@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/users/user-credentials.shared.schemas.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { MfaEnrollmentState } from '../security/authentications/authentication.shared.schemas.js';
+import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
 /**
  * Individual WebAuthn/Passkey credential entry.
  * Stores the data returned by @simplewebauthn/server after registration verification.
@@ -21,6 +22,11 @@ export const PasskeyCredentialEntrySchema = z.object({
  * Stores all authentication secrets for a user: password hash + optional TOTP.
  * All fields are compatible with MongoDB via zod-to-mongoose converter.
  *
+ * The local first-factor / TOTP secret fields (`passwordHash`, `secretBase32`,
+ * `totpVerifiedAt`) are `.nullish()` — absent when never set, or explicitly `null`
+ * once a compliance clear physically destroys them (directory-managed reconciliation,
+ * TOTP-disable). See each field's JSDoc for the null-vs-absent contract.
+ *
  * TOTP fields (optional — user may have password-only auth):
  * - `secretBase32`: base32-encoded TOTP secret (backendOnly). Used with otpauth library.
  *    NOTE: stored as plaintext base32. For production hardening, add AES-256-GCM encryption at rest.
@@ -31,19 +37,54 @@ export const PasskeyCredentialEntrySchema = z.object({
 export const UserCredentialsSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
     userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
-    passwordHash: z.string().min(1).isBackendOnly(),
-    /** TOTP secret encoded as base32 — used with otpauth library for code generation/verification */
-    secretBase32: z.string().optional().isBackendOnly(),
+    // NULLISH by design — the hash is a non-empty `string` when set, ABSENT for a PASSWORD-LESS
+    // account (first factor is a passkey, magic link, or enterprise SSO — the row must be
+    // creatable with no `passwordHash`, e.g. passkey-enroll-at-invitation-accept), or explicitly
+    // `null` once a clear physically DESTROYS it. The AUTH-24 directory-managed reconciliation
+    // (`_reconcileLocalCredentialsForDirectoryManaged`) writes `passwordHash: null` to neutralise a
+    // local first factor that would otherwise survive IdP deprovisioning. `null` MUST be accepted
+    // here: the write re-attaches this backend-only field past the strict request-DTO strip
+    // (`updateAsSystem`), but the SERVICE-LAYER OUTPUT PROJECTION (`transformOutput` →
+    // `internalDto.parse`) re-validates the persisted document against the FULL schema (backend-only
+    // fields included). Were this merely `.optional()` (absent-only, not null), the destroy-write
+    // would persist the `null` and THEN throw `service_resource_transformation_failed` on the
+    // after-image — the credential is gone but the operation errors (misleading "reconcile failed"
+    // log). Every consumer treats the hash as falsy-when-absent (`!credentials?.passwordHash`
+    // guards, `enrolled: !!passwordHash`, last-method-removal counting), so `null` and absent are
+    // handled identically. `.min(1)` still guarantees a NON-EMPTY hash whenever one IS present.
+    // ── CREDENTIALS is declared, not derived, on this resource ──
+    //
+    // The producer DERIVES `credentials` from `.isPassword()` / `.isOtp()` / `.isWriteOnlySecret()`.
+    // These fields carry `.isBackendOnly()` instead — correctly, since they are stored HASHES and
+    // secrets that must never leave the backend, not editable password INPUTS. So the derivation
+    // cannot see them and the declaration has to be explicit. Measured: before this, `userCredentials`
+    // reported zero categories while holding every secret the application has.
+    passwordHash: z.string().min(1).nullish().isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),
+    /**
+     * TOTP secret encoded as base32 — used with otpauth library for code generation/verification.
+     * NULLISH: absent when TOTP was never set up, or explicitly `null` after the
+     * auth-method-management TOTP-disable clear physically destroys it. `null` must be accepted so
+     * that disable-clear's null-write round-trips through the output projection — same contract as
+     * `passwordHash` above (backend-only field, re-validated by `transformOutput`).
+     */
+    secretBase32: z.string().nullish().isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),
     /** Whether the user has confirmed TOTP setup by entering a valid code */
     totpVerified: z.boolean().default(false).isDBIndexed(),
     /** SHA-256 hashes of backup codes — consumed on use (removed from array) */
-    backupCodesHashed: z.array(z.string()).default([]).isBackendOnly(),
-    /** When the user verified their TOTP setup */
-    totpVerifiedAt: z.date().optional(),
+    backupCodesHashed: z.array(z.string()).default([]).isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),
+    /**
+     * When the user verified their TOTP setup. NULLISH: absent before verification, a `Date` once
+     * verified, or explicitly `null` after the TOTP-disable clear. Unlike the backend-only TOTP
+     * secret this field is NOT stripped from the request DTO, so `null` must be accepted on BOTH
+     * the write-side parse (`validateAndTransformInput`, which loose-parses the in-shape field) AND
+     * the output projection — otherwise the disable-clear throws before/after persisting. Readers
+     * use `?? undefined`, so `null` and absent behave identically.
+     */
+    totpVerifiedAt: z.date().nullish(),
     /** Timestamp of the last password change. Refresh tokens issued before this are rejected (C4 fix). */
     passwordChangedAt: z.date().optional().isBackendOnly(),
     /** WebAuthn/Passkey credentials — array of registered passkeys */
-    passkeyCredentials: z.array(PasskeyCredentialEntrySchema).default([]).isBackendOnly(),
+    passkeyCredentials: z.array(PasskeyCredentialEntrySchema).default([]).isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),
     /** W2.1: timestamp of the first login where MFA was required but not yet enrolled. Used with enrollmentGracePeriodDays. */
     firstMfaPromptAt: z.date().optional().isBackendOnly(),
     /** W4.6: MFA enrollment lifecycle state. Computed at user creation and updated on enrollment completion. */
@@ -51,7 +92,10 @@ export const UserCredentialsSchema = z.object({
     /** W2.3: tracks consecutive account lockouts for progressive lockout duration (2^n multiplier). Reset on successful login. */
     consecutiveLockouts: z.number().default(0).isBackendOnly(),
     /** Phone number in E.164 format for SMS OTP authentication (Phase G2) */
-    phoneNumber: z.string().regex(/^\+?[1-9]\d{1,14}$/).optional(),
+    // CONTACT_DETAILS, not CREDENTIALS. It is the SMS OTP delivery ADDRESS — a way to reach the
+    // person, which they hold independently of this application — not a secret this application
+    // stores. Merging the two would make a notice say the phone number is a credential.
+    phoneNumber: z.string().regex(/^\+?[1-9]\d{1,14}$/).optional().dataCategories(PersonalDataCategory.CONTACT_DETAILS),
     /** Whether the phone number has been verified via OTP confirmation */
     phoneNumberVerified: z.boolean().default(false),
     /** When the phone number was verified */
@@ -59,4 +103,4 @@ export const UserCredentialsSchema = z.object({
     createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
 });
-//# sourceMappingURL=user-credentials.shared.schemas.js.map
+//# sourceMappingURL=user-credentials.shared.schemas.js.map

package/dist/esm/users/user-credentials.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-credentials.shared.schemas.js","sourceRoot":"","sources":["../../../src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAE/F;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;IACxD,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAKH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC3F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;IAE/C,iGAAiG;IACjG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACnD,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;IACtD,4EAA4E;IAC5E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;IAClE,8CAA8C;IAC9C,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACnC,sGAAsG;IACtG,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACtD,kEAAkE;IAClE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;IAErF,2HAA2H;IAC3H,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACrD,4GAA4G;IAC5G,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE;IACvG,8HAA8H;IAC9H,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;IAE1D,yEAAyE;IACzE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,sEAAsE;IACtE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,yCAAyC;IACzC,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEpC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC"}
+{"version":3,"file":"user-credentials.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-credentials.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAC/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;IACxD,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAKH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAC3F,4FAA4F;IAC5F,sFAAsF;IACtF,6FAA6F;IAC7F,2FAA2F;IAC3F,gGAAgG;IAChG,8FAA8F;IAC9F,wFAAwF;IACxF,mFAAmF;IACnF,iGAAiG;IACjG,8FAA8F;IAC9F,0FAA0F;IAC1F,+FAA+F;IAC/F,0FAA0F;IAC1F,8FAA8F;IAC9F,4FAA4F;IAC5F,+DAA+D;IAC/D,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,6FAA6F;IAC7F,mGAAmG;IACnG,2EAA2E;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC;IAE1G;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC;IACnG,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;IACtD,4EAA4E;IAC5E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC;IACnH;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE;IAClC,sGAAsG;IACtG,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACtD,kEAAkE;IAClE,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,WAAW,CAAC;IAEtI,2HAA2H;IAC3H,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IACrD,4GAA4G;IAC5G,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE;IACvG,8HAA8H;IAC9H,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;IAE1D,yEAAyE;IACzE,4FAA4F;IAC5F,4FAA4F;IAC5F,oFAAoF;IACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC;IACnH,sEAAsE;IACtE,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,yCAAyC;IACzC,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAEpC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACnG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { MfaEnrollmentState } from '../security/authentications/authentication.shared.schemas';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\n\n/**\n * Individual WebAuthn/Passkey credential entry.\n * Stores the data returned by @simplewebauthn/server after registration verification.\n */\nexport const PasskeyCredentialEntrySchema = z.object({\n  credentialId: z.string().min(1),\n  publicKey: z.string().min(1),\n  counter: z.number().int().min(0).default(0),\n  transports: z.array(z.string()).default([]),\n  credentialDeviceType: z.string().default('singleDevice'),\n  credentialBackedUp: z.boolean().default(false),\n  name: z.string().max(100).default('Passkey'),\n  aaguid: z.string().optional(),\n  createdAt: z.date().default(() => new Date()),\n  lastUsedAt: z.date().optional(),\n});\n\n\nexport type PasskeyCredentialEntry = z.infer<typeof PasskeyCredentialEntrySchema>;\n\n/**\n * User Credentials Schema\n * Stores all authentication secrets for a user: password hash + optional TOTP.\n * All fields are compatible with MongoDB via zod-to-mongoose converter.\n *\n * The local first-factor / TOTP secret fields (`passwordHash`, `secretBase32`,\n * `totpVerifiedAt`) are `.nullish()` — absent when never set, or explicitly `null`\n * once a compliance clear physically destroys them (directory-managed reconciliation,\n * TOTP-disable). See each field's JSDoc for the null-vs-absent contract.\n *\n * TOTP fields (optional — user may have password-only auth):\n * - `secretBase32`: base32-encoded TOTP secret (backendOnly). Used with otpauth library.\n *    NOTE: stored as plaintext base32. For production hardening, add AES-256-GCM encryption at rest.\n * - `totpVerified`: whether the user has confirmed TOTP setup by entering a valid code\n * - `backupCodesHashed`: SHA-256 hashes of backup codes (consumed on use)\n * - `totpVerifiedAt`: timestamp when TOTP setup was confirmed\n */\nexport const UserCredentialsSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n  // NULLISH by design — the hash is a non-empty `string` when set, ABSENT for a PASSWORD-LESS\n  // account (first factor is a passkey, magic link, or enterprise SSO — the row must be\n  // creatable with no `passwordHash`, e.g. passkey-enroll-at-invitation-accept), or explicitly\n  // `null` once a clear physically DESTROYS it. The AUTH-24 directory-managed reconciliation\n  // (`_reconcileLocalCredentialsForDirectoryManaged`) writes `passwordHash: null` to neutralise a\n  // local first factor that would otherwise survive IdP deprovisioning. `null` MUST be accepted\n  // here: the write re-attaches this backend-only field past the strict request-DTO strip\n  // (`updateAsSystem`), but the SERVICE-LAYER OUTPUT PROJECTION (`transformOutput` →\n  // `internalDto.parse`) re-validates the persisted document against the FULL schema (backend-only\n  // fields included). Were this merely `.optional()` (absent-only, not null), the destroy-write\n  // would persist the `null` and THEN throw `service_resource_transformation_failed` on the\n  // after-image — the credential is gone but the operation errors (misleading \"reconcile failed\"\n  // log). Every consumer treats the hash as falsy-when-absent (`!credentials?.passwordHash`\n  // guards, `enrolled: !!passwordHash`, last-method-removal counting), so `null` and absent are\n  // handled identically. `.min(1)` still guarantees a NON-EMPTY hash whenever one IS present.\n  // ── CREDENTIALS is declared, not derived, on this resource ──\n  //\n  // The producer DERIVES `credentials` from `.isPassword()` / `.isOtp()` / `.isWriteOnlySecret()`.\n  // These fields carry `.isBackendOnly()` instead — correctly, since they are stored HASHES and\n  // secrets that must never leave the backend, not editable password INPUTS. So the derivation\n  // cannot see them and the declaration has to be explicit. Measured: before this, `userCredentials`\n  // reported zero categories while holding every secret the application has.\n  passwordHash: z.string().min(1).nullish().isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n\n  /**\n   * TOTP secret encoded as base32 — used with otpauth library for code generation/verification.\n   * NULLISH: absent when TOTP was never set up, or explicitly `null` after the\n   * auth-method-management TOTP-disable clear physically destroys it. `null` must be accepted so\n   * that disable-clear's null-write round-trips through the output projection — same contract as\n   * `passwordHash` above (backend-only field, re-validated by `transformOutput`).\n   */\n  secretBase32: z.string().nullish().isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n  /** Whether the user has confirmed TOTP setup by entering a valid code */\n  totpVerified: z.boolean().default(false).isDBIndexed(),\n  /** SHA-256 hashes of backup codes — consumed on use (removed from array) */\n  backupCodesHashed: z.array(z.string()).default([]).isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n  /**\n   * When the user verified their TOTP setup. NULLISH: absent before verification, a `Date` once\n   * verified, or explicitly `null` after the TOTP-disable clear. Unlike the backend-only TOTP\n   * secret this field is NOT stripped from the request DTO, so `null` must be accepted on BOTH\n   * the write-side parse (`validateAndTransformInput`, which loose-parses the in-shape field) AND\n   * the output projection — otherwise the disable-clear throws before/after persisting. Readers\n   * use `?? undefined`, so `null` and absent behave identically.\n   */\n  totpVerifiedAt: z.date().nullish(),\n  /** Timestamp of the last password change. Refresh tokens issued before this are rejected (C4 fix). */\n  passwordChangedAt: z.date().optional().isBackendOnly(),\n  /** WebAuthn/Passkey credentials — array of registered passkeys */\n  passkeyCredentials: z.array(PasskeyCredentialEntrySchema).default([]).isBackendOnly().dataCategories(PersonalDataCategory.CREDENTIALS),\n\n  /** W2.1: timestamp of the first login where MFA was required but not yet enrolled. Used with enrollmentGracePeriodDays. */\n  firstMfaPromptAt: z.date().optional().isBackendOnly(),\n  /** W4.6: MFA enrollment lifecycle state. Computed at user creation and updated on enrollment completion. */\n  mfaEnrollmentState: z.enum(MfaEnrollmentState).default(MfaEnrollmentState.NOT_REQUIRED).isBackendOnly(),\n  /** W2.3: tracks consecutive account lockouts for progressive lockout duration (2^n multiplier). Reset on successful login. */\n  consecutiveLockouts: z.number().default(0).isBackendOnly(),\n\n  /** Phone number in E.164 format for SMS OTP authentication (Phase G2) */\n  // CONTACT_DETAILS, not CREDENTIALS. It is the SMS OTP delivery ADDRESS — a way to reach the\n  // person, which they hold independently of this application — not a secret this application\n  // stores. Merging the two would make a notice say the phone number is a credential.\n  phoneNumber: z.string().regex(/^\\+?[1-9]\\d{1,14}$/).optional().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n  /** Whether the phone number has been verified via OTP confirmation */\n  phoneNumberVerified: z.boolean().default(false),\n  /** When the phone number was verified */\n  phoneVerifiedAt: z.date().optional(),\n\n  createdAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type UserCredentials = z.infer<typeof UserCredentialsSchema>;\n\n\n"]}

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.d.ts

@@ -8,22 +8,24 @@
  * by trusted internal code (OAuth2 JIT provisioning, auth method management),
  * but not exposed as HTTP endpoints.
  */
-import { CoreResourceOperation } from '../resources/resources.shared.core.definitions.js';
-import { ResourceRelationship } from '../resources/resources.shared.schemas.js';
-export declare const userIdentityLinksResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../index.js").ResourceConfiguration<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, import("zod").ZodObject<{
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
+import { ResourceRelationship } from '../resources/resources.shared.schemas';
+export declare const userIdentityLinksResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>>>;
-    connectionType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("../index.js").SsoConnectionType>>>;
+    connectionType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodEnum<typeof import("..").SsoConnectionType>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
-    providerUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;
-    providerEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>;
-    providerDisplayName: import("zod").ZodOptional<import("zod").ZodString>;
-    providerAvatarUrl: import("zod").ZodOptional<import("zod").ZodString>;
-    providerRawProfile: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>>;
+    providerUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
+    providerEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodString>>;
+    providerDisplayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
+    providerAvatarUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
+    providerRawProfile: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>>>;
+    scopeType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodEnum<typeof import("..").AuthScopeType>>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodOptional<import("zod").ZodString>>;
     connectionId: import("zod").ZodOptional<import("zod").ZodString>;
-    source: import("zod").ZodOptional<import("zod").ZodEnum<typeof import("./user-identity-links.shared.schemas.js").IdentityLinkSource>>;
+    source: import("zod").ZodEnum<typeof import("..").ExternalIdentitySource>;
     linkedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodDate>>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("zod").ZodDefault<import("zod").ZodDate>>>>;
-}, import("zod/v4/core").$strip, core.$ZodObjectExtra>>;
+}, import("zod/v4/core").$strip>>>;
 //# sourceMappingURL=user-identity-links.shared.resources-config.schemas.d.ts.map

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAGvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;uDAqE9C,CAAC"}
+{"version":3,"file":"user-identity-links.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAA4D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAIvI,eAAO,MAAM,4DAA4D,GACvE,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;kCA4F9C,CAAC"}

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.js

@@ -10,15 +10,38 @@
  */
 import { UserIdentityLinkSchema } from './user-identity-links.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
 import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas.js';
 export const userIdentityLinksResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
     mainSchema: UserIdentityLinkSchema,
     resourceIdentifier: CoreResourceType.USER_IDENTITY_LINKS,
     resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_IDENTITY_LINKS],
     resourceRelationships: resourcesRelationships,
     isSystemResource: true,
+    // OAuth2 JIT + enterprise SSO / SCIM provisioning create and update identity links
+    // in-process on a request-context-less EC. The client-shaped CREATE DTO strips the
+    // context FKs by name (`userId`, `organizationId`, `applicationId`), and both CREATE and UPDATE strip
+    // the backend-only `providerRawProfile`. This resource has no HTTP surface (all
+    // variants are INTERNAL_CALL), so the trusted `createAsSystem` / `updateAsSystem`
+    // primitives are the ONLY writers — opt both verbs in so the stripped fields survive
+    // the strict-DTO parse (re-attached from the schema-derived allowlist).
+    systemAccessPolicy: {
+        exportSubject: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+        // AUTH-24: the auth-policy resolver READS a user's identity link during LOGIN to decide whether they are
+        // IdP-PROVISIONED in an actively directory-managed org — only THEN are their local first-factor
+        // credentials derived off (and reconciled). The owner/admin who registered locally has no link and keeps
+        // a break-glass credential (user decision 2026-07-21). The bulk sweep on SCIM activation LISTS an org's
+        // links to reconcile all already-provisioned members. Both run under a pre-/being-authenticated or
+        // token-mint EC, so they resolve via the system door.
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+    },
+    portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
@@ -79,4 +102,4 @@ export const userIdentityLinksResourceConfiguration_InitializationFactory = (res
         },
     },
 });
-//# sourceMappingURL=user-identity-links.shared.resources-config.schemas.js.map
+//# sourceMappingURL=user-identity-links.shared.resources-config.schemas.js.map

package/dist/esm/users/user-identity-links.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAC1E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,sBAAsB;IAClC,kBAAkB,EAAE,gBAAgB,CAAC,mBAAmB;IACxD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;IACjG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"user-identity-links.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,uCAAuC,CAAC;AACvI,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAEhG,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAC1E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAG7C;IACA,UAAU,EAAE,sBAAsB;IAClC,kBAAkB,EAAE,gBAAgB,CAAC,mBAAmB;IACxD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,mBAAmB,CAAC;IACjG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,mFAAmF;IACnF,mFAAmF;IACnF,sGAAsG;IACtG,gFAAgF;IAChF,kFAAkF;IAClF,qFAAqF;IACrF,wEAAwE;IACxE,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,yGAAyG;QACzG,gGAAgG;QAChG,yGAAyG;QACzG,wGAAwG;QACxG,mGAAmG;QACnG,sDAAsD;QACtD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAE5E,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Identity Links Resource Configuration (Internal-only)\n *\n * System resource — no auto-generated API controller.\n * Frontend access via custom auth controller endpoint: GET /auth/identity-links\n *\n * Operations are INTERNAL_CALL: accessible through the service layer pipeline\n * by trusted internal code (OAuth2 JIT provisioning, auth method management),\n * but not exposed as HTTP endpoints.\n */\n\nimport { UserIdentityLinkSchema } from './user-identity-links.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../compliance/privacy/subject-export.shared.schemas';\n\nexport const userIdentityLinksResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE,\n  typeof UserIdentityLinkSchema\n>({\n  mainSchema: UserIdentityLinkSchema,\n  resourceIdentifier: CoreResourceType.USER_IDENTITY_LINKS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_IDENTITY_LINKS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // OAuth2 JIT + enterprise SSO / SCIM provisioning create and update identity links\n  // in-process on a request-context-less EC. The client-shaped CREATE DTO strips the\n  // context FKs by name (`userId`, `organizationId`, `applicationId`), and both CREATE and UPDATE strip\n  // the backend-only `providerRawProfile`. This resource has no HTTP surface (all\n  // variants are INTERNAL_CALL), so the trusted `createAsSystem` / `updateAsSystem`\n  // primitives are the ONLY writers — opt both verbs in so the stripped fields survive\n  // the strict-DTO parse (re-attached from the schema-derived allowlist).\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    // AUTH-24: the auth-policy resolver READS a user's identity link during LOGIN to decide whether they are\n    // IdP-PROVISIONED in an actively directory-managed org — only THEN are their local first-factor\n    // credentials derived off (and reconciled). The owner/admin who registered locally has no link and keeps\n    // a break-glass credential (user decision 2026-07-21). The bulk sweep on SCIM activation LISTS an org's\n    // links to reconcile all already-provisioned members. Both run under a pre-/being-authenticated or\n    // token-mint EC, so they resolve via the system door.\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n  },\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.OBSERVED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n  ],\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/users/user-identity-links.shared.schemas.d.ts

@@ -4,34 +4,37 @@
  * Tracks OAuth2/SSO provider connections per user.
  * A user can have multiple identity links (e.g., Google social + Microsoft enterprise).
  *
- * Unique constraint: userId + providerRef + connectionType
- * (allows a user to have both a social Google link and an enterprise Google Workspace link)
- *
- * Secondary index: providerRef + providerUserId (fast lookup during identity link check in provisionOrLinkUser)
+ * Canonical identity key: connection type + provider + provider user + exact enterprise
+ * scope/connection coordinates. The database compound unique index prevents the same
+ * external identity from being bound to two Wildo users inside one tenant connection.
  */
 import { z } from 'zod';
-import { SsoConnectionType } from '../compliance/audit-trails/auditable-events.shared.schema.js';
-/** Authentication source that created this identity link. */
-export declare enum IdentityLinkSource {
-    OIDC = "oidc",
-    SAML = "saml",
-    SCIM = "scim"
-}
-export declare const UserIdentityLinkSchema: z.ZodObject<{
+import { AuthScopeType, ExternalIdentitySource, SsoConnectionType } from '../security/authentications/authentication.shared.schemas';
+/**
+ * Valid provenance mechanisms for each connection ownership class.
+ *
+ * OAuth2 is social-only; SAML and SCIM are enterprise-only; OIDC legitimately
+ * spans both. Keeping this relationship beside the persisted link schema makes
+ * invalid cross-products impossible at every repository boundary.
+ */
+export declare const IDENTITY_SOURCES_BY_CONNECTION_TYPE: Readonly<Record<SsoConnectionType, ReadonlySet<ExternalIdentitySource>>>;
+export declare const UserIdentityLinkSchema: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
     connectionType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof SsoConnectionType>>>;
     providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    providerUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-    providerEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-    providerDisplayName: z.ZodOptional<z.ZodString>;
-    providerAvatarUrl: z.ZodOptional<z.ZodString>;
-    providerRawProfile: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    providerUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    providerEmail: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    providerDisplayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    providerAvatarUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    providerRawProfile: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>>;
+    scopeType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<typeof AuthScopeType>>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     connectionId: z.ZodOptional<z.ZodString>;
-    source: z.ZodOptional<z.ZodEnum<typeof IdentityLinkSource>>;
+    source: z.ZodEnum<typeof ExternalIdentitySource>;
     linkedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
     lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>>;
 export type UserIdentityLink = z.infer<typeof UserIdentityLinkSchema>;
 //# sourceMappingURL=user-identity-links.shared.schemas.d.ts.map

package/dist/esm/users/user-identity-links.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,2DAA2D,CAAC;AAE9F,6DAA6D;AAC7D,oBAAY,kBAAkB;IAC5B,IAAI,SAAS;IACb,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;uCAyCjC,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"user-identity-links.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,EAAE,QAAQ,CACxD,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAW/D,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBA2HjC,CAAC;AAGH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/esm/users/user-identity-links.shared.schemas.js

@@ -4,20 +4,31 @@
  * Tracks OAuth2/SSO provider connections per user.
  * A user can have multiple identity links (e.g., Google social + Microsoft enterprise).
  *
- * Unique constraint: userId + providerRef + connectionType
- * (allows a user to have both a social Google link and an enterprise Google Workspace link)
- *
- * Secondary index: providerRef + providerUserId (fast lookup during identity link check in provisionOrLinkUser)
+ * Canonical identity key: connection type + provider + provider user + exact enterprise
+ * scope/connection coordinates. The database compound unique index prevents the same
+ * external identity from being bound to two Wildo users inside one tenant connection.
  */
 import { z } from 'zod';
-import { SsoConnectionType } from '../compliance/audit-trails/auditable-events.shared.schema.js';
-/** Authentication source that created this identity link. */
-export var IdentityLinkSource;
-(function (IdentityLinkSource) {
-    IdentityLinkSource["OIDC"] = "oidc";
-    IdentityLinkSource["SAML"] = "saml";
-    IdentityLinkSource["SCIM"] = "scim";
-})(IdentityLinkSource || (IdentityLinkSource = {}));
+import { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas.js';
+import { AuthScopeType, ExternalIdentitySource, SsoConnectionType, } from '../security/authentications/authentication.shared.schemas.js';
+/**
+ * Valid provenance mechanisms for each connection ownership class.
+ *
+ * OAuth2 is social-only; SAML and SCIM are enterprise-only; OIDC legitimately
+ * spans both. Keeping this relationship beside the persisted link schema makes
+ * invalid cross-products impossible at every repository boundary.
+ */
+export const IDENTITY_SOURCES_BY_CONNECTION_TYPE = {
+    [SsoConnectionType.SOCIAL]: new Set([
+        ExternalIdentitySource.OAUTH2,
+        ExternalIdentitySource.OIDC,
+    ]),
+    [SsoConnectionType.ENTERPRISE]: new Set([
+        ExternalIdentitySource.OIDC,
+        ExternalIdentitySource.SAML,
+        ExternalIdentitySource.SCIM,
+    ]),
+};
 export const UserIdentityLinkSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
     /** FK → USERS — the user who owns this identity link */
@@ -27,24 +38,97 @@ export const UserIdentityLinkSchema = z.object({
     /** Matches external connector ref (e.g., "google", "microsoft", "github", "oidc") */
     providerRef: z.string().min(1).isDBIndexed().isSummaryField(),
     /** The user's ID at the IdP */
-    providerUserId: z.string().min(1).isDBIndexed(),
+    providerUserId: z.string().min(1).isDBIndexed().dataCategories(PersonalDataCategory.IDENTITY),
     /** Email from the IdP */
-    providerEmail: z.string().isDBIndexed(),
+    providerEmail: z.string().isDBIndexed().dataCategories(PersonalDataCategory.CONTACT_DETAILS),
     /** Display name from IdP */
-    providerDisplayName: z.string().optional(),
+    providerDisplayName: z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),
     /** Avatar URL from IdP */
-    providerAvatarUrl: z.string().optional(),
-    /** Raw claims from the IdP for debugging — backend only */
-    providerRawProfile: z.record(z.string(), z.unknown()).optional().isBackendOnly(),
-    /** Only for enterprise links — identifies the organization */
+    providerAvatarUrl: z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),
+    /**
+     * Raw claims from the IdP for debugging — backend only.
+     *
+     * The one field on this resource whose contents the framework does not control: an IdP may put
+     * anything in a claim set, including a special category. IDENTITY + USER_CONTENT is what the field
+     * is FOR; it is not a certification of what a given IdP will send. An application whose IdP is
+     * known to emit a special-category claim should say so on its own copy.
+     */
+    providerRawProfile: z.record(z.string(), z.unknown()).optional().isBackendOnly()
+        .dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.USER_CONTENT]),
+    /** Enterprise tenant kind. Absent for social links. */
+    scopeType: z.enum(AuthScopeType).optional().isDBIndexed(),
+    /** Organization tenant identifier. Present only for organization-scoped enterprise links. */
     organizationId: z.string().optional().isForeignKey(),
-    /** Enterprise connection identifier within the org config */
+    /** Application tenant identifier. Present only for application-scoped enterprise links. */
+    applicationId: z.string().optional().isForeignKey(),
+    /** Enterprise connection identifier within the owning scope. */
     connectionId: z.string().optional(),
-    /** Authentication source that created this link (optional for backward compat with pre-existing links) */
-    source: z.enum(IdentityLinkSource).optional(),
+    /** Authentication source that created this link. */
+    source: z.enum(ExternalIdentitySource),
     /** When this identity link was created */
     linkedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
     /** Last time this identity link was used for authentication */
     lastUsedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+}).businessKeySet([
+    'connectionType',
+    'providerRef',
+    'providerUserId',
+    'scopeType',
+    'organizationId',
+    'applicationId',
+    'connectionId',
+]).superRefine((link, ctx) => {
+    if (!IDENTITY_SOURCES_BY_CONNECTION_TYPE[link.connectionType].has(link.source)) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['source'],
+            message: `Identity source ${link.source} is incompatible with ${link.connectionType} connections`,
+        });
+    }
+    if (link.connectionType === SsoConnectionType.SOCIAL) {
+        if (link.scopeType !== undefined
+            || link.organizationId !== undefined
+            || link.applicationId !== undefined
+            || link.connectionId !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['scopeType'],
+                message: 'Social identity links must not carry enterprise scope fields',
+            });
+        }
+        return;
+    }
+    if (!link.connectionId) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['connectionId'],
+            message: 'Enterprise identity links require connectionId',
+        });
+    }
+    if (link.scopeType === AuthScopeType.ORGANIZATION) {
+        if (!link.organizationId || link.applicationId !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['organizationId'],
+                message: 'Organization-scoped identity links require only organizationId',
+            });
+        }
+        return;
+    }
+    if (link.scopeType === AuthScopeType.APPLICATION) {
+        if (!link.applicationId || link.organizationId !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['applicationId'],
+                message: 'Application-scoped identity links require only applicationId',
+            });
+        }
+        return;
+    }
+    ctx.addIssue({
+        code: 'custom',
+        path: ['scopeType'],
+        message: 'Enterprise identity links require an explicit scopeType',
+    });
 });
-//# sourceMappingURL=user-identity-links.shared.schemas.js.map
+//# sourceMappingURL=user-identity-links.shared.schemas.js.map

package/dist/esm/users/user-identity-links.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-identity-links.shared.schemas.js","sourceRoot":"","sources":["../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,2DAA2D,CAAC;AAE9F,6DAA6D;AAC7D,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,mCAAa,CAAA;IACb,mCAAa,CAAA;IACb,mCAAa,CAAA;AACf,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExE,qFAAqF;IACrF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE7D,+BAA+B;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;IAE/C,yBAAyB;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAEvC,4BAA4B;IAC5B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,0BAA0B;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC,2DAA2D;IAC3D,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;IAEhF,8DAA8D;IAC9D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEpD,6DAA6D;IAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,0GAA0G;IAC1G,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAE7C,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElG,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACrG,CAAC,CAAC"}
+{"version":3,"file":"user-identity-links.shared.schemas.js","sourceRoot":"","sources":["../../../../src/users/user-identity-links.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,2DAA2D,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAE5C;IACF,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC;QAClC,sBAAsB,CAAC,MAAM;QAC7B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;IACF,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,CAAC;QACtC,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;QAC3B,sBAAsB,CAAC,IAAI;KAC5B,CAAC;CACH,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,+CAA+C;IAC/C,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAExE,qFAAqF;IACrF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE7D,+BAA+B;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAE7F,yBAAyB;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,eAAe,CAAC;IAE5F,4BAA4B;IAC5B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAExF,0BAA0B;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC;IAEtF;;;;;;;OAOG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;SAC7E,cAAc,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAErF,uDAAuD;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAEzD,6FAA6F;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEpD,2FAA2F;IAC3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE;IAEnD,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,oDAAoD;IACpD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAEtC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAElG,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACrG,CAAC,CAAC,cAAc,CAAC;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,cAAc;CACf,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM,yBAAyB,IAAI,CAAC,cAAc,cAAc;SAClG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACrD,IACE,IAAI,CAAC,SAAS,KAAK,SAAS;eACzB,IAAI,CAAC,cAAc,KAAK,SAAS;eACjC,IAAI,CAAC,aAAa,KAAK,SAAS;eAChC,IAAI,CAAC,YAAY,KAAK,SAAS,EAClC,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;gBACxB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EAAE,8DAA8D;aACxE,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,OAAO,EAAE,yDAAyD;KACnE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["/**\n * User Identity Links Schema\n *\n * Tracks OAuth2/SSO provider connections per user.\n * A user can have multiple identity links (e.g., Google social + Microsoft enterprise).\n *\n * Canonical identity key: connection type + provider + provider user + exact enterprise\n * scope/connection coordinates. The database compound unique index prevents the same\n * external identity from being bound to two Wildo users inside one tenant connection.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../compliance/privacy/personal-data-category.shared.schemas';\nimport {\n  AuthScopeType,\n  ExternalIdentitySource,\n  SsoConnectionType,\n} from '../security/authentications/authentication.shared.schemas';\n\n/**\n * Valid provenance mechanisms for each connection ownership class.\n *\n * OAuth2 is social-only; SAML and SCIM are enterprise-only; OIDC legitimately\n * spans both. Keeping this relationship beside the persisted link schema makes\n * invalid cross-products impossible at every repository boundary.\n */\nexport const IDENTITY_SOURCES_BY_CONNECTION_TYPE: Readonly<\n  Record<SsoConnectionType, ReadonlySet<ExternalIdentitySource>>\n> = {\n  [SsoConnectionType.SOCIAL]: new Set([\n    ExternalIdentitySource.OAUTH2,\n    ExternalIdentitySource.OIDC,\n  ]),\n  [SsoConnectionType.ENTERPRISE]: new Set([\n    ExternalIdentitySource.OIDC,\n    ExternalIdentitySource.SAML,\n    ExternalIdentitySource.SCIM,\n  ]),\n};\n\nexport const UserIdentityLinkSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** FK → USERS — the user who owns this identity link */\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  /** Distinguishes social vs enterprise links */\n  connectionType: z.enum(SsoConnectionType).isDBIndexed().isSummaryField(),\n\n  /** Matches external connector ref (e.g., \"google\", \"microsoft\", \"github\", \"oidc\") */\n  providerRef: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /** The user's ID at the IdP */\n  providerUserId: z.string().min(1).isDBIndexed().dataCategories(PersonalDataCategory.IDENTITY),\n\n  /** Email from the IdP */\n  providerEmail: z.string().isDBIndexed().dataCategories(PersonalDataCategory.CONTACT_DETAILS),\n\n  /** Display name from IdP */\n  providerDisplayName: z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n\n  /** Avatar URL from IdP */\n  providerAvatarUrl: z.string().optional().dataCategories(PersonalDataCategory.IDENTITY),\n\n  /**\n   * Raw claims from the IdP for debugging — backend only.\n   *\n   * The one field on this resource whose contents the framework does not control: an IdP may put\n   * anything in a claim set, including a special category. IDENTITY + USER_CONTENT is what the field\n   * is FOR; it is not a certification of what a given IdP will send. An application whose IdP is\n   * known to emit a special-category claim should say so on its own copy.\n   */\n  providerRawProfile: z.record(z.string(), z.unknown()).optional().isBackendOnly()\n    .dataCategories([PersonalDataCategory.IDENTITY, PersonalDataCategory.USER_CONTENT]),\n\n  /** Enterprise tenant kind. Absent for social links. */\n  scopeType: z.enum(AuthScopeType).optional().isDBIndexed(),\n\n  /** Organization tenant identifier. Present only for organization-scoped enterprise links. */\n  organizationId: z.string().optional().isForeignKey(),\n\n  /** Application tenant identifier. Present only for application-scoped enterprise links. */\n  applicationId: z.string().optional().isForeignKey(),\n\n  /** Enterprise connection identifier within the owning scope. */\n  connectionId: z.string().optional(),\n\n  /** Authentication source that created this link. */\n  source: z.enum(ExternalIdentitySource),\n\n  /** When this identity link was created */\n  linkedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n  /** Last time this identity link was used for authentication */\n  lastUsedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'connectionType',\n  'providerRef',\n  'providerUserId',\n  'scopeType',\n  'organizationId',\n  'applicationId',\n  'connectionId',\n]).superRefine((link, ctx) => {\n  if (!IDENTITY_SOURCES_BY_CONNECTION_TYPE[link.connectionType].has(link.source)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['source'],\n      message: `Identity source ${link.source} is incompatible with ${link.connectionType} connections`,\n    });\n  }\n\n  if (link.connectionType === SsoConnectionType.SOCIAL) {\n    if (\n      link.scopeType !== undefined\n      || link.organizationId !== undefined\n      || link.applicationId !== undefined\n      || link.connectionId !== undefined\n    ) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['scopeType'],\n        message: 'Social identity links must not carry enterprise scope fields',\n      });\n    }\n    return;\n  }\n\n  if (!link.connectionId) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['connectionId'],\n      message: 'Enterprise identity links require connectionId',\n    });\n  }\n\n  if (link.scopeType === AuthScopeType.ORGANIZATION) {\n    if (!link.organizationId || link.applicationId !== undefined) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['organizationId'],\n        message: 'Organization-scoped identity links require only organizationId',\n      });\n    }\n    return;\n  }\n\n  if (link.scopeType === AuthScopeType.APPLICATION) {\n    if (!link.applicationId || link.organizationId !== undefined) {\n      ctx.addIssue({\n        code: 'custom',\n        path: ['applicationId'],\n        message: 'Application-scoped identity links require only applicationId',\n      });\n    }\n    return;\n  }\n\n  ctx.addIssue({\n    code: 'custom',\n    path: ['scopeType'],\n    message: 'Enterprise identity links require an explicit scopeType',\n  });\n});\n\n\nexport type UserIdentityLink = z.infer<typeof UserIdentityLinkSchema>;\n"]}

package/dist/esm/users/user-preferences-reset.shared.utils.d.ts

@@ -0,0 +1,78 @@
+/**
+ * User Preferences Reset — the shared contract behind `reset_to_defaults`.
+ *
+ * ONE authority for the self-service reset of a preferences row. `USER_SELF_PREFERENCES`
+ * resolves to the `USER_PREFERENCES` persistence collection, but the administrator-addressed
+ * resource deliberately exposes no reset operation: a second public verb would be a second
+ * contract for the same mutation, free to drift. Administrators have the generic UPDATE for an
+ * explicit correction; subjects own selective reset here.
+ *
+ * ## Why this file exists at all
+ *
+ * The operation used to declare six booleans (`resetNotifications`, `resetPrivacy`, `resetUI`,
+ * `resetRegional`, `resetLanguage`, `resetAll`). None of them is a field on
+ * `UserPreferencesSchema`, and a payload is stripped THREE times on the way to the database —
+ * the controller parses the body against the operation `requestDto`, the repository re-parses
+ * the write against that same DTO, and Mongoose drops every non-schema path. A request naming
+ * no schema path therefore produced an empty `$set`: the route answered HTTP 200 having reset
+ * nothing. That is the class of defect catalogued in
+ * `.claude/plans/routed-unimplemented-operations-fail-closed.md`.
+ *
+ * ## How the reset reaches the database now
+ *
+ * `requestDto` names the caller-facing vocabulary ({@link UserPreferenceGroup}); a
+ * `basicPrefixOperation` turns it into the patch this module builds. The framework merges a
+ * prefix's return value onto the payload and whitelists the keys the prefix ADDED into
+ * `preserveServerInjectedFields`, which the repository re-attaches after its strict parse. So
+ * the group fields persist while the `groups` array itself — a client-supplied key, never
+ * whitelisted — is stripped before it can reach a document.
+ *
+ * The patch is deliberately PARTIAL. The repository `$set`s it with no dot-path flattening, so
+ * naming a group replaces that whole subdocument (which is exactly what "reset this block"
+ * means), while an unnamed group is not in the `$set` at all and is left untouched. Spreading
+ * the current row instead — the shape `todo-lists`/`todos` use — would make `_id` and `userId`
+ * prefix-injected keys and re-write `userId` on every reset, despite it being
+ * `.excludeFromUpdate()`.
+ */
+import { z } from "zod";
+import { UserPreferenceGroup, UserPreferences } from "./users.shared.schemas";
+/**
+ * The `reset_to_defaults` request body for the subject-facing preferences resource.
+ *
+ * `.min(1)` is load-bearing, not decoration: a reset naming no group would write nothing and
+ * answer 200, re-creating the exact silent no-op this operation was fixed for. Rejecting it at
+ * the DTO makes that unrepresentable — the controller's strict parse turns it into a 400 before
+ * any dispatch, and the repository's re-parse of the write enforces the same rule on every
+ * non-HTTP path.
+ *
+ * `COMBOBOX` renders the array as a chips multi-select rather than an add-a-row array field,
+ * matching how `fallbackLanguages` presents a compact multi-select in the same settings surface.
+ */
+export declare const UserPreferencesResetRequestSchema: z.ZodObject<{
+    groups: z.ZodArray<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof UserPreferenceGroup>>>;
+}, z.core.$strip>;
+export type UserPreferencesResetRequest = z.infer<typeof UserPreferencesResetRequestSchema>;
+/**
+ * The persistence patch for a `reset_to_defaults` request — one key per requested block, and
+ * nothing else.
+ *
+ * Returned from a `basicPrefixOperation`, so the framework merges it onto the payload and the
+ * core UPDATE persists it. Keys absent from the patch are absent from the `$set`, so an
+ * unnamed block is left exactly as it was.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD — resetting {@link UserPreferenceGroup.PRIVACY}
+ * returns `dataProcessingConsent` to its default, which IS a consent decision. It leaves a trail
+ * naming the previous and resulting value: the operation is CRITICAL, so it sits above the
+ * framework's automatic audit floor and emits `resource_operation_performed`, and
+ * `dataProcessingConsent` / `privacyLevel` carry `.isAuditEvidence()` so their VALUES ride on that
+ * record. Governed-document receipts are neither preference members nor resettable values.
+ *
+ * @param request - the parsed request body. Re-parse `inputDto` through
+ *   {@link UserPreferencesResetRequestSchema} at the call site rather than casting it: the
+ *   prefix hook types `inputDto` as the resource's main schema, while the runtime value is the
+ *   operation's request DTO.
+ * @param currentPreferences - the row being reset, needed by blocks whose reset is not a pure
+ *   default (today: privacy, whose consent receipts are carried through).
+ */
+export declare function buildUserPreferencesResetPatch(request: UserPreferencesResetRequest, currentPreferences: UserPreferences | undefined): Partial<UserPreferences>;
+//# sourceMappingURL=user-preferences-reset.shared.utils.d.ts.map

package/dist/esm/users/user-preferences-reset.shared.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-preferences-reset.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/users/user-preferences-reset.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,mBAAmB,EACnB,eAAe,EAKhB,MAAM,wBAAwB,CAAC;AAGhC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AA2B5F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,2BAA2B,EACpC,kBAAkB,EAAE,eAAe,GAAG,SAAS,GAC9C,OAAO,CAAC,eAAe,CAAC,CAU1B"}