined): AuthMethod[] {\n  const enabled = getEnabledMethods(policy?.authMethodsEnabled);\n  const acceptable = policy?.mfaPolicy?.acceptableMFAMethods ?? [];\n  const acceptableSet = acceptable.length > 0 ? new Set(acceptable) : undefined;\n  /*\n   * `requireStrongMFA` now asks the method what it PROVES (#1246), instead of standing on the\n   * enrolment proxy. The set is identical today — `EMAIL_OTP` is the only second factor on the email\n   * channel and the only always-available one — but the two properties merely coincide: a second\n   * always-available factor on another channel would have been dropped for no reason, and a weak\n   * factor that did need enrolment would have passed. `isStrongSecondFactor` carries the reasoning\n   * and the citation.\n   */\n  const excluded = policy?.mfaPolicy?.requireStrongMFA\n    ? new Set(AuthUtils.getSecondFactorMethods().filter((method) => !isStrongSecondFactor(method)))\n    : undefined;\n\n  return AuthUtils.getSecondFactorMethods().filter(\n    (method) => enabled.has(method)\n      && (!acceptableSet || acceptableSet.has(method))\n      && (!excluded || !excluded.has(method)),\n  );\n}\n\n/**\n * The second-factor methods THIS policy accepts **and** that a user can actually enroll — the\n * accepted set minus the ones that need no enrollment.\n *\n * This is what an enrollment surface offers. Listing an always-available factor there would render\n * a setup step for something already set up, so the subtraction is semantic rather than cosmetic.\n *\n * An empty result is meaningful and not a bug: it means every factor the policy accepts is already\n * available to this user, so there is nothing to enroll. (An empty ACCEPTED set is the real\n * deadlock, and `application-startup-config-validator` refuses that at boot.)\n */\nexport function resolveEnrollableSecondFactorMethods(policy: SecondFactorPolicyInput | undefined): AuthMethod[] {\n  const alwaysAvailable = new Set(AuthUtils.getAlwaysAvailableSecondFactorMethods());\n  return resolveAcceptedSecondFactorMethods(policy).filter((method) => !alwaysAvailable.has(method));\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n  userTypeMethods: Set<AuthMethod>,\n  orgOverride: OrgTypeAuthOverrides,\n  policy: OrgAuthMethodPolicy,\n  expandable: AuthMethod[],\n): Set<AuthMethod> {\n  if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n  const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n  switch (policy) {\n    case OrgAuthMethodPolicy.RESTRICT_ONLY:\n      return intersection(userTypeMethods, orgMethods);\n\n    case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n      const expandableSet = new Set(expandable);\n      const expansions = intersection(orgMethods, expandableSet);\n      return union(userTypeMethods, expansions);\n    }\n\n    case OrgAuthMethodPolicy.UNRESTRICTED:\n      return new Set(orgMethods);\n\n    default:\n      return new Set(userTypeMethods);\n  }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n  userTypeMethods: Set<AuthMethod>,\n  orgOverrides: OrgTypeAuthOverrides[],\n  policy: OrgAuthMethodPolicy,\n  expandable: AuthMethod[],\n): Set<AuthMethod> {\n  const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n  if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n  const perOrgResults = validOverrides.map(o =>\n    resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n  );\n\n  if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n    // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n    // Each org may expand within the expandable set, but multi-org users only get\n    // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n    return perOrgResults.reduce((acc, set) => intersection(acc, set));\n  }\n\n  return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n  base: MfaPolicyConfig,\n  override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n  return {\n    externalAssuranceEnforcement: base.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT || override.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT\n      ? ExternalAssuranceEnforcement.STRICT : ExternalAssuranceEnforcement.WARN,\n    requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n    requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n    acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n    enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n    passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n  };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n  base: MfaPolicyConfig,\n  orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n  const mfaOverrides = orgOverrides\n    .map(o => o?.mfaPolicy)\n    .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n  if (mfaOverrides.length === 0) return { ...base };\n\n  const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n  return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n  return {\n    externalAssuranceEnforcement: a.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT || b.externalAssuranceEnforcement === ExternalAssuranceEnforcement.STRICT\n      ? ExternalAssuranceEnforcement.STRICT : ExternalAssuranceEnforcement.WARN,\n    requireMFA: a.requireMFA || b.requireMFA,\n    requireStrongMFA: a.requireStrongMFA || b.requireStrongMFA,\n    acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n    enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n    passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n  };\n}\n\n// ─── Step-Up Auth Resolution ────────────────────────────────────────────────\n\nfunction resolveStepUpSingle(base: StepUpAuthConfig, override: Partial<StepUpAuthConfig>): StepUpAuthConfig {\n  return {\n    // Either side turning step-up ON wins: an organisation may require re-authentication where the\n    // application does not, and may never switch off one the application requires.\n    enabled: base.enabled || (override.enabled ?? false),\n    // The SHORTER window wins — the opposite arithmetic to `enabled`, same direction of intent.\n    maxAgeSeconds: mergeNumberLowerWins(base.maxAgeSeconds, override.maxAgeSeconds),\n    // Intersection: an organisation may WITHDRAW an acceptable method, never introduce one.\n    methods: mergeArrayIntersection(base.methods, override.methods) ?? base.methods,\n  };\n}\n\nfunction resolveStepUpMultiOrg(\n  base: StepUpAuthConfig | undefined,\n  orgOverrides: OrgTypeAuthOverrides[],\n): StepUpAuthConfig | undefined {\n  if (base === undefined) return undefined;\n  const stepUpOverrides = orgOverrides\n    .map(o => o?.stepUpAuth)\n    .filter((p): p is Partial<StepUpAuthConfig> => !!p);\n  if (stepUpOverrides.length === 0) return { ...base };\n\n  const perOrgResults = stepUpOverrides.map(o => resolveStepUpSingle(base, o));\n  return perOrgResults.reduce((acc, r) => ({\n    enabled: acc.enabled || r.enabled,\n    maxAgeSeconds: Math.min(acc.maxAgeSeconds, r.maxAgeSeconds),\n    methods: mergeArrayIntersection(acc.methods, r.methods) ?? acc.methods,\n  }));\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n  base: PasswordPolicyConfig,\n  override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n  return {\n    minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n    maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n    requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n    requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n    requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n    requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n    expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n  };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n  base: PasswordPolicyConfig,\n  orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n  const pwOverrides = orgOverrides\n    .map(o => o?.passwordPolicy)\n    .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n  if (pwOverrides.length === 0) return { ...base };\n\n  const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n  return normalizePasswordPolicyBounds(\n    perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n  );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n  return normalizePasswordPolicyBounds({\n    minLength: Math.max(a.minLength, b.minLength),\n    maxLength: Math.min(a.maxLength, b.maxLength),\n    requireUppercase: a.requireUppercase || b.requireUppercase,\n    requireLowercase: a.requireLowercase || b.requireLowercase,\n    requireNumbers: a.requireNumbers || b.requireNumbers,\n    requireSpecialChars: a.requireSpecialChars || b.requireSpecialChars,\n    expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n  });\n}\n\n/**\n * Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n  if (policy.maxLength >= policy.minLength) {\n    return policy;\n  }\n\n  return {\n    ...policy,\n    maxLength: policy.minLength,\n  };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean | undefined): boolean {\n  if (override === undefined) return base;\n  return base || override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean | undefined): boolean {\n  if (override === undefined) return base;\n  return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  if (base === 0 && override === 0) return 0;\n  if (base === 0) return override;\n  if (override === 0) return base;\n  return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] | undefined, b: T[] | undefined): T[] | undefined {\n  if (a === undefined) return b;\n  if (b === undefined) return a;\n  const setB = new Set(b);\n  return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n  const result = new Set<T>();\n  for (const item of a) {\n    if (b.has(item)) result.add(item);\n  }\n  return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n  return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n  const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n  if (!orgOverrides.length) {\n    return {\n      authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n      mfaPolicy: { ...userTypeAuth.mfaPolicy },\n      passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n      stepUpAuth: userTypeAuth.stepUpAuth ? { ...userTypeAuth.stepUpAuth } : undefined,\n    };\n  }\n\n  const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n  const resolvedMethods = resolveAuthMethodsMultiOrg(\n    userTypeMethods,\n    orgOverrides,\n    orgAuthMethodPolicy,\n    expandableOrgMethods ?? [],\n  );\n\n  return {\n    authMethodsEnabled: setToMethodsMap(resolvedMethods),\n    mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n    passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n    stepUpAuth: resolveStepUpMultiOrg(userTypeAuth.stepUpAuth, orgOverrides),\n  };\n}\n"]}

package/dist/esm/config/brand-assets.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"brand-assets.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAED,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,UAAU,eAAe;CAC1B;AAED,oBAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,MAAM,WAAW;IACjB,mFAAmF;IACnF,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,oBAAY,gBAAgB;IAC1B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AASD,QAAA,MAAM,wBAAwB;;;;;;;;iBAS5B,CAAC;AACH,eAAO,MAAM,uBAAuB,EAAE,OAAO,wBAAmD,CAAC;AACjG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,qBAAqB,CAAC;IACnC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,KAAK,EAAE,eAAe,GACrB,iBAAiB,GAAG,SAAS,CAsB/B"}
+{"version":3,"file":"brand-assets.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAED,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,UAAU,eAAe;CAC1B;AAED,oBAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,MAAM,WAAW;IACjB,mFAAmF;IACnF,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,oBAAY,gBAAgB;IAC1B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AASD,QAAA,MAAM,wBAAwB;;;;;;;;iBAS5B,CAAC;AACH,eAAO,MAAM,uBAAuB,EAAE,OAAO,wBAAmD,CAAC;AACjG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,qBAAqB,CAAC;IACnC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,KAAK,EAAE,eAAe,GACrB,iBAAiB,GAAG,SAAS,CAsB/B"}

package/dist/esm/config/brand-assets.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"brand-assets.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,8CAAqB,CAAA;IACrB,0CAAiB,CAAA;AACnB,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,sCAAmB,CAAA;IACnB,gCAAa,CAAA;IACb,kCAAe,CAAA;IACf,4CAAyB,CAAA;AAC3B,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED,MAAM,CAAN,IAAY,iBAeX;AAfD,WAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,sCAAiB,CAAA;IACjB,mFAAmF;IACnF,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;IACnB,0DAAqC,CAAA;IACrC,oDAA+B,CAAA;IAC/B,0CAAqB,CAAA;IACrB,oCAAe,CAAA;AACjB,CAAC,EAfW,iBAAiB,KAAjB,iBAAiB,QAe5B;AAED,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,+BAAW,CAAA;IACX,+BAAW,CAAA;IACX,+BAAW,CAAA;IACX,iCAAa,CAAA;AACf,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC;IAC9E,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAClE,8DAA8D;IAC9D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC;IAC/D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAoC,wBAAwB,CAAC;AAUjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA2B,EAC3B,KAAsB;IAEtB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC;IAE3D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CACzF,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAC3G,CAAC;IACF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,CAAC,OAAO,CAC7H,CAAC;IACF,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAElD,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,CAAC,OAAO,CACtF,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\n\n/**\n * RUNTIME brand-asset representation — the servable projection of the\n * authored/generated brand identity, importable by every runtime consumer\n * (app shell, org branding, email, auth, website, docs).\n *\n * WHY A RUNTIME SIBLING: the authoring/spec `BrandAssetConfig` lives in\n * `@wildo-ai/saas-specifications`, which sits BELOW `saas-models` in the\n * dependency graph — runtime consumers (this package and above) cannot import\n * it. This is the runtime counterpart the companion PROJECTS the generated\n * brand manifest into: a flat list of `(composition × theme × purpose) → url`\n * entries a consumer resolves against by the axes it cares about (the app-shell\n * header asks for `(LOCKUP, DEFAULT)`, the favicon for `(SYMBOL, DEFAULT,\n * FAVICON)`). Enum VALUES are kept identical to the spec enums so the\n * companion's projection is a value-preserving map — a value present in one\n * enum and not the other makes `projectResolvedAssets` throw, by design.\n */\nexport enum BrandAssetComposition {\n  SYMBOL = 'SYMBOL',\n  WORDMARK = 'WORDMARK',\n  LOCKUP = 'LOCKUP',\n}\n\nexport enum BrandAssetTheme {\n  DEFAULT = 'DEFAULT',\n  DARK = 'DARK',\n  LIGHT = 'LIGHT',\n  MONOCHROME = 'MONOCHROME',\n}\n\nexport enum BrandAssetPurpose {\n  /**\n   * Full-resolution generated source — print, high-DPI export, re-derivation.\n   * Reachable ONLY by an exact {@link resolveBrandAsset} query: it is\n   * deliberately absent from every fallback rung, so no consumer is ever handed\n   * an unbounded file it did not ask for. A UI surface wants {@link PRIMARY}.\n   */\n  MASTER = 'MASTER',\n  /** The base DISPLAY form of a (composition, theme) — what a UI surface renders. */\n  PRIMARY = 'PRIMARY',\n  FAVICON = 'FAVICON',\n  APPLE_TOUCH_ICON = 'APPLE_TOUCH_ICON',\n  MASKABLE_ICON = 'MASKABLE_ICON',\n  OG_IMAGE = 'OG_IMAGE',\n  EMAIL = 'EMAIL',\n}\n\nexport enum BrandAssetFormat {\n  PNG = 'PNG',\n  SVG = 'SVG',\n  ICO = 'ICO',\n  WEBP = 'WEBP',\n}\n\n/*\n * Each vocabulary is DECLARED under the same name as its authoring counterpart in\n * `@wildo-ai/saas-specifications` (`BrandAssetConfig`), so a surface that words a runtime asset reads the\n * same `system_enums.<name>` block as the brand document does (#966). Measured 2026-09-13: no label walk\n * reaches this schema today (it lives in application configuration, not in a resource or an aspect), so\n * the declaration costs nothing and keeps the first such surface from rendering raw.\n */\nconst _RuntimeBrandAssetSchema = z.object({\n  composition: z.enum(BrandAssetComposition).systemEnum('BrandAssetComposition'),\n  theme: z.enum(BrandAssetTheme).systemEnum('BrandAssetTheme'),\n  purpose: z.enum(BrandAssetPurpose).systemEnum('BrandAssetPurpose'),\n  /** A servable URL or app-relative path for the asset file. */\n  url: z.string().min(1),\n  format: z.enum(BrandAssetFormat).systemEnum('BrandAssetFormat'),\n  width: z.number().int().positive().optional(),\n  height: z.number().int().positive().optional(),\n});\nexport const RuntimeBrandAssetSchema: typeof _RuntimeBrandAssetSchema = _RuntimeBrandAssetSchema;\nexport type RuntimeBrandAsset = z.infer<typeof _RuntimeBrandAssetSchema>;\n\n/** A resolution query — composition is required; theme/purpose default sensibly. */\nexport interface BrandAssetQuery {\n  composition: BrandAssetComposition;\n  theme?: BrandAssetTheme;\n  purpose?: BrandAssetPurpose;\n}\n\n/**\n * Resolves the best runtime brand asset for a query, with graceful fallbacks so\n * a consumer always gets *something* when a specific variant was not generated:\n *\n * 1. exact `(composition, theme, purpose)` match, else\n * 2. same `(composition, purpose)` at `theme: DEFAULT`, else\n * 3. same `composition` at `(DEFAULT, PRIMARY)`, else\n * 4. any `(DEFAULT, PRIMARY)` asset, else `undefined`.\n *\n * NOTE RUNGS 3 AND 4 BOTH TARGET `PRIMARY`: it is the universal last-resort, so\n * whatever occupies it is what every unresolved query in the system degrades to.\n * That is why {@link BrandAssetPurpose.MASTER} exists as a separate slot and\n * appears on NO rung here — the full-resolution source must be asked for by an\n * exact query (rung 1) and can never be handed to a consumer by a fallback.\n * Keep it that way when editing the ladder.\n *\n * Returns `undefined` when the list is empty (no brand generated yet) — the\n * caller keeps its existing fallback (e.g. a placeholder or the legacy URL).\n */\nexport function resolveBrandAsset(\n  assets: RuntimeBrandAsset[],\n  query: BrandAssetQuery,\n): RuntimeBrandAsset | undefined {\n  const theme = query.theme ?? BrandAssetTheme.DEFAULT;\n  const purpose = query.purpose ?? BrandAssetPurpose.PRIMARY;\n\n  const exact = assets.find(\n    (a) => a.composition === query.composition && a.theme === theme && a.purpose === purpose,\n  );\n  if (exact) return exact;\n\n  const themeFallback = assets.find(\n    (a) => a.composition === query.composition && a.theme === BrandAssetTheme.DEFAULT && a.purpose === purpose,\n  );\n  if (themeFallback) return themeFallback;\n\n  const compositionPrimary = assets.find(\n    (a) => a.composition === query.composition && a.theme === BrandAssetTheme.DEFAULT && a.purpose === BrandAssetPurpose.PRIMARY,\n  );\n  if (compositionPrimary) return compositionPrimary;\n\n  return assets.find(\n    (a) => a.theme === BrandAssetTheme.DEFAULT && a.purpose === BrandAssetPurpose.PRIMARY,\n  );\n}\n"]}
+{"version":3,"file":"brand-assets.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,0CAAiB,CAAA;IACjB,8CAAqB,CAAA;IACrB,0CAAiB,CAAA;AACnB,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,sCAAmB,CAAA;IACnB,gCAAa,CAAA;IACb,kCAAe,CAAA;IACf,4CAAyB,CAAA;AAC3B,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED,MAAM,CAAN,IAAY,iBAeX;AAfD,WAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,sCAAiB,CAAA;IACjB,mFAAmF;IACnF,wCAAmB,CAAA;IACnB,wCAAmB,CAAA;IACnB,0DAAqC,CAAA;IACrC,oDAA+B,CAAA;IAC/B,0CAAqB,CAAA;IACrB,oCAAe,CAAA;AACjB,CAAC,EAfW,iBAAiB,KAAjB,iBAAiB,QAe5B;AAED,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,+BAAW,CAAA;IACX,+BAAW,CAAA;IACX,+BAAW,CAAA;IACX,iCAAa,CAAA;AACf,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC;IAC9E,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAClE,8DAA8D;IAC9D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC;IAC/D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAoC,wBAAwB,CAAC;AAUjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA2B,EAC3B,KAAsB;IAEtB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC;IAE3D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CACzF,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAC3G,CAAC;IACF,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,CAAC,OAAO,CAC7H,CAAC;IACF,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAElD,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,CAAC,OAAO,CACtF,CAAC;AACJ,CAAC","sourcesContent":["import { z } from 'zod';\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\n\n/**\n * RUNTIME brand-asset representation — the servable projection of the\n * authored/generated brand identity, importable by every runtime consumer\n * (app shell, org branding, email, auth, website, docs).\n *\n * WHY A RUNTIME SIBLING: the authoring/spec `BrandAssetConfig` lives in\n * `@wildo-ai/saas-specifications`, which sits BELOW `saas-models` in the\n * dependency graph — runtime consumers (this package and above) cannot import\n * it. This is the runtime counterpart the companion PROJECTS the generated\n * brand manifest into: a flat list of `(composition × theme × purpose) → url`\n * entries a consumer resolves against by the axes it cares about (the app-shell\n * header asks for `(LOCKUP, DEFAULT)`, the favicon for `(SYMBOL, DEFAULT,\n * FAVICON)`). Enum VALUES are kept identical to the spec enums so the\n * companion's projection is a value-preserving map — a value present in one\n * enum and not the other makes `projectResolvedAssets` throw, by design.\n */\nexport enum BrandAssetComposition {\n  SYMBOL = 'SYMBOL',\n  WORDMARK = 'WORDMARK',\n  LOCKUP = 'LOCKUP',\n}\n\nexport enum BrandAssetTheme {\n  DEFAULT = 'DEFAULT',\n  DARK = 'DARK',\n  LIGHT = 'LIGHT',\n  MONOCHROME = 'MONOCHROME',\n}\n\nexport enum BrandAssetPurpose {\n  /**\n   * Full-resolution generated source — print, high-DPI export, re-derivation.\n   * Reachable ONLY by an exact {@link resolveBrandAsset} query: it is\n   * deliberately absent from every fallback rung, so no consumer is ever handed\n   * an unbounded file it did not ask for. A UI surface wants {@link PRIMARY}.\n   */\n  MASTER = 'MASTER',\n  /** The base DISPLAY form of a (composition, theme) — what a UI surface renders. */\n  PRIMARY = 'PRIMARY',\n  FAVICON = 'FAVICON',\n  APPLE_TOUCH_ICON = 'APPLE_TOUCH_ICON',\n  MASKABLE_ICON = 'MASKABLE_ICON',\n  OG_IMAGE = 'OG_IMAGE',\n  EMAIL = 'EMAIL',\n}\n\nexport enum BrandAssetFormat {\n  PNG = 'PNG',\n  SVG = 'SVG',\n  ICO = 'ICO',\n  WEBP = 'WEBP',\n}\n\n/*\n * Each vocabulary is DECLARED under the same name as its authoring counterpart in\n * `@wildo-ai/saas-specifications` (`BrandAssetConfig`), so a surface that words a runtime asset reads the\n * same `system_enums.<name>` block as the brand document does (#966). Measured 2026-09-13: no label walk\n * reaches this schema today (it lives in application configuration, not in a resource or an aspect), so\n * the declaration costs nothing and keeps the first such surface from rendering raw.\n */\nconst _RuntimeBrandAssetSchema = z.object({\n  composition: z.enum(BrandAssetComposition).systemEnum('BrandAssetComposition'),\n  theme: z.enum(BrandAssetTheme).systemEnum('BrandAssetTheme'),\n  purpose: z.enum(BrandAssetPurpose).systemEnum('BrandAssetPurpose'),\n  /** A servable URL or app-relative path for the asset file. */\n  url: z.string().min(1),\n  format: z.enum(BrandAssetFormat).systemEnum('BrandAssetFormat'),\n  width: z.number().int().positive().optional(),\n  height: z.number().int().positive().optional(),\n});\nexport const RuntimeBrandAssetSchema: typeof _RuntimeBrandAssetSchema = _RuntimeBrandAssetSchema;\nexport type RuntimeBrandAsset = z.infer<typeof _RuntimeBrandAssetSchema>;\n\n/** A resolution query — composition is required; theme/purpose default sensibly. */\nexport interface BrandAssetQuery {\n  composition: BrandAssetComposition;\n  theme?: BrandAssetTheme;\n  purpose?: BrandAssetPurpose;\n}\n\n/**\n * Resolves the best runtime brand asset for a query, with graceful fallbacks so\n * a consumer always gets *something* when a specific variant was not generated:\n *\n * 1. exact `(composition, theme, purpose)` match, else\n * 2. same `(composition, purpose)` at `theme: DEFAULT`, else\n * 3. same `composition` at `(DEFAULT, PRIMARY)`, else\n * 4. any `(DEFAULT, PRIMARY)` asset, else `undefined`.\n *\n * NOTE RUNGS 3 AND 4 BOTH TARGET `PRIMARY`: it is the universal last-resort, so\n * whatever occupies it is what every unresolved query in the system degrades to.\n * That is why {@link BrandAssetPurpose.MASTER} exists as a separate slot and\n * appears on NO rung here — the full-resolution source must be asked for by an\n * exact query (rung 1) and can never be handed to a consumer by a fallback.\n * Keep it that way when editing the ladder.\n *\n * Returns `undefined` when the list is empty (no brand generated yet) — the\n * caller keeps its existing fallback (e.g. a placeholder or the legacy URL).\n */\nexport function resolveBrandAsset(\n  assets: RuntimeBrandAsset[],\n  query: BrandAssetQuery,\n): RuntimeBrandAsset | undefined {\n  const theme = query.theme ?? BrandAssetTheme.DEFAULT;\n  const purpose = query.purpose ?? BrandAssetPurpose.PRIMARY;\n\n  const exact = assets.find(\n    (a) => a.composition === query.composition && a.theme === theme && a.purpose === purpose,\n  );\n  if (exact) return exact;\n\n  const themeFallback = assets.find(\n    (a) => a.composition === query.composition && a.theme === BrandAssetTheme.DEFAULT && a.purpose === purpose,\n  );\n  if (themeFallback) return themeFallback;\n\n  const compositionPrimary = assets.find(\n    (a) => a.composition === query.composition && a.theme === BrandAssetTheme.DEFAULT && a.purpose === BrandAssetPurpose.PRIMARY,\n  );\n  if (compositionPrimary) return compositionPrimary;\n\n  return assets.find(\n    (a) => a.theme === BrandAssetTheme.DEFAULT && a.purpose === BrandAssetPurpose.PRIMARY,\n  );\n}\n"]}

package/dist/esm/config/configuration-validation.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configuration-validation.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/configuration-validation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,oBAAY,+BAA+B;IACzC,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAMD,oBAAY,6BAA6B;IACvC,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,iBAAiB,sBAAsB;IACvC,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,IAAI,SAAS;IACb;;;;;;;;;OASG;IACH,GAAG,QAAQ;CACZ;AAMD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,+BAA+B,CAAC;IAC1C,MAAM,EAAE,6BAA6B,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAMD,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACvC,KAAK,EAAE,OAAO,CAAC;CAChB;AAMD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,4BAA4B,EAAE,GAAG,6BAA6B,CAK3G;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,6BAA6B,EACrC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,4BAA4B,CAE9B;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,6BAA6B,EACrC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,4BAA4B,CAE9B"}
+{"version":3,"file":"configuration-validation.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/configuration-validation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,oBAAY,+BAA+B;IACzC,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAMD,oBAAY,6BAA6B;IACvC,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,iBAAiB,sBAAsB;IACvC,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,IAAI,SAAS;IACb;;;;;;;;;OASG;IACH,GAAG,QAAQ;CACZ;AAMD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,+BAA+B,CAAC;IAC1C,MAAM,EAAE,6BAA6B,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAMD,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACvC,KAAK,EAAE,OAAO,CAAC;CAChB;AAMD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,4BAA4B,EAAE,GAAG,6BAA6B,CAK3G;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,6BAA6B,EACrC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,4BAA4B,CAE9B;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,6BAA6B,EACrC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,4BAA4B,CAE9B"}

package/dist/esm/config/configuration-validation.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"configuration-validation.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/configuration-validation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAN,IAAY,+BAGX;AAHD,WAAY,+BAA+B;IACzC,kDAAe,CAAA;IACf,sDAAmB,CAAA;AACrB,CAAC,EAHW,+BAA+B,KAA/B,+BAA+B,QAG1C;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,CAAN,IAAY,6BAoBX;AApBD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,8CAAa,CAAA;IACb,kDAAiB,CAAA;IACjB,wEAAuC,CAAA;IACvC,sDAAqB,CAAA;IACrB,oDAAmB,CAAA;IACnB,wDAAuB,CAAA;IACvB,8CAAa,CAAA;IACb;;;;;;;;;OASG;IACH,4CAAW,CAAA;AACb,CAAC,EApBW,6BAA6B,KAA7B,6BAA6B,QAoBxC;AAsBD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,UAAU,qBAAqB,CAAC,MAAsC;IAC1E,OAAO;QACL,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,+BAA+B,CAAC,KAAK,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAqC,EACrC,OAAe,EACf,OAAiC;IAEjC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAqC,EACrC,OAAe,EACf,OAAiC;IAEjC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACzF,CAAC","sourcesContent":["/**\n * Configuration Validation — shared contract for startup cross-checks.\n *\n * Used by both backend (ApplicationStartupConfigValidatorService) and\n * frontend (future AppShellConfigValidatorService) to produce structured\n * validation reports after registry initialization.\n *\n * Each validator returns ConfigurationValidationIssue[] and the runner\n * collects, logs, and optionally throws on errors.\n */\n\n// ---------------------------------------------------------------------------\n// Issue severity\n// ---------------------------------------------------------------------------\n\nexport enum ConfigurationValidationSeverity {\n  ERROR = 'ERROR',\n  WARNING = 'WARNING',\n}\n\n// ---------------------------------------------------------------------------\n// Validation domain — groups related cross-checks\n// ---------------------------------------------------------------------------\n\nexport enum ConfigurationValidationDomain {\n  STORAGE = 'STORAGE',\n  AUTH = 'AUTH',\n  AGENTS = 'AGENTS',\n  FRONTEND_SERVICES = 'FRONTEND_SERVICES',\n  FEATURES = 'FEATURES',\n  BILLING = 'BILLING',\n  LIFECYCLE = 'LIFECYCLE',\n  I18N = 'I18N',\n  /**\n   * RAG derived-data-tier capability checks: `.ragSource()` field declarations cross-referenced\n   * against the owning datastore's vector capability — pgvector on PostgreSQL, `mongot` (MongoDB\n   * Search / Vector Search, a process beside `mongod`) on MongoDB. Both are proven by EXECUTING a\n   * command on the live connection rather than by reading a version, because a server can report a\n   * capable version while lacking the extension or the sidecar that implements it.\n   *\n   * Fail-closed at boot because chunks already written into an unreachable store are an ERASURE\n   * dead-end, not merely a degraded feature.\n   */\n  RAG = 'RAG',\n}\n\n// ---------------------------------------------------------------------------\n// Issue shape\n// ---------------------------------------------------------------------------\n\nexport interface ConfigurationValidationIssue {\n  severity: ConfigurationValidationSeverity;\n  domain: ConfigurationValidationDomain;\n  message: string;\n  context?: Record<string, unknown>;\n}\n\n// ---------------------------------------------------------------------------\n// Aggregated result\n// ---------------------------------------------------------------------------\n\nexport interface ConfigurationValidationResult {\n  issues: ConfigurationValidationIssue[];\n  valid: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nexport function buildValidationResult(issues: ConfigurationValidationIssue[]): ConfigurationValidationResult {\n  return {\n    issues,\n    valid: issues.every((i) => i.severity !== ConfigurationValidationSeverity.ERROR),\n  };\n}\n\nexport function issueError(\n  domain: ConfigurationValidationDomain,\n  message: string,\n  context?: Record<string, unknown>,\n): ConfigurationValidationIssue {\n  return { severity: ConfigurationValidationSeverity.ERROR, domain, message, context };\n}\n\nexport function issueWarning(\n  domain: ConfigurationValidationDomain,\n  message: string,\n  context?: Record<string, unknown>,\n): ConfigurationValidationIssue {\n  return { severity: ConfigurationValidationSeverity.WARNING, domain, message, context };\n}\n"]}
+{"version":3,"file":"configuration-validation.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/configuration-validation.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAN,IAAY,+BAGX;AAHD,WAAY,+BAA+B;IACzC,kDAAe,CAAA;IACf,sDAAmB,CAAA;AACrB,CAAC,EAHW,+BAA+B,KAA/B,+BAA+B,QAG1C;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,CAAN,IAAY,6BAoBX;AApBD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,8CAAa,CAAA;IACb,kDAAiB,CAAA;IACjB,wEAAuC,CAAA;IACvC,sDAAqB,CAAA;IACrB,oDAAmB,CAAA;IACnB,wDAAuB,CAAA;IACvB,8CAAa,CAAA;IACb;;;;;;;;;OASG;IACH,4CAAW,CAAA;AACb,CAAC,EApBW,6BAA6B,KAA7B,6BAA6B,QAoBxC;AAsBD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,UAAU,qBAAqB,CAAC,MAAsC;IAC1E,OAAO;QACL,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,+BAA+B,CAAC,KAAK,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAqC,EACrC,OAAe,EACf,OAAiC;IAEjC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAqC,EACrC,OAAe,EACf,OAAiC;IAEjC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACzF,CAAC","sourcesContent":["/**\n * Configuration Validation — shared contract for startup cross-checks.\n *\n * Used by both backend (ApplicationStartupConfigValidatorService) and\n * frontend (future AppShellConfigValidatorService) to produce structured\n * validation reports after registry initialization.\n *\n * Each validator returns ConfigurationValidationIssue[] and the runner\n * collects, logs, and optionally throws on errors.\n */\n\n// ---------------------------------------------------------------------------\n// Issue severity\n// ---------------------------------------------------------------------------\n\nexport enum ConfigurationValidationSeverity {\n  ERROR = 'ERROR',\n  WARNING = 'WARNING',\n}\n\n// ---------------------------------------------------------------------------\n// Validation domain — groups related cross-checks\n// ---------------------------------------------------------------------------\n\nexport enum ConfigurationValidationDomain {\n  STORAGE = 'STORAGE',\n  AUTH = 'AUTH',\n  AGENTS = 'AGENTS',\n  FRONTEND_SERVICES = 'FRONTEND_SERVICES',\n  FEATURES = 'FEATURES',\n  BILLING = 'BILLING',\n  LIFECYCLE = 'LIFECYCLE',\n  I18N = 'I18N',\n  /**\n   * RAG derived-data-tier capability checks: `.ragSource()` field declarations cross-referenced\n   * against the owning datastore's vector capability — pgvector on PostgreSQL, `mongot` (MongoDB\n   * Search / Vector Search, a process beside `mongod`) on MongoDB. Both are proven by EXECUTING a\n   * command on the live connection rather than by reading a version, because a server can report a\n   * capable version while lacking the extension or the sidecar that implements it.\n   *\n   * Fail-closed at boot because chunks already written into an unreachable store are an ERASURE\n   * dead-end, not merely a degraded feature.\n   */\n  RAG = 'RAG',\n}\n\n// ---------------------------------------------------------------------------\n// Issue shape\n// ---------------------------------------------------------------------------\n\nexport interface ConfigurationValidationIssue {\n  severity: ConfigurationValidationSeverity;\n  domain: ConfigurationValidationDomain;\n  message: string;\n  context?: Record<string, unknown>;\n}\n\n// ---------------------------------------------------------------------------\n// Aggregated result\n// ---------------------------------------------------------------------------\n\nexport interface ConfigurationValidationResult {\n  issues: ConfigurationValidationIssue[];\n  valid: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nexport function buildValidationResult(issues: ConfigurationValidationIssue[]): ConfigurationValidationResult {\n  return {\n    issues,\n    valid: issues.every((i) => i.severity !== ConfigurationValidationSeverity.ERROR),\n  };\n}\n\nexport function issueError(\n  domain: ConfigurationValidationDomain,\n  message: string,\n  context?: Record<string, unknown>,\n): ConfigurationValidationIssue {\n  return { severity: ConfigurationValidationSeverity.ERROR, domain, message, context };\n}\n\nexport function issueWarning(\n  domain: ConfigurationValidationDomain,\n  message: string,\n  context?: Record<string, unknown>,\n): ConfigurationValidationIssue {\n  return { severity: ConfigurationValidationSeverity.WARNING, domain, message, context };\n}\n"]}

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,gEAAgE,CAAC;AAUtH,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,4BAA4B;IACtC,2BAA2B;IAC3B,YAAY,iBAAiB;IAC7B,6EAA6E;IAC7E,UAAU,eAAe;CAC1B;AACD,6DAA6D;AAE7D,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AActF,eAAO,MAAM,qBAAqB;;;;;;;iBAYhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB;;IAEnC;;;;;;;;;;;;OAYG;;IAEH,6DAA6D;;IAE7D,yFAAyF;;IAEzF;;;;;;;;;;;;;;;;;;;OAmBG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;;;;;;;;;;IAEH,yGAAyG;;kBA0FzG,CAAC;AACH,6DAA6D;AAC7D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,GAAG,IAAI,GAAG,SAAS,GACnF,4BAA4B,CAE9B;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBAwCrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAiBvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;QAlQnC;;;;;;;;;;;;WAYG;;QAEH,6DAA6D;;QAE7D,yFAAyF;;QAEzF;;;;;;;;;;;;;;;;;;;WAmBG;;QAEH;;;;;;;;;;;;;;;;WAgBG;;;;;;;;;;;QAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsRzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;YApVnC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkTzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,8GAA8G;AAC9G,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmB1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0J3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,mEAAmE;AAInE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;YAnpBhC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0lBxB,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwFtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE;AAED;;;GAGG;AACH,oBAAY,sCAAsC;IAChD,0HAA0H;IAC1H,sBAAsB,2BAA2B;IACjD,kHAAkH;IAClH,yBAAyB,8BAA8B;IACvD,mIAAmI;IACnI,4BAA4B,iCAAiC;CAC9D;AAED;;;;;;;;GAQG;AACH,oBAAY,iCAAiC;IAC3C,gEAAgE;IAChE,OAAO,YAAY;IACnB,6BAA6B;IAC7B,IAAI,SAAS;IACb,qFAAqF;IACrF,SAAS,cAAc;CACxB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,OAAO,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,IAAI,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAW9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,wCAAwC,CACtD,iBAAiB,EACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GACpG,SAAS,EACb,2BAA2B,EAAE,SAAS,MAAM,EAAE,GAC7C,0BAA0B,CAU5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oCAAoC,CAClD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAC7H,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,CAGR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uCAAuC,CACrD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,GAC3F,0BAA0B,CAM5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GAC/D,0BAA0B,CAE5B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yCAAyC,CACvD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAClG,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,0BAA0B,CAS5B"}
+{"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AACtH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,OAAO,EAAE,oCAAoC,EAAE,MAAM,gEAAgE,CAAC;AAUtH,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,4BAA4B;IACtC,2BAA2B;IAC3B,YAAY,iBAAiB;IAC7B,6EAA6E;IAC7E,UAAU,eAAe;CAC1B;AACD,6DAA6D;AAE7D,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AActF,eAAO,MAAM,qBAAqB;;;;;;;iBAYhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB;;IAEnC;;;;;;;;;;;;OAYG;;IAEH,6DAA6D;;IAE7D,yFAAyF;;IAEzF;;;;;;;;;;;;;;;;;;;OAmBG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;;;;;;;;;;IAEH,yGAAyG;;kBA0FzG,CAAC;AACH,6DAA6D;AAC7D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,GAAG,IAAI,GAAG,SAAS,GACnF,4BAA4B,CAE9B;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBAwCrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAiBvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;QAlQnC;;;;;;;;;;;;WAYG;;QAEH,6DAA6D;;QAE7D,yFAAyF;;QAEzF;;;;;;;;;;;;;;;;;;;WAmBG;;QAEH;;;;;;;;;;;;;;;;WAgBG;;;;;;;;;;;QAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsRzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;YApVnC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkTzG,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,8GAA8G;AAC9G,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmB1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0J3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,mEAAmE;AAInE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;YAnpBhC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;YAEzF;;;;;;;;;;;;;;;;;;;eAmBG;;YAEH;;;;;;;;;;;;;;;;eAgBG;;;;;;;;;;;YAEH,yGAAyG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0lBxB,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwFtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE;AAED;;;GAGG;AACH,oBAAY,sCAAsC;IAChD,0HAA0H;IAC1H,sBAAsB,2BAA2B;IACjD,kHAAkH;IAClH,yBAAyB,8BAA8B;IACvD,mIAAmI;IACnI,4BAA4B,iCAAiC;CAC9D;AAED;;;;;;;;GAQG;AACH,oBAAY,iCAAiC;IAC3C,gEAAgE;IAChE,OAAO,YAAY;IACnB,6BAA6B;IAC7B,IAAI,SAAS;IACb,qFAAqF;IACrF,SAAS,cAAc;CACxB;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,OAAO,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,IAAI,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAW9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,wCAAwC,CACtD,iBAAiB,EACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GACpG,SAAS,EACb,2BAA2B,EAAE,SAAS,MAAM,EAAE,GAC7C,0BAA0B,CAU5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oCAAoC,CAClD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAC7H,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,CAGR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uCAAuC,CACrD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,GAC3F,0BAA0B,CAM5B;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GAC/D,0BAA0B,CAE5B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yCAAyC,CACvD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EAClG,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,0BAA0B,CAS5B"}