@wildo-ai/presets-components 1.1.2 → 1.1.3

package/dist/esm/config/resources/index.d.ts

@@ -17,6 +17,28 @@ import type { ResourceUIBehavior } from '@wildo-ai/saas-frontend-lib';
 export declare const RESOURCES_FRONTEND_MAIN_APP: ResourceUIBehavior;
 /** Complete resource frontend configuration for the admin application. */
 export declare const RESOURCES_FRONTEND_ADMIN_APP: ResourceUIBehavior;
-/** Complete resource frontend configuration for the platform layer (companion, internal tooling). */
+/**
+ * Complete resource frontend configuration for the platform layer (companion, internal tooling).
+ *
+ * ## There is deliberately no `jobExecutions` / `jobPayloadStorage` preset — decided 2026-09-08 (#469)
+ *
+ * One used to exist: a per-status colour map and per-field display modes for both resources. It
+ * rendered nowhere and never could — every operation on both is `REPOSITORY_ONLY`, so no route and
+ * no generated screen can reach them — and its existence made the absence of a job browser look
+ * like an oversight rather than a decision. It was deleted rather than wired.
+ *
+ * So an operator does NOT get "what happened to this job" from inside the product. That is the
+ * accepted cost. Where to look instead:
+ *
+ * - **A parked or dead-lettered job** is a BROKER-level concern; inspect and replay it with the
+ *   broker's own tooling. See the note on `QueueBackendService`.
+ * - **A worker that outran its shutdown grace period** is an ORCHESTRATOR-level concern; see the
+ *   note on `WorkerShutdownManagerBackendService`.
+ *
+ * If that ever bites, the option to revisit FIRST is the middle one that was not taken: queue depth
+ * in the health signal and a recorded event on a grace-period overrun, WITHOUT a job-execution read
+ * surface — it catches fleet-level problems without exposing job payloads, which may carry personal
+ * data. Restoring display behaviour is the last step, not the first.
+ */
 export declare const RESOURCES_FRONTEND_PLATFORM: ResourceUIBehavior;
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/config/resources/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/config/resources/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AActE,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,EAAE,kBAQzC,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,4BAA4B,EAAE,kBAQ1C,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,2BAA2B,EAAE,kBAGzC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/config/resources/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAatE,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,EAAE,kBAQzC,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,4BAA4B,EAAE,kBAQ1C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,2BAA2B,EAAE,kBAEzC,CAAC"}

package/dist/esm/config/resources/index.js

@@ -19,7 +19,6 @@ import { securityAdminPresets, securityMainPresets } from './security.resource-p
 import { billingAdminPresets, billingMainPresets } from './billing.resource-presets.js';
 import { webhooksAdminPresets, webhooksMainPresets } from './webhooks.resource-presets.js';
 import { guidanceAdminPresets, guidanceMainPresets, guidancePlatformPresets } from './guidance.resource-presets.js';
-import { infrastructurePlatformPresets } from './infrastructure.resource-presets.js';
 function mergePresets(...partials) {
     return Object.assign({}, ...partials);
 }
@@ -27,6 +26,28 @@ function mergePresets(...partials) {
 export const RESOURCES_FRONTEND_MAIN_APP = mergePresets(identityMainPresets, organizationsMainPresets, applicationMainPresets, securityMainPresets, billingMainPresets, webhooksMainPresets, guidanceMainPresets);
 /** Complete resource frontend configuration for the admin application. */
 export const RESOURCES_FRONTEND_ADMIN_APP = mergePresets(identityAdminPresets, organizationsAdminPresets, applicationAdminPresets, securityAdminPresets, billingAdminPresets, webhooksAdminPresets, guidanceAdminPresets);
-/** Complete resource frontend configuration for the platform layer (companion, internal tooling). */
-export const RESOURCES_FRONTEND_PLATFORM = mergePresets(guidancePlatformPresets, infrastructurePlatformPresets);
+/**
+ * Complete resource frontend configuration for the platform layer (companion, internal tooling).
+ *
+ * ## There is deliberately no `jobExecutions` / `jobPayloadStorage` preset — decided 2026-09-08 (#469)
+ *
+ * One used to exist: a per-status colour map and per-field display modes for both resources. It
+ * rendered nowhere and never could — every operation on both is `REPOSITORY_ONLY`, so no route and
+ * no generated screen can reach them — and its existence made the absence of a job browser look
+ * like an oversight rather than a decision. It was deleted rather than wired.
+ *
+ * So an operator does NOT get "what happened to this job" from inside the product. That is the
+ * accepted cost. Where to look instead:
+ *
+ * - **A parked or dead-lettered job** is a BROKER-level concern; inspect and replay it with the
+ *   broker's own tooling. See the note on `QueueBackendService`.
+ * - **A worker that outran its shutdown grace period** is an ORCHESTRATOR-level concern; see the
+ *   note on `WorkerShutdownManagerBackendService`.
+ *
+ * If that ever bites, the option to revisit FIRST is the middle one that was not taken: queue depth
+ * in the health signal and a recorded event on a grace-period overrun, WITHOUT a job-execution read
+ * surface — it catches fleet-level problems without exposing job payloads, which may carry personal
+ * data. Restoring display behaviour is the last step, not the first.
+ */
+export const RESOURCES_FRONTEND_PLATFORM = mergePresets(guidancePlatformPresets);
 //# sourceMappingURL=index.js.map

package/dist/esm/config/resources/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/config/resources/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACvG,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACjH,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAElF,SAAS,YAAY,CAAC,GAAG,QAAuC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAuB,CAAC;AAC9D,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,2BAA2B,GAAuB,YAAY,CACzE,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,CACpB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,4BAA4B,GAAuB,YAAY,CAC1E,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;AAEF,qGAAqG;AACrG,MAAM,CAAC,MAAM,2BAA2B,GAAuB,YAAY,CACzE,uBAAuB,EACvB,6BAA6B,CAC9B,CAAC","sourcesContent":["/**\n * Resource frontend presets — domain-oriented aggregation\n *\n * Three application scopes:\n * - **MAIN_APP** — end-user facing, role-filtered at runtime\n * - **ADMIN_APP** — app administrator / platform operator\n * - **PLATFORM** — Wildo platform layer (companion, internal tooling, CLI)\n *\n * Each domain file exports `buildXxxMainPresets`, `buildXxxAdminPresets`, and/or\n * `buildXxxPlatformPresets` depending on where its resources belong.\n *\n * **Canonical layout + template pattern:** `billing.resource-presets.tsx` (inline arrow\n * templates, `defaultChromeMode`, `useFormTemplateContext` / `useDisplayTemplateContext`).\n */\n\nimport type { ResourceUIBehavior } from '@wildo-ai/saas-frontend-lib';\nimport { identityAdminPresets, identityMainPresets } from './identity.resource-presets';\nimport { organizationsAdminPresets, organizationsMainPresets } from './organizations.resource-presets';\nimport { applicationAdminPresets, applicationMainPresets } from './application.resource-presets';\nimport { securityAdminPresets, securityMainPresets } from './security.resource-presets';\nimport { billingAdminPresets, billingMainPresets } from './billing.resource-presets';\nimport { webhooksAdminPresets, webhooksMainPresets } from './webhooks.resource-presets';\nimport { guidanceAdminPresets, guidanceMainPresets, guidancePlatformPresets } from './guidance.resource-presets';\nimport { infrastructurePlatformPresets } from './infrastructure.resource-presets';\n\nfunction mergePresets(...partials: Partial<ResourceUIBehavior>[]): ResourceUIBehavior {\n  return Object.assign({}, ...partials) as ResourceUIBehavior;\n}\n\n/** Complete resource frontend configuration for the main application. */\nexport const RESOURCES_FRONTEND_MAIN_APP: ResourceUIBehavior = mergePresets(\n  identityMainPresets,\n  organizationsMainPresets,\n  applicationMainPresets,\n  securityMainPresets,\n  billingMainPresets,\n  webhooksMainPresets,\n  guidanceMainPresets,\n);\n\n/** Complete resource frontend configuration for the admin application. */\nexport const RESOURCES_FRONTEND_ADMIN_APP: ResourceUIBehavior = mergePresets(\n  identityAdminPresets,\n  organizationsAdminPresets,\n  applicationAdminPresets,\n  securityAdminPresets,\n  billingAdminPresets,\n  webhooksAdminPresets,\n  guidanceAdminPresets,\n);\n\n/** Complete resource frontend configuration for the platform layer (companion, internal tooling). */\nexport const RESOURCES_FRONTEND_PLATFORM: ResourceUIBehavior = mergePresets(\n  guidancePlatformPresets,\n  infrastructurePlatformPresets,\n);\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/config/resources/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACvG,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEjH,SAAS,YAAY,CAAC,GAAG,QAAuC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAuB,CAAC;AAC9D,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,2BAA2B,GAAuB,YAAY,CACzE,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,CACpB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,4BAA4B,GAAuB,YAAY,CAC1E,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAuB,YAAY,CACzE,uBAAuB,CACxB,CAAC","sourcesContent":["/**\n * Resource frontend presets — domain-oriented aggregation\n *\n * Three application scopes:\n * - **MAIN_APP** — end-user facing, role-filtered at runtime\n * - **ADMIN_APP** — app administrator / platform operator\n * - **PLATFORM** — Wildo platform layer (companion, internal tooling, CLI)\n *\n * Each domain file exports `buildXxxMainPresets`, `buildXxxAdminPresets`, and/or\n * `buildXxxPlatformPresets` depending on where its resources belong.\n *\n * **Canonical layout + template pattern:** `billing.resource-presets.tsx` (inline arrow\n * templates, `defaultChromeMode`, `useFormTemplateContext` / `useDisplayTemplateContext`).\n */\n\nimport type { ResourceUIBehavior } from '@wildo-ai/saas-frontend-lib';\nimport { identityAdminPresets, identityMainPresets } from './identity.resource-presets';\nimport { organizationsAdminPresets, organizationsMainPresets } from './organizations.resource-presets';\nimport { applicationAdminPresets, applicationMainPresets } from './application.resource-presets';\nimport { securityAdminPresets, securityMainPresets } from './security.resource-presets';\nimport { billingAdminPresets, billingMainPresets } from './billing.resource-presets';\nimport { webhooksAdminPresets, webhooksMainPresets } from './webhooks.resource-presets';\nimport { guidanceAdminPresets, guidanceMainPresets, guidancePlatformPresets } from './guidance.resource-presets';\n\nfunction mergePresets(...partials: Partial<ResourceUIBehavior>[]): ResourceUIBehavior {\n  return Object.assign({}, ...partials) as ResourceUIBehavior;\n}\n\n/** Complete resource frontend configuration for the main application. */\nexport const RESOURCES_FRONTEND_MAIN_APP: ResourceUIBehavior = mergePresets(\n  identityMainPresets,\n  organizationsMainPresets,\n  applicationMainPresets,\n  securityMainPresets,\n  billingMainPresets,\n  webhooksMainPresets,\n  guidanceMainPresets,\n);\n\n/** Complete resource frontend configuration for the admin application. */\nexport const RESOURCES_FRONTEND_ADMIN_APP: ResourceUIBehavior = mergePresets(\n  identityAdminPresets,\n  organizationsAdminPresets,\n  applicationAdminPresets,\n  securityAdminPresets,\n  billingAdminPresets,\n  webhooksAdminPresets,\n  guidanceAdminPresets,\n);\n\n/**\n * Complete resource frontend configuration for the platform layer (companion, internal tooling).\n *\n * ## There is deliberately no `jobExecutions` / `jobPayloadStorage` preset — decided 2026-09-08 (#469)\n *\n * One used to exist: a per-status colour map and per-field display modes for both resources. It\n * rendered nowhere and never could — every operation on both is `REPOSITORY_ONLY`, so no route and\n * no generated screen can reach them — and its existence made the absence of a job browser look\n * like an oversight rather than a decision. It was deleted rather than wired.\n *\n * So an operator does NOT get \"what happened to this job\" from inside the product. That is the\n * accepted cost. Where to look instead:\n *\n * - **A parked or dead-lettered job** is a BROKER-level concern; inspect and replay it with the\n *   broker's own tooling. See the note on `QueueBackendService`.\n * - **A worker that outran its shutdown grace period** is an ORCHESTRATOR-level concern; see the\n *   note on `WorkerShutdownManagerBackendService`.\n *\n * If that ever bites, the option to revisit FIRST is the middle one that was not taken: queue depth\n * in the health signal and a recorded event on a grace-period overrun, WITHOUT a job-execution read\n * surface — it catches fleet-level problems without exposing job payloads, which may carry personal\n * data. Restoring display behaviour is the last step, not the first.\n */\nexport const RESOURCES_FRONTEND_PLATFORM: ResourceUIBehavior = mergePresets(\n  guidancePlatformPresets,\n);\n"]}

package/dist/esm/config/resources/organizations.resource-presets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.resource-presets.d.ts","sourceRoot":"","sources":["../../../../../src/config/resources/organizations.resource-presets.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAmC,MAAM,6BAA6B,CAAC;AAoGvG,wBAAgB,6BAA6B,IAAI,OAAO,CAAC,kBAAkB,CAAC,CA0gB3E;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA2B7G;AAED,eAAO,MAAM,wBAAwB,6BAAkC,CAAC;AACxE,eAAO,MAAM,yBAAyB,6BAA2D,CAAC;AAElG,eAAO,MAAM,sCAAsC,gGAA6C,CAAC;AACjG,eAAO,MAAM,uCAAuC,gGAA8C,CAAC;AACnG,eAAO,MAAM,uCAAuC,gGAAkD,CAAC;AACvG,eAAO,MAAM,yCAAyC,gGAAoD,CAAC;AAC3G,eAAO,MAAM,0CAA0C,gGAAqD,CAAC;AAC7G,eAAO,MAAM,+CAA+C,gGAA0D,CAAC;AACvH,eAAO,MAAM,6CAA6C,gGAAwD,CAAC;AACnH,eAAO,MAAM,0CAA0C,gGAAqD,CAAC;AAC7G,eAAO,MAAM,2CAA2C,gGAAsD,CAAC"}
+{"version":3,"file":"organizations.resource-presets.d.ts","sourceRoot":"","sources":["../../../../src/config/resources/organizations.resource-presets.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAmC,MAAM,6BAA6B,CAAC;AAoGvG,wBAAgB,6BAA6B,IAAI,OAAO,CAAC,kBAAkB,CAAC,CA0gB3E;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA2B7G;AAED,eAAO,MAAM,wBAAwB,6BAAkC,CAAC;AACxE,eAAO,MAAM,yBAAyB,6BAA2D,CAAC;AAElG,eAAO,MAAM,sCAAsC,gGAA6C,CAAC;AACjG,eAAO,MAAM,uCAAuC,gGAA8C,CAAC;AACnG,eAAO,MAAM,uCAAuC,gGAAkD,CAAC;AACvG,eAAO,MAAM,yCAAyC,gGAAoD,CAAC;AAC3G,eAAO,MAAM,0CAA0C,gGAAqD,CAAC;AAC7G,eAAO,MAAM,+CAA+C,gGAA0D,CAAC;AACvH,eAAO,MAAM,6CAA6C,gGAAwD,CAAC;AACnH,eAAO,MAAM,0CAA0C,gGAAqD,CAAC;AAC7G,eAAO,MAAM,2CAA2C,gGAAsD,CAAC"}

package/dist/esm/config/resources/resource.config.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.config.utils.d.ts","sourceRoot":"","sources":["../../../../../src/config/resources/resource.config.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAGnF;;;GAGG;AACH,KAAK,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC,CAAC;AAExF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,CAAC,EAAE,sBAAsB,GAAG,+BAA+B,CAE/F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,sBAAsB,GAAG,+BAA+B,CAElG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,+BAA+B,CAEzD"}
+{"version":3,"file":"resource.config.utils.d.ts","sourceRoot":"","sources":["../../../../src/config/resources/resource.config.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAGnF;;;GAGG;AACH,KAAK,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC,CAAC;AAExF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,CAAC,EAAE,sBAAsB,GAAG,+BAA+B,CAE/F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,sBAAsB,GAAG,+BAA+B,CAElG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,+BAA+B,CAEzD"}

package/dist/esm/config/resources/security.resource-presets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.resource-presets.d.ts","sourceRoot":"","sources":["../../../../../src/config/resources/security.resource-presets.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAudtE,wBAAgB,wBAAwB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAwXtE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4MxG;AAED,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,6BAAiD,CAAC;AAEnF,eAAO,MAAM,gCAAgC,gGAAuC,CAAC;AACrF,eAAO,MAAM,iCAAiC,gGAAwC,CAAC;AACvF,eAAO,MAAM,+BAA+B,gGAAqC,CAAC"}
+{"version":3,"file":"security.resource-presets.d.ts","sourceRoot":"","sources":["../../../../src/config/resources/security.resource-presets.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAqetE,wBAAgB,wBAAwB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CA0dtE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA+MxG;AAED,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,6BAAiD,CAAC;AAEnF,eAAO,MAAM,gCAAgC,gGAAuC,CAAC;AACrF,eAAO,MAAM,iCAAiC,gGAAwC,CAAC;AACvF,eAAO,MAAM,+BAA+B,gGAAqC,CAAC"}

package/dist/esm/config/resources/security.resource-presets.js

@@ -2,8 +2,8 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { resourceUIBehavior, resourceUIBehaviorFrom, polymorphicResourceUIBehavior, polymorphicResourceUIBehaviorFrom, StandardIconReference, ResourceOperationActionScope, } from '@wildo-ai/saas-frontend-lib';
 import { DisplayField, DisplayLayout, FormField, FormLayout, ObjectScope, Section, SummaryLayout, useFormTemplateContext, useDisplayTemplateContext, ResourceLayoutPreset_Create_SamlWizard, ResourceLayoutPreset_Read_SsoSaml, SummaryFlow, SummaryMeta, SummaryTitle, } from '@wildo-ai/saas-frontend-lib';
 import { BadgeSemanticVariant, BooleanDisplayMode, BooleanEditMode, BooleanLabellingValue, SectionMode, DisplayChromeMode, EditChromeMode, EnumDisplayMode, ShowWhenOperator, StringDisplayMode, } from '@wildo-ai/zod-decorators';
-import { Key, ShieldCheck, Fingerprint, UserCog, KeyRound, Radio, AlertTriangle, RotateCw, RefreshCw, PowerOff, Power, CalendarPlus, ChartColumn, Download, Trash2, PlugZap, Search, ShieldX, } from 'lucide-react';
-import { CoreResourceType as R, CoreResourceOperation as Op, ApiKeyStatus, OrgApiKeys_Operations, AuditLogs_Operations, SiemDeliveryDlq_Operations, SsoConnection_Operations, ScimTokens_Operations, orgApiKeysResourceConfiguration_InitializationFactory as orgApiKeysFactory, auditLogsResourceConfiguration_InitializationFactory as auditLogsFactory, siemExportConfigPolymorphicFactories, siemDeliveryDlqPolymorphicFactories, ssoConfigPolymorphicFactories, ssoConnectionPolymorphicFactories, scimProvisioningConfigPolymorphicFactories, scimTokensPolymorphicFactories, ApiKeyOrganizationSchema, AuditableEvent_BaseSchema, SiemExportConfigBaseSchema, SiemDeliveryDlqBaseSchema, SiemDeliveryDlqStatus, SsoConfigBaseSchema, SsoConnectionBaseSchema, ScimProvisioningConfigBaseSchema, ScimTokenBaseSchema, SsoProtocol, SIEMAuthMethod, } from '@wildo-ai/saas-models';
+import { Key, ShieldCheck, Globe, Unlink, Fingerprint, UserCog, KeyRound, Radio, AlertTriangle, RotateCw, RefreshCw, PowerOff, Power, CalendarPlus, ChartColumn, Download, Trash2, PlugZap, Search, ShieldX, } from 'lucide-react';
+import { CoreResourceType as R, CoreResourceOperation as Op, ApiKeyStatus, OrgApiKeys_Operations, AuditLogs_Operations, SiemDeliveryDlq_Operations, SsoConnection_Operations, ScimTokens_Operations, orgApiKeysResourceConfiguration_InitializationFactory as orgApiKeysFactory, orgProviderCredentialsResourceConfiguration_InitializationFactory as orgProviderCredentialsFactory, OrganizationProviderCredentialSchema, userProviderCredentialsResourceConfiguration_InitializationFactory as userProviderCredentialsFactory, UserProviderCredentialSchema, ProviderCredentialValidationState, auditLogsResourceConfiguration_InitializationFactory as auditLogsFactory, siemExportConfigPolymorphicFactories, siemDeliveryDlqPolymorphicFactories, ssoConfigPolymorphicFactories, SsoConfig_Operations, ssoConnectionPolymorphicFactories, scimProvisioningConfigPolymorphicFactories, scimTokensPolymorphicFactories, ApiKeyOrganizationSchema, AuditableEvent_BaseSchema, SiemExportConfigBaseSchema, SiemDeliveryDlqBaseSchema, SiemDeliveryDlqStatus, SsoConfigBaseSchema, SsoConnectionBaseSchema, ScimProvisioningConfigBaseSchema, ScimTokenBaseSchema, SsoProtocol, SIEMAuthMethod, } from '@wildo-ai/saas-models';
 import { addressable, notAddressable } from './resource.config.utils.js';
 // ── SIEM export config — field overrides (shared across polymorphic variants) ─
 const siemExportFieldOverrides = {
@@ -66,13 +66,13 @@ function SiemDlqSummaryTemplate() {
     return (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "failureReason" }), _jsx(SummaryMeta, { children: _jsx(DisplayField, { name: "status" }) })] }));
 }
 function SsoConfigDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsx(Section, { name: "enforcement", appearance: SectionMode.CARD, children: _jsxs(ObjectScope, { name: "enforcement", children: [_jsx(DisplayField, { name: "requireSSO" }), _jsx(DisplayField, { name: "allowPasswordFallback" }), _jsx(DisplayField, { name: "enforceForAdmins" }), _jsx(DisplayField, { name: "graceLoginAttempts" })] }) }), _jsx(Section, { name: "domains", children: _jsxs(ObjectScope, { name: "domains", children: [_jsx(DisplayField, { name: "verifiedDomains" }), _jsx(DisplayField, { name: "ssoEnabledDomains" }), _jsx(DisplayField, { name: "domainHinting" }), _jsx(DisplayField, { name: "allowExternalDomains" }), _jsx(DisplayField, { name: "domainVerificationStatus" })] }) }), _jsx(Section, { name: "provisioning", children: _jsxs(ObjectScope, { name: "provisioning", children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoUpdateUsers" }), _jsx(DisplayField, { name: "autoDeactivateUsers" }), _jsx(DisplayField, { name: "defaultRole" }), _jsx(DisplayField, { name: "requiredAttributes" }), _jsx(DisplayField, { name: "syncFrequencyHours" })] }) }), _jsx(Section, { name: "session", children: _jsxs(ObjectScope, { name: "sessionSettings", children: [_jsx(DisplayField, { name: "ssoSessionDurationMinutes" }), _jsx(DisplayField, { name: "requireReauthForSensitive" }), _jsx(DisplayField, { name: "singleLogoutEnabled" }), _jsx(DisplayField, { name: "maxConcurrentSessions" })] }) }), _jsx(Section, { name: "audit", children: _jsxs(ObjectScope, { name: "auditConfig", children: [_jsx(DisplayField, { name: "logAllSSOEvents" }), _jsx(DisplayField, { name: "logProviderSwitching" }), _jsx(DisplayField, { name: "logRoleMapping" }), _jsx(DisplayField, { name: "complianceReporting" }), _jsx(DisplayField, { name: "retentionDays" })] }) }), _jsx(Section, { name: "emergency", children: _jsxs(ObjectScope, { name: "emergencyAccess", children: [_jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "breakGlassAccounts" }), _jsx(DisplayField, { name: "requireApproval" }), _jsx(DisplayField, { name: "maxDurationHours" }), _jsx(DisplayField, { name: "auditLevel" })] }) }), _jsxs(Section, { name: "oauth", children: [_jsxs(ObjectScope, { name: "oauth2ProviderRestrictions", children: [_jsx(DisplayField, { name: "allowedProviders" }), _jsx(DisplayField, { name: "blockedProviders" }), _jsx(DisplayField, { name: "requireEnterpriseSSOOnly" })] }), _jsx(DisplayField, { name: "socialCredentialOverrides" })] })] }));
+    return (_jsxs(DisplayLayout, { children: [_jsx(Section, { name: "enforcement", appearance: SectionMode.CARD, children: _jsxs(ObjectScope, { name: "enforcement", children: [_jsx(DisplayField, { name: "requireSSO" }), _jsx(DisplayField, { name: "allowPasswordFallback" }), _jsx(DisplayField, { name: "graceLoginAttempts" })] }) }), _jsx(Section, { name: "domains", children: _jsxs(ObjectScope, { name: "domains", children: [_jsx(DisplayField, { name: "verifiedDomains" }), _jsx(DisplayField, { name: "ssoEnabledDomains" }), _jsx(DisplayField, { name: "domainHinting" }), _jsx(DisplayField, { name: "allowExternalDomains" }), _jsx(DisplayField, { name: "domainVerificationStatus" })] }) }), _jsx(Section, { name: "provisioning", children: _jsxs(ObjectScope, { name: "provisioning", children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoUpdateUsers" }), _jsx(DisplayField, { name: "autoDeactivateUsers" }), _jsx(DisplayField, { name: "defaultRole" }), _jsx(DisplayField, { name: "requiredAttributes" }), _jsx(DisplayField, { name: "syncFrequencyHours" })] }) }), _jsx(Section, { name: "session", children: _jsxs(ObjectScope, { name: "sessionSettings", children: [_jsx(DisplayField, { name: "ssoSessionDurationMinutes" }), _jsx(DisplayField, { name: "requireReauthForSensitive" }), _jsx(DisplayField, { name: "singleLogoutEnabled" }), _jsx(DisplayField, { name: "maxConcurrentSessions" })] }) }), _jsx(Section, { name: "audit", children: _jsxs(ObjectScope, { name: "auditConfig", children: [_jsx(DisplayField, { name: "logAllSSOEvents" }), _jsx(DisplayField, { name: "logProviderSwitching" }), _jsx(DisplayField, { name: "logRoleMapping" }), _jsx(DisplayField, { name: "complianceReporting" }), _jsx(DisplayField, { name: "retentionDays" })] }) }), _jsx(Section, { name: "emergency", children: _jsxs(ObjectScope, { name: "emergencyAccess", children: [_jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "breakGlassAccounts" })] }) }), _jsxs(Section, { name: "oauth", children: [_jsxs(ObjectScope, { name: "oauth2ProviderRestrictions", children: [_jsx(DisplayField, { name: "allowedProviders" }), _jsx(DisplayField, { name: "blockedProviders" }), _jsx(DisplayField, { name: "requireEnterpriseSSOOnly" })] }), _jsx(DisplayField, { name: "socialCredentialOverrides" })] })] }));
 }
 function SsoConfigSummaryTemplate() {
     return (_jsx(SummaryLayout, { flow: SummaryFlow.ROW, children: _jsx(ObjectScope, { name: "enforcement", children: _jsx(DisplayField, { name: "requireSSO" }) }) }));
 }
 function SsoConnectionDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "displayName" }), _jsx(DisplayField, { name: "protocol" }), _jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "isDefault" }), _jsx(DisplayField, { name: "externalProviderId" })] }), _jsx(Section, { name: "oidc", children: _jsxs(ObjectScope, { name: "oidc", children: [_jsx(DisplayField, { name: "templateMode" }), _jsx(DisplayField, { name: "discoveryUrl" }), _jsx(DisplayField, { name: "issuer" }), _jsx(DisplayField, { name: "authorizationEndpoint" }), _jsx(DisplayField, { name: "tokenEndpoint" }), _jsx(DisplayField, { name: "userInfoEndpoint" }), _jsx(DisplayField, { name: "jwksUri" }), _jsx(DisplayField, { name: "endSessionEndpoint" }), _jsx(DisplayField, { name: "clientId" }), _jsx(DisplayField, { name: "scopes" }), _jsx(DisplayField, { name: "responseType" }), _jsx(DisplayField, { name: "responseMode" }), _jsx(DisplayField, { name: "validateIssuer" }), _jsx(DisplayField, { name: "validateAudience" }), _jsx(DisplayField, { name: "pkceEnabled" }), _jsx(DisplayField, { name: "pkceMethod" }), _jsx(DisplayField, { name: "prompt" }), _jsx(DisplayField, { name: "claimsMapping" }), _jsx(DisplayField, { name: "auditSettings" })] }) }), _jsx(Section, { name: "saml", children: _jsxs(ObjectScope, { name: "saml", children: [_jsx(DisplayField, { name: "entityId" }), _jsx(DisplayField, { name: "ssoUrl" }), _jsx(DisplayField, { name: "sloUrl" }), _jsx(DisplayField, { name: "x509CertificatePem" }), _jsx(DisplayField, { name: "attributeMapping" }), _jsx(DisplayField, { name: "signRequests" }), _jsx(DisplayField, { name: "wantAssertionsSigned" }), _jsx(DisplayField, { name: "allowedClockDrift" }), _jsx(DisplayField, { name: "forceAuthn" }), _jsx(DisplayField, { name: "maxAuthAge" }), _jsx(DisplayField, { name: "nameIdFormat" }), _jsx(DisplayField, { name: "allowIdpInitiated" }), _jsx(DisplayField, { name: "auditSettings" })] }) }), _jsxs(Section, { name: "provisioning", children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoVerifyEmail" }), _jsx(DisplayField, { name: "bypassAppMFA" }), _jsx(DisplayField, { name: "defaultRole" }), _jsx(DisplayField, { name: "allowedDomains" }), _jsx(DisplayField, { name: "roleMapping" }), _jsx(DisplayField, { name: "groupMapping" })] })] }));
+    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "displayName" }), _jsx(DisplayField, { name: "protocol" }), _jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "isDefault" }), _jsx(DisplayField, { name: "externalProviderId" })] }), _jsx(Section, { name: "oidc", children: _jsxs(ObjectScope, { name: "oidc", children: [_jsx(DisplayField, { name: "templateMode" }), _jsx(DisplayField, { name: "discoveryUrl" }), _jsx(DisplayField, { name: "issuer" }), _jsx(DisplayField, { name: "authorizationEndpoint" }), _jsx(DisplayField, { name: "tokenEndpoint" }), _jsx(DisplayField, { name: "userInfoEndpoint" }), _jsx(DisplayField, { name: "jwksUri" }), _jsx(DisplayField, { name: "endSessionEndpoint" }), _jsx(DisplayField, { name: "clientId" }), _jsx(DisplayField, { name: "scopes" }), _jsx(DisplayField, { name: "responseType" }), _jsx(DisplayField, { name: "responseMode" }), _jsx(DisplayField, { name: "pkceEnabled" }), _jsx(DisplayField, { name: "pkceMethod" }), _jsx(DisplayField, { name: "prompt" }), _jsx(DisplayField, { name: "acrValues" }), _jsx(DisplayField, { name: "maxAge" }), _jsx(DisplayField, { name: "claimsMapping" }), _jsx(DisplayField, { name: "auditSettings" })] }) }), _jsx(Section, { name: "saml", children: _jsxs(ObjectScope, { name: "saml", children: [_jsx(DisplayField, { name: "entityId" }), _jsx(DisplayField, { name: "ssoUrl" }), _jsx(DisplayField, { name: "sloUrl" }), _jsx(DisplayField, { name: "x509CertificatePem" }), _jsx(DisplayField, { name: "attributeMapping" }), _jsx(DisplayField, { name: "signRequests" }), _jsx(DisplayField, { name: "wantAssertionsSigned" }), _jsx(DisplayField, { name: "allowedClockDrift" }), _jsx(DisplayField, { name: "forceAuthn" }), _jsx(DisplayField, { name: "maxAuthAge" }), _jsx(DisplayField, { name: "nameIdFormat" }), _jsx(DisplayField, { name: "allowIdpInitiated" }), _jsx(DisplayField, { name: "auditSettings" })] }) }), _jsxs(Section, { name: "provisioning", children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoVerifyEmail" }), _jsx(DisplayField, { name: "bypassAppMFA" }), _jsx(DisplayField, { name: "defaultRole" }), _jsx(DisplayField, { name: "allowedDomains" }), _jsx(DisplayField, { name: "roleMapping" }), _jsx(DisplayField, { name: "groupMapping" })] })] }));
 }
 function SsoConnectionSummaryTemplate() {
     return (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "displayName" }), _jsxs(SummaryMeta, { children: [_jsx(DisplayField, { name: "protocol" }), _jsx(DisplayField, { name: "enabled" })] })] }));
@@ -138,6 +138,88 @@ export function buildSecurityMainPresets() {
                 [OrgApiKeys_Operations.USAGE_STATS, notAddressable({ iconOverride: ChartColumn })],
             ],
         })),
+        /**
+         * The tenant's OWN credentials toward third parties.
+         *
+         * Easy to read as a sibling of API keys and it is their mirror image: an API key lets somebody
+         * reach THIS application, and one of these lets this application reach somebody else AS THIS
+         * TENANT. Same administrator, opposite direction — which is why they sit next to each other in
+         * Settings and must not be described in the same words.
+         *
+         * ## No layout refs, deliberately
+         *
+         * Declaring `layout.refs.sections` creates a contract the resource SPECIFICATION has to document
+         * slot for slot, validated at load; this resource has eight visible fields and no section would
+         * earn that coupling. Field-level UI is the whole surface until it needs one.
+         *
+         * ## What the administrator can see, and what they cannot
+         *
+         * `secretValue` is `.isWriteOnlySecret()`, so it is present in the CREATE and UPDATE forms and
+         * masked on every read — the operator supplies and rotates it, and no screen ever shows it back.
+         * Nothing here weakens that; the preset only names the fields that are already readable.
+         */
+        [R.ORG_PROVIDER_CREDENTIALS]: resourceUIBehavior(orgProviderCredentialsFactory, OrganizationProviderCredentialSchema, ({ schemaShape }) => ({
+            icon: KeyRound,
+            fields: {
+                validationState: schemaShape.validationState.enumUI({
+                    display: { displayMode: EnumDisplayMode.BADGE, showDescription: true },
+                    edit: { showDescription: true },
+                    values: {
+                        // UNVALIDATED is the honest default and is not a warning: storing a credential proves
+                        // only that somebody typed one, which is a normal state rather than a problem.
+                        [ProviderCredentialValidationState.UNVALIDATED]: { color: BadgeSemanticVariant.SECONDARY },
+                        [ProviderCredentialValidationState.VALID]: { color: BadgeSemanticVariant.SUCCESS },
+                        // The provider REJECTED it on its last use, so the tenant is acting as nobody until it
+                        // is rotated. That is a call to action, not an error the screen has to explain away.
+                        [ProviderCredentialValidationState.INVALID]: { color: BadgeSemanticVariant.WARNING },
+                    },
+                }),
+            },
+            getFrontendResourceLabel: ({ currentObject }) => `${currentObject.providerRef} · ${currentObject.secretSlug}`,
+            emptyState: { primaryAction: Op.CREATE },
+            views: [
+                [Op.READ, notAddressable()],
+                [Op.LIST, addressable()],
+                [Op.CREATE, notAddressable()],
+                [Op.UPDATE, notAddressable()],
+                [Op.DELETE, notAddressable()],
+            ],
+        })),
+        [R.USER_PROVIDER_CREDENTIALS]: resourceUIBehavior(userProviderCredentialsFactory, UserProviderCredentialSchema, ({ schemaShape }) => ({
+            icon: KeyRound,
+            fields: {
+                // The same three states as the tenant's, coloured identically on purpose: a person reading
+                // their own connections and an administrator reading the tenant's are answering the same
+                // question, and two colour languages for one vocabulary is how a reader learns to distrust
+                // both. The WORDS come from the enum's i18n entry, authored once for every surface.
+                validationState: schemaShape.validationState.enumUI({
+                    display: { displayMode: EnumDisplayMode.BADGE, showDescription: true },
+                    edit: { showDescription: true },
+                    values: {
+                        // UNVALIDATED is the honest default and is not a warning: storing a credential proves
+                        // only that somebody typed one, which is a normal state rather than a problem.
+                        [ProviderCredentialValidationState.UNVALIDATED]: { color: BadgeSemanticVariant.SECONDARY },
+                        [ProviderCredentialValidationState.VALID]: { color: BadgeSemanticVariant.SUCCESS },
+                        // The provider REJECTED it on its last use. For a person this is the more actionable of
+                        // the two failure shapes: nobody else can rotate it for them, so the badge is the only
+                        // notice they will get that their own integration has stopped working.
+                        [ProviderCredentialValidationState.INVALID]: { color: BadgeSemanticVariant.WARNING },
+                    },
+                }),
+            },
+            getFrontendResourceLabel: ({ currentObject }) => `${currentObject.providerRef} · ${currentObject.secretSlug}`,
+            emptyState: { primaryAction: Op.CREATE },
+            // No `layout.refs`, matching the tenant sibling: this resource declares no layout sections in
+            // its specification, and a preset naming refs the layout does not declare fails the
+            // structural-slot validator at import time and crash-loops the companion.
+            views: [
+                [Op.READ, notAddressable()],
+                [Op.LIST, addressable()],
+                [Op.CREATE, notAddressable()],
+                [Op.UPDATE, notAddressable()],
+                [Op.DELETE, notAddressable()],
+            ],
+        })),
         [R.AUDIT_LOGS]: resourceUIBehavior(auditLogsFactory, AuditableEvent_BaseSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
             icon: ShieldCheck,
             getFrontendResourceLabel: ({ currentObject }) => `${currentObject.eventType ?? 'Audit Event'} — ${currentObject.createdAt?.toISOString?.() ?? ''}`,
@@ -271,6 +353,12 @@ export function buildSecurityMainPresets() {
             },
             views: [
                 [Op.READ, addressable()],
+                // Domain ownership is the one publicly mutable part of this policy row (#424). The three
+                // actions live beside the `domains` section: claim returns a DNS record to copy, verify
+                // resolves it, revoke releases the domain for another scope to verify.
+                [SsoConfig_Operations.CLAIM_DOMAIN, notAddressable({ iconOverride: Globe })],
+                [SsoConfig_Operations.VERIFY_DOMAIN, notAddressable({ iconOverride: ShieldCheck })],
+                [SsoConfig_Operations.REVOKE_DOMAIN, notAddressable({ iconOverride: Unlink })],
             ],
             variantOverrides: {
                 [R.APPLICATION]: { views: [] },
@@ -431,6 +519,9 @@ export function buildSecurityAdminPresets(main) {
             layout: base.layout,
             views: [
                 [Op.READ, addressable()],
+                [SsoConfig_Operations.CLAIM_DOMAIN, notAddressable({ iconOverride: Globe })],
+                [SsoConfig_Operations.VERIFY_DOMAIN, notAddressable({ iconOverride: ShieldCheck })],
+                [SsoConfig_Operations.REVOKE_DOMAIN, notAddressable({ iconOverride: Unlink })],
             ],
             variantOverrides: {
                 [R.ORGANIZATIONS]: {