@wildo-ai/saas-models 1.1.2 → 1.1.3

package/dist/esm/security/authentications/registration.shared.dto.schemas.js

@@ -54,6 +54,17 @@ export const UserRegisterApiDtoSchema = z.object({
     password: z.string().min(1).optional(),
     /** W6.2: Org name when orgNameSource is 'ask'. */
     organizationName: z.string().min(1).max(200).optional(),
+    /**
+     * How the registrant will authenticate afterwards (#463). Absent ⇒ PASSWORD, so a client that
+     * predates password-less signup keeps working unchanged.
+     *
+     * Typed as the whole `AuthMethod` vocabulary rather than a narrowed subset, deliberately: the set
+     * a given application accepts is `registration.allowedMethods`, which is per user type and
+     * authored, and duplicating a narrower list here would be a second place for it to drift. A method
+     * this application does not allow is refused by the service with the allowed set in the message,
+     * which is a better answer than a schema rejection that cannot say what IS allowed.
+     */
+    method: z.enum(AuthMethod).optional(),
 });
 // ═══════════════════════════════════════════════════════════════
 // Invitation Acceptance DTOs

package/dist/esm/security/authentications/registration.shared.dto.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,8FAA8F;IAC9F,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACzC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACV,CAAC;AAWX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8EAA8E;IAC9E,gFAAgF;IAChF,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC","sourcesContent":["/**\n * User Registration — Shared DTO Schemas\n *\n * Single source of truth for user registration validation.\n * Used by both frontend (AutomatedForm component) and backend (req.body parsing).\n */\n\nimport { z } from 'zod';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\nimport { AuthMethod } from './authentication.shared.schemas';\n\n// ═══════════════════════════════════════════════════════════════\n// Registration Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/register — registration form fields.\n * Used as:\n * - Frontend: AutomatedForm schema (all 5 fields rendered)\n * - Backend: req.body parsing (minus confirmPassword)\n *\n * confirmPassword is a frontend-only field for client-side match validation.\n * The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n.\n * The .isPassword() decorator tells FormField to render password inputs.\n */\nexport const UserRegisterFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n  }),\n  firstName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  /** W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. */\n  organizationName: z.string().min(1).max(200).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n  }).optional(),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\n\nexport type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;\n\n/**\n * POST /auth/register — API contract (what goes over the wire).\n * Backend uses this for req.body parsing.\n * confirmPassword is NOT sent to the backend.\n */\nexport const UserRegisterApiDtoSchema = z.object({\n  email: z.email().toLowerCase(),\n  firstName: z.string().min(1).max(50),\n  lastName: z.string().min(1).max(50),\n  password: z.string().min(1).optional(),\n  /** W6.2: Org name when orgNameSource is 'ask'. */\n  organizationName: z.string().min(1).max(200).optional(),\n});\n\n\nexport type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Invitation Acceptance DTOs\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/invitation/accept — public invitation-acceptance form fields.\n *\n * The invitation token identifies the target invitation. Name/password fields are optional\n * because an existing invited user may only need to confirm the invitation, while a new\n * invited user can provide profile/password data in the same flow.\n *\n * confirmPassword is frontend-only and excluded from the API DTO.\n */\nexport const UserInvitationFormDtoSchema = z.object({\n  // Required, mirroring registration: the invitee establishes their identity at acceptance, and\n  // the profile seed keys on non-empty first+last (UserProfileSchema requires both).\n  // `.regex(/\\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS\n  // (\"  \" has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`\n  // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,\n  // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the\n  // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is\n  // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).\n  firstName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  password: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\nexport type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;\n\n/**\n * The first-factor credential the invitee chooses to establish at acceptance.\n *\n * The invitation-accept endpoint supports exactly three establishment paths (SSO-managed\n * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):\n * - `PASSWORD` — set a password now. When both `credentialMethod` and\n *   `password` are omitted, intentionally activate with no local credential;\n *   another configured authentication method can establish later sessions.\n * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the\n *   session is established when the invitee clicks it.\n * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps\n *   the session and the passkey is registered as the go-forward credential.\n */\nexport const INVITATION_ACCEPT_CREDENTIAL_METHODS = [\n  AuthMethod.PASSWORD,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.PASSKEY,\n] as const;\n\n/**\n * The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-\n * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are\n * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and\n * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift\n * wider than the wire contract it is fed from.\n */\nexport type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];\n\n/**\n * POST /auth/invitation/accept — API contract.\n *\n * `credentialMethod` is optional by design. When absent, a provided `password`\n * establishes a password credential; without one, acceptance activates the\n * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are\n * explicit because they initiate method-specific work.\n */\nexport const UserInvitationApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.\n  // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary\n  // (a direct API caller can't seed a blank profile name).\n  firstName: z.string().trim().min(1).max(50),\n  lastName: z.string().trim().min(1).max(50),\n  password: z.string().optional(),\n  credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),\n});\n\nexport type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;\n\n/**\n * POST /auth/invitation/reject — API contract.\n */\nexport const UserInvitationRejectApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  rejectionReason: z.string().max(500).optional(),\n});\n\nexport type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Email Verification API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/verify-email — API contract.\n * Token and email are extracted from URL query parameters on the frontend.\n * Email is required for defense-in-depth constant-time comparison against token metadata.\n */\nexport const EmailVerifyDtoSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\nexport type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;\n"]}
+{"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,8FAA8F;IAC9F,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACzC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACV,CAAC;AAWX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8EAA8E;IAC9E,gFAAgF;IAChF,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;CAC1E,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC","sourcesContent":["/**\n * User Registration — Shared DTO Schemas\n *\n * Single source of truth for user registration validation.\n * Used by both frontend (AutomatedForm component) and backend (req.body parsing).\n */\n\nimport { z } from 'zod';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\nimport { AuthMethod } from './authentication.shared.schemas';\n\n// ═══════════════════════════════════════════════════════════════\n// Registration Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/register — registration form fields.\n * Used as:\n * - Frontend: AutomatedForm schema (all 5 fields rendered)\n * - Backend: req.body parsing (minus confirmPassword)\n *\n * confirmPassword is a frontend-only field for client-side match validation.\n * The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n.\n * The .isPassword() decorator tells FormField to render password inputs.\n */\nexport const UserRegisterFormDtoSchema = z.object({\n  email: z.email().toLowerCase().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n  }),\n  firstName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  /** W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. */\n  organizationName: z.string().min(1).max(200).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n  }).optional(),\n  password: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().min(1).isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\n\nexport type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;\n\n/**\n * POST /auth/register — API contract (what goes over the wire).\n * Backend uses this for req.body parsing.\n * confirmPassword is NOT sent to the backend.\n */\nexport const UserRegisterApiDtoSchema = z.object({\n  email: z.email().toLowerCase(),\n  firstName: z.string().min(1).max(50),\n  lastName: z.string().min(1).max(50),\n  password: z.string().min(1).optional(),\n  /** W6.2: Org name when orgNameSource is 'ask'. */\n  organizationName: z.string().min(1).max(200).optional(),\n  /**\n   * How the registrant will authenticate afterwards (#463). Absent ⇒ PASSWORD, so a client that\n   * predates password-less signup keeps working unchanged.\n   *\n   * Typed as the whole `AuthMethod` vocabulary rather than a narrowed subset, deliberately: the set\n   * a given application accepts is `registration.allowedMethods`, which is per user type and\n   * authored, and duplicating a narrower list here would be a second place for it to drift. A method\n   * this application does not allow is refused by the service with the allowed set in the message,\n   * which is a better answer than a schema rejection that cannot say what IS allowed.\n   */\n  method: z.enum(AuthMethod).optional(),\n});\n\n\nexport type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Invitation Acceptance DTOs\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/invitation/accept — public invitation-acceptance form fields.\n *\n * The invitation token identifies the target invitation. Name/password fields are optional\n * because an existing invited user may only need to confirm the invitation, while a new\n * invited user can provide profile/password data in the same flow.\n *\n * confirmPassword is frontend-only and excluded from the API DTO.\n */\nexport const UserInvitationFormDtoSchema = z.object({\n  // Required, mirroring registration: the invitee establishes their identity at acceptance, and\n  // the profile seed keys on non-empty first+last (UserProfileSchema requires both).\n  // `.regex(/\\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS\n  // (\"  \" has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`\n  // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,\n  // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the\n  // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is\n  // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).\n  firstName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n  }),\n  lastName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n  }),\n  password: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n  confirmPassword: z.string().isPassword().stringUI({\n    edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n  }).optional(),\n});\n\nexport type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;\n\n/**\n * The first-factor credential the invitee chooses to establish at acceptance.\n *\n * The invitation-accept endpoint supports exactly three establishment paths (SSO-managed\n * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):\n * - `PASSWORD` — set a password now. When both `credentialMethod` and\n *   `password` are omitted, intentionally activate with no local credential;\n *   another configured authentication method can establish later sessions.\n * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the\n *   session is established when the invitee clicks it.\n * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps\n *   the session and the passkey is registered as the go-forward credential.\n */\nexport const INVITATION_ACCEPT_CREDENTIAL_METHODS = [\n  AuthMethod.PASSWORD,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.PASSKEY,\n] as const;\n\n/**\n * The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-\n * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are\n * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and\n * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift\n * wider than the wire contract it is fed from.\n */\nexport type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];\n\n/**\n * POST /auth/invitation/accept — API contract.\n *\n * `credentialMethod` is optional by design. When absent, a provided `password`\n * establishes a password credential; without one, acceptance activates the\n * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are\n * explicit because they initiate method-specific work.\n */\nexport const UserInvitationApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.\n  // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary\n  // (a direct API caller can't seed a blank profile name).\n  firstName: z.string().trim().min(1).max(50),\n  lastName: z.string().trim().min(1).max(50),\n  password: z.string().optional(),\n  credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),\n});\n\nexport type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;\n\n/**\n * POST /auth/invitation/reject — API contract.\n */\nexport const UserInvitationRejectApiDtoSchema = z.object({\n  invitationToken: z.string().min(1),\n  rejectionReason: z.string().max(500).optional(),\n});\n\nexport type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Email Verification API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * POST /auth/verify-email — API contract.\n * Token and email are extracted from URL query parameters on the frontend.\n * Email is required for defense-in-depth constant-time comparison against token metadata.\n */\nexport const EmailVerifyDtoSchema = z.object({\n  token: z.string().min(1),\n  email: z.email().toLowerCase(),\n});\n\nexport type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;\n"]}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.d.ts

@@ -30,6 +30,21 @@ export declare const ScimAttributeMappingSchema: z.ZodObject<{
     displayName: z.ZodDefault<z.ZodString>;
 }, z.core.$strip>;
 export type ScimAttributeMapping = z.infer<typeof ScimAttributeMappingSchema>;
+/**
+ * The API-relative base an external identity provider pushes SCIM traffic to.
+ *
+ * ONE named source for a path that four different surfaces need to agree on: the virtual
+ * `scimEndpointUrl` below, the SCIM controller's own mount, the specification that documents the
+ * field, and the customer documentation that tells an administrator what to paste into their IdP.
+ * Before this existed the documentation's worked example was `https://api.example.com/api/v1/scim/v2`
+ * — a real path under a host that does not exist, which an administrator cannot tell from a value
+ * they are meant to use.
+ *
+ * Built from {@link MAIN_API_BASE_PATH}, so a mount change moves every consumer with it rather than
+ * stranding a literal. That is not hypothetical here: this field replaced a dead custom
+ * implementation that hardcoded `/api/scim/v2` and was simply wrong for missing the version prefix.
+ */
+export declare const SCIM_SERVICE_BASE_PATH: string;
 export declare const ScimProvisioningConfigBaseSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     autoCreateUsers: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAa9E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;iBAsJ3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;kBAMvD,CAAC"}
+{"version":3,"file":"scim-provisioning-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAa9E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAwC,CAAC;AAE9E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;iBAsJ3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;kBAMvD,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.js

@@ -13,7 +13,7 @@ import { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas.js';
 import { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas.js';
 import { CoreResourceType } from '../../../resources/resources.shared.core.definitions.js';
 import { MAIN_API_BASE_PATH } from '../../../requests/manual-controllers-routes-urls.js';
-import { DomainVerificationStatus } from '../sso/sso-config.shared.schemas.js';
+import { resolveVerifiedDomains } from '../sso/sso-config.shared.schemas.js';
 import { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit-mapping.shared.js';
 /**
  * Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a
@@ -44,6 +44,21 @@ const SCIM_SCOPE_FK_TO_SSO_CONFIG = [
     ['organizationId', CoreResourceType.ORGANIZATION_SSO_CONFIG],
     ['applicationId', CoreResourceType.APPLICATION_SSO_CONFIG],
 ];
+/**
+ * The API-relative base an external identity provider pushes SCIM traffic to.
+ *
+ * ONE named source for a path that four different surfaces need to agree on: the virtual
+ * `scimEndpointUrl` below, the SCIM controller's own mount, the specification that documents the
+ * field, and the customer documentation that tells an administrator what to paste into their IdP.
+ * Before this existed the documentation's worked example was `https://api.example.com/api/v1/scim/v2`
+ * — a real path under a host that does not exist, which an administrator cannot tell from a value
+ * they are meant to use.
+ *
+ * Built from {@link MAIN_API_BASE_PATH}, so a mount change moves every consumer with it rather than
+ * stranding a literal. That is not hypothetical here: this field replaced a dead custom
+ * implementation that hardcoded `/api/scim/v2` and was simply wrong for missing the version prefix.
+ */
+export const SCIM_SERVICE_BASE_PATH = `${MAIN_API_BASE_PATH}/scim/v2`;
 export const ScimProvisioningConfigBaseSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
     // NOTE: there is deliberately NO `scimEnabled` field. Whether SCIM is AVAILABLE for an org is a
@@ -127,7 +142,7 @@ export const ScimProvisioningConfigBaseSchema = z.object({
      * separates tenants by bearer token, not by path.
      */
     scimEndpointUrl: z.string().optional().isVirtual({
-        calculate: () => `${MAIN_API_BASE_PATH}/scim/v2`,
+        calculate: () => SCIM_SERVICE_BASE_PATH,
     }),
     /**
      * The email domains SCIM provisioning will accept, mirroring the gate actually enforced at
@@ -169,8 +184,10 @@ export const ScimProvisioningConfigBaseSchema = z.object({
                 const domains = rowsByScopeId.get(scopeId)?.['domains'];
                 if (!domains)
                     return undefined;
-                const verificationStatus = domains.domainVerificationStatus ?? {};
-                return (domains.verifiedDomains ?? []).filter((domain) => verificationStatus[domain] === DomainVerificationStatus.VERIFIED);
+                // The one derivation (#457), not a sixth hand-written join. `undefined` above is still
+                // DISTINCT from the `[]` this can return — see the field's docstring; the helper answers
+                // "which are verified", and only the caller knows whether the config was readable at all.
+                return resolveVerifiedDomains(domains);
             }
             catch (error) {
                 utils?.logger?.warn?.(`[scimProvisioningConfig.allowedDomains] SSO config read failed for ${scope.fk}=${scopeId}; reporting undetermined`, error);

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AAEjG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;CAC/C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,2BAA2B,GAA4E;IAC3G,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,uBAAuB,CAAC;IAC5D,CAAC,eAAe,EAAE,gBAAgB,CAAC,sBAAsB,CAAC;CAClD,CAAC;AAGX,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,kGAAkG;IAClG,4EAA4E;IAC5E,gGAAgG;IAChG,mFAAmF;IACnF,6FAA6F;IAC7F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,6FAA6F;IAC7F,4FAA4F;IAC5F,mGAAmG;IACnG,sBAAsB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC7E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,gBAAgB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,4FAA4F;IAC5F,6FAA6F;IAC7F,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAErG;;;;;;;;;;;OAWG;IACH,gGAAgG;IAChG,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAExD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QAC/C,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,kBAAkB,UAAU;KACjD,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QACvD,YAAY,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,aAAoD,CAAC;YAEjE,MAAM,KAAK,GAAG,2BAA2B;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC3E,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClF,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,0BAA0B,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC;YAEvG,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAEzC,CAAC;gBACd,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAE/B,MAAM,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,IAAI,EAAE,CAAC;gBAClE,OAAO,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAC7E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CACnB,sEAAsE,KAAK,CAAC,EAAE,IAAI,OAAO,0BAA0B,EACnH,KAAK,CACN,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4CAA4C,GAAG,yBAAyB,CAAC;IACpF,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,0BAA0B;IAC/C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,gCAAgC;IAC5C,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SCIM Provisioning Config Schema (Shared) — Polymorphic\n *\n * SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.\n * Independent from SSO JIT provisioning (SsoConfig.provisioning) — SCIM is a\n * separate provisioning channel triggered by IdP push.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2G\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { MAIN_API_BASE_PATH } from '../../../requests/manual-controllers-routes-urls';\nimport { DomainVerificationStatus } from '../sso/sso-config.shared.schemas';\nimport { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit-mapping.shared';\n\n/**\n * Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a\n * path expression resolved against the SCIM body at push time by the backend\n * `resolveScimAttributePath` — the row's authoritative source for how a directory's payload\n * shape translates to Wildo's `{email, firstName, lastName, displayName}` (Okta, Azure AD, etc.\n * differ). The defaults reproduce the framework's built-in mapping exactly, so an org that never\n * customises this behaves identically to the hardcoded normalisation it replaces.\n *\n * Supported path grammar (what `resolveScimAttributePath` understands):\n * - dotted traversal — `name.givenName`\n * - array index — `emails[0].value`\n * - array filter — `emails[primary eq true].value` (first element whose `primary` equals `true`;\n *   also `emails[type eq \"work\"].value`) — the SCIM-style selector the spec examples use.\n */\nexport const ScimAttributeMappingSchema = z.object({\n  email: z.string().default('emails[0].value'),\n  firstName: z.string().default('name.givenName'),\n  lastName: z.string().default('name.familyName'),\n  displayName: z.string().default('displayName'),\n});\nexport type ScimAttributeMapping = z.infer<typeof ScimAttributeMappingSchema>;\n\n/**\n * The scope FKs the polymorphism engine injects onto the two variants. Declared here\n * (rather than read off a variant schema) because this BASE schema's virtual fields run\n * for both variants and must discover which scope the row belongs to at read time.\n */\nconst SCIM_SCOPE_FK_TO_SSO_CONFIG: ReadonlyArray<readonly [fk: string, ssoResourceType: CoreResourceType]> = [\n  ['organizationId', CoreResourceType.ORGANIZATION_SSO_CONFIG],\n  ['applicationId', CoreResourceType.APPLICATION_SSO_CONFIG],\n] as const;\n\n\nexport const ScimProvisioningConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // NOTE: there is deliberately NO `scimEnabled` field. Whether SCIM is AVAILABLE for an org is a\n  // per-ORG-TYPE decision at `organizationTypes[type].scimProvisioning.enabled` in the app config —\n  // the authority the app-global MOUNT gate and the SCIM controller auth gate\n  // (`isScimProvisioningEnabledForOrg`) consult. NB: the invitation `managementMode` resolver and\n  // the invite-accept credential block key instead on per-org ACTIVE management (the\n  // DIRECTORY_PROVISIONING feature + a live SCIM token — see `isOrgActivelyDirectoryManaged` /\n  // AUTH-23), so a SCIM-capable type does not by itself forbid local credentials. A per-scope\n  // `scimEnabled` on this row would duplicate the type-level authority, could silently drift from\n  // it, and was read by nothing. This row governs only WHAT HAPPENS to users once SCIM is on.\n  // `.isAuditEvidence()` on the four below — every one decides what the DIRECTORY is allowed to do\n  // to member accounts and with what standing. `defaultRole` in particular is a role GRANT: SCIM\n  // provisions through an internal execution context, so it is NOT bounded by any caller's role\n  // ceiling (see `defaultUnitRole`'s note below) — configuring it IS granting the role, which is\n  // exactly the class of change an auditor must be able to reconstruct with before/after values.\n  // `autoDeactivateUsers` is the deprovisioning switch; flipping it off silently strands access.\n  // None of these is personal data — they are flags and role names — so recording their values\n  // does not conflict with the minimisation rule that keeps user-identifying fields unmarked.\n  // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the switches that create accounts and\n  // deprovision access.\n  autoCreateUsers: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  autoVerifyEmail: z.boolean().default(true),\n  autoDeactivateUsers: z.boolean().default(true).isAuditEvidence(),\n  defaultRole: z.string().optional().isAuditEvidence(),\n  attributeMapping: ScimAttributeMappingSchema.optional(),\n\n  /**\n   * Declared bindings from the directory's `department` value to an ORGANIZATION UNIT.\n   *\n   * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory becomes the authority\n   * for which unit a member belongs to.\n   *\n   * Explicit and unit-id-addressed on purpose. Since units are an authorization axis, resolving a\n   * flat directory string to the wrong node in the tree grants the wrong DATA — and `code` is unique\n   * only among siblings while `name` is freeform, so a search-based match is genuinely ambiguous.\n   * Nothing here guesses: a value with no declared binding is ignored, and no unit is ever created.\n   *\n   * ⚠️ **Declaring this makes SCIM AUTHORITATIVE over the member's unit assignments.** Every push\n   * replaces the member's assignments with exactly what the directory says, so leaving a department\n   * actually revokes its access — and assignments made BY HAND in the application are removed too.\n   * An organization that wants manual unit assignments should leave this empty. Reconciliation only\n   * runs when this list is non-empty AND {@link ScimProvisioningConfigBaseSchema.shape.defaultUnitRole}\n   * is set, so an organization that never opted in can never have assignments deleted by a push.\n   */\n  // `.isAuditEvidence()` — declaring a binding makes SCIM AUTHORITATIVE over unit assignments\n  // (see the warning above), so the mapping list is an authorization surface, not preferences.\n  organizationUnitMapping: z.array(ScimOrganizationUnitMappingEntrySchema).optional().isAuditEvidence(),\n\n  /**\n   * The role every SCIM-created unit assignment carries.\n   *\n   * Deliberately SEPARATE from {@link ScimProvisioningConfigBaseSchema.shape.defaultRole}, which is the\n   * ORGANIZATION-wide role. A unit grant and an organization grant are different authority over\n   * different row sets; one field meaning both would merge two scopes that the whole narrowing model\n   * exists to keep apart.\n   *\n   * ⚠️ SCIM provisions through an internal execution context, so this value is NOT bounded by a\n   * caller's role ceiling — exactly as `defaultRole` is not. The gate is the write to THIS row, which\n   * is organization-admin-gated. Treat configuring it as granting the role.\n   */\n  // `.isAuditEvidence()` — a role grant on a DIFFERENT authority axis than `defaultRole`, and the\n  // JSDoc above says it plainly: treat configuring it as granting the role.\n  defaultUnitRole: z.string().optional().isAuditEvidence(),\n\n  /**\n   * The API-relative path an external IdP pushes SCIM traffic to, e.g. `/api/v1/scim/v2`.\n   *\n   * VIRTUAL (computed per read, never persisted, never accepted on write) because it is\n   * derived deployment routing — not tenant data. Storing it would let a row drift from the\n   * route the server actually mounts, which is precisely the class of lie this field replaces:\n   * it supersedes a dead custom-implementation that injected a hardcoded `/api/scim/v2`,\n   * **missing the `/api/v1` mount prefix and therefore simply wrong**. Built from\n   * {@link MAIN_API_BASE_PATH} — the documented single source of truth for the prefix — so a\n   * future mount change moves this field with it instead of stranding a literal.\n   *\n   * PATH, not an absolute URL: the host lives in `runtime.endPoints.main_backend_api.publicUrl`,\n   * reachable only through `AppConfigService`, whose DI symbol lives in `saas-backend-lib` —\n   * unreachable from this shared package without inverting the dependency direction. `publicUrl`\n   * is also optional, so an absolute form would frequently resolve to nothing. Callers that need\n   * the absolute endpoint compose it against their own API base (the frontend already knows it).\n   *\n   * Identical on both scope variants: the SCIM controller mounts ONE app-global router and\n   * separates tenants by bearer token, not by path.\n   */\n  scimEndpointUrl: z.string().optional().isVirtual({\n    calculate: () => `${MAIN_API_BASE_PATH}/scim/v2`,\n  }),\n\n  /**\n   * The email domains SCIM provisioning will accept, mirroring the gate actually enforced at\n   * push time — `EnterpriseUserProvisioningBackendService.provisionEnterpriseUser` rejects an IdP profile\n   * whose email domain is absent from this list.\n   *\n   * VIRTUAL and read live from the scope's SSO config rather than stored here: the domains are\n   * OWNED by `SsoConfig.domains` (verified via DNS there), so persisting a copy on this row\n   * would denormalize a security-relevant allow-list and let it go stale against the owner —\n   * exactly the drift `forwardedLabel` exists to avoid. Same predicate as the enforcement path\n   * (`SCIMControllerBackendService._getProvisioningConfig`): a domain counts only once DNS\n   * verification has actually passed, so `verifiedDomains` is filtered by\n   * `domainVerificationStatus`. Deliberately NOT the looser `verifiedDomains || ssoEnabledDomains`\n   * union used by domain→org lookup — widening this list would widen a security gate.\n   *\n   * `[]` and `undefined` are DISTINCT and both meaningful:\n   * - `[]` — the SSO config exists and has no verified domain ⇒ **unrestricted** (the enforcement\n   *   check is skipped entirely when the list is empty). This is the honest reading of the value.\n   * - `undefined` — the SSO config could not be read ⇒ **undetermined**. Degrading to `[]` here\n   *   would render an unread config as \"unrestricted\", overstating what we know.\n   *\n   * Fail-safe: never throws — this is a display mirror, not the enforcement point.\n   */\n  allowedDomains: z.array(z.string()).optional().isVirtual({\n    dependencies: SCIM_SCOPE_FK_TO_SSO_CONFIG.map(([fk]) => fk),\n    calculate: async ({ currentObject, utils }) => {\n      const row = currentObject as Record<string, unknown> | undefined;\n\n      const scope = SCIM_SCOPE_FK_TO_SSO_CONFIG\n        .map(([fk, ssoResourceType]) => ({ fk, ssoResourceType, value: row?.[fk] }))\n        .find(({ value }) => value !== null && value !== undefined && String(value).length > 0);\n      if (!scope) return undefined;\n\n      const scopeId = String(scope.value);\n      const ssoRepository = utils?.repositories?.getRepository?.(scope.ssoResourceType);\n      if (!ssoRepository || typeof ssoRepository.findFieldValuesByJoinField !== 'function') return undefined;\n\n      try {\n        const rowsByScopeId: Map<string, Record<string, unknown>> =\n          await ssoRepository.findFieldValuesByJoinField(scope.fk, [scopeId], ['domains']);\n        const domains = rowsByScopeId.get(scopeId)?.['domains'] as\n          | { verifiedDomains?: string[]; domainVerificationStatus?: Record<string, string> }\n          | undefined;\n        if (!domains) return undefined;\n\n        const verificationStatus = domains.domainVerificationStatus ?? {};\n        return (domains.verifiedDomains ?? []).filter(\n          (domain) => verificationStatus[domain] === DomainVerificationStatus.VERIFIED,\n        );\n      } catch (error) {\n        utils?.logger?.warn?.(\n          `[scimProvisioningConfig.allowedDomains] SSO config read failed for ${scope.fk}=${scopeId}; reporting undetermined`,\n          error,\n        );\n        return undefined;\n      }\n    },\n  }),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimProvisioningConfigBase = z.infer<typeof ScimProvisioningConfigBaseSchema>;\n\nexport const scimProvisioningConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'scimProvisioningConfig',\n  baseFieldIdentifier: 'scimProvisioningConfigId',\n  baseEnumKey: 'SCIM_PROVISIONING_CONFIG',\n  baseSchema: ScimProvisioningConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}
+{"version":3,"file":"scim-provisioning-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AAEjG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;CAC/C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,2BAA2B,GAA4E;IAC3G,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,uBAAuB,CAAC;IAC5D,CAAC,eAAe,EAAE,gBAAgB,CAAC,sBAAsB,CAAC;CAClD,CAAC;AAGX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAW,GAAG,kBAAkB,UAAU,CAAC;AAE9E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,kGAAkG;IAClG,4EAA4E;IAC5E,gGAAgG;IAChG,mFAAmF;IACnF,6FAA6F;IAC7F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,6FAA6F;IAC7F,4FAA4F;IAC5F,mGAAmG;IACnG,sBAAsB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC7E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,gBAAgB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,4FAA4F;IAC5F,6FAA6F;IAC7F,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAErG;;;;;;;;;;;OAWG;IACH,gGAAgG;IAChG,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAExD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QAC/C,SAAS,EAAE,GAAG,EAAE,CAAC,sBAAsB;KACxC,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QACvD,YAAY,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,aAAoD,CAAC;YAEjE,MAAM,KAAK,GAAG,2BAA2B;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC3E,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClF,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,0BAA0B,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC;YAEvG,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAEzC,CAAC;gBACd,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAE/B,uFAAuF;gBACvF,yFAAyF;gBACzF,0FAA0F;gBAC1F,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CACnB,sEAAsE,KAAK,CAAC,EAAE,IAAI,OAAO,0BAA0B,EACnH,KAAK,CACN,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4CAA4C,GAAG,yBAAyB,CAAC;IACpF,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,0BAA0B;IAC/C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,gCAAgC;IAC5C,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SCIM Provisioning Config Schema (Shared) — Polymorphic\n *\n * SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.\n * Independent from SSO JIT provisioning (SsoConfig.provisioning) — SCIM is a\n * separate provisioning channel triggered by IdP push.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2G\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { MAIN_API_BASE_PATH } from '../../../requests/manual-controllers-routes-urls';\nimport { resolveVerifiedDomains } from '../sso/sso-config.shared.schemas';\nimport { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit-mapping.shared';\n\n/**\n * Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a\n * path expression resolved against the SCIM body at push time by the backend\n * `resolveScimAttributePath` — the row's authoritative source for how a directory's payload\n * shape translates to Wildo's `{email, firstName, lastName, displayName}` (Okta, Azure AD, etc.\n * differ). The defaults reproduce the framework's built-in mapping exactly, so an org that never\n * customises this behaves identically to the hardcoded normalisation it replaces.\n *\n * Supported path grammar (what `resolveScimAttributePath` understands):\n * - dotted traversal — `name.givenName`\n * - array index — `emails[0].value`\n * - array filter — `emails[primary eq true].value` (first element whose `primary` equals `true`;\n *   also `emails[type eq \"work\"].value`) — the SCIM-style selector the spec examples use.\n */\nexport const ScimAttributeMappingSchema = z.object({\n  email: z.string().default('emails[0].value'),\n  firstName: z.string().default('name.givenName'),\n  lastName: z.string().default('name.familyName'),\n  displayName: z.string().default('displayName'),\n});\nexport type ScimAttributeMapping = z.infer<typeof ScimAttributeMappingSchema>;\n\n/**\n * The scope FKs the polymorphism engine injects onto the two variants. Declared here\n * (rather than read off a variant schema) because this BASE schema's virtual fields run\n * for both variants and must discover which scope the row belongs to at read time.\n */\nconst SCIM_SCOPE_FK_TO_SSO_CONFIG: ReadonlyArray<readonly [fk: string, ssoResourceType: CoreResourceType]> = [\n  ['organizationId', CoreResourceType.ORGANIZATION_SSO_CONFIG],\n  ['applicationId', CoreResourceType.APPLICATION_SSO_CONFIG],\n] as const;\n\n\n/**\n * The API-relative base an external identity provider pushes SCIM traffic to.\n *\n * ONE named source for a path that four different surfaces need to agree on: the virtual\n * `scimEndpointUrl` below, the SCIM controller's own mount, the specification that documents the\n * field, and the customer documentation that tells an administrator what to paste into their IdP.\n * Before this existed the documentation's worked example was `https://api.example.com/api/v1/scim/v2`\n * — a real path under a host that does not exist, which an administrator cannot tell from a value\n * they are meant to use.\n *\n * Built from {@link MAIN_API_BASE_PATH}, so a mount change moves every consumer with it rather than\n * stranding a literal. That is not hypothetical here: this field replaced a dead custom\n * implementation that hardcoded `/api/scim/v2` and was simply wrong for missing the version prefix.\n */\nexport const SCIM_SERVICE_BASE_PATH: string = `${MAIN_API_BASE_PATH}/scim/v2`;\n\nexport const ScimProvisioningConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // NOTE: there is deliberately NO `scimEnabled` field. Whether SCIM is AVAILABLE for an org is a\n  // per-ORG-TYPE decision at `organizationTypes[type].scimProvisioning.enabled` in the app config —\n  // the authority the app-global MOUNT gate and the SCIM controller auth gate\n  // (`isScimProvisioningEnabledForOrg`) consult. NB: the invitation `managementMode` resolver and\n  // the invite-accept credential block key instead on per-org ACTIVE management (the\n  // DIRECTORY_PROVISIONING feature + a live SCIM token — see `isOrgActivelyDirectoryManaged` /\n  // AUTH-23), so a SCIM-capable type does not by itself forbid local credentials. A per-scope\n  // `scimEnabled` on this row would duplicate the type-level authority, could silently drift from\n  // it, and was read by nothing. This row governs only WHAT HAPPENS to users once SCIM is on.\n  // `.isAuditEvidence()` on the four below — every one decides what the DIRECTORY is allowed to do\n  // to member accounts and with what standing. `defaultRole` in particular is a role GRANT: SCIM\n  // provisions through an internal execution context, so it is NOT bounded by any caller's role\n  // ceiling (see `defaultUnitRole`'s note below) — configuring it IS granting the role, which is\n  // exactly the class of change an auditor must be able to reconstruct with before/after values.\n  // `autoDeactivateUsers` is the deprovisioning switch; flipping it off silently strands access.\n  // None of these is personal data — they are flags and role names — so recording their values\n  // does not conflict with the minimisation rule that keeps user-identifying fields unmarked.\n  // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the switches that create accounts and\n  // deprovision access.\n  autoCreateUsers: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  autoVerifyEmail: z.boolean().default(true),\n  autoDeactivateUsers: z.boolean().default(true).isAuditEvidence(),\n  defaultRole: z.string().optional().isAuditEvidence(),\n  attributeMapping: ScimAttributeMappingSchema.optional(),\n\n  /**\n   * Declared bindings from the directory's `department` value to an ORGANIZATION UNIT.\n   *\n   * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory becomes the authority\n   * for which unit a member belongs to.\n   *\n   * Explicit and unit-id-addressed on purpose. Since units are an authorization axis, resolving a\n   * flat directory string to the wrong node in the tree grants the wrong DATA — and `code` is unique\n   * only among siblings while `name` is freeform, so a search-based match is genuinely ambiguous.\n   * Nothing here guesses: a value with no declared binding is ignored, and no unit is ever created.\n   *\n   * ⚠️ **Declaring this makes SCIM AUTHORITATIVE over the member's unit assignments.** Every push\n   * replaces the member's assignments with exactly what the directory says, so leaving a department\n   * actually revokes its access — and assignments made BY HAND in the application are removed too.\n   * An organization that wants manual unit assignments should leave this empty. Reconciliation only\n   * runs when this list is non-empty AND {@link ScimProvisioningConfigBaseSchema.shape.defaultUnitRole}\n   * is set, so an organization that never opted in can never have assignments deleted by a push.\n   */\n  // `.isAuditEvidence()` — declaring a binding makes SCIM AUTHORITATIVE over unit assignments\n  // (see the warning above), so the mapping list is an authorization surface, not preferences.\n  organizationUnitMapping: z.array(ScimOrganizationUnitMappingEntrySchema).optional().isAuditEvidence(),\n\n  /**\n   * The role every SCIM-created unit assignment carries.\n   *\n   * Deliberately SEPARATE from {@link ScimProvisioningConfigBaseSchema.shape.defaultRole}, which is the\n   * ORGANIZATION-wide role. A unit grant and an organization grant are different authority over\n   * different row sets; one field meaning both would merge two scopes that the whole narrowing model\n   * exists to keep apart.\n   *\n   * ⚠️ SCIM provisions through an internal execution context, so this value is NOT bounded by a\n   * caller's role ceiling — exactly as `defaultRole` is not. The gate is the write to THIS row, which\n   * is organization-admin-gated. Treat configuring it as granting the role.\n   */\n  // `.isAuditEvidence()` — a role grant on a DIFFERENT authority axis than `defaultRole`, and the\n  // JSDoc above says it plainly: treat configuring it as granting the role.\n  defaultUnitRole: z.string().optional().isAuditEvidence(),\n\n  /**\n   * The API-relative path an external IdP pushes SCIM traffic to, e.g. `/api/v1/scim/v2`.\n   *\n   * VIRTUAL (computed per read, never persisted, never accepted on write) because it is\n   * derived deployment routing — not tenant data. Storing it would let a row drift from the\n   * route the server actually mounts, which is precisely the class of lie this field replaces:\n   * it supersedes a dead custom-implementation that injected a hardcoded `/api/scim/v2`,\n   * **missing the `/api/v1` mount prefix and therefore simply wrong**. Built from\n   * {@link MAIN_API_BASE_PATH} — the documented single source of truth for the prefix — so a\n   * future mount change moves this field with it instead of stranding a literal.\n   *\n   * PATH, not an absolute URL: the host lives in `runtime.endPoints.main_backend_api.publicUrl`,\n   * reachable only through `AppConfigService`, whose DI symbol lives in `saas-backend-lib` —\n   * unreachable from this shared package without inverting the dependency direction. `publicUrl`\n   * is also optional, so an absolute form would frequently resolve to nothing. Callers that need\n   * the absolute endpoint compose it against their own API base (the frontend already knows it).\n   *\n   * Identical on both scope variants: the SCIM controller mounts ONE app-global router and\n   * separates tenants by bearer token, not by path.\n   */\n  scimEndpointUrl: z.string().optional().isVirtual({\n    calculate: () => SCIM_SERVICE_BASE_PATH,\n  }),\n\n  /**\n   * The email domains SCIM provisioning will accept, mirroring the gate actually enforced at\n   * push time — `EnterpriseUserProvisioningBackendService.provisionEnterpriseUser` rejects an IdP profile\n   * whose email domain is absent from this list.\n   *\n   * VIRTUAL and read live from the scope's SSO config rather than stored here: the domains are\n   * OWNED by `SsoConfig.domains` (verified via DNS there), so persisting a copy on this row\n   * would denormalize a security-relevant allow-list and let it go stale against the owner —\n   * exactly the drift `forwardedLabel` exists to avoid. Same predicate as the enforcement path\n   * (`SCIMControllerBackendService._getProvisioningConfig`): a domain counts only once DNS\n   * verification has actually passed, so `verifiedDomains` is filtered by\n   * `domainVerificationStatus`. Deliberately NOT the looser `verifiedDomains || ssoEnabledDomains`\n   * union used by domain→org lookup — widening this list would widen a security gate.\n   *\n   * `[]` and `undefined` are DISTINCT and both meaningful:\n   * - `[]` — the SSO config exists and has no verified domain ⇒ **unrestricted** (the enforcement\n   *   check is skipped entirely when the list is empty). This is the honest reading of the value.\n   * - `undefined` — the SSO config could not be read ⇒ **undetermined**. Degrading to `[]` here\n   *   would render an unread config as \"unrestricted\", overstating what we know.\n   *\n   * Fail-safe: never throws — this is a display mirror, not the enforcement point.\n   */\n  allowedDomains: z.array(z.string()).optional().isVirtual({\n    dependencies: SCIM_SCOPE_FK_TO_SSO_CONFIG.map(([fk]) => fk),\n    calculate: async ({ currentObject, utils }) => {\n      const row = currentObject as Record<string, unknown> | undefined;\n\n      const scope = SCIM_SCOPE_FK_TO_SSO_CONFIG\n        .map(([fk, ssoResourceType]) => ({ fk, ssoResourceType, value: row?.[fk] }))\n        .find(({ value }) => value !== null && value !== undefined && String(value).length > 0);\n      if (!scope) return undefined;\n\n      const scopeId = String(scope.value);\n      const ssoRepository = utils?.repositories?.getRepository?.(scope.ssoResourceType);\n      if (!ssoRepository || typeof ssoRepository.findFieldValuesByJoinField !== 'function') return undefined;\n\n      try {\n        const rowsByScopeId: Map<string, Record<string, unknown>> =\n          await ssoRepository.findFieldValuesByJoinField(scope.fk, [scopeId], ['domains']);\n        const domains = rowsByScopeId.get(scopeId)?.['domains'] as\n          | { verifiedDomains?: string[]; domainVerificationStatus?: Record<string, string> }\n          | undefined;\n        if (!domains) return undefined;\n\n        // The one derivation (#457), not a sixth hand-written join. `undefined` above is still\n        // DISTINCT from the `[]` this can return — see the field's docstring; the helper answers\n        // \"which are verified\", and only the caller knows whether the config was readable at all.\n        return resolveVerifiedDomains(domains);\n      } catch (error) {\n        utils?.logger?.warn?.(\n          `[scimProvisioningConfig.allowedDomains] SSO config read failed for ${scope.fk}=${scopeId}; reporting undetermined`,\n          error,\n        );\n        return undefined;\n      }\n    },\n  }),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimProvisioningConfigBase = z.infer<typeof ScimProvisioningConfigBaseSchema>;\n\nexport const scimProvisioningConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'scimProvisioningConfig',\n  baseFieldIdentifier: 'scimProvisioningConfigId',\n  baseEnumKey: 'SCIM_PROVISIONING_CONFIG',\n  baseSchema: ScimProvisioningConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.d.ts

@@ -5,6 +5,66 @@
  * Spread into the registry factory map:
  *   ...ssoConfigPolymorphicFactories
  */
+import { z } from 'zod';
 import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions';
-export declare const ssoConfigPolymorphicFactories: Record<string, import("../../..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE, any>>;
+export declare enum SsoConfig_Operations {
+    CLAIM_DOMAIN = "claimDomain",
+    VERIFY_DOMAIN = "verifyDomain",
+    REVOKE_DOMAIN = "revokeDomain"
+}
+export declare const SsoConfig_ClaimDomainRequestDto: z.ZodObject<{
+    domain: z.ZodString;
+}, z.core.$strict>;
+export declare const SsoConfig_VerifyDomainRequestDto: z.ZodObject<{
+    domain: z.ZodString;
+}, z.core.$strict>;
+export declare const SsoConfig_RevokeDomainRequestDto: z.ZodObject<{
+    domain: z.ZodString;
+}, z.core.$strict>;
+/**
+ * The claim response is the ONLY disclosure of the challenge nonce.
+ *
+ * `domainVerificationTokens` is `.isBackendOnly()`, so no READ of the config ever returns it — an
+ * operator who loses this response claims again, which mints a new nonce and invalidates the old
+ * one. `.isEphemeral()` marks `dnsRecordValue` as a revealed-once secret, the same contract the
+ * SCIM token mint uses for its one-time plaintext.
+ */
+export declare const SsoConfig_ClaimDomainResponseDto: z.ZodObject<{
+    domain: z.ZodString;
+    status: z.ZodEnum<{
+        readonly PENDING: "pending";
+        readonly VERIFIED: "verified";
+        readonly FAILED: "failed";
+        readonly EXPIRED: "expired";
+    }>;
+    /** The DNS name the TXT record goes on: `_wildo-verification.<domain>`. */
+    dnsName: z.ZodString;
+    /** The exact TXT value to publish. Revealed once. */
+    dnsRecordValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+}, z.core.$strict>;
+export declare const SsoConfig_VerifyDomainResponseDto: z.ZodObject<{
+    domain: z.ZodString;
+    status: z.ZodEnum<{
+        readonly PENDING: "pending";
+        readonly VERIFIED: "verified";
+        readonly FAILED: "failed";
+        readonly EXPIRED: "expired";
+    }>;
+    dnsName: z.ZodString;
+    /**
+     * Every TXT record found at `dnsName`, so a failed check is diagnosable without a second tool.
+     * These are public DNS records of a domain the caller is claiming to own — echoing them discloses
+     * nothing the caller could not resolve themselves.
+     */
+    dnsRecordsFound: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const SsoConfig_RevokeDomainResponseDto: z.ZodObject<{
+    domain: z.ZodString;
+    /** True once the domain holds no claim, no status and no nonce in this scope. */
+    revoked: z.ZodBoolean;
+}, z.core.$strict>;
+export type SsoConfig_ClaimDomainResponse = z.infer<typeof SsoConfig_ClaimDomainResponseDto>;
+export type SsoConfig_VerifyDomainResponse = z.infer<typeof SsoConfig_VerifyDomainResponseDto>;
+export type SsoConfig_RevokeDomainResponse = z.infer<typeof SsoConfig_RevokeDomainResponseDto>;
+export declare const ssoConfigPolymorphicFactories: Record<string, import("../../..").ResourceConfiguration_InitializationFactory<typeof SsoConfig_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
 //# sourceMappingURL=sso-config.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,eAAO,MAAM,6BAA6B,yNAoGzC,CAAC"}
+{"version":3,"file":"sso-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAsB/G,oBAAY,oBAAoB;IAC9B,YAAY,gBAAgB;IAC5B,aAAa,iBAAiB;IAC9B,aAAa,iBAAiB;CAC/B;AAiBD,eAAO,MAAM,+BAA+B;;kBAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;kBAE3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;kBAE3C,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;IAG3C,2EAA2E;;IAE3E,qDAAqD;;kBAErD,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;IAI5C;;;;OAIG;;kBAEH,CAAC;AAEH,eAAO,MAAM,iCAAiC;;IAE5C,iFAAiF;;kBAEjF,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC7F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC/F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAI/F,eAAO,MAAM,6BAA6B,wQAyOzC,CAAC"}

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.js

@@ -5,15 +5,88 @@
  * Spread into the registry factory map:
  *   ...ssoConfigPolymorphicFactories
  */
+import { z } from 'zod';
 import { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../../resources/resources.shared.schemas.js';
 import { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory.js';
 import { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas.js';
 import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas.js';
-import { ssoConfigPolymorphicDeclaration } from './sso-config.shared.schemas.js';
+import { DomainVerificationStatus, ssoConfigPolymorphicDeclaration } from './sso-config.shared.schemas.js';
+// ── Domain-ownership operations ──────────────────────────────────────
+//
+// Enterprise domain routing sends every `@customer.com` sign-in to that customer's identity
+// provider. Reaching the VERIFIED state used to require an out-of-band database write, which made
+// enterprise onboarding a support ticket forever (#424). These three operations are the door.
+//
+// They are entity-level operations on a resource that is a ONE-to-ONE COMPOSITION under its scope,
+// so the URL builder omits the id segment and the scope in the path selects the row:
+//   PUT /organizations/{organizationId}/sso-configs/claim-domain
+//   PUT /organizations/{organizationId}/sso-configs/verify-domain
+//   PUT /organizations/{organizationId}/sso-configs/revoke-domain
+export var SsoConfig_Operations;
+(function (SsoConfig_Operations) {
+    SsoConfig_Operations["CLAIM_DOMAIN"] = "claimDomain";
+    SsoConfig_Operations["VERIFY_DOMAIN"] = "verifyDomain";
+    SsoConfig_Operations["REVOKE_DOMAIN"] = "revokeDomain";
+})(SsoConfig_Operations || (SsoConfig_Operations = {}));
+/**
+ * A DNS hostname, syntactically. Two labels minimum — a single label is not a domain anyone can
+ * publish a TXT record under, and accepting one would mint a challenge that can never be answered.
+ *
+ * Case is NOT normalised here. The backend lowercases before every read and every write, because
+ * that is where the stored map keys are decided; doing it in two places would make the request
+ * contract look like the authority when it is not.
+ */
+const SSO_DOMAIN_PATTERN = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))+$/;
+const SsoConfig_DomainSelector = z.string()
+    .min(4)
+    .max(253)
+    .regex(SSO_DOMAIN_PATTERN, 'Provide a DNS hostname with at least two labels, e.g. "customer.com".');
+export const SsoConfig_ClaimDomainRequestDto = z.strictObject({
+    domain: SsoConfig_DomainSelector,
+});
+export const SsoConfig_VerifyDomainRequestDto = z.strictObject({
+    domain: SsoConfig_DomainSelector,
+});
+export const SsoConfig_RevokeDomainRequestDto = z.strictObject({
+    domain: SsoConfig_DomainSelector,
+});
+/**
+ * The claim response is the ONLY disclosure of the challenge nonce.
+ *
+ * `domainVerificationTokens` is `.isBackendOnly()`, so no READ of the config ever returns it — an
+ * operator who loses this response claims again, which mints a new nonce and invalidates the old
+ * one. `.isEphemeral()` marks `dnsRecordValue` as a revealed-once secret, the same contract the
+ * SCIM token mint uses for its one-time plaintext.
+ */
+export const SsoConfig_ClaimDomainResponseDto = z.strictObject({
+    domain: z.string(),
+    status: z.enum(DomainVerificationStatus),
+    /** The DNS name the TXT record goes on: `_wildo-verification.<domain>`. */
+    dnsName: z.string(),
+    /** The exact TXT value to publish. Revealed once. */
+    dnsRecordValue: z.string().isEphemeral(),
+});
+export const SsoConfig_VerifyDomainResponseDto = z.strictObject({
+    domain: z.string(),
+    status: z.enum(DomainVerificationStatus),
+    dnsName: z.string(),
+    /**
+     * Every TXT record found at `dnsName`, so a failed check is diagnosable without a second tool.
+     * These are public DNS records of a domain the caller is claiming to own — echoing them discloses
+     * nothing the caller could not resolve themselves.
+     */
+    dnsRecordsFound: z.array(z.string()),
+});
+export const SsoConfig_RevokeDomainResponseDto = z.strictObject({
+    domain: z.string(),
+    /** True once the domain holds no claim, no status and no nonce in this scope. */
+    revoked: z.boolean(),
+});
 // ── Polymorphic Factory ──────────────────────────────────────────────
 export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurations(ssoConfigPolymorphicDeclaration, {
     isSystemResource: true,
+    customOperation: SsoConfig_Operations,
     // The auth runtime loads the org SSO config via `readAsSystem` during login,
     // before the user's roles/membership are established (READ). When the row is
     // absent — a provisioned / migrated / pre-seed org that bypassed the
@@ -22,11 +95,24 @@ export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurat
     // `AuthOrganizationConfigurationService.loadSSOConfig`. Both are system-context
     // (the logging-in user is not the config's admin owner), so the resource opts
     // BOTH verbs in.
+    //
+    // `list` is the DOMAIN-EXCLUSIVITY probe and nothing else (#424). At most one scope may hold a
+    // domain VERIFIED, or a `@customer.com` sign-in routes non-deterministically to whichever
+    // config the lookup happens to reach first. Answering "does another scope already hold this
+    // domain" is unavoidably a cross-scope read, and the two candidates that avoid this grant are
+    // both worse:
+    //   - `AuthOrganizationConfigurationService.getAllOrganizationIds()` enumerates an IN-MEMORY
+    //     CACHE of scopes whose config has been loaded, so it under-reports on a cold process. An
+    //     exclusivity check built on it answers "nobody else holds it" from an incomplete
+    //     population — the negative-result failure that produces a confident wrong answer;
+    //   - reaching the repository directly bypasses the `systemAccessPolicy` opt-in AND the
+    //     `SYSTEM_CONTEXT_*` audit event, which is a bigger grant wearing a smaller name.
     systemAccessPolicy: {
         read: ResourceSystemAccessMode.ALLOWED,
         create: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
     },
-    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],
+    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],
     operationsConfiguration: {
         [CoreResourceOperation.READ]: {
             variants: [{
@@ -61,13 +147,36 @@ export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurat
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                 }],
         },
+        // Internal-only (INTERNAL_CALL, NO HTTP route): the ONE caller is the domain-exclusivity
+        // probe described on `systemAccessPolicy.list` above, reached through
+        // `SystemAccessService.listAsSystem`. It must NOT be REPOSITORY_ONLY for the same reason the
+        // CREATE and UPDATE below are not: `listAsSystem` resolves the verb through
+        // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL and rejects
+        // REPOSITORY_ONLY. There is deliberately no API_CALL variant — one tenant enumerating every
+        // other tenant's SSO policy is the opposite of what this resource is for, and the probe that
+        // needs the enumeration answers a single yes/no question and returns no row to a caller.
+        // Admin tier / HIGH.
+        [CoreResourceOperation.LIST]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
         // Internal-only (INTERNAL_CALL, NO HTTP route): admin policy edits reach this
         // through the config service path — `AuthOrganizationConfigurationService.saveSSOConfig`
         // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC,
-        // preserving admin audit attribution. `DomainVerificationBackendService` is currently
-        // bound but has no public operation wired to it, so this path is correct-but-dormant. Do
-        // not "simplify" the variant on the theory that nothing calls it: a future real domain
-        // workflow must be able to resolve this INTERNAL_CALL update path.
+        // preserving admin audit attribution. The comment here used to say the path was
+        // "correct-but-dormant" because `DomainVerificationBackendService` had no public operation
+        // wired to it, and warned against "simplifying" the variant on the theory that nothing calls
+        // it. That warning was right and is now moot: the domain workflow it was holding the door
+        // open for exists (`claimDomain` / `verifyDomain` / `revokeDomain` below), and
+        // `initiateDomainVerification` / `verifyDomainOwnership` still reach this INTERNAL_CALL path
+        // for callers that hold no operation.
         // Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via
         // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT
         // REPOSITORY_ONLY — a repository-only UPDATE throws
@@ -108,6 +217,99 @@ export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurat
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                 }],
         },
+        /*
+         * ─── The three domain-ownership doors (#424) ────────────────────────────────────────────
+         *
+         * ## Why the tenant's own admin, and NOT a platform operator
+         *
+         * None of the three declares `admitsCrossTenantPlatformAdministration`, and that is a
+         * decision rather than an omission. A platform operator crossing into a tenant is justified
+         * when the tenant CANNOT act for itself — `organizationMembers.grantOwnership` repairs a
+         * tenant with no owner. Domain ownership is the opposite shape: the party who must prove it
+         * is the party who controls the DNS, and the operator controls neither the DNS nor the
+         * business relationship. A crossing here would let a platform administrator hand one tenant
+         * routing control over every sign-in at a domain, with the tenant's own admins unable to see
+         * why. The ambient reach `.claude/rules/administrative-continuity-floors.md` forbids is
+         * exactly this.
+         *
+         * ## Why each is UPDATE-like
+         *
+         * All three mutate `domains` on the scope's single config row, so they borrow UPDATE and get
+         * a PUT that carries a body. The domain travels in the BODY, never in the URL: a domain name
+         * is a customer identity, and a GET would write it into every access log between the operator
+         * and the server.
+         *
+         * ## Where the work happens
+         *
+         * Each is implemented as a PREFIX that returns the new `domains` object, which the core
+         * UPDATE persists — the organization-units MOVE/ARCHIVE shape. Deliberately NOT `OVERRIDE_ALL`:
+         * that mode returns before the framework's post-operation lane and would therefore emit NO
+         * `RESOURCE_OPERATION_PERFORMED` audit event, which is the one control that makes a
+         * privileged configuration change with cross-tenant reach accountable. See
+         * `sso-config-domain-verification.custom-impl.backend.service.ts`.
+         *
+         * ## What the trail carries
+         *
+         * All three sit at or above `AUTOMATIC_AUDIT_RISK_FLOOR`, so no `auditableEvent` declaration
+         * is needed. `domains.verifiedDomains`, `domains.ssoEnabledDomains` and
+         * `domains.domainVerificationStatus` are `.isAuditEvidence()`, so the row carries the
+         * before/after of the claimed set and the status map — i.e. WHICH domain moved, and to what.
+         * `domains.domainVerificationTokens` is not marked and must never be: it is the challenge
+         * nonce, and the ledger it would land in cannot be scrubbed.
+         *
+         * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a verified domain decides which
+         * identity provider authenticates every principal at that domain.
+         * assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — the domain-ownership trail.
+         */
+        [SsoConfig_Operations.CLAIM_DOMAIN]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    // HIGH, not CRITICAL: a claim grants NOTHING. It records `pending` and mints a nonce, and
+                    // every routing reader gates on `verified`. The step that confers authority is VERIFY.
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: SsoConfig_ClaimDomainRequestDto,
+                    customResponseDto: SsoConfig_ClaimDomainResponseDto,
+                }],
+        },
+        [SsoConfig_Operations.VERIFY_DOMAIN]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    // CRITICAL: this is the transition that hands a tenant SSO routing control over EVERY
+                    // person who signs in with an address at the domain — including people who are not that
+                    // tenant's members.
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: SsoConfig_VerifyDomainRequestDto,
+                    customResponseDto: SsoConfig_VerifyDomainResponseDto,
+                }],
+        },
+        [SsoConfig_Operations.REVOKE_DOMAIN]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    // CRITICAL for the same reason as VERIFY, from the other side: revocation is what makes a
+                    // domain claimable by a different scope, so it is the hinge of every hand-over.
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: SsoConfig_RevokeDomainRequestDto,
+                    customResponseDto: SsoConfig_RevokeDomainResponseDto,
+                }],
+        },
     },
 });
 //# sourceMappingURL=sso-config.shared.resources-config.schemas.js.map