@wildo-ai/presets-components 1.1.3 → 1.1.5

package/dist/esm/config/resources/security.resource-presets.js

@@ -1,9 +1,9 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { resourceUIBehavior, resourceUIBehaviorFrom, polymorphicResourceUIBehavior, polymorphicResourceUIBehaviorFrom, StandardIconReference, ResourceOperationActionScope, } from '@wildo-ai/saas-frontend-lib';
+import { resourceUIBehavior, resourceUIBehaviorFrom, polymorphicResourceUIBehavior, polymorphicResourceUIBehaviorFrom, StandardIconReference, ResourceOperationActionScope, ActionVisibility, ResourceLayoutInlineEditDefault, CollectionDisplayMode, } from '@wildo-ai/saas-frontend-lib';
 import { DisplayField, DisplayLayout, FormField, FormLayout, ObjectScope, Section, SummaryLayout, useFormTemplateContext, useDisplayTemplateContext, ResourceLayoutPreset_Create_SamlWizard, ResourceLayoutPreset_Read_SsoSaml, SummaryFlow, SummaryMeta, SummaryTitle, } from '@wildo-ai/saas-frontend-lib';
 import { BadgeSemanticVariant, BooleanDisplayMode, BooleanEditMode, BooleanLabellingValue, SectionMode, DisplayChromeMode, EditChromeMode, EnumDisplayMode, ShowWhenOperator, StringDisplayMode, } from '@wildo-ai/zod-decorators';
 import { Key, ShieldCheck, Globe, Unlink, Fingerprint, UserCog, KeyRound, Radio, AlertTriangle, RotateCw, RefreshCw, PowerOff, Power, CalendarPlus, ChartColumn, Download, Trash2, PlugZap, Search, ShieldX, } from 'lucide-react';
-import { CoreResourceType as R, CoreResourceOperation as Op, ApiKeyStatus, OrgApiKeys_Operations, AuditLogs_Operations, SiemDeliveryDlq_Operations, SsoConnection_Operations, ScimTokens_Operations, orgApiKeysResourceConfiguration_InitializationFactory as orgApiKeysFactory, orgProviderCredentialsResourceConfiguration_InitializationFactory as orgProviderCredentialsFactory, OrganizationProviderCredentialSchema, userProviderCredentialsResourceConfiguration_InitializationFactory as userProviderCredentialsFactory, UserProviderCredentialSchema, ProviderCredentialValidationState, auditLogsResourceConfiguration_InitializationFactory as auditLogsFactory, siemExportConfigPolymorphicFactories, siemDeliveryDlqPolymorphicFactories, ssoConfigPolymorphicFactories, SsoConfig_Operations, ssoConnectionPolymorphicFactories, scimProvisioningConfigPolymorphicFactories, scimTokensPolymorphicFactories, ApiKeyOrganizationSchema, AuditableEvent_BaseSchema, SiemExportConfigBaseSchema, SiemDeliveryDlqBaseSchema, SiemDeliveryDlqStatus, SsoConfigBaseSchema, SsoConnectionBaseSchema, ScimProvisioningConfigBaseSchema, ScimTokenBaseSchema, SsoProtocol, SIEMAuthMethod, } from '@wildo-ai/saas-models';
+import { CoreResourceType as R, CoreResourceOperation as Op, ApiKeyStatus, OrgApiKeys_Operations, AuditLogs_Operations, SiemDeliveryDlq_Operations, SsoConnection_Operations, ScimTokens_Operations, orgApiKeysResourceConfiguration_InitializationFactory as orgApiKeysFactory, orgProviderCredentialsResourceConfiguration_InitializationFactory as orgProviderCredentialsFactory, OrganizationProviderCredentialSchema, userProviderCredentialsResourceConfiguration_InitializationFactory as userProviderCredentialsFactory, UserProviderCredentialSchema, ProviderCredentialValidationState, auditLogsResourceConfiguration_InitializationFactory as auditLogsFactory, applicationAuditLogsResourceConfiguration_InitializationFactory as applicationAuditLogsFactory, siemExportConfigPolymorphicFactories, siemDeliveryDlqPolymorphicFactories, ssoConfigPolymorphicFactories, SsoConfig_Operations, ssoConnectionPolymorphicFactories, scimProvisioningConfigPolymorphicFactories, scimTokensPolymorphicFactories, ApiKeyOrganizationSchema, AuditableEvent_BaseSchema, SiemExportConfigBaseSchema, SiemDeliveryDlqBaseSchema, SiemDeliveryDlqStatus, SsoConfigBaseSchema, SsoConnectionBaseSchema, ScimProvisioningConfigBaseSchema, ScimTokenBaseSchema, SsoProtocol, SIEMAuthMethod, } from '@wildo-ai/saas-models';
 import { addressable, notAddressable } from './resource.config.utils.js';
 // ── SIEM export config — field overrides (shared across polymorphic variants) ─
 const siemExportFieldOverrides = {
@@ -24,16 +24,6 @@ const siemExportFieldOverrides = {
         display: { displayMode: EnumDisplayMode.BADGE, showDescription: true },
         edit: { showDescription: true },
     }),
-    includeRawEventData: (schema) => schema.shape.includeRawEventData.booleanUI({
-        labellingValue: BooleanLabellingValue.YES_NO,
-        display: { displayMode: BooleanDisplayMode.CHECKMARK, showDescription: true },
-        edit: { editMode: BooleanEditMode.SWITCH, showDescription: true },
-    }),
-    includeDeviceContext: (schema) => schema.shape.includeDeviceContext.booleanUI({
-        labellingValue: BooleanLabellingValue.YES_NO,
-        display: { displayMode: BooleanDisplayMode.CHECKMARK, showDescription: true },
-        edit: { editMode: BooleanEditMode.SWITCH, showDescription: true },
-    }),
     authCredential: (schema) => schema.shape.authCredential.showWhen({
         conditions: { field: 'authMethod', value: SIEMAuthMethod.NONE, operator: ShowWhenOperator.NOT_EQUALS },
     }),
@@ -66,13 +56,13 @@ function SiemDlqSummaryTemplate() {
     return (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "failureReason" }), _jsx(SummaryMeta, { children: _jsx(DisplayField, { name: "status" }) })] }));
 }
 function SsoConfigDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsx(Section, { name: "enforcement", appearance: SectionMode.CARD, children: _jsxs(ObjectScope, { name: "enforcement", children: [_jsx(DisplayField, { name: "requireSSO" }), _jsx(DisplayField, { name: "allowPasswordFallback" }), _jsx(DisplayField, { name: "graceLoginAttempts" })] }) }), _jsx(Section, { name: "domains", children: _jsxs(ObjectScope, { name: "domains", children: [_jsx(DisplayField, { name: "verifiedDomains" }), _jsx(DisplayField, { name: "ssoEnabledDomains" }), _jsx(DisplayField, { name: "domainHinting" }), _jsx(DisplayField, { name: "allowExternalDomains" }), _jsx(DisplayField, { name: "domainVerificationStatus" })] }) }), _jsx(Section, { name: "provisioning", children: _jsxs(ObjectScope, { name: "provisioning", children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoUpdateUsers" }), _jsx(DisplayField, { name: "autoDeactivateUsers" }), _jsx(DisplayField, { name: "defaultRole" }), _jsx(DisplayField, { name: "requiredAttributes" }), _jsx(DisplayField, { name: "syncFrequencyHours" })] }) }), _jsx(Section, { name: "session", children: _jsxs(ObjectScope, { name: "sessionSettings", children: [_jsx(DisplayField, { name: "ssoSessionDurationMinutes" }), _jsx(DisplayField, { name: "requireReauthForSensitive" }), _jsx(DisplayField, { name: "singleLogoutEnabled" }), _jsx(DisplayField, { name: "maxConcurrentSessions" })] }) }), _jsx(Section, { name: "audit", children: _jsxs(ObjectScope, { name: "auditConfig", children: [_jsx(DisplayField, { name: "logAllSSOEvents" }), _jsx(DisplayField, { name: "logProviderSwitching" }), _jsx(DisplayField, { name: "logRoleMapping" }), _jsx(DisplayField, { name: "complianceReporting" }), _jsx(DisplayField, { name: "retentionDays" })] }) }), _jsx(Section, { name: "emergency", children: _jsxs(ObjectScope, { name: "emergencyAccess", children: [_jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "breakGlassAccounts" })] }) }), _jsxs(Section, { name: "oauth", children: [_jsxs(ObjectScope, { name: "oauth2ProviderRestrictions", children: [_jsx(DisplayField, { name: "allowedProviders" }), _jsx(DisplayField, { name: "blockedProviders" }), _jsx(DisplayField, { name: "requireEnterpriseSSOOnly" })] }), _jsx(DisplayField, { name: "socialCredentialOverrides" })] })] }));
+    return (_jsxs(DisplayLayout, { children: [_jsx(Section, { name: "enforcement", children: _jsxs(ObjectScope, { name: "enforcement", children: [_jsx(DisplayField, { name: "requireSSO" }), _jsx(DisplayField, { name: "allowPasswordFallback" }), _jsx(DisplayField, { name: "graceLoginAttempts" })] }) }), _jsx(Section, { name: "domains", children: _jsxs(ObjectScope, { name: "domains", children: [_jsx(DisplayField, { name: "verifiedDomains" }), _jsx(DisplayField, { name: "ssoEnabledDomains" }), _jsx(DisplayField, { name: "domainVerificationStatus" })] }) }), _jsx(Section, { name: "session", children: _jsx(ObjectScope, { name: "sessionSettings", children: _jsx(DisplayField, { name: "singleLogoutEnabled" }) }) }), _jsx(Section, { name: "emergency", children: _jsxs(ObjectScope, { name: "emergencyAccess", children: [_jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "breakGlassAccounts" })] }) }), _jsxs(Section, { name: "oauth", children: [_jsxs(ObjectScope, { name: "oauth2ProviderRestrictions", children: [_jsx(DisplayField, { name: "allowedProviders" }), _jsx(DisplayField, { name: "blockedProviders" }), _jsx(DisplayField, { name: "requireEnterpriseSSOOnly" })] }), _jsx(DisplayField, { name: "socialCredentialOverrides" })] })] }));
 }
 function SsoConfigSummaryTemplate() {
     return (_jsx(SummaryLayout, { flow: SummaryFlow.ROW, children: _jsx(ObjectScope, { name: "enforcement", children: _jsx(DisplayField, { name: "requireSSO" }) }) }));
 }
 function SsoConnectionDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "displayName" }), _jsx(DisplayField, { name: "protocol" }), _jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "isDefault" }), _jsx(DisplayField, { name: "externalProviderId" })] }), _jsx(Section, { name: "oidc", children: _jsxs(ObjectScope, { name: "oidc", children: [_jsx(DisplayField, { name: "templateMode" }), _jsx(DisplayField, { name: "discoveryUrl" }), _jsx(DisplayField, { name: "issuer" }), _jsx(DisplayField, { name: "authorizationEndpoint" }), _jsx(DisplayField, { name: "tokenEndpoint" }), _jsx(DisplayField, { name: "userInfoEndpoint" }), _jsx(DisplayField, { name: "jwksUri" }), _jsx(DisplayField, { name: "endSessionEndpoint" }), _jsx(DisplayField, { name: "clientId" }), _jsx(DisplayField, { name: "scopes" }), _jsx(DisplayField, { name: "responseType" }), _jsx(DisplayField, { name: "responseMode" }), _jsx(DisplayField, { name: "pkceEnabled" }), _jsx(DisplayField, { name: "pkceMethod" }), _jsx(DisplayField, { name: "prompt" }), _jsx(DisplayField, { name: "acrValues" }), _jsx(DisplayField, { name: "maxAge" }), _jsx(DisplayField, { name: "claimsMapping" }), _jsx(DisplayField, { name: "auditSettings" })] }) }), _jsx(Section, { name: "saml", children: _jsxs(ObjectScope, { name: "saml", children: [_jsx(DisplayField, { name: "entityId" }), _jsx(DisplayField, { name: "ssoUrl" }), _jsx(DisplayField, { name: "sloUrl" }), _jsx(DisplayField, { name: "x509CertificatePem" }), _jsx(DisplayField, { name: "attributeMapping" }), _jsx(DisplayField, { name: "signRequests" }), _jsx(DisplayField, { name: "wantAssertionsSigned" }), _jsx(DisplayField, { name: "allowedClockDrift" }), _jsx(DisplayField, { name: "forceAuthn" }), _jsx(DisplayField, { name: "maxAuthAge" }), _jsx(DisplayField, { name: "nameIdFormat" }), _jsx(DisplayField, { name: "allowIdpInitiated" }), _jsx(DisplayField, { name: "auditSettings" })] }) }), _jsxs(Section, { name: "provisioning", children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoVerifyEmail" }), _jsx(DisplayField, { name: "bypassAppMFA" }), _jsx(DisplayField, { name: "defaultRole" }), _jsx(DisplayField, { name: "allowedDomains" }), _jsx(DisplayField, { name: "roleMapping" }), _jsx(DisplayField, { name: "groupMapping" })] })] }));
+    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "displayName" }), _jsx(DisplayField, { name: "protocol" }), _jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "isDefault" }), _jsx(DisplayField, { name: "externalProviderId" })] }), _jsx(Section, { name: "oidc", children: _jsxs(ObjectScope, { name: "oidc", children: [_jsx(DisplayField, { name: "templateMode" }), _jsx(DisplayField, { name: "discoveryUrl" }), _jsx(DisplayField, { name: "issuer" }), _jsx(DisplayField, { name: "authorizationEndpoint" }), _jsx(DisplayField, { name: "tokenEndpoint" }), _jsx(DisplayField, { name: "userInfoEndpoint" }), _jsx(DisplayField, { name: "jwksUri" }), _jsx(DisplayField, { name: "endSessionEndpoint" }), _jsx(DisplayField, { name: "clientId" }), _jsx(DisplayField, { name: "scopes" }), _jsx(DisplayField, { name: "responseType" }), _jsx(DisplayField, { name: "responseMode" }), _jsx(DisplayField, { name: "pkceEnabled" }), _jsx(DisplayField, { name: "pkceMethod" }), _jsx(DisplayField, { name: "prompt" }), _jsx(DisplayField, { name: "acrValues" }), _jsx(DisplayField, { name: "maxAge" }), _jsx(DisplayField, { name: "claimsMapping" }), _jsx(DisplayField, { name: "auditSettings" })] }) }), _jsx(Section, { name: "saml", children: _jsxs(ObjectScope, { name: "saml", children: [_jsx(DisplayField, { name: "entityId" }), _jsx(DisplayField, { name: "ssoUrl" }), _jsx(DisplayField, { name: "sloUrl" }), _jsx(DisplayField, { name: "x509CertificatePem" }), _jsx(DisplayField, { name: "attributeMapping" }), _jsx(DisplayField, { name: "signRequests" }), _jsx(DisplayField, { name: "wantAssertionsSigned" }), _jsx(DisplayField, { name: "allowedClockDrift" }), _jsx(DisplayField, { name: "forceAuthn" }), _jsx(DisplayField, { name: "maxAuthAge" }), _jsx(DisplayField, { name: "nameIdFormat" }), _jsx(DisplayField, { name: "allowIdpInitiated" }), _jsx(DisplayField, { name: "auditSettings" })] }) }), _jsxs(Section, { name: "provisioning", children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoVerifyEmail" }), _jsx(DisplayField, { name: "defaultRole" }), _jsx(DisplayField, { name: "allowedDomains" }), _jsx(DisplayField, { name: "roleMapping" }), _jsx(DisplayField, { name: "groupMapping" })] })] }));
 }
 function SsoConnectionSummaryTemplate() {
     return (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "displayName" }), _jsxs(SummaryMeta, { children: [_jsx(DisplayField, { name: "protocol" }), _jsx(DisplayField, { name: "enabled" })] })] }));
@@ -122,7 +112,18 @@ export function buildSecurityMainPresets() {
             emptyState: { primaryAction: Op.CREATE },
             views: [
                 [Op.READ, notAddressable()],
-                [Op.LIST, addressable()],
+                // A key registry: name, scope, created, last used. Comparable rows.
+                // CARDS is the framework default and nothing had ever declared otherwise, so every
+                // collection in the product rendered as stacked cards — ~150px per row, four people to a
+                // viewport, with each field's help text and label repeated on every card. TABLE writes the
+                // headers once. `userSwitchableDisplayMode` keeps cards one click away rather than removing
+                // a rendering somebody may prefer on a narrow screen.
+                [Op.LIST, addressable({
+                        collectionDisplayConfig: {
+                            displayMode: CollectionDisplayMode.TABLE,
+                            userSwitchableDisplayMode: true,
+                        },
+                    })],
                 // CREATE has a view but is NOT URL-addressable — surface EMBEDDED; the create
                 // form opens as a drill-in within the Settings Hub panel, not a routed page.
                 // Its Create button still shows: action visibility is governed by the op
@@ -176,11 +177,15 @@ export function buildSecurityMainPresets() {
                 }),
             },
             getFrontendResourceLabel: ({ currentObject }) => `${currentObject.providerRef} · ${currentObject.secretSlug}`,
-            emptyState: { primaryAction: Op.CREATE },
+            // No Create call to action, and no Create on the list either (#1040). A credential is pasted through the Connect
+            // tab beside this list, which offers only declared providers and each provider's declared slots. This list's
+            // CREATE form took both as free text, so a value could be stored in a slot nothing reads, and the refusal naming
+            // the valid slots never reached the person. The API's CREATE stays for callers that are not these screens.
+            emptyState: { primaryAction: false },
             views: [
                 [Op.READ, notAddressable()],
                 [Op.LIST, addressable()],
-                [Op.CREATE, notAddressable()],
+                [Op.CREATE, notAddressable({ actionVisibility: ActionVisibility.HIDDEN })],
                 [Op.UPDATE, notAddressable()],
                 [Op.DELETE, notAddressable()],
             ],
@@ -208,14 +213,18 @@ export function buildSecurityMainPresets() {
                 }),
             },
             getFrontendResourceLabel: ({ currentObject }) => `${currentObject.providerRef} · ${currentObject.secretSlug}`,
-            emptyState: { primaryAction: Op.CREATE },
+            // No Create call to action, and no Create on the list either (#1040). A credential is pasted through the Connect
+            // tab beside this list, which offers only declared providers and each provider's declared slots. This list's
+            // CREATE form took both as free text, so a value could be stored in a slot nothing reads, and the refusal naming
+            // the valid slots never reached the person. The API's CREATE stays for callers that are not these screens.
+            emptyState: { primaryAction: false },
             // No `layout.refs`, matching the tenant sibling: this resource declares no layout sections in
             // its specification, and a preset naming refs the layout does not declare fails the
             // structural-slot validator at import time and crash-loops the companion.
             views: [
                 [Op.READ, notAddressable()],
                 [Op.LIST, addressable()],
-                [Op.CREATE, notAddressable()],
+                [Op.CREATE, notAddressable({ actionVisibility: ActionVisibility.HIDDEN })],
                 [Op.UPDATE, notAddressable()],
                 [Op.DELETE, notAddressable()],
             ],
@@ -257,16 +266,29 @@ export function buildSecurityMainPresets() {
                 refs: {
                     sections: ['status', 'destination', 'authentication', 'format', 'advanced'],
                 },
-                defaultChromeMode: {
-                    edit: EditChromeMode.SETTINGS_ROW,
-                },
+                // `display` and `summary` joined `edit` on 2026-09-18. Only the form carried the settings
+                // treatment, so the READ an operator actually opens rendered with the stacked default while
+                // its own edit form used rows — the same record, two shapes, depending on which verb you
+                // reached it by.
+                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.INLINE, edit: EditChromeMode.SETTINGS_ROW },
+                // SIEM export configuration — a scope-level configuration record. A settings pane is a list of decisions an operator came to TAKE, so its
+                // writable fields are offered in place rather than behind a whole-pane edit mode. The set is
+                // DERIVED (not primary key, not excludeFromUpdate, not hidden, not opted out), so a field
+                // added to this schema tomorrow is covered without anyone remembering to decorate it.
+                defaultInlineEdit: ResourceLayoutInlineEditDefault.WRITABLE_FIELDS,
+                // And its empty rows say WHICH emptiness they are — "None yet" for a list with no members,
+                // "Not available" for a computed value, "No value" for a field awaiting input — instead of one
+                // em dash standing for all three. The surface policy's dash is right where a reader is scanning;
+                // on a settings row, which is read one at a time to decide something, it is an answer that
+                // refuses to answer.
+                defaultEmptyValue: 'placeholder',
                 edit: () => {
                     const { isExisting, operationType } = useFormTemplateContext();
-                    return (_jsxs(FormLayout, { children: [_jsx(Section, { name: "status", appearance: SectionMode.CARD, chromeMode: EditChromeMode.INLINE, children: _jsx(FormField, { name: "enabled" }) }), _jsx(Section, { name: "destination", appearance: SectionMode.CARD, children: _jsx(FormField, { name: "webhookUrl" }) }), _jsxs(Section, { name: "authentication", children: [_jsx(FormField, { name: "authMethod" }), _jsx(FormField, { name: "authCredential" }), _jsx(FormField, { name: "authHeaderName" })] }), _jsxs(Section, { name: "format", children: [_jsx(FormField, { name: "eventFormat" }), _jsxs(ObjectScope, { name: "eventFilter", children: [_jsx(FormField, { name: "categories" }), _jsx(FormField, { name: "severityMinimum" }), _jsx(FormField, { name: "specificEventTypes" })] })] }), _jsxs(Section, { name: "advanced", appearance: SectionMode.COLLAPSIBLE, defaultFocus: false, children: [_jsxs(ObjectScope, { name: "delivery", children: [_jsx(FormField, { name: "batchSize" }), _jsx(FormField, { name: "batchWindowSeconds" }), _jsx(FormField, { name: "retryAttempts" }), _jsx(FormField, { name: "retryBackoffSeconds" }), _jsx(FormField, { name: "timeoutSeconds" })] }), _jsx(FormField, { name: "customHeaders" }), _jsx(FormField, { name: "includeRawEventData" }), _jsx(FormField, { name: "includeDeviceContext" })] })] }));
+                    return (_jsxs(FormLayout, { children: [_jsx(Section, { name: "status", appearance: SectionMode.CARD, chromeMode: EditChromeMode.INLINE, children: _jsx(FormField, { name: "enabled" }) }), _jsx(Section, { name: "destination", appearance: SectionMode.CARD, children: _jsx(FormField, { name: "webhookUrl" }) }), _jsxs(Section, { name: "authentication", children: [_jsx(FormField, { name: "authMethod" }), _jsx(FormField, { name: "authCredential" }), _jsx(FormField, { name: "authHeaderName" })] }), _jsxs(Section, { name: "format", children: [_jsx(FormField, { name: "eventFormat" }), _jsxs(ObjectScope, { name: "eventFilter", children: [_jsx(FormField, { name: "categories" }), _jsx(FormField, { name: "severityMinimum" }), _jsx(FormField, { name: "specificEventTypes" })] }), _jsxs(ObjectScope, { name: "exportProjection", children: [_jsx(FormField, { name: "disclosedTiers" }), _jsx(FormField, { name: "disclosedEventDataClasses" })] })] }), _jsxs(Section, { name: "advanced", appearance: SectionMode.COLLAPSIBLE, defaultFocus: false, children: [_jsxs(ObjectScope, { name: "delivery", children: [_jsx(FormField, { name: "retryAttempts" }), _jsx(FormField, { name: "retryBackoffSeconds" }), _jsx(FormField, { name: "timeoutSeconds" })] }), _jsx(FormField, { name: "customHeaders" })] })] }));
                 },
                 display: () => {
                     const { data, isLoading } = useDisplayTemplateContext();
-                    return (_jsxs(DisplayLayout, { children: [_jsx(Section, { name: "status", appearance: SectionMode.CARD, children: _jsx(DisplayField, { name: "enabled" }) }), _jsx(Section, { name: "destination", appearance: SectionMode.CARD, children: _jsx(DisplayField, { name: "webhookUrl" }) }), _jsxs(Section, { name: "authentication", children: [_jsx(DisplayField, { name: "authMethod" }), _jsx(DisplayField, { name: "authCredential" }), _jsx(DisplayField, { name: "authHeaderName" })] }), _jsxs(Section, { name: "format", children: [_jsx(DisplayField, { name: "eventFormat" }), _jsxs(ObjectScope, { name: "eventFilter", children: [_jsx(DisplayField, { name: "categories" }), _jsx(DisplayField, { name: "severityMinimum" }), _jsx(DisplayField, { name: "specificEventTypes" })] })] }), _jsxs(Section, { name: "advanced", appearance: SectionMode.COLLAPSIBLE, defaultFocus: false, children: [_jsxs(ObjectScope, { name: "delivery", children: [_jsx(DisplayField, { name: "batchSize" }), _jsx(DisplayField, { name: "batchWindowSeconds" }), _jsx(DisplayField, { name: "retryAttempts" }), _jsx(DisplayField, { name: "retryBackoffSeconds" }), _jsx(DisplayField, { name: "timeoutSeconds" })] }), _jsx(DisplayField, { name: "customHeaders" }), _jsx(DisplayField, { name: "includeRawEventData" }), _jsx(DisplayField, { name: "includeDeviceContext" })] })] }));
+                    return (_jsxs(DisplayLayout, { children: [_jsx(Section, { name: "status", appearance: SectionMode.CARD, children: _jsx(DisplayField, { name: "enabled" }) }), _jsx(Section, { name: "destination", appearance: SectionMode.CARD, children: _jsx(DisplayField, { name: "webhookUrl" }) }), _jsxs(Section, { name: "authentication", children: [_jsx(DisplayField, { name: "authMethod" }), _jsx(DisplayField, { name: "authCredential" }), _jsx(DisplayField, { name: "authHeaderName" })] }), _jsxs(Section, { name: "format", children: [_jsx(DisplayField, { name: "eventFormat" }), _jsxs(ObjectScope, { name: "eventFilter", children: [_jsx(DisplayField, { name: "categories" }), _jsx(DisplayField, { name: "severityMinimum" }), _jsx(DisplayField, { name: "specificEventTypes" })] }), _jsxs(ObjectScope, { name: "exportProjection", children: [_jsx(DisplayField, { name: "disclosedTiers" }), _jsx(DisplayField, { name: "disclosedEventDataClasses" })] })] }), _jsxs(Section, { name: "advanced", appearance: SectionMode.COLLAPSIBLE, defaultFocus: false, children: [_jsxs(ObjectScope, { name: "delivery", children: [_jsx(DisplayField, { name: "retryAttempts" }), _jsx(DisplayField, { name: "retryBackoffSeconds" }), _jsx(DisplayField, { name: "timeoutSeconds" })] }), _jsx(DisplayField, { name: "customHeaders" })] })] }));
                 },
                 summary: SiemExportSummaryTemplate,
             },
@@ -275,13 +297,14 @@ export function buildSecurityMainPresets() {
                 webhookUrl: siemExportFieldOverrides.webhookUrl(schema),
                 authMethod: siemExportFieldOverrides.authMethod(schema),
                 eventFormat: siemExportFieldOverrides.eventFormat(schema),
-                includeRawEventData: siemExportFieldOverrides.includeRawEventData(schema),
-                includeDeviceContext: siemExportFieldOverrides.includeDeviceContext(schema),
                 authCredential: siemExportFieldOverrides.authCredential(schema),
                 authHeaderName: siemExportFieldOverrides.authHeaderName(schema),
             },
             views: [
                 [Op.READ, addressable()],
+                // The edit this preset's form was always rendering, and nothing could save (#953): UPDATE became
+                // the administrator's API_CALL door. Not addressable — it opens from the READ view.
+                [Op.UPDATE, notAddressable()],
             ],
             variantOverrides: {
                 [R.APPLICATION]: { views: [] },
@@ -345,14 +368,48 @@ export function buildSecurityMainPresets() {
         }, ssoConfigPolymorphicFactories[R.ORGANIZATION_SSO_CONFIG], SsoConfigBaseSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
             icon: StandardIconReference.LOCK,
             layout: {
+                // Settings-page chrome (Settings Hub): label-left / value-right rows. A scope-level
+                // configuration record is READ far more often than it is edited — an operator opens it to
+                // confirm a value — so the DISPLAY side needs the row treatment at least as much as the form.
+                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.INLINE, edit: EditChromeMode.SETTINGS_ROW },
+                // SSO policy — a scope-level configuration record; every field here is a decision. A settings pane is a list of decisions an operator came to TAKE, so its
+                // writable fields are offered in place rather than behind a whole-pane edit mode. The set is
+                // DERIVED (not primary key, not excludeFromUpdate, not hidden, not opted out), so a field
+                // added to this schema tomorrow is covered without anyone remembering to decorate it.
+                defaultInlineEdit: ResourceLayoutInlineEditDefault.WRITABLE_FIELDS,
+                // And its empty rows say WHICH emptiness they are — "None yet" for a list with no members,
+                // "Not available" for a computed value, "No value" for a field awaiting input — instead of one
+                // em dash standing for all three. The surface policy's dash is right where a reader is scanning;
+                // on a settings row, which is read one at a time to decide something, it is an answer that
+                // refuses to answer.
+                defaultEmptyValue: 'placeholder',
+                // Seven groups of decisions — enforcement, domains, provisioning, session, audit,
+                // emergency access, OAuth restrictions — and thirty fields between them. Stacked, the pane
+                // is a scroll in which the thing you came to change is below the fold and the six you did
+                // not is what you read on the way. Vertical tabs is what a settings surface of this size
+                // does: one group at a time, all of them named and reachable in one click, and the rail
+                // doubles as the answer to "what else does SSO decide here".
+                //
+                // Declared on the LAYOUT rather than on the seven sections: the section grouping keys on
+                // `(mode, its mode-specific props)` over consecutive siblings, so per-section it is an
+                // agreement N authors must keep, and a member that slips renders a second rail rather than
+                // failing. It is also what lets the Settings Hub know the pane carries a rail of its own
+                // and give it the wider frame — a prop inside a React template cannot be read by anything
+                // that has to size the surface around it.
+                defaultDisplaySectionAppearance: SectionMode.VERTICAL_TABS,
                 refs: {
-                    sections: ['enforcement', 'domains', 'provisioning', 'session', 'audit', 'emergency', 'oauth'],
+                    sections: ['enforcement', 'domains', 'session', 'emergency', 'oauth'],
                 },
                 display: SsoConfigDisplayTemplate,
                 summary: SsoConfigSummaryTemplate,
             },
             views: [
                 [Op.READ, addressable()],
+                // The edit an administrator opens this pane to make, which until now nothing could save: the
+                // literal UPDATE was INTERNAL_CALL, so no route existed and the frontend's update resolution
+                // fell through to whichever custom verb below borrowed UPDATE semantics. Not addressable — it
+                // opens from the READ view, like SIEM export config's (#953).
+                [Op.UPDATE, notAddressable()],
                 // Domain ownership is the one publicly mutable part of this policy row (#424). The three
                 // actions live beside the `domains` section: claim returns a DNS record to copy, verify
                 // resolves it, revoke releases the domain for another scope to verify.
@@ -390,7 +447,18 @@ export function buildSecurityMainPresets() {
             },
             getFrontendResourceLabel: ({ currentObject }) => currentObject.displayName,
             views: [
-                [Op.LIST, addressable()],
+                // A connection registry: provider, protocol, status. Comparable rows.
+                // CARDS is the framework default and nothing had ever declared otherwise, so every
+                // collection in the product rendered as stacked cards — ~150px per row, four people to a
+                // viewport, with each field's help text and label repeated on every card. TABLE writes the
+                // headers once. `userSwitchableDisplayMode` keeps cards one click away rather than removing
+                // a rendering somebody may prefer on a narrow screen.
+                [Op.LIST, addressable({
+                        collectionDisplayConfig: {
+                            displayMode: CollectionDisplayMode.TABLE,
+                            userSwitchableDisplayMode: true,
+                        },
+                    })],
                 [SsoConnection_Operations.TEST_CONNECTION, addressable({
                         iconOverride: PlugZap,
                         customView: ResourceLayoutPreset_Read_SsoSaml,
@@ -412,6 +480,21 @@ export function buildSecurityMainPresets() {
         }, scimProvisioningConfigPolymorphicFactories[R.ORGANIZATION_SCIM_PROVISIONING_CONFIG], ScimProvisioningConfigBaseSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
             icon: UserCog,
             layout: {
+                // Settings-page chrome (Settings Hub): label-left / value-right rows. A scope-level
+                // configuration record is READ far more often than it is edited — an operator opens it to
+                // confirm a value — so the DISPLAY side needs the row treatment at least as much as the form.
+                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.INLINE, edit: EditChromeMode.SETTINGS_ROW },
+                // SCIM provisioning policy — a scope-level configuration record. A settings pane is a list of decisions an operator came to TAKE, so its
+                // writable fields are offered in place rather than behind a whole-pane edit mode. The set is
+                // DERIVED (not primary key, not excludeFromUpdate, not hidden, not opted out), so a field
+                // added to this schema tomorrow is covered without anyone remembering to decorate it.
+                defaultInlineEdit: ResourceLayoutInlineEditDefault.WRITABLE_FIELDS,
+                // And its empty rows say WHICH emptiness they are — "None yet" for a list with no members,
+                // "Not available" for a computed value, "No value" for a field awaiting input — instead of one
+                // em dash standing for all three. The surface policy's dash is right where a reader is scanning;
+                // on a settings row, which is read one at a time to decide something, it is an answer that
+                // refuses to answer.
+                defaultEmptyValue: 'placeholder',
                 refs: {
                     sections: ['overview', 'mapping', 'lifecycle'],
                 },
@@ -420,6 +503,11 @@ export function buildSecurityMainPresets() {
             },
             views: [
                 [Op.READ, addressable()],
+                // The four decisions on this row — create users, verify their email, deactivate on
+                // deprovision, and the role they land with — are what an operator opens SCIM settings to set,
+                // and none of them was settable: the literal UPDATE was INTERNAL_CALL. Not addressable — it
+                // opens from the READ view, like SIEM export config's (#953).
+                [Op.UPDATE, notAddressable()],
             ],
             variantOverrides: {
                 [R.APPLICATION]: { views: [] },
@@ -440,7 +528,18 @@ export function buildSecurityMainPresets() {
                 summary: ScimTokenSummaryTemplate,
             },
             views: [
-                [Op.LIST, addressable()],
+                // A token registry: name, status, last used, expiry. Comparable rows.
+                // CARDS is the framework default and nothing had ever declared otherwise, so every
+                // collection in the product rendered as stacked cards — ~150px per row, four people to a
+                // viewport, with each field's help text and label repeated on every card. TABLE writes the
+                // headers once. `userSwitchableDisplayMode` keeps cards one click away rather than removing
+                // a rendering somebody may prefer on a narrow screen.
+                [Op.LIST, addressable({
+                        collectionDisplayConfig: {
+                            displayMode: CollectionDisplayMode.TABLE,
+                            userSwitchableDisplayMode: true,
+                        },
+                    })],
                 [ScimTokens_Operations.GENERATE_TOKEN, notAddressable({ iconOverride: KeyRound })],
                 [ScimTokens_Operations.REVOKE_TOKEN, notAddressable({ iconOverride: ShieldX })],
                 [ScimTokens_Operations.ROTATE_TOKEN, notAddressable({ iconOverride: RotateCw })],
@@ -450,6 +549,47 @@ export function buildSecurityMainPresets() {
 }
 export function buildSecurityAdminPresets(main) {
     return {
+        /**
+         * The APPLICATION-wide audit trail — the same rows the organization door serves, read across
+         * every tenant instead of inside one.
+         *
+         * A separate resource rather than a polymorphic variant of `AUDIT_LOGS`, which is why this is a
+         * second entry and not a `variantOverrides` block: the two doors differ in what a read MEANS, not
+         * only in scope. Every read here is a declared crossing (`admitsCrossTenantPlatformAdministration`)
+         * and emits one crossing event per tenant reached, and under an `INDEPENDENT_APPROVAL` audit
+         * policy it additionally needs a two-person `applicationAccessGrants` window. None of that is true
+         * of the tenant door.
+         *
+         * It shares `AuditableEvent_BaseSchema` and therefore both templates verbatim: an audit event is
+         * the same object whichever door served it, and giving the operator a differently-shaped row would
+         * be a difference with no meaning behind it.
+         *
+         * NO `EXPORT_AUDIT_LOGS`: the application factory declares READ, LIST and SEARCH and no custom
+         * operation, so naming the export here would name an operation that does not exist.
+         */
+        [R.APPLICATION_AUDIT_LOGS]: resourceUIBehavior(applicationAuditLogsFactory, AuditableEvent_BaseSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
+            icon: ShieldCheck,
+            getFrontendResourceLabel: ({ currentObject }) => `${currentObject.eventType ?? 'Audit Event'} — ${currentObject.createdAt?.toISOString?.() ?? ''}`,
+            layout: {
+                refs: {
+                    sections: ['overview', 'actors', 'payload'],
+                },
+                display: AuditLogDisplayTemplate,
+                summary: AuditLogSummaryTemplate,
+            },
+            views: [
+                [Op.READ, notAddressable()],
+                // Same dashboard capabilities as the tenant door — `severity` is in this operation's own
+                // declared `filterFields` and `createdAt` is a summary field, so both cues resolve here too.
+                [Op.LIST, addressable({
+                        collectionDisplayConfig: {
+                            quickFilterField: 'severity',
+                            temporalGroupField: 'createdAt',
+                        },
+                    })],
+                [Op.SEARCH, addressable()],
+            ],
+        })),
         ...polymorphicResourceUIBehaviorFrom({
             variants: [
                 { parentResourceType: R.ORGANIZATIONS, resourceType: R.ORGANIZATION_SIEM_EXPORT_CONFIG },
@@ -461,6 +601,11 @@ export function buildSecurityAdminPresets(main) {
             fields: base.fields,
             views: [
                 [Op.READ, addressable()],
+                // The admin app's own edit door for the APP-scope row. The `main` preset above declares
+                // the same view for the ORG-scope pane; this block is the SECOND lane, and the two carry
+                // the same operation set for a reason — an app super-administrator reading a
+                // configuration record here is reading it to change it.
+                [Op.UPDATE, notAddressable()],
             ],
             variantOverrides: {
                 [R.ORGANIZATIONS]: {
@@ -519,6 +664,11 @@ export function buildSecurityAdminPresets(main) {
             layout: base.layout,
             views: [
                 [Op.READ, addressable()],
+                // The admin app's own edit door for the APP-scope row. The `main` preset above declares
+                // the same view for the ORG-scope pane; this block is the SECOND lane, and the two carry
+                // the same operation set for a reason — an app super-administrator reading a
+                // configuration record here is reading it to change it.
+                [Op.UPDATE, notAddressable()],
                 [SsoConfig_Operations.CLAIM_DOMAIN, notAddressable({ iconOverride: Globe })],
                 [SsoConfig_Operations.VERIFY_DOMAIN, notAddressable({ iconOverride: ShieldCheck })],
                 [SsoConfig_Operations.REVOKE_DOMAIN, notAddressable({ iconOverride: Unlink })],
@@ -569,6 +719,11 @@ export function buildSecurityAdminPresets(main) {
             layout: base.layout,
             views: [
                 [Op.READ, addressable()],
+                // The admin app's own edit door for the APP-scope row. The `main` preset above declares
+                // the same view for the ORG-scope pane; this block is the SECOND lane, and the two carry
+                // the same operation set for a reason — an app super-administrator reading a
+                // configuration record here is reading it to change it.
+                [Op.UPDATE, notAddressable()],
             ],
             variantOverrides: {
                 [R.ORGANIZATIONS]: {
@@ -625,4 +780,5 @@ export const securityAdminPresets = buildSecurityAdminPresets(securityMainPreset
 export const orgApiKeysMainResourceUIBehavior = securityMainPresets[R.ORG_API_KEYS];
 export const orgApiKeysAdminResourceUIBehavior = securityAdminPresets[R.ORG_API_KEYS];
 export const auditLogsMainResourceUIBehavior = securityMainPresets[R.AUDIT_LOGS];
+export const applicationAuditLogsAdminResourceUIBehavior = securityAdminPresets[R.APPLICATION_AUDIT_LOGS];
 //# sourceMappingURL=security.resource-presets.js.map