@wildo-ai/saas-models 1.0.1

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js

@@ -0,0 +1,143 @@
+/**
+ * SSO Connection Schema (Shared) — Polymorphic
+ *
+ * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).
+ * Unified resource — `protocol` field determines which sub-object is populated.
+ * SAML fields are defined but the protocol engine is NOT IMPLEMENTED (DEFERRED AUTH-2).
+ * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
+ *
+ * @see auth-data-model-audit.md §2B
+ */
+import { z } from 'zod';
+import { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas.js';
+import { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas.js';
+export const SSOProtocol = {
+    OIDC: 'oidc',
+    SAML: 'saml',
+};
+export const SSOTemplateMode = {
+    TEMPLATE: 'template',
+    DISCOVERY: 'discovery',
+    MANUAL: 'manual',
+};
+export const SSOResponseType = {
+    CODE: 'code',
+    ID_TOKEN: 'id_token',
+    TOKEN: 'token',
+};
+export const SSOResponseMode = {
+    QUERY: 'query',
+    FRAGMENT: 'fragment',
+    FORM_POST: 'form_post',
+};
+export const SSOPrompt = {
+    NONE: 'none',
+    LOGIN: 'login',
+    CONSENT: 'consent',
+    SELECT_ACCOUNT: 'select_account',
+};
+export const SSOPKCEMethod = {
+    S256: 'S256',
+    PLAIN: 'plain',
+};
+export const SamlNameIdFormat = {
+    UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',
+    EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
+    PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
+    TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
+};
+export const SsoConnectionBaseSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    protocol: z.enum(SSOProtocol).isSummaryField(),
+    externalProviderId: z.string().min(1).optional(),
+    displayName: z.string().min(1).isSummaryField(),
+    enabled: z.boolean().default(true).isSummaryField(),
+    isDefault: z.boolean().default(false),
+    saml: z.object({
+        entityId: z.string().min(1),
+        ssoUrl: z.url(),
+        sloUrl: z.url().optional(),
+        /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */
+        x509CertificatePem: z.string().min(1).optional(),
+        x509Certificates: z.array(z.string()).min(1).isBackendOnly(),
+        attributeMapping: z.object({
+            email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),
+            firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),
+            lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),
+            roles: z.string().optional(),
+            department: z.string().optional(),
+            employeeId: z.string().optional(),
+            groups: z.string().optional(),
+        }),
+        signRequests: z.boolean().default(true),
+        wantAssertionsSigned: z.boolean().default(true),
+        allowedClockDrift: z.number().min(0).max(300).default(30),
+        forceAuthn: z.boolean().default(false),
+        maxAuthAge: z.number().min(0).optional(),
+        nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS),
+        allowIdpInitiated: z.boolean().default(false),
+        auditSettings: z.object({
+            logAuthAttempts: z.boolean().default(true),
+            logAttributeMapping: z.boolean().default(true),
+            retentionDays: z.number().min(1).max(2555).default(90),
+        }),
+    }).optional(),
+    oidc: z.object({
+        templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL),
+        templateOverrides: z.record(z.string(), z.string()).optional(),
+        customScopes: z.array(z.string()).optional(),
+        discoveryUrl: z.url().optional(),
+        issuer: z.url().optional(),
+        authorizationEndpoint: z.url().optional(),
+        tokenEndpoint: z.url().optional(),
+        userInfoEndpoint: z.url().optional(),
+        jwksUri: z.url().optional(),
+        endSessionEndpoint: z.url().optional(),
+        clientId: z.string().min(1),
+        clientSecret: z.string().min(1).isBackendOnly(),
+        scopes: z.array(z.string()).default(['openid', 'email', 'profile']),
+        responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE),
+        responseMode: z.enum(SSOResponseMode).optional(),
+        claimsMapping: z.object({
+            email: z.string().default('email'),
+            firstName: z.string().default('given_name'),
+            lastName: z.string().default('family_name'),
+            roles: z.string().optional(),
+            department: z.string().optional(),
+            employeeId: z.string().optional(),
+            groups: z.string().optional(),
+        }),
+        validateIssuer: z.boolean().default(true),
+        validateAudience: z.boolean().default(true),
+        clockTolerance: z.number().min(0).max(300).default(30),
+        acrValues: z.array(z.string()).optional(),
+        maxAge: z.number().min(0).optional(),
+        prompt: z.enum(SSOPrompt).optional(),
+        pkceEnabled: z.boolean().default(true),
+        pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256),
+        auditSettings: z.object({
+            logAuthAttempts: z.boolean().default(true),
+            logTokenExchange: z.boolean().default(true),
+            logClaimsMapping: z.boolean().default(true),
+            retentionDays: z.number().min(1).max(2555).default(90),
+        }),
+    }).optional(),
+    autoCreateUsers: z.boolean().default(true),
+    autoVerifyEmail: z.boolean().default(true),
+    /** W2.8: if true, users authenticating via this SSO connection skip the application-level MFA policy. */
+    bypassAppMFA: z.boolean().default(false),
+    defaultRole: z.string().optional(),
+    allowedDomains: z.array(z.string()).default([]).isDBIndexed(),
+    roleMapping: z.record(z.string(), z.string()).optional(),
+    groupMapping: z.record(z.string(), z.array(z.string())).optional(),
+    createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
+    updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
+});
+export const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({
+    baseResourceType: 'ssoConnections',
+    baseFieldIdentifier: 'ssoConnectionId',
+    baseEnumKey: 'SSO_CONNECTIONS',
+    baseSchema: SsoConnectionBaseSchema,
+    variants: AUTH_SCOPE_VARIANTS,
+});
+//# sourceMappingURL=sso-connection.shared.schemas.js.map

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;IACnD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAErC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1B,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;YAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC;YAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC;YAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAC9E,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;QACrE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC9D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC5C,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1B,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACjC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACpC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC3B,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACnE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC;QACnE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;QAChD,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;QACpC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC;QAC7D,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,yGAAyG;IACzG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAElE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC"}

package/dist/esm/security/authorizations/roles.shared.defaults.d.ts

@@ -0,0 +1,10 @@
+/**
+ * App Roles Shared Schemas
+ *
+ * Application-level roles directly linked to users (not organization-specific)
+ * Similar behavior to OrganizationRole but for app-wide permissions
+ */
+import { RolesConfiguration } from './roles.shared.schemas.js';
+export declare const DEFAULT_APP_ROLE_CONFIGURATION: RolesConfiguration;
+export declare const DEFAULT_ORGANIZATION_ROLES: RolesConfiguration;
+//# sourceMappingURL=roles.shared.defaults.d.ts.map

package/dist/esm/security/authorizations/roles.shared.defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.shared.defaults.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/roles.shared.defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAkC,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5F,eAAO,MAAM,8BAA8B,EAAE,kBAmC5C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,kBA8BxC,CAAC"}

package/dist/esm/security/authorizations/roles.shared.defaults.js

@@ -0,0 +1,76 @@
+/**
+ * App Roles Shared Schemas
+ *
+ * Application-level roles directly linked to users (not organization-specific)
+ * Similar behavior to OrganizationRole but for app-wide permissions
+ */
+import { ResourcePrimaryScope } from '../../resources/resources.shared.schemas.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from './roles.shared.schemas.js';
+export const DEFAULT_APP_ROLE_CONFIGURATION = {
+    [CORE_APP_ROLES.APP_USER]: {
+        role: CORE_APP_ROLES.APP_USER,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.APPLICATION
+    },
+    [CORE_APP_ROLES.APP_ADMIN_VIEWER]: {
+        role: CORE_APP_ROLES.APP_ADMIN_VIEWER,
+        inheritFrom: CORE_APP_ROLES.APP_USER,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.APPLICATION
+    },
+    [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR]: {
+        role: CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR,
+        inheritFrom: CORE_APP_ROLES.APP_ADMIN_VIEWER,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.APPLICATION
+    },
+    [CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER]: {
+        role: CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,
+        inheritFrom: CORE_APP_ROLES.APP_ADMIN_VIEWER,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.APPLICATION
+    },
+    [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN]: {
+        role: CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,
+        inheritFrom: CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.APPLICATION
+    },
+    [CORE_APP_ROLES.APP_ANONYMOUS]: {
+        role: CORE_APP_ROLES.APP_ANONYMOUS,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.APPLICATION
+    },
+};
+export const DEFAULT_ORGANIZATION_ROLES = {
+    [CORE_ORG_ROLES.ORG_GUEST]: {
+        role: CORE_ORG_ROLES.ORG_GUEST,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
+    [CORE_ORG_ROLES.ORG_MEMBER]: {
+        role: CORE_ORG_ROLES.ORG_MEMBER,
+        inheritFrom: CORE_ORG_ROLES.ORG_GUEST,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
+    [CORE_ORG_ROLES.ORG_MANAGER]: {
+        role: CORE_ORG_ROLES.ORG_MANAGER,
+        inheritFrom: CORE_ORG_ROLES.ORG_MEMBER,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
+    [CORE_ORG_ROLES.ORG_ADMIN]: {
+        role: CORE_ORG_ROLES.ORG_ADMIN,
+        inheritFrom: CORE_ORG_ROLES.ORG_MANAGER,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
+    [CORE_ORG_ROLES.ORG_OWNER]: {
+        role: CORE_ORG_ROLES.ORG_OWNER,
+        inheritFrom: CORE_ORG_ROLES.ORG_ADMIN,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    }
+};
+//# sourceMappingURL=roles.shared.defaults.js.map

package/dist/esm/security/authorizations/roles.shared.defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.shared.defaults.js","sourceRoot":"","sources":["../../../../src/security/authorizations/roles.shared.defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAsB,MAAM,wBAAwB,CAAC;AAE5F,MAAM,CAAC,MAAM,8BAA8B,GAAuB;IAChE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,IAAI,EAAE,cAAc,CAAC,QAAQ;QAC7B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE;QACjC,IAAI,EAAE,cAAc,CAAC,gBAAgB;QACrC,WAAW,EAAE,cAAc,CAAC,QAAQ;QACpC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;QAC3C,IAAI,EAAE,cAAc,CAAC,0BAA0B;QAC/C,WAAW,EAAE,cAAc,CAAC,gBAAgB;QAC5C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE;QAC1C,IAAI,EAAE,cAAc,CAAC,yBAAyB;QAC9C,WAAW,EAAE,cAAc,CAAC,gBAAgB;QAC5C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE;QACtC,IAAI,EAAE,cAAc,CAAC,qBAAqB;QAC1C,WAAW,EAAE,cAAc,CAAC,yBAAyB;QACrD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE;QAC9B,IAAI,EAAE,cAAc,CAAC,aAAa;QAClC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAuB;IAC5D,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;QAC3B,IAAI,EAAE,cAAc,CAAC,UAAU;QAC/B,WAAW,EAAE,cAAc,CAAC,SAAS;QACrC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE;QAC5B,IAAI,EAAE,cAAc,CAAC,WAAW;QAChC,WAAW,EAAE,cAAc,CAAC,UAAU;QACtC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,WAAW,EAAE,cAAc,CAAC,WAAW;QACvC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,WAAW,EAAE,cAAc,CAAC,SAAS;QACrC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;CACF,CAAC"}

package/dist/esm/security/authorizations/roles.shared.schemas.d.ts

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+import { ResourcePrimaryScope } from '../../resources/resources.shared.schemas.js';
+export declare enum CORE_APP_ROLES {
+    /** Unauthenticated access. Operations with APP_PUBLIC are accessible without auth. */
+    APP_PUBLIC = "APP_PUBLIC",
+    APP_ADMIN_SUPER_ADMIN = "APP_ADMIN_SUPER_ADMIN",
+    APP_ADMIN_BILLING_MANAGER = "APP_ADMIN_BILLING_MANAGER",
+    APP_ADMIN_MARKETING_EDITOR = "APP_ADMIN_MARKETING_EDITOR",
+    APP_ADMIN_VIEWER = "APP_ADMIN_VIEWER",
+    APP_USER = "APP_USER",
+    /** Anonymous session access. Operations with APP_ANONYMOUS are accessible to anonymous users. */
+    APP_ANONYMOUS = "APP_ANONYMOUS"
+}
+export declare enum CORE_ORG_ROLES {
+    ORG_GUEST = "ORG_GUEST",
+    ORG_OWNER = "ORG_OWNER",
+    ORG_ADMIN = "ORG_ADMIN",
+    ORG_MANAGER = "ORG_MANAGER",
+    ORG_MEMBER = "ORG_MEMBER"
+}
+export declare const CoreRolesSchema: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>]>;
+export declare const RolesSchema: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>;
+export declare const AppRolesSchema: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodString]>;
+export declare const OrgRolesSchema: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>;
+export declare const RoleDefinitionSchema: z.ZodObject<{
+    role: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>;
+    inheritFrom: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>>;
+    isSystemRole: z.ZodDefault<z.ZodBoolean>;
+    relatedPrimaryScope: z.ZodEnum<typeof ResourcePrimaryScope>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type RoleDefinition = z.infer<typeof RoleDefinitionSchema>;
+export declare const RolesConfigurationSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    role: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>;
+    inheritFrom: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>>;
+    isSystemRole: z.ZodDefault<z.ZodBoolean>;
+    relatedPrimaryScope: z.ZodEnum<typeof ResourcePrimaryScope>;
+}, z.core.$strip, core.$ZodObjectExtra>>;
+export type Roles = z.infer<typeof RolesSchema>;
+export type CoreRoles = z.infer<typeof CoreRolesSchema>;
+export type AppRoles = z.infer<typeof AppRolesSchema>;
+export type OrgRoles = z.infer<typeof OrgRolesSchema>;
+export type RolesConfiguration = z.infer<typeof RolesConfigurationSchema>;
+//# sourceMappingURL=roles.shared.schemas.d.ts.map

package/dist/esm/security/authorizations/roles.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/roles.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAEhF,oBAAY,cAAc;IACxB,sFAAsF;IACtF,UAAU,eAAe;IACzB,qBAAqB,0BAA0B;IAC/C,yBAAyB,8BAA8B;IACvD,0BAA0B,+BAA+B;IACzD,gBAAgB,qBAAqB;IACrC,QAAQ,aAAa;IACrB,iGAAiG;IACjG,aAAa,kBAAkB;CAChC;AAED,oBAAY,cAAc;IACxB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;CAC1B;AAGD,eAAO,MAAM,eAAe,2FAG1B,CAAC;AAEH,eAAO,MAAM,WAAW,wGAItB,CAAC;AAEH,eAAO,MAAM,cAAc,sEAGzB,CAAC;AAEH,eAAO,MAAM,cAAc,sEAGzB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;uCAK/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;wCAYpC,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAChD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/security/authorizations/roles.shared.schemas.js

@@ -0,0 +1,58 @@
+import { z } from 'zod';
+import { ResourcePrimaryScope } from '../../resources/resources.shared.schemas.js';
+export var CORE_APP_ROLES;
+(function (CORE_APP_ROLES) {
+    /** Unauthenticated access. Operations with APP_PUBLIC are accessible without auth. */
+    CORE_APP_ROLES["APP_PUBLIC"] = "APP_PUBLIC";
+    CORE_APP_ROLES["APP_ADMIN_SUPER_ADMIN"] = "APP_ADMIN_SUPER_ADMIN";
+    CORE_APP_ROLES["APP_ADMIN_BILLING_MANAGER"] = "APP_ADMIN_BILLING_MANAGER";
+    CORE_APP_ROLES["APP_ADMIN_MARKETING_EDITOR"] = "APP_ADMIN_MARKETING_EDITOR";
+    CORE_APP_ROLES["APP_ADMIN_VIEWER"] = "APP_ADMIN_VIEWER";
+    CORE_APP_ROLES["APP_USER"] = "APP_USER";
+    /** Anonymous session access. Operations with APP_ANONYMOUS are accessible to anonymous users. */
+    CORE_APP_ROLES["APP_ANONYMOUS"] = "APP_ANONYMOUS";
+})(CORE_APP_ROLES || (CORE_APP_ROLES = {}));
+export var CORE_ORG_ROLES;
+(function (CORE_ORG_ROLES) {
+    CORE_ORG_ROLES["ORG_GUEST"] = "ORG_GUEST";
+    CORE_ORG_ROLES["ORG_OWNER"] = "ORG_OWNER";
+    CORE_ORG_ROLES["ORG_ADMIN"] = "ORG_ADMIN";
+    CORE_ORG_ROLES["ORG_MANAGER"] = "ORG_MANAGER";
+    CORE_ORG_ROLES["ORG_MEMBER"] = "ORG_MEMBER";
+})(CORE_ORG_ROLES || (CORE_ORG_ROLES = {}));
+export const CoreRolesSchema = z.union([
+    z.enum(CORE_APP_ROLES),
+    z.enum(CORE_ORG_ROLES),
+]);
+export const RolesSchema = z.union([
+    z.enum(CORE_APP_ROLES),
+    z.enum(CORE_ORG_ROLES),
+    z.string().min(1),
+]);
+export const AppRolesSchema = z.union([
+    z.enum(CORE_APP_ROLES),
+    z.string().min(1),
+]);
+export const OrgRolesSchema = z.union([
+    z.enum(CORE_ORG_ROLES),
+    z.string().min(1),
+]);
+export const RoleDefinitionSchema = z.object({
+    role: RolesSchema,
+    inheritFrom: RolesSchema.optional(),
+    isSystemRole: z.boolean().default(false),
+    relatedPrimaryScope: z.enum(ResourcePrimaryScope),
+});
+export const RolesConfigurationSchema = z.record(z.string(), RoleDefinitionSchema).refine((record) => {
+    // Validate that all keys are valid roles
+    return Object.keys(record).every(key => {
+        try {
+            RolesSchema.parse(key);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+});
+//# sourceMappingURL=roles.shared.schemas.js.map

package/dist/esm/security/authorizations/roles.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authorizations/roles.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAEhF,MAAM,CAAN,IAAY,cAUX;AAVD,WAAY,cAAc;IACxB,sFAAsF;IACtF,2CAAyB,CAAA;IACzB,iEAA+C,CAAA;IAC/C,yEAAuD,CAAA;IACvD,2EAAyD,CAAA;IACzD,uDAAqC,CAAA;IACrC,uCAAqB,CAAA;IACrB,iGAAiG;IACjG,iDAA+B,CAAA;AACjC,CAAC,EAVW,cAAc,KAAd,cAAc,QAUzB;AAED,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,yCAAuB,CAAA;IACvB,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,2CAAyB,CAAA;AAC3B,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AAGD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC;IACjC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,mBAAmB,EAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;CACnD,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,MAAM,CACvF,CAAC,MAAM,EAAE,EAAE;IACT,yCAAyC;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACrC,IAAI,CAAC;YACH,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}

package/dist/esm/security/crypto-keys/crypto-keys.shared.schemas.d.ts

@@ -0,0 +1,6 @@
+export declare enum CryptoKey_Management {
+    PLATFORM = "platform",
+    CUSTOMER = "customer",
+    HSM = "hsm"
+}
+//# sourceMappingURL=crypto-keys.shared.schemas.d.ts.map

package/dist/esm/security/crypto-keys/crypto-keys.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-keys.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/crypto-keys/crypto-keys.shared.schemas.ts"],"names":[],"mappings":"AACA,oBAAY,oBAAoB;IAC9B,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,GAAG,QAAQ;CACZ"}

package/dist/esm/security/crypto-keys/crypto-keys.shared.schemas.js

@@ -0,0 +1,7 @@
+export var CryptoKey_Management;
+(function (CryptoKey_Management) {
+    CryptoKey_Management["PLATFORM"] = "platform";
+    CryptoKey_Management["CUSTOMER"] = "customer";
+    CryptoKey_Management["HSM"] = "hsm";
+})(CryptoKey_Management || (CryptoKey_Management = {}));
+//# sourceMappingURL=crypto-keys.shared.schemas.js.map

package/dist/esm/security/crypto-keys/crypto-keys.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-keys.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/crypto-keys/crypto-keys.shared.schemas.ts"],"names":[],"mappings":"AACA,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,6CAAqB,CAAA;IACrB,6CAAqB,CAAA;IACrB,mCAAW,CAAA;AACb,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B"}

package/dist/esm/testing/resource-config-builders.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Shared helpers for saas-models tests: minimal resource configs, auth fixtures,
+ * and relationship processing that mirrors `createResourceConfiguration_Initialization`.
+ *
+ * Not re-exported from the main package entry — use `@wildo-ai/saas-models/testing`.
+ */
+import type { z } from 'zod';
+import { type UserTypeAuthPolicy } from '../config/entity-identity-config.shared.schemas.js';
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions.js';
+import type { ResourceConfiguration, ResourceConfiguration_Operation, ResourceConfiguration_ResourceRelationships } from '../resources/resources-config.shared.schemas.js';
+import { ResourceRelationship } from '../resources/resources.shared.schemas.js';
+export declare function makeUserTypeAuth(overrides?: Partial<UserTypeAuthPolicy>): UserTypeAuthPolicy;
+/**
+ * Minimal `ResourceConfiguration_Operation` for **saas-models** DTO / resource-config unit tests.
+ *
+ * **Not** the same symbol as `createTestOperation` in `@wildo-ai/saas-backend-lib/testing`
+ * (`feature-test-utils.ts`), which builds operation stubs for **feature-gate** tests.
+ */
+export declare function createTestOperation(mainSchema: z.ZodTypeAny, operationIdentifier?: CoreResourceOperation): ResourceConfiguration_Operation<any, any, any>;
+export declare function createTestResourceConfig(mainSchema: z.ZodTypeAny, operations: ResourceConfiguration_Operation<any, any, any>[]): ResourceConfiguration<any, any, any>;
+/**
+ * Process relationships for a resource — mirrors the logic in createResourceConfiguration_Initialization.
+ * M:N relationships are transformed into 1:N relationships for the junction table.
+ *
+ * The helper expects compiled runtime relationships, matching the production
+ * factory output from `createResourcesRelationship()` / registry initialization.
+ */
+export declare function processResourceRelationships(resourceIdentifier: string, resourceRelationships: ResourceRelationship[]): ResourceConfiguration_ResourceRelationships;
+/**
+ * Conditional relationships — active only for specific discriminator variants.
+ */
+export declare function getConditionalRelationships(resourceIdentifier: string, resourceRelationships: ResourceRelationship[]): ResourceRelationship[];
+//# sourceMappingURL=resource-config-builders.d.ts.map

package/dist/esm/testing/resource-config-builders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-config-builders.d.ts","sourceRoot":"","sources":["../../../src/testing/resource-config-builders.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iDAAiD,CAAC;AAGzD,OAAO,EACL,qBAAqB,EAGtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,qBAAqB,EACrB,+BAA+B,EAC/B,2CAA2C,EAC5C,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAKL,oBAAoB,EAKrB,MAAM,uCAAuC,CAAC;AAG/C,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAwC5F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,mBAAmB,GAAE,qBAAkD,GACtE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAkChD;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,CAAC,CAAC,UAAU,EACxB,UAAU,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,GAC3D,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAsBtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,2CAA2C,CAuI7C;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,kBAAkB,EAAE,MAAM,EAC1B,qBAAqB,EAAE,oBAAoB,EAAE,GAC5C,oBAAoB,EAAE,CAQxB"}