@wildo-ai/saas-models 1.1.2 → 1.1.4

package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,wCAAwC,GACzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAS1H,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACnI,0CAA0C,CAIxC;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;OAKG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,kCAAkC,CAAC,cAAc,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;qBACjE,CAAC;iBACH;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,kCAAkC,CAAC,OAAO,CAAC,EAAE;YAC5C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,CACpD,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,wCAAwC,CAAC;4BAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;4BAC5C,cAAc,EAAE,YAAY,EAAE,MAAM;yBACrC,CAAC;iBACL;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,kCAAkC,CAAC,IAAI,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,mIAAmI;QACnI,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;KACF;IACD,4FAA4F;IAC5F,0FAA0F;CAC3F,CAAC,CAAC","sourcesContent":["/**\n * Application Access Grants — resource configuration.\n *\n * The operation set mirrors `platformAccessGrants` verb for verb, and the ONE difference is the whole\n * feature: `approve` is gated on the PLATFORM's own administrators rather than a tenant's, and refuses\n * the requester. On the tenant resource the ABSENCE of `admitsCrossTenantPlatformAdministration` on\n * `approve` is what stops an operator approving their own request; here every verb is platform-tier by\n * construction, so that absence buys nothing and the refusal has to be a MEASUREMENT the\n * implementation makes — `applicationAccessGrantApproverIsDistinct`.\n *\n * See `application-access-grants.shared.schemas.ts` for why the resource exists and why it is a\n * sibling type rather than a field, and `.claude/rules/administrative-continuity-floors.md` for the\n * ladder it sits on.\n */\n\nimport { z } from 'zod';\nimport {\n  ApplicationAccessGrantSchema,\n  ApplicationAccessGrants_Operations,\n  applicationAccessGrantApproverIsDistinct,\n} from './application-access-grants.shared.schemas';\nimport { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\ntype ApplicationAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const applicationAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ApplicationAccessGrants_Operations,\n    ApplicationAccessGrantsCoreOperations,\n    typeof ApplicationAccessGrantSchema\n  >({\n    mainSchema: ApplicationAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.APPLICATION_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` ALLOWED for the trusted path, and for exactly the reason the tenant resource\n     * allows them: the authorization layer itself resolves a caller's usable grant on a system\n     * context, before the caller's own authority has been established for the read it is gating.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the two-person measurement. A system door around those would be a second way to mint an\n     * application-wide elevation, which is the one thing this resource exists to prevent.\n     *\n     * `exportSubject: FORBIDDEN`, mirrored from the tenant resource. `operatorUserId` and\n     * `approvedByUserId` are foreign keys back to USERS, so these rows sit on a user's Art. 15 graph\n     * as `INCLUDED_REFERENCES_SUBJECT`; an included resource carrying NO declaration REFUSES the whole\n     * export, so omitting this would trade a boot failure for a broken disclosure right. FORBIDDEN\n     * because this is a security-monitoring record and handing the monitoring trail to the person it\n     * monitors is self-defeating — and because it names ANOTHER data subject's decision (the second\n     * administrator), which Art. 15(4) protects.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text — mirrored from the tenant resource\n     * because it is the same kind of record. What survives is WHO reached application-wide, WHEN, and\n     * who signed for it; what does not is `justification` and `decisionReason`, the operator- and\n     * approver-written prose most likely to name a third party in passing.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these revokes NO session: the grant is a record ABOUT an operator's access, not\n     * the operator. Their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be\n       * REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize\n       * writer uses to stamp markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      /**\n       * The pending queue a second administrator works from, and the record of what was granted.\n       *\n       * `APP_ADMIN_SUPER_ADMIN` on every read: the rows name operator reach across every tenant, and\n       * there is no tenant-side reader here as there is on the platform resource — an application-wide\n       * grant has no customer to show it to. That absence is precisely why the approval had to become\n       * a second signature.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb.\n       *\n       * Note what it deliberately does NOT declare: `admitsCrossTenantPlatformAdministration`. On the\n       * tenant resource that flag is what lets a non-member operator write a row inside someone else's\n       * tenant, and `requestAccess` there is exempted from the grant requirement it bootstraps. Here\n       * the resource is APPLICATION-scoped — there is no tenant boundary to cross — so the flag would\n       * be meaningless and the exemption has a different shape: the ADMISSION gate exempts this\n       * resource entirely, because an operator would otherwise need an application-wide grant in order\n       * to ask for one.\n       *\n       * What keeps that safe is the same argument the tenant resource makes: requesting is not\n       * accessing. This writes one PENDING row and reads nothing. The blast radius of an abused\n       * request is an entry in a queue that another administrator must sign.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — application-wide reach is\n       * requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [ApplicationAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 1h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional(),\n            }),\n          },\n        ],\n      },\n\n      /**\n       * The SECOND SIGNATURE.\n       *\n       * `enabledCondition` refuses a self-approval here as well as in the implementation, and the\n       * duplication is deliberate rather than redundant — they are two different guarantees. This one\n       * makes the affordance DISAPPEAR for the requester, so a platform console never renders an\n       * Approve button on one's own request; the implementation's `assert…` is the fail-closed half,\n       * because `enabledCondition` is evaluated against the row the framework fetched and a future\n       * variant authored without one would otherwise transition silently.\n       *\n       * Neutering either alone must not admit a self-approval. That is what the two pins assert.\n       *\n       * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation requires\n       * a second, distinct platform administrator's signature.\n       */\n      [ApplicationAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject, initiatorIds }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              && applicationAccessGrantApproverIsDistinct({\n                operatorUserId: currentObject.operatorUserId,\n                approverUserId: initiatorIds?.userId,\n              }),\n          },\n        ],\n      },\n\n      /**\n       * Refusing a request. NOT gated on being a different person: an operator who thinks better of\n       * their own request should be able to withdraw it, and a denial only ever removes authority.\n       * The two-person rule constrains what an operator can GRANT themselves, never what they can\n       * refuse themselves.\n       */\n      [ApplicationAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /** Ending an elevation early. Monotonic — it only ever removes authority — so it is unrestricted among platform administrators. */\n      [ApplicationAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n\n      /**\n       * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and by\n       * nothing else. INTERNAL_CALL: no route, no affordance.\n       *\n       * `requestDto: z.object({})` is EMPTY BY CONTRACT, not by omission — an operation without a\n       * `requestDto` inherits the resource's entire update contract, which would let a verb that\n       * accepts nothing advertise every field, `status` included.\n       */\n      [ApplicationAccessGrants_Operations.EXPIRE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({}),\n          },\n        ],\n      },\n    },\n    // NOTE: the APPLICATION primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (APPLICATION → APPLICATION_ACCESS_GRANTS).\n  });\n"]}

package/dist/esm/security/authorizations/application-access-grants.shared.schemas.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Application Access Grants — time-bound, justified, TWO-PERSON-APPROVED elevation for an operator
+ * act that names no single tenant.
+ *
+ * ## The asymmetry this closes
+ *
+ * `platformAccessGrants` governs the NARROW act: one operator, one named tenant, one window. It is
+ * the door `.claude/rules/administrative-continuity-floors.md` calls rungs 4–5 of the ladder, and it
+ * works.
+ *
+ * The WIDE act was ungoverned. Measured 2026-09-09 and recorded on
+ * `ScopeRootConfinementDisposition.UNCONFINED_APPLICATION_TIER_DIRECTORY`:
+ *
+ * | | per-row crossing | application-wide read |
+ * |---|---|---|
+ * | elevation required | a usable `platformAccessGrants` row | **none** |
+ * | role tier | `APP_ADMIN_SUPER_ADMIN` | `APP_ADMIN_VIEWER` / `ORG_MEMBER` |
+ * | evidence | `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, naming the grant | an observation naming no elevation |
+ *
+ * So the narrow act carried elevation and expiry and the widest read did not — and the wide one sat
+ * at a strictly LOWER role tier. That is worse than "not symmetric"; it is the control inverted.
+ *
+ * ## Why a SEPARATE resource and not a `scope` field on the tenant grant
+ *
+ * Structural, not stylistic. A `platformAccessGrants` row is ORGANIZATIONS-scoped: its primary-scope
+ * relationship carries `isPrimaryScope: true` on `organizationId`, every route is
+ * `/organizations/{organizationId}/platform-access-grants/…`, and the tenant's ability to SEE and
+ * REVOKE the row is exactly what that scope buys. An application-wide elevation names no tenant, so
+ * the route has nothing to carry and the scope has nobody to serve. Adding a nullable
+ * `organizationId` to make one row shape serve both would weaken the field whose presence IS the
+ * tenant grant's control — which the finding explicitly refuses ("do not weaken the per-row model to
+ * make the two symmetric").
+ *
+ * The engine's own precedent for a second scope over one lifecycle is `applicationAuditLogs` beside
+ * `auditLogs`: a sibling resource type carrying ONE application parent, taking the route it needs and
+ * leaving the existing door byte-identical.
+ *
+ * ## Why TWO-PERSON, and what was rejected
+ *
+ * Tenant approval is the industry ceiling (Microsoft Customer Lockbox, Google Access Approval) and it
+ * is structurally unavailable here: there is no single customer to ask. `administrative-continuity-floors.md`
+ * names the next-strongest control in as many words — *"a second factor authenticates a session; only
+ * a second signature constrains an authenticated operator"* — and asks for a two-person rule on the
+ * widest acts.
+ *
+ * Auto-approval was rejected: it is the tenant grant's default posture precisely BECAUSE a tenant can
+ * opt in above it, and there is no such party here, so an auto-approved application-wide grant would
+ * be a standing privilege with a request form in front of it.
+ *
+ * Confining the read to tenants the caller holds a grant for was rejected on MEASUREMENT rather than
+ * cost: `users` rows carry no tenant column at all, so there is nothing for a tenant predicate to
+ * bind to, and any junction-based confinement would also remove the tenant-less user — the person who
+ * has just signed up and belongs to nobody — from the only surface that can find them.
+ */
+import { z } from 'zod';
+import { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';
+/**
+ * The default life of an application-wide grant whose request names no duration.
+ *
+ * THIRTY minutes — half the tenant grant's default, and the halving is the point rather than a round
+ * number. A tenant grant reaches ONE customer and the customer can see and revoke it; this one
+ * reaches every customer at once and no customer can see it. The window is the only thing that ends
+ * it early, so the unconsidered case gets the narrowest window a support interaction can still use.
+ */
+export declare const APPLICATION_ACCESS_GRANT_DEFAULT_DURATION_MINUTES = 30;
+/**
+ * The maximum life of an application-wide grant, whatever a request asks for.
+ *
+ * ONE HOUR against the tenant grant's four. A four-hour window is defended there as "a working
+ * session, not a working week" for an elevation into one tenant; the same reasoning gives a shorter
+ * answer for an elevation into all of them. An operator who genuinely needs longer re-requests, and
+ * a second administrator signs again — which is the record we want, and the reason a shorter ceiling
+ * here costs no security and buys a second signature per hour of the widest access the system grants.
+ */
+export declare const APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES = 60;
+/**
+ * Custom verbs. Mirrors `PlatformAccessGrants_Operations` deliberately — the same lifecycle,
+ * so the same verbs, so a reader who knows one knows the other.
+ *
+ * There is no ordinary CREATE/UPDATE for the same reason: they would be a second, ungated path to the
+ * server-authored fields whose server authorship IS the control.
+ */
+export declare enum ApplicationAccessGrants_Operations {
+    /**
+     * The bootstrap verb. Writes one row in `PENDING_APPROVAL` and NEVER in `ACTIVE` — see
+     * the `status` field below for why auto-approval has no member here.
+     */
+    REQUEST_ACCESS = "requestAccess",
+    /** The SECOND administrator's signature. Refuses the requester — {@link applicationAccessGrantApproverIsDistinct}. */
+    APPROVE = "approve",
+    DENY = "deny",
+    REVOKE = "revoke",
+    /** ACTIVE → EXPIRED, dispatched by the credential-expiry sweep and by nothing else. */
+    EXPIRE = "expire"
+}
+export declare const ApplicationAccessGrantSchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
+    operatorUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    justification: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof PlatformAccessGrantStatus>>>>>>>>;
+    expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>>>;
+    approvedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>>;
+    approvedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    decisionReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>;
+export type ApplicationAccessGrant = z.infer<typeof ApplicationAccessGrantSchema>;
+/**
+ * Clamp a requested duration to the application-wide ceiling.
+ *
+ * A deliberate near-copy of `resolvePlatformAccessGrantExpiry` rather than a shared function taking
+ * two constants: the two ceilings are two DECISIONS about two different acts, and a shared helper
+ * invites the next author to pass whichever constant is in scope. The behaviour that matters is
+ * identical and stated in both places — a longer ask is CLAMPED, never refused, because being told
+ * "ask again with a smaller number" during an incident is friction with no security benefit.
+ */
+export declare function resolveApplicationAccessGrantExpiry(requestedDurationMinutes: number | undefined, now: Date): Date;
+/**
+ * Is this approver a DIFFERENT person from the operator who asked?
+ *
+ * **This predicate is the two-person rule.** Everything else about an application-wide grant — the
+ * request, the window, the justification, the audit row — exists in the tenant grant too. What is new
+ * here is exactly this comparison, so it is named, exported, and asked in ONE place.
+ *
+ * ## Why it is a predicate and not an inline `!==`
+ *
+ * Three call sites would otherwise each write their own comparison, and two of the three ways to
+ * write it are wrong in the same direction:
+ *
+ *  - an approver id that is ABSENT must NOT pass. An unauthenticated or system-context approval has
+ *    no second person behind it, and `undefined !== 'operator'` is `true` — the inline form fails
+ *    OPEN on precisely the input a broken context supplies;
+ *  - an operator id that is absent must not pass either, for the mirror reason.
+ *
+ * So the predicate requires BOTH ids to be present and different. Fails closed on everything else.
+ */
+export declare function applicationAccessGrantApproverIsDistinct(params: {
+    readonly operatorUserId: string | undefined | null;
+    readonly approverUserId: string | undefined | null;
+}): boolean;
+//# sourceMappingURL=application-access-grants.shared.schemas.d.ts.map

package/dist/esm/security/authorizations/application-access-grants.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-access-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAKpF;;;;;;;GAOG;AACH,eAAO,MAAM,iDAAiD,KAAK,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,iDAAiD,KAAK,CAAC;AAEpE;;;;;;GAMG;AACH,oBAAY,kCAAkC;IAC5C;;;OAGG;IACH,cAAc,kBAAkB;IAChC,sHAAsH;IACtH,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,uFAAuF;IACvF,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,4BAA4B;;;;;;;;;;;;iBAyFvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAMjH;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE;IAC/D,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;CACpD,GAAG,OAAO,CAKV"}

package/dist/esm/security/authorizations/application-access-grants.shared.schemas.js

@@ -0,0 +1,219 @@
+/**
+ * Application Access Grants — time-bound, justified, TWO-PERSON-APPROVED elevation for an operator
+ * act that names no single tenant.
+ *
+ * ## The asymmetry this closes
+ *
+ * `platformAccessGrants` governs the NARROW act: one operator, one named tenant, one window. It is
+ * the door `.claude/rules/administrative-continuity-floors.md` calls rungs 4–5 of the ladder, and it
+ * works.
+ *
+ * The WIDE act was ungoverned. Measured 2026-09-09 and recorded on
+ * `ScopeRootConfinementDisposition.UNCONFINED_APPLICATION_TIER_DIRECTORY`:
+ *
+ * | | per-row crossing | application-wide read |
+ * |---|---|---|
+ * | elevation required | a usable `platformAccessGrants` row | **none** |
+ * | role tier | `APP_ADMIN_SUPER_ADMIN` | `APP_ADMIN_VIEWER` / `ORG_MEMBER` |
+ * | evidence | `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, naming the grant | an observation naming no elevation |
+ *
+ * So the narrow act carried elevation and expiry and the widest read did not — and the wide one sat
+ * at a strictly LOWER role tier. That is worse than "not symmetric"; it is the control inverted.
+ *
+ * ## Why a SEPARATE resource and not a `scope` field on the tenant grant
+ *
+ * Structural, not stylistic. A `platformAccessGrants` row is ORGANIZATIONS-scoped: its primary-scope
+ * relationship carries `isPrimaryScope: true` on `organizationId`, every route is
+ * `/organizations/{organizationId}/platform-access-grants/…`, and the tenant's ability to SEE and
+ * REVOKE the row is exactly what that scope buys. An application-wide elevation names no tenant, so
+ * the route has nothing to carry and the scope has nobody to serve. Adding a nullable
+ * `organizationId` to make one row shape serve both would weaken the field whose presence IS the
+ * tenant grant's control — which the finding explicitly refuses ("do not weaken the per-row model to
+ * make the two symmetric").
+ *
+ * The engine's own precedent for a second scope over one lifecycle is `applicationAuditLogs` beside
+ * `auditLogs`: a sibling resource type carrying ONE application parent, taking the route it needs and
+ * leaving the existing door byte-identical.
+ *
+ * ## Why TWO-PERSON, and what was rejected
+ *
+ * Tenant approval is the industry ceiling (Microsoft Customer Lockbox, Google Access Approval) and it
+ * is structurally unavailable here: there is no single customer to ask. `administrative-continuity-floors.md`
+ * names the next-strongest control in as many words — *"a second factor authenticates a session; only
+ * a second signature constrains an authenticated operator"* — and asks for a two-person rule on the
+ * widest acts.
+ *
+ * Auto-approval was rejected: it is the tenant grant's default posture precisely BECAUSE a tenant can
+ * opt in above it, and there is no such party here, so an auto-approved application-wide grant would
+ * be a standing privilege with a request form in front of it.
+ *
+ * Confining the read to tenants the caller holds a grant for was rejected on MEASUREMENT rather than
+ * cost: `users` rows carry no tenant column at all, so there is nothing for a tenant predicate to
+ * bind to, and any junction-based confinement would also remove the tenant-less user — the person who
+ * has just signed up and belongs to nobody — from the only surface that can find them.
+ */
+import { z } from 'zod';
+import { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas.js';
+import { RedactionType } from '../../compliance/privacy/redaction.shared.schemas.js';
+import { addImpersonalizeWith } from '@wildo-ai/zod-decorators';
+import { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas.js';
+/** Fixed replacement for grant free-text that cannot be cleared (a `.min(1)` field). */
+const ERASED_GRANT_TEXT = '[erased]';
+/**
+ * The default life of an application-wide grant whose request names no duration.
+ *
+ * THIRTY minutes — half the tenant grant's default, and the halving is the point rather than a round
+ * number. A tenant grant reaches ONE customer and the customer can see and revoke it; this one
+ * reaches every customer at once and no customer can see it. The window is the only thing that ends
+ * it early, so the unconsidered case gets the narrowest window a support interaction can still use.
+ */
+export const APPLICATION_ACCESS_GRANT_DEFAULT_DURATION_MINUTES = 30;
+/**
+ * The maximum life of an application-wide grant, whatever a request asks for.
+ *
+ * ONE HOUR against the tenant grant's four. A four-hour window is defended there as "a working
+ * session, not a working week" for an elevation into one tenant; the same reasoning gives a shorter
+ * answer for an elevation into all of them. An operator who genuinely needs longer re-requests, and
+ * a second administrator signs again — which is the record we want, and the reason a shorter ceiling
+ * here costs no security and buys a second signature per hour of the widest access the system grants.
+ */
+export const APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES = 60;
+/**
+ * Custom verbs. Mirrors `PlatformAccessGrants_Operations` deliberately — the same lifecycle,
+ * so the same verbs, so a reader who knows one knows the other.
+ *
+ * There is no ordinary CREATE/UPDATE for the same reason: they would be a second, ungated path to the
+ * server-authored fields whose server authorship IS the control.
+ */
+export var ApplicationAccessGrants_Operations;
+(function (ApplicationAccessGrants_Operations) {
+    /**
+     * The bootstrap verb. Writes one row in `PENDING_APPROVAL` and NEVER in `ACTIVE` — see
+     * the `status` field below for why auto-approval has no member here.
+     */
+    ApplicationAccessGrants_Operations["REQUEST_ACCESS"] = "requestAccess";
+    /** The SECOND administrator's signature. Refuses the requester — {@link applicationAccessGrantApproverIsDistinct}. */
+    ApplicationAccessGrants_Operations["APPROVE"] = "approve";
+    ApplicationAccessGrants_Operations["DENY"] = "deny";
+    ApplicationAccessGrants_Operations["REVOKE"] = "revoke";
+    /** ACTIVE → EXPIRED, dispatched by the credential-expiry sweep and by nothing else. */
+    ApplicationAccessGrants_Operations["EXPIRE"] = "expire";
+})(ApplicationAccessGrants_Operations || (ApplicationAccessGrants_Operations = {}));
+export const ApplicationAccessGrantSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /**
+     * The primary-scope parent — the deployment this elevation is inside.
+     *
+     * OPTIONAL, and that is a load-bearing copy of `applicationAuditLogs`' own shape rather than a
+     * looseness: declared MANDATORY the resource does not load at all on a Mongo-persisted deployment
+     * (the ZodToMongoose convertor refuses it and INIT dies on `zod_converter_schema_conversion_failed`).
+     * Addressing is carried by `isPrimaryScope` + `REQUIRES_CONTEXT` on the relationship, which is what
+     * the URL builder reads, so the route is identical either way.
+     */
+    applicationId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),
+    /** The operator who requested the elevation. Server-authored from the session, never client-supplied. */
+    operatorUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    /**
+     * Why the operator needs application-wide reach. REQUIRED, like its tenant sibling, and here it
+     * carries more weight: it is the ONLY thing the approving administrator has to decide on. A tenant
+     * grant's approver knows their own tenant and their own support case; this approver knows nothing
+     * but this sentence.
+     */
+    // USER_CONTENT — free prose an OPERATOR typed. MASK rather than REMOVE on erasure: `.min(1)` makes
+    // it non-clearable, so a null would be rejected by the strict update-DTO parse the impersonalize
+    // writer runs, and a fixed non-empty string is accepted.
+    justification: addImpersonalizeWith(z.string().min(1).max(1000).isSummaryField()
+        .dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.MASK, { maskValue: ERASED_GRANT_TEXT }),
+    /**
+     * Lifecycle position, sharing {@link PlatformAccessGrantStatus} rather than declaring a parallel
+     * vocabulary — the states really are the same states, and two enums holding the same five members
+     * is how a sweep, a predicate and a UI come to disagree about what `active` means.
+     *
+     * ## The member that is UNREACHABLE here, and why that is the control
+     *
+     * Every application-wide grant starts `PENDING_APPROVAL`. There is no auto-approval path and
+     * therefore no `autoApprovalReason` field: the tenant grant auto-approves when the tenant has not
+     * opted into approval, or cannot approve — both are statements about a NAMED tenant, and this row
+     * names none. A grant that could approve itself would make the two-person rule ceremonial, which is
+     * exactly the criticism `approve` on the tenant resource carries against platform self-approval.
+     */
+    status: z.enum(PlatformAccessGrantStatus)
+        .systemEnum('PlatformAccessGrantStatus')
+        .default(PlatformAccessGrantStatus.PENDING_APPROVAL)
+        .isDBIndexed()
+        .isSummaryField()
+        .excludeFromCreate()
+        .excludeFromUpdate()
+        .isAuditEvidence(),
+    /**
+     * When the elevation stops working.
+     *
+     * Server-authored from the requested duration, clamped to
+     * {@link APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES}. The admission predicate reads THIS
+     * field and not `status`, so expiry needs no sweeper to take effect — the same separation the
+     * tenant grant keeps, and for the same reason: if admission ever starts reading the label, a
+     * lagging sweep becomes an authorization hole rather than a stale display.
+     */
+    expiresAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    /**
+     * The SECOND administrator. Present on every `ACTIVE` row, by construction.
+     *
+     * Optional in the SCHEMA because it is unset while the request is pending and stays unset on a
+     * denied or revoked one. It is not optional in the LIFECYCLE: the only writer of
+     * `status = ACTIVE` is `approve`, and `approve` refuses when this would equal `operatorUserId`.
+     * That refusal is the two-person rule, and it lives in one predicate
+     * ({@link applicationAccessGrantApproverIsDistinct}) so no second call site can re-derive it
+     * more leniently.
+     */
+    approvedByUserId: z.string().min(1).optional().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
+    approvedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),
+    /** The approver's reason for refusing, or the revoker's reason for withdrawing. */
+    // REMOVE — free text again, and clearable (`.optional()`).
+    decisionReason: addImpersonalizeWith(z.string().max(1000).optional().excludeFromCreate().excludeFromUpdate()
+        .dataCategories(PersonalDataCategory.USER_CONTENT), RedactionType.REMOVE),
+    createdAt: z.date().optional(),
+    updatedAt: z.date().optional(),
+});
+/**
+ * Clamp a requested duration to the application-wide ceiling.
+ *
+ * A deliberate near-copy of `resolvePlatformAccessGrantExpiry` rather than a shared function taking
+ * two constants: the two ceilings are two DECISIONS about two different acts, and a shared helper
+ * invites the next author to pass whichever constant is in scope. The behaviour that matters is
+ * identical and stated in both places — a longer ask is CLAMPED, never refused, because being told
+ * "ask again with a smaller number" during an incident is friction with no security benefit.
+ */
+export function resolveApplicationAccessGrantExpiry(requestedDurationMinutes, now) {
+    const requested = requestedDurationMinutes && requestedDurationMinutes > 0
+        ? requestedDurationMinutes
+        : APPLICATION_ACCESS_GRANT_DEFAULT_DURATION_MINUTES;
+    const minutes = Math.min(requested, APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES);
+    return new Date(now.getTime() + minutes * 60_000);
+}
+/**
+ * Is this approver a DIFFERENT person from the operator who asked?
+ *
+ * **This predicate is the two-person rule.** Everything else about an application-wide grant — the
+ * request, the window, the justification, the audit row — exists in the tenant grant too. What is new
+ * here is exactly this comparison, so it is named, exported, and asked in ONE place.
+ *
+ * ## Why it is a predicate and not an inline `!==`
+ *
+ * Three call sites would otherwise each write their own comparison, and two of the three ways to
+ * write it are wrong in the same direction:
+ *
+ *  - an approver id that is ABSENT must NOT pass. An unauthenticated or system-context approval has
+ *    no second person behind it, and `undefined !== 'operator'` is `true` — the inline form fails
+ *    OPEN on precisely the input a broken context supplies;
+ *  - an operator id that is absent must not pass either, for the mirror reason.
+ *
+ * So the predicate requires BOTH ids to be present and different. Fails closed on everything else.
+ */
+export function applicationAccessGrantApproverIsDistinct(params) {
+    const operator = String(params.operatorUserId ?? '');
+    const approver = String(params.approverUserId ?? '');
+    if (!operator || !approver)
+        return false;
+    return operator !== approver;
+}
+//# sourceMappingURL=application-access-grants.shared.schemas.js.map

package/dist/esm/security/authorizations/application-access-grants.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-access-grants.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,EAAE,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,EAAE,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,kCAYX;AAZD,WAAY,kCAAkC;IAC5C;;;OAGG;IACH,sEAAgC,CAAA;IAChC,sHAAsH;IACtH,yDAAmB,CAAA;IACnB,mDAAa,CAAA;IACb,uDAAiB,CAAA;IACjB,uFAAuF;IACvF,uDAAiB,CAAA;AACnB,CAAC,EAZW,kCAAkC,KAAlC,kCAAkC,QAY7C;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE9G,yGAAyG;IACzG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzI;;;;;OAKG;IACH,mGAAmG;IACnG,iGAAiG;IACjG,yDAAyD;IACzD,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;SAC3C,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;SACtC,UAAU,CAAC,2BAA2B,CAAC;SACvC,OAAO,CAAC,yBAAyB,CAAC,gBAAgB,CAAC;SACnD,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE5G;;;;;;;;;OASG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACxI,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEvE,mFAAmF;IACnF,2DAA2D;IAC3D,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACtE,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,MAAM,CACrB;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,wBAA4C,EAAE,GAAS;IACzG,MAAM,SAAS,GAAG,wBAAwB,IAAI,wBAAwB,GAAG,CAAC;QACxE,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,iDAAiD,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,iDAAiD,CAAC,CAAC;IACvF,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wCAAwC,CAAC,MAGxD;IACC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,QAAQ,KAAK,QAAQ,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * Application Access Grants — time-bound, justified, TWO-PERSON-APPROVED elevation for an operator\n * act that names no single tenant.\n *\n * ## The asymmetry this closes\n *\n * `platformAccessGrants` governs the NARROW act: one operator, one named tenant, one window. It is\n * the door `.claude/rules/administrative-continuity-floors.md` calls rungs 4–5 of the ladder, and it\n * works.\n *\n * The WIDE act was ungoverned. Measured 2026-09-09 and recorded on\n * `ScopeRootConfinementDisposition.UNCONFINED_APPLICATION_TIER_DIRECTORY`:\n *\n * | | per-row crossing | application-wide read |\n * |---|---|---|\n * | elevation required | a usable `platformAccessGrants` row | **none** |\n * | role tier | `APP_ADMIN_SUPER_ADMIN` | `APP_ADMIN_VIEWER` / `ORG_MEMBER` |\n * | evidence | `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, naming the grant | an observation naming no elevation |\n *\n * So the narrow act carried elevation and expiry and the widest read did not — and the wide one sat\n * at a strictly LOWER role tier. That is worse than \"not symmetric\"; it is the control inverted.\n *\n * ## Why a SEPARATE resource and not a `scope` field on the tenant grant\n *\n * Structural, not stylistic. A `platformAccessGrants` row is ORGANIZATIONS-scoped: its primary-scope\n * relationship carries `isPrimaryScope: true` on `organizationId`, every route is\n * `/organizations/{organizationId}/platform-access-grants/…`, and the tenant's ability to SEE and\n * REVOKE the row is exactly what that scope buys. An application-wide elevation names no tenant, so\n * the route has nothing to carry and the scope has nobody to serve. Adding a nullable\n * `organizationId` to make one row shape serve both would weaken the field whose presence IS the\n * tenant grant's control — which the finding explicitly refuses (\"do not weaken the per-row model to\n * make the two symmetric\").\n *\n * The engine's own precedent for a second scope over one lifecycle is `applicationAuditLogs` beside\n * `auditLogs`: a sibling resource type carrying ONE application parent, taking the route it needs and\n * leaving the existing door byte-identical.\n *\n * ## Why TWO-PERSON, and what was rejected\n *\n * Tenant approval is the industry ceiling (Microsoft Customer Lockbox, Google Access Approval) and it\n * is structurally unavailable here: there is no single customer to ask. `administrative-continuity-floors.md`\n * names the next-strongest control in as many words — *\"a second factor authenticates a session; only\n * a second signature constrains an authenticated operator\"* — and asks for a two-person rule on the\n * widest acts.\n *\n * Auto-approval was rejected: it is the tenant grant's default posture precisely BECAUSE a tenant can\n * opt in above it, and there is no such party here, so an auto-approved application-wide grant would\n * be a standing privilege with a request form in front of it.\n *\n * Confining the read to tenants the caller holds a grant for was rejected on MEASUREMENT rather than\n * cost: `users` rows carry no tenant column at all, so there is nothing for a tenant predicate to\n * bind to, and any junction-based confinement would also remove the tenant-less user — the person who\n * has just signed up and belongs to nobody — from the only surface that can find them.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';\n\n/** Fixed replacement for grant free-text that cannot be cleared (a `.min(1)` field). */\nconst ERASED_GRANT_TEXT = '[erased]';\n\n/**\n * The default life of an application-wide grant whose request names no duration.\n *\n * THIRTY minutes — half the tenant grant's default, and the halving is the point rather than a round\n * number. A tenant grant reaches ONE customer and the customer can see and revoke it; this one\n * reaches every customer at once and no customer can see it. The window is the only thing that ends\n * it early, so the unconsidered case gets the narrowest window a support interaction can still use.\n */\nexport const APPLICATION_ACCESS_GRANT_DEFAULT_DURATION_MINUTES = 30;\n\n/**\n * The maximum life of an application-wide grant, whatever a request asks for.\n *\n * ONE HOUR against the tenant grant's four. A four-hour window is defended there as \"a working\n * session, not a working week\" for an elevation into one tenant; the same reasoning gives a shorter\n * answer for an elevation into all of them. An operator who genuinely needs longer re-requests, and\n * a second administrator signs again — which is the record we want, and the reason a shorter ceiling\n * here costs no security and buys a second signature per hour of the widest access the system grants.\n */\nexport const APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES = 60;\n\n/**\n * Custom verbs. Mirrors `PlatformAccessGrants_Operations` deliberately — the same lifecycle,\n * so the same verbs, so a reader who knows one knows the other.\n *\n * There is no ordinary CREATE/UPDATE for the same reason: they would be a second, ungated path to the\n * server-authored fields whose server authorship IS the control.\n */\nexport enum ApplicationAccessGrants_Operations {\n  /**\n   * The bootstrap verb. Writes one row in `PENDING_APPROVAL` and NEVER in `ACTIVE` — see\n   * the `status` field below for why auto-approval has no member here.\n   */\n  REQUEST_ACCESS = 'requestAccess',\n  /** The SECOND administrator's signature. Refuses the requester — {@link applicationAccessGrantApproverIsDistinct}. */\n  APPROVE = 'approve',\n  DENY = 'deny',\n  REVOKE = 'revoke',\n  /** ACTIVE → EXPIRED, dispatched by the credential-expiry sweep and by nothing else. */\n  EXPIRE = 'expire',\n}\n\nexport const ApplicationAccessGrantSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The primary-scope parent — the deployment this elevation is inside.\n   *\n   * OPTIONAL, and that is a load-bearing copy of `applicationAuditLogs`' own shape rather than a\n   * looseness: declared MANDATORY the resource does not load at all on a Mongo-persisted deployment\n   * (the ZodToMongoose convertor refuses it and INIT dies on `zod_converter_schema_conversion_failed`).\n   * Addressing is carried by `isPrimaryScope` + `REQUIRES_CONTEXT` on the relationship, which is what\n   * the URL builder reads, so the route is identical either way.\n   */\n  applicationId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),\n\n  /** The operator who requested the elevation. Server-authored from the session, never client-supplied. */\n  operatorUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * Why the operator needs application-wide reach. REQUIRED, like its tenant sibling, and here it\n   * carries more weight: it is the ONLY thing the approving administrator has to decide on. A tenant\n   * grant's approver knows their own tenant and their own support case; this approver knows nothing\n   * but this sentence.\n   */\n  // USER_CONTENT — free prose an OPERATOR typed. MASK rather than REMOVE on erasure: `.min(1)` makes\n  // it non-clearable, so a null would be rejected by the strict update-DTO parse the impersonalize\n  // writer runs, and a fixed non-empty string is accepted.\n  justification: addImpersonalizeWith(\n    z.string().min(1).max(1000).isSummaryField()\n    .dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.MASK,\n    { maskValue: ERASED_GRANT_TEXT },\n  ),\n\n  /**\n   * Lifecycle position, sharing {@link PlatformAccessGrantStatus} rather than declaring a parallel\n   * vocabulary — the states really are the same states, and two enums holding the same five members\n   * is how a sweep, a predicate and a UI come to disagree about what `active` means.\n   *\n   * ## The member that is UNREACHABLE here, and why that is the control\n   *\n   * Every application-wide grant starts `PENDING_APPROVAL`. There is no auto-approval path and\n   * therefore no `autoApprovalReason` field: the tenant grant auto-approves when the tenant has not\n   * opted into approval, or cannot approve — both are statements about a NAMED tenant, and this row\n   * names none. A grant that could approve itself would make the two-person rule ceremonial, which is\n   * exactly the criticism `approve` on the tenant resource carries against platform self-approval.\n   */\n  status: z.enum(PlatformAccessGrantStatus)\n    .systemEnum('PlatformAccessGrantStatus')\n    .default(PlatformAccessGrantStatus.PENDING_APPROVAL)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /**\n   * When the elevation stops working.\n   *\n   * Server-authored from the requested duration, clamped to\n   * {@link APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES}. The admission predicate reads THIS\n   * field and not `status`, so expiry needs no sweeper to take effect — the same separation the\n   * tenant grant keeps, and for the same reason: if admission ever starts reading the label, a\n   * lagging sweep becomes an authorization hole rather than a stale display.\n   */\n  expiresAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * The SECOND administrator. Present on every `ACTIVE` row, by construction.\n   *\n   * Optional in the SCHEMA because it is unset while the request is pending and stays unset on a\n   * denied or revoked one. It is not optional in the LIFECYCLE: the only writer of\n   * `status = ACTIVE` is `approve`, and `approve` refuses when this would equal `operatorUserId`.\n   * That refusal is the two-person rule, and it lives in one predicate\n   * ({@link applicationAccessGrantApproverIsDistinct}) so no second call site can re-derive it\n   * more leniently.\n   */\n  approvedByUserId: z.string().min(1).optional().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  approvedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n\n  /** The approver's reason for refusing, or the revoker's reason for withdrawing. */\n  // REMOVE — free text again, and clearable (`.optional()`).\n  decisionReason: addImpersonalizeWith(\n    z.string().max(1000).optional().excludeFromCreate().excludeFromUpdate()\n    .dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\n\nexport type ApplicationAccessGrant = z.infer<typeof ApplicationAccessGrantSchema>;\n\n/**\n * Clamp a requested duration to the application-wide ceiling.\n *\n * A deliberate near-copy of `resolvePlatformAccessGrantExpiry` rather than a shared function taking\n * two constants: the two ceilings are two DECISIONS about two different acts, and a shared helper\n * invites the next author to pass whichever constant is in scope. The behaviour that matters is\n * identical and stated in both places — a longer ask is CLAMPED, never refused, because being told\n * \"ask again with a smaller number\" during an incident is friction with no security benefit.\n */\nexport function resolveApplicationAccessGrantExpiry(requestedDurationMinutes: number | undefined, now: Date): Date {\n  const requested = requestedDurationMinutes && requestedDurationMinutes > 0\n    ? requestedDurationMinutes\n    : APPLICATION_ACCESS_GRANT_DEFAULT_DURATION_MINUTES;\n  const minutes = Math.min(requested, APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES);\n  return new Date(now.getTime() + minutes * 60_000);\n}\n\n/**\n * Is this approver a DIFFERENT person from the operator who asked?\n *\n * **This predicate is the two-person rule.** Everything else about an application-wide grant — the\n * request, the window, the justification, the audit row — exists in the tenant grant too. What is new\n * here is exactly this comparison, so it is named, exported, and asked in ONE place.\n *\n * ## Why it is a predicate and not an inline `!==`\n *\n * Three call sites would otherwise each write their own comparison, and two of the three ways to\n * write it are wrong in the same direction:\n *\n *  - an approver id that is ABSENT must NOT pass. An unauthenticated or system-context approval has\n *    no second person behind it, and `undefined !== 'operator'` is `true` — the inline form fails\n *    OPEN on precisely the input a broken context supplies;\n *  - an operator id that is absent must not pass either, for the mirror reason.\n *\n * So the predicate requires BOTH ids to be present and different. Fails closed on everything else.\n */\nexport function applicationAccessGrantApproverIsDistinct(params: {\n  readonly operatorUserId: string | undefined | null;\n  readonly approverUserId: string | undefined | null;\n}): boolean {\n  const operator = String(params.operatorUserId ?? '');\n  const approver = String(params.approverUserId ?? '');\n  if (!operator || !approver) return false;\n  return operator !== approver;\n}\n"]}

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAQlD,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAE5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,+DAA+D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;kBA2S1H,CAAC"}
+{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAQlD,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAE5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,+DAA+D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;kBAuU1H,CAAC"}

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.js

@@ -269,6 +269,33 @@ export const platformAccessGrantsResourceConfiguration_InitializationFactory = (
          * Revoking is monotonic — it only ever removes authority — so admitting the platform side costs
          * nothing the reversibility test would object to.
          */
+        /**
+         * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and
+         * by nothing else (#413). INTERNAL_CALL: no route, no frontend affordance, and therefore no
+         * `admitsCrossTenantPlatformAdministration` — the tenant-boundary question does not arise for
+         * an operation no request can reach.
+         *
+         * The transition precondition lives in the paired implementation, which permits it only from
+         * ACTIVE: a grant the tenant DENIED or REVOKED must keep saying so, and relabelling a
+         * terminal grant would rewrite the decision history a customer audit reads.
+         */
+        [PlatformAccessGrants_Operations.EXPIRE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`
+                    // and the paired prefix implementation forces the status transition itself, so there is no field
+                    // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without
+                    // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL
+                    // that accepts nothing advertise every field — `status` included, the one field this verb owns.
+                    requestDto: z.object({}),
+                },
+            ],
+        },
         [PlatformAccessGrants_Operations.REVOKE]: {
             variants: [
                 {

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAW1H,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAChI,0CAA0C,CAIxC;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;OAQG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QAEtC;;;;;;;;;;;;;;;WAeG;QACH,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;QACjC,uFAAuF;QACvF,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB;;;;;;;;WAQG;QAEH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,mBAAmB;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;WAaG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,+BAA+B,CAAC,cAAc,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C;;;;;;;;;;;;;;;uBAeG;oBACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;qBACjE,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,uFAAuF;oBACvF,sFAAsF;oBACtF,iEAAiE;oBACjE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,0FAA0F;oBAC1F,sEAAsE;oBACtE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE;YACtC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;KACF;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,+FAA+F;IAC/F,wEAAwE;CACzE,CAAC,CAAC","sourcesContent":["/**\n * Platform Access Grants — resource configuration.\n *\n * The operation set is unusual and the asymmetry is the point: the PLATFORM requests, the TENANT\n * decides. No verb lets one side do the other's job.\n *\n *   requestAccess  — platform-tier, crosses the tenant boundary\n *   approve / deny — the TARGET tenant's own administrators, never platform-tier\n *   revoke         — either side, because either may end an elevation early\n *\n * See `platform-access-grants.shared.schemas.ts` for why the resource exists at all (rungs 4–5 of\n * the operator-access ladder in `.claude/rules/administrative-continuity-floors.md`) and\n * `.claude/plans/platform-access-grants-jit-elevation.md` for the remaining steps.\n */\n\nimport { z } from 'zod';\nimport { PlatformAccessGrantSchema, PlatformAccessGrantStatus, PlatformAccessGrants_Operations } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n\ntype PlatformAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const platformAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof PlatformAccessGrants_Operations,\n    PlatformAccessGrantsCoreOperations,\n    typeof PlatformAccessGrantSchema\n  >({\n    mainSchema: PlatformAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.PLATFORM_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.PLATFORM_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` are ALLOWED for the trusted path because the authorization layer itself has to\n     * resolve a caller's usable grant before admitting a crossing, and it does so on a system context\n     * — the caller is by definition not a member of the tenant whose grants are being read.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the tenant policy and the continuity-floor measurement. A system door around those would be a\n     * second way to mint an elevation, which is the one thing this resource exists to prevent.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n\n      /**\n       * Subject-export disclosure — FORBIDDEN, and the declaration is REQUIRED rather than optional.\n       *\n       * `operatorUserId` and `approvedByUserId` are foreign keys back to USERS, so\n       * `classifySubjectExportDisposition` puts these rows on a user's Art. 15 graph as\n       * `INCLUDED_REFERENCES_SUBJECT` — personal data CONCERNING the subject even though the subject\n       * does not own it. An included resource carrying NO declaration REFUSES the entire export, so\n       * omitting this would trade a frontend boot failure for a broken disclosure right.\n       *\n       * FORBIDDEN for the reason AUDIT_LOGS is: this is a security/operational monitoring record, and\n       * handing the monitoring trail to the person it monitors is self-defeating. It is also not only\n       * about them — a grant names the TENANT's approver and carries the tenant's decision reason, so\n       * disclosing it to the operator would expose another data subject's decision (Art. 15(4)).\n       * FORBIDDEN rows are left OUT of the bundle and RECORDED with that reason, never silently\n       * dropped, so the report still answers \"why is this missing?\".\n       */\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text.\n     *\n     * Note this is a DIFFERENT question from the `exportSubject: FORBIDDEN` above, and the two answers\n     * differ deliberately. That one asks whether the monitored operator may READ the monitoring trail —\n     * no. This one asks what erasure DOES to the row, and nothing here says erasure must not reach it.\n     *\n     * The grant survives because its security value is WHO reached WHICH tenant, WHEN, and under whose\n     * approval — none of which is scrubbed. What does not survive is `justification` and `decisionReason`:\n     * operator- and approver-written prose, and the surface most likely to name a third party in passing.\n     * That makes the erasure narrow rather than destructive of the record.\n     *\n     * Contrast `auditLogs`, which is exempt outright: it is the immutable ledger of what happened,\n     * including this erasure, so scrubbing it would destroy the evidence the erasure was performed.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The grant is a record ABOUT an operator's access, not\n     * the operator; their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n      // Present for the tenant-purge cascade ONLY — see the operation's configuration below.\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be REPOSITORY_ONLY: the\n\n       * retention primitives resolve through `getServiceOperationPathDefault`, which matches only\n\n       * INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize writer uses to stamp markers.\n\n       */\n\n      [CoreResourceOperation.UPDATE_MANY]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n        }],\n\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            // Both sides read the same row through the same door: a tenant admin sees elevations\n            // raised against their tenant (the consent record is worthless if the consenting party\n            // cannot see it), and the platform sees the ones it raised. The ORGANIZATIONS scope does\n            // the tenant separation; the platform reaches it through the cross-tenant admission on\n            // the verbs below.\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * PURGE ONLY — there is deliberately no `API_CALL` variant, so no client can delete a grant.\n       *\n       * The verb exists because grants are a COMPOSITION child of ORGANIZATIONS with\n       * `onParentDelete` enabled, and a cascade can only call an operation the child actually\n       * declares. Without it the registry's composition-cascade-deletability guard fails — correctly:\n       * the cascade would have been declared and then silently unable to run, leaving grant rows\n       * behind after their tenant was purged.\n       *\n       * Route-less is the whole point of the shape. `INTERNAL_CALL` mirrors `organizations.delete`'s\n       * own default: the tenant purge may remove these rows, and nobody else may. Erasing a consent\n       * record through an API would let either party rewrite the history of an access decision, which\n       * is exactly what this resource exists to make impossible.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb, and the ONE operation here that must stay reachable without an existing\n       * grant — otherwise the mechanism cannot start: an operator would need an elevation to request\n       * an elevation. It therefore declares `admitsCrossTenantPlatformAdministration` and must be\n       * explicitly exempted when the admission predicate later starts requiring a usable grant\n       * (Step 4 of the plan). That exemption is load-bearing and gets its own pin.\n       *\n       * What keeps the exemption safe is that requesting is not accessing: this verb writes a row in\n       * `PENDING_APPROVAL` (or `ACTIVE` when the tenant has not opted into approval) and touches\n       * nothing else in the tenant. The blast radius of an abused request is a notification and an\n       * audit row naming the operator.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — elevation is requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [PlatformAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            admitsCrossTenantPlatformAdministration: true,\n            /**\n             * `organizationId` deliberately does NOT appear in this body DTO. The organization is\n             * already the mandatory primary-scope path segment and the execution-context creator\n             * validates that URL value before dispatch. Requiring it again in JSON made clients\n             * author the same security-critical target twice and created an avoidable mismatch case.\n             *\n             * WHERE AN OPERATOR GETS the path id is still a deliberate product decision. There is\n             * no in-product surface that lists organizations the operator does not belong to:\n             * `organizations | LIST` is confined to the caller's own memberships. The id therefore\n             * arrives with the customer support case, where it is also present in support URLs,\n             * organization notifications and the audit trail.\n             *\n             * Do not widen `organizations | LIST` to make discovery convenient: a browsable\n             * directory is the customer list and would restore the standing cross-tenant\n             * visibility this workflow exists to avoid.\n             */\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 4h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional(),\n            }),\n          },\n        ],\n        userNotifications: [\n          {\n            // The tenant learns immediately that an operator asked for access — before it happens,\n            // not after. Under the approval posture this notification IS the request; without it,\n            // opting in would give a tenant a decision it never hears about.\n            target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n            channel: CoreUserNotificationChannel.EMAIL,\n          },\n        ],\n      },\n\n      /**\n       * The tenant's decision. Gated on the TENANT's own roles and deliberately NOT reachable by the\n       * platform: an operator who could approve their own request would make the whole Lockbox\n       * posture ceremonial. Note the absence of `admitsCrossTenantPlatformAdministration` here — that\n       * absence is the control, so do not add it \"for symmetry\".\n       */\n      [PlatformAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            // Only a request still awaiting a decision can be decided. Fails closed server-side, so a\n            // replayed approval cannot revive a denied, revoked or expired grant.\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      [PlatformAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /**\n       * Ending an elevation early. Reachable by BOTH sides, which is why it carries the cross-tenant\n       * admission while `approve`/`deny` do not: a tenant revokes access it granted, and an operator\n       * closes out their own session rather than leaving a live window open until it lapses.\n       *\n       * Revoking is monotonic — it only ever removes authority — so admitting the platform side costs\n       * nothing the reversibility test would object to.\n       */\n      [PlatformAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            admitsCrossTenantPlatformAdministration: true,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n    },\n    // NOTE: the ORGANIZATIONS primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (ORGANIZATIONS → PLATFORM_ACCESS_GRANTS), which is\n    // the single place scope is expressed for every resource. Declaring it twice would let the two\n    // drift, and the relationship is the one the authorizer actually reads.\n  });\n"]}
+{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAW1H,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAChI,0CAA0C,CAIxC;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;OAQG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QAEtC;;;;;;;;;;;;;;;WAeG;QACH,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;QACjC,uFAAuF;QACvF,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB;;;;;;;;WAQG;QAEH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,mBAAmB;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;WAaG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,+BAA+B,CAAC,cAAc,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C;;;;;;;;;;;;;;;uBAeG;oBACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;qBACjE,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,uFAAuF;oBACvF,sFAAsF;oBACtF,iEAAiE;oBACjE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,0FAA0F;oBAC1F,sEAAsE;oBACtE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE;YACtC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED;;;;;;;WAOG;QACH;;;;;;;;;WASG;QACH,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;KACF;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,+FAA+F;IAC/F,wEAAwE;CACzE,CAAC,CAAC","sourcesContent":["/**\n * Platform Access Grants — resource configuration.\n *\n * The operation set is unusual and the asymmetry is the point: the PLATFORM requests, the TENANT\n * decides. No verb lets one side do the other's job.\n *\n *   requestAccess  — platform-tier, crosses the tenant boundary\n *   approve / deny — the TARGET tenant's own administrators, never platform-tier\n *   revoke         — either side, because either may end an elevation early\n *\n * See `platform-access-grants.shared.schemas.ts` for why the resource exists at all (rungs 4–5 of\n * the operator-access ladder in `.claude/rules/administrative-continuity-floors.md`) and\n * `.claude/plans/platform-access-grants-jit-elevation.md` for the remaining steps.\n */\n\nimport { z } from 'zod';\nimport { PlatformAccessGrantSchema, PlatformAccessGrantStatus, PlatformAccessGrants_Operations } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n\ntype PlatformAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const platformAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof PlatformAccessGrants_Operations,\n    PlatformAccessGrantsCoreOperations,\n    typeof PlatformAccessGrantSchema\n  >({\n    mainSchema: PlatformAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.PLATFORM_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.PLATFORM_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` are ALLOWED for the trusted path because the authorization layer itself has to\n     * resolve a caller's usable grant before admitting a crossing, and it does so on a system context\n     * — the caller is by definition not a member of the tenant whose grants are being read.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the tenant policy and the continuity-floor measurement. A system door around those would be a\n     * second way to mint an elevation, which is the one thing this resource exists to prevent.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n\n      /**\n       * Subject-export disclosure — FORBIDDEN, and the declaration is REQUIRED rather than optional.\n       *\n       * `operatorUserId` and `approvedByUserId` are foreign keys back to USERS, so\n       * `classifySubjectExportDisposition` puts these rows on a user's Art. 15 graph as\n       * `INCLUDED_REFERENCES_SUBJECT` — personal data CONCERNING the subject even though the subject\n       * does not own it. An included resource carrying NO declaration REFUSES the entire export, so\n       * omitting this would trade a frontend boot failure for a broken disclosure right.\n       *\n       * FORBIDDEN for the reason AUDIT_LOGS is: this is a security/operational monitoring record, and\n       * handing the monitoring trail to the person it monitors is self-defeating. It is also not only\n       * about them — a grant names the TENANT's approver and carries the tenant's decision reason, so\n       * disclosing it to the operator would expose another data subject's decision (Art. 15(4)).\n       * FORBIDDEN rows are left OUT of the bundle and RECORDED with that reason, never silently\n       * dropped, so the report still answers \"why is this missing?\".\n       */\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text.\n     *\n     * Note this is a DIFFERENT question from the `exportSubject: FORBIDDEN` above, and the two answers\n     * differ deliberately. That one asks whether the monitored operator may READ the monitoring trail —\n     * no. This one asks what erasure DOES to the row, and nothing here says erasure must not reach it.\n     *\n     * The grant survives because its security value is WHO reached WHICH tenant, WHEN, and under whose\n     * approval — none of which is scrubbed. What does not survive is `justification` and `decisionReason`:\n     * operator- and approver-written prose, and the surface most likely to name a third party in passing.\n     * That makes the erasure narrow rather than destructive of the record.\n     *\n     * Contrast `auditLogs`, which is exempt outright: it is the immutable ledger of what happened,\n     * including this erasure, so scrubbing it would destroy the evidence the erasure was performed.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The grant is a record ABOUT an operator's access, not\n     * the operator; their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n      // Present for the tenant-purge cascade ONLY — see the operation's configuration below.\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be REPOSITORY_ONLY: the\n\n       * retention primitives resolve through `getServiceOperationPathDefault`, which matches only\n\n       * INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize writer uses to stamp markers.\n\n       */\n\n      [CoreResourceOperation.UPDATE_MANY]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n        }],\n\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            // Both sides read the same row through the same door: a tenant admin sees elevations\n            // raised against their tenant (the consent record is worthless if the consenting party\n            // cannot see it), and the platform sees the ones it raised. The ORGANIZATIONS scope does\n            // the tenant separation; the platform reaches it through the cross-tenant admission on\n            // the verbs below.\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * PURGE ONLY — there is deliberately no `API_CALL` variant, so no client can delete a grant.\n       *\n       * The verb exists because grants are a COMPOSITION child of ORGANIZATIONS with\n       * `onParentDelete` enabled, and a cascade can only call an operation the child actually\n       * declares. Without it the registry's composition-cascade-deletability guard fails — correctly:\n       * the cascade would have been declared and then silently unable to run, leaving grant rows\n       * behind after their tenant was purged.\n       *\n       * Route-less is the whole point of the shape. `INTERNAL_CALL` mirrors `organizations.delete`'s\n       * own default: the tenant purge may remove these rows, and nobody else may. Erasing a consent\n       * record through an API would let either party rewrite the history of an access decision, which\n       * is exactly what this resource exists to make impossible.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb, and the ONE operation here that must stay reachable without an existing\n       * grant — otherwise the mechanism cannot start: an operator would need an elevation to request\n       * an elevation. It therefore declares `admitsCrossTenantPlatformAdministration` and must be\n       * explicitly exempted when the admission predicate later starts requiring a usable grant\n       * (Step 4 of the plan). That exemption is load-bearing and gets its own pin.\n       *\n       * What keeps the exemption safe is that requesting is not accessing: this verb writes a row in\n       * `PENDING_APPROVAL` (or `ACTIVE` when the tenant has not opted into approval) and touches\n       * nothing else in the tenant. The blast radius of an abused request is a notification and an\n       * audit row naming the operator.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — elevation is requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [PlatformAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            admitsCrossTenantPlatformAdministration: true,\n            /**\n             * `organizationId` deliberately does NOT appear in this body DTO. The organization is\n             * already the mandatory primary-scope path segment and the execution-context creator\n             * validates that URL value before dispatch. Requiring it again in JSON made clients\n             * author the same security-critical target twice and created an avoidable mismatch case.\n             *\n             * WHERE AN OPERATOR GETS the path id is still a deliberate product decision. There is\n             * no in-product surface that lists organizations the operator does not belong to:\n             * `organizations | LIST` is confined to the caller's own memberships. The id therefore\n             * arrives with the customer support case, where it is also present in support URLs,\n             * organization notifications and the audit trail.\n             *\n             * Do not widen `organizations | LIST` to make discovery convenient: a browsable\n             * directory is the customer list and would restore the standing cross-tenant\n             * visibility this workflow exists to avoid.\n             */\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 4h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional(),\n            }),\n          },\n        ],\n        userNotifications: [\n          {\n            // The tenant learns immediately that an operator asked for access — before it happens,\n            // not after. Under the approval posture this notification IS the request; without it,\n            // opting in would give a tenant a decision it never hears about.\n            target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n            channel: CoreUserNotificationChannel.EMAIL,\n          },\n        ],\n      },\n\n      /**\n       * The tenant's decision. Gated on the TENANT's own roles and deliberately NOT reachable by the\n       * platform: an operator who could approve their own request would make the whole Lockbox\n       * posture ceremonial. Note the absence of `admitsCrossTenantPlatformAdministration` here — that\n       * absence is the control, so do not add it \"for symmetry\".\n       */\n      [PlatformAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            // Only a request still awaiting a decision can be decided. Fails closed server-side, so a\n            // replayed approval cannot revive a denied, revoked or expired grant.\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      [PlatformAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /**\n       * Ending an elevation early. Reachable by BOTH sides, which is why it carries the cross-tenant\n       * admission while `approve`/`deny` do not: a tenant revokes access it granted, and an operator\n       * closes out their own session rather than leaving a live window open until it lapses.\n       *\n       * Revoking is monotonic — it only ever removes authority — so admitting the platform side costs\n       * nothing the reversibility test would object to.\n       */\n      /**\n       * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and\n       * by nothing else (#413). INTERNAL_CALL: no route, no frontend affordance, and therefore no\n       * `admitsCrossTenantPlatformAdministration` — the tenant-boundary question does not arise for\n       * an operation no request can reach.\n       *\n       * The transition precondition lives in the paired implementation, which permits it only from\n       * ACTIVE: a grant the tenant DENIED or REVOKED must keep saying so, and relabelling a\n       * terminal grant would rewrite the decision history a customer audit reads.\n       */\n      [PlatformAccessGrants_Operations.EXPIRE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n            // and the paired prefix implementation forces the status transition itself, so there is no field\n            // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n            // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n            // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n            requestDto: z.object({}),\n          },\n        ],\n      },\n\n      [PlatformAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            admitsCrossTenantPlatformAdministration: true,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n    },\n    // NOTE: the ORGANIZATIONS primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (ORGANIZATIONS → PLATFORM_ACCESS_GRANTS), which is\n    // the single place scope is expressed for every resource. Declaring it twice would let the two\n    // drift, and the relationship is the one the authorizer actually reads.\n  });\n"]}