@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/security/authentications/siem/siem-export-config.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,sCAAsC,EAAE,MAAM,qCAAqC,CAAC;AAE7F,wEAAwE;AAExE,MAAM,CAAN,IAAY,2BAGX;AAHD,WAAY,2BAA2B;IACrC,2DAA4B,CAAA;IAC5B,wEAAyC,CAAA;AAC3C,CAAC,EAHW,2BAA2B,KAA3B,2BAA2B,QAGtC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,sCAAsC,GAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEpF,MAAM,CAAC,MAAM,4CAA4C,GAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE1F,wEAAwE;AAExE,MAAM,CAAC,MAAM,oCAAoC,GAAG,uCAAuC,CACzF,sCAAsC,EACtC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,2BAA2B;IAC5C,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACxG,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;iBACnD,CAAC;SACH;QACD,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE;YACjD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,4CAA4C;iBACzD,CAAC;SACH;KACF;CACF,CACF,CAAC"}
+{"version":3,"file":"siem-export-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,sCAAsC,EAAE,MAAM,qCAAqC,CAAC;AAE7F,wEAAwE;AAExE,MAAM,CAAC,MAAM,oCAAoC,GAAG,uCAAuC,CACzF,sCAAsC,EACtC;IACE,gBAAgB,EAAE,IAAI;IACtB,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,oEAAoE;IACpE,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,mCAAmC;IACnC,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACtI,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,qFAAqF;QACrF,wFAAwF;QACxF,sFAAsF;QACtF,4FAA4F;QAC5F,qFAAqF;QACrF,oFAAoF;QACpF,mFAAmF;QACnF,sFAAsF;QACtF,wFAAwF;QACxF,0EAA0E;QAC1E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,yEAAyE;QACzE,oFAAoF;QACpF,8EAA8E;QAC9E,+EAA+E;QAC/E,+DAA+D;QAC/D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SIEM Export Config Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...siemExportConfigPolymorphicFactories\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { siemExportConfigPolymorphicDeclaration } from './siem-export-config.shared.schemas';\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const siemExportConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n  siemExportConfigPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // Audit/SIEM dispatch loads the export config via `readAsSystem` to decide\n    // where to deliver events, independent of any user (READ). When the row is\n    // absent — a provisioned / migrated / pre-seed org that bypassed the\n    // `afterCreate` default-seed — that same userless login path lazily\n    // materialises the disabled-default row via `createAsSystem` (CREATE); see\n    // `AuthOrganizationConfigurationService.loadSiemExportConfig`. Both are\n    // system-context (the logging-in user is not the config's admin owner), so\n    // the resource opts BOTH verbs in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n      // materialised by the framework default-seed (repository tier) OR — when that\n      // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n      // userless login path via `createAsSystem` (`systemAccessPolicy.create` opts\n      // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n      // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n      // self-alerting on mere construction) on every login for a config-less org.\n      // No public HTTP create surface (config is seeded/bootstrapped, never\n      // self-serve). Same fix as the SCIM-tokens READ/UPDATE. Admin tier / MEDIUM.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): SIEM config edits reach this through\n      // the config service path — `AuthOrganizationConfigurationService.saveSiemExportConfig`\n      // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC. Must\n      // NOT be REPOSITORY_ONLY: `.update()` resolves the op via `getServiceOperationPathDefault`,\n      // which honours INTERNAL_CALL / API_CALL but NOT REPOSITORY_ONLY — a repository-only\n      // UPDATE throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical)\n      // whenever the save method runs. (`authCredential` masking is framework-driven via\n      // `.isWriteOnlySecret()`, so — unlike SSO's `socialCredentialOverrides` — there is no\n      // UPDATE custom-impl to keep in lockstep here.) No public HTTP update surface. Same fix\n      // as the CREATE above + the SCIM-tokens READ/UPDATE. Admin tier / MEDIUM.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n      // onParentDelete cascade so this one-per-scope SIEM-export-config row is physically\n      // removed when its owning org/app is deleted. Without a DELETE op the cascade\n      // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a\n      // config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/siem/siem-export-config.shared.schemas.d.ts

@@ -5,6 +5,19 @@
  * Nested sub-objects: eventFilter{}, delivery{}.
  * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
  *
+ * ── ORG variant is live; the APPLICATION variant is settable but INERT ─────────────
+ * The polymorphism below emits both an ORGANIZATION and an APPLICATION variant. Only the
+ * ORGANIZATION variant drives delivery today: the sole SIEM producer
+ * (`AuditEventDispatcherBackendService`) fans out per authenticated tenant (org) and reads
+ * this config via `loadSiemExportConfig(ec, ORGANIZATION, orgId)`. An app super-admin CAN
+ * create/enable `APPLICATION_SIEM_EXPORT_CONFIG` (it has its own custom-impl +
+ * APP_ADMIN_SUPER_ADMIN roles), but NO producer emits app-scoped deliveries, so an enabled
+ * app config silently delivers nothing. The APP variant is RESERVED / DORMANT until an
+ * app-scoped producer is built — see `AuditEventDispatcherBackendService.
+ * dispatchToOrganizationAuditSinks` for the rationale + the wiring it would need. (When
+ * that producer lands, or if this trap is hardened sooner, the app config surface should
+ * be gated/hidden until delivery actually works.)
+ *
  * @see auth-data-model-audit.md §2D
  */
 import { z } from 'zod';
@@ -14,10 +27,20 @@ export declare const SIEMAuthMethod: {
     readonly HMAC_SHA256: "hmac_sha256";
     readonly NONE: "none";
 };
+/**
+ * The wire formats a tenant's SIEM export can request.
+ *
+ * `OCSF` is the JSON-native security schema the category has standardised on (ITU ratification track
+ * to June 2026), and it is a PEER of the two text formats rather than a replacement: CEF and LEEF stay
+ * for tenants whose SIEM wants them. The difference that matters is representational — a
+ * security-audit envelope maps onto an OCSF CLASS natively, where CEF can only force it into a
+ * `csN` custom-string slot.
+ */
 export declare const SIEMEventFormat: {
     readonly JSON_STRUCTURED: "json_structured";
     readonly CEF: "cef";
     readonly LEEF: "leef";
+    readonly OCSF: "ocsf";
 };
 export declare const SIEMEventCategory: {
     readonly AUTHENTICATION: "authentication";
@@ -34,7 +57,7 @@ export declare const SIEMFilterSeverity: {
 export declare const SiemExportConfigBaseSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-    webhookUrl: z.ZodDefault<z.ZodURL>;
+    webhookUrl: z.ZodDefault<z.ZodUnion<[z.ZodURL, z.ZodLiteral<"">]>>;
     authMethod: z.ZodDefault<z.ZodEnum<{
         readonly BEARER_TOKEN: "bearer_token";
         readonly API_KEY_HEADER: "api_key_header";
@@ -47,6 +70,7 @@ export declare const SiemExportConfigBaseSchema: z.ZodObject<{
         readonly JSON_STRUCTURED: "json_structured";
         readonly CEF: "cef";
         readonly LEEF: "leef";
+        readonly OCSF: "ocsf";
     }>>;
     eventFilter: z.ZodObject<{
         categories: z.ZodDefault<z.ZodArray<z.ZodEnum<{
@@ -62,25 +86,25 @@ export declare const SiemExportConfigBaseSchema: z.ZodObject<{
             readonly CRITICAL: "critical";
         }>>;
         specificEventTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>;
     delivery: z.ZodObject<{
         batchSize: z.ZodDefault<z.ZodNumber>;
         batchWindowSeconds: z.ZodDefault<z.ZodNumber>;
         retryAttempts: z.ZodDefault<z.ZodNumber>;
         retryBackoffSeconds: z.ZodDefault<z.ZodNumber>;
         timeoutSeconds: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>;
     customHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     includeRawEventData: z.ZodDefault<z.ZodBoolean>;
     includeDeviceContext: z.ZodDefault<z.ZodBoolean>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type SiemExportConfigBase = z.infer<typeof SiemExportConfigBaseSchema>;
-export declare const siemExportConfigPolymorphicDeclaration: import("../../../index.js").PolymorphicSchemaDeclaration<z.ZodObject<{
+export declare const siemExportConfigPolymorphicDeclaration: import("../../..").PolymorphicSchemaDeclaration<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-    webhookUrl: z.ZodDefault<z.ZodURL>;
+    webhookUrl: z.ZodDefault<z.ZodUnion<[z.ZodURL, z.ZodLiteral<"">]>>;
     authMethod: z.ZodDefault<z.ZodEnum<{
         readonly BEARER_TOKEN: "bearer_token";
         readonly API_KEY_HEADER: "api_key_header";
@@ -93,6 +117,7 @@ export declare const siemExportConfigPolymorphicDeclaration: import("../../../in
         readonly JSON_STRUCTURED: "json_structured";
         readonly CEF: "cef";
         readonly LEEF: "leef";
+        readonly OCSF: "ocsf";
     }>>;
     eventFilter: z.ZodObject<{
         categories: z.ZodDefault<z.ZodArray<z.ZodEnum<{
@@ -108,18 +133,18 @@ export declare const siemExportConfigPolymorphicDeclaration: import("../../../in
             readonly CRITICAL: "critical";
         }>>;
         specificEventTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>;
     delivery: z.ZodObject<{
         batchSize: z.ZodDefault<z.ZodNumber>;
         batchWindowSeconds: z.ZodDefault<z.ZodNumber>;
         retryAttempts: z.ZodDefault<z.ZodNumber>;
         retryBackoffSeconds: z.ZodDefault<z.ZodNumber>;
         timeoutSeconds: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>;
     customHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     includeRawEventData: z.ZodDefault<z.ZodBoolean>;
     includeDeviceContext: z.ZodDefault<z.ZodBoolean>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip>>;
 //# sourceMappingURL=siem-export-config.shared.schemas.d.ts.map

package/dist/esm/security/authentications/siem/siem-export-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;CAMpB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAuCrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAMjD,CAAC"}
+{"version":3,"file":"siem-export-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;CAMpB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4DrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAMjD,CAAC"}

package/dist/esm/security/authentications/siem/siem-export-config.shared.schemas.js

@@ -5,6 +5,19 @@
  * Nested sub-objects: eventFilter{}, delivery{}.
  * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
  *
+ * ── ORG variant is live; the APPLICATION variant is settable but INERT ─────────────
+ * The polymorphism below emits both an ORGANIZATION and an APPLICATION variant. Only the
+ * ORGANIZATION variant drives delivery today: the sole SIEM producer
+ * (`AuditEventDispatcherBackendService`) fans out per authenticated tenant (org) and reads
+ * this config via `loadSiemExportConfig(ec, ORGANIZATION, orgId)`. An app super-admin CAN
+ * create/enable `APPLICATION_SIEM_EXPORT_CONFIG` (it has its own custom-impl +
+ * APP_ADMIN_SUPER_ADMIN roles), but NO producer emits app-scoped deliveries, so an enabled
+ * app config silently delivers nothing. The APP variant is RESERVED / DORMANT until an
+ * app-scoped producer is built — see `AuditEventDispatcherBackendService.
+ * dispatchToOrganizationAuditSinks` for the rationale + the wiring it would need. (When
+ * that producer lands, or if this trap is hardened sooner, the app config surface should
+ * be gated/hidden until delivery actually works.)
+ *
  * @see auth-data-model-audit.md §2D
  */
 import { z } from 'zod';
@@ -17,10 +30,20 @@ export const SIEMAuthMethod = {
     HMAC_SHA256: 'hmac_sha256',
     NONE: 'none',
 };
+/**
+ * The wire formats a tenant's SIEM export can request.
+ *
+ * `OCSF` is the JSON-native security schema the category has standardised on (ITU ratification track
+ * to June 2026), and it is a PEER of the two text formats rather than a replacement: CEF and LEEF stay
+ * for tenants whose SIEM wants them. The difference that matters is representational — a
+ * security-audit envelope maps onto an OCSF CLASS natively, where CEF can only force it into a
+ * `csN` custom-string slot.
+ */
 export const SIEMEventFormat = {
     JSON_STRUCTURED: 'json_structured',
     CEF: 'cef',
     LEEF: 'leef',
+    OCSF: 'ocsf',
 };
 export const SIEMEventCategory = {
     AUTHENTICATION: 'authentication',
@@ -37,9 +60,30 @@ export const SIEMFilterSeverity = {
 export const SiemExportConfigBaseSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
     enabled: z.boolean().default(false).isSummaryField(),
-    webhookUrl: z.url().default(''),
+    // Destination for exported audit events. The empty string is the DISABLED /
+    // not-yet-configured state (paired with `enabled: false`) and is the default
+    // for a freshly-seeded config — so the union MUST admit `''`. A bare
+    // `z.url().default('')` is self-contradictory: `z.url()` rejects `''`, so the
+    // default value fails output re-validation and every unconfigured row 500s on
+    // READ (`transformOutput`). Accept a real URL OR the empty sentinel.
+    webhookUrl: z.url().or(z.literal('')).default(''),
     authMethod: z.enum(SIEMAuthMethod).default(SIEMAuthMethod.NONE),
-    authCredential: z.string().optional().isBackendOnly(),
+    /**
+     * User-provided secret used to authenticate outbound webhook deliveries to the
+     * customer's SIEM endpoint (bearer token, API-key value, etc.).
+     *
+     * `.isWriteOnlySecret()` gives this the framework's write-then-masked-secret
+     * contract: it stays in the CREATE/UPDATE request DTO (the operator supplies
+     * and rotates it) and in the response DTO (so the UI renders a masked
+     * placeholder), but the framework redacts it to `••••••••` at the client
+     * boundary and treats a round-tripped `••••••••` on write as "keep the existing
+     * secret". The real value is retained for backend internal reads only — the
+     * webhook dispatcher reads it via `readAsSystem` to sign deliveries. Do NOT use
+     * `.isBackendOnly()` here: that strips the field from every client DTO, dropping
+     * the operator's typed value before it is stored and leaving the presets a field
+     * they cannot resolve.
+     */
+    authCredential: z.string().optional().isWriteOnlySecret(),
     authHeaderName: z.string().default(WildoHeaderKeys.API_KEY),
     eventFormat: z.enum(SIEMEventFormat).default(SIEMEventFormat.JSON_STRUCTURED),
     eventFilter: z.object({
@@ -73,4 +117,4 @@ export const siemExportConfigPolymorphicDeclaration = declarePolymorphicSchemas(
     baseSchema: SiemExportConfigBaseSchema,
     variants: AUTH_SCOPE_VARIANTS,
 });
-//# sourceMappingURL=siem-export-config.shared.schemas.js.map
+//# sourceMappingURL=siem-export-config.shared.schemas.js.map

package/dist/esm/security/authentications/siem/siem-export-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,eAAe,EAAE,iBAAiB;IAClC,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAE,eAAe;IAC9B,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;CAClB,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IAEpD,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACrD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC;IAE3D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC;IAE7E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;YACrD,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,WAAW;SAC9B,CAAC;QACF,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC5E,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACnD,CAAC;IAEF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACtD,CAAC;IAEF,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE/C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sCAAsC,GAAG,yBAAyB,CAAC;IAC9E,gBAAgB,EAAE,kBAAkB;IACpC,mBAAmB,EAAE,oBAAoB;IACzC,WAAW,EAAE,oBAAoB;IACjC,UAAU,EAAE,0BAA0B;IACtC,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC"}
+{"version":3,"file":"siem-export-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,eAAe,EAAE,iBAAiB;IAClC,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAE,eAAe;IAC9B,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;CAClB,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IAEpD,4EAA4E;IAC5E,6EAA6E;IAC7E,qEAAqE;IACrE,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC;IAC/D;;;;;;;;;;;;;;OAcG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IACzD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC;IAE3D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC;IAE7E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;YACrD,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,WAAW;SAC9B,CAAC;QACF,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC5E,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACnD,CAAC;IAEF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACtD,CAAC;IAEF,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE/C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sCAAsC,GAAG,yBAAyB,CAAC;IAC9E,gBAAgB,EAAE,kBAAkB;IACpC,mBAAmB,EAAE,oBAAoB;IACzC,WAAW,EAAE,oBAAoB;IACjC,UAAU,EAAE,0BAA0B;IACtC,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SIEM Export Config Schema (Shared) — Polymorphic\n *\n * Webhook configuration for exporting security audit events to external SIEM.\n * Nested sub-objects: eventFilter{}, delivery{}.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * ── ORG variant is live; the APPLICATION variant is settable but INERT ─────────────\n * The polymorphism below emits both an ORGANIZATION and an APPLICATION variant. Only the\n * ORGANIZATION variant drives delivery today: the sole SIEM producer\n * (`AuditEventDispatcherBackendService`) fans out per authenticated tenant (org) and reads\n * this config via `loadSiemExportConfig(ec, ORGANIZATION, orgId)`. An app super-admin CAN\n * create/enable `APPLICATION_SIEM_EXPORT_CONFIG` (it has its own custom-impl +\n * APP_ADMIN_SUPER_ADMIN roles), but NO producer emits app-scoped deliveries, so an enabled\n * app config silently delivers nothing. The APP variant is RESERVED / DORMANT until an\n * app-scoped producer is built — see `AuditEventDispatcherBackendService.\n * dispatchToOrganizationAuditSinks` for the rationale + the wiring it would need. (When\n * that producer lands, or if this trap is hardened sooner, the app config surface should\n * be gated/hidden until delivery actually works.)\n *\n * @see auth-data-model-audit.md §2D\n */\n\nimport { z } from 'zod';\nimport { WildoHeaderKeys } from '../../../requests/header-keys.shared';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const SIEMAuthMethod = {\n  BEARER_TOKEN: 'bearer_token',\n  API_KEY_HEADER: 'api_key_header',\n  HMAC_SHA256: 'hmac_sha256',\n  NONE: 'none',\n} as const;\n\n/**\n * The wire formats a tenant's SIEM export can request.\n *\n * `OCSF` is the JSON-native security schema the category has standardised on (ITU ratification track\n * to June 2026), and it is a PEER of the two text formats rather than a replacement: CEF and LEEF stay\n * for tenants whose SIEM wants them. The difference that matters is representational — a\n * security-audit envelope maps onto an OCSF CLASS natively, where CEF can only force it into a\n * `csN` custom-string slot.\n */\nexport const SIEMEventFormat = {\n  JSON_STRUCTURED: 'json_structured',\n  CEF: 'cef',\n  LEEF: 'leef',\n  OCSF: 'ocsf',\n} as const;\n\nexport const SIEMEventCategory = {\n  AUTHENTICATION: 'authentication',\n  AUTHORIZATION: 'authorization',\n  USER_LIFECYCLE: 'user_lifecycle',\n  ORG_MANAGEMENT: 'org_management',\n  DATA_ACCESS: 'data_access',\n} as const;\n\nexport const SIEMFilterSeverity = {\n  INFO: 'info',\n  WARNING: 'warning',\n  CRITICAL: 'critical',\n} as const;\n\nexport const SiemExportConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  enabled: z.boolean().default(false).isSummaryField(),\n\n  // Destination for exported audit events. The empty string is the DISABLED /\n  // not-yet-configured state (paired with `enabled: false`) and is the default\n  // for a freshly-seeded config — so the union MUST admit `''`. A bare\n  // `z.url().default('')` is self-contradictory: `z.url()` rejects `''`, so the\n  // default value fails output re-validation and every unconfigured row 500s on\n  // READ (`transformOutput`). Accept a real URL OR the empty sentinel.\n  webhookUrl: z.url().or(z.literal('')).default(''),\n\n  authMethod: z.enum(SIEMAuthMethod).default(SIEMAuthMethod.NONE),\n  /**\n   * User-provided secret used to authenticate outbound webhook deliveries to the\n   * customer's SIEM endpoint (bearer token, API-key value, etc.).\n   *\n   * `.isWriteOnlySecret()` gives this the framework's write-then-masked-secret\n   * contract: it stays in the CREATE/UPDATE request DTO (the operator supplies\n   * and rotates it) and in the response DTO (so the UI renders a masked\n   * placeholder), but the framework redacts it to `••••••••` at the client\n   * boundary and treats a round-tripped `••••••••` on write as \"keep the existing\n   * secret\". The real value is retained for backend internal reads only — the\n   * webhook dispatcher reads it via `readAsSystem` to sign deliveries. Do NOT use\n   * `.isBackendOnly()` here: that strips the field from every client DTO, dropping\n   * the operator's typed value before it is stored and leaving the presets a field\n   * they cannot resolve.\n   */\n  authCredential: z.string().optional().isWriteOnlySecret(),\n  authHeaderName: z.string().default(WildoHeaderKeys.API_KEY),\n\n  eventFormat: z.enum(SIEMEventFormat).default(SIEMEventFormat.JSON_STRUCTURED),\n\n  eventFilter: z.object({\n    categories: z.array(z.enum(SIEMEventCategory)).default([\n      SIEMEventCategory.AUTHENTICATION,\n      SIEMEventCategory.AUTHORIZATION,\n      SIEMEventCategory.USER_LIFECYCLE,\n      SIEMEventCategory.ORG_MANAGEMENT,\n      SIEMEventCategory.DATA_ACCESS,\n    ]),\n    severityMinimum: z.enum(SIEMFilterSeverity).default(SIEMFilterSeverity.INFO),\n    specificEventTypes: z.array(z.string()).optional(),\n  }),\n\n  delivery: z.object({\n    batchSize: z.number().min(1).max(100).default(1),\n    batchWindowSeconds: z.number().min(0).max(60).default(0),\n    retryAttempts: z.number().min(0).max(5).default(3),\n    retryBackoffSeconds: z.number().min(1).max(300).default(30),\n    timeoutSeconds: z.number().min(1).max(60).default(10),\n  }),\n\n  customHeaders: z.record(z.string(), z.string()).optional(),\n  includeRawEventData: z.boolean().default(true),\n  includeDeviceContext: z.boolean().default(true),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SiemExportConfigBase = z.infer<typeof SiemExportConfigBaseSchema>;\n\nexport const siemExportConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'siemExportConfig',\n  baseFieldIdentifier: 'siemExportConfigId',\n  baseEnumKey: 'SIEM_EXPORT_CONFIG',\n  baseSchema: SiemExportConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.d.ts

@@ -5,21 +5,6 @@
  * Spread into the registry factory map:
  *   ...ssoConfigPolymorphicFactories
  */
-import { z } from 'zod';
-import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions.js';
-export declare enum SsoConfig_Operations {
-    ADD_DOMAIN = "addDomain",
-    VERIFY_DOMAIN = "verifyDomain",
-    REMOVE_DOMAIN = "removeDomain"
-}
-export declare const SsoConfig_AddDomainRequestDto: z.ZodObject<{
-    domain: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export declare const SsoConfig_VerifyDomainRequestDto: z.ZodObject<{
-    domain: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export declare const SsoConfig_RemoveDomainRequestDto: z.ZodObject<{
-    domain: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export declare const ssoConfigPolymorphicFactories: Record<string, import("../../../index.js").ResourceConfiguration_InitializationFactory<typeof SsoConfig_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.CREATE, any>>;
+import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions';
+export declare const ssoConfigPolymorphicFactories: Record<string, import("../../..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE, any>>;
 //# sourceMappingURL=sso-config.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAW/G,oBAAY,oBAAoB;IAC9B,UAAU,cAAc;IACxB,aAAa,iBAAiB;IAC9B,aAAa,iBAAiB;CAC/B;AAID,eAAO,MAAM,6BAA6B;;uCAExC,CAAC;AAEH,eAAO,MAAM,gCAAgC;;uCAE3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;uCAE3C,CAAC;AAIH,eAAO,MAAM,6BAA6B,4MAiFzC,CAAC"}
+{"version":3,"file":"sso-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,eAAO,MAAM,6BAA6B,yNAoGzC,CAAC"}

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.js

@@ -5,34 +5,28 @@
  * Spread into the registry factory map:
  *   ...ssoConfigPolymorphicFactories
  */
-import { z } from 'zod';
 import { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../../resources/resources.shared.schemas.js';
 import { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory.js';
+import { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas.js';
 import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas.js';
 import { ssoConfigPolymorphicDeclaration } from './sso-config.shared.schemas.js';
-// ── Custom Operations ────────────────────────────────────────────────
-export var SsoConfig_Operations;
-(function (SsoConfig_Operations) {
-    SsoConfig_Operations["ADD_DOMAIN"] = "addDomain";
-    SsoConfig_Operations["VERIFY_DOMAIN"] = "verifyDomain";
-    SsoConfig_Operations["REMOVE_DOMAIN"] = "removeDomain";
-})(SsoConfig_Operations || (SsoConfig_Operations = {}));
-// ── Request DTOs ─────────────────────────────────────────────────────
-export const SsoConfig_AddDomainRequestDto = z.object({
-    domain: z.string(),
-});
-export const SsoConfig_VerifyDomainRequestDto = z.object({
-    domain: z.string(),
-});
-export const SsoConfig_RemoveDomainRequestDto = z.object({
-    domain: z.string(),
-});
 // ── Polymorphic Factory ──────────────────────────────────────────────
 export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurations(ssoConfigPolymorphicDeclaration, {
     isSystemResource: true,
-    customOperation: SsoConfig_Operations,
-    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE],
+    // The auth runtime loads the org SSO config via `readAsSystem` during login,
+    // before the user's roles/membership are established (READ). When the row is
+    // absent — a provisioned / migrated / pre-seed org that bypassed the
+    // `afterCreate` default-seed — that same userless login path lazily
+    // materialises the disabled-default row via `createAsSystem` (CREATE); see
+    // `AuthOrganizationConfigurationService.loadSSOConfig`. Both are system-context
+    // (the logging-in user is not the config's admin owner), so the resource opts
+    // BOTH verbs in.
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+    },
+    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],
     operationsConfiguration: {
         [CoreResourceOperation.READ]: {
             variants: [{
@@ -45,9 +39,20 @@ export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurat
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 }],
         },
+        // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is
+        // materialised by the framework default-seed (repository tier) OR — when that
+        // was bypassed (provisioned / migrated / pre-seed org) — lazily by the
+        // userless login path via `createAsSystem` (`systemAccessPolicy.create` opts
+        // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via
+        // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but
+        // NOT REPOSITORY_ONLY — a repository-only CREATE throws
+        // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and
+        // self-alerting on mere construction) on every login for a config-less org.
+        // No public HTTP create surface (config is seeded/bootstrapped, never
+        // self-serve). Same fix as the SCIM-tokens READ/UPDATE. Admin tier / HIGH.
         [CoreResourceOperation.CREATE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
@@ -56,9 +61,28 @@ export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurat
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                 }],
         },
+        // Internal-only (INTERNAL_CALL, NO HTTP route): admin policy edits reach this
+        // through the config service path — `AuthOrganizationConfigurationService.saveSSOConfig`
+        // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC,
+        // preserving admin audit attribution. `DomainVerificationBackendService` is currently
+        // bound but has no public operation wired to it, so this path is correct-but-dormant. Do
+        // not "simplify" the variant on the theory that nothing calls it: a future real domain
+        // workflow must be able to resolve this INTERNAL_CALL update path.
+        // Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via
+        // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT
+        // REPOSITORY_ONLY — a repository-only UPDATE throws
+        // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) on any admin
+        // domain edit (and, post lazy-create fix, `loadSSOConfig` always materialises a row,
+        // so `saveSSOConfig` reliably hits THIS update branch). No public HTTP update surface
+        // (future supported edits flow through this internal service path). The
+        // `socialCredentialOverrides` write-only-secret-preservation custom-impl
+        // (`createSsoConfigUpdateFactories`) is keyed on this variant and MOVES IN LOCKSTEP —
+        // the custom-impl dispatch key encodes variantType, so a REPOSITORY_ONLY drift on
+        // either side silently drops the PREFIX and wipes per-override secrets on every save.
+        // Same fix as the CREATE above + the SCIM-tokens READ/UPDATE. Admin tier / HIGH.
         [CoreResourceOperation.UPDATE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
@@ -67,45 +91,23 @@ export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurat
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                 }],
         },
-        [SsoConfig_Operations.ADD_DOMAIN]: {
+        // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition
+        // onParentDelete cascade so this one-per-scope SSO-config row is physically
+        // removed when its owning org/app is deleted. Without a DELETE op the cascade
+        // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a
+        // config row. This deletes the whole row; domain mutation is not currently a
+        // public operation. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.
+        [CoreResourceOperation.DELETE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.API_CALL,
-                    isDefault: true,
-                    polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
-                    },
-                    riskLevel: ResourceOperationRiskLevel.HIGH,
-                    resourceOperationLike: CoreResourceOperation.UPDATE,
-                    requestDto: SsoConfig_AddDomainRequestDto,
-                }],
-        },
-        [SsoConfig_Operations.VERIFY_DOMAIN]: {
-            variants: [{
-                    variantType: ResourceOperationVariantType.API_CALL,
-                    isDefault: true,
-                    polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
-                    },
-                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
-                    resourceOperationLike: CoreResourceOperation.READ,
-                    requestDto: SsoConfig_VerifyDomainRequestDto,
-                }],
-        },
-        [SsoConfig_Operations.REMOVE_DOMAIN]: {
-            variants: [{
-                    variantType: ResourceOperationVariantType.API_CALL,
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
-                    resourceOperationLike: CoreResourceOperation.DELETE,
-                    requestDto: SsoConfig_RemoveDomainRequestDto,
                 }],
         },
     },
 });
-//# sourceMappingURL=sso-config.shared.resources-config.schemas.js.map
+//# sourceMappingURL=sso-config.shared.resources-config.schemas.js.map

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAE9E,wEAAwE;AAExE,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,gDAAwB,CAAA;IACxB,sDAA8B,CAAA;IAC9B,sDAA8B,CAAA;AAChC,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAAG,uCAAuC,CAClF,+BAA+B,EAC/B;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,oBAAoB;IACrC,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACxG,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE;YACjC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,6BAA6B;iBAC1C,CAAC;SACH;QACD,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,gCAAgC;iBAC7C,CAAC;SACH;QACD,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;iBAC7C,CAAC;SACH;KACF;CACF,CACF,CAAC"}
+{"version":3,"file":"sso-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAE9E,wEAAwE;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAAG,uCAAuC,CAClF,+BAA+B,EAC/B;IACE,gBAAgB,EAAE,IAAI;IACtB,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,oEAAoE;IACpE,2EAA2E;IAC3E,gFAAgF;IAChF,8EAA8E;IAC9E,iBAAiB;IACjB,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACtI,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,8EAA8E;QAC9E,yFAAyF;QACzF,iFAAiF;QACjF,sFAAsF;QACtF,yFAAyF;QACzF,uFAAuF;QACvF,mEAAmE;QACnE,+DAA+D;QAC/D,mFAAmF;QACnF,oDAAoD;QACpD,mFAAmF;QACnF,qFAAqF;QACrF,sFAAsF;QACtF,wEAAwE;QACxE,yEAAyE;QACzE,sFAAsF;QACtF,kFAAkF;QAClF,sFAAsF;QACtF,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,6EAA6E;QAC7E,qEAAqE;QACrE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SSO Config Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...ssoConfigPolymorphicFactories\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { ssoConfigPolymorphicDeclaration } from './sso-config.shared.schemas';\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n  ssoConfigPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // The auth runtime loads the org SSO config via `readAsSystem` during login,\n    // before the user's roles/membership are established (READ). When the row is\n    // absent — a provisioned / migrated / pre-seed org that bypassed the\n    // `afterCreate` default-seed — that same userless login path lazily\n    // materialises the disabled-default row via `createAsSystem` (CREATE); see\n    // `AuthOrganizationConfigurationService.loadSSOConfig`. Both are system-context\n    // (the logging-in user is not the config's admin owner), so the resource opts\n    // BOTH verbs in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n      // materialised by the framework default-seed (repository tier) OR — when that\n      // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n      // userless login path via `createAsSystem` (`systemAccessPolicy.create` opts\n      // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n      // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n      // self-alerting on mere construction) on every login for a config-less org.\n      // No public HTTP create surface (config is seeded/bootstrapped, never\n      // self-serve). Same fix as the SCIM-tokens READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): admin policy edits reach this\n      // through the config service path — `AuthOrganizationConfigurationService.saveSSOConfig`\n      // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC,\n      // preserving admin audit attribution. `DomainVerificationBackendService` is currently\n      // bound but has no public operation wired to it, so this path is correct-but-dormant. Do\n      // not \"simplify\" the variant on the theory that nothing calls it: a future real domain\n      // workflow must be able to resolve this INTERNAL_CALL update path.\n      // Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT\n      // REPOSITORY_ONLY — a repository-only UPDATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) on any admin\n      // domain edit (and, post lazy-create fix, `loadSSOConfig` always materialises a row,\n      // so `saveSSOConfig` reliably hits THIS update branch). No public HTTP update surface\n      // (future supported edits flow through this internal service path). The\n      // `socialCredentialOverrides` write-only-secret-preservation custom-impl\n      // (`createSsoConfigUpdateFactories`) is keyed on this variant and MOVES IN LOCKSTEP —\n      // the custom-impl dispatch key encodes variantType, so a REPOSITORY_ONLY drift on\n      // either side silently drops the PREFIX and wipes per-override secrets on every save.\n      // Same fix as the CREATE above + the SCIM-tokens READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n      // onParentDelete cascade so this one-per-scope SSO-config row is physically\n      // removed when its owning org/app is deleted. Without a DELETE op the cascade\n      // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a\n      // config row. This deletes the whole row; domain mutation is not currently a\n      // public operation. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}