@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/security/authorizations/application-wide-read-admission.backend.d.ts

@@ -0,0 +1,84 @@
+/**
+ * # Which reads require an APPLICATION-WIDE elevation
+ *
+ * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a read that spans every tenant is
+ * admitted only under a requested, justified, time-bound, second-signed grant.
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+ *
+ * ## The inversion this closes
+ *
+ * Measured 2026-09-09. A PER-ROW crossing into ONE tenant required a usable `platformAccessGrants`
+ * row: requested, justified, approved by that tenant, and expiring on its own. The APPLICATION-WIDE
+ * read — the whole user directory, the whole cross-tenant audit trail — required nothing but an
+ * administrator role, and sat at a LOWER role tier. The narrow act carried elevation and expiry; the
+ * widest read did not.
+ *
+ * ## The rule, stated once
+ *
+ * > **A read that this deployment can already SEE as application-wide requires an application-wide
+ * > grant.**
+ *
+ * "Can already see" is not a new judgement. Two authorities already answer it, and they are the two
+ * that decide what the audit trail RECORDS:
+ *
+ * | authority | the population it names | the evidence it produces |
+ * |---|---|---|
+ * | {@link isUnconfinedScopeRootDirectoryRead} | a scope-root collection read the confinement authority declines to confine | `PLATFORM_DIRECTORY_ACCESS` |
+ * | {@link isObservedCrossTenantRead} | a DECLARED cross-tenant read on an APPLICATION-scoped resource | `CROSS_TENANT_ADMINISTRATIVE_ACCESS` |
+ *
+ * **This module composes those two and adds no third derivation.** That is the point rather than an
+ * economy: the admission and the observation must agree about which reads are in scope, or the trail
+ * records elevations the gate never required (or, worse, the gate refuses reads the trail says
+ * nothing about). `.claude/rules/invariant-call-site-enumeration.md` is a catalogue of what a second
+ * look-alike derivation of one predicate costs.
+ *
+ * ## What it deliberately does NOT gate
+ *
+ * **The per-row tenant crossing.** That door already works — a usable `platformAccessGrants` row,
+ * scoped to the named tenant, approved by that tenant where the tenant opted in. Requiring an
+ * application-wide grant there too would replace a customer-approvable control with a
+ * platform-internal one, which is a step DOWN the ladder in
+ * `.claude/rules/administrative-continuity-floors.md`. The finding says so in as many words: do not
+ * weaken the per-row model to make the two symmetric.
+ *
+ * **The grant resources themselves.** An operator would otherwise need an application-wide grant in
+ * order to ask for one, and the second administrator would need one in order to sign. Both grant
+ * resources are exempt WHOLESALE rather than per verb, and that is wider than the tenant resource's
+ * `requestAccess`-only exemption on purpose: `applicationAccessGrants` is APPLICATION-scoped, so its
+ * own `list` — the pending queue a second administrator works from — is a scope-root-adjacent
+ * application-tier read, and gating the queue on a grant would make the approval flow unreachable.
+ * The exemption is safe for the same reason the tenant one is: these rows are the elevation LEDGER,
+ * they belong to no tenant, and reading them discloses no customer's data.
+ *
+ * **An exempt execution type.** Both underlying authorities already skip
+ * `INTERNALLY_INITIATED_REQUEST` and `WEBHOOK_CALLBACK`; gating a batch, a cron, a cascade or a
+ * verified webhook on a human's elevation would fail closed on every sweep in the system. Inherited
+ * rather than restated, so the three answers cannot drift.
+ */
+import { CoreResourceOperation } from '@wildo-ai/saas-models';
+import { type ScopeRootCollectionConfinementSignal } from '../../security/authorizations/scope-root-collection-confinement.backend';
+import { type CrossTenantReadObservationOperation } from '../../security/authorizations/cross-tenant-read-observation.backend';
+/** What this authority needs from the resource configuration. Deliberately narrow, like its siblings. */
+export interface ApplicationWideReadAdmissionResource {
+    readonly resourceIdentifier?: string;
+    readonly resourcePrimaryScope?: string;
+}
+/**
+ * Does this read reach application-wide, and therefore owe an application-wide elevation?
+ *
+ * Returns `false` for everything else, which is the overwhelming majority of reads — the two
+ * authorities it composes are both narrow by construction, so a caller pays two boolean checks and a
+ * set lookup on the ordinary path.
+ */
+export declare function readRequiresApplicationWideGrant(params: {
+    readonly executionContext: ScopeRootCollectionConfinementSignal;
+    /**
+     * The EXECUTED operation variant. Passed explicitly for the reason the observation authority
+     * documents: a resource authors ONE variant per operation and the config factory derives `summary`
+     * and `context` variants from it, so "the operation" is ambiguous unless the executed one is named.
+     */
+    readonly operation: CrossTenantReadObservationOperation | undefined;
+    readonly resourceConfiguration: ApplicationWideReadAdmissionResource;
+    readonly executedCoreOperation: CoreResourceOperation | undefined;
+}): boolean;
+//# sourceMappingURL=application-wide-read-admission.backend.d.ts.map

package/dist/esm/security/authorizations/application-wide-read-admission.backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-wide-read-admission.backend.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/application-wide-read-admission.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EACL,qBAAqB,EAEtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,oCAAoC,EAC1C,MAAM,sFAAsF,CAAC;AAC9F,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,kFAAkF,CAAC;AAc1F,yGAAyG;AACzG,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE;IACvD,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,CAAC;IAChE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;IACrE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACnE,GAAG,OAAO,CAoBV"}

package/dist/esm/security/authorizations/application-wide-read-admission.backend.js

@@ -0,0 +1,99 @@
+/**
+ * # Which reads require an APPLICATION-WIDE elevation
+ *
+ * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a read that spans every tenant is
+ * admitted only under a requested, justified, time-bound, second-signed grant.
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+ *
+ * ## The inversion this closes
+ *
+ * Measured 2026-09-09. A PER-ROW crossing into ONE tenant required a usable `platformAccessGrants`
+ * row: requested, justified, approved by that tenant, and expiring on its own. The APPLICATION-WIDE
+ * read — the whole user directory, the whole cross-tenant audit trail — required nothing but an
+ * administrator role, and sat at a LOWER role tier. The narrow act carried elevation and expiry; the
+ * widest read did not.
+ *
+ * ## The rule, stated once
+ *
+ * > **A read that this deployment can already SEE as application-wide requires an application-wide
+ * > grant.**
+ *
+ * "Can already see" is not a new judgement. Two authorities already answer it, and they are the two
+ * that decide what the audit trail RECORDS:
+ *
+ * | authority | the population it names | the evidence it produces |
+ * |---|---|---|
+ * | {@link isUnconfinedScopeRootDirectoryRead} | a scope-root collection read the confinement authority declines to confine | `PLATFORM_DIRECTORY_ACCESS` |
+ * | {@link isObservedCrossTenantRead} | a DECLARED cross-tenant read on an APPLICATION-scoped resource | `CROSS_TENANT_ADMINISTRATIVE_ACCESS` |
+ *
+ * **This module composes those two and adds no third derivation.** That is the point rather than an
+ * economy: the admission and the observation must agree about which reads are in scope, or the trail
+ * records elevations the gate never required (or, worse, the gate refuses reads the trail says
+ * nothing about). `.claude/rules/invariant-call-site-enumeration.md` is a catalogue of what a second
+ * look-alike derivation of one predicate costs.
+ *
+ * ## What it deliberately does NOT gate
+ *
+ * **The per-row tenant crossing.** That door already works — a usable `platformAccessGrants` row,
+ * scoped to the named tenant, approved by that tenant where the tenant opted in. Requiring an
+ * application-wide grant there too would replace a customer-approvable control with a
+ * platform-internal one, which is a step DOWN the ladder in
+ * `.claude/rules/administrative-continuity-floors.md`. The finding says so in as many words: do not
+ * weaken the per-row model to make the two symmetric.
+ *
+ * **The grant resources themselves.** An operator would otherwise need an application-wide grant in
+ * order to ask for one, and the second administrator would need one in order to sign. Both grant
+ * resources are exempt WHOLESALE rather than per verb, and that is wider than the tenant resource's
+ * `requestAccess`-only exemption on purpose: `applicationAccessGrants` is APPLICATION-scoped, so its
+ * own `list` — the pending queue a second administrator works from — is a scope-root-adjacent
+ * application-tier read, and gating the queue on a grant would make the approval flow unreachable.
+ * The exemption is safe for the same reason the tenant one is: these rows are the elevation LEDGER,
+ * they belong to no tenant, and reading them discloses no customer's data.
+ *
+ * **An exempt execution type.** Both underlying authorities already skip
+ * `INTERNALLY_INITIATED_REQUEST` and `WEBHOOK_CALLBACK`; gating a batch, a cron, a cascade or a
+ * verified webhook on a human's elevation would fail closed on every sweep in the system. Inherited
+ * rather than restated, so the three answers cannot drift.
+ */
+import { CoreResourceType, } from '@wildo-ai/saas-models';
+import { isUnconfinedScopeRootDirectoryRead, } from '../../security/authorizations/scope-root-collection-confinement.backend.js';
+import { isObservedCrossTenantRead, } from '../../security/authorizations/cross-tenant-read-observation.backend.js';
+/**
+ * The elevation LEDGER itself — never gated on an elevation.
+ *
+ * A set rather than two comparisons so the enumeration is readable, and so a third grant resource (a
+ * future scope) is added in one place instead of being discovered by an operator who cannot request
+ * access to request access.
+ */
+const ACCESS_GRANT_LEDGER_RESOURCES = Object.freeze([
+    String(CoreResourceType.PLATFORM_ACCESS_GRANTS),
+    String(CoreResourceType.APPLICATION_ACCESS_GRANTS),
+]);
+/**
+ * Does this read reach application-wide, and therefore owe an application-wide elevation?
+ *
+ * Returns `false` for everything else, which is the overwhelming majority of reads — the two
+ * authorities it composes are both narrow by construction, so a caller pays two boolean checks and a
+ * set lookup on the ordinary path.
+ */
+export function readRequiresApplicationWideGrant(params) {
+    // The ledger is exempt WHOLESALE — see the module JSDoc. Checked FIRST so no later branch can make
+    // the approval flow unreachable.
+    if (ACCESS_GRANT_LEDGER_RESOURCES.includes(String(params.resourceConfiguration.resourceIdentifier ?? ''))) {
+        return false;
+    }
+    // Composed, never re-derived. Either authority answering `true` is an application-wide read.
+    if (isUnconfinedScopeRootDirectoryRead({
+        executionContext: params.executionContext,
+        resourceConfiguration: params.resourceConfiguration,
+        executedCoreOperation: params.executedCoreOperation,
+    }))
+        return true;
+    return isObservedCrossTenantRead({
+        executionContext: params.executionContext,
+        operation: params.operation,
+        resourceConfiguration: params.resourceConfiguration,
+        executedCoreOperation: params.executedCoreOperation,
+    });
+}
+//# sourceMappingURL=application-wide-read-admission.backend.js.map

package/dist/esm/security/authorizations/application-wide-read-admission.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-wide-read-admission.backend.js","sourceRoot":"","sources":["../../../../src/security/authorizations/application-wide-read-admission.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAEL,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kCAAkC,GAEnC,MAAM,sFAAsF,CAAC;AAC9F,OAAO,EACL,yBAAyB,GAE1B,MAAM,kFAAkF,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAsB,MAAM,CAAC,MAAM,CAAC;IACrE,MAAM,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IAC/C,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;CACnD,CAAC,CAAC;AAQH;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,MAUhD;IACC,mGAAmG;IACnG,iCAAiC;IACjC,IAAI,6BAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1G,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6FAA6F;IAC7F,IAAI,kCAAkC,CAAC;QACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhB,OAAO,yBAAyB,CAAC;QAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * # Which reads require an APPLICATION-WIDE elevation\n *\n * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a read that spans every tenant is\n * admitted only under a requested, justified, time-bound, second-signed grant.\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE\n *\n * ## The inversion this closes\n *\n * Measured 2026-09-09. A PER-ROW crossing into ONE tenant required a usable `platformAccessGrants`\n * row: requested, justified, approved by that tenant, and expiring on its own. The APPLICATION-WIDE\n * read — the whole user directory, the whole cross-tenant audit trail — required nothing but an\n * administrator role, and sat at a LOWER role tier. The narrow act carried elevation and expiry; the\n * widest read did not.\n *\n * ## The rule, stated once\n *\n * > **A read that this deployment can already SEE as application-wide requires an application-wide\n * > grant.**\n *\n * \"Can already see\" is not a new judgement. Two authorities already answer it, and they are the two\n * that decide what the audit trail RECORDS:\n *\n * | authority | the population it names | the evidence it produces |\n * |---|---|---|\n * | {@link isUnconfinedScopeRootDirectoryRead} | a scope-root collection read the confinement authority declines to confine | `PLATFORM_DIRECTORY_ACCESS` |\n * | {@link isObservedCrossTenantRead} | a DECLARED cross-tenant read on an APPLICATION-scoped resource | `CROSS_TENANT_ADMINISTRATIVE_ACCESS` |\n *\n * **This module composes those two and adds no third derivation.** That is the point rather than an\n * economy: the admission and the observation must agree about which reads are in scope, or the trail\n * records elevations the gate never required (or, worse, the gate refuses reads the trail says\n * nothing about). `.claude/rules/invariant-call-site-enumeration.md` is a catalogue of what a second\n * look-alike derivation of one predicate costs.\n *\n * ## What it deliberately does NOT gate\n *\n * **The per-row tenant crossing.** That door already works — a usable `platformAccessGrants` row,\n * scoped to the named tenant, approved by that tenant where the tenant opted in. Requiring an\n * application-wide grant there too would replace a customer-approvable control with a\n * platform-internal one, which is a step DOWN the ladder in\n * `.claude/rules/administrative-continuity-floors.md`. The finding says so in as many words: do not\n * weaken the per-row model to make the two symmetric.\n *\n * **The grant resources themselves.** An operator would otherwise need an application-wide grant in\n * order to ask for one, and the second administrator would need one in order to sign. Both grant\n * resources are exempt WHOLESALE rather than per verb, and that is wider than the tenant resource's\n * `requestAccess`-only exemption on purpose: `applicationAccessGrants` is APPLICATION-scoped, so its\n * own `list` — the pending queue a second administrator works from — is a scope-root-adjacent\n * application-tier read, and gating the queue on a grant would make the approval flow unreachable.\n * The exemption is safe for the same reason the tenant one is: these rows are the elevation LEDGER,\n * they belong to no tenant, and reading them discloses no customer's data.\n *\n * **An exempt execution type.** Both underlying authorities already skip\n * `INTERNALLY_INITIATED_REQUEST` and `WEBHOOK_CALLBACK`; gating a batch, a cron, a cascade or a\n * verified webhook on a human's elevation would fail closed on every sweep in the system. Inherited\n * rather than restated, so the three answers cannot drift.\n */\n\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n} from '@wildo-ai/saas-models';\n\nimport {\n  isUnconfinedScopeRootDirectoryRead,\n  type ScopeRootCollectionConfinementSignal,\n} from '~wildo-backend-lib/security/authorizations/scope-root-collection-confinement.backend';\nimport {\n  isObservedCrossTenantRead,\n  type CrossTenantReadObservationOperation,\n} from '~wildo-backend-lib/security/authorizations/cross-tenant-read-observation.backend';\n\n/**\n * The elevation LEDGER itself — never gated on an elevation.\n *\n * A set rather than two comparisons so the enumeration is readable, and so a third grant resource (a\n * future scope) is added in one place instead of being discovered by an operator who cannot request\n * access to request access.\n */\nconst ACCESS_GRANT_LEDGER_RESOURCES: readonly string[] = Object.freeze([\n  String(CoreResourceType.PLATFORM_ACCESS_GRANTS),\n  String(CoreResourceType.APPLICATION_ACCESS_GRANTS),\n]);\n\n/** What this authority needs from the resource configuration. Deliberately narrow, like its siblings. */\nexport interface ApplicationWideReadAdmissionResource {\n  readonly resourceIdentifier?: string;\n  readonly resourcePrimaryScope?: string;\n}\n\n/**\n * Does this read reach application-wide, and therefore owe an application-wide elevation?\n *\n * Returns `false` for everything else, which is the overwhelming majority of reads — the two\n * authorities it composes are both narrow by construction, so a caller pays two boolean checks and a\n * set lookup on the ordinary path.\n */\nexport function readRequiresApplicationWideGrant(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  /**\n   * The EXECUTED operation variant. Passed explicitly for the reason the observation authority\n   * documents: a resource authors ONE variant per operation and the config factory derives `summary`\n   * and `context` variants from it, so \"the operation\" is ambiguous unless the executed one is named.\n   */\n  readonly operation: CrossTenantReadObservationOperation | undefined;\n  readonly resourceConfiguration: ApplicationWideReadAdmissionResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n}): boolean {\n  // The ledger is exempt WHOLESALE — see the module JSDoc. Checked FIRST so no later branch can make\n  // the approval flow unreachable.\n  if (ACCESS_GRANT_LEDGER_RESOURCES.includes(String(params.resourceConfiguration.resourceIdentifier ?? ''))) {\n    return false;\n  }\n\n  // Composed, never re-derived. Either authority answering `true` is an application-wide read.\n  if (isUnconfinedScopeRootDirectoryRead({\n    executionContext: params.executionContext,\n    resourceConfiguration: params.resourceConfiguration,\n    executedCoreOperation: params.executedCoreOperation,\n  })) return true;\n\n  return isObservedCrossTenantRead({\n    executionContext: params.executionContext,\n    operation: params.operation,\n    resourceConfiguration: params.resourceConfiguration,\n    executedCoreOperation: params.executedCoreOperation,\n  });\n}\n"]}

package/dist/esm/security/authorizations/authorization-denial-audit.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-denial-audit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/authorization-denial-audit.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,6BAA6B,EAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAExF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAmBrD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,6BAA6B,CAAC;CAC7C,GAAG,MAAM,CAST;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMvE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,kBAAkB,EAAE,6BAA6B,GAChD,6BAA6B,GAAG,SAAS,CAiB3C;AAED,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC1C,wDAAwD;IACxD,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,eAAe,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,EAAE;IAAE,YAAY,CAAC,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAC5D,MAAM,EAAE;IACN,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,6BAA6B,CAAC;CAC7C,GACA,OAAO,CAAC,2BAA2B,CAAC,CAgCtC"}
+{"version":3,"file":"authorization-denial-audit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/authorization-denial-audit.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,6BAA6B,EAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAExF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;GAGG;AACH,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAmBrD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,6BAA6B,CAAC;CAC7C,GAAG,MAAM,CAST;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMvE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,kBAAkB,EAAE,6BAA6B,GAChD,6BAA6B,GAAG,SAAS,CAiB3C;AAED,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC1C,wDAAwD;IACxD,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,eAAe,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,EAAE;IAAE,YAAY,CAAC,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAC5D,MAAM,EAAE;IACN,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,6BAA6B,CAAC;CAC7C,GACA,OAAO,CAAC,2BAA2B,CAAC,CAgCtC"}

package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.d.ts

@@ -0,0 +1,116 @@
+/**
+ * # Cross-tenant READ observation — the half `authorizeOrganizations` structurally cannot see
+ *
+ * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a declared read across the tenant
+ * boundary leaves evidence, per tenant reached.
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+ *
+ * ## The gap this closes
+ *
+ * `CROSS_TENANT_ADMINISTRATIVE_ACCESS` is emitted from `authorizeOrganizations`, which runs on
+ * ORGANIZATIONS-scoped resources: it fetches a row, resolves the tenant that row belongs to, and
+ * records the crossing when the caller holds no organization-wide entry for it.
+ *
+ * An APPLICATION-scoped resource never traverses that path — there is no organization in its route
+ * and no per-row tenant gate — so a door that returns rows CARRYING an `organizationId` reaches
+ * every tenant with nothing written down. That is the same invariant applied at some of its sites
+ * (`.claude/rules/invariant-call-site-enumeration.md`), and the missing site is the one that hurts
+ * most: `APPLICATION_AUDIT_LOGS` is the operator's cross-tenant view of the audit trail itself, and
+ * the trail is the worst possible surface on which to make an operator read invisible
+ * (`.claude/rules/administrative-continuity-floors.md`).
+ *
+ * Measured 2026-09-09 over the real core registry: exactly FIVE resources are APPLICATION-scoped and
+ * declare a top-level `organizationId` — `applicationAuditLogs`, `auditLogs`, `consumableTokens`,
+ * `files` and `jobExecutions`. This is a small, enumerable population, not a framework-wide sweep.
+ *
+ * ## Why only a DECLARED crossing is observed
+ *
+ * `admissionDeclared: false` on that event means an ATTEMPTED crossing that no variant asked for,
+ * **and which was refused** — that is what its own field JSDoc says, and what a reviewer reads it
+ * as. A read here SUCCEEDS, so emitting `false` for an undeclared door would put a false sentence in
+ * the trail: it would describe a completed disclosure as a blocked attempt. Deriving the field from
+ * anywhere other than the variant's own flag would be a second derivation of one predicate, which is
+ * how a gate and its trail start disagreeing.
+ *
+ * So the enrolment rule is exact, and it is one act: **declaring
+ * `admitsCrossTenantPlatformAdministration` on a read variant is what puts that read in the trail.**
+ * The four sibling resources declare no crossing and are therefore unchanged. An UNDECLARED
+ * application-scoped door that returns foreign rows is a different defect — an undeclared crossing —
+ * and the answer to it is a declaration or a confinement, never an audit row that misdescribes
+ * itself.
+ *
+ * ## Why ORGANIZATIONS-scoped resources are excluded
+ *
+ * They already emit, from `authorizeOrganizations`, on the same event. Observing them here as well
+ * would double-record every declared crossing on `organizations` and `platformAccessGrants` — and a
+ * duplicated crossing is worse than a missing one, because a reviewer counting operator reaches
+ * would over-count without any way to tell.
+ *
+ * ## Why membership comes from ROLE ENTRIES
+ *
+ * The same reason its three siblings give: `initiatorIds.organizationId` names the one tenant the
+ * request is acting in, which cannot answer "is this caller a member of the tenant THIS ROW belongs
+ * to" for a result set spanning many. Role entries are the one input a request cannot author for
+ * itself. {@link resolveCallerOrganizationIds} is reused rather than re-derived so this observation
+ * and the confinement authorities can never disagree about who is a member.
+ */
+import { CoreResourceOperation } from '@wildo-ai/saas-models';
+import { type ScopeRootCollectionConfinementSignal } from '../../security/authorizations/scope-root-collection-confinement.backend';
+/**
+ * The EXECUTED operation variant — the one whose declaration decides enrolment.
+ *
+ * Passed explicitly rather than read off `executionContext.operation`, and that is a correctness
+ * requirement rather than a style choice. A resource authors ONE variant per operation and the
+ * config factory derives `summary` and `context` variants from it, so "the operation" is ambiguous
+ * unless the executed one is named; `authorizations.backend.service` already hedges by consulting
+ * BOTH the passed operation and the context's, which is the tell that the context's copy cannot be
+ * relied on. Taking it here means the enrolment decision and the `admissionDeclared` the emitter
+ * writes are read from the SAME object and cannot disagree — the failure this repository keeps
+ * paying for when one predicate is derived twice.
+ */
+export interface CrossTenantReadObservationOperation {
+    readonly admitsCrossTenantPlatformAdministration?: boolean;
+}
+/** What this authority needs from the resource configuration. Deliberately narrow, like its siblings. */
+export interface CrossTenantReadObservationResource {
+    readonly resourceIdentifier?: string;
+    readonly resourcePrimaryScope?: string;
+}
+/** One tenant reached by a single read, with the rows of that tenant it returned. */
+export interface CrossTenantReadCrossing {
+    readonly targetOrganizationId: string;
+    readonly targetResourceIds: string[];
+}
+/**
+ * Is this read enrolled in the crossing trail at all?
+ *
+ * Separated from the row walk so the decision can be pinned on its own, and so a caller pays nothing
+ * for a read that is not enrolled — which is every read of all but a handful of resources.
+ */
+export declare function isObservedCrossTenantRead(params: {
+    readonly executionContext: ScopeRootCollectionConfinementSignal;
+    readonly operation: CrossTenantReadObservationOperation | undefined;
+    readonly resourceConfiguration: CrossTenantReadObservationResource;
+    readonly executedCoreOperation: CoreResourceOperation | undefined;
+}): boolean;
+/**
+ * The distinct tenants a read reached into, and which of their rows it returned.
+ *
+ * Returns EMPTY when the read is not enrolled, when no returned row carries a tenant, or when every
+ * tenant reached is one the caller belongs to. Grouping by tenant rather than emitting per row is
+ * what bounds the trail: one operator read produces one row per TENANT reached, not one per record,
+ * and the audit row's own `organizationId` is then that tenant's — which is what makes the crossing
+ * visible in the reached tenant's own organization-scoped viewer, rather than only to the operator.
+ *
+ * `rows` accepts whatever the read returned — one object, an array, or nothing — because the three
+ * seams that call this differ in shape and normalising at each of them is how one of them would come
+ * to normalise differently.
+ */
+export declare function collectCrossTenantReadCrossings(params: {
+    readonly executionContext: ScopeRootCollectionConfinementSignal;
+    readonly operation: CrossTenantReadObservationOperation | undefined;
+    readonly resourceConfiguration: CrossTenantReadObservationResource;
+    readonly executedCoreOperation: CoreResourceOperation | undefined;
+    readonly rows: unknown;
+}): CrossTenantReadCrossing[];
+//# sourceMappingURL=cross-tenant-read-observation.backend.d.ts.map

package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-tenant-read-observation.backend.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/cross-tenant-read-observation.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EACL,qBAAqB,EAGtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,oCAAoC,EAC1C,MAAM,sFAAsF,CAAC;AAoC9F;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAC;CAC5D;AAED,yGAAyG;AACzG,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,CAAC;IAChE,QAAQ,CAAC,SAAS,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;IACnE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACnE,GAAG,OAAO,CAUV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,CAAC;IAChE,QAAQ,CAAC,SAAS,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;IACnE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,GAAG,uBAAuB,EAAE,CAiC5B"}

package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.js

@@ -0,0 +1,162 @@
+/**
+ * # Cross-tenant READ observation — the half `authorizeOrganizations` structurally cannot see
+ *
+ * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a declared read across the tenant
+ * boundary leaves evidence, per tenant reached.
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+ *
+ * ## The gap this closes
+ *
+ * `CROSS_TENANT_ADMINISTRATIVE_ACCESS` is emitted from `authorizeOrganizations`, which runs on
+ * ORGANIZATIONS-scoped resources: it fetches a row, resolves the tenant that row belongs to, and
+ * records the crossing when the caller holds no organization-wide entry for it.
+ *
+ * An APPLICATION-scoped resource never traverses that path — there is no organization in its route
+ * and no per-row tenant gate — so a door that returns rows CARRYING an `organizationId` reaches
+ * every tenant with nothing written down. That is the same invariant applied at some of its sites
+ * (`.claude/rules/invariant-call-site-enumeration.md`), and the missing site is the one that hurts
+ * most: `APPLICATION_AUDIT_LOGS` is the operator's cross-tenant view of the audit trail itself, and
+ * the trail is the worst possible surface on which to make an operator read invisible
+ * (`.claude/rules/administrative-continuity-floors.md`).
+ *
+ * Measured 2026-09-09 over the real core registry: exactly FIVE resources are APPLICATION-scoped and
+ * declare a top-level `organizationId` — `applicationAuditLogs`, `auditLogs`, `consumableTokens`,
+ * `files` and `jobExecutions`. This is a small, enumerable population, not a framework-wide sweep.
+ *
+ * ## Why only a DECLARED crossing is observed
+ *
+ * `admissionDeclared: false` on that event means an ATTEMPTED crossing that no variant asked for,
+ * **and which was refused** — that is what its own field JSDoc says, and what a reviewer reads it
+ * as. A read here SUCCEEDS, so emitting `false` for an undeclared door would put a false sentence in
+ * the trail: it would describe a completed disclosure as a blocked attempt. Deriving the field from
+ * anywhere other than the variant's own flag would be a second derivation of one predicate, which is
+ * how a gate and its trail start disagreeing.
+ *
+ * So the enrolment rule is exact, and it is one act: **declaring
+ * `admitsCrossTenantPlatformAdministration` on a read variant is what puts that read in the trail.**
+ * The four sibling resources declare no crossing and are therefore unchanged. An UNDECLARED
+ * application-scoped door that returns foreign rows is a different defect — an undeclared crossing —
+ * and the answer to it is a declaration or a confinement, never an audit row that misdescribes
+ * itself.
+ *
+ * ## Why ORGANIZATIONS-scoped resources are excluded
+ *
+ * They already emit, from `authorizeOrganizations`, on the same event. Observing them here as well
+ * would double-record every declared crossing on `organizations` and `platformAccessGrants` — and a
+ * duplicated crossing is worse than a missing one, because a reviewer counting operator reaches
+ * would over-count without any way to tell.
+ *
+ * ## Why membership comes from ROLE ENTRIES
+ *
+ * The same reason its three siblings give: `initiatorIds.organizationId` names the one tenant the
+ * request is acting in, which cannot answer "is this caller a member of the tenant THIS ROW belongs
+ * to" for a result set spanning many. Role entries are the one input a request cannot author for
+ * itself. {@link resolveCallerOrganizationIds} is reused rather than re-derived so this observation
+ * and the confinement authorities can never disagree about who is a member.
+ */
+import { CoreResourceOperation, ExecutionContext_ExecutionType, ResourcePrimaryScope, } from '@wildo-ai/saas-models';
+import { resolveCallerOrganizationIds, } from '../../security/authorizations/scope-root-collection-confinement.backend.js';
+import { INITIATOR_ORGANIZATION_CONFINEMENT_FIELD } from '../../security/authorizations/initiator-organization-confinement.backend.js';
+/**
+ * The read operations this observation covers.
+ *
+ * All three of the audit door's operations, deliberately. A per-instance READ is included even
+ * though it names one row: reading ONE tenant's audit row from a cross-tenant door is exactly the
+ * access the event exists to show, and covering only the collection verbs would leave the cheapest
+ * crossing — fetch by id — unrecorded.
+ *
+ * COUNT is absent because it returns no rows, so it discloses no tenant's data and this authority
+ * has nothing to attribute. That is a decision, not an omission: if a count is ever considered a
+ * disclosure, it needs a different event carrying a number, the way `PLATFORM_DIRECTORY_ACCESS` does.
+ */
+const OBSERVED_READ_OPERATIONS = [
+    CoreResourceOperation.READ,
+    CoreResourceOperation.LIST,
+    CoreResourceOperation.SEARCH,
+];
+/**
+ * Execution types that carry no operator to attribute.
+ *
+ * Mirrors {@link SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES} and is exempt for the same reason:
+ * `INTERNALLY_INITIATED_REQUEST` is the framework's context-free system actor (batch, cron, cascade,
+ * bootstrap, and the audit writer's own synthesised temp context) and `WEBHOOK_CALLBACK` is trusted
+ * after signature verification. Recording framework machinery as operator browsing would bury the
+ * signal this event exists to carry — and for the audit resources specifically it would make the
+ * retention scrub and the archive batch emit a crossing per tenant on every run.
+ */
+const OBSERVATION_EXEMPT_EXECUTION_TYPES = [
+    ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,
+    ExecutionContext_ExecutionType.WEBHOOK_CALLBACK,
+];
+/**
+ * Is this read enrolled in the crossing trail at all?
+ *
+ * Separated from the row walk so the decision can be pinned on its own, and so a caller pays nothing
+ * for a read that is not enrolled — which is every read of all but a handful of resources.
+ */
+export function isObservedCrossTenantRead(params) {
+    if (!params.executedCoreOperation)
+        return false;
+    if (!OBSERVED_READ_OPERATIONS.includes(params.executedCoreOperation))
+        return false;
+    if (OBSERVATION_EXEMPT_EXECUTION_TYPES.includes(params.executionContext.executionType))
+        return false;
+    // Only a DECLARED crossing — see the module JSDoc. This is also what keeps the enrolled set
+    // enumerable: `rg admitsCrossTenantPlatformAdministration` names every door in the trail.
+    if (params.operation?.admitsCrossTenantPlatformAdministration !== true)
+        return false;
+    // Already emitted by `authorizeOrganizations` for this scope; observing again would double-count.
+    if (params.resourceConfiguration.resourcePrimaryScope === String(ResourcePrimaryScope.ORGANIZATIONS))
+        return false;
+    return true;
+}
+/**
+ * The distinct tenants a read reached into, and which of their rows it returned.
+ *
+ * Returns EMPTY when the read is not enrolled, when no returned row carries a tenant, or when every
+ * tenant reached is one the caller belongs to. Grouping by tenant rather than emitting per row is
+ * what bounds the trail: one operator read produces one row per TENANT reached, not one per record,
+ * and the audit row's own `organizationId` is then that tenant's — which is what makes the crossing
+ * visible in the reached tenant's own organization-scoped viewer, rather than only to the operator.
+ *
+ * `rows` accepts whatever the read returned — one object, an array, or nothing — because the three
+ * seams that call this differ in shape and normalising at each of them is how one of them would come
+ * to normalise differently.
+ */
+export function collectCrossTenantReadCrossings(params) {
+    if (!isObservedCrossTenantRead(params))
+        return [];
+    const rows = Array.isArray(params.rows)
+        ? params.rows
+        : params.rows && typeof params.rows === 'object' ? [params.rows] : [];
+    if (rows.length === 0)
+        return [];
+    const callerOrganizationIds = new Set(resolveCallerOrganizationIds(params.executionContext));
+    const byTenant = new Map();
+    for (const row of rows) {
+        const record = row;
+        if (!record || typeof record !== 'object')
+            continue;
+        const rowOrganizationId = String(record[INITIATOR_ORGANIZATION_CONFINEMENT_FIELD] ?? '');
+        // A row with no tenant is not a crossing — it is application-wide data, which is the majority of
+        // the audit trail (94 of 127 rows on the dogfood application that motivated this door).
+        if (!rowOrganizationId)
+            continue;
+        if (callerOrganizationIds.has(rowOrganizationId))
+            continue;
+        const rowId = String(record._id ?? '');
+        const ids = byTenant.get(rowOrganizationId);
+        if (ids) {
+            if (rowId)
+                ids.push(rowId);
+        }
+        else {
+            byTenant.set(rowOrganizationId, rowId ? [rowId] : []);
+        }
+    }
+    return [...byTenant.entries()].map(([targetOrganizationId, targetResourceIds]) => ({
+        targetOrganizationId,
+        targetResourceIds,
+    }));
+}
+//# sourceMappingURL=cross-tenant-read-observation.backend.js.map

package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-tenant-read-observation.backend.js","sourceRoot":"","sources":["../../../../src/security/authorizations/cross-tenant-read-observation.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,4BAA4B,GAE7B,MAAM,sFAAsF,CAAC;AAC9F,OAAO,EAAE,wCAAwC,EAAE,MAAM,uFAAuF,CAAC;AAEjJ;;;;;;;;;;;GAWG;AACH,MAAM,wBAAwB,GAAqC;IACjE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,kCAAkC,GAA8C;IACpF,8BAA8B,CAAC,4BAA4B;IAC3D,8BAA8B,CAAC,gBAAgB;CAChD,CAAC;AA8BF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAKzC;IACC,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,kCAAkC,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACrG,4FAA4F;IAC5F,0FAA0F;IAC1F,IAAI,MAAM,CAAC,SAAS,EAAE,uCAAuC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrF,kGAAkG;IAClG,IAAI,MAAM,CAAC,qBAAqB,CAAC,oBAAoB,KAAK,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACnH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAM/C;IACC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAElD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAiD,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpD,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,wCAAwC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,iGAAiG;QACjG,wFAAwF;QACxF,IAAI,CAAC,iBAAiB;YAAE,SAAS;QACjC,IAAI,qBAAqB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAAE,SAAS;QAE3D,MAAM,KAAK,GAAG,MAAM,CAAE,MAA4B,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC5C,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,oBAAoB;QACpB,iBAAiB;KAClB,CAAC,CAAC,CAAC;AACN,CAAC","sourcesContent":["/**\n * # Cross-tenant READ observation — the half `authorizeOrganizations` structurally cannot see\n *\n * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a declared read across the tenant\n * boundary leaves evidence, per tenant reached.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n *\n * ## The gap this closes\n *\n * `CROSS_TENANT_ADMINISTRATIVE_ACCESS` is emitted from `authorizeOrganizations`, which runs on\n * ORGANIZATIONS-scoped resources: it fetches a row, resolves the tenant that row belongs to, and\n * records the crossing when the caller holds no organization-wide entry for it.\n *\n * An APPLICATION-scoped resource never traverses that path — there is no organization in its route\n * and no per-row tenant gate — so a door that returns rows CARRYING an `organizationId` reaches\n * every tenant with nothing written down. That is the same invariant applied at some of its sites\n * (`.claude/rules/invariant-call-site-enumeration.md`), and the missing site is the one that hurts\n * most: `APPLICATION_AUDIT_LOGS` is the operator's cross-tenant view of the audit trail itself, and\n * the trail is the worst possible surface on which to make an operator read invisible\n * (`.claude/rules/administrative-continuity-floors.md`).\n *\n * Measured 2026-09-09 over the real core registry: exactly FIVE resources are APPLICATION-scoped and\n * declare a top-level `organizationId` — `applicationAuditLogs`, `auditLogs`, `consumableTokens`,\n * `files` and `jobExecutions`. This is a small, enumerable population, not a framework-wide sweep.\n *\n * ## Why only a DECLARED crossing is observed\n *\n * `admissionDeclared: false` on that event means an ATTEMPTED crossing that no variant asked for,\n * **and which was refused** — that is what its own field JSDoc says, and what a reviewer reads it\n * as. A read here SUCCEEDS, so emitting `false` for an undeclared door would put a false sentence in\n * the trail: it would describe a completed disclosure as a blocked attempt. Deriving the field from\n * anywhere other than the variant's own flag would be a second derivation of one predicate, which is\n * how a gate and its trail start disagreeing.\n *\n * So the enrolment rule is exact, and it is one act: **declaring\n * `admitsCrossTenantPlatformAdministration` on a read variant is what puts that read in the trail.**\n * The four sibling resources declare no crossing and are therefore unchanged. An UNDECLARED\n * application-scoped door that returns foreign rows is a different defect — an undeclared crossing —\n * and the answer to it is a declaration or a confinement, never an audit row that misdescribes\n * itself.\n *\n * ## Why ORGANIZATIONS-scoped resources are excluded\n *\n * They already emit, from `authorizeOrganizations`, on the same event. Observing them here as well\n * would double-record every declared crossing on `organizations` and `platformAccessGrants` — and a\n * duplicated crossing is worse than a missing one, because a reviewer counting operator reaches\n * would over-count without any way to tell.\n *\n * ## Why membership comes from ROLE ENTRIES\n *\n * The same reason its three siblings give: `initiatorIds.organizationId` names the one tenant the\n * request is acting in, which cannot answer \"is this caller a member of the tenant THIS ROW belongs\n * to\" for a result set spanning many. Role entries are the one input a request cannot author for\n * itself. {@link resolveCallerOrganizationIds} is reused rather than re-derived so this observation\n * and the confinement authorities can never disagree about who is a member.\n */\n\nimport {\n  CoreResourceOperation,\n  ExecutionContext_ExecutionType,\n  ResourcePrimaryScope,\n} from '@wildo-ai/saas-models';\n\nimport {\n  resolveCallerOrganizationIds,\n  type ScopeRootCollectionConfinementSignal,\n} from '~wildo-backend-lib/security/authorizations/scope-root-collection-confinement.backend';\nimport { INITIATOR_ORGANIZATION_CONFINEMENT_FIELD } from '~wildo-backend-lib/security/authorizations/initiator-organization-confinement.backend';\n\n/**\n * The read operations this observation covers.\n *\n * All three of the audit door's operations, deliberately. A per-instance READ is included even\n * though it names one row: reading ONE tenant's audit row from a cross-tenant door is exactly the\n * access the event exists to show, and covering only the collection verbs would leave the cheapest\n * crossing — fetch by id — unrecorded.\n *\n * COUNT is absent because it returns no rows, so it discloses no tenant's data and this authority\n * has nothing to attribute. That is a decision, not an omission: if a count is ever considered a\n * disclosure, it needs a different event carrying a number, the way `PLATFORM_DIRECTORY_ACCESS` does.\n */\nconst OBSERVED_READ_OPERATIONS: readonly CoreResourceOperation[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.SEARCH,\n];\n\n/**\n * Execution types that carry no operator to attribute.\n *\n * Mirrors {@link SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES} and is exempt for the same reason:\n * `INTERNALLY_INITIATED_REQUEST` is the framework's context-free system actor (batch, cron, cascade,\n * bootstrap, and the audit writer's own synthesised temp context) and `WEBHOOK_CALLBACK` is trusted\n * after signature verification. Recording framework machinery as operator browsing would bury the\n * signal this event exists to carry — and for the audit resources specifically it would make the\n * retention scrub and the archive batch emit a crossing per tenant on every run.\n */\nconst OBSERVATION_EXEMPT_EXECUTION_TYPES: readonly ExecutionContext_ExecutionType[] = [\n  ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,\n  ExecutionContext_ExecutionType.WEBHOOK_CALLBACK,\n];\n\n/**\n * The EXECUTED operation variant — the one whose declaration decides enrolment.\n *\n * Passed explicitly rather than read off `executionContext.operation`, and that is a correctness\n * requirement rather than a style choice. A resource authors ONE variant per operation and the\n * config factory derives `summary` and `context` variants from it, so \"the operation\" is ambiguous\n * unless the executed one is named; `authorizations.backend.service` already hedges by consulting\n * BOTH the passed operation and the context's, which is the tell that the context's copy cannot be\n * relied on. Taking it here means the enrolment decision and the `admissionDeclared` the emitter\n * writes are read from the SAME object and cannot disagree — the failure this repository keeps\n * paying for when one predicate is derived twice.\n */\nexport interface CrossTenantReadObservationOperation {\n  readonly admitsCrossTenantPlatformAdministration?: boolean;\n}\n\n/** What this authority needs from the resource configuration. Deliberately narrow, like its siblings. */\nexport interface CrossTenantReadObservationResource {\n  readonly resourceIdentifier?: string;\n  readonly resourcePrimaryScope?: string;\n}\n\n/** One tenant reached by a single read, with the rows of that tenant it returned. */\nexport interface CrossTenantReadCrossing {\n  readonly targetOrganizationId: string;\n  readonly targetResourceIds: string[];\n}\n\n/**\n * Is this read enrolled in the crossing trail at all?\n *\n * Separated from the row walk so the decision can be pinned on its own, and so a caller pays nothing\n * for a read that is not enrolled — which is every read of all but a handful of resources.\n */\nexport function isObservedCrossTenantRead(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly operation: CrossTenantReadObservationOperation | undefined;\n  readonly resourceConfiguration: CrossTenantReadObservationResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n}): boolean {\n  if (!params.executedCoreOperation) return false;\n  if (!OBSERVED_READ_OPERATIONS.includes(params.executedCoreOperation)) return false;\n  if (OBSERVATION_EXEMPT_EXECUTION_TYPES.includes(params.executionContext.executionType)) return false;\n  // Only a DECLARED crossing — see the module JSDoc. This is also what keeps the enrolled set\n  // enumerable: `rg admitsCrossTenantPlatformAdministration` names every door in the trail.\n  if (params.operation?.admitsCrossTenantPlatformAdministration !== true) return false;\n  // Already emitted by `authorizeOrganizations` for this scope; observing again would double-count.\n  if (params.resourceConfiguration.resourcePrimaryScope === String(ResourcePrimaryScope.ORGANIZATIONS)) return false;\n  return true;\n}\n\n/**\n * The distinct tenants a read reached into, and which of their rows it returned.\n *\n * Returns EMPTY when the read is not enrolled, when no returned row carries a tenant, or when every\n * tenant reached is one the caller belongs to. Grouping by tenant rather than emitting per row is\n * what bounds the trail: one operator read produces one row per TENANT reached, not one per record,\n * and the audit row's own `organizationId` is then that tenant's — which is what makes the crossing\n * visible in the reached tenant's own organization-scoped viewer, rather than only to the operator.\n *\n * `rows` accepts whatever the read returned — one object, an array, or nothing — because the three\n * seams that call this differ in shape and normalising at each of them is how one of them would come\n * to normalise differently.\n */\nexport function collectCrossTenantReadCrossings(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly operation: CrossTenantReadObservationOperation | undefined;\n  readonly resourceConfiguration: CrossTenantReadObservationResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n  readonly rows: unknown;\n}): CrossTenantReadCrossing[] {\n  if (!isObservedCrossTenantRead(params)) return [];\n\n  const rows = Array.isArray(params.rows)\n    ? params.rows\n    : params.rows && typeof params.rows === 'object' ? [params.rows] : [];\n  if (rows.length === 0) return [];\n\n  const callerOrganizationIds = new Set(resolveCallerOrganizationIds(params.executionContext));\n\n  const byTenant = new Map<string, string[]>();\n  for (const row of rows) {\n    const record = row as Record<string, unknown> | null | undefined;\n    if (!record || typeof record !== 'object') continue;\n    const rowOrganizationId = String(record[INITIATOR_ORGANIZATION_CONFINEMENT_FIELD] ?? '');\n    // A row with no tenant is not a crossing — it is application-wide data, which is the majority of\n    // the audit trail (94 of 127 rows on the dogfood application that motivated this door).\n    if (!rowOrganizationId) continue;\n    if (callerOrganizationIds.has(rowOrganizationId)) continue;\n\n    const rowId = String((record as { _id?: unknown })._id ?? '');\n    const ids = byTenant.get(rowOrganizationId);\n    if (ids) {\n      if (rowId) ids.push(rowId);\n    } else {\n      byTenant.set(rowOrganizationId, rowId ? [rowId] : []);\n    }\n  }\n\n  return [...byTenant.entries()].map(([targetOrganizationId, targetResourceIds]) => ({\n    targetOrganizationId,\n    targetResourceIds,\n  }));\n}\n"]}

package/dist/esm/security/authorizations/initiator-organization-confinement.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initiator-organization-confinement.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/initiator-organization-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,oGAAoG;AACpG,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CAC5F;AAED,qFAAqF;AACrF,MAAM,WAAW,4CAA4C;IAC3D,iCAAiC,CAAC,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACrD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACpE;AAED,sFAAsF;AACtF,eAAO,MAAM,wCAAwC,mBAAmB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8CAA8C,CAAC,OAAO,SAAS,MAAM,EAAE,MAAM,EAAE;IAC7F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;IAClE,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,4CAA4C,CAAC;IACnE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3D,GAAG,OAAO,CAyDV"}
+{"version":3,"file":"initiator-organization-confinement.backend.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/initiator-organization-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,oGAAoG;AACpG,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CAC5F;AAED,qFAAqF;AACrF,MAAM,WAAW,4CAA4C;IAC3D,iCAAiC,CAAC,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACrD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACpE;AAED,sFAAsF;AACtF,eAAO,MAAM,wCAAwC,mBAAmB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8CAA8C,CAAC,OAAO,SAAS,MAAM,EAAE,MAAM,EAAE;IAC7F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;IAClE,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,4CAA4C,CAAC;IACnE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3D,GAAG,OAAO,CAyDV"}

package/dist/esm/security/authorizations/junction-scope-resolution.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"junction-scope-resolution.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/junction-scope-resolution.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,kEAAkE;AAClE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,YAAY,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,4EAA4E;AAC5E,MAAM,WAAW,2BAA2B;IAC1C,yBAAyB,CACvB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtB;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAOD;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE;IAC5D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iCAAiC,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/F,QAAQ,CAAC,2BAA2B,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;CAC7F,GAAG,GAAG,CAAC,MAAM,CAAC,CAcd;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE;IAC1F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iCAAiC,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,QAAQ,CAAC,wBAAwB,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,GAAG,SAAS,CAAC;IAC7F,QAAQ,CAAC,qBAAqB,EAAE,CAC9B,oBAAoB,EAAE,YAAY,KAC/B,2BAA2B,GAAG,SAAS,CAAC;CAC9C,GAAG,OAAO,CAAC,OAAO,CAAC,CAqCnB"}
+{"version":3,"file":"junction-scope-resolution.backend.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/junction-scope-resolution.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,kEAAkE;AAClE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,YAAY,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,4EAA4E;AAC5E,MAAM,WAAW,2BAA2B;IAC1C,yBAAyB,CACvB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACtB;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAOD;;;;;;GAMG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE;IAC5D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iCAAiC,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/F,QAAQ,CAAC,2BAA2B,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;CAC7F,GAAG,GAAG,CAAC,MAAM,CAAC,CAcd;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE;IAC1F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,SAAS,iCAAiC,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC;IAC1C,QAAQ,CAAC,wBAAwB,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,GAAG,SAAS,CAAC;IAC7F,QAAQ,CAAC,qBAAqB,EAAE,CAC9B,oBAAoB,EAAE,YAAY,KAC/B,2BAA2B,GAAG,SAAS,CAAC;CAC9C,GAAG,OAAO,CAAC,OAAO,CAAC,CAqCnB"}

package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.d.ts

@@ -177,21 +177,16 @@ export type OrganizationOwnerConferralResolver = () => string[];
  * Every ORGANIZATIONS-scope role key whose `inheritFrom` chain reaches `ORG_OWNER` — i.e. every role
  * whose holder passes an owner gate.
  *
- * Mirrors the authorization layer's own test: `authorize` admits a caller when
- * `getRoleHierarchy(heldRole, scope).includes(requiredRole)`. Deriving the set the same way is what
- * keeps the floor counting exactly the principals the gates would let through — an independently
- * written membership test is how the two would drift.
- *
- * `ORG_OWNER` itself is seeded unconditionally rather than being discovered by the walk. If an
- * application's role table somehow omitted the key, `getRoleHierarchy` would return an empty chain,
- * the conferring set would be empty, and the floor would then measure a population that is empty by
- * construction — refusing every removal forever while protecting nothing.
- *
- * APPLICATION-scope roles are never consulted: membership `roles` is the ORGANIZATIONS authority
- * axis, and `getRoleHierarchy` partitions the two tables precisely so an app-scoped role string that
- * happens to appear on a membership row confers nothing. The role-ceiling gate relies on the same
- * partition (see its `holdsPlatformSuperAdmin` scope qualifier); this module must not be the weaker
- * link.
+ * This floor's BINDING of the shared conferral derivation. The derivation itself — and the reasoning
+ * that used to be restated here and in the super-admin floor in two different sets of words — lives
+ * in {@link resolveRolesConferringAnchor}, including why the anchor is seeded unconditionally.
+ *
+ * Membership `roles` is the ORGANIZATIONS authority axis, so APPLICATION-scope roles are never
+ * consulted. That safety comes from RESOLUTION rather than from the field's type: membership `roles`
+ * is a free-form string on purpose (an application declares its own org roles), and what makes an
+ * app-scoped string written onto a membership row confer nothing is that `getRoleHierarchy` reads it
+ * against the ORGANIZATIONS table only. The role-ceiling gate relies on the same partition (see its
+ * `holdsPlatformSuperAdmin` scope qualifier); this module must not be the weaker link.
  */
 export declare function resolveOrganizationOwnerConferringRoles(authorizationsService: Pick<AuthorizationsBackendService, 'getOrgRoles' | 'getRoleHierarchy'>): string[];
 /**
@@ -524,11 +519,16 @@ export declare function readOwnerMembershipsForSubjects(params: {
  * *with management oversight*, and AC-2(7) requires privileged changes to be monitored — an audited,
  * per-request, non-default override is precisely that, and precisely not a standing bypass.
  *
- * ⚠️ The escape is only half a remedy while the tenant cannot be repaired afterwards. The industry
- * pattern is two-part — block at the tenant tier, repair from a higher one (GitHub: an Enterprise
- * owner re-owns the org; otherwise Support). Wildo has the block and not yet the repair door; see
- * O6 in `.claude/plans/last-organization-owner-floor.md`. Until that lands, an acknowledged breach
- * leaves a tenant that only an out-of-band write can rescue, which is why the default stays refuse.
+ * The industry pattern is two-part — block at the tenant tier, repair from a higher one (GitHub: an
+ * Enterprise owner re-owns the org; otherwise Support). Wildo has BOTH halves: the block is here, and
+ * the repair door is `organizationMembers.grantOwnership`, a platform-tier verb that promotes an
+ * existing member, writes only `roles`, additively, and is audited at CRITICAL with a mandatory
+ * justification. An acknowledged breach therefore leaves a tenant that cannot administer ITSELF, and
+ * that a platform operator can repair without an out-of-band write.
+ *
+ * ⚠️ The default still stays refuse. A repair door is an escalation someone has to notice and
+ * perform; it is not a reason to strand a tenant casually, and the tenant-tier answer remains
+ * "transfer ownership first".
  */
 export declare function assertOrganizationOwnerFloorForSubjectErasure(params: {
     subjectUserIds: readonly string[];