@wildo-ai/presets-components 1.0.1 → 1.1.0

package/dist/esm/config/resources/resource.config.utils.d.ts

@@ -1,11 +1,44 @@
 /**
  * Shared helpers for resource frontend configuration.
- * Used by domain-oriented preset files (`addressable` / `notAddressable` for `views` entries).
+ * Used by domain-oriented preset files (`addressable` / `notAddressable` /
+ * `apiOnly` for `views` entries).
  *
  * Prefer importing these from here rather than duplicating per app; layout/template patterns
  * live in domain presets (see `billing.resource-presets.tsx` as reference).
  */
 import type { ResourceOperationFrontendConfig } from '@wildo-ai/saas-frontend-lib';
-export declare function notAddressable(overrides?: Partial<ResourceOperationFrontendConfig>): ResourceOperationFrontendConfig;
-export declare function addressable(overrides?: Partial<ResourceOperationFrontendConfig>): ResourceOperationFrontendConfig;
+/**
+ * Optional view fields an `addressable()` / `notAddressable()` operation may
+ * carry. Excludes `surface` — the factory owns it.
+ */
+type OperationViewOverrides = Partial<Omit<ResourceOperationFrontendConfig, 'surface'>>;
+/**
+ * Declare an operation's frontend surface as **ADDRESSABLE** — a URL-routable
+ * view (a deep-linkable page that lives in the navigation area; row-click
+ * resolves a route). Has an action button. Accepts the optional view fields
+ * (`actionVisibility`, `iconOverride`, layout override, …).
+ */
+export declare function addressable(overrides?: OperationViewOverrides): ResourceOperationFrontendConfig;
+/**
+ * Declare an operation's frontend surface as **EMBEDDED** — a non-addressable
+ * view (no URL) rendered within a host: an overlay/drill-in when invoked standalone,
+ * or inline when embedded in a composite view or a nested relationship view. Has an
+ * action button. Accepts the optional view fields. (Replaces `isAddressable: false`.)
+ */
+export declare function notAddressable(overrides?: OperationViewOverrides): ResourceOperationFrontendConfig;
+/**
+ * Declare an operation as **API_ONLY** — headless: callable from frontend code
+ * as a typed API, with NO rendered interface at all (no page, no embedded view, no
+ * action button). Use for operations driven by the system, a workflow, or signup
+ * rather than a user form (e.g. auto-created profiles/preferences, engine-authored
+ * state, system-managed versions/metadata).
+ *
+ * Takes NO view overrides by design — a headless operation has no view fields to
+ * set, and the registry build fails closed if an `API_ONLY` config carries any.
+ * To make an operation headless-by-default across every app, set its
+ * `defaultFrontendPosture: ResourceOperationFrontendSurface.API_ONLY` on the
+ * resource operation config instead of authoring `apiOnly()` per app.
+ */
+export declare function apiOnly(): ResourceOperationFrontendConfig;
+export {};
 //# sourceMappingURL=resource.config.utils.d.ts.map

package/dist/esm/config/resources/resource.config.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.config.utils.d.ts","sourceRoot":"","sources":["../../../../src/config/resources/resource.config.utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAEnF,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,+BAA+B,CAAC,GAAG,+BAA+B,CAEpH;AAED,wBAAgB,WAAW,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,+BAA+B,CAAC,GAAG,+BAA+B,CAEjH"}
+{"version":3,"file":"resource.config.utils.d.ts","sourceRoot":"","sources":["../../../../../src/config/resources/resource.config.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAGnF;;;GAGG;AACH,KAAK,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC,CAAC;AAExF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,CAAC,EAAE,sBAAsB,GAAG,+BAA+B,CAE/F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,sBAAsB,GAAG,+BAA+B,CAElG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,+BAA+B,CAEzD"}

package/dist/esm/config/resources/resource.config.utils.js

@@ -1,14 +1,44 @@
 /**
  * Shared helpers for resource frontend configuration.
- * Used by domain-oriented preset files (`addressable` / `notAddressable` for `views` entries).
+ * Used by domain-oriented preset files (`addressable` / `notAddressable` /
+ * `apiOnly` for `views` entries).
  *
  * Prefer importing these from here rather than duplicating per app; layout/template patterns
  * live in domain presets (see `billing.resource-presets.tsx` as reference).
  */
+import { ResourceOperationFrontendSurface } from '@wildo-ai/saas-models';
+/**
+ * Declare an operation's frontend surface as **ADDRESSABLE** — a URL-routable
+ * view (a deep-linkable page that lives in the navigation area; row-click
+ * resolves a route). Has an action button. Accepts the optional view fields
+ * (`actionVisibility`, `iconOverride`, layout override, …).
+ */
+export function addressable(overrides) {
+    return { surface: ResourceOperationFrontendSurface.ADDRESSABLE, ...overrides };
+}
+/**
+ * Declare an operation's frontend surface as **EMBEDDED** — a non-addressable
+ * view (no URL) rendered within a host: an overlay/drill-in when invoked standalone,
+ * or inline when embedded in a composite view or a nested relationship view. Has an
+ * action button. Accepts the optional view fields. (Replaces `isAddressable: false`.)
+ */
 export function notAddressable(overrides) {
-    return { isAddressable: false, ...overrides };
+    return { surface: ResourceOperationFrontendSurface.EMBEDDED, ...overrides };
 }
-export function addressable(overrides) {
-    return { isAddressable: true, ...overrides };
+/**
+ * Declare an operation as **API_ONLY** — headless: callable from frontend code
+ * as a typed API, with NO rendered interface at all (no page, no embedded view, no
+ * action button). Use for operations driven by the system, a workflow, or signup
+ * rather than a user form (e.g. auto-created profiles/preferences, engine-authored
+ * state, system-managed versions/metadata).
+ *
+ * Takes NO view overrides by design — a headless operation has no view fields to
+ * set, and the registry build fails closed if an `API_ONLY` config carries any.
+ * To make an operation headless-by-default across every app, set its
+ * `defaultFrontendPosture: ResourceOperationFrontendSurface.API_ONLY` on the
+ * resource operation config instead of authoring `apiOnly()` per app.
+ */
+export function apiOnly() {
+    return { surface: ResourceOperationFrontendSurface.API_ONLY };
 }
-//# sourceMappingURL=resource.config.utils.js.map
+//# sourceMappingURL=resource.config.utils.js.map

package/dist/esm/config/resources/resource.config.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource.config.utils.js","sourceRoot":"","sources":["../../../../src/config/resources/resource.config.utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,UAAU,cAAc,CAAC,SAAoD;IACjF,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAoD;IAC9E,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"resource.config.utils.js","sourceRoot":"","sources":["../../../../../src/config/resources/resource.config.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAQzE;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,SAAkC;IAC5D,OAAO,EAAE,OAAO,EAAE,gCAAgC,CAAC,WAAW,EAAE,GAAG,SAAS,EAAE,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAkC;IAC/D,OAAO,EAAE,OAAO,EAAE,gCAAgC,CAAC,QAAQ,EAAE,GAAG,SAAS,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,OAAO;IACrB,OAAO,EAAE,OAAO,EAAE,gCAAgC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC","sourcesContent":["/**\n * Shared helpers for resource frontend configuration.\n * Used by domain-oriented preset files (`addressable` / `notAddressable` /\n * `apiOnly` for `views` entries).\n *\n * Prefer importing these from here rather than duplicating per app; layout/template patterns\n * live in domain presets (see `billing.resource-presets.tsx` as reference).\n */\n\nimport type { ResourceOperationFrontendConfig } from '@wildo-ai/saas-frontend-lib';\nimport { ResourceOperationFrontendSurface } from '@wildo-ai/saas-models';\n\n/**\n * Optional view fields an `addressable()` / `notAddressable()` operation may\n * carry. Excludes `surface` — the factory owns it.\n */\ntype OperationViewOverrides = Partial<Omit<ResourceOperationFrontendConfig, 'surface'>>;\n\n/**\n * Declare an operation's frontend surface as **ADDRESSABLE** — a URL-routable\n * view (a deep-linkable page that lives in the navigation area; row-click\n * resolves a route). Has an action button. Accepts the optional view fields\n * (`actionVisibility`, `iconOverride`, layout override, …).\n */\nexport function addressable(overrides?: OperationViewOverrides): ResourceOperationFrontendConfig {\n  return { surface: ResourceOperationFrontendSurface.ADDRESSABLE, ...overrides };\n}\n\n/**\n * Declare an operation's frontend surface as **EMBEDDED** — a non-addressable\n * view (no URL) rendered within a host: an overlay/drill-in when invoked standalone,\n * or inline when embedded in a composite view or a nested relationship view. Has an\n * action button. Accepts the optional view fields. (Replaces `isAddressable: false`.)\n */\nexport function notAddressable(overrides?: OperationViewOverrides): ResourceOperationFrontendConfig {\n  return { surface: ResourceOperationFrontendSurface.EMBEDDED, ...overrides };\n}\n\n/**\n * Declare an operation as **API_ONLY** — headless: callable from frontend code\n * as a typed API, with NO rendered interface at all (no page, no embedded view, no\n * action button). Use for operations driven by the system, a workflow, or signup\n * rather than a user form (e.g. auto-created profiles/preferences, engine-authored\n * state, system-managed versions/metadata).\n *\n * Takes NO view overrides by design — a headless operation has no view fields to\n * set, and the registry build fails closed if an `API_ONLY` config carries any.\n * To make an operation headless-by-default across every app, set its\n * `defaultFrontendPosture: ResourceOperationFrontendSurface.API_ONLY` on the\n * resource operation config instead of authoring `apiOnly()` per app.\n */\nexport function apiOnly(): ResourceOperationFrontendConfig {\n  return { surface: ResourceOperationFrontendSurface.API_ONLY };\n}\n"]}

package/dist/esm/config/resources/security.resource-presets.d.ts

@@ -1,7 +1,7 @@
 /**
  * Security & Compliance — Resource frontend presets
  *
- * Domain: ORG_API_KEYS, AUDIT_LOGS, SIEM (polymorphic), AUTH_POLICY (poly),
+ * Domain: ORG_API_KEYS, AUDIT_LOGS, SIEM (polymorphic),
  * SSO_CONFIG (poly), SSO_CONNECTIONS (poly), SCIM_PROVISIONING (poly), SCIM_TOKENS (poly)
  *
  * SIEM layout JSX lives in this file next to `layout.refs` + `fields` so section chrome
@@ -15,4 +15,9 @@
 import type { ResourceUIBehavior } from '@wildo-ai/saas-frontend-lib';
 export declare function buildSecurityMainPresets(): Partial<ResourceUIBehavior>;
 export declare function buildSecurityAdminPresets(main: Partial<ResourceUIBehavior>): Partial<ResourceUIBehavior>;
+export declare const securityMainPresets: Partial<ResourceUIBehavior>;
+export declare const securityAdminPresets: Partial<ResourceUIBehavior>;
+export declare const orgApiKeysMainResourceUIBehavior: import("@wildo-ai/saas-frontend-lib").ResourceUIBehaviorConfig<any, any, import("zod").ZodAny>;
+export declare const orgApiKeysAdminResourceUIBehavior: import("@wildo-ai/saas-frontend-lib").ResourceUIBehaviorConfig<any, any, import("zod").ZodAny>;
+export declare const auditLogsMainResourceUIBehavior: import("@wildo-ai/saas-frontend-lib").ResourceUIBehaviorConfig<any, any, import("zod").ZodAny>;
 //# sourceMappingURL=security.resource-presets.d.ts.map

package/dist/esm/config/resources/security.resource-presets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.resource-presets.d.ts","sourceRoot":"","sources":["../../../../src/config/resources/security.resource-presets.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAgftE,wBAAgB,wBAAwB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CA2XtE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA2NxG"}
+{"version":3,"file":"security.resource-presets.d.ts","sourceRoot":"","sources":["../../../../../src/config/resources/security.resource-presets.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AA8dtE,wBAAgB,wBAAwB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAwXtE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4MxG;AAED,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,6BAAiD,CAAC;AAEnF,eAAO,MAAM,gCAAgC,gGAAuC,CAAC;AACrF,eAAO,MAAM,iCAAiC,gGAAwC,CAAC;AACvF,eAAO,MAAM,+BAA+B,gGAAqC,CAAC"}

package/dist/esm/config/resources/security.resource-presets.js

@@ -1,8 +1,9 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { resourceUIBehavior, resourceUIBehaviorFrom, polymorphicResourceUIBehavior, polymorphicResourceUIBehaviorFrom, StandardIconReference, DisplayField, DisplayLayout, FormField, FormLayout, ObjectScope, Section, SummaryLayout, useFormTemplateContext, useDisplayTemplateContext, ResourceLayoutPreset_Create_SamlWizard, ResourceLayoutPreset_Read_SsoSaml, } from '@wildo-ai/saas-frontend-lib';
-import { BadgeSemanticVariant, BooleanDisplayMode, BooleanEditMode, BooleanLabellingValue, SectionMode, EditChromeMode, EnumDisplayMode, ShowWhenOperator, StringDisplayMode, } from '@wildo-ai/zod-decorators';
-import { Key, ShieldCheck, ShieldAlert, Fingerprint, UserCog, KeyRound, Radio, AlertTriangle, } from 'lucide-react';
-import { CoreResourceType as R, CoreResourceOperation as Op, ApiKeyStatus, OrgApiKeys_Operations, AuditLogs_Operations, SiemExportConfig_Operations, SiemDeliveryDlq_Operations, SsoConfig_Operations, SsoConnection_Operations, ScimProvisioningConfig_Operations, ScimTokens_Operations, orgApiKeysResourceConfiguration_InitializationFactory as orgApiKeysFactory, auditLogsResourceConfiguration_InitializationFactory as auditLogsFactory, siemExportConfigPolymorphicFactories, siemDeliveryDlqPolymorphicFactories, authPolicyPolymorphicFactories, ssoConfigPolymorphicFactories, ssoConnectionPolymorphicFactories, scimProvisioningConfigPolymorphicFactories, scimTokensPolymorphicFactories, ApiKeyOrganizationSchema, AuditableEvent_BaseSchema, AuthPolicyBaseSchema, SiemExportConfigBaseSchema, SiemDeliveryDlqBaseSchema, SiemDeliveryDlqStatus, SsoConfigBaseSchema, SsoConnectionBaseSchema, ScimProvisioningConfigBaseSchema, ScimTokenBaseSchema, SSOProtocol, SIEMAuthMethod, } from '@wildo-ai/saas-models';
+import { resourceUIBehavior, resourceUIBehaviorFrom, polymorphicResourceUIBehavior, polymorphicResourceUIBehaviorFrom, StandardIconReference, ResourceOperationActionScope, } from '@wildo-ai/saas-frontend-lib';
+import { DisplayField, DisplayLayout, FormField, FormLayout, ObjectScope, Section, SummaryLayout, useFormTemplateContext, useDisplayTemplateContext, ResourceLayoutPreset_Create_SamlWizard, ResourceLayoutPreset_Read_SsoSaml, } from '@wildo-ai/saas-frontend-lib';
+import { BadgeSemanticVariant, BooleanDisplayMode, BooleanEditMode, BooleanLabellingValue, SectionMode, DisplayChromeMode, EditChromeMode, EnumDisplayMode, ShowWhenOperator, StringDisplayMode, } from '@wildo-ai/zod-decorators';
+import { Key, ShieldCheck, Fingerprint, UserCog, KeyRound, Radio, AlertTriangle, RotateCw, RefreshCw, PowerOff, Power, CalendarPlus, ChartColumn, Download, Trash2, PlugZap, Search, ShieldX, } from 'lucide-react';
+import { CoreResourceType as R, CoreResourceOperation as Op, ApiKeyStatus, OrgApiKeys_Operations, AuditLogs_Operations, SiemDeliveryDlq_Operations, SsoConnection_Operations, ScimTokens_Operations, orgApiKeysResourceConfiguration_InitializationFactory as orgApiKeysFactory, auditLogsResourceConfiguration_InitializationFactory as auditLogsFactory, siemExportConfigPolymorphicFactories, siemDeliveryDlqPolymorphicFactories, ssoConfigPolymorphicFactories, ssoConnectionPolymorphicFactories, scimProvisioningConfigPolymorphicFactories, scimTokensPolymorphicFactories, ApiKeyOrganizationSchema, AuditableEvent_BaseSchema, SiemExportConfigBaseSchema, SiemDeliveryDlqBaseSchema, SiemDeliveryDlqStatus, SsoConfigBaseSchema, SsoConnectionBaseSchema, ScimProvisioningConfigBaseSchema, ScimTokenBaseSchema, SsoProtocol, SIEMAuthMethod, } from '@wildo-ai/saas-models';
 import { addressable, notAddressable } from './resource.config.utils.js';
 // ── SIEM export config — field overrides (shared across polymorphic variants) ─
 const siemExportFieldOverrides = {
@@ -64,12 +65,6 @@ function SiemDlqDisplayTemplate() {
 function SiemDlqSummaryTemplate() {
     return (_jsxs(SummaryLayout, { className: "flex flex-col gap-2 text-sm", children: [_jsx("div", { className: "font-medium leading-tight", children: _jsx(DisplayField, { name: "failureReason", hideLabel: true }) }), _jsx("div", { className: "flex flex-wrap items-center gap-x-3 gap-y-1", children: _jsx(DisplayField, { name: "status" }) })] }));
 }
-function AuthPolicyDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsx(Section, { name: "requirements", appearance: SectionMode.CARD, children: _jsxs(ObjectScope, { name: "requirements", children: [_jsx(DisplayField, { name: "minimumAuthLevel" }), _jsx(DisplayField, { name: "passwordlessAllowed" }), _jsx(DisplayField, { name: "passkeyEnabled" }), _jsx(DisplayField, { name: "passkeyRequiredForAdmins" }), _jsx(DisplayField, { name: "passkeyExemptFromMFA" })] }) }), _jsxs(Section, { name: "lifecycle", children: [_jsx(DisplayField, { name: "createdAt" }), _jsx(DisplayField, { name: "updatedAt" })] })] }));
-}
-function AuthPolicySummaryTemplate() {
-    return (_jsx(SummaryLayout, { className: "flex flex-wrap items-center gap-x-3 gap-y-1 text-sm", children: _jsx(ObjectScope, { name: "requirements", children: _jsx(DisplayField, { name: "minimumAuthLevel" }) }) }));
-}
 function SsoConfigDisplayTemplate() {
     return (_jsxs(DisplayLayout, { children: [_jsx(Section, { name: "enforcement", appearance: SectionMode.CARD, children: _jsxs(ObjectScope, { name: "enforcement", children: [_jsx(DisplayField, { name: "requireSSO" }), _jsx(DisplayField, { name: "allowPasswordFallback" }), _jsx(DisplayField, { name: "enforceForAdmins" }), _jsx(DisplayField, { name: "graceLoginAttempts" })] }) }), _jsx(Section, { name: "domains", children: _jsxs(ObjectScope, { name: "domains", children: [_jsx(DisplayField, { name: "verifiedDomains" }), _jsx(DisplayField, { name: "ssoEnabledDomains" }), _jsx(DisplayField, { name: "domainHinting" }), _jsx(DisplayField, { name: "allowExternalDomains" }), _jsx(DisplayField, { name: "domainVerificationStatus" })] }) }), _jsx(Section, { name: "provisioning", children: _jsxs(ObjectScope, { name: "provisioning", children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoUpdateUsers" }), _jsx(DisplayField, { name: "autoDeactivateUsers" }), _jsx(DisplayField, { name: "defaultRole" }), _jsx(DisplayField, { name: "requiredAttributes" }), _jsx(DisplayField, { name: "syncFrequencyHours" })] }) }), _jsx(Section, { name: "session", children: _jsxs(ObjectScope, { name: "sessionSettings", children: [_jsx(DisplayField, { name: "ssoSessionDurationMinutes" }), _jsx(DisplayField, { name: "requireReauthForSensitive" }), _jsx(DisplayField, { name: "singleLogoutEnabled" }), _jsx(DisplayField, { name: "maxConcurrentSessions" })] }) }), _jsx(Section, { name: "audit", children: _jsxs(ObjectScope, { name: "auditConfig", children: [_jsx(DisplayField, { name: "logAllSSOEvents" }), _jsx(DisplayField, { name: "logProviderSwitching" }), _jsx(DisplayField, { name: "logRoleMapping" }), _jsx(DisplayField, { name: "complianceReporting" }), _jsx(DisplayField, { name: "retentionDays" })] }) }), _jsx(Section, { name: "emergency", children: _jsxs(ObjectScope, { name: "emergencyAccess", children: [_jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "breakGlassAccounts" }), _jsx(DisplayField, { name: "requireApproval" }), _jsx(DisplayField, { name: "maxDurationHours" }), _jsx(DisplayField, { name: "auditLevel" })] }) }), _jsxs(Section, { name: "oauth", children: [_jsxs(ObjectScope, { name: "oauth2ProviderRestrictions", children: [_jsx(DisplayField, { name: "allowedProviders" }), _jsx(DisplayField, { name: "blockedProviders" }), _jsx(DisplayField, { name: "requireEnterpriseSSOOnly" })] }), _jsx(DisplayField, { name: "socialCredentialOverrides" })] })] }));
 }
@@ -83,10 +78,10 @@ function SsoConnectionSummaryTemplate() {
     return (_jsxs(SummaryLayout, { className: "flex flex-col gap-2 text-sm", children: [_jsx("div", { className: "font-medium leading-tight", children: _jsx(DisplayField, { name: "displayName", hideLabel: true }) }), _jsxs("div", { className: "flex flex-wrap items-center gap-x-3 gap-y-1", children: [_jsx(DisplayField, { name: "protocol" }), _jsx(DisplayField, { name: "enabled" })] })] }));
 }
 function ScimProvisioningDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "scimEnabled" }), _jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoVerifyEmail" }), _jsx(DisplayField, { name: "autoDeactivateUsers" }), _jsx(DisplayField, { name: "defaultRole" })] }), _jsx(Section, { name: "mapping", children: _jsx(DisplayField, { name: "attributeMapping" }) }), _jsxs(Section, { name: "lifecycle", children: [_jsx(DisplayField, { name: "createdAt" }), _jsx(DisplayField, { name: "updatedAt" })] })] }));
+    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoVerifyEmail" }), _jsx(DisplayField, { name: "autoDeactivateUsers" }), _jsx(DisplayField, { name: "defaultRole" })] }), _jsx(Section, { name: "mapping", children: _jsx(DisplayField, { name: "attributeMapping" }) }), _jsxs(Section, { name: "lifecycle", children: [_jsx(DisplayField, { name: "createdAt" }), _jsx(DisplayField, { name: "updatedAt" })] })] }));
 }
 function ScimProvisioningSummaryTemplate() {
-    return (_jsx(SummaryLayout, { className: "flex flex-wrap items-center gap-x-3 gap-y-1 text-sm", children: _jsx(DisplayField, { name: "scimEnabled" }) }));
+    return (_jsx(SummaryLayout, { className: "flex flex-wrap items-center gap-x-3 gap-y-1 text-sm", children: _jsx(DisplayField, { name: "autoCreateUsers" }) }));
 }
 function ScimTokenDisplayTemplate() {
     return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "displayName" }), _jsx(DisplayField, { name: "isActive" }), _jsx(DisplayField, { name: "createdByUserId" })] }), _jsxs(Section, { name: "lifecycle", children: [_jsx(DisplayField, { name: "lastUsedAt" }), _jsx(DisplayField, { name: "expiresAt" }), _jsx(DisplayField, { name: "createdAt" })] })] }));
@@ -102,6 +97,8 @@ export function buildSecurityMainPresets() {
                 refs: {
                     sections: ['overview', 'access', 'lifecycle'],
                 },
+                // Settings-page chrome (Settings Hub → API keys): label-left / value-right rows.
+                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.INLINE, edit: EditChromeMode.SETTINGS_ROW },
                 display: OrgApiKeyDisplayTemplate,
                 summary: OrgApiKeySummaryTemplate,
                 edit: OrgApiKeyEditTemplate,
@@ -118,18 +115,27 @@ export function buildSecurityMainPresets() {
                 }),
             },
             getFrontendResourceLabel: ({ currentObject }) => currentObject.name,
+            // The empty state's primary action is Create — surfaced because CREATE
+            // declares a (non-addressable, overlay) view below. Creating a key returns
+            // its one-time `plainKey` (`.isEphemeral()` on the CREATE response DTO) →
+            // the ephemeral reveal dialog shows the secret exactly once.
+            emptyState: { primaryAction: Op.CREATE },
             views: [
                 [Op.READ, notAddressable()],
                 [Op.LIST, addressable()],
+                // CREATE has a view but is NOT URL-addressable — surface EMBEDDED; the create
+                // form opens as a drill-in within the Settings Hub panel, not a routed page.
+                // Its Create button still shows: action visibility is governed by the op
+                // having a surface + `actionVisibility`, NOT by addressability.
                 [Op.CREATE, notAddressable()],
                 [Op.SEARCH, notAddressable()],
                 [Op.DELETE, notAddressable()],
-                [OrgApiKeys_Operations.ROTATE, notAddressable()],
-                [OrgApiKeys_Operations.REGENERATE, notAddressable()],
-                [OrgApiKeys_Operations.DEACTIVATE, notAddressable()],
-                [OrgApiKeys_Operations.REACTIVATE, notAddressable()],
-                [OrgApiKeys_Operations.EXTEND_EXPIRY, notAddressable()],
-                [OrgApiKeys_Operations.USAGE_STATS, notAddressable()],
+                [OrgApiKeys_Operations.ROTATE, notAddressable({ iconOverride: RotateCw })],
+                [OrgApiKeys_Operations.REGENERATE, notAddressable({ iconOverride: RefreshCw })],
+                [OrgApiKeys_Operations.DEACTIVATE, notAddressable({ iconOverride: PowerOff })],
+                [OrgApiKeys_Operations.REACTIVATE, notAddressable({ iconOverride: Power })],
+                [OrgApiKeys_Operations.EXTEND_EXPIRY, notAddressable({ iconOverride: CalendarPlus })],
+                [OrgApiKeys_Operations.USAGE_STATS, notAddressable({ iconOverride: ChartColumn })],
             ],
         })),
         [R.AUDIT_LOGS]: resourceUIBehavior(auditLogsFactory, AuditableEvent_BaseSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
@@ -144,9 +150,18 @@ export function buildSecurityMainPresets() {
             },
             views: [
                 [Op.READ, notAddressable()],
-                [Op.LIST, addressable()],
+                // Audit-trail review dashboard: severity quick tabs (All/Info/Warning/…)
+                // + day-bucket grouping — the same generic collection capabilities as
+                // the webhook delivery log. `severity` is an enum in the LIST op's own
+                // `filterFields`; `createdAt` is a summary field.
+                [Op.LIST, addressable({
+                        collectionDisplayConfig: {
+                            quickFilterField: 'severity',
+                            temporalGroupField: 'createdAt',
+                        },
+                    })],
                 [Op.SEARCH, addressable()],
-                [AuditLogs_Operations.EXPORT_AUDIT_LOGS, notAddressable()],
+                [AuditLogs_Operations.EXPORT_AUDIT_LOGS, notAddressable({ iconOverride: Download })],
             ],
         })),
         ...polymorphicResourceUIBehavior({
@@ -185,8 +200,6 @@ export function buildSecurityMainPresets() {
             },
             views: [
                 [Op.READ, addressable()],
-                [SiemExportConfig_Operations.TEST_WEBHOOK, notAddressable()],
-                [SiemExportConfig_Operations.GET_DELIVERY_STATUS, notAddressable()],
             ],
             variantOverrides: {
                 [R.APPLICATION]: { views: [] },
@@ -220,31 +233,23 @@ export function buildSecurityMainPresets() {
             },
             getFrontendResourceLabel: ({ currentObject }) => currentObject.failureReason,
             views: [
-                [Op.LIST, addressable()],
-                [SiemDeliveryDlq_Operations.RETRY_SINGLE, notAddressable()],
-                [SiemDeliveryDlq_Operations.RETRY_ALL, notAddressable()],
-                [SiemDeliveryDlq_Operations.PURGE_ALL, notAddressable()],
-            ],
-            variantOverrides: {
-                [R.APPLICATION]: { views: [] },
-            },
-        })),
-        ...polymorphicResourceUIBehavior({
-            variants: [
-                { parentResourceType: R.ORGANIZATIONS, resourceType: R.ORGANIZATION_AUTH_POLICY },
-                { parentResourceType: R.APPLICATION, resourceType: R.APPLICATION_AUTH_POLICY },
-            ],
-        }, authPolicyPolymorphicFactories[R.ORGANIZATION_AUTH_POLICY], AuthPolicyBaseSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
-            icon: ShieldAlert,
-            layout: {
-                refs: {
-                    sections: ['requirements', 'lifecycle'],
-                },
-                display: AuthPolicyDisplayTemplate,
-                summary: AuthPolicySummaryTemplate,
-            },
-            views: [
-                [Op.READ, addressable()],
+                // Failed-deliveries triage dashboard: status quick tabs + day-bucket
+                // grouping (same generic capabilities as the webhook delivery log).
+                [Op.LIST, addressable({
+                        collectionDisplayConfig: {
+                            quickFilterField: 'status',
+                            temporalGroupField: 'createdAt',
+                        },
+                    })],
+                // Per-row retry: executes in place on the clicked row. Its backend reads
+                // the target from the request-DTO `entryId` (not the URL id), so the row
+                // id is injected into that body field via `rowTargetRequestField`.
+                [SiemDeliveryDlq_Operations.RETRY_SINGLE, notAddressable({ iconOverride: RotateCw, rowTargetRequestField: 'entryId' })],
+                // Whole-scope drain actions: rendered once in the list's collection-action
+                // bar (not per row), confirm by risk (HIGH → confirm, CRITICAL → type-to-
+                // confirm), and surface their `{ …count, message }` summary as a toast.
+                [SiemDeliveryDlq_Operations.RETRY_ALL, notAddressable({ iconOverride: RefreshCw, actionScope: ResourceOperationActionScope.COLLECTION })],
+                [SiemDeliveryDlq_Operations.PURGE_ALL, notAddressable({ iconOverride: Trash2, actionScope: ResourceOperationActionScope.COLLECTION })],
             ],
             variantOverrides: {
                 [R.APPLICATION]: { views: [] },
@@ -266,9 +271,6 @@ export function buildSecurityMainPresets() {
             },
             views: [
                 [Op.READ, addressable()],
-                [SsoConfig_Operations.ADD_DOMAIN, notAddressable()],
-                [SsoConfig_Operations.VERIFY_DOMAIN, notAddressable()],
-                [SsoConfig_Operations.REMOVE_DOMAIN, notAddressable()],
             ],
             variantOverrides: {
                 [R.APPLICATION]: { views: [] },
@@ -293,8 +295,8 @@ export function buildSecurityMainPresets() {
                     display: { displayMode: EnumDisplayMode.BADGE, showDescription: true },
                     edit: { showDescription: true },
                     values: {
-                        [SSOProtocol.OIDC]: { color: BadgeSemanticVariant.INFO },
-                        [SSOProtocol.SAML]: { color: BadgeSemanticVariant.SECONDARY },
+                        [SsoProtocol.OIDC]: { color: BadgeSemanticVariant.INFO },
+                        [SsoProtocol.SAML]: { color: BadgeSemanticVariant.SECONDARY },
                     },
                 }),
             },
@@ -302,9 +304,11 @@ export function buildSecurityMainPresets() {
             views: [
                 [Op.LIST, addressable()],
                 [SsoConnection_Operations.TEST_CONNECTION, addressable({
+                        iconOverride: PlugZap,
                         customView: ResourceLayoutPreset_Read_SsoSaml,
                     })],
                 [SsoConnection_Operations.DISCOVER_ENDPOINTS, addressable({
+                        iconOverride: Search,
                         customView: ResourceLayoutPreset_Create_SamlWizard,
                     })],
             ],
@@ -328,8 +332,6 @@ export function buildSecurityMainPresets() {
             },
             views: [
                 [Op.READ, addressable()],
-                [ScimProvisioningConfig_Operations.TEST_SCIM_CONNECTION, notAddressable()],
-                [ScimProvisioningConfig_Operations.GET_PROVISIONING_STATS, notAddressable()],
             ],
             variantOverrides: {
                 [R.APPLICATION]: { views: [] },
@@ -338,7 +340,6 @@ export function buildSecurityMainPresets() {
         ...polymorphicResourceUIBehavior({
             variants: [
                 { parentResourceType: R.ORGANIZATIONS, resourceType: R.ORGANIZATION_SCIM_TOKENS },
-                { parentResourceType: R.APPLICATION, resourceType: R.APPLICATION_SCIM_TOKENS },
             ],
         }, scimTokensPolymorphicFactories[R.ORGANIZATION_SCIM_TOKENS], ScimTokenBaseSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
             icon: KeyRound,
@@ -352,13 +353,10 @@ export function buildSecurityMainPresets() {
             },
             views: [
                 [Op.LIST, addressable()],
-                [ScimTokens_Operations.GENERATE_TOKEN, notAddressable()],
-                [ScimTokens_Operations.REVOKE_TOKEN, notAddressable()],
-                [ScimTokens_Operations.ROTATE_TOKEN, notAddressable()],
+                [ScimTokens_Operations.GENERATE_TOKEN, notAddressable({ iconOverride: KeyRound })],
+                [ScimTokens_Operations.REVOKE_TOKEN, notAddressable({ iconOverride: ShieldX })],
+                [ScimTokens_Operations.ROTATE_TOKEN, notAddressable({ iconOverride: RotateCw })],
             ],
-            variantOverrides: {
-                [R.APPLICATION]: { views: [] },
-            },
         })),
     };
 }
@@ -375,8 +373,6 @@ export function buildSecurityAdminPresets(main) {
             fields: base.fields,
             views: [
                 [Op.READ, addressable()],
-                [SiemExportConfig_Operations.TEST_WEBHOOK, notAddressable()],
-                [SiemExportConfig_Operations.GET_DELIVERY_STATUS, notAddressable()],
             ],
             variantOverrides: {
                 [R.ORGANIZATIONS]: {
@@ -395,35 +391,32 @@ export function buildSecurityAdminPresets(main) {
             fields: base.fields,
             getFrontendResourceLabel: base.getFrontendResourceLabel,
             views: [
-                [Op.LIST, addressable()],
-                [SiemDeliveryDlq_Operations.RETRY_SINGLE, notAddressable()],
-                [SiemDeliveryDlq_Operations.RETRY_ALL, notAddressable()],
-                [SiemDeliveryDlq_Operations.PURGE_ALL, notAddressable()],
-            ],
-            variantOverrides: {
-                [R.ORGANIZATIONS]: {
-                    views: [
-                        [Op.READ, notAddressable()],
-                        [Op.LIST, notAddressable()],
-                    ],
-                },
-            },
-        })),
-        ...polymorphicResourceUIBehaviorFrom({
-            variants: [
-                { parentResourceType: R.ORGANIZATIONS, resourceType: R.ORGANIZATION_AUTH_POLICY },
-                { parentResourceType: R.APPLICATION, resourceType: R.APPLICATION_AUTH_POLICY },
-            ],
-        }, authPolicyPolymorphicFactories[R.ORGANIZATION_AUTH_POLICY], main, ({ base }) => ({
-            icon: base.icon,
-            layout: base.layout,
-            views: [
-                [Op.READ, addressable()],
+                [Op.LIST, addressable({
+                        collectionDisplayConfig: {
+                            quickFilterField: 'status',
+                            temporalGroupField: 'createdAt',
+                        },
+                    })],
+                // Per-row retry: executes in place on the clicked row. Its backend reads
+                // the target from the request-DTO `entryId` (not the URL id), so the row
+                // id is injected into that body field via `rowTargetRequestField`.
+                [SiemDeliveryDlq_Operations.RETRY_SINGLE, notAddressable({ iconOverride: RotateCw, rowTargetRequestField: 'entryId' })],
+                // Whole-scope drain actions: rendered once in the list's collection-action
+                // bar (not per row), confirm by risk (HIGH → confirm, CRITICAL → type-to-
+                // confirm), and surface their `{ …count, message }` summary as a toast.
+                [SiemDeliveryDlq_Operations.RETRY_ALL, notAddressable({ iconOverride: RefreshCw, actionScope: ResourceOperationActionScope.COLLECTION })],
+                [SiemDeliveryDlq_Operations.PURGE_ALL, notAddressable({ iconOverride: Trash2, actionScope: ResourceOperationActionScope.COLLECTION })],
             ],
             variantOverrides: {
                 [R.ORGANIZATIONS]: {
                     views: [
                         [Op.READ, notAddressable()],
+                        [Op.LIST, notAddressable({
+                                collectionDisplayConfig: {
+                                    quickFilterField: 'status',
+                                    temporalGroupField: 'createdAt',
+                                },
+                            })],
                     ],
                 },
             },
@@ -438,9 +431,6 @@ export function buildSecurityAdminPresets(main) {
             layout: base.layout,
             views: [
                 [Op.READ, addressable()],
-                [SsoConfig_Operations.ADD_DOMAIN, notAddressable()],
-                [SsoConfig_Operations.VERIFY_DOMAIN, notAddressable()],
-                [SsoConfig_Operations.REMOVE_DOMAIN, notAddressable()],
             ],
             variantOverrides: {
                 [R.ORGANIZATIONS]: {
@@ -461,9 +451,11 @@ export function buildSecurityAdminPresets(main) {
             views: [
                 [Op.LIST, addressable()],
                 [SsoConnection_Operations.TEST_CONNECTION, addressable({
+                        iconOverride: PlugZap,
                         customView: ResourceLayoutPreset_Read_SsoSaml,
                     })],
                 [SsoConnection_Operations.DISCOVER_ENDPOINTS, addressable({
+                        iconOverride: Search,
                         customView: ResourceLayoutPreset_Create_SamlWizard,
                     })],
             ],
@@ -486,8 +478,6 @@ export function buildSecurityAdminPresets(main) {
             layout: base.layout,
             views: [
                 [Op.READ, addressable()],
-                [ScimProvisioningConfig_Operations.TEST_SCIM_CONNECTION, notAddressable()],
-                [ScimProvisioningConfig_Operations.GET_PROVISIONING_STATS, notAddressable()],
             ],
             variantOverrides: {
                 [R.ORGANIZATIONS]: {
@@ -498,7 +488,6 @@ export function buildSecurityAdminPresets(main) {
         ...polymorphicResourceUIBehaviorFrom({
             variants: [
                 { parentResourceType: R.ORGANIZATIONS, resourceType: R.ORGANIZATION_SCIM_TOKENS },
-                { parentResourceType: R.APPLICATION, resourceType: R.APPLICATION_SCIM_TOKENS },
             ],
         }, scimTokensPolymorphicFactories[R.ORGANIZATION_SCIM_TOKENS], main, ({ base }) => ({
             icon: base.icon,
@@ -506,9 +495,9 @@ export function buildSecurityAdminPresets(main) {
             getFrontendResourceLabel: base.getFrontendResourceLabel,
             views: [
                 [Op.LIST, addressable()],
-                [ScimTokens_Operations.GENERATE_TOKEN, notAddressable()],
-                [ScimTokens_Operations.REVOKE_TOKEN, notAddressable()],
-                [ScimTokens_Operations.ROTATE_TOKEN, notAddressable()],
+                [ScimTokens_Operations.GENERATE_TOKEN, notAddressable({ iconOverride: KeyRound })],
+                [ScimTokens_Operations.REVOKE_TOKEN, notAddressable({ iconOverride: ShieldX })],
+                [ScimTokens_Operations.ROTATE_TOKEN, notAddressable({ iconOverride: RotateCw })],
             ],
             variantOverrides: {
                 [R.ORGANIZATIONS]: {
@@ -540,4 +529,9 @@ export function buildSecurityAdminPresets(main) {
         })),
     };
 }
-//# sourceMappingURL=security.resource-presets.js.map
+export const securityMainPresets = buildSecurityMainPresets();
+export const securityAdminPresets = buildSecurityAdminPresets(securityMainPresets);
+export const orgApiKeysMainResourceUIBehavior = securityMainPresets[R.ORG_API_KEYS];
+export const orgApiKeysAdminResourceUIBehavior = securityAdminPresets[R.ORG_API_KEYS];
+export const auditLogsMainResourceUIBehavior = securityMainPresets[R.AUDIT_LOGS];
+//# sourceMappingURL=security.resource-presets.js.map