npm - @wildo-ai/saas-models - Versions diffs - 1.0.1 → 1.1.0 - Mend

@wildo-ai/saas-models 1.0.1 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1282) hide show

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;IACnD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1B,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;YAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC;YAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC;YAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAC9E,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;QACrE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC9D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC5C,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1B,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACjC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACpC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACnE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC;QACnE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAChD,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;QACpC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC;QAC7D,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,yGAAyG;IACzG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAElE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC"}
1	+ {"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,2EAA2E;AAC3E,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,4BAAa,CAAA;AACf,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,gGAAgG;IAChG,0FAA0F;IAC1F,8FAA8F;IAC9F,qEAAqE;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAEvD,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,qGAAqG;IACrG,kGAAkG;IAClG,kGAAkG;IAClG,kDAAkD;IAClD,+FAA+F;IAC/F,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;YAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC;YAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC;YAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACzD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACjE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC3E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC1D,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE;QAChG,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,sGAAsG;IACtG,iGAAiG;IACjG,0FAA0F;IAC1F,qGAAqG;IACrG,iGAAiG;IACjG,kGAAkG;IAClG,oGAAoG;IACpG,kGAAkG;IAClG,mBAAmB;IACnB,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE;QACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClD,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACnD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC7C,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACxD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C;;;;;;;;;;;;;;;;;;WAkBG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC3D,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QACxE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,yGAAyG;IACzG,6FAA6F;IAC7F,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAC1D,gGAAgG;IAChG,8FAA8F;IAC9F,4FAA4F;IAC5F,4EAA4E;IAC5E,4EAA4E;IAC5E,sFAAsF;IACtF,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAEpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/*\n SSO Connection Schema (Shared) — Polymorphic\n \n Individual SSO provider connections with protocol discriminator (OIDC vs SAML).\n * Unified resource — `protocol` field determines which sub-object is populated.\n * Both OIDC and SAML protocol engines consume this shared discriminator.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n \n @see auth-data-model-audit.md §2B\n /\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\n/* Interactive single-sign-on protocols supported by an SSO connection. /\nexport enum SsoProtocol {\n OIDC = 'oidc',\n SAML = 'saml',\n}\n\nexport const SSOTemplateMode = {\n TEMPLATE: 'template',\n DISCOVERY: 'discovery',\n MANUAL: 'manual',\n} as const;\n\nexport const SSOResponseType = {\n CODE: 'code',\n ID_TOKEN: 'id_token',\n TOKEN: 'token',\n} as const;\n\nexport const SSOResponseMode = {\n QUERY: 'query',\n FRAGMENT: 'fragment',\n FORM_POST: 'form_post',\n} as const;\n\nexport const SSOPrompt = {\n NONE: 'none',\n LOGIN: 'login',\n CONSENT: 'consent',\n SELECT_ACCOUNT: 'select_account',\n} as const;\n\nexport const SSOPKCEMethod = {\n S256: 'S256',\n PLAIN: 'plain',\n} as const;\n\nexport const SamlNameIdFormat = {\n UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',\n EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',\n PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',\n} as const;\n\nexport const SsoConnectionBaseSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n protocol: z.enum(SsoProtocol).isSummaryField(),\n externalProviderId: z.string().min(1).optional(),\n displayName: z.string().min(1).isSummaryField(),\n // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides\n // which IdP silently receives logins. Marked individually rather than on any parent: this\n // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records\n // the WHOLE object into rows that replicate to an unerasable ledger.\n // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP\n // decide which identity provider is trusted to authenticate this tenant.\n enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n isDefault: z.boolean().default(false).isAuditEvidence(),\n\n // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates\n // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,\n // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,\n // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed\n // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a\n // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the\n // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the\n // container would copy key material into an unerasable ledger. The two-level `attributeMapping` /\n // `auditSettings` leaves are deliberately NOT marked — the evidence resolver reaches one level of\n // nesting only, so a marker there would be inert.\n // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay\n // validation posture decide which provider is trusted to authenticate this tenant and whether its\n // assertions are actually verified.\n saml: z.object({\n entityId: z.string().min(1).isAuditEvidence(),\n ssoUrl: z.url().isAuditEvidence(),\n sloUrl: z.url().optional().isAuditEvidence(),\n /* Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. /\n x509CertificatePem: z.string().min(1).optional(),\n x509Certificates: z.array(z.string()).min(1).isBackendOnly(),\n attributeMapping: z.object({\n email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),\n firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),\n lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),\n roles: z.string().optional(),\n department: z.string().optional(),\n employeeId: z.string().optional(),\n groups: z.string().optional(),\n }),\n signRequests: z.boolean().default(true).isAuditEvidence(),\n wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),\n allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),\n forceAuthn: z.boolean().default(false).isAuditEvidence(),\n maxAuthAge: z.number().min(0).optional().isAuditEvidence(),\n nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),\n allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),\n auditSettings: z.object({\n logAuthAttempts: z.boolean().default(true),\n logAttributeMapping: z.boolean().default(true),\n retentionDays: z.number().min(1).max(2555).default(90),\n }),\n }).optional(),\n\n // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection\n // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /\n // `clientId`) and HOW strictly it validates tokens (`validateIssuer`, `validateAudience`,\n // `clockTolerance`, `pkceEnabled`, `pkceMethod`), plus what it requests (`scopes` / `customScopes` /\n // `responseType` / `responseMode` / template + auth-request shaping). Turning `validateIssuer` /\n // `validateAudience` / `pkceEnabled` off, or repointing `issuer` / `jwksUri`, silently breaks the\n // token trust chain, so a reviewer must see the before/after. `clientSecret` is NEVER marked (it is\n // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's\n // one-level reach.\n // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-\n // validation posture decide which provider is trusted and whether its tokens are actually verified.\n oidc: z.object({\n templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence(),\n templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n customScopes: z.array(z.string()).optional().isAuditEvidence(),\n discoveryUrl: z.url().optional().isAuditEvidence(),\n issuer: z.url().optional().isAuditEvidence(),\n authorizationEndpoint: z.url().optional().isAuditEvidence(),\n tokenEndpoint: z.url().optional().isAuditEvidence(),\n userInfoEndpoint: z.url().optional().isAuditEvidence(),\n jwksUri: z.url().optional().isAuditEvidence(),\n endSessionEndpoint: z.url().optional().isAuditEvidence(),\n clientId: z.string().min(1).isAuditEvidence(),\n /\n OIDC/OAuth2 client secret issued by the IdP, used by the backend token\n * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to\n * authenticate this connection at the provider's token endpoint.\n \n `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:\n * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it\n * stays in the response DTO so the UI renders a masked placeholder, but the\n * framework redacts it to `••••••••` at the client-serialization boundary only\n * — internal reads (`servicesRegistryHandler.read` during token exchange) keep\n * the real value. Do NOT use `.isBackendOnly()`: that strips the field from\n * every client DTO, so the operator could never supply it.\n \n Preservation on UPDATE is NOT automatic here: this is a nested field, and the\n * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a\n * round-tripped mask must be re-injected from the stored record by the SSO\n * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The\n * central sentinel-strip only preserves TOP-LEVEL write-only secrets.\n /\n clientSecret: z.string().min(1).isWriteOnlySecret(),\n scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence(),\n responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence(),\n responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence(),\n claimsMapping: z.object({\n email: z.string().default('email'),\n firstName: z.string().default('given_name'),\n lastName: z.string().default('family_name'),\n roles: z.string().optional(),\n department: z.string().optional(),\n employeeId: z.string().optional(),\n groups: z.string().optional(),\n }),\n validateIssuer: z.boolean().default(true).isAuditEvidence(),\n validateAudience: z.boolean().default(true).isAuditEvidence(),\n clockTolerance: z.number().min(0).max(300).default(30).isAuditEvidence(),\n acrValues: z.array(z.string()).optional().isAuditEvidence(),\n maxAge: z.number().min(0).optional().isAuditEvidence(),\n prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),\n pkceEnabled: z.boolean().default(true).isAuditEvidence(),\n pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),\n auditSettings: z.object({\n logAuthAttempts: z.boolean().default(true),\n logTokenExchange: z.boolean().default(true),\n logClaimsMapping: z.boolean().default(true),\n retentionDays: z.number().min(1).max(2555).default(90),\n }),\n }).optional(),\n\n autoCreateUsers: z.boolean().default(true),\n autoVerifyEmail: z.boolean().default(true),\n /* W2.8: if true, users authenticating via this SSO connection skip the application-level MFA policy. */\n // `.isAuditEvidence()` — an explicit escape from the application MFA policy for everyone who\n // authenticates through this connection. Flipping it on lowers the assurance level tenant-wide.\n bypassAppMFA: z.boolean().default(false).isAuditEvidence(),\n // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`\n // and the two mappings decide what authority an externally-authenticated identity lands with,\n // and `allowedDomains` decides whose identities the connection will accept at all. A change\n // here is an authorization change; the field NAME alone cannot evidence it.\n // The values are role names and domains — configuration, not personal data.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an\n // externally-authenticated identity lands with, and whose identities are accepted.\n defaultRole: z.string().optional().isAuditEvidence(),\n allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),\n\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n// NOTE: Protocol-config discriminant enforcement (protocol=saml → saml defined, protocol=oidc → oidc defined)\n// is validated at the backend service layer, not via .refine() here.\n// Zod 4 doesn't allow .extend() on refined objects, which breaks the polymorphism engine.\n\n\nexport type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;\n\nexport const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'ssoConnections',\n baseFieldIdentifier: 'ssoConnectionId',\n baseEnumKey: 'SSO_CONNECTIONS',\n baseSchema: SsoConnectionBaseSchema,\n // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the\n // polymorphism engine's singleton-per-scope business-key auto-default.\n variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.d.ts ADDED Viewed

@@ -0,0 +1,57 @@
+/**
+ * Administrative-continuity refusal codes — the stable, client-branchable identity of a
+ * "you would remove the last accountable administrator" refusal.
+ *
+ * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application, and each of its
+ * tenants, must retain an accountable administrative principal.
+ *
+ * ## Why this exists as a shared enum rather than prose
+ *
+ * Both authority floors refuse with `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an
+ * ALLOWLIST of context keys on a CONFLICT. The human remedy travels under `message`, which is on that
+ * list — but prose is not a contract: a client wanting to tell "you would strip the last
+ * administrator" apart from any other 409 would have to regex-parse it, and that breaks the moment
+ * the wording is improved.
+ *
+ * The allowlist's own documented rule is that a client-branchable value rides under the stable `code`
+ * key, sourced from an enum declared HERE in `@wildo-ai/saas-models` so backend and frontend share one
+ * definition — and explicitly NOT under an invented `reason` / `errorKind` field (which the sanitizer
+ * strips precisely so that this rule is the only way through). The backend-side `reason` codes remain,
+ * unchanged and unshipped: they are the LOG/audit identity, richer than the wire and free to stay so.
+ *
+ * ## Why one enum for two floors
+ *
+ * The application floor and the organization-owner floor are distinct authorities over distinct
+ * populations, but from a CLIENT's perspective they are one situation with one remedy shape: appoint
+ * another administrator at the named scope, then retry. A single enum lets a caller branch on "this is
+ * an administrative-continuity refusal" with one check and still distinguish the scope when it wants
+ * to — which two unrelated enums would not.
+ */
+/**
+ * Which administrative population a refusal was protecting.
+ *
+ * A closed vocabulary with one named runtime source: schemas, comparisons and client branches all
+ * derive from this enum rather than re-typing the literals.
+ */
+export declare enum AdministrativeContinuityErrorCode {
+    /**
+     * The write would leave the APPLICATION with no administratively usable super-administrator —
+     * a principal that confers `APP_ADMIN_SUPER_ADMIN` (directly or through an `inheritFrom` chain)
+     * and whose account status can still authenticate.
+     *
+     * Unrecoverable in-product once breached: every recovery door is itself gated on that role.
+     * Remedy: grant a super-administrator role to another active user, then retry.
+     */
+    LAST_APPLICATION_SUPER_ADMIN = "LAST_APPLICATION_SUPER_ADMIN",
+    /**
+     * The write would leave ONE organization with no administratively usable owner — an ACTIVE
+     * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.
+     *
+     * Unrecoverable in-product once breached, and MORE absolutely than the application case:
+     * `ORGANIZATION_MEMBERS` declares no super-administrator variant, so a platform administrator who
+     * is not a member of the stranded tenant can observe and destroy it but cannot re-own it.
+     * Remedy: grant an owner role to another active member of that organization, then retry.
+     */
+    LAST_ORGANIZATION_OWNER = "LAST_ORGANIZATION_OWNER"
+}
+//# sourceMappingURL=administrative-continuity.shared.schemas.d.ts.map

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"administrative-continuity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;GAKG;AACH,oBAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAE7D;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;CACpD"}

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.js ADDED Viewed

@@ -0,0 +1,58 @@
+/**
+ * Administrative-continuity refusal codes — the stable, client-branchable identity of a
+ * "you would remove the last accountable administrator" refusal.
+ *
+ * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application, and each of its
+ * tenants, must retain an accountable administrative principal.
+ *
+ * ## Why this exists as a shared enum rather than prose
+ *
+ * Both authority floors refuse with `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an
+ * ALLOWLIST of context keys on a CONFLICT. The human remedy travels under `message`, which is on that
+ * list — but prose is not a contract: a client wanting to tell "you would strip the last
+ * administrator" apart from any other 409 would have to regex-parse it, and that breaks the moment
+ * the wording is improved.
+ *
+ * The allowlist's own documented rule is that a client-branchable value rides under the stable `code`
+ * key, sourced from an enum declared HERE in `@wildo-ai/saas-models` so backend and frontend share one
+ * definition — and explicitly NOT under an invented `reason` / `errorKind` field (which the sanitizer
+ * strips precisely so that this rule is the only way through). The backend-side `reason` codes remain,
+ * unchanged and unshipped: they are the LOG/audit identity, richer than the wire and free to stay so.
+ *
+ * ## Why one enum for two floors
+ *
+ * The application floor and the organization-owner floor are distinct authorities over distinct
+ * populations, but from a CLIENT's perspective they are one situation with one remedy shape: appoint
+ * another administrator at the named scope, then retry. A single enum lets a caller branch on "this is
+ * an administrative-continuity refusal" with one check and still distinguish the scope when it wants
+ * to — which two unrelated enums would not.
+ */
+/**
+ * Which administrative population a refusal was protecting.
+ *
+ * A closed vocabulary with one named runtime source: schemas, comparisons and client branches all
+ * derive from this enum rather than re-typing the literals.
+ */
+export var AdministrativeContinuityErrorCode;
+(function (AdministrativeContinuityErrorCode) {
+    /**
+     * The write would leave the APPLICATION with no administratively usable super-administrator —
+     * a principal that confers `APP_ADMIN_SUPER_ADMIN` (directly or through an `inheritFrom` chain)
+     * and whose account status can still authenticate.
+     *
+     * Unrecoverable in-product once breached: every recovery door is itself gated on that role.
+     * Remedy: grant a super-administrator role to another active user, then retry.
+     */
+    AdministrativeContinuityErrorCode["LAST_APPLICATION_SUPER_ADMIN"] = "LAST_APPLICATION_SUPER_ADMIN";
+    /**
+     * The write would leave ONE organization with no administratively usable owner — an ACTIVE
+     * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.
+     *
+     * Unrecoverable in-product once breached, and MORE absolutely than the application case:
+     * `ORGANIZATION_MEMBERS` declares no super-administrator variant, so a platform administrator who
+     * is not a member of the stranded tenant can observe and destroy it but cannot re-own it.
+     * Remedy: grant an owner role to another active member of that organization, then retry.
+     */
+    AdministrativeContinuityErrorCode["LAST_ORGANIZATION_OWNER"] = "LAST_ORGANIZATION_OWNER";
+})(AdministrativeContinuityErrorCode || (AdministrativeContinuityErrorCode = {}));
+//# sourceMappingURL=administrative-continuity.shared.schemas.js.map

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"administrative-continuity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iCAqBX;AArBD,WAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,kGAA6D,CAAA;IAE7D;;;;;;;;OAQG;IACH,wFAAmD,CAAA;AACrD,CAAC,EArBW,iCAAiC,KAAjC,iCAAiC,QAqB5C","sourcesContent":["/**\n * Administrative-continuity refusal codes — the stable, client-branchable identity of a\n * \"you would remove the last accountable administrator\" refusal.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application, and each of its\n * tenants, must retain an accountable administrative principal.\n *\n * ## Why this exists as a shared enum rather than prose\n *\n * Both authority floors refuse with `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an\n * ALLOWLIST of context keys on a CONFLICT. The human remedy travels under `message`, which is on that\n * list — but prose is not a contract: a client wanting to tell \"you would strip the last\n * administrator\" apart from any other 409 would have to regex-parse it, and that breaks the moment\n * the wording is improved.\n *\n * The allowlist's own documented rule is that a client-branchable value rides under the stable `code`\n * key, sourced from an enum declared HERE in `@wildo-ai/saas-models` so backend and frontend share one\n * definition — and explicitly NOT under an invented `reason` / `errorKind` field (which the sanitizer\n * strips precisely so that this rule is the only way through). The backend-side `reason` codes remain,\n * unchanged and unshipped: they are the LOG/audit identity, richer than the wire and free to stay so.\n *\n * ## Why one enum for two floors\n *\n * The application floor and the organization-owner floor are distinct authorities over distinct\n * populations, but from a CLIENT's perspective they are one situation with one remedy shape: appoint\n * another administrator at the named scope, then retry. A single enum lets a caller branch on \"this is\n * an administrative-continuity refusal\" with one check and still distinguish the scope when it wants\n * to — which two unrelated enums would not.\n */\n\n/**\n * Which administrative population a refusal was protecting.\n *\n * A closed vocabulary with one named runtime source: schemas, comparisons and client branches all\n * derive from this enum rather than re-typing the literals.\n */\nexport enum AdministrativeContinuityErrorCode {\n /**\n * The write would leave the APPLICATION with no administratively usable super-administrator —\n * a principal that confers `APP_ADMIN_SUPER_ADMIN` (directly or through an `inheritFrom` chain)\n * and whose account status can still authenticate.\n *\n * Unrecoverable in-product once breached: every recovery door is itself gated on that role.\n * Remedy: grant a super-administrator role to another active user, then retry.\n */\n LAST_APPLICATION_SUPER_ADMIN = 'LAST_APPLICATION_SUPER_ADMIN',\n\n /**\n * The write would leave ONE organization with no administratively usable owner — an ACTIVE\n * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.\n *\n * Unrecoverable in-product once breached, and MORE absolutely than the application case:\n * `ORGANIZATION_MEMBERS` declares no super-administrator variant, so a platform administrator who\n * is not a member of the stranded tenant can observe and destroy it but cannot re-own it.\n * Remedy: grant an owner role to another active member of that organization, then retry.\n */\n LAST_ORGANIZATION_OWNER = 'LAST_ORGANIZATION_OWNER',\n}\n"]}

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.d.ts ADDED Viewed

@@ -0,0 +1,35 @@
+/**
+ * Platform Access Grants — resource configuration.
+ *
+ * The operation set is unusual and the asymmetry is the point: the PLATFORM requests, the TENANT
+ * decides. No verb lets one side do the other's job.
+ *
+ *   requestAccess  — platform-tier, crosses the tenant boundary
+ *   approve / deny — the TARGET tenant's own administrators, never platform-tier
+ *   revoke         — either side, because either may end an elevation early
+ *
+ * See `platform-access-grants.shared.schemas.ts` for why the resource exists at all (rungs 4–5 of
+ * the operator-access ladder in `.claude/rules/administrative-continuity-floors.md`) and
+ * `.claude/plans/platform-access-grants-jit-elevation.md` for the remaining steps.
+ */
+import { z } from 'zod';
+import { PlatformAccessGrantStatus, PlatformAccessGrants_Operations } from './platform-access-grants.shared.schemas';
+import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
+import { type ResourceRelationship } from '../../resources/resources.shared.schemas';
+type PlatformAccessGrantsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.COUNT | CoreResourceOperation.DELETE;
+export declare const platformAccessGrantsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<typeof PlatformAccessGrants_Operations, PlatformAccessGrantsCoreOperations, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    operatorUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    justification: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof PlatformAccessGrantStatus>>>>>>>>;
+    expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>>>;
+    approvedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
+    approvedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    autoApprovalReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("./platform-access-grants.shared.schemas").PlatformAccessGrantAutoApprovalReason>>>>>>;
+    decisionReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>>;
+export {};
+//# sourceMappingURL=platform-access-grants.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"platform-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAOlD,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,+DAA+D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;kBAqP1H,CAAC"}

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.js ADDED Viewed

@@ -0,0 +1,252 @@
+/**
+ * Platform Access Grants — resource configuration.
+ *
+ * The operation set is unusual and the asymmetry is the point: the PLATFORM requests, the TENANT
+ * decides. No verb lets one side do the other's job.
+ *
+ *   requestAccess  — platform-tier, crosses the tenant boundary
+ *   approve / deny — the TARGET tenant's own administrators, never platform-tier
+ *   revoke         — either side, because either may end an elevation early
+ *
+ * See `platform-access-grants.shared.schemas.ts` for why the resource exists at all (rungs 4–5 of
+ * the operator-access ladder in `.claude/rules/administrative-continuity-floors.md`) and
+ * `.claude/plans/platform-access-grants-jit-elevation.md` for the remaining steps.
+ */
+import { z } from 'zod';
+import { PlatformAccessGrantSchema, PlatformAccessGrantStatus, PlatformAccessGrants_Operations } from './platform-access-grants.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../resources/resources.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
+import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from './roles.shared.schemas.js';
+export const platformAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: PlatformAccessGrantSchema,
+    resourceIdentifier: CoreResourceType.PLATFORM_ACCESS_GRANTS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.PLATFORM_ACCESS_GRANTS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /**
+     * `read`/`list` are ALLOWED for the trusted path because the authorization layer itself has to
+     * resolve a caller's usable grant before admitting a crossing, and it does so on a system context
+     * — the caller is by definition not a member of the tenant whose grants are being read.
+     *
+     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies
+     * the tenant policy and the continuity-floor measurement. A system door around those would be a
+     * second way to mint an elevation, which is the one thing this resource exists to prevent.
+     */
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        /**
+         * Subject-export disclosure — FORBIDDEN, and the declaration is REQUIRED rather than optional.
+         *
+         * `operatorUserId` and `approvedByUserId` are foreign keys back to USERS, so
+         * `classifySubjectExportDisposition` puts these rows on a user's Art. 15 graph as
+         * `INCLUDED_REFERENCES_SUBJECT` — personal data CONCERNING the subject even though the subject
+         * does not own it. An included resource carrying NO declaration REFUSES the entire export, so
+         * omitting this would trade a frontend boot failure for a broken disclosure right.
+         *
+         * FORBIDDEN for the reason AUDIT_LOGS is: this is a security/operational monitoring record, and
+         * handing the monitoring trail to the person it monitors is self-defeating. It is also not only
+         * about them — a grant names the TENANT's approver and carries the tenant's decision reason, so
+         * disclosing it to the operator would expose another data subject's decision (Art. 15(4)).
+         * FORBIDDEN rows are left OUT of the bundle and RECORDED with that reason, never silently
+         * dropped, so the report still answers "why is this missing?".
+         */
+        exportSubject: ResourceSystemAccessMode.FORBIDDEN,
+    },
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.COUNT,
+        // Present for the tenant-purge cascade ONLY — see the operation's configuration below.
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    // Both sides read the same row through the same door: a tenant admin sees elevations
+                    // raised against their tenant (the consent record is worthless if the consenting party
+                    // cannot see it), and the platform sees the ones it raised. The ORGANIZATIONS scope does
+                    // the tenant separation; the platform reaches it through the cross-tenant admission on
+                    // the verbs below.
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.COUNT]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        /**
+         * PURGE ONLY — there is deliberately no `API_CALL` variant, so no client can delete a grant.
+         *
+         * The verb exists because grants are a COMPOSITION child of ORGANIZATIONS with
+         * `onParentDelete` enabled, and a cascade can only call an operation the child actually
+         * declares. Without it the registry's composition-cascade-deletability guard fails — correctly:
+         * the cascade would have been declared and then silently unable to run, leaving grant rows
+         * behind after their tenant was purged.
+         *
+         * Route-less is the whole point of the shape. `INTERNAL_CALL` mirrors `organizations.delete`'s
+         * own default: the tenant purge may remove these rows, and nobody else may. Erasing a consent
+         * record through an API would let either party rewrite the history of an access decision, which
+         * is exactly what this resource exists to make impossible.
+         */
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+        /**
+         * The bootstrap verb, and the ONE operation here that must stay reachable without an existing
+         * grant — otherwise the mechanism cannot start: an operator would need an elevation to request
+         * an elevation. It therefore declares `admitsCrossTenantPlatformAdministration` and must be
+         * explicitly exempted when the admission predicate later starts requiring a usable grant
+         * (Step 4 of the plan). That exemption is load-bearing and gets its own pin.
+         *
+         * What keeps the exemption safe is that requesting is not accessing: this verb writes a row in
+         * `PENDING_APPROVAL` (or `ACTIVE` when the tenant has not opted into approval) and touches
+         * nothing else in the tenant. The blast radius of an abused request is a notification and an
+         * audit row naming the operator.
+         *
+         * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — elevation is requested, never assumed.
+         * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+         */
+        [PlatformAccessGrants_Operations.REQUEST_ACCESS]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    admitsCrossTenantPlatformAdministration: true,
+                    /**
+                     * `organizationId` deliberately does NOT appear in this body DTO. The organization is
+                     * already the mandatory primary-scope path segment and the execution-context creator
+                     * validates that URL value before dispatch. Requiring it again in JSON made clients
+                     * author the same security-critical target twice and created an avoidable mismatch case.
+                     *
+                     * WHERE AN OPERATOR GETS the path id is still a deliberate product decision. There is
+                     * no in-product surface that lists organizations the operator does not belong to:
+                     * `organizations | LIST` is confined to the caller's own memberships. The id therefore
+                     * arrives with the customer support case, where it is also present in support URLs,
+                     * organization notifications and the audit trail.
+                     *
+                     * Do not widen `organizations | LIST` to make discovery convenient: a browsable
+                     * directory is the customer list and would restore the standing cross-tenant
+                     * visibility this workflow exists to avoid.
+                     */
+                    requestDto: z.object({
+                        justification: z.string().min(1).max(1000),
+                        /** Minutes. Clamped server-side to the 4h ceiling; a longer ask is not refused. */
+                        requestedDurationMinutes: z.number().int().positive().optional(),
+                    }),
+                },
+            ],
+            userNotifications: [
+                {
+                    // The tenant learns immediately that an operator asked for access — before it happens,
+                    // not after. Under the approval posture this notification IS the request; without it,
+                    // opting in would give a tenant a decision it never hears about.
+                    target: CoreUserNotificationTarget.ORGANIZATION_USERS,
+                    channel: CoreUserNotificationChannel.EMAIL,
+                },
+            ],
+        },
+        /**
+         * The tenant's decision. Gated on the TENANT's own roles and deliberately NOT reachable by the
+         * platform: an operator who could approve their own request would make the whole Lockbox
+         * posture ceremonial. Note the absence of `admitsCrossTenantPlatformAdministration` here — that
+         * absence is the control, so do not add it "for symmetry".
+         */
+        [PlatformAccessGrants_Operations.APPROVE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({
+                        decisionReason: z.string().max(1000).optional(),
+                    }),
+                    // Only a request still awaiting a decision can be decided. Fails closed server-side, so a
+                    // replayed approval cannot revive a denied, revoked or expired grant.
+                    enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,
+                },
+            ],
+        },
+        [PlatformAccessGrants_Operations.DENY]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({
+                        decisionReason: z.string().max(1000).optional(),
+                    }),
+                    enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,
+                },
+            ],
+        },
+        /**
+         * Ending an elevation early. Reachable by BOTH sides, which is why it carries the cross-tenant
+         * admission while `approve`/`deny` do not: a tenant revokes access it granted, and an operator
+         * closes out their own session rather than leaving a live window open until it lapses.
+         *
+         * Revoking is monotonic — it only ever removes authority — so admitting the platform side costs
+         * nothing the reversibility test would object to.
+         */
+        [PlatformAccessGrants_Operations.REVOKE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    admitsCrossTenantPlatformAdministration: true,
+                    requestDto: z.object({
+                        decisionReason: z.string().max(1000).optional(),
+                    }),
+                    enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL
+                        || currentObject.status === PlatformAccessGrantStatus.ACTIVE,
+                },
+            ],
+        },
+    },
+    // NOTE: the ORGANIZATIONS primary scope is NOT declared here. It is derived from the registry
+    // relationship carrying `isPrimaryScope: true` (ORGANIZATIONS → PLATFORM_ACCESS_GRANTS), which is
+    // the single place scope is expressed for every resource. Declaring it twice would let the two
+    // drift, and the relationship is the one the authorizer actually reads.
+});
+//# sourceMappingURL=platform-access-grants.shared.resources-config.schemas.js.map

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"platform-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AASxE,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAChI,0CAA0C,CAIxC;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;OAQG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QAEtC;;;;;;;;;;;;;;;WAeG;QACH,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,uFAAuF;QACvF,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,mBAAmB;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;WAaG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,+BAA+B,CAAC,cAAc,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C;;;;;;;;;;;;;;;uBAeG;oBACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;qBACjE,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,uFAAuF;oBACvF,sFAAsF;oBACtF,iEAAiE;oBACjE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,0FAA0F;oBAC1F,sEAAsE;oBACtE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE;YACtC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;KACF;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,+FAA+F;IAC/F,wEAAwE;CACzE,CAAC,CAAC","sourcesContent":["/**\n * Platform Access Grants — resource configuration.\n *\n * The operation set is unusual and the asymmetry is the point: the PLATFORM requests, the TENANT\n * decides. No verb lets one side do the other's job.\n *\n * requestAccess — platform-tier, crosses the tenant boundary\n * approve / deny — the TARGET tenant's own administrators, never platform-tier\n * revoke — either side, because either may end an elevation early\n *\n * See `platform-access-grants.shared.schemas.ts` for why the resource exists at all (rungs 4–5 of\n * the operator-access ladder in `.claude/rules/administrative-continuity-floors.md`) and\n * `.claude/plans/platform-access-grants-jit-elevation.md` for the remaining steps.\n */\n\nimport { z } from 'zod';\nimport { PlatformAccessGrantSchema, PlatformAccessGrantStatus, PlatformAccessGrants_Operations } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from './roles.shared.schemas';\n\n\ntype PlatformAccessGrantsCoreOperations =\n | CoreResourceOperation.READ\n | CoreResourceOperation.LIST\n | CoreResourceOperation.COUNT\n | CoreResourceOperation.DELETE;\n\nexport const platformAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n createResourceConfiguration_Initialization<\n typeof PlatformAccessGrants_Operations,\n PlatformAccessGrantsCoreOperations,\n typeof PlatformAccessGrantSchema\n >({\n mainSchema: PlatformAccessGrantSchema,\n resourceIdentifier: CoreResourceType.PLATFORM_ACCESS_GRANTS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.PLATFORM_ACCESS_GRANTS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n /**\n * `read`/`list` are ALLOWED for the trusted path because the authorization layer itself has to\n * resolve a caller's usable grant before admitting a crossing, and it does so on a system context\n * — the caller is by definition not a member of the tenant whose grants are being read.\n *\n * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n * the tenant policy and the continuity-floor measurement. A system door around those would be a\n * second way to mint an elevation, which is the one thing this resource exists to prevent.\n */\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n\n /**\n * Subject-export disclosure — FORBIDDEN, and the declaration is REQUIRED rather than optional.\n *\n * `operatorUserId` and `approvedByUserId` are foreign keys back to USERS, so\n * `classifySubjectExportDisposition` puts these rows on a user's Art. 15 graph as\n * `INCLUDED_REFERENCES_SUBJECT` — personal data CONCERNING the subject even though the subject\n * does not own it. An included resource carrying NO declaration REFUSES the entire export, so\n * omitting this would trade a frontend boot failure for a broken disclosure right.\n *\n * FORBIDDEN for the reason AUDIT_LOGS is: this is a security/operational monitoring record, and\n * handing the monitoring trail to the person it monitors is self-defeating. It is also not only\n * about them — a grant names the TENANT's approver and carries the tenant's decision reason, so\n * disclosing it to the operator would expose another data subject's decision (Art. 15(4)).\n * FORBIDDEN rows are left OUT of the bundle and RECORDED with that reason, never silently\n * dropped, so the report still answers \"why is this missing?\".\n */\n exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.COUNT,\n // Present for the tenant-purge cascade ONLY — see the operation's configuration below.\n CoreResourceOperation.DELETE,\n ],\n\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n // Both sides read the same row through the same door: a tenant admin sees elevations\n // raised against their tenant (the consent record is worthless if the consenting party\n // cannot see it), and the platform sees the ones it raised. The ORGANIZATIONS scope does\n // the tenant separation; the platform reaches it through the cross-tenant admission on\n // the verbs below.\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.COUNT]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n /**\n * PURGE ONLY — there is deliberately no `API_CALL` variant, so no client can delete a grant.\n *\n * The verb exists because grants are a COMPOSITION child of ORGANIZATIONS with\n * `onParentDelete` enabled, and a cascade can only call an operation the child actually\n * declares. Without it the registry's composition-cascade-deletability guard fails — correctly:\n * the cascade would have been declared and then silently unable to run, leaving grant rows\n * behind after their tenant was purged.\n *\n * Route-less is the whole point of the shape. `INTERNAL_CALL` mirrors `organizations.delete`'s\n * own default: the tenant purge may remove these rows, and nobody else may. Erasing a consent\n * record through an API would let either party rewrite the history of an access decision, which\n * is exactly what this resource exists to make impossible.\n */\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n },\n ],\n },\n\n /**\n * The bootstrap verb, and the ONE operation here that must stay reachable without an existing\n * grant — otherwise the mechanism cannot start: an operator would need an elevation to request\n * an elevation. It therefore declares `admitsCrossTenantPlatformAdministration` and must be\n * explicitly exempted when the admission predicate later starts requiring a usable grant\n * (Step 4 of the plan). That exemption is load-bearing and gets its own pin.\n *\n * What keeps the exemption safe is that requesting is not accessing: this verb writes a row in\n * `PENDING_APPROVAL` (or `ACTIVE` when the tenant has not opted into approval) and touches\n * nothing else in the tenant. The blast radius of an abused request is a notification and an\n * audit row naming the operator.\n *\n * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — elevation is requested, never assumed.\n * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n */\n [PlatformAccessGrants_Operations.REQUEST_ACCESS]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n resourceOperationLike: CoreResourceOperation.CREATE,\n admitsCrossTenantPlatformAdministration: true,\n /**\n * `organizationId` deliberately does NOT appear in this body DTO. The organization is\n * already the mandatory primary-scope path segment and the execution-context creator\n * validates that URL value before dispatch. Requiring it again in JSON made clients\n * author the same security-critical target twice and created an avoidable mismatch case.\n *\n * WHERE AN OPERATOR GETS the path id is still a deliberate product decision. There is\n * no in-product surface that lists organizations the operator does not belong to:\n * `organizations | LIST` is confined to the caller's own memberships. The id therefore\n * arrives with the customer support case, where it is also present in support URLs,\n * organization notifications and the audit trail.\n *\n * Do not widen `organizations | LIST` to make discovery convenient: a browsable\n * directory is the customer list and would restore the standing cross-tenant\n * visibility this workflow exists to avoid.\n */\n requestDto: z.object({\n justification: z.string().min(1).max(1000),\n /** Minutes. Clamped server-side to the 4h ceiling; a longer ask is not refused. */\n requestedDurationMinutes: z.number().int().positive().optional(),\n }),\n },\n ],\n userNotifications: [\n {\n // The tenant learns immediately that an operator asked for access — before it happens,\n // not after. Under the approval posture this notification IS the request; without it,\n // opting in would give a tenant a decision it never hears about.\n target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n ],\n },\n\n /**\n * The tenant's decision. Gated on the TENANT's own roles and deliberately NOT reachable by the\n * platform: an operator who could approve their own request would make the whole Lockbox\n * posture ceremonial. Note the absence of `admitsCrossTenantPlatformAdministration` here — that\n * absence is the control, so do not add it \"for symmetry\".\n */\n [PlatformAccessGrants_Operations.APPROVE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n decisionReason: z.string().max(1000).optional(),\n }),\n // Only a request still awaiting a decision can be decided. Fails closed server-side, so a\n // replayed approval cannot revive a denied, revoked or expired grant.\n enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n },\n ],\n },\n\n [PlatformAccessGrants_Operations.DENY]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n decisionReason: z.string().max(1000).optional(),\n }),\n enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n },\n ],\n },\n\n /**\n * Ending an elevation early. Reachable by BOTH sides, which is why it carries the cross-tenant\n * admission while `approve`/`deny` do not: a tenant revokes access it granted, and an operator\n * closes out their own session rather than leaving a live window open until it lapses.\n *\n * Revoking is monotonic — it only ever removes authority — so admitting the platform side costs\n * nothing the reversibility test would object to.\n */\n [PlatformAccessGrants_Operations.REVOKE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN],\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n admitsCrossTenantPlatformAdministration: true,\n requestDto: z.object({\n decisionReason: z.string().max(1000).optional(),\n }),\n enabledCondition: ({ currentObject }) =>\n currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n },\n ],\n },\n },\n // NOTE: the ORGANIZATIONS primary scope is NOT declared here. It is derived from the registry\n // relationship carrying `isPrimaryScope: true` (ORGANIZATIONS → PLATFORM_ACCESS_GRANTS), which is\n // the single place scope is expressed for every resource. Declaring it twice would let the two\n // drift, and the relationship is the one the authorizer actually reads.\n });\n"]}