@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-consent-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAC3E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,kGAAkG;IAClG,oGAAoG;IACpG,qGAAqG;IACrG,kGAAkG;IAClG,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,iGAAiG;QACjG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACrJ;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACrJ;SACF;QACD,mGAAmG;QACnG,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aAC1K;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aAC1K;SACF;QACD,gGAAgG;QAChG,qGAAqG;QACrG,yBAAyB;QACzB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aACxJ;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * OIDC Persistent Consent Grants — Resource Configuration\n *\n * USER_SELF-scoped (the scope is derived from the `USERS → OAUTH_CONSENT_GRANTS` composition\n * relationship). READ / LIST / DELETE are OWNER-facing (`API_CALL` + `APP_USER`): the framework's\n * USER_SELF primary-scope filter restricts every result to the authenticated caller's own grants, so a\n * user can list their \"authorized apps\" and revoke one, and nobody can see or delete another user's\n * grants. CREATE / UPDATE are SYSTEM-only (`INTERNAL_CALL`): the OIDC consent-decision endpoint is the\n * sole writer, via the `createAsSystem` / `updateAsSystem` primitives.\n *\n * `systemAccessPolicy` opts the write + read verbs into the `*AsSystem` door (default is fail-closed\n * FORBIDDEN): the decision endpoint create/updates a grant with no request-context FK to attach\n * (`userId` is re-attached from the schema allowlist on the system path), and the authorize endpoint\n * read/lists a user's grants to decide whether to skip the prompt. There is no `delete` system-access\n * verb (none exists); owner revoke goes through the `API_CALL` DELETE route, and the USERS\n * `onParentDelete` composition cascade deletes grants directly at the repository layer (variant-agnostic).\n */\n\nimport { OAuthConsentGrantSchema } from './oauth-consent-grants.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../../compliance/privacy/subject-export.shared.schemas';\n\nexport const oauthConsentGrantsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE,\n  typeof OAuthConsentGrantSchema\n>({\n  mainSchema: OAuthConsentGrantSchema,\n  resourceIdentifier: CoreResourceType.OAUTH_CONSENT_GRANTS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.OAUTH_CONSENT_GRANTS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // The OIDC consent-decision endpoint stores/updates grants via createAsSystem/updateAsSystem (the\n  // client-shaped CREATE DTO strips the context FK `userId`, re-attached from the schema allowlist on\n  // the system path); the authorize endpoint reads/lists a user's grants via readAsSystem/listAsSystem\n  // to decide whether to skip the consent prompt. Default is fail-closed FORBIDDEN, so opt each in.\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n  },\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n  operationsConfiguration: {\n    // Owner-facing: the USER_SELF primary-scope filter restricts results to the caller's own grants.\n    [CoreResourceOperation.READ]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.LOW },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.LOW },\n      ],\n    },\n    // System-only: the consent-decision endpoint is the sole writer (createAsSystem / updateAsSystem).\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n      ],\n    },\n    // Owner-facing revoke (USER_SELF filter → own grant only). The USERS onParentDelete composition\n    // cascade also deletes grants, directly at the repository layer (variant-agnostic — it only requires\n    // a DELETE op to exist).\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.d.ts

@@ -0,0 +1,29 @@
+/**
+ * OIDC Persistent Consent Grants ("remember this app")
+ *
+ * A durable "user X authorized OAuth client Y for identity scopes Z (at resource R)" record. It is
+ * CREATED (via the system write primitive) when a user APPROVES an interactive-consent request AND
+ * opts to remember the app, and READ at `/oauth/authorize` to SKIP re-prompting when an existing grant
+ * already covers the requested scopes. The user can list their grants ("authorized apps") and revoke
+ * one.
+ *
+ * USER-scoped: owned by `userId` (USER_SELF primary scope, derived from the `USERS → OAUTH_CONSENT_GRANTS`
+ * composition relationship). One grant per `(userId, clientId, resource)` — a re-consent UPDATES the
+ * granted scopes rather than creating a duplicate. `resource` participates in the grain because two
+ * authorize requests from the same client for different RFC 8707 resources (distinct A2A / MCP agent
+ * endpoints) are genuinely distinct delegations; an OIDC-only login carries no `resource` and yields a
+ * single resource-less grant.
+ */
+import { z } from 'zod';
+export declare const OAuthConsentGrantSchema: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    clientId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    resource: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    scopes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
+}, z.core.$strip>>;
+export type OAuthConsentGrant = z.infer<typeof OAuthConsentGrantSchema>;
+//# sourceMappingURL=oauth-consent-grants.shared.schemas.d.ts.map

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-consent-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,uBAAuB;;;;;;;;;kBAuClC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.js

@@ -0,0 +1,53 @@
+/**
+ * OIDC Persistent Consent Grants ("remember this app")
+ *
+ * A durable "user X authorized OAuth client Y for identity scopes Z (at resource R)" record. It is
+ * CREATED (via the system write primitive) when a user APPROVES an interactive-consent request AND
+ * opts to remember the app, and READ at `/oauth/authorize` to SKIP re-prompting when an existing grant
+ * already covers the requested scopes. The user can list their grants ("authorized apps") and revoke
+ * one.
+ *
+ * USER-scoped: owned by `userId` (USER_SELF primary scope, derived from the `USERS → OAUTH_CONSENT_GRANTS`
+ * composition relationship). One grant per `(userId, clientId, resource)` — a re-consent UPDATES the
+ * granted scopes rather than creating a duplicate. `resource` participates in the grain because two
+ * authorize requests from the same client for different RFC 8707 resources (distinct A2A / MCP agent
+ * endpoints) are genuinely distinct delegations; an OIDC-only login carries no `resource` and yields a
+ * single resource-less grant.
+ */
+import { z } from 'zod';
+import { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas.js';
+export const OAuthConsentGrantSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** FK → USERS — the user who granted consent (the USER_SELF scope owner). */
+    userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
+    /** The registered OAuth client (`_id`, `oc_*`) the user authorized. Part of the business key. */
+    clientId: z.string().min(1).isDBIndexed().isSummaryField(),
+    /**
+     * The RFC 8707 `resource` (the target A2A / MCP agent endpoint) this grant covers. Absent for an
+     * OIDC-only login with no delegation. Part of the business key — a grant authorizes one client for
+     * one resource, so different agent endpoints require separate, explicit consent.
+     */
+    resource: z.string().optional().isDBIndexed().isSummaryField(),
+    /**
+     * The IDENTITY scopes the user granted (e.g. `openid`, `profile`, `email`). A later authorize whose
+     * requested scopes are a SUBSET of these skips the prompt; a request for a scope NOT in the grant
+     * re-prompts (silent scope expansion is forbidden). Identity only — scopes carry no authorization
+     * weight (authorization is roles-only).
+     */
+    // USAGE — what this person authorized a third-party client to reach on their behalf, and when.
+    // A consent record is an observation of a decision they made, not an attribute of them.
+    scopes: z.array(z.string()).default([]).dataCategories(PersonalDataCategory.USAGE),
+    /**
+     * Optional expiry. When set, the authorize lookup ignores a grant past this instant (fail-closed to a
+     * fresh consent prompt). No operator TTL is authored in v1; the field future-proofs a policy knob
+     * without a schema reshape.
+     */
+    expiresAt: z.date().optional().isDBIndexed(),
+    createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),
+    updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+}).businessKeySet([
+    'userId',
+    'clientId',
+    'resource',
+]);
+//# sourceMappingURL=oauth-consent-grants.shared.schemas.js.map

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-consent-grants.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AAEtG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,6EAA6E;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,iGAAiG;IACjG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE1D;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE9D;;;;;OAKG;IACH,+FAA+F;IAC/F,wFAAwF;IACxF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC;IAElF;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,UAAU;IACV,UAAU;CACX,CAAC,CAAC","sourcesContent":["/**\n * OIDC Persistent Consent Grants (\"remember this app\")\n *\n * A durable \"user X authorized OAuth client Y for identity scopes Z (at resource R)\" record. It is\n * CREATED (via the system write primitive) when a user APPROVES an interactive-consent request AND\n * opts to remember the app, and READ at `/oauth/authorize` to SKIP re-prompting when an existing grant\n * already covers the requested scopes. The user can list their grants (\"authorized apps\") and revoke\n * one.\n *\n * USER-scoped: owned by `userId` (USER_SELF primary scope, derived from the `USERS → OAUTH_CONSENT_GRANTS`\n * composition relationship). One grant per `(userId, clientId, resource)` — a re-consent UPDATES the\n * granted scopes rather than creating a duplicate. `resource` participates in the grain because two\n * authorize requests from the same client for different RFC 8707 resources (distinct A2A / MCP agent\n * endpoints) are genuinely distinct delegations; an OIDC-only login carries no `resource` and yields a\n * single resource-less grant.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\n\nexport const OAuthConsentGrantSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** FK → USERS — the user who granted consent (the USER_SELF scope owner). */\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  /** The registered OAuth client (`_id`, `oc_*`) the user authorized. Part of the business key. */\n  clientId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * The RFC 8707 `resource` (the target A2A / MCP agent endpoint) this grant covers. Absent for an\n   * OIDC-only login with no delegation. Part of the business key — a grant authorizes one client for\n   * one resource, so different agent endpoints require separate, explicit consent.\n   */\n  resource: z.string().optional().isDBIndexed().isSummaryField(),\n\n  /**\n   * The IDENTITY scopes the user granted (e.g. `openid`, `profile`, `email`). A later authorize whose\n   * requested scopes are a SUBSET of these skips the prompt; a request for a scope NOT in the grant\n   * re-prompts (silent scope expansion is forbidden). Identity only — scopes carry no authorization\n   * weight (authorization is roles-only).\n   */\n  // USAGE — what this person authorized a third-party client to reach on their behalf, and when.\n  // A consent record is an observation of a decision they made, not an attribute of them.\n  scopes: z.array(z.string()).default([]).dataCategories(PersonalDataCategory.USAGE),\n\n  /**\n   * Optional expiry. When set, the authorize lookup ignores a grant past this instant (fail-closed to a\n   * fresh consent prompt). No operator TTL is authored in v1; the field future-proofs a policy knob\n   * without a schema reshape.\n   */\n  expiresAt: z.date().optional().isDBIndexed(),\n\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'userId',\n  'clientId',\n  'resource',\n]);\n\nexport type OAuthConsentGrant = z.infer<typeof OAuthConsentGrantSchema>;\n"]}

package/dist/esm/security/oauth-clients/oauth-resource-server.shared.schemas.d.ts

@@ -0,0 +1,117 @@
+import { z } from 'zod';
+import { ManualControllerRouteKey } from '../../requests/manual-controllers-routes-urls';
+/**
+ * OAuth 2.0 **Resource Servers** exposed by a Wildo app — the token-CONSUMING surfaces, each
+ * with its OWN canonical audience URI (RFC 8707 §2, "Resource Indicators for OAuth 2.0").
+ *
+ * ## What this is (and is NOT)
+ *
+ * A `ResourceServerKind` identifies WHICH endpoint may consume a token — it is an
+ * **audience / transport** concept, a confused-deputy + token-replay defense
+ * (RFC 8707: "an audience-restricted access token … cannot then be taken by that resource
+ * and presented elsewhere"). It is **NOT** an authorization axis: it never decides WHAT a
+ * token may do at a surface. Authorization at every resource server is **roles-only** — the
+ * framework's RBAC (scope-based authorization was removed 2026-07-21). So:
+ *
+ * - **Audience** (this enum) answers *"at which door may this token be presented?"*
+ * - **Roles** answer *"what may it do once through that door?"*
+ *
+ * The two compose; they are not competing vocabularies.
+ *
+ * ## The three resource servers
+ *
+ * | Kind  | Surface                                   | Canonical audience (`aud`)          |
+ * |-------|-------------------------------------------|-------------------------------------|
+ * | `API` | generic HTTP resource API (CRUD)          | `<appPublicBase>/api/v1`            |
+ * | `A2A` | Agent2Agent endpoint (external agents)    | `<API audience>/a2a`               |
+ * | `MCP` | Model Context Protocol tool endpoint      | `<API audience>/mcp`               |
+ *
+ * ## Standards
+ *
+ * - **RFC 8707** — a token is minted `aud`-bound to the resource server it targets; the AS is
+ *   told the target via the `resource` request parameter.
+ * - **RFC 9728** (Protected Resource Metadata) — each server publishes
+ *   `/.well-known/oauth-protected-resource` advertising its trusted authorization server.
+ * - **MCP / A2A authorization specs** — the MCP server (and A2A agent) MUST verify a received
+ *   token is `aud`-restricted to ITSELF and MUST reject tokens not issued for it.
+ *
+ * Resolve a kind's canonical audience via
+ * `AppConfigurationService.resolveResourceServerAudience(kind)` (backend) — the SINGLE SOURCE
+ * OF TRUTH so minting and validation cannot drift.
+ */
+export declare enum ResourceServerKind {
+    /** The generic HTTP resource API (CRUD on resources), mounted at the API base path. */
+    API = "api",
+    /** The Agent2Agent (A2A) endpoint — external agents acting on behalf of a user or a machine. */
+    A2A = "a2a",
+    /** The Model Context Protocol (MCP) endpoint — a curated subset of operations exposed as MCP tools. */
+    MCP = "mcp"
+}
+/**
+ * The mount-path route each NON-`API` resource server appends to the API audience to form its
+ * canonical audience URI (see {@link ResourceServerKind}). `API` is the API base itself, so it
+ * is intentionally absent here. Keeping the mapping in `_core` next to the enum guarantees the
+ * audience derivation is identical everywhere it is computed.
+ */
+export declare const RESOURCE_SERVER_MOUNT_ROUTE: Record<Exclude<ResourceServerKind, ResourceServerKind.API>, ManualControllerRouteKey>;
+/** The resource servers that a USER-DELEGATED token may legitimately target (never the main API —
+ *  a delegated token must be confined to an agent surface, per B-S2 / the audience-confinement rule). */
+export declare const DELEGATED_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[];
+/**
+ * The resource servers a MACHINE (client-credentials) token may be audience-bound to — ALL of them.
+ * Unlike a user-delegated token (confined to agent surfaces), a machine principal legitimately calls
+ * the generic API directly AND the A2A / MCP endpoints. The `client_credentials` token endpoint
+ * validates the requested RFC 8707 `resource` against this set and mints an `aud`-bound token for the
+ * named surface (an absent `resource` deliberately selects the generic API audience). Each resource server then accepts
+ * a token bound to its OWN audience (per-endpoint, tight) — the confused-deputy / token-passthrough
+ * defense — while the main API accepts only the API audience, so a per-endpoint token cannot be
+ * replayed there.
+ */
+export declare const MACHINE_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[];
+/**
+ * The resource-server kinds that support MULTIPLE NAMED INSTANCES (R-2). `API` is excluded: there is
+ * exactly one generic resource API per app, so an instance ref never applies to it.
+ */
+export declare const INSTANCEABLE_RESOURCE_SERVERS: readonly ResourceServerKind[];
+/**
+ * A named **MCP server**: its own `/mcp/<ref>` URL, RFC 8707 audience, protected-resource metadata and
+ * curated tool catalog. Membership is declared on the OPERATION (`operation.mcp.servers`), never here —
+ * which is why this branch carries no membership list of its own.
+ */
+export declare const McpServerInstanceSchema: z.ZodObject<{
+    kind: z.ZodLiteral<ResourceServerKind.MCP>;
+    ref: z.ZodString;
+    displayName: z.ZodString;
+    description: z.ZodString;
+}, z.core.$strip>;
+/**
+ * A named **A2A agent**: its own `/a2a/<ref>` URL, RFC 8707 audience, agent card and skill subset. A
+ * distinct agent IDENTITY, not a view onto the default card.
+ */
+export declare const A2aAgentInstanceSchema: z.ZodObject<{
+    kind: z.ZodLiteral<ResourceServerKind.A2A>;
+    actorSystemRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    ref: z.ZodString;
+    displayName: z.ZodString;
+    description: z.ZodString;
+}, z.core.$strip>;
+export declare const ResourceServerInstanceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<ResourceServerKind.MCP>;
+    ref: z.ZodString;
+    displayName: z.ZodString;
+    description: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<ResourceServerKind.A2A>;
+    actorSystemRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    ref: z.ZodString;
+    displayName: z.ZodString;
+    description: z.ZodString;
+}, z.core.$strip>], "kind">;
+/** A named MCP server instance (see {@link McpServerInstanceSchema}). */
+export type McpServerInstance = z.infer<typeof McpServerInstanceSchema>;
+/** A named A2A agent instance (see {@link A2aAgentInstanceSchema}). */
+export type A2aAgentInstance = z.infer<typeof A2aAgentInstanceSchema>;
+/** Any named resource-server instance — narrow on `kind` to reach the kind-specific fields. */
+export type ResourceServerInstance = z.infer<typeof ResourceServerInstanceSchema>;
+/** @wildo_source:part:end saas.models.resource-server-instance */
+//# sourceMappingURL=oauth-resource-server.shared.schemas.d.ts.map

package/dist/esm/security/oauth-clients/oauth-resource-server.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-resource-server.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,oBAAY,kBAAkB;IAC5B,uFAAuF;IACvF,GAAG,QAAQ;IACX,gGAAgG;IAChG,GAAG,QAAQ;IACX,uGAAuG;IACvG,GAAG,QAAQ;CACZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAC9C,OAAO,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,EACnD,wBAAwB,CAIzB,CAAC;AAEF;yGACyG;AACzG,eAAO,MAAM,gCAAgC,EAAE,SAAS,kBAAkB,EAGzE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,kBAAkB,EAIvE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAGtE,CAAC;AAoEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;iBAGlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBASjC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;2BAAkF,CAAC;AAE5H,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,kEAAkE"}

package/dist/esm/security/oauth-clients/oauth-resource-server.shared.schemas.js

@@ -0,0 +1,180 @@
+import { z } from 'zod';
+import { ManualControllerRouteKey } from '../../requests/manual-controllers-routes-urls.js';
+/**
+ * OAuth 2.0 **Resource Servers** exposed by a Wildo app — the token-CONSUMING surfaces, each
+ * with its OWN canonical audience URI (RFC 8707 §2, "Resource Indicators for OAuth 2.0").
+ *
+ * ## What this is (and is NOT)
+ *
+ * A `ResourceServerKind` identifies WHICH endpoint may consume a token — it is an
+ * **audience / transport** concept, a confused-deputy + token-replay defense
+ * (RFC 8707: "an audience-restricted access token … cannot then be taken by that resource
+ * and presented elsewhere"). It is **NOT** an authorization axis: it never decides WHAT a
+ * token may do at a surface. Authorization at every resource server is **roles-only** — the
+ * framework's RBAC (scope-based authorization was removed 2026-07-21). So:
+ *
+ * - **Audience** (this enum) answers *"at which door may this token be presented?"*
+ * - **Roles** answer *"what may it do once through that door?"*
+ *
+ * The two compose; they are not competing vocabularies.
+ *
+ * ## The three resource servers
+ *
+ * | Kind  | Surface                                   | Canonical audience (`aud`)          |
+ * |-------|-------------------------------------------|-------------------------------------|
+ * | `API` | generic HTTP resource API (CRUD)          | `<appPublicBase>/api/v1`            |
+ * | `A2A` | Agent2Agent endpoint (external agents)    | `<API audience>/a2a`               |
+ * | `MCP` | Model Context Protocol tool endpoint      | `<API audience>/mcp`               |
+ *
+ * ## Standards
+ *
+ * - **RFC 8707** — a token is minted `aud`-bound to the resource server it targets; the AS is
+ *   told the target via the `resource` request parameter.
+ * - **RFC 9728** (Protected Resource Metadata) — each server publishes
+ *   `/.well-known/oauth-protected-resource` advertising its trusted authorization server.
+ * - **MCP / A2A authorization specs** — the MCP server (and A2A agent) MUST verify a received
+ *   token is `aud`-restricted to ITSELF and MUST reject tokens not issued for it.
+ *
+ * Resolve a kind's canonical audience via
+ * `AppConfigurationService.resolveResourceServerAudience(kind)` (backend) — the SINGLE SOURCE
+ * OF TRUTH so minting and validation cannot drift.
+ */
+export var ResourceServerKind;
+(function (ResourceServerKind) {
+    /** The generic HTTP resource API (CRUD on resources), mounted at the API base path. */
+    ResourceServerKind["API"] = "api";
+    /** The Agent2Agent (A2A) endpoint — external agents acting on behalf of a user or a machine. */
+    ResourceServerKind["A2A"] = "a2a";
+    /** The Model Context Protocol (MCP) endpoint — a curated subset of operations exposed as MCP tools. */
+    ResourceServerKind["MCP"] = "mcp";
+})(ResourceServerKind || (ResourceServerKind = {}));
+/**
+ * The mount-path route each NON-`API` resource server appends to the API audience to form its
+ * canonical audience URI (see {@link ResourceServerKind}). `API` is the API base itself, so it
+ * is intentionally absent here. Keeping the mapping in `_core` next to the enum guarantees the
+ * audience derivation is identical everywhere it is computed.
+ */
+export const RESOURCE_SERVER_MOUNT_ROUTE = {
+    [ResourceServerKind.A2A]: ManualControllerRouteKey.A2A_TASKS,
+    [ResourceServerKind.MCP]: ManualControllerRouteKey.MCP_ENDPOINT,
+};
+/** The resource servers that a USER-DELEGATED token may legitimately target (never the main API —
+ *  a delegated token must be confined to an agent surface, per B-S2 / the audience-confinement rule). */
+export const DELEGATED_TOKEN_RESOURCE_SERVERS = [
+    ResourceServerKind.A2A,
+    ResourceServerKind.MCP,
+];
+/**
+ * The resource servers a MACHINE (client-credentials) token may be audience-bound to — ALL of them.
+ * Unlike a user-delegated token (confined to agent surfaces), a machine principal legitimately calls
+ * the generic API directly AND the A2A / MCP endpoints. The `client_credentials` token endpoint
+ * validates the requested RFC 8707 `resource` against this set and mints an `aud`-bound token for the
+ * named surface (an absent `resource` deliberately selects the generic API audience). Each resource server then accepts
+ * a token bound to its OWN audience (per-endpoint, tight) — the confused-deputy / token-passthrough
+ * defense — while the main API accepts only the API audience, so a per-endpoint token cannot be
+ * replayed there.
+ */
+export const MACHINE_TOKEN_RESOURCE_SERVERS = [
+    ResourceServerKind.API,
+    ResourceServerKind.A2A,
+    ResourceServerKind.MCP,
+];
+/**
+ * The resource-server kinds that support MULTIPLE NAMED INSTANCES (R-2). `API` is excluded: there is
+ * exactly one generic resource API per app, so an instance ref never applies to it.
+ */
+export const INSTANCEABLE_RESOURCE_SERVERS = [
+    ResourceServerKind.A2A,
+    ResourceServerKind.MCP,
+];
+/**
+ * @wildo_source:part:start saas.models.resource-server-instance facet:layer:shared facet:family:external-access
+ *
+ * A NAMED resource-server instance — one addressable external surface of a given
+ * {@link ResourceServerKind}, with its OWN URL segment, RFC 8707 audience, discovery document, and
+ * curated content. Declare instances on `ApplicationInitializationConfig.resourceServerInstances`
+ * (your backend's initialization config). Import path: `@wildo-ai/saas-models`.
+ *
+ * This is a DISCRIMINATED UNION on `kind`, so the two surfaces cannot be confused at authoring time:
+ * an MCP server has no `actorSystemRefs` (its membership is declared per-operation), and `kind: API`
+ * is unrepresentable (there is exactly one generic resource API per app — see
+ * {@link INSTANCEABLE_RESOURCE_SERVERS}). Both were previously only caught at startup, if at all.
+ *
+ * ## Why instances exist
+ *
+ * - **MCP** has no grouping primitive: a server exposes ONE flat `tools/list` and a client is
+ *   configured with ONE URL. Multiple named servers are therefore the only way to offer curated tool
+ *   subsets per consumer (e.g. a read-only `support` server vs a write-capable `ops` server) — which
+ *   also keeps tool counts small enough for reliable agent tool-choice.
+ * - **A2A** groups SKILLS inside one agent card (a request targets one via `metadata.skillId`).
+ *   Multiple named agents therefore express distinct agent IDENTITIES (own card, own audience, own
+ *   skill subset) — skills remain the routing mechanism WITHIN an agent.
+ *
+ * ## What a named instance IS, and what it is NOT
+ *
+ * Each instance's canonical audience is `resolveResourceServerAudience(kind, ref)` → `…/<mount>/<ref>`.
+ * An access token is RFC 8707 bound to exactly ONE instance, so **a token minted for one instance is
+ * REJECTED at another** (the 2026-07-29 strict-audience flip makes this real, not advisory). That is a
+ * TOKEN-REPLAY boundary: a leaked or misdirected token cannot be used on a sibling surface.
+ *
+ * It is **NOT a per-client capability grant**. Any client the app authorizes for a grant may request any
+ * audience the app declares, exactly as at the generic API. What a caller may DO once through the door is
+ * decided by **roles**, uniformly:
+ *
+ * > **MCP/A2A exposure can only ever be a SUBSET of what roles already permit — it never widens.**
+ * > `mcp.exposed` and `mcp.servers` are CURATION applied BEFORE authorization, never instead of it: they
+ * > decide which operations are shaped as agent tools and which surface advertises them. Every
+ * > `tools/call` still re-runs the same role authorization the REST API runs, and primary scope resolves
+ * > identically (a USER_SELF operation reaches the delegating user's own row; an ORG/APPLICATION-scoped
+ * > operation runs in the machine token's or delegating user's scope).
+ *
+ * So curate a surface to make an agent's tool-choice reliable and to confine a token — and use ROLES when
+ * a caller must be unable to perform an operation at all.
+ *
+ * ## Membership (deliberately asymmetric — the units differ)
+ *
+ * - **MCP**: the OPERATION opts in (`operation.mcp.servers`), beside its existing `mcp.exposed`.
+ * - **A2A**: the AGENT lists its skills ({@link A2aAgentInstance.actorSystemRefs}), because the card is
+ *   itself the grouping primitive and actor systems carry no a2a config.
+ *
+ * Both membership lists follow the same rule: OMITTED means "the default", PRESENT means "exactly these,
+ * and there must be at least one". An empty array is rejected rather than silently meaning "all" on one
+ * side and "the default" on the other.
+ *
+ * `ref` is the URL/audience segment: keep it short, stable and URL-safe — renaming it changes the
+ * instance's audience and invalidates tokens minted for the old name.
+ */
+const resourceServerInstanceCommonShape = {
+    /** URL + audience segment (`…/mcp/<ref>`). Short, stable, URL-safe; renaming invalidates tokens. */
+    ref: z.string().min(1).regex(/^[a-z0-9][a-z0-9-]*$/, 'ref must be lowercase alphanumeric with dashes'),
+    /** Human/agent-facing name — surfaced in the instance's discovery document (PRM / agent card). */
+    displayName: z.string().min(1),
+    /** What this surface is for; surfaced in discovery so a client can pick the right instance. */
+    description: z.string(),
+};
+/**
+ * A named **MCP server**: its own `/mcp/<ref>` URL, RFC 8707 audience, protected-resource metadata and
+ * curated tool catalog. Membership is declared on the OPERATION (`operation.mcp.servers`), never here —
+ * which is why this branch carries no membership list of its own.
+ */
+export const McpServerInstanceSchema = z.object({
+    ...resourceServerInstanceCommonShape,
+    kind: z.literal(ResourceServerKind.MCP),
+});
+/**
+ * A named **A2A agent**: its own `/a2a/<ref>` URL, RFC 8707 audience, agent card and skill subset. A
+ * distinct agent IDENTITY, not a view onto the default card.
+ */
+export const A2aAgentInstanceSchema = z.object({
+    ...resourceServerInstanceCommonShape,
+    kind: z.literal(ResourceServerKind.A2A),
+    /**
+     * The actor systems exposed as THIS agent's skills. OMITTED ⇒ every exposable system (the default
+     * single-card behavior). PRESENT ⇒ exactly these, and at least one — an empty list is rejected at
+     * startup rather than being read as "all", which would turn a typo into a silently WIDER agent.
+     */
+    actorSystemRefs: z.array(z.string()).min(1, 'actorSystemRefs must name at least one actor system when present — omit it to expose every exposable system').optional(),
+});
+export const ResourceServerInstanceSchema = z.discriminatedUnion('kind', [McpServerInstanceSchema, A2aAgentInstanceSchema]);
+/** @wildo_source:part:end saas.models.resource-server-instance */
+//# sourceMappingURL=oauth-resource-server.shared.schemas.js.map

package/dist/esm/security/oauth-clients/oauth-resource-server.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-resource-server.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAN,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,uFAAuF;IACvF,iCAAW,CAAA;IACX,gGAAgG;IAChG,iCAAW,CAAA;IACX,uGAAuG;IACvG,iCAAW,CAAA;AACb,CAAC,EAPW,kBAAkB,KAAlB,kBAAkB,QAO7B;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAGpC;IACF,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,SAAS;IAC5D,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,YAAY;CAChE,CAAC;AAEF;yGACyG;AACzG,MAAM,CAAC,MAAM,gCAAgC,GAAkC;IAC7E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAkC;IAC3E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAkC;IAC1E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,iCAAiC,GAAG;IACxC,oGAAoG;IACpG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,gDAAgD,CAAC;IACtG,kGAAkG;IAClG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,+FAA+F;IAC/F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,iCAAiC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,iCAAiC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;IACvC;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,6GAA6G,CAAC,CAAC,QAAQ,EAAE;CACtK,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAQ5H,kEAAkE","sourcesContent":["import { z } from 'zod';\nimport { ManualControllerRouteKey } from '../../requests/manual-controllers-routes-urls';\n\n/**\n * OAuth 2.0 **Resource Servers** exposed by a Wildo app — the token-CONSUMING surfaces, each\n * with its OWN canonical audience URI (RFC 8707 §2, \"Resource Indicators for OAuth 2.0\").\n *\n * ## What this is (and is NOT)\n *\n * A `ResourceServerKind` identifies WHICH endpoint may consume a token — it is an\n * **audience / transport** concept, a confused-deputy + token-replay defense\n * (RFC 8707: \"an audience-restricted access token … cannot then be taken by that resource\n * and presented elsewhere\"). It is **NOT** an authorization axis: it never decides WHAT a\n * token may do at a surface. Authorization at every resource server is **roles-only** — the\n * framework's RBAC (scope-based authorization was removed 2026-07-21). So:\n *\n * - **Audience** (this enum) answers *\"at which door may this token be presented?\"*\n * - **Roles** answer *\"what may it do once through that door?\"*\n *\n * The two compose; they are not competing vocabularies.\n *\n * ## The three resource servers\n *\n * | Kind  | Surface                                   | Canonical audience (`aud`)          |\n * |-------|-------------------------------------------|-------------------------------------|\n * | `API` | generic HTTP resource API (CRUD)          | `<appPublicBase>/api/v1`            |\n * | `A2A` | Agent2Agent endpoint (external agents)    | `<API audience>/a2a`               |\n * | `MCP` | Model Context Protocol tool endpoint      | `<API audience>/mcp`               |\n *\n * ## Standards\n *\n * - **RFC 8707** — a token is minted `aud`-bound to the resource server it targets; the AS is\n *   told the target via the `resource` request parameter.\n * - **RFC 9728** (Protected Resource Metadata) — each server publishes\n *   `/.well-known/oauth-protected-resource` advertising its trusted authorization server.\n * - **MCP / A2A authorization specs** — the MCP server (and A2A agent) MUST verify a received\n *   token is `aud`-restricted to ITSELF and MUST reject tokens not issued for it.\n *\n * Resolve a kind's canonical audience via\n * `AppConfigurationService.resolveResourceServerAudience(kind)` (backend) — the SINGLE SOURCE\n * OF TRUTH so minting and validation cannot drift.\n */\nexport enum ResourceServerKind {\n  /** The generic HTTP resource API (CRUD on resources), mounted at the API base path. */\n  API = 'api',\n  /** The Agent2Agent (A2A) endpoint — external agents acting on behalf of a user or a machine. */\n  A2A = 'a2a',\n  /** The Model Context Protocol (MCP) endpoint — a curated subset of operations exposed as MCP tools. */\n  MCP = 'mcp',\n}\n\n/**\n * The mount-path route each NON-`API` resource server appends to the API audience to form its\n * canonical audience URI (see {@link ResourceServerKind}). `API` is the API base itself, so it\n * is intentionally absent here. Keeping the mapping in `_core` next to the enum guarantees the\n * audience derivation is identical everywhere it is computed.\n */\nexport const RESOURCE_SERVER_MOUNT_ROUTE: Record<\n  Exclude<ResourceServerKind, ResourceServerKind.API>,\n  ManualControllerRouteKey\n> = {\n  [ResourceServerKind.A2A]: ManualControllerRouteKey.A2A_TASKS,\n  [ResourceServerKind.MCP]: ManualControllerRouteKey.MCP_ENDPOINT,\n};\n\n/** The resource servers that a USER-DELEGATED token may legitimately target (never the main API —\n *  a delegated token must be confined to an agent surface, per B-S2 / the audience-confinement rule). */\nexport const DELEGATED_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n  ResourceServerKind.A2A,\n  ResourceServerKind.MCP,\n];\n\n/**\n * The resource servers a MACHINE (client-credentials) token may be audience-bound to — ALL of them.\n * Unlike a user-delegated token (confined to agent surfaces), a machine principal legitimately calls\n * the generic API directly AND the A2A / MCP endpoints. The `client_credentials` token endpoint\n * validates the requested RFC 8707 `resource` against this set and mints an `aud`-bound token for the\n * named surface (an absent `resource` deliberately selects the generic API audience). Each resource server then accepts\n * a token bound to its OWN audience (per-endpoint, tight) — the confused-deputy / token-passthrough\n * defense — while the main API accepts only the API audience, so a per-endpoint token cannot be\n * replayed there.\n */\nexport const MACHINE_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n  ResourceServerKind.API,\n  ResourceServerKind.A2A,\n  ResourceServerKind.MCP,\n];\n\n/**\n * The resource-server kinds that support MULTIPLE NAMED INSTANCES (R-2). `API` is excluded: there is\n * exactly one generic resource API per app, so an instance ref never applies to it.\n */\nexport const INSTANCEABLE_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n  ResourceServerKind.A2A,\n  ResourceServerKind.MCP,\n];\n\n/**\n * @wildo_source:part:start saas.models.resource-server-instance facet:layer:shared facet:family:external-access\n *\n * A NAMED resource-server instance — one addressable external surface of a given\n * {@link ResourceServerKind}, with its OWN URL segment, RFC 8707 audience, discovery document, and\n * curated content. Declare instances on `ApplicationInitializationConfig.resourceServerInstances`\n * (your backend's initialization config). Import path: `@wildo-ai/saas-models`.\n *\n * This is a DISCRIMINATED UNION on `kind`, so the two surfaces cannot be confused at authoring time:\n * an MCP server has no `actorSystemRefs` (its membership is declared per-operation), and `kind: API`\n * is unrepresentable (there is exactly one generic resource API per app — see\n * {@link INSTANCEABLE_RESOURCE_SERVERS}). Both were previously only caught at startup, if at all.\n *\n * ## Why instances exist\n *\n * - **MCP** has no grouping primitive: a server exposes ONE flat `tools/list` and a client is\n *   configured with ONE URL. Multiple named servers are therefore the only way to offer curated tool\n *   subsets per consumer (e.g. a read-only `support` server vs a write-capable `ops` server) — which\n *   also keeps tool counts small enough for reliable agent tool-choice.\n * - **A2A** groups SKILLS inside one agent card (a request targets one via `metadata.skillId`).\n *   Multiple named agents therefore express distinct agent IDENTITIES (own card, own audience, own\n *   skill subset) — skills remain the routing mechanism WITHIN an agent.\n *\n * ## What a named instance IS, and what it is NOT\n *\n * Each instance's canonical audience is `resolveResourceServerAudience(kind, ref)` → `…/<mount>/<ref>`.\n * An access token is RFC 8707 bound to exactly ONE instance, so **a token minted for one instance is\n * REJECTED at another** (the 2026-07-29 strict-audience flip makes this real, not advisory). That is a\n * TOKEN-REPLAY boundary: a leaked or misdirected token cannot be used on a sibling surface.\n *\n * It is **NOT a per-client capability grant**. Any client the app authorizes for a grant may request any\n * audience the app declares, exactly as at the generic API. What a caller may DO once through the door is\n * decided by **roles**, uniformly:\n *\n * > **MCP/A2A exposure can only ever be a SUBSET of what roles already permit — it never widens.**\n * > `mcp.exposed` and `mcp.servers` are CURATION applied BEFORE authorization, never instead of it: they\n * > decide which operations are shaped as agent tools and which surface advertises them. Every\n * > `tools/call` still re-runs the same role authorization the REST API runs, and primary scope resolves\n * > identically (a USER_SELF operation reaches the delegating user's own row; an ORG/APPLICATION-scoped\n * > operation runs in the machine token's or delegating user's scope).\n *\n * So curate a surface to make an agent's tool-choice reliable and to confine a token — and use ROLES when\n * a caller must be unable to perform an operation at all.\n *\n * ## Membership (deliberately asymmetric — the units differ)\n *\n * - **MCP**: the OPERATION opts in (`operation.mcp.servers`), beside its existing `mcp.exposed`.\n * - **A2A**: the AGENT lists its skills ({@link A2aAgentInstance.actorSystemRefs}), because the card is\n *   itself the grouping primitive and actor systems carry no a2a config.\n *\n * Both membership lists follow the same rule: OMITTED means \"the default\", PRESENT means \"exactly these,\n * and there must be at least one\". An empty array is rejected rather than silently meaning \"all\" on one\n * side and \"the default\" on the other.\n *\n * `ref` is the URL/audience segment: keep it short, stable and URL-safe — renaming it changes the\n * instance's audience and invalidates tokens minted for the old name.\n */\nconst resourceServerInstanceCommonShape = {\n  /** URL + audience segment (`…/mcp/<ref>`). Short, stable, URL-safe; renaming invalidates tokens. */\n  ref: z.string().min(1).regex(/^[a-z0-9][a-z0-9-]*$/, 'ref must be lowercase alphanumeric with dashes'),\n  /** Human/agent-facing name — surfaced in the instance's discovery document (PRM / agent card). */\n  displayName: z.string().min(1),\n  /** What this surface is for; surfaced in discovery so a client can pick the right instance. */\n  description: z.string(),\n};\n\n/**\n * A named **MCP server**: its own `/mcp/<ref>` URL, RFC 8707 audience, protected-resource metadata and\n * curated tool catalog. Membership is declared on the OPERATION (`operation.mcp.servers`), never here —\n * which is why this branch carries no membership list of its own.\n */\nexport const McpServerInstanceSchema = z.object({\n  ...resourceServerInstanceCommonShape,\n  kind: z.literal(ResourceServerKind.MCP),\n});\n\n/**\n * A named **A2A agent**: its own `/a2a/<ref>` URL, RFC 8707 audience, agent card and skill subset. A\n * distinct agent IDENTITY, not a view onto the default card.\n */\nexport const A2aAgentInstanceSchema = z.object({\n  ...resourceServerInstanceCommonShape,\n  kind: z.literal(ResourceServerKind.A2A),\n  /**\n   * The actor systems exposed as THIS agent's skills. OMITTED ⇒ every exposable system (the default\n   * single-card behavior). PRESENT ⇒ exactly these, and at least one — an empty list is rejected at\n   * startup rather than being read as \"all\", which would turn a typo into a silently WIDER agent.\n   */\n  actorSystemRefs: z.array(z.string()).min(1, 'actorSystemRefs must name at least one actor system when present — omit it to expose every exposable system').optional(),\n});\n\nexport const ResourceServerInstanceSchema = z.discriminatedUnion('kind', [McpServerInstanceSchema, A2aAgentInstanceSchema]);\n\n/** A named MCP server instance (see {@link McpServerInstanceSchema}). */\nexport type McpServerInstance = z.infer<typeof McpServerInstanceSchema>;\n/** A named A2A agent instance (see {@link A2aAgentInstanceSchema}). */\nexport type A2aAgentInstance = z.infer<typeof A2aAgentInstanceSchema>;\n/** Any named resource-server instance — narrow on `kind` to reach the kind-specific fields. */\nexport type ResourceServerInstance = z.infer<typeof ResourceServerInstanceSchema>;\n/** @wildo_source:part:end saas.models.resource-server-instance */\n"]}

package/dist/esm/testing/resource-config-builders.d.ts

@@ -5,10 +5,10 @@
  * Not re-exported from the main package entry — use `@wildo-ai/saas-models/testing`.
  */
 import type { z } from 'zod';
-import { type UserTypeAuthPolicy } from '../config/entity-identity-config.shared.schemas.js';
-import { CoreResourceOperation } from '../resources/resources.shared.core.definitions.js';
-import type { ResourceConfiguration, ResourceConfiguration_Operation, ResourceConfiguration_ResourceRelationships } from '../resources/resources-config.shared.schemas.js';
-import { ResourceRelationship } from '../resources/resources.shared.schemas.js';
+import { type UserTypeAuthPolicy } from '../config/entity-identity-config.shared.schemas';
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
+import type { ResourceConfiguration, ResourceConfiguration_Operation, ResourceConfiguration_ResourceRelationships } from '../resources/resources-config.shared.schemas';
+import { ResourceRelationship } from '../resources/resources.shared.schemas';
 export declare function makeUserTypeAuth(overrides?: Partial<UserTypeAuthPolicy>): UserTypeAuthPolicy;
 /**
  * Minimal `ResourceConfiguration_Operation` for **saas-models** DTO / resource-config unit tests.

package/dist/esm/testing/resource-config-builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-config-builders.d.ts","sourceRoot":"","sources":["../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iDAAiD,CAAC;AAGzD,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,qBAAqB,EACrB,+BAA+B,EAC/B,2CAA2C,EAC5C,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAKL,oBAAoB,EAKrB,MAAM,uCAAuC,CAAC;AAG/C,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAwC5F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,mBAAmB,GAAE,qBAAkD,GACtE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAkChD;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,UAAU,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,GAC3D,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAsBtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,2CAA2C,CAuI7C;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,oBAAoB,EAAE,CAQxB"}
+{"version":3,"file":"resource-config-builders.d.ts","sourceRoot":"","sources":["../../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iDAAiD,CAAC;AAGzD,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,qBAAqB,EACrB,+BAA+B,EAC/B,2CAA2C,EAC5C,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAKL,oBAAoB,EAKrB,MAAM,uCAAuC,CAAC;AAG/C,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAuC5F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,mBAAmB,GAAE,qBAAkD,GACtE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAsChD;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,UAAU,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,GAC3D,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CA0BtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,2CAA2C,CAuI7C;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,oBAAoB,EAAE,CAQxB"}

package/dist/esm/testing/resource-config-builders.js

@@ -17,7 +17,6 @@ export function makeUserTypeAuth(overrides) {
         registration: {
             mode: RegistrationMode.OPEN,
             allowedMethods: [AuthMethod.PASSWORD],
-            requirePasswordOnRegister: true,
             emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,
             blockForSSODomains: false,
         },
@@ -58,6 +57,10 @@ export function createTestOperation(mainSchema, operationIdentifier = CoreResour
         resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,
         resourceIdentifier: 'TEST_RESOURCE',
         resourceFieldIdentifier: 'testId',
+        // The safe default, matching what the factory materialises: this resource's own primary-key URL
+        // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an
+        // administrative resource whose segment names a SUBJECT declares `false`.
+        primaryKeyIdentifiesInitiator: true,
         resourceRelationships: {
             parentRelationships: [],
             childRelationships: [],
@@ -92,6 +95,10 @@ export function createTestResourceConfig(mainSchema, operations) {
         resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,
         resourceIdentifier: 'TEST_RESOURCE',
         resourceFieldIdentifier: 'testId',
+        // The safe default, matching what the factory materialises: this resource's own primary-key URL
+        // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an
+        // administrative resource whose segment names a SUBJECT declares `false`.
+        primaryKeyIdentifiesInitiator: true,
         coreOperations: [],
         customOperation: undefined,
         mainSchema,
@@ -237,4 +244,4 @@ export function getConditionalRelationships(resourceIdentifier, resourceRelation
         rel.discriminator.values.length > 0 &&
         (rel.resourceType1 === resourceIdentifier || rel.resourceType2 === resourceIdentifier));
 }
-//# sourceMappingURL=resource-config-builders.js.map
+//# sourceMappingURL=resource-config-builders.js.map

package/dist/esm/testing/resource-config-builders.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-config-builders.js","sourceRoot":"","sources":["../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EACL,qBAAqB,GAGtB,MAAM,gDAAgD,CAAC;AAMxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,UAAU,gBAAgB,CAAC,SAAuC;IACtE,OAAO;QACL,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;QAClF,SAAS,EAAE;YACT,UAAU,EAAE,KAAK;YACjB,gBAAgB,EAAE,KAAK;YACvB,oBAAoB,EAAE,SAAS;YAC/B,yBAAyB,EAAE,EAAE;YAC7B,oBAAoB,EAAE,IAAI;SAC3B;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,cAAc,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YACrC,yBAAyB,EAAE,IAAI;YAC/B,iBAAiB,EAAE,qBAAqB,CAAC,sBAAsB;YAC/D,kBAAkB,EAAE,KAAK;SAC1B;QACD,cAAc,EAAE;YACd,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,IAAI;YACtB,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,CAAC;SACd;QACD,sBAAsB,EAAE,EAAE;QAC1B,aAAa,EAAE;YACb,gBAAgB,EAAE,CAAC;YACnB,sBAAsB,EAAE,EAAE;YAC1B,kBAAkB,EAAE,KAAK;YACzB,0BAA0B,EAAE,EAAE;SAC/B;QACD,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE;YAChB,sBAAsB,EAAE,IAAI;YAC5B,6BAA6B,EAAE,KAAK;SACrC;QACD,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAwB,EACxB,sBAA6C,qBAAqB,CAAC,IAAI;IAEvE,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,UAAU;QACV,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,gBAAgB,EAAE,KAAK;QACvB,mBAAmB;QACnB,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,QAAe;QACnC,2BAA2B,EAAE,EAAE;QAC/B,iBAAiB,EAAE,EAAE;QACrB,gBAAgB,EAAE,EAAE;QACpB,WAAW,EAAE,4BAA4B,CAAC,QAAQ;QAClD,qBAAqB,EAAE,SAAS;QAChC,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,0BAA0B,CAAC,GAAG;QACzC,KAAK,EAAE,EAAE;QACT,gCAAgC,EAAE,EAAE;QACpC,oBAAoB,EAAE,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,sBAAsB,EAAE,KAAK;QAC7B,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,SAAS;QAC1B,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,SAAS;KAC4B,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAAwB,EACxB,UAA4D;IAE5D,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,SAAS;QAC1B,UAAU;QACV,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,2BAA2B,EAAE,SAAS;QACtC,gBAAgB,EAAE,KAAK;QACvB,iGAAiG;QACjG,cAAc,EAAE,KAAK;QACrB,4FAA4F;QAC5F,mBAAmB,EAAE,2BAA2B,CAAC,GAAG;QACpD,UAAU;KACoC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,kBAA0B,EAC1B,qBAA6C;IAE7C,MAAM,4BAA4B,GAAG,CACnC,uBAAwD,EAClC,EAAE,CACxB,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAEhF,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnF,MAAM,YAAY,GAAG,CAAC,GAAyB,EAAE,EAAE,CACjD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CAAC;IAExB,MAAM,8BAA8B,GAAgD;QAClF,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAC7C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,kBAAkB,EAAE,mBAAmB,CAAC,MAAM,CAC5C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;KACF,CAAC;IAEF,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,CACxD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CACxB,CAAC;IAEF,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,qBAAqB,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAE7F,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAC7C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAE7E,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,kBAA0B,EAC1B,qBAA6C;IAE7C,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,EAAE,kBAAkB;QACrC,GAAG,CAAC,aAAa,CAAC,MAAM;QACxB,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,CAAC,CACzF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resource-config-builders.js","sourceRoot":"","sources":["../../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EACL,qBAAqB,GAGtB,MAAM,gDAAgD,CAAC;AAMxD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EAGpB,uCAAuC,EACvC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,MAAM,UAAU,gBAAgB,CAAC,SAAuC;IACtE,OAAO;QACL,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;QAClF,SAAS,EAAE;YACT,UAAU,EAAE,KAAK;YACjB,gBAAgB,EAAE,KAAK;YACvB,oBAAoB,EAAE,SAAS;YAC/B,yBAAyB,EAAE,EAAE;YAC7B,oBAAoB,EAAE,IAAI;SAC3B;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,cAAc,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YACrC,iBAAiB,EAAE,qBAAqB,CAAC,sBAAsB;YAC/D,kBAAkB,EAAE,KAAK;SAC1B;QACD,cAAc,EAAE;YACd,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,IAAI;YACtB,gBAAgB,EAAE,IAAI;YACtB,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,CAAC;SACd;QACD,sBAAsB,EAAE,EAAE;QAC1B,aAAa,EAAE;YACb,gBAAgB,EAAE,CAAC;YACnB,sBAAsB,EAAE,EAAE;YAC1B,kBAAkB,EAAE,KAAK;YACzB,0BAA0B,EAAE,EAAE;SAC/B;QACD,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE;YAChB,sBAAsB,EAAE,IAAI;YAC5B,6BAA6B,EAAE,KAAK;SACrC;QACD,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAwB,EACxB,sBAA6C,qBAAqB,CAAC,IAAI;IAEvE,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,UAAU;QACV,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,gBAAgB,EAAE,KAAK;QACvB,mBAAmB;QACnB,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,QAAe;QACnC,2BAA2B,EAAE,EAAE;QAC/B,iBAAiB,EAAE,EAAE;QACrB,gBAAgB,EAAE,EAAE;QACpB,WAAW,EAAE,4BAA4B,CAAC,QAAQ;QAClD,qBAAqB,EAAE,SAAS;QAChC,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,0BAA0B,CAAC,GAAG;QACzC,KAAK,EAAE,EAAE;QACT,gCAAgC,EAAE,EAAE;QACpC,oBAAoB,EAAE,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,GAAG;QACxB,sBAAsB,EAAE,KAAK;QAC7B,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,SAAS;QAC1B,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,SAAS;KAC4B,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAAwB,EACxB,UAA4D;IAE5D,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,oBAAoB,EAAE,oBAAoB,CAAC,aAAa;QACxD,kBAAkB,EAAE,eAA+B;QACnD,uBAAuB,EAAE,QAAmC;QAC5D,gGAAgG;QAChG,gGAAgG;QAChG,0EAA0E;QAC1E,6BAA6B,EAAE,IAAI;QACnC,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,SAAS;QAC1B,UAAU;QACV,qBAAqB,EAAE;YACrB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAE,EAAE;SACtB;QACD,2BAA2B,EAAE,SAAS;QACtC,gBAAgB,EAAE,KAAK;QACvB,iGAAiG;QACjG,cAAc,EAAE,KAAK;QACrB,4FAA4F;QAC5F,mBAAmB,EAAE,2BAA2B,CAAC,GAAG;QACpD,UAAU;KACoC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,kBAA0B,EAC1B,qBAA6C;IAE7C,MAAM,4BAA4B,GAAG,CACnC,uBAAwD,EAClC,EAAE,CACxB,qBAAqB,CAAC,8BAA8B,CAAC,uBAAuB,CAAC,CAAC;IAEhF,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnF,MAAM,YAAY,GAAG,CAAC,GAAyB,EAAE,EAAE,CACjD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CAAC;IAExB,MAAM,8BAA8B,GAAgD;QAClF,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAC7C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,kBAAkB,EAAE,mBAAmB,CAAC,MAAM,CAC5C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;QACD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,GAAG,CAAC,aAAa,KAAK,kBAAkB;YACxC,CAAC,YAAY,CAAC,GAAG,CAAC,CACrB;KACF,CAAC;IAEF,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,CACxD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,YAAY,KAAK,+BAA+B,CAAC,IAAI;QACzD,GAAG,CAAC,iBAAiB,CACxB,CAAC;IAEF,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,qBAAqB,CAAC,2CAA2C,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;QAE7F,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAC7C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAE7E,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;gBACvD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,WAAW;gBAC1B,aAAa,EAAE,kBAAkB;gBACjC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,KAAK;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC,CAAC;YACH,8BAA8B,CAAC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,kBAAkB,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,QAAQ,WAAW,gCAAgC,CAAC,CAAC;YACvH,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;gBACnD,YAAY,EAAE,+BAA+B,CAAC,GAAG;gBACjD,YAAY,EAAE,+BAA+B,CAAC,IAAI;gBAClD,aAAa,EAAE,kBAAkB;gBACjC,aAAa,EAAE,iBAAiB;gBAChC,iBAAiB;gBACjB,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;gBACvC,yBAAyB,EAAE,iCAAiC,CAAC,QAAQ;gBACrE,mBAAmB,EAAE,uCAAuC,CAAC,gBAAgB;gBAC7E,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,8BAA8B,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,8BAA8B,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,kBAA0B,EAC1B,qBAA6C;IAE7C,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,aAAa,EAAE,kBAAkB;QACrC,GAAG,CAAC,aAAa,CAAC,MAAM;QACxB,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,GAAG,CAAC,aAAa,KAAK,kBAAkB,IAAI,GAAG,CAAC,aAAa,KAAK,kBAAkB,CAAC,CACzF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared helpers for saas-models tests: minimal resource configs, auth fixtures,\n * and relationship processing that mirrors `createResourceConfiguration_Initialization`.\n *\n * Not re-exported from the main package entry — use `@wildo-ai/saas-models/testing`.\n */\nimport type { z } from 'zod';\nimport {\n  EmailVerificationMode,\n  RegistrationMode,\n  type UserTypeAuthPolicy,\n} from '../config/entity-identity-config.shared.schemas';\nimport { HttpMethod } from '../requests/http-requests.shared';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport {\n  CoreResourceOperation,\n  ResourceFieldIdentifier,\n  ResourceType,\n} from '../resources/resources.shared.core.definitions';\nimport type {\n  ResourceConfiguration,\n  ResourceConfiguration_Operation,\n  ResourceConfiguration_ResourceRelationships,\n} from '../resources/resources-config.shared.schemas';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  ResourceParentResourceRequirement,\n  ResourcePrimaryScope,\n  ResourceRelationship,\n  ResourceRelationshipDeclaration,\n  ResourceRelationshipAccessScopeStrategy,\n  ResourceRelationshipCardinality,\n  ResourceTranspositionPolicy,\n} from '../resources/resources.shared.schemas';\nimport { Resources_SharedUtils } from '../resources/resources.shared.utils';\n\nexport function makeUserTypeAuth(overrides?: Partial<UserTypeAuthPolicy>): UserTypeAuthPolicy {\n  return {\n    authMethodsEnabled: { [AuthMethod.PASSWORD]: true, [AuthMethod.MAGIC_LINK]: true },\n    mfaPolicy: {\n      requireMFA: false,\n      requireStrongMFA: false,\n      acceptableMFAMethods: undefined,\n      enrollmentGracePeriodDays: 14,\n      passkeyExemptFromMFA: true,\n    },\n    registration: {\n      mode: RegistrationMode.OPEN,\n      allowedMethods: [AuthMethod.PASSWORD],\n      emailVerification: EmailVerificationMode.REQUIRED_BEFORE_ACCESS,\n      blockForSSODomains: false,\n    },\n    passwordPolicy: {\n      minLength: 8,\n      maxLength: 128,\n      requireUppercase: true,\n      requireLowercase: true,\n      requireNumbers: false,\n      requireSpecialChars: false,\n      expiryDays: 0,\n    },\n    sessionDurationMinutes: 30,\n    lockoutPolicy: {\n      maxLoginAttempts: 5,\n      lockoutDurationMinutes: 30,\n      progressiveLockout: false,\n      maxProgressiveLockoutHours: 24,\n    },\n    autoLinkByEmail: true,\n    methodManagement: {\n      allowUserMethodRemoval: true,\n      requireReauthForMethodChanges: false,\n    },\n    ...overrides,\n  } as UserTypeAuthPolicy;\n}\n\n/**\n * Minimal `ResourceConfiguration_Operation` for **saas-models** DTO / resource-config unit tests.\n *\n * **Not** the same symbol as `createTestOperation` in `@wildo-ai/saas-backend-lib/testing`\n * (`feature-test-utils.ts`), which builds operation stubs for **feature-gate** tests.\n */\nexport function createTestOperation(\n  mainSchema: z.ZodTypeAny,\n  operationIdentifier: CoreResourceOperation = CoreResourceOperation.READ\n): ResourceConfiguration_Operation<any, any, any> {\n  return {\n    isDisabled: false,\n    mainSchema,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    isSystemResource: false,\n    operationIdentifier,\n    isOperationDefault: true,\n    serviceRuntimeMode: 'INLINE' as any,\n    notificationBadgeOperations: [],\n    userNotifications: [],\n    m2mNotifications: [],\n    variantType: ResourceOperationVariantType.API_CALL,\n    resourceOperationLike: undefined,\n    requiredFeatures: undefined,\n    riskLevel: ResourceOperationRiskLevel.LOW,\n    roles: [],\n    customServiceImplementationModes: [],\n    basicPrefixOperation: undefined,\n    httpVerb: HttpMethod.GET,\n    isApiKeyAccessDisabled: false,\n    isBulkOperation: false,\n    consumableToken: undefined,\n    enabledCondition: undefined,\n    isDefault: true,\n    variantKey: undefined,\n  } as ResourceConfiguration_Operation<any, any, any>;\n}\n\nexport function createTestResourceConfig(\n  mainSchema: z.ZodTypeAny,\n  operations: ResourceConfiguration_Operation<any, any, any>[]\n): ResourceConfiguration<any, any, any> {\n  return {\n    isDisabled: false,\n    resourcePrimaryScope: ResourcePrimaryScope.ORGANIZATIONS,\n    resourceIdentifier: 'TEST_RESOURCE' as ResourceType,\n    resourceFieldIdentifier: 'testId' as ResourceFieldIdentifier,\n    // The safe default, matching what the factory materialises: this resource's own primary-key URL\n    // segment is treated as naming the CALLER, so the identity-coherence guard stays armed. Only an\n    // administrative resource whose segment names a SUBJECT declares `false`.\n    primaryKeyIdentifiesInitiator: true,\n    coreOperations: [],\n    customOperation: undefined,\n    mainSchema,\n    resourceRelationships: {\n      parentRelationships: [],\n      childRelationships: [],\n      selfRelationships: [],\n    },\n    inheritenceSchemaDefinition: undefined,\n    isSystemResource: false,\n    /** W7.3a: test fixtures default to non-anonymizable unless overrides replace the full config. */\n    isAnonymizable: false,\n    /** Required by type; only applied when `isAnonymizable` is true (engine default is ADD). */\n    transpositionPolicy: ResourceTranspositionPolicy.ADD,\n    operations,\n  } satisfies ResourceConfiguration<any, any, any>;\n}\n\n/**\n * Process relationships for a resource — mirrors the logic in createResourceConfiguration_Initialization.\n * M:N relationships are transformed into 1:N relationships for the junction table.\n *\n * The helper expects compiled runtime relationships, matching the production\n * factory output from `createResourcesRelationship()` / registry initialization.\n */\nexport function processResourceRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceConfiguration_ResourceRelationships {\n  const compileSyntheticRelationship = (\n    relationshipDeclaration: ResourceRelationshipDeclaration\n  ): ResourceRelationship =>\n    Resources_SharedUtils.compileRelationshipDeclaration(relationshipDeclaration);\n\n  const activeRelationships = resourceRelationships.filter((rel) => !rel.isDisabled);\n\n  const isManyToMany = (rel: ResourceRelationship) =>\n    rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n    rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n    rel.jointResourceType;\n\n  const processedResourceRelationships: ResourceConfiguration_ResourceRelationships = {\n    parentRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType2 === resourceIdentifier &&\n        rel.resourceType1 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    childRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 !== resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n    selfRelationships: activeRelationships.filter(\n      (rel) =>\n        rel.resourceType1 === resourceIdentifier &&\n        rel.resourceType2 === resourceIdentifier &&\n        !isManyToMany(rel)\n    ),\n  };\n\n  const manyToManyRelationships = activeRelationships.filter(\n    (rel) =>\n      rel.cardinality1 === ResourceRelationshipCardinality.MANY &&\n      rel.cardinality2 === ResourceRelationshipCardinality.MANY &&\n      rel.jointResourceType\n  );\n\n  manyToManyRelationships.forEach((m2mRel) => {\n    Resources_SharedUtils.assertSupportedManyToManySyntheticExpansion(m2mRel);\n    const { resourceType1: entity1Type, resourceType2: entity2Type, jointResourceType } = m2mRel;\n\n    if (resourceIdentifier === jointResourceType) {\n      const relationFromEntity1 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity1Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity1);\n\n      const relationFromEntity2 = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: entity2Type,\n        resourceType2: resourceIdentifier,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n      });\n      processedResourceRelationships.parentRelationships.push(relationFromEntity2);\n    } else if (resourceIdentifier === entity1Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    } else if (resourceIdentifier === entity2Type) {\n      if (!jointResourceType) {\n        throw new Error(`Many-to-many relationship between ${entity1Type} and ${entity2Type} must have a jointResourceType`);\n      }\n\n      const relationToJoint = compileSyntheticRelationship({\n        cardinality1: ResourceRelationshipCardinality.ONE,\n        cardinality2: ResourceRelationshipCardinality.MANY,\n        resourceType1: resourceIdentifier,\n        resourceType2: jointResourceType,\n        jointResourceType,\n        nature: m2mRel.resolvedSemantics.nature,\n        parentResourceRequirement: ResourceParentResourceRequirement.OPTIONAL,\n        accessScopeStrategy: ResourceRelationshipAccessScopeStrategy.OPTIONAL_CONTEXT,\n        isPrimaryScope: false,\n        isDisabled: m2mRel.isDisabled || false,\n        allowCycle: m2mRel.allowCycle || false,\n        contextPolicy: m2mRel.contextPolicy,\n        childOperations: m2mRel.childOperations,\n        foreignKeyField: m2mRel.foreignKeyField,\n        discriminator: m2mRel.discriminator,\n        condition: m2mRel.condition,\n        display: m2mRel.display,\n      });\n      processedResourceRelationships.childRelationships.push(relationToJoint);\n    }\n  });\n\n  return processedResourceRelationships;\n}\n\n/**\n * Conditional relationships — active only for specific discriminator variants.\n */\nexport function getConditionalRelationships(\n  resourceIdentifier: string,\n  resourceRelationships: ResourceRelationship[]\n): ResourceRelationship[] {\n  return resourceRelationships.filter(\n    (rel) =>\n      rel.discriminator?.discriminatorField &&\n      rel.discriminator.values &&\n      rel.discriminator.values.length > 0 &&\n      (rel.resourceType1 === resourceIdentifier || rel.resourceType2 === resourceIdentifier)\n  );\n}\n"]}

package/dist/esm/testing.d.ts

@@ -2,5 +2,5 @@
  * Public testing surface for @wildo-ai/saas-models.
  * Import from `@wildo-ai/saas-models/testing` — not from the main package entry.
  */
-export * from './testing/resource-config-builders.js';
+export * from './testing/resource-config-builders';
 //# sourceMappingURL=testing.d.ts.map

package/dist/esm/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC"}

package/dist/esm/testing.js

@@ -3,4 +3,4 @@
  * Import from `@wildo-ai/saas-models/testing` — not from the main package entry.
  */
 export * from './testing/resource-config-builders.js';
-//# sourceMappingURL=testing.js.map
+//# sourceMappingURL=testing.js.map

package/dist/esm/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC"}
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oCAAoC,CAAC","sourcesContent":["/**\n * Public testing surface for @wildo-ai/saas-models.\n * Import from `@wildo-ai/saas-models/testing` — not from the main package entry.\n */\nexport * from './testing/resource-config-builders';\n"]}