@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/security/authorizations/roles.shared.utils.d.ts

@@ -41,6 +41,60 @@ import { type RolesConfiguration } from './roles.shared.schemas';
  * @returns the role + its inherited ancestors, nearest-first; empty if unknown
  */
 export declare function computeRoleHierarchy(roleKey: string, rolesConfig: RolesConfiguration): string[];
+/**
+ * Does this required-role set declare PUBLIC access — imposing no positive role requirement on ANY
+ * caller, credentialed or not?
+ *
+ * ## The semantic this settles, and why the alternative reading was wrong
+ *
+ * `APP_PUBLIC` can be read two ways, and for a long time different layers of the framework read it
+ * differently:
+ *
+ *  - *no credential REQUIRED* — reachable when nobody authenticated, and gated on roles otherwise;
+ *  - *no credential EXAMINED* — reachable by everyone, whether or not they authenticated.
+ *
+ * The second is the contract, and the first was a defect. Under the first reading, an operation
+ * declaring `APP_PUBLIC` answered 200 to an anonymous probe and **403 to the same request carrying a
+ * valid token**, because `APP_PUBLIC` is not a role anybody is GRANTED — so a credentialed caller
+ * fell past the public carve-out to an ordinary role gate that nothing in their grant set could
+ * satisfy. Authenticating REDUCED access below what anonymity gave, on every public surface an
+ * application can build: a price list, a public catalogue, an i18n bundle served as a resource.
+ *
+ * Three of the four surfaces that consume `roles` already implemented the second reading, which is
+ * what makes this the framework's settled contract rather than a preference:
+ *
+ * | surface | reading |
+ * |---|---|
+ * | frontend action visibility ({@link userRolesSatisfyRequiredRoles}) | no positive requirement |
+ * | OpenAPI generation — `APP_PUBLIC` emits `security: []` | no authentication required |
+ * | variant rights ranking ({@link computeRolePrivilegeRank}) | ranks `0`, the floor |
+ * | backend role gate (before this predicate existed) | **credentialed callers refused** |
+ *
+ * An OpenAPI `security: []` says the endpoint imposes no security requirement. A client that sends a
+ * bearer token to such an endpoint is conformant, and refusing it contradicts the published
+ * contract. And independently of any document: **authenticating must never take access away.**
+ *
+ * ## What it does NOT relax
+ *
+ * Only the ROLE question. Tenancy, parent-scope and FK-path gates run unchanged, and the
+ * repository's contextual filter still confines every row the caller then reaches. A public
+ * declaration says "no role is required to ask"; it never says "no scope confines the answer".
+ *
+ * ## Why `APP_ANONYMOUS` is deliberately NOT here
+ *
+ * {@link OPEN_REQUIRED_ROLES} — the DISPLAY-side set — holds both sentinels, because that gate only
+ * decides whether to render a button and is documented to fail OPEN on uncertainty. This predicate
+ * is an ADMISSION rule, and the two sentinels are not interchangeable for admission:
+ * `APP_ANONYMOUS` is a role an anonymous session genuinely HOLDS (the execution-context creator
+ * grants it), so an anonymous caller already satisfies the ordinary gate and needs no carve-out —
+ * whereas nobody is ever granted `APP_PUBLIC`. Widening admission to `APP_ANONYMOUS` would therefore
+ * change who reaches anonymous-scoped operations without fixing anything, which is the wrong trade
+ * for a gate. Keep the two questions separate.
+ *
+ * @param requiredRoles - an operation's declared `roles` (OR semantics)
+ * @returns `true` when the declaration admits every caller, role-wise
+ */
+export declare function requiredRolesDeclarePublicAccess(requiredRoles: readonly string[] | undefined): boolean;
 /** Parameters for {@link userRolesSatisfyRequiredRoles}. */
 export interface UserRolesSatisfyRequiredRolesParams {
     /** The operation's required roles (OR semantics). Empty/undefined ⇒ unrestricted. */

package/dist/esm/security/authorizations/roles.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAkC,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAMjG;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAQ/F;AAYD,4DAA4D;AAC5D,MAAM,WAAW,mCAAmC;IAClD,qFAAqF;IACrF,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,wEAAwE;IACxE,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,0GAA0G;IAC1G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,mFAAmF;IACnF,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,+EAA+E;IAC/E,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAoClG;AAsCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,kBAAmD,EACnE,cAAc,GAAE,kBAA+C,GAC9D,MAAM,CAMR;AAED,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IACpC,8FAA8F;IAC9F,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,qBAAqB,EAC9B,cAAc,CAAC,EAAE,kBAAkB,EACnC,cAAc,CAAC,EAAE,kBAAkB,GAClC,MAAM,CAIR;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,qBAAqB,EACzE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,cAAc,CAAC,EAAE,kBAAkB,EACnC,cAAc,CAAC,EAAE,kBAAkB,GAClC,CAAC,EAAE,CAQL"}
+{"version":3,"file":"roles.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAkC,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAMjG;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAQ/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,gCAAgC,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAEtG;AAeD,4DAA4D;AAC5D,MAAM,WAAW,mCAAmC;IAClD,qFAAqF;IACrF,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,wEAAwE;IACxE,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,0GAA0G;IAC1G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,mFAAmF;IACnF,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,+EAA+E;IAC/E,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mCAAmC,GAAG,OAAO,CAoClG;AAsCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,kBAAmD,EACnE,cAAc,GAAE,kBAA+C,GAC9D,MAAM,CAMR;AAED,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IACpC,8FAA8F;IAC9F,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,qBAAqB,EAC9B,cAAc,CAAC,EAAE,kBAAkB,EACnC,cAAc,CAAC,EAAE,kBAAkB,GAClC,MAAM,CAIR;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,qBAAqB,EACzE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,cAAc,CAAC,EAAE,kBAAkB,EACnC,cAAc,CAAC,EAAE,kBAAkB,GAClC,CAAC,EAAE,CAQL"}

package/dist/esm/security/authorizations/roles.shared.utils.js

@@ -50,10 +50,69 @@ export function computeRoleHierarchy(roleKey, rolesConfig) {
     }
     return hierarchy;
 }
+/**
+ * Does this required-role set declare PUBLIC access — imposing no positive role requirement on ANY
+ * caller, credentialed or not?
+ *
+ * ## The semantic this settles, and why the alternative reading was wrong
+ *
+ * `APP_PUBLIC` can be read two ways, and for a long time different layers of the framework read it
+ * differently:
+ *
+ *  - *no credential REQUIRED* — reachable when nobody authenticated, and gated on roles otherwise;
+ *  - *no credential EXAMINED* — reachable by everyone, whether or not they authenticated.
+ *
+ * The second is the contract, and the first was a defect. Under the first reading, an operation
+ * declaring `APP_PUBLIC` answered 200 to an anonymous probe and **403 to the same request carrying a
+ * valid token**, because `APP_PUBLIC` is not a role anybody is GRANTED — so a credentialed caller
+ * fell past the public carve-out to an ordinary role gate that nothing in their grant set could
+ * satisfy. Authenticating REDUCED access below what anonymity gave, on every public surface an
+ * application can build: a price list, a public catalogue, an i18n bundle served as a resource.
+ *
+ * Three of the four surfaces that consume `roles` already implemented the second reading, which is
+ * what makes this the framework's settled contract rather than a preference:
+ *
+ * | surface | reading |
+ * |---|---|
+ * | frontend action visibility ({@link userRolesSatisfyRequiredRoles}) | no positive requirement |
+ * | OpenAPI generation — `APP_PUBLIC` emits `security: []` | no authentication required |
+ * | variant rights ranking ({@link computeRolePrivilegeRank}) | ranks `0`, the floor |
+ * | backend role gate (before this predicate existed) | **credentialed callers refused** |
+ *
+ * An OpenAPI `security: []` says the endpoint imposes no security requirement. A client that sends a
+ * bearer token to such an endpoint is conformant, and refusing it contradicts the published
+ * contract. And independently of any document: **authenticating must never take access away.**
+ *
+ * ## What it does NOT relax
+ *
+ * Only the ROLE question. Tenancy, parent-scope and FK-path gates run unchanged, and the
+ * repository's contextual filter still confines every row the caller then reaches. A public
+ * declaration says "no role is required to ask"; it never says "no scope confines the answer".
+ *
+ * ## Why `APP_ANONYMOUS` is deliberately NOT here
+ *
+ * {@link OPEN_REQUIRED_ROLES} — the DISPLAY-side set — holds both sentinels, because that gate only
+ * decides whether to render a button and is documented to fail OPEN on uncertainty. This predicate
+ * is an ADMISSION rule, and the two sentinels are not interchangeable for admission:
+ * `APP_ANONYMOUS` is a role an anonymous session genuinely HOLDS (the execution-context creator
+ * grants it), so an anonymous caller already satisfies the ordinary gate and needs no carve-out —
+ * whereas nobody is ever granted `APP_PUBLIC`. Widening admission to `APP_ANONYMOUS` would therefore
+ * change who reaches anonymous-scoped operations without fixing anything, which is the wrong trade
+ * for a gate. Keep the two questions separate.
+ *
+ * @param requiredRoles - an operation's declared `roles` (OR semantics)
+ * @returns `true` when the declaration admits every caller, role-wise
+ */
+export function requiredRolesDeclarePublicAccess(requiredRoles) {
+    return Array.isArray(requiredRoles) && requiredRoles.includes(CORE_APP_ROLES.APP_PUBLIC);
+}
 /**
  * Required-role sentinels that impose NO positive role requirement — an operation
  * gated on public / anonymous access must never be hidden from a viewer. Treated
  * as always-satisfied.
+ *
+ * DISPLAY-side and deliberately WIDER than {@link requiredRolesDeclarePublicAccess}; see that
+ * predicate's JSDoc for why the admission rule must not adopt `APP_ANONYMOUS`.
  */
 const OPEN_REQUIRED_ROLES = new Set([
     CORE_APP_ROLES.APP_PUBLIC,

package/dist/esm/security/authorizations/roles.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.shared.utils.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAA2B,MAAM,wBAAwB,CAAC;AACjG,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,WAA+B;IACnF,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAuB,OAAO,CAAC;IAC1C,OAAO,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAS;IAC/D,cAAc,CAAC,UAAU;IACzB,cAAc,CAAC,aAAa;CAC7B,CAAC,CAAC;AAgBH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAA2C;IACvF,MAAM,EACJ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,cAAc,GAAG,8BAA8B,EAC/C,cAAc,GAAG,0BAA0B,GAC5C,GAAG,MAAM,CAAC;IAEX,6CAA6C;IAC7C,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,2DAA2D;IAC3D,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3E,gEAAgE;IAChE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,uBAAuB,GAAG,KAAK,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,uBAAuB,GAAG,IAAI,CAAC;QAC3D,KAAK,MAAM,SAAS,IAAI,SAAS;YAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,uBAAuB,GAAG,IAAI,CAAC;QAC3D,KAAK,MAAM,SAAS,IAAI,SAAS;YAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IAED,yCAAyC;IACzC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,4EAA4E;IAC5E,gFAAgF;IAChF,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,mBAAmB,GAAqC;IAC5D,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC9B,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;IACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC9B,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACpC,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC9C,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE,CAAC;IAC7C,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,CAAC;CAC1C,CAAC;AAEF,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,iBAAqC,8BAA8B,EACnE,iBAAqC,0BAA0B;IAE/D,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC;IAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,GAAG,eAAe,GAAG,KAAK,CAAC;AACxC,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA8B,EAC9B,cAAmC,EACnC,cAAmC;IAEnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAsB,EACtB,cAAmC,EACnC,cAAmC;IAEnC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO;QACP,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC;KACxE,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC","sourcesContent":["/**\n * Role-resolution utilities — pure, shared between backend authorization and\n * frontend display gating.\n *\n * The framework authorizes operations against a role **hierarchy**: a user\n * holding a high role (e.g. `ORG_OWNER`) implicitly satisfies every role it\n * inherits from (`ORG_OWNER → ORG_ADMIN → ORG_MANAGER → ORG_MEMBER → ORG_GUEST`).\n * `AuthorizationsBackendService` enforces this on every request; these helpers\n * expose the SAME hierarchy walk so the frontend can decide which operation\n * actions to even surface — without duplicating (and drifting from) the\n * algorithm.\n *\n * **Why this exists on the frontend.** The resource registry the browser holds\n * carries every operation a resource declares, each with its `roles` requirement,\n * but the frontend historically never consulted `operation.roles` when building\n * the action bar — so admin-only / super-admin-only actions rendered for every\n * viewer and only 403'd on click. The backend stays the security authority; this\n * gate is a display optimisation that hides buttons the user provably cannot use.\n *\n * @see roles.shared.defaults.ts — the default app/org role configurations\n * @see roles.shared.schemas.ts — `Roles`, `RolesConfiguration`, `RoleDefinition`\n * @see AuthorizationsBackendService.getRoleHierarchy / validateOperationRoles —\n *   the backend twin this mirrors. If the hierarchy walk changes there, change it\n *   here too (the role *configuration* is already shared via the constants below,\n *   so only the algorithm can drift).\n */\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES, type RolesConfiguration } from './roles.shared.schemas';\nimport {\n  DEFAULT_APP_ROLE_CONFIGURATION,\n  DEFAULT_ORGANIZATION_ROLES,\n} from './roles.shared.defaults';\n\n/**\n * Walk a role's inheritance chain within a single role configuration, returning\n * the role itself plus every role it (transitively) inherits from, nearest-first.\n *\n * Mirrors `AuthorizationsBackendService.getRoleHierarchy`: starts at `roleKey`\n * and follows `inheritFrom` until a role is absent from the config. A role that\n * is **not present** in `rolesConfig` yields an EMPTY chain (it contributes\n * nothing), exactly like the backend — callers that must not over-restrict on\n * unknown (app-custom) roles handle that case explicitly (see\n * {@link userRolesSatisfyRequiredRoles}).\n *\n * @param roleKey - the assigned role to expand\n * @param rolesConfig - the role configuration owning the hierarchy (app or org)\n * @returns the role + its inherited ancestors, nearest-first; empty if unknown\n */\nexport function computeRoleHierarchy(roleKey: string, rolesConfig: RolesConfiguration): string[] {\n  const hierarchy: string[] = [];\n  let current: string | undefined = roleKey;\n  while (current && rolesConfig[current]) {\n    hierarchy.push(current);\n    current = rolesConfig[current].inheritFrom;\n  }\n  return hierarchy;\n}\n\n/**\n * Required-role sentinels that impose NO positive role requirement — an operation\n * gated on public / anonymous access must never be hidden from a viewer. Treated\n * as always-satisfied.\n */\nconst OPEN_REQUIRED_ROLES: ReadonlySet<string> = new Set<string>([\n  CORE_APP_ROLES.APP_PUBLIC,\n  CORE_APP_ROLES.APP_ANONYMOUS,\n]);\n\n/** Parameters for {@link userRolesSatisfyRequiredRoles}. */\nexport interface UserRolesSatisfyRequiredRolesParams {\n  /** The operation's required roles (OR semantics). Empty/undefined ⇒ unrestricted. */\n  requiredRoles: readonly string[] | undefined;\n  /** The user's APPLICATION-scope roles (e.g. `permissions.appLevel`). */\n  userAppRoles: readonly string[];\n  /** The user's ORGANIZATIONS-scope roles for the CURRENT org (e.g. `permissions.organizations[orgId]`). */\n  userOrgRoles: readonly string[];\n  /** App role configuration (defaults to {@link DEFAULT_APP_ROLE_CONFIGURATION}). */\n  appRolesConfig?: RolesConfiguration;\n  /** Org role configuration (defaults to {@link DEFAULT_ORGANIZATION_ROLES}). */\n  orgRolesConfig?: RolesConfiguration;\n}\n\n/**\n * Decide whether a user's effective roles satisfy an operation's required roles,\n * honouring the role hierarchy — the shared answer to \"can this user perform this\n * operation, role-wise?\".\n *\n * This is the SAME OR-with-hierarchy decision the backend enforces\n * (`validateOperationRoles`): the user passes if ANY required role lies in the\n * inheritance closure of ANY role they hold (app roles expanded against the app\n * config, org roles against the org config).\n *\n * **Conservative on the frontend / display side.** It gates which action buttons\n * are even shown; the backend remains the security authority. It therefore FAILS\n * OPEN on uncertainty so it can never hide a button the user is actually allowed\n * to use:\n *   - no/empty `requiredRoles` ⇒ `true` (unrestricted operation).\n *   - a required role that is a public/anonymous sentinel ⇒ `true`.\n *   - if the user holds a role UNKNOWN to the supplied config (an app-custom role\n *     whose inheritance the default config cannot resolve) and the known-role\n *     expansion did not already satisfy the requirement ⇒ `true` (do not hide —\n *     the custom role might inherit a required role). For core-role-only users\n *     (the common case, and the whole settings hub) the decision is exact.\n *\n * @returns `true` if the operation should be considered role-permitted (shown).\n */\nexport function userRolesSatisfyRequiredRoles(params: UserRolesSatisfyRequiredRolesParams): boolean {\n  const {\n    requiredRoles,\n    userAppRoles,\n    userOrgRoles,\n    appRolesConfig = DEFAULT_APP_ROLE_CONFIGURATION,\n    orgRolesConfig = DEFAULT_ORGANIZATION_ROLES,\n  } = params;\n\n  // Unrestricted operation — always permitted.\n  if (!requiredRoles || requiredRoles.length === 0) return true;\n\n  // A public/anonymous gate imposes no positive requirement.\n  if (requiredRoles.some(role => OPEN_REQUIRED_ROLES.has(role))) return true;\n\n  // Expand the user's roles through their respective hierarchies.\n  const satisfiedRoles = new Set<string>();\n  let hasUnresolvableUserRole = false;\n\n  for (const role of userAppRoles) {\n    const hierarchy = computeRoleHierarchy(role, appRolesConfig);\n    if (hierarchy.length === 0) hasUnresolvableUserRole = true;\n    for (const inherited of hierarchy) satisfiedRoles.add(inherited);\n  }\n  for (const role of userOrgRoles) {\n    const hierarchy = computeRoleHierarchy(role, orgRolesConfig);\n    if (hierarchy.length === 0) hasUnresolvableUserRole = true;\n    for (const inherited of hierarchy) satisfiedRoles.add(inherited);\n  }\n\n  // Direct OR-with-hierarchy satisfaction.\n  if (requiredRoles.some(role => satisfiedRoles.has(role))) return true;\n\n  // Fail open if the user holds a role the supplied config can't expand — its\n  // (unknown) inheritance might cover a required role. Never hide on uncertainty.\n  return hasUnresolvableUserRole;\n}\n\n// ════════════════════════════════════════════════════════════════════════════\n// Variant selection by rights (\"show only the highest-right-level variant\")\n// ════════════════════════════════════════════════════════════════════════════\n\n/**\n * Privilege **tier** of a core role — the product ordering between role families.\n * A variant gated on a higher-tier role represents a \"higher right level\".\n *\n *   3 — platform/app admin (`APP_ADMIN_*`)\n *   2 — organisation roles (`ORG_*`)\n *   1 — authenticated user (`APP_USER`)\n *   0 — public / anonymous\n *\n * This is the one **cross-scope** decision the ranking needs: app-admin outranks\n * org, which outranks the plain authenticated user. Within a tier, the role\n * hierarchy depth breaks ties (a deeper role inherits more, so it is higher).\n */\nconst ROLE_PRIVILEGE_TIER: Readonly<Record<string, number>> = {\n  [CORE_APP_ROLES.APP_PUBLIC]: 0,\n  [CORE_APP_ROLES.APP_ANONYMOUS]: 0,\n  [CORE_APP_ROLES.APP_USER]: 1,\n  [CORE_ORG_ROLES.ORG_GUEST]: 2,\n  [CORE_ORG_ROLES.ORG_MEMBER]: 2,\n  [CORE_ORG_ROLES.ORG_MANAGER]: 2,\n  [CORE_ORG_ROLES.ORG_ADMIN]: 2,\n  [CORE_ORG_ROLES.ORG_OWNER]: 2,\n  [CORE_APP_ROLES.APP_ADMIN_VIEWER]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN]: 3,\n};\n\n/** Tier used for a role unknown to the default config (an app-custom role). */\nconst UNKNOWN_ROLE_TIER = 2;\nconst TIER_MULTIPLIER = 100;\n\n/**\n * Numeric privilege rank of a single role: `tier * 100 + hierarchyDepth`.\n *\n * Higher = more privileged. Derived from {@link ROLE_PRIVILEGE_TIER} (cross-tier\n * ordering) plus the role's hierarchy depth within its config (intra-tier\n * ordering), so e.g. `ORG_OWNER` (205) > `ORG_MEMBER` (202), and\n * `APP_ADMIN_SUPER_ADMIN` (304) outranks every `ORG_*`. Unknown custom roles fall\n * back to the org tier with depth 1 — exact for core-role apps (the common case),\n * conservative otherwise.\n *\n * Public / anonymous gates impose no positive requirement, so they rank `0` — the\n * floor, equal to a truly unrestricted variant (see {@link computeVariantRightsRank}).\n *\n * NOTE: the intra-tier tiebreak uses hierarchy DEPTH, which is a faithful proxy\n * for privilege only when inheritance is (near-)linear, as it is in the default\n * configs. A branching custom `RolesConfiguration` could give a shallow-but-powerful\n * role a lower depth than a deep-but-weak one and mis-order them; thread an explicit\n * rank (or extend this) if such a config is introduced.\n */\nexport function computeRolePrivilegeRank(\n  role: string,\n  appRolesConfig: RolesConfiguration = DEFAULT_APP_ROLE_CONFIGURATION,\n  orgRolesConfig: RolesConfiguration = DEFAULT_ORGANIZATION_ROLES,\n): number {\n  if (OPEN_REQUIRED_ROLES.has(role)) return 0;\n  const tier = ROLE_PRIVILEGE_TIER[role] ?? UNKNOWN_ROLE_TIER;\n  const config = appRolesConfig[role] ? appRolesConfig : orgRolesConfig[role] ? orgRolesConfig : undefined;\n  const depth = config ? computeRoleHierarchy(role, config).length : 1;\n  return tier * TIER_MULTIPLIER + depth;\n}\n\n/** Minimal shape this module needs from an operation variant to rank it by rights. */\nexport interface RightsRankableVariant {\n  /** The roles that may perform this variant (OR semantics). Empty/undefined = unrestricted. */\n  roles?: readonly string[];\n}\n\n/**\n * The rights rank a variant represents = the privilege of its most-privileged\n * required role. An unrestricted variant (no `roles`) ranks `0` — the lowest gate.\n */\nexport function computeVariantRightsRank(\n  variant: RightsRankableVariant,\n  appRolesConfig?: RolesConfiguration,\n  orgRolesConfig?: RolesConfiguration,\n): number {\n  const roles = variant.roles ?? [];\n  if (roles.length === 0) return 0;\n  return Math.max(...roles.map(role => computeRolePrivilegeRank(role, appRolesConfig, orgRolesConfig)));\n}\n\n/**\n * Collapse a set of operation variants to **only the highest-right-level ones**.\n *\n * The framework principle: variants of an operation exist to give different\n * behaviour according to rights, so a surface should show only the variant with\n * the highest right level the user qualifies for — not the lower-rights ones too.\n * (A super-admin who is also an org member otherwise sees both the member READ and\n * the super-admin READ; this keeps only the super-admin one.)\n *\n * **Precondition:** pass variants the user already QUALIFIES for (i.e. post\n * role-gating via {@link userRolesSatisfyRequiredRoles}). This selector then keeps\n * the subset with the maximum {@link computeVariantRightsRank}. Variants that\n * **tie** at the top rank (equal rights — e.g. context/variantKey variants that\n * are not a rights distinction) are all returned, so the caller's existing\n * default/sub-group logic still handles non-rights multiplicity unchanged.\n *\n * Used globally wherever variants surface as user actions; composite / execution\n * views deliberately bypass this (they may show all variants, for now) by not\n * routing through the collapsing path.\n */\nexport function selectHighestRightsVariants<T extends RightsRankableVariant>(\n  variants: readonly T[],\n  appRolesConfig?: RolesConfiguration,\n  orgRolesConfig?: RolesConfiguration,\n): T[] {\n  if (variants.length <= 1) return [...variants];\n  const ranked = variants.map(variant => ({\n    variant,\n    rank: computeVariantRightsRank(variant, appRolesConfig, orgRolesConfig),\n  }));\n  const maxRank = Math.max(...ranked.map(entry => entry.rank));\n  return ranked.filter(entry => entry.rank === maxRank).map(entry => entry.variant);\n}\n"]}
+{"version":3,"file":"roles.shared.utils.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAA2B,MAAM,wBAAwB,CAAC;AACjG,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,WAA+B;IACnF,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAuB,OAAO,CAAC;IAC1C,OAAO,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,UAAU,gCAAgC,CAAC,aAA4C;IAC3F,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAS;IAC/D,cAAc,CAAC,UAAU;IACzB,cAAc,CAAC,aAAa;CAC7B,CAAC,CAAC;AAgBH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAA2C;IACvF,MAAM,EACJ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,cAAc,GAAG,8BAA8B,EAC/C,cAAc,GAAG,0BAA0B,GAC5C,GAAG,MAAM,CAAC;IAEX,6CAA6C;IAC7C,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,2DAA2D;IAC3D,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3E,gEAAgE;IAChE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,uBAAuB,GAAG,KAAK,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,uBAAuB,GAAG,IAAI,CAAC;QAC3D,KAAK,MAAM,SAAS,IAAI,SAAS;YAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,uBAAuB,GAAG,IAAI,CAAC;QAC3D,KAAK,MAAM,SAAS,IAAI,SAAS;YAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IAED,yCAAyC;IACzC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,4EAA4E;IAC5E,gFAAgF;IAChF,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,mBAAmB,GAAqC;IAC5D,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC9B,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;IACjC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC9B,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7B,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACpC,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC9C,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE,CAAC;IAC7C,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,CAAC;CAC1C,CAAC;AAEF,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,iBAAqC,8BAA8B,EACnE,iBAAqC,0BAA0B;IAE/D,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC;IAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,GAAG,eAAe,GAAG,KAAK,CAAC;AACxC,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA8B,EAC9B,cAAmC,EACnC,cAAmC;IAEnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAsB,EACtB,cAAmC,EACnC,cAAmC;IAEnC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO;QACP,IAAI,EAAE,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC;KACxE,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC","sourcesContent":["/**\n * Role-resolution utilities — pure, shared between backend authorization and\n * frontend display gating.\n *\n * The framework authorizes operations against a role **hierarchy**: a user\n * holding a high role (e.g. `ORG_OWNER`) implicitly satisfies every role it\n * inherits from (`ORG_OWNER → ORG_ADMIN → ORG_MANAGER → ORG_MEMBER → ORG_GUEST`).\n * `AuthorizationsBackendService` enforces this on every request; these helpers\n * expose the SAME hierarchy walk so the frontend can decide which operation\n * actions to even surface — without duplicating (and drifting from) the\n * algorithm.\n *\n * **Why this exists on the frontend.** The resource registry the browser holds\n * carries every operation a resource declares, each with its `roles` requirement,\n * but the frontend historically never consulted `operation.roles` when building\n * the action bar — so admin-only / super-admin-only actions rendered for every\n * viewer and only 403'd on click. The backend stays the security authority; this\n * gate is a display optimisation that hides buttons the user provably cannot use.\n *\n * @see roles.shared.defaults.ts — the default app/org role configurations\n * @see roles.shared.schemas.ts — `Roles`, `RolesConfiguration`, `RoleDefinition`\n * @see AuthorizationsBackendService.getRoleHierarchy / validateOperationRoles —\n *   the backend twin this mirrors. If the hierarchy walk changes there, change it\n *   here too (the role *configuration* is already shared via the constants below,\n *   so only the algorithm can drift).\n */\n\nimport { CORE_APP_ROLES, CORE_ORG_ROLES, type RolesConfiguration } from './roles.shared.schemas';\nimport {\n  DEFAULT_APP_ROLE_CONFIGURATION,\n  DEFAULT_ORGANIZATION_ROLES,\n} from './roles.shared.defaults';\n\n/**\n * Walk a role's inheritance chain within a single role configuration, returning\n * the role itself plus every role it (transitively) inherits from, nearest-first.\n *\n * Mirrors `AuthorizationsBackendService.getRoleHierarchy`: starts at `roleKey`\n * and follows `inheritFrom` until a role is absent from the config. A role that\n * is **not present** in `rolesConfig` yields an EMPTY chain (it contributes\n * nothing), exactly like the backend — callers that must not over-restrict on\n * unknown (app-custom) roles handle that case explicitly (see\n * {@link userRolesSatisfyRequiredRoles}).\n *\n * @param roleKey - the assigned role to expand\n * @param rolesConfig - the role configuration owning the hierarchy (app or org)\n * @returns the role + its inherited ancestors, nearest-first; empty if unknown\n */\nexport function computeRoleHierarchy(roleKey: string, rolesConfig: RolesConfiguration): string[] {\n  const hierarchy: string[] = [];\n  let current: string | undefined = roleKey;\n  while (current && rolesConfig[current]) {\n    hierarchy.push(current);\n    current = rolesConfig[current].inheritFrom;\n  }\n  return hierarchy;\n}\n\n/**\n * Does this required-role set declare PUBLIC access — imposing no positive role requirement on ANY\n * caller, credentialed or not?\n *\n * ## The semantic this settles, and why the alternative reading was wrong\n *\n * `APP_PUBLIC` can be read two ways, and for a long time different layers of the framework read it\n * differently:\n *\n *  - *no credential REQUIRED* — reachable when nobody authenticated, and gated on roles otherwise;\n *  - *no credential EXAMINED* — reachable by everyone, whether or not they authenticated.\n *\n * The second is the contract, and the first was a defect. Under the first reading, an operation\n * declaring `APP_PUBLIC` answered 200 to an anonymous probe and **403 to the same request carrying a\n * valid token**, because `APP_PUBLIC` is not a role anybody is GRANTED — so a credentialed caller\n * fell past the public carve-out to an ordinary role gate that nothing in their grant set could\n * satisfy. Authenticating REDUCED access below what anonymity gave, on every public surface an\n * application can build: a price list, a public catalogue, an i18n bundle served as a resource.\n *\n * Three of the four surfaces that consume `roles` already implemented the second reading, which is\n * what makes this the framework's settled contract rather than a preference:\n *\n * | surface | reading |\n * |---|---|\n * | frontend action visibility ({@link userRolesSatisfyRequiredRoles}) | no positive requirement |\n * | OpenAPI generation — `APP_PUBLIC` emits `security: []` | no authentication required |\n * | variant rights ranking ({@link computeRolePrivilegeRank}) | ranks `0`, the floor |\n * | backend role gate (before this predicate existed) | **credentialed callers refused** |\n *\n * An OpenAPI `security: []` says the endpoint imposes no security requirement. A client that sends a\n * bearer token to such an endpoint is conformant, and refusing it contradicts the published\n * contract. And independently of any document: **authenticating must never take access away.**\n *\n * ## What it does NOT relax\n *\n * Only the ROLE question. Tenancy, parent-scope and FK-path gates run unchanged, and the\n * repository's contextual filter still confines every row the caller then reaches. A public\n * declaration says \"no role is required to ask\"; it never says \"no scope confines the answer\".\n *\n * ## Why `APP_ANONYMOUS` is deliberately NOT here\n *\n * {@link OPEN_REQUIRED_ROLES} — the DISPLAY-side set — holds both sentinels, because that gate only\n * decides whether to render a button and is documented to fail OPEN on uncertainty. This predicate\n * is an ADMISSION rule, and the two sentinels are not interchangeable for admission:\n * `APP_ANONYMOUS` is a role an anonymous session genuinely HOLDS (the execution-context creator\n * grants it), so an anonymous caller already satisfies the ordinary gate and needs no carve-out —\n * whereas nobody is ever granted `APP_PUBLIC`. Widening admission to `APP_ANONYMOUS` would therefore\n * change who reaches anonymous-scoped operations without fixing anything, which is the wrong trade\n * for a gate. Keep the two questions separate.\n *\n * @param requiredRoles - an operation's declared `roles` (OR semantics)\n * @returns `true` when the declaration admits every caller, role-wise\n */\nexport function requiredRolesDeclarePublicAccess(requiredRoles: readonly string[] | undefined): boolean {\n  return Array.isArray(requiredRoles) && requiredRoles.includes(CORE_APP_ROLES.APP_PUBLIC);\n}\n\n/**\n * Required-role sentinels that impose NO positive role requirement — an operation\n * gated on public / anonymous access must never be hidden from a viewer. Treated\n * as always-satisfied.\n *\n * DISPLAY-side and deliberately WIDER than {@link requiredRolesDeclarePublicAccess}; see that\n * predicate's JSDoc for why the admission rule must not adopt `APP_ANONYMOUS`.\n */\nconst OPEN_REQUIRED_ROLES: ReadonlySet<string> = new Set<string>([\n  CORE_APP_ROLES.APP_PUBLIC,\n  CORE_APP_ROLES.APP_ANONYMOUS,\n]);\n\n/** Parameters for {@link userRolesSatisfyRequiredRoles}. */\nexport interface UserRolesSatisfyRequiredRolesParams {\n  /** The operation's required roles (OR semantics). Empty/undefined ⇒ unrestricted. */\n  requiredRoles: readonly string[] | undefined;\n  /** The user's APPLICATION-scope roles (e.g. `permissions.appLevel`). */\n  userAppRoles: readonly string[];\n  /** The user's ORGANIZATIONS-scope roles for the CURRENT org (e.g. `permissions.organizations[orgId]`). */\n  userOrgRoles: readonly string[];\n  /** App role configuration (defaults to {@link DEFAULT_APP_ROLE_CONFIGURATION}). */\n  appRolesConfig?: RolesConfiguration;\n  /** Org role configuration (defaults to {@link DEFAULT_ORGANIZATION_ROLES}). */\n  orgRolesConfig?: RolesConfiguration;\n}\n\n/**\n * Decide whether a user's effective roles satisfy an operation's required roles,\n * honouring the role hierarchy — the shared answer to \"can this user perform this\n * operation, role-wise?\".\n *\n * This is the SAME OR-with-hierarchy decision the backend enforces\n * (`validateOperationRoles`): the user passes if ANY required role lies in the\n * inheritance closure of ANY role they hold (app roles expanded against the app\n * config, org roles against the org config).\n *\n * **Conservative on the frontend / display side.** It gates which action buttons\n * are even shown; the backend remains the security authority. It therefore FAILS\n * OPEN on uncertainty so it can never hide a button the user is actually allowed\n * to use:\n *   - no/empty `requiredRoles` ⇒ `true` (unrestricted operation).\n *   - a required role that is a public/anonymous sentinel ⇒ `true`.\n *   - if the user holds a role UNKNOWN to the supplied config (an app-custom role\n *     whose inheritance the default config cannot resolve) and the known-role\n *     expansion did not already satisfy the requirement ⇒ `true` (do not hide —\n *     the custom role might inherit a required role). For core-role-only users\n *     (the common case, and the whole settings hub) the decision is exact.\n *\n * @returns `true` if the operation should be considered role-permitted (shown).\n */\nexport function userRolesSatisfyRequiredRoles(params: UserRolesSatisfyRequiredRolesParams): boolean {\n  const {\n    requiredRoles,\n    userAppRoles,\n    userOrgRoles,\n    appRolesConfig = DEFAULT_APP_ROLE_CONFIGURATION,\n    orgRolesConfig = DEFAULT_ORGANIZATION_ROLES,\n  } = params;\n\n  // Unrestricted operation — always permitted.\n  if (!requiredRoles || requiredRoles.length === 0) return true;\n\n  // A public/anonymous gate imposes no positive requirement.\n  if (requiredRoles.some(role => OPEN_REQUIRED_ROLES.has(role))) return true;\n\n  // Expand the user's roles through their respective hierarchies.\n  const satisfiedRoles = new Set<string>();\n  let hasUnresolvableUserRole = false;\n\n  for (const role of userAppRoles) {\n    const hierarchy = computeRoleHierarchy(role, appRolesConfig);\n    if (hierarchy.length === 0) hasUnresolvableUserRole = true;\n    for (const inherited of hierarchy) satisfiedRoles.add(inherited);\n  }\n  for (const role of userOrgRoles) {\n    const hierarchy = computeRoleHierarchy(role, orgRolesConfig);\n    if (hierarchy.length === 0) hasUnresolvableUserRole = true;\n    for (const inherited of hierarchy) satisfiedRoles.add(inherited);\n  }\n\n  // Direct OR-with-hierarchy satisfaction.\n  if (requiredRoles.some(role => satisfiedRoles.has(role))) return true;\n\n  // Fail open if the user holds a role the supplied config can't expand — its\n  // (unknown) inheritance might cover a required role. Never hide on uncertainty.\n  return hasUnresolvableUserRole;\n}\n\n// ════════════════════════════════════════════════════════════════════════════\n// Variant selection by rights (\"show only the highest-right-level variant\")\n// ════════════════════════════════════════════════════════════════════════════\n\n/**\n * Privilege **tier** of a core role — the product ordering between role families.\n * A variant gated on a higher-tier role represents a \"higher right level\".\n *\n *   3 — platform/app admin (`APP_ADMIN_*`)\n *   2 — organisation roles (`ORG_*`)\n *   1 — authenticated user (`APP_USER`)\n *   0 — public / anonymous\n *\n * This is the one **cross-scope** decision the ranking needs: app-admin outranks\n * org, which outranks the plain authenticated user. Within a tier, the role\n * hierarchy depth breaks ties (a deeper role inherits more, so it is higher).\n */\nconst ROLE_PRIVILEGE_TIER: Readonly<Record<string, number>> = {\n  [CORE_APP_ROLES.APP_PUBLIC]: 0,\n  [CORE_APP_ROLES.APP_ANONYMOUS]: 0,\n  [CORE_APP_ROLES.APP_USER]: 1,\n  [CORE_ORG_ROLES.ORG_GUEST]: 2,\n  [CORE_ORG_ROLES.ORG_MEMBER]: 2,\n  [CORE_ORG_ROLES.ORG_MANAGER]: 2,\n  [CORE_ORG_ROLES.ORG_ADMIN]: 2,\n  [CORE_ORG_ROLES.ORG_OWNER]: 2,\n  [CORE_APP_ROLES.APP_ADMIN_VIEWER]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER]: 3,\n  [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN]: 3,\n};\n\n/** Tier used for a role unknown to the default config (an app-custom role). */\nconst UNKNOWN_ROLE_TIER = 2;\nconst TIER_MULTIPLIER = 100;\n\n/**\n * Numeric privilege rank of a single role: `tier * 100 + hierarchyDepth`.\n *\n * Higher = more privileged. Derived from {@link ROLE_PRIVILEGE_TIER} (cross-tier\n * ordering) plus the role's hierarchy depth within its config (intra-tier\n * ordering), so e.g. `ORG_OWNER` (205) > `ORG_MEMBER` (202), and\n * `APP_ADMIN_SUPER_ADMIN` (304) outranks every `ORG_*`. Unknown custom roles fall\n * back to the org tier with depth 1 — exact for core-role apps (the common case),\n * conservative otherwise.\n *\n * Public / anonymous gates impose no positive requirement, so they rank `0` — the\n * floor, equal to a truly unrestricted variant (see {@link computeVariantRightsRank}).\n *\n * NOTE: the intra-tier tiebreak uses hierarchy DEPTH, which is a faithful proxy\n * for privilege only when inheritance is (near-)linear, as it is in the default\n * configs. A branching custom `RolesConfiguration` could give a shallow-but-powerful\n * role a lower depth than a deep-but-weak one and mis-order them; thread an explicit\n * rank (or extend this) if such a config is introduced.\n */\nexport function computeRolePrivilegeRank(\n  role: string,\n  appRolesConfig: RolesConfiguration = DEFAULT_APP_ROLE_CONFIGURATION,\n  orgRolesConfig: RolesConfiguration = DEFAULT_ORGANIZATION_ROLES,\n): number {\n  if (OPEN_REQUIRED_ROLES.has(role)) return 0;\n  const tier = ROLE_PRIVILEGE_TIER[role] ?? UNKNOWN_ROLE_TIER;\n  const config = appRolesConfig[role] ? appRolesConfig : orgRolesConfig[role] ? orgRolesConfig : undefined;\n  const depth = config ? computeRoleHierarchy(role, config).length : 1;\n  return tier * TIER_MULTIPLIER + depth;\n}\n\n/** Minimal shape this module needs from an operation variant to rank it by rights. */\nexport interface RightsRankableVariant {\n  /** The roles that may perform this variant (OR semantics). Empty/undefined = unrestricted. */\n  roles?: readonly string[];\n}\n\n/**\n * The rights rank a variant represents = the privilege of its most-privileged\n * required role. An unrestricted variant (no `roles`) ranks `0` — the lowest gate.\n */\nexport function computeVariantRightsRank(\n  variant: RightsRankableVariant,\n  appRolesConfig?: RolesConfiguration,\n  orgRolesConfig?: RolesConfiguration,\n): number {\n  const roles = variant.roles ?? [];\n  if (roles.length === 0) return 0;\n  return Math.max(...roles.map(role => computeRolePrivilegeRank(role, appRolesConfig, orgRolesConfig)));\n}\n\n/**\n * Collapse a set of operation variants to **only the highest-right-level ones**.\n *\n * The framework principle: variants of an operation exist to give different\n * behaviour according to rights, so a surface should show only the variant with\n * the highest right level the user qualifies for — not the lower-rights ones too.\n * (A super-admin who is also an org member otherwise sees both the member READ and\n * the super-admin READ; this keeps only the super-admin one.)\n *\n * **Precondition:** pass variants the user already QUALIFIES for (i.e. post\n * role-gating via {@link userRolesSatisfyRequiredRoles}). This selector then keeps\n * the subset with the maximum {@link computeVariantRightsRank}. Variants that\n * **tie** at the top rank (equal rights — e.g. context/variantKey variants that\n * are not a rights distinction) are all returned, so the caller's existing\n * default/sub-group logic still handles non-rights multiplicity unchanged.\n *\n * Used globally wherever variants surface as user actions; composite / execution\n * views deliberately bypass this (they may show all variants, for now) by not\n * routing through the collapsing path.\n */\nexport function selectHighestRightsVariants<T extends RightsRankableVariant>(\n  variants: readonly T[],\n  appRolesConfig?: RolesConfiguration,\n  orgRolesConfig?: RolesConfiguration,\n): T[] {\n  if (variants.length <= 1) return [...variants];\n  const ranked = variants.map(variant => ({\n    variant,\n    rank: computeVariantRightsRank(variant, appRolesConfig, orgRolesConfig),\n  }));\n  const maxRank = Math.max(...ranked.map(entry => entry.rank));\n  return ranked.filter(entry => entry.rank === maxRank).map(entry => entry.variant);\n}\n"]}

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Organization Provider Credentials — resource configuration.
+ *
+ * The tenant-owned service credential toward a third-party provider. See
+ * `provider-credentials.shared.schemas.ts` for what the resource is and what it deliberately is not.
+ */
+import { z } from 'zod';
+import { ProviderCredentialValidationState } from './provider-credentials.shared.schemas';
+import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
+import { ResourceRelationship } from '../../resources/resources.shared.schemas';
+type OrgProviderCredentialsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY;
+export declare const orgProviderCredentialsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<undefined, OrgProviderCredentialsCoreOperations, import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
+    setByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    secretSetAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    connectionParameters: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    description: z.ZodOptional<z.ZodString>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
+}, z.core.$strip>>>;
+export {};
+//# sourceMappingURL=provider-credentials-organization.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,iCAAiC,EAClC,MAAM,uCAAuC,CAAC;AAK/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAY1I,KAAK,oCAAoC,GACrC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,iEAAiE,GAC5E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;mBA8L9C,CAAC"}

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js

@@ -0,0 +1,198 @@
+/**
+ * Organization Provider Credentials — resource configuration.
+ *
+ * The tenant-owned service credential toward a third-party provider. See
+ * `provider-credentials.shared.schemas.ts` for what the resource is and what it deliberately is not.
+ */
+import { z } from 'zod';
+import { OrganizationProviderCredentialSchema, ProviderCredentialValidationState, } from './provider-credentials.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas.js';
+const ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'];
+const ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {
+    providerRef: z.string(),
+    secretSlug: z.string(),
+    enabled: z.boolean(),
+    validationState: z.enum(ProviderCredentialValidationState),
+};
+export const orgProviderCredentialsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: OrganizationProviderCredentialSchema,
+    resourceIdentifier: CoreResourceType.ORG_PROVIDER_CREDENTIALS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_PROVIDER_CREDENTIALS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /**
+     * ## `read` / `list` — the RESOLVER's door
+     *
+     * A provider call happens on whatever execution context the caller holds: a batch, a queue
+     * consumer, an anonymous webhook return leg. None of those carry an ORG_ADMIN role, and the
+     * resolution must still work — so the resolver reads through `readAsSystem`, which is fail-closed
+     * on this opt-in. The scope is supplied as the organization FK in the system context map, so the
+     * bypass is of the ROLE check only, never of the tenant boundary.
+     *
+     * ## `update` — the resolver's WRITE-BACK door
+     *
+     * `lastUsedAt`, `validationState`, `validationError` and `lastValidatedAt` are all
+     * `.excludeFromUpdate()`, so the strict re-parse on the ordinary update path strips them. The
+     * trusted `updateAsSystem` path is the only one that re-attaches them, which is why it is opted
+     * into here and why those fields are not client-writable: a tenant administrator must not be able
+     * to declare their own credential `VALID`.
+     *
+     * ## `create` — deliberately NOT opted in
+     *
+     * A credential comes into existence only when a human supplies one. There is no seed, no
+     * provisioning step and no import that should mint one on a tenant's behalf, so the system create
+     * door stays shut.
+     *
+     * ## `exportSubject: FORBIDDEN`
+     *
+     * The reserved class. This row is a live credential toward a third party; a subject export that
+     * carried one would hand a working secret to whoever requested the export.
+     */
+    /**
+     * `create` is open for the reason its user-owned sibling documents at length: a credential a
+     * vendor MINTS has no HTTP write that could carry it. An OAuth2 grant arrives through a redirect
+     * after a tenant administrator authorized it on the vendor's consent screen, so the exchange —
+     * engine code, never a request payload — is the only thing that can store it.
+     */
+    systemAccessPolicy: {
+        exportSubject: ResourceSystemAccessMode.FORBIDDEN,
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+    },
+    /**
+     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here that belongs
+     * to a person.
+     *
+     * The row is a TENANT's credential. `setByUserId` names an ACTOR — the administrator who typed it
+     * — which is the first population `NO_PRINCIPAL` describes, and it is exactly the field an
+     * erasure must not use as a reason to destroy the row: a tenant losing its Slack integration
+     * because the admin who configured it left the company is a bug, not a privacy guarantee.
+     *
+     * The erasure walk cannot reach this resource in any case, because no `USERS` relationship is
+     * registered for `setByUserId` — withheld deliberately, since that edge would also put a
+     * credential on the Art. 15 export graph. `RETAIN_ONLY` is therefore a statement of what WOULD
+     * happen rather than a path that runs today, and it is worth declaring for that reason: the next
+     * author who registers a USERS edge inherits the correct answer instead of the default.
+     *
+     * The assertion is checked in both directions by the factory — `RETAIN_ONLY` is refused if any
+     * field carries an impersonalize treatment or declares a personal-data category.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_ONLY,
+    },
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.UPDATE,
+        // Required by the ORGANIZATIONS cascade: `onParentDelete` dispatches the child's DELETE, and a
+        // relationship declaring the cascade against a resource with no DELETE core operation throws at
+        // config build. It is also the tenant's own "remove this credential" door.
+        CoreResourceOperation.DELETE,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
+    ],
+    operationsConfiguration: {
+        /*
+         * ORG_ADMIN everywhere, and NO super-administrator variant anywhere — a deliberate refusal, not
+         * an omission.
+         *
+         * Every sibling security resource (org API keys, org OAuth clients) carries an `admin` variant
+         * so a platform operator can support a tenant. This one does not, because the thing being
+         * supported is a live credential toward a THIRD PARTY: an operator who can list, rotate or spend
+         * a tenant's Slack token can act as that tenant toward Slack, and no audit event afterwards
+         * makes that reversible. `administrative-continuity-floors.md` asks for the reversibility test
+         * before crossing a tenant boundary, and this verb fails it in both directions — reading is
+         * masked but LISTing reveals which vendors a tenant integrates with, and rotating locks the
+         * tenant out of its own integration.
+         *
+         * The cost is real and accepted: a tenant that loses every ORG_ADMIN cannot have its credentials
+         * repaired by support. That is what `organizationMembers.grantOwnership` exists for — restore an
+         * administrator to the tenant, and the tenant repairs its own credentials. The repair path runs
+         * through identity, where it is audited and reversible, rather than through the credential
+         * store, where it would not be.
+         */
+        [CoreResourceOperation.READ]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client
+                    // boundary, so a READ returns metadata and a placeholder.
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    filterFields: ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS,
+                    sortFields: ORG_PROVIDER_CREDENTIALS_SORT_FIELDS,
+                    maxPaginatedResultPerPageLimit: 100,
+                },
+            ],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    // CRITICAL: this is the act of granting the application authority to act as the tenant
+                    // toward a third party.
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+        /*
+         * Route-less retention plumbing. INTERNAL_CALL registers NO route, and must not be
+         * REPOSITORY_ONLY: that satisfies the factory's boot-time presence guard and then fails to
+         * resolve when an erasure actually runs, because the retention primitives resolve through
+         * `getServiceOperationPathDefault`, which excludes REPOSITORY_ONLY.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+    },
+});
+//# sourceMappingURL=provider-credentials-organization.shared.resources-config.schemas.js.map

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oCAAoC,EACpC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,MAAM,oCAAoC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9G,MAAM,sCAAsC,GAAG;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AAUF,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAC/E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH;;;;;OAKG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,+FAA+F;QAC/F,gGAAgG;QAChG,2EAA2E;QAC3E,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,sCAAsC;oBACpD,UAAU,EAAE,oCAAoC;oBAChD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,uFAAuF;oBACvF,wBAAwB;oBACxB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Provider Credentials — resource configuration.\n *\n * The tenant-owned service credential toward a third-party provider. See\n * `provider-credentials.shared.schemas.ts` for what the resource is and what it deliberately is not.\n */\n\nimport { z } from 'zod';\n\nimport {\n  OrganizationProviderCredentialSchema,\n  ProviderCredentialValidationState,\n} from './provider-credentials.shared.schemas';\n\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'] as const;\n\nconst ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n  providerRef: z.string(),\n  secretSlug: z.string(),\n  enabled: z.boolean(),\n  validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype OrgProviderCredentialsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const orgProviderCredentialsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  OrgProviderCredentialsCoreOperations,\n  typeof OrganizationProviderCredentialSchema\n>({\n  mainSchema: OrganizationProviderCredentialSchema,\n  resourceIdentifier: CoreResourceType.ORG_PROVIDER_CREDENTIALS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_PROVIDER_CREDENTIALS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /**\n   * ## `read` / `list` — the RESOLVER's door\n   *\n   * A provider call happens on whatever execution context the caller holds: a batch, a queue\n   * consumer, an anonymous webhook return leg. None of those carry an ORG_ADMIN role, and the\n   * resolution must still work — so the resolver reads through `readAsSystem`, which is fail-closed\n   * on this opt-in. The scope is supplied as the organization FK in the system context map, so the\n   * bypass is of the ROLE check only, never of the tenant boundary.\n   *\n   * ## `update` — the resolver's WRITE-BACK door\n   *\n   * `lastUsedAt`, `validationState`, `validationError` and `lastValidatedAt` are all\n   * `.excludeFromUpdate()`, so the strict re-parse on the ordinary update path strips them. The\n   * trusted `updateAsSystem` path is the only one that re-attaches them, which is why it is opted\n   * into here and why those fields are not client-writable: a tenant administrator must not be able\n   * to declare their own credential `VALID`.\n   *\n   * ## `create` — deliberately NOT opted in\n   *\n   * A credential comes into existence only when a human supplies one. There is no seed, no\n   * provisioning step and no import that should mint one on a tenant's behalf, so the system create\n   * door stays shut.\n   *\n   * ## `exportSubject: FORBIDDEN`\n   *\n   * The reserved class. This row is a live credential toward a third party; a subject export that\n   * carried one would hand a working secret to whoever requested the export.\n   */\n  /**\n   * `create` is open for the reason its user-owned sibling documents at length: a credential a\n   * vendor MINTS has no HTTP write that could carry it. An OAuth2 grant arrives through a redirect\n   * after a tenant administrator authorized it on the vendor's consent screen, so the exchange —\n   * engine code, never a request payload — is the only thing that can store it.\n   */\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n  },\n\n  /**\n   * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here that belongs\n   * to a person.\n   *\n   * The row is a TENANT's credential. `setByUserId` names an ACTOR — the administrator who typed it\n   * — which is the first population `NO_PRINCIPAL` describes, and it is exactly the field an\n   * erasure must not use as a reason to destroy the row: a tenant losing its Slack integration\n   * because the admin who configured it left the company is a bug, not a privacy guarantee.\n   *\n   * The erasure walk cannot reach this resource in any case, because no `USERS` relationship is\n   * registered for `setByUserId` — withheld deliberately, since that edge would also put a\n   * credential on the Art. 15 export graph. `RETAIN_ONLY` is therefore a statement of what WOULD\n   * happen rather than a path that runs today, and it is worth declaring for that reason: the next\n   * author who registers a USERS edge inherits the correct answer instead of the default.\n   *\n   * The assertion is checked in both directions by the factory — `RETAIN_ONLY` is refused if any\n   * field carries an impersonalize treatment or declares a personal-data category.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_ONLY,\n  },\n\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // Required by the ORGANIZATIONS cascade: `onParentDelete` dispatches the child's DELETE, and a\n    // relationship declaring the cascade against a resource with no DELETE core operation throws at\n    // config build. It is also the tenant's own \"remove this credential\" door.\n    CoreResourceOperation.DELETE,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  operationsConfiguration: {\n    /*\n     * ORG_ADMIN everywhere, and NO super-administrator variant anywhere — a deliberate refusal, not\n     * an omission.\n     *\n     * Every sibling security resource (org API keys, org OAuth clients) carries an `admin` variant\n     * so a platform operator can support a tenant. This one does not, because the thing being\n     * supported is a live credential toward a THIRD PARTY: an operator who can list, rotate or spend\n     * a tenant's Slack token can act as that tenant toward Slack, and no audit event afterwards\n     * makes that reversible. `administrative-continuity-floors.md` asks for the reversibility test\n     * before crossing a tenant boundary, and this verb fails it in both directions — reading is\n     * masked but LISTing reveals which vendors a tenant integrates with, and rotating locks the\n     * tenant out of its own integration.\n     *\n     * The cost is real and accepted: a tenant that loses every ORG_ADMIN cannot have its credentials\n     * repaired by support. That is what `organizationMembers.grantOwnership` exists for — restore an\n     * administrator to the tenant, and the tenant repairs its own credentials. The repair path runs\n     * through identity, where it is audited and reversible, rather than through the credential\n     * store, where it would not be.\n     */\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n          // boundary, so a READ returns metadata and a placeholder.\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n          sortFields: ORG_PROVIDER_CREDENTIALS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          // CRITICAL: this is the act of granting the application authority to act as the tenant\n          // toward a third party.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    /*\n     * Route-less retention plumbing. INTERNAL_CALL registers NO route, and must not be\n     * REPOSITORY_ONLY: that satisfies the factory's boot-time presence guard and then fails to\n     * resolve when an erasure actually runs, because the retention primitives resolve through\n     * `getServiceOperationPathDefault`, which excludes REPOSITORY_ONLY.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.d.ts

@@ -0,0 +1,31 @@
+/**
+ * User Provider Credentials — resource configuration.
+ *
+ * A PERSON's own credential toward a third party. See `provider-credentials.shared.schemas.ts` for
+ * what the resource is, why it is separate from the organization-owned sibling, and why it is not a
+ * delegated OAuth grant.
+ */
+import { z } from 'zod';
+import { ProviderCredentialValidationState } from './provider-credentials.shared.schemas';
+import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
+import { ResourceRelationship } from '../../resources/resources.shared.schemas';
+type UserProviderCredentialsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY;
+export declare const userProviderCredentialsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<undefined, UserProviderCredentialsCoreOperations, import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
+    secretSetAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    connectionParameters: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    description: z.ZodOptional<z.ZodString>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
+}, z.core.$strip>>>;
+export {};
+//# sourceMappingURL=provider-credentials-user.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EAElC,MAAM,uCAAuC,CAAC;AAK/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAY1I,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,kEAAkE,GAC7E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;mBAsL9C,CAAC"}