@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/security/authorizations/platform-access-grants.shared.schemas.d.ts

@@ -0,0 +1,171 @@
+/**
+ * Platform Access Grants — time-bound, justified, optionally tenant-approved elevation that lets a
+ * platform operator cross the tenant boundary.
+ *
+ * ## Where this sits
+ *
+ * Wildo's answer to "may a platform super-administrator administer any tenant?" is YES, as at most
+ * B2B platforms. The question this resource answers is the narrower one that follows: *on what
+ * terms?* The progression, recorded in `.claude/rules/administrative-continuity-floors.md`:
+ *
+ *   ambient+unaudited → ambient+audited → declared, deny-by-default → **JIT/time-bound (here)**
+ *   → customer-approved (here, when the tenant opts in)
+ *
+ * Declaring a crossing per operation variant (`admitsCrossTenantPlatformAdministration`) removed
+ * AMBIENT authority: a crossing must now be asked for in code, reviewed, and specified. It did not
+ * remove STANDING authority — every platform administrator still held every declared crossing,
+ * permanently, over every tenant. That is the shape zero-standing-privilege programmes exist to
+ * eliminate, and what NIST SP 800-53 AC-2 / AC-6(1) mean by least privilege: privileged access is
+ * requested, scoped, time-boxed, and expires on its own.
+ *
+ * A grant is therefore required IN ADDITION to the variant's declaration. The declaration says
+ * "this verb MAY cross"; the grant says "this operator MAY cross into THIS tenant, until THIS time,
+ * for THIS reason". Neither is sufficient alone.
+ *
+ * ## The tenant-approval half (Lockbox)
+ *
+ * Microsoft Customer Lockbox and Google Access Approval let the CUSTOMER approve provider access
+ * before it happens. Wildo models that as {@link PlatformAccessGrantStatus.PENDING_APPROVAL}, gated
+ * per tenant so it is an opt-in posture rather than a deployment-wide one — the same shape those
+ * products ship, and for the same reason: a tenant that has not staffed an approver must not be
+ * unable to receive support.
+ *
+ * ## ⚠️ The interaction that is easy to get wrong
+ *
+ * Tenant approval and the administrative-continuity floors are in direct tension. Approval requires
+ * an administrator; the floors exist precisely because a tenant can end up WITHOUT one. Requiring a
+ * stranded tenant to approve its own repair is circular — the tenant cannot approve, so the repair
+ * cannot happen, so the tenant stays stranded.
+ *
+ * This is resolved by measurement, not by exception: when the target tenant has no administratively
+ * usable owner, the grant is auto-approved with
+ * {@link PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE} and recorded loudly. The
+ * condition is evaluated with the SAME predicate the owner floor uses to refuse writes, so the two
+ * can never disagree about whether a tenant can administer itself. An operator cannot manufacture
+ * the condition either: stranding a tenant is exactly what the floors refuse.
+ */
+import { z } from 'zod';
+/**
+ * Lifecycle of one elevation request.
+ *
+ * A closed vocabulary with one named runtime source: schemas, guards, fixtures and comparisons all
+ * derive from this enum rather than repeating literals.
+ */
+export declare enum PlatformAccessGrantStatus {
+    /** Awaiting a decision from an administrator of the TARGET tenant (Lockbox posture). */
+    PENDING_APPROVAL = "pending_approval",
+    /** Usable now. The admission predicate accepts this status, and only while unexpired. */
+    ACTIVE = "active",
+    /** The tenant refused. Terminal — a new request must be raised rather than this one retried. */
+    DENIED = "denied",
+    /**
+     * The window elapsed. Terminal, and reached WITHOUT a writer: the admission predicate compares
+     * `expiresAt` against now, so an expired grant stops working whether or not any sweeper has
+     * relabelled it. A background transition to this status is bookkeeping for humans and reporting,
+     * never the control.
+     */
+    EXPIRED = "expired",
+    /** Withdrawn before expiry, by the tenant or by the platform. Terminal. */
+    REVOKED = "revoked"
+}
+/**
+ * Which step of a grant's life an audit row records.
+ *
+ * Distinct from {@link PlatformAccessGrantStatus}: a status is where the grant IS, a transition is
+ * what just happened to it. They differ where it matters — an auto-approved grant lands in `ACTIVE`
+ * through `REQUESTED`, never through `APPROVED`, and collapsing the two would erase exactly the
+ * distinction a customer audit asks about.
+ */
+export declare enum PlatformAccessGrantLifecycleTransition {
+    REQUESTED = "requested",
+    APPROVED = "approved",
+    DENIED = "denied",
+    REVOKED = "revoked"
+}
+/** Why a grant became {@link PlatformAccessGrantStatus.ACTIVE} without a tenant administrator acting. */
+export declare enum PlatformAccessGrantAutoApprovalReason {
+    /** The tenant has not opted into approval. The default posture, matching Lockbox being opt-in. */
+    TENANT_APPROVAL_NOT_REQUIRED = "tenant_approval_not_required",
+    /**
+     * The tenant has NO administratively usable owner, so no principal exists who could approve.
+     * Evaluated with the owner floor's own predicate — see this file's header for why the alternative
+     * (refusing) is circular. Recorded at high severity: this is the one path where operator access
+     * proceeds against a tenant that never consented and never could.
+     */
+    TENANT_CANNOT_APPROVE = "tenant_cannot_approve"
+}
+/**
+ * The maximum life of a grant, and the default when a request names none.
+ *
+ * Four hours is a working session, not a working week: long enough that an operator is not
+ * re-requesting mid-incident, short enough that a forgotten grant is not a standing privilege by
+ * another name. Callers may request LESS; the ceiling is enforced server-side so a client cannot
+ * mint a long-lived elevation by asking for one.
+ */
+export declare const PLATFORM_ACCESS_GRANT_DEFAULT_DURATION_MINUTES = 240;
+export declare const PLATFORM_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES = 240;
+/** Statuses from which a grant can still be withdrawn. */
+export declare const PLATFORM_ACCESS_GRANT_REVOCABLE_STATUSES: readonly PlatformAccessGrantStatus[];
+export declare const PlatformAccessGrantSchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    operatorUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    justification: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof PlatformAccessGrantStatus>>>>>>>>;
+    expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>>>;
+    approvedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
+    approvedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    autoApprovalReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof PlatformAccessGrantAutoApprovalReason>>>>>>;
+    decisionReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>;
+export type PlatformAccessGrant = z.infer<typeof PlatformAccessGrantSchema>;
+/**
+ * Is this grant usable RIGHT NOW?
+ *
+ * The single predicate every consumer must use — the admission check, the tenant's UI, and any
+ * report. Two independent conditions, and the expiry half is why this is a function rather than a
+ * status comparison: a grant whose window elapsed is unusable the moment it elapses, with no writer
+ * involved. Reading `status === ACTIVE` alone would honour a stale row for as long as no sweeper had
+ * run, turning a time-bound elevation back into a standing one.
+ *
+ * `now` is injected so callers can evaluate a grant at a decision time they already fixed, and so
+ * this stays testable without clock control.
+ */
+export declare function isPlatformAccessGrantUsable(grant: Pick<PlatformAccessGrant, 'status' | 'expiresAt'> | undefined, now: Date): boolean;
+/**
+ * Clamp a requested duration to the server-side ceiling.
+ *
+ * Applied to every request path, including trusted ones. A caller asking for a longer window is not
+ * refused — being told "no, ask again with a smaller number" during an incident is friction with no
+ * security benefit, since the ceiling is what actually binds. They simply get the ceiling.
+ */
+export declare function resolvePlatformAccessGrantExpiry(requestedDurationMinutes: number | undefined, now: Date): Date;
+/**
+ * NOTE ON PLACEMENT — this enum lives with the VOCABULARY, not with the resource configuration,
+ * and moving it back would reintroduce a real defect.
+ *
+ * The authorization layer needs `REQUEST_ACCESS` by name (it is the bootstrap verb, exempt from the
+ * grant requirement it bootstraps). Importing that value from the resources-config module dragged
+ * resource-configuration evaluation into the authorizer's module graph, and schema construction that
+ * runs before the Zod decorators are initialised loses decorator metadata — which surfaced, far from
+ * here, as the ephemeral-disclosure catalogue losing an operation-level declaration. A vocabulary has
+ * no such side effects.
+ */
+/**
+ * Custom verbs. Ordinary CREATE/UPDATE/DELETE are deliberately NOT exposed:
+ *
+ * - CREATE would let a caller author `status`, `expiresAt` and `operatorUserId` directly, which are
+ *   precisely the fields whose server authorship IS the control.
+ * - UPDATE would be a second, ungated path to the status transitions `approve`/`deny`/`revoke` own.
+ * - DELETE exists but has NO client door — see its configuration below. An elevation either side could
+ *   erase is not evidence; the terminal statuses (DENIED / EXPIRED / REVOKED) are how a grant ends.
+ */
+export declare enum PlatformAccessGrants_Operations {
+    REQUEST_ACCESS = "requestAccess",
+    APPROVE = "approve",
+    DENY = "deny",
+    REVOKE = "revoke"
+}
+//# sourceMappingURL=platform-access-grants.shared.schemas.d.ts.map

package/dist/esm/security/authorizations/platform-access-grants.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-access-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;GAKG;AACH,oBAAY,yBAAyB;IACnC,wFAAwF;IACxF,gBAAgB,qBAAqB;IACrC,yFAAyF;IACzF,MAAM,WAAW;IACjB,gGAAgG;IAChG,MAAM,WAAW;IACjB;;;;;OAKG;IACH,OAAO,YAAY;IACnB,2EAA2E;IAC3E,OAAO,YAAY;CACpB;AAED;;;;;;;GAOG;AACH,oBAAY,sCAAsC;IAChD,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,yGAAyG;AACzG,oBAAY,qCAAqC;IAC/C,kGAAkG;IAClG,4BAA4B,iCAAiC;IAC7D;;;;;OAKG;IACH,qBAAqB,0BAA0B;CAChD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,8CAA8C,MAAM,CAAC;AAClE,eAAO,MAAM,8CAA8C,MAAM,CAAC;AAElE,0DAA0D;AAC1D,eAAO,MAAM,wCAAwC,EAAE,SAAS,yBAAyB,EAGxF,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;iBAqEpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,SAAS,EACpE,GAAG,EAAE,IAAI,GACR,OAAO,CAMT;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAM9G;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,oBAAY,+BAA+B;IACzC,cAAc,kBAAkB;IAChC,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,MAAM,WAAW;CAClB"}

package/dist/esm/security/authorizations/platform-access-grants.shared.schemas.js

@@ -0,0 +1,239 @@
+/**
+ * Platform Access Grants — time-bound, justified, optionally tenant-approved elevation that lets a
+ * platform operator cross the tenant boundary.
+ *
+ * ## Where this sits
+ *
+ * Wildo's answer to "may a platform super-administrator administer any tenant?" is YES, as at most
+ * B2B platforms. The question this resource answers is the narrower one that follows: *on what
+ * terms?* The progression, recorded in `.claude/rules/administrative-continuity-floors.md`:
+ *
+ *   ambient+unaudited → ambient+audited → declared, deny-by-default → **JIT/time-bound (here)**
+ *   → customer-approved (here, when the tenant opts in)
+ *
+ * Declaring a crossing per operation variant (`admitsCrossTenantPlatformAdministration`) removed
+ * AMBIENT authority: a crossing must now be asked for in code, reviewed, and specified. It did not
+ * remove STANDING authority — every platform administrator still held every declared crossing,
+ * permanently, over every tenant. That is the shape zero-standing-privilege programmes exist to
+ * eliminate, and what NIST SP 800-53 AC-2 / AC-6(1) mean by least privilege: privileged access is
+ * requested, scoped, time-boxed, and expires on its own.
+ *
+ * A grant is therefore required IN ADDITION to the variant's declaration. The declaration says
+ * "this verb MAY cross"; the grant says "this operator MAY cross into THIS tenant, until THIS time,
+ * for THIS reason". Neither is sufficient alone.
+ *
+ * ## The tenant-approval half (Lockbox)
+ *
+ * Microsoft Customer Lockbox and Google Access Approval let the CUSTOMER approve provider access
+ * before it happens. Wildo models that as {@link PlatformAccessGrantStatus.PENDING_APPROVAL}, gated
+ * per tenant so it is an opt-in posture rather than a deployment-wide one — the same shape those
+ * products ship, and for the same reason: a tenant that has not staffed an approver must not be
+ * unable to receive support.
+ *
+ * ## ⚠️ The interaction that is easy to get wrong
+ *
+ * Tenant approval and the administrative-continuity floors are in direct tension. Approval requires
+ * an administrator; the floors exist precisely because a tenant can end up WITHOUT one. Requiring a
+ * stranded tenant to approve its own repair is circular — the tenant cannot approve, so the repair
+ * cannot happen, so the tenant stays stranded.
+ *
+ * This is resolved by measurement, not by exception: when the target tenant has no administratively
+ * usable owner, the grant is auto-approved with
+ * {@link PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE} and recorded loudly. The
+ * condition is evaluated with the SAME predicate the owner floor uses to refuse writes, so the two
+ * can never disagree about whether a tenant can administer itself. An operator cannot manufacture
+ * the condition either: stranding a tenant is exactly what the floors refuse.
+ */
+import { z } from 'zod';
+import { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas.js';
+/**
+ * Lifecycle of one elevation request.
+ *
+ * A closed vocabulary with one named runtime source: schemas, guards, fixtures and comparisons all
+ * derive from this enum rather than repeating literals.
+ */
+export var PlatformAccessGrantStatus;
+(function (PlatformAccessGrantStatus) {
+    /** Awaiting a decision from an administrator of the TARGET tenant (Lockbox posture). */
+    PlatformAccessGrantStatus["PENDING_APPROVAL"] = "pending_approval";
+    /** Usable now. The admission predicate accepts this status, and only while unexpired. */
+    PlatformAccessGrantStatus["ACTIVE"] = "active";
+    /** The tenant refused. Terminal — a new request must be raised rather than this one retried. */
+    PlatformAccessGrantStatus["DENIED"] = "denied";
+    /**
+     * The window elapsed. Terminal, and reached WITHOUT a writer: the admission predicate compares
+     * `expiresAt` against now, so an expired grant stops working whether or not any sweeper has
+     * relabelled it. A background transition to this status is bookkeeping for humans and reporting,
+     * never the control.
+     */
+    PlatformAccessGrantStatus["EXPIRED"] = "expired";
+    /** Withdrawn before expiry, by the tenant or by the platform. Terminal. */
+    PlatformAccessGrantStatus["REVOKED"] = "revoked";
+})(PlatformAccessGrantStatus || (PlatformAccessGrantStatus = {}));
+/**
+ * Which step of a grant's life an audit row records.
+ *
+ * Distinct from {@link PlatformAccessGrantStatus}: a status is where the grant IS, a transition is
+ * what just happened to it. They differ where it matters — an auto-approved grant lands in `ACTIVE`
+ * through `REQUESTED`, never through `APPROVED`, and collapsing the two would erase exactly the
+ * distinction a customer audit asks about.
+ */
+export var PlatformAccessGrantLifecycleTransition;
+(function (PlatformAccessGrantLifecycleTransition) {
+    PlatformAccessGrantLifecycleTransition["REQUESTED"] = "requested";
+    PlatformAccessGrantLifecycleTransition["APPROVED"] = "approved";
+    PlatformAccessGrantLifecycleTransition["DENIED"] = "denied";
+    PlatformAccessGrantLifecycleTransition["REVOKED"] = "revoked";
+})(PlatformAccessGrantLifecycleTransition || (PlatformAccessGrantLifecycleTransition = {}));
+/** Why a grant became {@link PlatformAccessGrantStatus.ACTIVE} without a tenant administrator acting. */
+export var PlatformAccessGrantAutoApprovalReason;
+(function (PlatformAccessGrantAutoApprovalReason) {
+    /** The tenant has not opted into approval. The default posture, matching Lockbox being opt-in. */
+    PlatformAccessGrantAutoApprovalReason["TENANT_APPROVAL_NOT_REQUIRED"] = "tenant_approval_not_required";
+    /**
+     * The tenant has NO administratively usable owner, so no principal exists who could approve.
+     * Evaluated with the owner floor's own predicate — see this file's header for why the alternative
+     * (refusing) is circular. Recorded at high severity: this is the one path where operator access
+     * proceeds against a tenant that never consented and never could.
+     */
+    PlatformAccessGrantAutoApprovalReason["TENANT_CANNOT_APPROVE"] = "tenant_cannot_approve";
+})(PlatformAccessGrantAutoApprovalReason || (PlatformAccessGrantAutoApprovalReason = {}));
+/**
+ * The maximum life of a grant, and the default when a request names none.
+ *
+ * Four hours is a working session, not a working week: long enough that an operator is not
+ * re-requesting mid-incident, short enough that a forgotten grant is not a standing privilege by
+ * another name. Callers may request LESS; the ceiling is enforced server-side so a client cannot
+ * mint a long-lived elevation by asking for one.
+ */
+export const PLATFORM_ACCESS_GRANT_DEFAULT_DURATION_MINUTES = 240;
+export const PLATFORM_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES = 240;
+/** Statuses from which a grant can still be withdrawn. */
+export const PLATFORM_ACCESS_GRANT_REVOCABLE_STATUSES = [
+    PlatformAccessGrantStatus.PENDING_APPROVAL,
+    PlatformAccessGrantStatus.ACTIVE,
+];
+export const PlatformAccessGrantSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /**
+     * The TARGET tenant — the one being reached into, never the operator's own.
+     *
+     * This is the scope anchor: the grant is an organization-scoped row so the tenant can see, approve
+     * and revoke elevations raised against it. A grant the tenant cannot see would defeat the point of
+     * modelling consent at all.
+     */
+    organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),
+    /** The operator who requested the elevation. Server-authored from the session, never client-supplied. */
+    operatorUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    /**
+     * Why the operator needs access. REQUIRED, and deliberately not optional anywhere in the flow.
+     *
+     * An elevation record without a reason answers "who and when" but not "why", which is the only
+     * question a reviewer or a customer actually asks. `AC-2(7)` wants privileged assignment monitored;
+     * an unexplained monitored assignment is a log line, not a control.
+     */
+    // USER_CONTENT — free prose an OPERATOR typed, about why they need to reach a customer tenant.
+    // The data subject here is the operator, not the tenant's users; a notice covering staff must
+    // enumerate it, and it is exactly the free-text surface that can name a third party in passing.
+    justification: z.string().min(1).max(1000).isSummaryField()
+        .dataCategories(PersonalDataCategory.USER_CONTENT),
+    status: z.enum(PlatformAccessGrantStatus)
+        .systemEnum('PlatformAccessGrantStatus')
+        .default(PlatformAccessGrantStatus.PENDING_APPROVAL)
+        .isDBIndexed()
+        .isSummaryField()
+        .excludeFromCreate()
+        .excludeFromUpdate()
+        .isAuditEvidence(),
+    /**
+     * When the elevation stops working.
+     *
+     * Server-authored from the requested duration, clamped to
+     * {@link PLATFORM_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES}. The admission predicate reads THIS field
+     * rather than trusting `status`, so expiry needs no sweeper to take effect.
+     */
+    expiresAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    /** Set when a tenant administrator approved. Absent on an auto-approved grant — see {@link autoApprovalReason}. */
+    approvedByUserId: z.string().min(1).optional().isForeignKey().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    approvedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),
+    /**
+     * Present exactly when the grant became ACTIVE with no tenant administrator acting.
+     *
+     * Its absence on an ACTIVE grant is therefore meaningful: a human in the tenant approved it. That
+     * distinction is what a customer audit needs and what a single `approved: true` boolean would erase.
+     */
+    autoApprovalReason: z.enum(PlatformAccessGrantAutoApprovalReason)
+        .systemEnum('PlatformAccessGrantAutoApprovalReason')
+        .optional()
+        .excludeFromCreate()
+        .excludeFromUpdate()
+        .isAuditEvidence(),
+    /** The tenant's reason for refusing, or the revoker's reason for withdrawing. */
+    decisionReason: z.string().max(1000).optional().excludeFromCreate().excludeFromUpdate()
+        .dataCategories(PersonalDataCategory.USER_CONTENT),
+    createdAt: z.date().optional(),
+    updatedAt: z.date().optional(),
+});
+/**
+ * Is this grant usable RIGHT NOW?
+ *
+ * The single predicate every consumer must use — the admission check, the tenant's UI, and any
+ * report. Two independent conditions, and the expiry half is why this is a function rather than a
+ * status comparison: a grant whose window elapsed is unusable the moment it elapses, with no writer
+ * involved. Reading `status === ACTIVE` alone would honour a stale row for as long as no sweeper had
+ * run, turning a time-bound elevation back into a standing one.
+ *
+ * `now` is injected so callers can evaluate a grant at a decision time they already fixed, and so
+ * this stays testable without clock control.
+ */
+export function isPlatformAccessGrantUsable(grant, now) {
+    if (!grant)
+        return false;
+    if (grant.status !== PlatformAccessGrantStatus.ACTIVE)
+        return false;
+    return grant.expiresAt instanceof Date
+        ? grant.expiresAt.getTime() > now.getTime()
+        : new Date(grant.expiresAt).getTime() > now.getTime();
+}
+/**
+ * Clamp a requested duration to the server-side ceiling.
+ *
+ * Applied to every request path, including trusted ones. A caller asking for a longer window is not
+ * refused — being told "no, ask again with a smaller number" during an incident is friction with no
+ * security benefit, since the ceiling is what actually binds. They simply get the ceiling.
+ */
+export function resolvePlatformAccessGrantExpiry(requestedDurationMinutes, now) {
+    const requested = requestedDurationMinutes && requestedDurationMinutes > 0
+        ? requestedDurationMinutes
+        : PLATFORM_ACCESS_GRANT_DEFAULT_DURATION_MINUTES;
+    const minutes = Math.min(requested, PLATFORM_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES);
+    return new Date(now.getTime() + minutes * 60_000);
+}
+/**
+ * NOTE ON PLACEMENT — this enum lives with the VOCABULARY, not with the resource configuration,
+ * and moving it back would reintroduce a real defect.
+ *
+ * The authorization layer needs `REQUEST_ACCESS` by name (it is the bootstrap verb, exempt from the
+ * grant requirement it bootstraps). Importing that value from the resources-config module dragged
+ * resource-configuration evaluation into the authorizer's module graph, and schema construction that
+ * runs before the Zod decorators are initialised loses decorator metadata — which surfaced, far from
+ * here, as the ephemeral-disclosure catalogue losing an operation-level declaration. A vocabulary has
+ * no such side effects.
+ */
+/**
+ * Custom verbs. Ordinary CREATE/UPDATE/DELETE are deliberately NOT exposed:
+ *
+ * - CREATE would let a caller author `status`, `expiresAt` and `operatorUserId` directly, which are
+ *   precisely the fields whose server authorship IS the control.
+ * - UPDATE would be a second, ungated path to the status transitions `approve`/`deny`/`revoke` own.
+ * - DELETE exists but has NO client door — see its configuration below. An elevation either side could
+ *   erase is not evidence; the terminal statuses (DENIED / EXPIRED / REVOKED) are how a grant ends.
+ */
+export var PlatformAccessGrants_Operations;
+(function (PlatformAccessGrants_Operations) {
+    PlatformAccessGrants_Operations["REQUEST_ACCESS"] = "requestAccess";
+    PlatformAccessGrants_Operations["APPROVE"] = "approve";
+    PlatformAccessGrants_Operations["DENY"] = "deny";
+    PlatformAccessGrants_Operations["REVOKE"] = "revoke";
+})(PlatformAccessGrants_Operations || (PlatformAccessGrants_Operations = {}));
+//# sourceMappingURL=platform-access-grants.shared.schemas.js.map

package/dist/esm/security/authorizations/platform-access-grants.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-access-grants.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,CAAN,IAAY,yBAgBX;AAhBD,WAAY,yBAAyB;IACnC,wFAAwF;IACxF,kEAAqC,CAAA;IACrC,yFAAyF;IACzF,8CAAiB,CAAA;IACjB,gGAAgG;IAChG,8CAAiB,CAAA;IACjB;;;;;OAKG;IACH,gDAAmB,CAAA;IACnB,2EAA2E;IAC3E,gDAAmB,CAAA;AACrB,CAAC,EAhBW,yBAAyB,KAAzB,yBAAyB,QAgBpC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,sCAKX;AALD,WAAY,sCAAsC;IAChD,iEAAuB,CAAA;IACvB,+DAAqB,CAAA;IACrB,2DAAiB,CAAA;IACjB,6DAAmB,CAAA;AACrB,CAAC,EALW,sCAAsC,KAAtC,sCAAsC,QAKjD;AAED,yGAAyG;AACzG,MAAM,CAAN,IAAY,qCAUX;AAVD,WAAY,qCAAqC;IAC/C,kGAAkG;IAClG,sGAA6D,CAAA;IAC7D;;;;;OAKG;IACH,wFAA+C,CAAA;AACjD,CAAC,EAVW,qCAAqC,KAArC,qCAAqC,QAUhD;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAG,GAAG,CAAC;AAClE,MAAM,CAAC,MAAM,8CAA8C,GAAG,GAAG,CAAC;AAElE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,wCAAwC,GAAyC;IAC5F,yBAAyB,CAAC,gBAAgB;IAC1C,yBAAyB,CAAC,MAAM;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAErH,yGAAyG;IACzG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzI;;;;;;OAMG;IACH,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;SACxD,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAEpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;SACtC,UAAU,CAAC,2BAA2B,CAAC;SACvC,OAAO,CAAC,yBAAyB,CAAC,gBAAgB,CAAC;SACnD,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE5G,mHAAmH;IACnH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACvH,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEvE;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC;SAC9D,UAAU,CAAC,uCAAuC,CAAC;SACnD,QAAQ,EAAE;SACV,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB,iFAAiF;IACjF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACpF,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC;IAEpD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAoE,EACpE,GAAS;IAET,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,KAAK,CAAC,SAAS,YAAY,IAAI;QACpC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE;QAC3C,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,wBAA4C,EAAE,GAAS;IACtG,MAAM,SAAS,GAAG,wBAAwB,IAAI,wBAAwB,GAAG,CAAC;QACxE,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,8CAA8C,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAC;IACpF,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,mEAAgC,CAAA;IAChC,sDAAmB,CAAA;IACnB,gDAAa,CAAA;IACb,oDAAiB,CAAA;AACnB,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C","sourcesContent":["/**\n * Platform Access Grants — time-bound, justified, optionally tenant-approved elevation that lets a\n * platform operator cross the tenant boundary.\n *\n * ## Where this sits\n *\n * Wildo's answer to \"may a platform super-administrator administer any tenant?\" is YES, as at most\n * B2B platforms. The question this resource answers is the narrower one that follows: *on what\n * terms?* The progression, recorded in `.claude/rules/administrative-continuity-floors.md`:\n *\n *   ambient+unaudited → ambient+audited → declared, deny-by-default → **JIT/time-bound (here)**\n *   → customer-approved (here, when the tenant opts in)\n *\n * Declaring a crossing per operation variant (`admitsCrossTenantPlatformAdministration`) removed\n * AMBIENT authority: a crossing must now be asked for in code, reviewed, and specified. It did not\n * remove STANDING authority — every platform administrator still held every declared crossing,\n * permanently, over every tenant. That is the shape zero-standing-privilege programmes exist to\n * eliminate, and what NIST SP 800-53 AC-2 / AC-6(1) mean by least privilege: privileged access is\n * requested, scoped, time-boxed, and expires on its own.\n *\n * A grant is therefore required IN ADDITION to the variant's declaration. The declaration says\n * \"this verb MAY cross\"; the grant says \"this operator MAY cross into THIS tenant, until THIS time,\n * for THIS reason\". Neither is sufficient alone.\n *\n * ## The tenant-approval half (Lockbox)\n *\n * Microsoft Customer Lockbox and Google Access Approval let the CUSTOMER approve provider access\n * before it happens. Wildo models that as {@link PlatformAccessGrantStatus.PENDING_APPROVAL}, gated\n * per tenant so it is an opt-in posture rather than a deployment-wide one — the same shape those\n * products ship, and for the same reason: a tenant that has not staffed an approver must not be\n * unable to receive support.\n *\n * ## ⚠️ The interaction that is easy to get wrong\n *\n * Tenant approval and the administrative-continuity floors are in direct tension. Approval requires\n * an administrator; the floors exist precisely because a tenant can end up WITHOUT one. Requiring a\n * stranded tenant to approve its own repair is circular — the tenant cannot approve, so the repair\n * cannot happen, so the tenant stays stranded.\n *\n * This is resolved by measurement, not by exception: when the target tenant has no administratively\n * usable owner, the grant is auto-approved with\n * {@link PlatformAccessGrantAutoApprovalReason.TENANT_CANNOT_APPROVE} and recorded loudly. The\n * condition is evaluated with the SAME predicate the owner floor uses to refuse writes, so the two\n * can never disagree about whether a tenant can administer itself. An operator cannot manufacture\n * the condition either: stranding a tenant is exactly what the floors refuse.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\n\n/**\n * Lifecycle of one elevation request.\n *\n * A closed vocabulary with one named runtime source: schemas, guards, fixtures and comparisons all\n * derive from this enum rather than repeating literals.\n */\nexport enum PlatformAccessGrantStatus {\n  /** Awaiting a decision from an administrator of the TARGET tenant (Lockbox posture). */\n  PENDING_APPROVAL = 'pending_approval',\n  /** Usable now. The admission predicate accepts this status, and only while unexpired. */\n  ACTIVE = 'active',\n  /** The tenant refused. Terminal — a new request must be raised rather than this one retried. */\n  DENIED = 'denied',\n  /**\n   * The window elapsed. Terminal, and reached WITHOUT a writer: the admission predicate compares\n   * `expiresAt` against now, so an expired grant stops working whether or not any sweeper has\n   * relabelled it. A background transition to this status is bookkeeping for humans and reporting,\n   * never the control.\n   */\n  EXPIRED = 'expired',\n  /** Withdrawn before expiry, by the tenant or by the platform. Terminal. */\n  REVOKED = 'revoked',\n}\n\n/**\n * Which step of a grant's life an audit row records.\n *\n * Distinct from {@link PlatformAccessGrantStatus}: a status is where the grant IS, a transition is\n * what just happened to it. They differ where it matters — an auto-approved grant lands in `ACTIVE`\n * through `REQUESTED`, never through `APPROVED`, and collapsing the two would erase exactly the\n * distinction a customer audit asks about.\n */\nexport enum PlatformAccessGrantLifecycleTransition {\n  REQUESTED = 'requested',\n  APPROVED = 'approved',\n  DENIED = 'denied',\n  REVOKED = 'revoked',\n}\n\n/** Why a grant became {@link PlatformAccessGrantStatus.ACTIVE} without a tenant administrator acting. */\nexport enum PlatformAccessGrantAutoApprovalReason {\n  /** The tenant has not opted into approval. The default posture, matching Lockbox being opt-in. */\n  TENANT_APPROVAL_NOT_REQUIRED = 'tenant_approval_not_required',\n  /**\n   * The tenant has NO administratively usable owner, so no principal exists who could approve.\n   * Evaluated with the owner floor's own predicate — see this file's header for why the alternative\n   * (refusing) is circular. Recorded at high severity: this is the one path where operator access\n   * proceeds against a tenant that never consented and never could.\n   */\n  TENANT_CANNOT_APPROVE = 'tenant_cannot_approve',\n}\n\n/**\n * The maximum life of a grant, and the default when a request names none.\n *\n * Four hours is a working session, not a working week: long enough that an operator is not\n * re-requesting mid-incident, short enough that a forgotten grant is not a standing privilege by\n * another name. Callers may request LESS; the ceiling is enforced server-side so a client cannot\n * mint a long-lived elevation by asking for one.\n */\nexport const PLATFORM_ACCESS_GRANT_DEFAULT_DURATION_MINUTES = 240;\nexport const PLATFORM_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES = 240;\n\n/** Statuses from which a grant can still be withdrawn. */\nexport const PLATFORM_ACCESS_GRANT_REVOCABLE_STATUSES: readonly PlatformAccessGrantStatus[] = [\n  PlatformAccessGrantStatus.PENDING_APPROVAL,\n  PlatformAccessGrantStatus.ACTIVE,\n];\n\nexport const PlatformAccessGrantSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The TARGET tenant — the one being reached into, never the operator's own.\n   *\n   * This is the scope anchor: the grant is an organization-scoped row so the tenant can see, approve\n   * and revoke elevations raised against it. A grant the tenant cannot see would defeat the point of\n   * modelling consent at all.\n   */\n  organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate().isAuditEvidence(),\n\n  /** The operator who requested the elevation. Server-authored from the session, never client-supplied. */\n  operatorUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * Why the operator needs access. REQUIRED, and deliberately not optional anywhere in the flow.\n   *\n   * An elevation record without a reason answers \"who and when\" but not \"why\", which is the only\n   * question a reviewer or a customer actually asks. `AC-2(7)` wants privileged assignment monitored;\n   * an unexplained monitored assignment is a log line, not a control.\n   */\n  // USER_CONTENT — free prose an OPERATOR typed, about why they need to reach a customer tenant.\n  // The data subject here is the operator, not the tenant's users; a notice covering staff must\n  // enumerate it, and it is exactly the free-text surface that can name a third party in passing.\n  justification: z.string().min(1).max(1000).isSummaryField()\n    .dataCategories(PersonalDataCategory.USER_CONTENT),\n\n  status: z.enum(PlatformAccessGrantStatus)\n    .systemEnum('PlatformAccessGrantStatus')\n    .default(PlatformAccessGrantStatus.PENDING_APPROVAL)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /**\n   * When the elevation stops working.\n   *\n   * Server-authored from the requested duration, clamped to\n   * {@link PLATFORM_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES}. The admission predicate reads THIS field\n   * rather than trusting `status`, so expiry needs no sweeper to take effect.\n   */\n  expiresAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  /** Set when a tenant administrator approved. Absent on an auto-approved grant — see {@link autoApprovalReason}. */\n  approvedByUserId: z.string().min(1).optional().isForeignKey().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  approvedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n\n  /**\n   * Present exactly when the grant became ACTIVE with no tenant administrator acting.\n   *\n   * Its absence on an ACTIVE grant is therefore meaningful: a human in the tenant approved it. That\n   * distinction is what a customer audit needs and what a single `approved: true` boolean would erase.\n   */\n  autoApprovalReason: z.enum(PlatformAccessGrantAutoApprovalReason)\n    .systemEnum('PlatformAccessGrantAutoApprovalReason')\n    .optional()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /** The tenant's reason for refusing, or the revoker's reason for withdrawing. */\n  decisionReason: z.string().max(1000).optional().excludeFromCreate().excludeFromUpdate()\n    .dataCategories(PersonalDataCategory.USER_CONTENT),\n\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\n\nexport type PlatformAccessGrant = z.infer<typeof PlatformAccessGrantSchema>;\n\n/**\n * Is this grant usable RIGHT NOW?\n *\n * The single predicate every consumer must use — the admission check, the tenant's UI, and any\n * report. Two independent conditions, and the expiry half is why this is a function rather than a\n * status comparison: a grant whose window elapsed is unusable the moment it elapses, with no writer\n * involved. Reading `status === ACTIVE` alone would honour a stale row for as long as no sweeper had\n * run, turning a time-bound elevation back into a standing one.\n *\n * `now` is injected so callers can evaluate a grant at a decision time they already fixed, and so\n * this stays testable without clock control.\n */\nexport function isPlatformAccessGrantUsable(\n  grant: Pick<PlatformAccessGrant, 'status' | 'expiresAt'> | undefined,\n  now: Date,\n): boolean {\n  if (!grant) return false;\n  if (grant.status !== PlatformAccessGrantStatus.ACTIVE) return false;\n  return grant.expiresAt instanceof Date\n    ? grant.expiresAt.getTime() > now.getTime()\n    : new Date(grant.expiresAt).getTime() > now.getTime();\n}\n\n/**\n * Clamp a requested duration to the server-side ceiling.\n *\n * Applied to every request path, including trusted ones. A caller asking for a longer window is not\n * refused — being told \"no, ask again with a smaller number\" during an incident is friction with no\n * security benefit, since the ceiling is what actually binds. They simply get the ceiling.\n */\nexport function resolvePlatformAccessGrantExpiry(requestedDurationMinutes: number | undefined, now: Date): Date {\n  const requested = requestedDurationMinutes && requestedDurationMinutes > 0\n    ? requestedDurationMinutes\n    : PLATFORM_ACCESS_GRANT_DEFAULT_DURATION_MINUTES;\n  const minutes = Math.min(requested, PLATFORM_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES);\n  return new Date(now.getTime() + minutes * 60_000);\n}\n\n/**\n * NOTE ON PLACEMENT — this enum lives with the VOCABULARY, not with the resource configuration,\n * and moving it back would reintroduce a real defect.\n *\n * The authorization layer needs `REQUEST_ACCESS` by name (it is the bootstrap verb, exempt from the\n * grant requirement it bootstraps). Importing that value from the resources-config module dragged\n * resource-configuration evaluation into the authorizer's module graph, and schema construction that\n * runs before the Zod decorators are initialised loses decorator metadata — which surfaced, far from\n * here, as the ephemeral-disclosure catalogue losing an operation-level declaration. A vocabulary has\n * no such side effects.\n */\n/**\n * Custom verbs. Ordinary CREATE/UPDATE/DELETE are deliberately NOT exposed:\n *\n * - CREATE would let a caller author `status`, `expiresAt` and `operatorUserId` directly, which are\n *   precisely the fields whose server authorship IS the control.\n * - UPDATE would be a second, ungated path to the status transitions `approve`/`deny`/`revoke` own.\n * - DELETE exists but has NO client door — see its configuration below. An elevation either side could\n *   erase is not evidence; the terminal statuses (DENIED / EXPIRED / REVOKED) are how a grant ends.\n */\nexport enum PlatformAccessGrants_Operations {\n  REQUEST_ACCESS = 'requestAccess',\n  APPROVE = 'approve',\n  DENY = 'deny',\n  REVOKE = 'revoke',\n}\n"]}

package/dist/esm/security/authorizations/roles.shared.defaults.d.ts

@@ -4,7 +4,7 @@
  * Application-level roles directly linked to users (not organization-specific)
  * Similar behavior to OrganizationRole but for app-wide permissions
  */
-import { RolesConfiguration } from './roles.shared.schemas.js';
+import { RolesConfiguration } from './roles.shared.schemas';
 export declare const DEFAULT_APP_ROLE_CONFIGURATION: RolesConfiguration;
 export declare const DEFAULT_ORGANIZATION_ROLES: RolesConfiguration;
 //# sourceMappingURL=roles.shared.defaults.d.ts.map

package/dist/esm/security/authorizations/roles.shared.defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.shared.defaults.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/roles.shared.defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAkC,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5F,eAAO,MAAM,8BAA8B,EAAE,kBAmC5C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,kBA8BxC,CAAC"}
+{"version":3,"file":"roles.shared.defaults.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAkC,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5F,eAAO,MAAM,8BAA8B,EAAE,kBAwC5C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,kBA8BxC,CAAC"}

package/dist/esm/security/authorizations/roles.shared.defaults.js

@@ -7,6 +7,11 @@
 import { ResourcePrimaryScope } from '../../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from './roles.shared.schemas.js';
 export const DEFAULT_APP_ROLE_CONFIGURATION = {
+    [CORE_APP_ROLES.APP_PUBLIC]: {
+        role: CORE_APP_ROLES.APP_PUBLIC,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.APPLICATION
+    },
     [CORE_APP_ROLES.APP_USER]: {
         role: CORE_APP_ROLES.APP_USER,
         isSystemRole: true,
@@ -73,4 +78,4 @@ export const DEFAULT_ORGANIZATION_ROLES = {
         relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
     }
 };
-//# sourceMappingURL=roles.shared.defaults.js.map
+//# sourceMappingURL=roles.shared.defaults.js.map

package/dist/esm/security/authorizations/roles.shared.defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.shared.defaults.js","sourceRoot":"","sources":["../../../../src/security/authorizations/roles.shared.defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAsB,MAAM,wBAAwB,CAAC;AAE5F,MAAM,CAAC,MAAM,8BAA8B,GAAuB;IAChE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,IAAI,EAAE,cAAc,CAAC,QAAQ;QAC7B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE;QACjC,IAAI,EAAE,cAAc,CAAC,gBAAgB;QACrC,WAAW,EAAE,cAAc,CAAC,QAAQ;QACpC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;QAC3C,IAAI,EAAE,cAAc,CAAC,0BAA0B;QAC/C,WAAW,EAAE,cAAc,CAAC,gBAAgB;QAC5C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE;QAC1C,IAAI,EAAE,cAAc,CAAC,yBAAyB;QAC9C,WAAW,EAAE,cAAc,CAAC,gBAAgB;QAC5C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE;QACtC,IAAI,EAAE,cAAc,CAAC,qBAAqB;QAC1C,WAAW,EAAE,cAAc,CAAC,yBAAyB;QACrD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE;QAC9B,IAAI,EAAE,cAAc,CAAC,aAAa;QAClC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAuB;IAC5D,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;QAC3B,IAAI,EAAE,cAAc,CAAC,UAAU;QAC/B,WAAW,EAAE,cAAc,CAAC,SAAS;QACrC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE;QAC5B,IAAI,EAAE,cAAc,CAAC,WAAW;QAChC,WAAW,EAAE,cAAc,CAAC,UAAU;QACtC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,WAAW,EAAE,cAAc,CAAC,WAAW;QACvC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,WAAW,EAAE,cAAc,CAAC,SAAS;QACrC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;CACF,CAAC"}
+{"version":3,"file":"roles.shared.defaults.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAsB,MAAM,wBAAwB,CAAC;AAE5F,MAAM,CAAC,MAAM,8BAA8B,GAAuB;IAChE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;QAC3B,IAAI,EAAE,cAAc,CAAC,UAAU;QAC/B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,IAAI,EAAE,cAAc,CAAC,QAAQ;QAC7B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE;QACjC,IAAI,EAAE,cAAc,CAAC,gBAAgB;QACrC,WAAW,EAAE,cAAc,CAAC,QAAQ;QACpC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;QAC3C,IAAI,EAAE,cAAc,CAAC,0BAA0B;QAC/C,WAAW,EAAE,cAAc,CAAC,gBAAgB;QAC5C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE;QAC1C,IAAI,EAAE,cAAc,CAAC,yBAAyB;QAC9C,WAAW,EAAE,cAAc,CAAC,gBAAgB;QAC5C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE;QACtC,IAAI,EAAE,cAAc,CAAC,qBAAqB;QAC1C,WAAW,EAAE,cAAc,CAAC,yBAAyB;QACrD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE;QAC9B,IAAI,EAAE,cAAc,CAAC,aAAa;QAClC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAuB;IAC5D,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;QAC3B,IAAI,EAAE,cAAc,CAAC,UAAU;QAC/B,WAAW,EAAE,cAAc,CAAC,SAAS;QACrC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE;QAC5B,IAAI,EAAE,cAAc,CAAC,WAAW;QAChC,WAAW,EAAE,cAAc,CAAC,UAAU;QACtC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,WAAW,EAAE,cAAc,CAAC,WAAW;QACvC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,WAAW,EAAE,cAAc,CAAC,SAAS;QACrC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;CACF,CAAC","sourcesContent":["/**\n * App Roles Shared Schemas\n *\n * Application-level roles directly linked to users (not organization-specific)\n * Similar behavior to OrganizationRole but for app-wide permissions\n */\n\nimport { ResourcePrimaryScope } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES, RolesConfiguration } from './roles.shared.schemas';\n\nexport const DEFAULT_APP_ROLE_CONFIGURATION: RolesConfiguration = {\n  [CORE_APP_ROLES.APP_PUBLIC]: {\n    role: CORE_APP_ROLES.APP_PUBLIC,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_USER]: {\n    role: CORE_APP_ROLES.APP_USER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_VIEWER]: {\n    role: CORE_APP_ROLES.APP_ADMIN_VIEWER,\n    inheritFrom: CORE_APP_ROLES.APP_USER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR]: {\n    role: CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR,\n    inheritFrom: CORE_APP_ROLES.APP_ADMIN_VIEWER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER]: {\n    role: CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,\n    inheritFrom: CORE_APP_ROLES.APP_ADMIN_VIEWER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN]: {\n    role: CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,\n    inheritFrom: CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ANONYMOUS]: {\n    role: CORE_APP_ROLES.APP_ANONYMOUS,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n};\n\nexport const DEFAULT_ORGANIZATION_ROLES: RolesConfiguration = {\n  [CORE_ORG_ROLES.ORG_GUEST]: {\n    role: CORE_ORG_ROLES.ORG_GUEST,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_MEMBER]: {\n    role: CORE_ORG_ROLES.ORG_MEMBER,\n    inheritFrom: CORE_ORG_ROLES.ORG_GUEST,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_MANAGER]: {\n    role: CORE_ORG_ROLES.ORG_MANAGER,\n    inheritFrom: CORE_ORG_ROLES.ORG_MEMBER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_ADMIN]: {\n    role: CORE_ORG_ROLES.ORG_ADMIN,\n    inheritFrom: CORE_ORG_ROLES.ORG_MANAGER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_OWNER]: {\n    role: CORE_ORG_ROLES.ORG_OWNER,\n    inheritFrom: CORE_ORG_ROLES.ORG_ADMIN,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  }\n};\n\n"]}

package/dist/esm/security/authorizations/roles.shared.schemas.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { ResourcePrimaryScope } from '../../resources/resources.shared.schemas.js';
+import { ResourcePrimaryScope } from '../../resources/resources.shared.schemas';
 export declare enum CORE_APP_ROLES {
     /** Unauthenticated access. Operations with APP_PUBLIC are accessible without auth. */
     APP_PUBLIC = "APP_PUBLIC",
@@ -11,6 +11,15 @@ export declare enum CORE_APP_ROLES {
     /** Anonymous session access. Operations with APP_ANONYMOUS are accessible to anonymous users. */
     APP_ANONYMOUS = "APP_ANONYMOUS"
 }
+/**
+ * Authorities that administer the generated application itself.
+ *
+ * This named subset is the canonical boundary used by consumer-facing
+ * products such as the API reference. It prevents each downstream consumer
+ * from guessing administrative meaning from `APP_ADMIN_` spelling or copying
+ * an independent list that drifts when the role vocabulary evolves.
+ */
+export declare const CORE_APPLICATION_ADMINISTRATION_ROLES: readonly CORE_APP_ROLES[];
 export declare enum CORE_ORG_ROLES {
     ORG_GUEST = "ORG_GUEST",
     ORG_OWNER = "ORG_OWNER",
@@ -27,14 +36,14 @@ export declare const RoleDefinitionSchema: z.ZodObject<{
     inheritFrom: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>>;
     isSystemRole: z.ZodDefault<z.ZodBoolean>;
     relatedPrimaryScope: z.ZodEnum<typeof ResourcePrimaryScope>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type RoleDefinition = z.infer<typeof RoleDefinitionSchema>;
 export declare const RolesConfigurationSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     role: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>;
     inheritFrom: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>>;
     isSystemRole: z.ZodDefault<z.ZodBoolean>;
     relatedPrimaryScope: z.ZodEnum<typeof ResourcePrimaryScope>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip>>;
 export type Roles = z.infer<typeof RolesSchema>;
 export type CoreRoles = z.infer<typeof CoreRolesSchema>;
 export type AppRoles = z.infer<typeof AppRolesSchema>;

package/dist/esm/security/authorizations/roles.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/roles.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAEhF,oBAAY,cAAc;IACxB,sFAAsF;IACtF,UAAU,eAAe;IACzB,qBAAqB,0BAA0B;IAC/C,yBAAyB,8BAA8B;IACvD,0BAA0B,+BAA+B;IACzD,gBAAgB,qBAAqB;IACrC,QAAQ,aAAa;IACrB,iGAAiG;IACjG,aAAa,kBAAkB;CAChC;AAED,oBAAY,cAAc;IACxB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;CAC1B;AAGD,eAAO,MAAM,eAAe,2FAG1B,CAAC;AAEH,eAAO,MAAM,WAAW,wGAItB,CAAC;AAEH,eAAO,MAAM,cAAc,sEAGzB,CAAC;AAEH,eAAO,MAAM,cAAc,sEAGzB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;uCAK/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;wCAYpC,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAChD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"roles.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAEhF,oBAAY,cAAc;IACxB,sFAAsF;IACtF,UAAU,eAAe;IACzB,qBAAqB,0BAA0B;IAC/C,yBAAyB,8BAA8B;IACvD,0BAA0B,+BAA+B;IACzD,gBAAgB,qBAAqB;IACrC,QAAQ,aAAa;IACrB,iGAAiG;IACjG,aAAa,kBAAkB;CAChC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC,EAAE,SAAS,cAAc,EAKzE,CAAC;AAEH,oBAAY,cAAc;IACxB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;CAC1B;AAGD,eAAO,MAAM,eAAe,2FAG1B,CAAC;AAEH,eAAO,MAAM,WAAW,wGAItB,CAAC;AAEH,eAAO,MAAM,cAAc,sEAGzB,CAAC;AAEH,eAAO,MAAM,cAAc,sEAGzB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;kBAYpC,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAChD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/security/authorizations/roles.shared.schemas.js

@@ -12,6 +12,20 @@ export var CORE_APP_ROLES;
     /** Anonymous session access. Operations with APP_ANONYMOUS are accessible to anonymous users. */
     CORE_APP_ROLES["APP_ANONYMOUS"] = "APP_ANONYMOUS";
 })(CORE_APP_ROLES || (CORE_APP_ROLES = {}));
+/**
+ * Authorities that administer the generated application itself.
+ *
+ * This named subset is the canonical boundary used by consumer-facing
+ * products such as the API reference. It prevents each downstream consumer
+ * from guessing administrative meaning from `APP_ADMIN_` spelling or copying
+ * an independent list that drifts when the role vocabulary evolves.
+ */
+export const CORE_APPLICATION_ADMINISTRATION_ROLES = Object.freeze([
+    CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,
+    CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,
+    CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR,
+    CORE_APP_ROLES.APP_ADMIN_VIEWER,
+]);
 export var CORE_ORG_ROLES;
 (function (CORE_ORG_ROLES) {
     CORE_ORG_ROLES["ORG_GUEST"] = "ORG_GUEST";
@@ -55,4 +69,4 @@ export const RolesConfigurationSchema = z.record(z.string(), RoleDefinitionSchem
         }
     });
 });
-//# sourceMappingURL=roles.shared.schemas.js.map
+//# sourceMappingURL=roles.shared.schemas.js.map

package/dist/esm/security/authorizations/roles.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authorizations/roles.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAEhF,MAAM,CAAN,IAAY,cAUX;AAVD,WAAY,cAAc;IACxB,sFAAsF;IACtF,2CAAyB,CAAA;IACzB,iEAA+C,CAAA;IAC/C,yEAAuD,CAAA;IACvD,2EAAyD,CAAA;IACzD,uDAAqC,CAAA;IACrC,uCAAqB,CAAA;IACrB,iGAAiG;IACjG,iDAA+B,CAAA;AACjC,CAAC,EAVW,cAAc,KAAd,cAAc,QAUzB;AAED,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,yCAAuB,CAAA;IACvB,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,2CAAyB,CAAA;AAC3B,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AAGD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC;IACjC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,mBAAmB,EAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;CACnD,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,MAAM,CACvF,CAAC,MAAM,EAAE,EAAE;IACT,yCAAyC;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACrC,IAAI,CAAC;YACH,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}
+{"version":3,"file":"roles.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAEhF,MAAM,CAAN,IAAY,cAUX;AAVD,WAAY,cAAc;IACxB,sFAAsF;IACtF,2CAAyB,CAAA;IACzB,iEAA+C,CAAA;IAC/C,yEAAuD,CAAA;IACvD,2EAAyD,CAAA;IACzD,uDAAqC,CAAA;IACrC,uCAAqB,CAAA;IACrB,iGAAiG;IACjG,iDAA+B,CAAA;AACjC,CAAC,EAVW,cAAc,KAAd,cAAc,QAUzB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAA8B,MAAM,CAAC,MAAM,CAAC;IAC5F,cAAc,CAAC,qBAAqB;IACpC,cAAc,CAAC,yBAAyB;IACxC,cAAc,CAAC,0BAA0B;IACzC,cAAc,CAAC,gBAAgB;CAChC,CAAC,CAAC;AAEH,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,yCAAuB,CAAA;IACvB,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,2CAAyB,CAAA;AAC3B,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AAGD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC;IACjC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,mBAAmB,EAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;CACnD,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,MAAM,CACvF,CAAC,MAAM,EAAE,EAAE;IACT,yCAAyC;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACrC,IAAI,CAAC;YACH,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC","sourcesContent":["\nimport { z } from 'zod';\nimport { ResourcePrimaryScope } from '../../resources/resources.shared.schemas';\n\nexport enum CORE_APP_ROLES {\n  /** Unauthenticated access. Operations with APP_PUBLIC are accessible without auth. */\n  APP_PUBLIC = 'APP_PUBLIC',\n  APP_ADMIN_SUPER_ADMIN = 'APP_ADMIN_SUPER_ADMIN',\n  APP_ADMIN_BILLING_MANAGER = 'APP_ADMIN_BILLING_MANAGER',\n  APP_ADMIN_MARKETING_EDITOR = 'APP_ADMIN_MARKETING_EDITOR',\n  APP_ADMIN_VIEWER = 'APP_ADMIN_VIEWER',\n  APP_USER = 'APP_USER',\n  /** Anonymous session access. Operations with APP_ANONYMOUS are accessible to anonymous users. */\n  APP_ANONYMOUS = 'APP_ANONYMOUS',\n}\n\n/**\n * Authorities that administer the generated application itself.\n *\n * This named subset is the canonical boundary used by consumer-facing\n * products such as the API reference. It prevents each downstream consumer\n * from guessing administrative meaning from `APP_ADMIN_` spelling or copying\n * an independent list that drifts when the role vocabulary evolves.\n */\nexport const CORE_APPLICATION_ADMINISTRATION_ROLES: readonly CORE_APP_ROLES[] = Object.freeze([\n  CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,\n  CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,\n  CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR,\n  CORE_APP_ROLES.APP_ADMIN_VIEWER,\n]);\n\nexport enum CORE_ORG_ROLES {\n  ORG_GUEST = 'ORG_GUEST',\n  ORG_OWNER = 'ORG_OWNER',\n  ORG_ADMIN = 'ORG_ADMIN',\n  ORG_MANAGER = 'ORG_MANAGER',\n  ORG_MEMBER = 'ORG_MEMBER',\n}\n\n\nexport const CoreRolesSchema = z.union([\n  z.enum(CORE_APP_ROLES),\n  z.enum(CORE_ORG_ROLES),\n]);\n\nexport const RolesSchema = z.union([\n  z.enum(CORE_APP_ROLES),\n  z.enum(CORE_ORG_ROLES),\n  z.string().min(1),\n]);\n\nexport const AppRolesSchema = z.union([\n  z.enum(CORE_APP_ROLES),\n  z.string().min(1),\n]);\n\nexport const OrgRolesSchema = z.union([\n  z.enum(CORE_ORG_ROLES),\n  z.string().min(1),\n]);\n\nexport const RoleDefinitionSchema = z.object({\n  role: RolesSchema,\n  inheritFrom: RolesSchema.optional(),\n  isSystemRole: z.boolean().default(false),\n  relatedPrimaryScope : z.enum(ResourcePrimaryScope),\n});\n\n\nexport type RoleDefinition = z.infer<typeof RoleDefinitionSchema>;\n\nexport const RolesConfigurationSchema = z.record(z.string(), RoleDefinitionSchema).refine(\n  (record) => {\n    // Validate that all keys are valid roles\n    return Object.keys(record).every(key => {\n      try {\n        RolesSchema.parse(key);\n        return true;\n      } catch {\n        return false;\n      }\n    });\n  }\n);\n\nexport type Roles = z.infer<typeof RolesSchema>;\nexport type CoreRoles = z.infer<typeof CoreRolesSchema>;\nexport type AppRoles = z.infer<typeof AppRolesSchema>;\nexport type OrgRoles = z.infer<typeof OrgRolesSchema>;\nexport type RolesConfiguration = z.infer<typeof RolesConfigurationSchema>;\n"]}