@wildo-ai/saas-models 1.1.3 → 1.1.4

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,eAAO,MAAM,0CAA0C,yNA6FtD,CAAC"}
+{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,eAAO,MAAM,0CAA0C,yNA6FtD,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAa9E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAwC,CAAC;AAE9E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;iBAsJ3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;kBAMvD,CAAC"}
+{"version":3,"file":"scim-provisioning-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAa9E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAwC,CAAC;AAE9E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;iBAsJ3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;kBAMvD,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AAEjG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;CAC/C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,2BAA2B,GAA4E;IAC3G,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,uBAAuB,CAAC;IAC5D,CAAC,eAAe,EAAE,gBAAgB,CAAC,sBAAsB,CAAC;CAClD,CAAC;AAGX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAW,GAAG,kBAAkB,UAAU,CAAC;AAE9E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,kGAAkG;IAClG,4EAA4E;IAC5E,gGAAgG;IAChG,mFAAmF;IACnF,6FAA6F;IAC7F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,6FAA6F;IAC7F,4FAA4F;IAC5F,mGAAmG;IACnG,sBAAsB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC7E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,gBAAgB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,4FAA4F;IAC5F,6FAA6F;IAC7F,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAErG;;;;;;;;;;;OAWG;IACH,gGAAgG;IAChG,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAExD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QAC/C,SAAS,EAAE,GAAG,EAAE,CAAC,sBAAsB;KACxC,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QACvD,YAAY,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,aAAoD,CAAC;YAEjE,MAAM,KAAK,GAAG,2BAA2B;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC3E,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClF,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,0BAA0B,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC;YAEvG,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAEzC,CAAC;gBACd,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAE/B,uFAAuF;gBACvF,yFAAyF;gBACzF,0FAA0F;gBAC1F,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CACnB,sEAAsE,KAAK,CAAC,EAAE,IAAI,OAAO,0BAA0B,EACnH,KAAK,CACN,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4CAA4C,GAAG,yBAAyB,CAAC;IACpF,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,0BAA0B;IAC/C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,gCAAgC;IAC5C,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SCIM Provisioning Config Schema (Shared) — Polymorphic\n *\n * SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.\n * Independent from SSO JIT provisioning (SsoConfig.provisioning) — SCIM is a\n * separate provisioning channel triggered by IdP push.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2G\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { MAIN_API_BASE_PATH } from '../../../requests/manual-controllers-routes-urls';\nimport { resolveVerifiedDomains } from '../sso/sso-config.shared.schemas';\nimport { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit-mapping.shared';\n\n/**\n * Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a\n * path expression resolved against the SCIM body at push time by the backend\n * `resolveScimAttributePath` — the row's authoritative source for how a directory's payload\n * shape translates to Wildo's `{email, firstName, lastName, displayName}` (Okta, Azure AD, etc.\n * differ). The defaults reproduce the framework's built-in mapping exactly, so an org that never\n * customises this behaves identically to the hardcoded normalisation it replaces.\n *\n * Supported path grammar (what `resolveScimAttributePath` understands):\n * - dotted traversal — `name.givenName`\n * - array index — `emails[0].value`\n * - array filter — `emails[primary eq true].value` (first element whose `primary` equals `true`;\n *   also `emails[type eq \"work\"].value`) — the SCIM-style selector the spec examples use.\n */\nexport const ScimAttributeMappingSchema = z.object({\n  email: z.string().default('emails[0].value'),\n  firstName: z.string().default('name.givenName'),\n  lastName: z.string().default('name.familyName'),\n  displayName: z.string().default('displayName'),\n});\nexport type ScimAttributeMapping = z.infer<typeof ScimAttributeMappingSchema>;\n\n/**\n * The scope FKs the polymorphism engine injects onto the two variants. Declared here\n * (rather than read off a variant schema) because this BASE schema's virtual fields run\n * for both variants and must discover which scope the row belongs to at read time.\n */\nconst SCIM_SCOPE_FK_TO_SSO_CONFIG: ReadonlyArray<readonly [fk: string, ssoResourceType: CoreResourceType]> = [\n  ['organizationId', CoreResourceType.ORGANIZATION_SSO_CONFIG],\n  ['applicationId', CoreResourceType.APPLICATION_SSO_CONFIG],\n] as const;\n\n\n/**\n * The API-relative base an external identity provider pushes SCIM traffic to.\n *\n * ONE named source for a path that four different surfaces need to agree on: the virtual\n * `scimEndpointUrl` below, the SCIM controller's own mount, the specification that documents the\n * field, and the customer documentation that tells an administrator what to paste into their IdP.\n * Before this existed the documentation's worked example was `https://api.example.com/api/v1/scim/v2`\n * — a real path under a host that does not exist, which an administrator cannot tell from a value\n * they are meant to use.\n *\n * Built from {@link MAIN_API_BASE_PATH}, so a mount change moves every consumer with it rather than\n * stranding a literal. That is not hypothetical here: this field replaced a dead custom\n * implementation that hardcoded `/api/scim/v2` and was simply wrong for missing the version prefix.\n */\nexport const SCIM_SERVICE_BASE_PATH: string = `${MAIN_API_BASE_PATH}/scim/v2`;\n\nexport const ScimProvisioningConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // NOTE: there is deliberately NO `scimEnabled` field. Whether SCIM is AVAILABLE for an org is a\n  // per-ORG-TYPE decision at `organizationTypes[type].scimProvisioning.enabled` in the app config —\n  // the authority the app-global MOUNT gate and the SCIM controller auth gate\n  // (`isScimProvisioningEnabledForOrg`) consult. NB: the invitation `managementMode` resolver and\n  // the invite-accept credential block key instead on per-org ACTIVE management (the\n  // DIRECTORY_PROVISIONING feature + a live SCIM token — see `isOrgActivelyDirectoryManaged` /\n  // AUTH-23), so a SCIM-capable type does not by itself forbid local credentials. A per-scope\n  // `scimEnabled` on this row would duplicate the type-level authority, could silently drift from\n  // it, and was read by nothing. This row governs only WHAT HAPPENS to users once SCIM is on.\n  // `.isAuditEvidence()` on the four below — every one decides what the DIRECTORY is allowed to do\n  // to member accounts and with what standing. `defaultRole` in particular is a role GRANT: SCIM\n  // provisions through an internal execution context, so it is NOT bounded by any caller's role\n  // ceiling (see `defaultUnitRole`'s note below) — configuring it IS granting the role, which is\n  // exactly the class of change an auditor must be able to reconstruct with before/after values.\n  // `autoDeactivateUsers` is the deprovisioning switch; flipping it off silently strands access.\n  // None of these is personal data — they are flags and role names — so recording their values\n  // does not conflict with the minimisation rule that keeps user-identifying fields unmarked.\n  // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the switches that create accounts and\n  // deprovision access.\n  autoCreateUsers: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  autoVerifyEmail: z.boolean().default(true),\n  autoDeactivateUsers: z.boolean().default(true).isAuditEvidence(),\n  defaultRole: z.string().optional().isAuditEvidence(),\n  attributeMapping: ScimAttributeMappingSchema.optional(),\n\n  /**\n   * Declared bindings from the directory's `department` value to an ORGANIZATION UNIT.\n   *\n   * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory becomes the authority\n   * for which unit a member belongs to.\n   *\n   * Explicit and unit-id-addressed on purpose. Since units are an authorization axis, resolving a\n   * flat directory string to the wrong node in the tree grants the wrong DATA — and `code` is unique\n   * only among siblings while `name` is freeform, so a search-based match is genuinely ambiguous.\n   * Nothing here guesses: a value with no declared binding is ignored, and no unit is ever created.\n   *\n   * ⚠️ **Declaring this makes SCIM AUTHORITATIVE over the member's unit assignments.** Every push\n   * replaces the member's assignments with exactly what the directory says, so leaving a department\n   * actually revokes its access — and assignments made BY HAND in the application are removed too.\n   * An organization that wants manual unit assignments should leave this empty. Reconciliation only\n   * runs when this list is non-empty AND {@link ScimProvisioningConfigBaseSchema.shape.defaultUnitRole}\n   * is set, so an organization that never opted in can never have assignments deleted by a push.\n   */\n  // `.isAuditEvidence()` — declaring a binding makes SCIM AUTHORITATIVE over unit assignments\n  // (see the warning above), so the mapping list is an authorization surface, not preferences.\n  organizationUnitMapping: z.array(ScimOrganizationUnitMappingEntrySchema).optional().isAuditEvidence(),\n\n  /**\n   * The role every SCIM-created unit assignment carries.\n   *\n   * Deliberately SEPARATE from {@link ScimProvisioningConfigBaseSchema.shape.defaultRole}, which is the\n   * ORGANIZATION-wide role. A unit grant and an organization grant are different authority over\n   * different row sets; one field meaning both would merge two scopes that the whole narrowing model\n   * exists to keep apart.\n   *\n   * ⚠️ SCIM provisions through an internal execution context, so this value is NOT bounded by a\n   * caller's role ceiling — exactly as `defaultRole` is not. The gate is the write to THIS row, which\n   * is organization-admin-gated. Treat configuring it as granting the role.\n   */\n  // `.isAuditEvidence()` — a role grant on a DIFFERENT authority axis than `defaultRole`, and the\n  // JSDoc above says it plainly: treat configuring it as granting the role.\n  defaultUnitRole: z.string().optional().isAuditEvidence(),\n\n  /**\n   * The API-relative path an external IdP pushes SCIM traffic to, e.g. `/api/v1/scim/v2`.\n   *\n   * VIRTUAL (computed per read, never persisted, never accepted on write) because it is\n   * derived deployment routing — not tenant data. Storing it would let a row drift from the\n   * route the server actually mounts, which is precisely the class of lie this field replaces:\n   * it supersedes a dead custom-implementation that injected a hardcoded `/api/scim/v2`,\n   * **missing the `/api/v1` mount prefix and therefore simply wrong**. Built from\n   * {@link MAIN_API_BASE_PATH} — the documented single source of truth for the prefix — so a\n   * future mount change moves this field with it instead of stranding a literal.\n   *\n   * PATH, not an absolute URL: the host lives in `runtime.endPoints.main_backend_api.publicUrl`,\n   * reachable only through `AppConfigService`, whose DI symbol lives in `saas-backend-lib` —\n   * unreachable from this shared package without inverting the dependency direction. `publicUrl`\n   * is also optional, so an absolute form would frequently resolve to nothing. Callers that need\n   * the absolute endpoint compose it against their own API base (the frontend already knows it).\n   *\n   * Identical on both scope variants: the SCIM controller mounts ONE app-global router and\n   * separates tenants by bearer token, not by path.\n   */\n  scimEndpointUrl: z.string().optional().isVirtual({\n    calculate: () => SCIM_SERVICE_BASE_PATH,\n  }),\n\n  /**\n   * The email domains SCIM provisioning will accept, mirroring the gate actually enforced at\n   * push time — `EnterpriseUserProvisioningBackendService.provisionEnterpriseUser` rejects an IdP profile\n   * whose email domain is absent from this list.\n   *\n   * VIRTUAL and read live from the scope's SSO config rather than stored here: the domains are\n   * OWNED by `SsoConfig.domains` (verified via DNS there), so persisting a copy on this row\n   * would denormalize a security-relevant allow-list and let it go stale against the owner —\n   * exactly the drift `forwardedLabel` exists to avoid. Same predicate as the enforcement path\n   * (`SCIMControllerBackendService._getProvisioningConfig`): a domain counts only once DNS\n   * verification has actually passed, so `verifiedDomains` is filtered by\n   * `domainVerificationStatus`. Deliberately NOT the looser `verifiedDomains || ssoEnabledDomains`\n   * union used by domain→org lookup — widening this list would widen a security gate.\n   *\n   * `[]` and `undefined` are DISTINCT and both meaningful:\n   * - `[]` — the SSO config exists and has no verified domain ⇒ **unrestricted** (the enforcement\n   *   check is skipped entirely when the list is empty). This is the honest reading of the value.\n   * - `undefined` — the SSO config could not be read ⇒ **undetermined**. Degrading to `[]` here\n   *   would render an unread config as \"unrestricted\", overstating what we know.\n   *\n   * Fail-safe: never throws — this is a display mirror, not the enforcement point.\n   */\n  allowedDomains: z.array(z.string()).optional().isVirtual({\n    dependencies: SCIM_SCOPE_FK_TO_SSO_CONFIG.map(([fk]) => fk),\n    calculate: async ({ currentObject, utils }) => {\n      const row = currentObject as Record<string, unknown> | undefined;\n\n      const scope = SCIM_SCOPE_FK_TO_SSO_CONFIG\n        .map(([fk, ssoResourceType]) => ({ fk, ssoResourceType, value: row?.[fk] }))\n        .find(({ value }) => value !== null && value !== undefined && String(value).length > 0);\n      if (!scope) return undefined;\n\n      const scopeId = String(scope.value);\n      const ssoRepository = utils?.repositories?.getRepository?.(scope.ssoResourceType);\n      if (!ssoRepository || typeof ssoRepository.findFieldValuesByJoinField !== 'function') return undefined;\n\n      try {\n        const rowsByScopeId: Map<string, Record<string, unknown>> =\n          await ssoRepository.findFieldValuesByJoinField(scope.fk, [scopeId], ['domains']);\n        const domains = rowsByScopeId.get(scopeId)?.['domains'] as\n          | { verifiedDomains?: string[]; domainVerificationStatus?: Record<string, string> }\n          | undefined;\n        if (!domains) return undefined;\n\n        // The one derivation (#457), not a sixth hand-written join. `undefined` above is still\n        // DISTINCT from the `[]` this can return — see the field's docstring; the helper answers\n        // \"which are verified\", and only the caller knows whether the config was readable at all.\n        return resolveVerifiedDomains(domains);\n      } catch (error) {\n        utils?.logger?.warn?.(\n          `[scimProvisioningConfig.allowedDomains] SSO config read failed for ${scope.fk}=${scopeId}; reporting undetermined`,\n          error,\n        );\n        return undefined;\n      }\n    },\n  }),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimProvisioningConfigBase = z.infer<typeof ScimProvisioningConfigBaseSchema>;\n\nexport const scimProvisioningConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'scimProvisioningConfig',\n  baseFieldIdentifier: 'scimProvisioningConfigId',\n  baseEnumKey: 'SCIM_PROVISIONING_CONFIG',\n  baseSchema: ScimProvisioningConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}
+{"version":3,"file":"scim-provisioning-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AAEjG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;CAC/C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,2BAA2B,GAA4E;IAC3G,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,uBAAuB,CAAC;IAC5D,CAAC,eAAe,EAAE,gBAAgB,CAAC,sBAAsB,CAAC;CAClD,CAAC;AAGX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAW,GAAG,kBAAkB,UAAU,CAAC;AAE9E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,kGAAkG;IAClG,4EAA4E;IAC5E,gGAAgG;IAChG,mFAAmF;IACnF,6FAA6F;IAC7F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,6FAA6F;IAC7F,4FAA4F;IAC5F,mGAAmG;IACnG,sBAAsB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC7E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,gBAAgB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,4FAA4F;IAC5F,6FAA6F;IAC7F,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAErG;;;;;;;;;;;OAWG;IACH,gGAAgG;IAChG,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAExD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QAC/C,SAAS,EAAE,GAAG,EAAE,CAAC,sBAAsB;KACxC,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QACvD,YAAY,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,aAAoD,CAAC;YAEjE,MAAM,KAAK,GAAG,2BAA2B;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC3E,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClF,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,0BAA0B,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC;YAEvG,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAEzC,CAAC;gBACd,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAE/B,uFAAuF;gBACvF,yFAAyF;gBACzF,0FAA0F;gBAC1F,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CACnB,sEAAsE,KAAK,CAAC,EAAE,IAAI,OAAO,0BAA0B,EACnH,KAAK,CACN,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4CAA4C,GAAG,yBAAyB,CAAC;IACpF,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,0BAA0B;IAC/C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,gCAAgC;IAC5C,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SCIM Provisioning Config Schema (Shared) — Polymorphic\n *\n * SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.\n * Independent from SSO JIT provisioning (SsoConfig.provisioning) — SCIM is a\n * separate provisioning channel triggered by IdP push.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2G\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { MAIN_API_BASE_PATH } from '../../../requests/manual-controllers-routes-urls';\nimport { resolveVerifiedDomains } from '../sso/sso-config.shared.schemas';\nimport { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit-mapping.shared';\n\n/**\n * Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a\n * path expression resolved against the SCIM body at push time by the backend\n * `resolveScimAttributePath` — the row's authoritative source for how a directory's payload\n * shape translates to Wildo's `{email, firstName, lastName, displayName}` (Okta, Azure AD, etc.\n * differ). The defaults reproduce the framework's built-in mapping exactly, so an org that never\n * customises this behaves identically to the hardcoded normalisation it replaces.\n *\n * Supported path grammar (what `resolveScimAttributePath` understands):\n * - dotted traversal — `name.givenName`\n * - array index — `emails[0].value`\n * - array filter — `emails[primary eq true].value` (first element whose `primary` equals `true`;\n *   also `emails[type eq \"work\"].value`) — the SCIM-style selector the spec examples use.\n */\nexport const ScimAttributeMappingSchema = z.object({\n  email: z.string().default('emails[0].value'),\n  firstName: z.string().default('name.givenName'),\n  lastName: z.string().default('name.familyName'),\n  displayName: z.string().default('displayName'),\n});\nexport type ScimAttributeMapping = z.infer<typeof ScimAttributeMappingSchema>;\n\n/**\n * The scope FKs the polymorphism engine injects onto the two variants. Declared here\n * (rather than read off a variant schema) because this BASE schema's virtual fields run\n * for both variants and must discover which scope the row belongs to at read time.\n */\nconst SCIM_SCOPE_FK_TO_SSO_CONFIG: ReadonlyArray<readonly [fk: string, ssoResourceType: CoreResourceType]> = [\n  ['organizationId', CoreResourceType.ORGANIZATION_SSO_CONFIG],\n  ['applicationId', CoreResourceType.APPLICATION_SSO_CONFIG],\n] as const;\n\n\n/**\n * The API-relative base an external identity provider pushes SCIM traffic to.\n *\n * ONE named source for a path that four different surfaces need to agree on: the virtual\n * `scimEndpointUrl` below, the SCIM controller's own mount, the specification that documents the\n * field, and the customer documentation that tells an administrator what to paste into their IdP.\n * Before this existed the documentation's worked example was `https://api.example.com/api/v1/scim/v2`\n * — a real path under a host that does not exist, which an administrator cannot tell from a value\n * they are meant to use.\n *\n * Built from {@link MAIN_API_BASE_PATH}, so a mount change moves every consumer with it rather than\n * stranding a literal. That is not hypothetical here: this field replaced a dead custom\n * implementation that hardcoded `/api/scim/v2` and was simply wrong for missing the version prefix.\n */\nexport const SCIM_SERVICE_BASE_PATH: string = `${MAIN_API_BASE_PATH}/scim/v2`;\n\nexport const ScimProvisioningConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // NOTE: there is deliberately NO `scimEnabled` field. Whether SCIM is AVAILABLE for an org is a\n  // per-ORG-TYPE decision at `organizationTypes[type].scimProvisioning.enabled` in the app config —\n  // the authority the app-global MOUNT gate and the SCIM controller auth gate\n  // (`isScimProvisioningEnabledForOrg`) consult. NB: the invitation `managementMode` resolver and\n  // the invite-accept credential block key instead on per-org ACTIVE management (the\n  // DIRECTORY_PROVISIONING feature + a live SCIM token — see `isOrgActivelyDirectoryManaged` /\n  // AUTH-23), so a SCIM-capable type does not by itself forbid local credentials. A per-scope\n  // `scimEnabled` on this row would duplicate the type-level authority, could silently drift from\n  // it, and was read by nothing. This row governs only WHAT HAPPENS to users once SCIM is on.\n  // `.isAuditEvidence()` on the four below — every one decides what the DIRECTORY is allowed to do\n  // to member accounts and with what standing. `defaultRole` in particular is a role GRANT: SCIM\n  // provisions through an internal execution context, so it is NOT bounded by any caller's role\n  // ceiling (see `defaultUnitRole`'s note below) — configuring it IS granting the role, which is\n  // exactly the class of change an auditor must be able to reconstruct with before/after values.\n  // `autoDeactivateUsers` is the deprovisioning switch; flipping it off silently strands access.\n  // None of these is personal data — they are flags and role names — so recording their values\n  // does not conflict with the minimisation rule that keeps user-identifying fields unmarked.\n  // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the switches that create accounts and\n  // deprovision access.\n  autoCreateUsers: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  autoVerifyEmail: z.boolean().default(true),\n  autoDeactivateUsers: z.boolean().default(true).isAuditEvidence(),\n  defaultRole: z.string().optional().isAuditEvidence(),\n  attributeMapping: ScimAttributeMappingSchema.optional(),\n\n  /**\n   * Declared bindings from the directory's `department` value to an ORGANIZATION UNIT.\n   *\n   * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory becomes the authority\n   * for which unit a member belongs to.\n   *\n   * Explicit and unit-id-addressed on purpose. Since units are an authorization axis, resolving a\n   * flat directory string to the wrong node in the tree grants the wrong DATA — and `code` is unique\n   * only among siblings while `name` is freeform, so a search-based match is genuinely ambiguous.\n   * Nothing here guesses: a value with no declared binding is ignored, and no unit is ever created.\n   *\n   * ⚠️ **Declaring this makes SCIM AUTHORITATIVE over the member's unit assignments.** Every push\n   * replaces the member's assignments with exactly what the directory says, so leaving a department\n   * actually revokes its access — and assignments made BY HAND in the application are removed too.\n   * An organization that wants manual unit assignments should leave this empty. Reconciliation only\n   * runs when this list is non-empty AND {@link ScimProvisioningConfigBaseSchema.shape.defaultUnitRole}\n   * is set, so an organization that never opted in can never have assignments deleted by a push.\n   */\n  // `.isAuditEvidence()` — declaring a binding makes SCIM AUTHORITATIVE over unit assignments\n  // (see the warning above), so the mapping list is an authorization surface, not preferences.\n  organizationUnitMapping: z.array(ScimOrganizationUnitMappingEntrySchema).optional().isAuditEvidence(),\n\n  /**\n   * The role every SCIM-created unit assignment carries.\n   *\n   * Deliberately SEPARATE from {@link ScimProvisioningConfigBaseSchema.shape.defaultRole}, which is the\n   * ORGANIZATION-wide role. A unit grant and an organization grant are different authority over\n   * different row sets; one field meaning both would merge two scopes that the whole narrowing model\n   * exists to keep apart.\n   *\n   * ⚠️ SCIM provisions through an internal execution context, so this value is NOT bounded by a\n   * caller's role ceiling — exactly as `defaultRole` is not. The gate is the write to THIS row, which\n   * is organization-admin-gated. Treat configuring it as granting the role.\n   */\n  // `.isAuditEvidence()` — a role grant on a DIFFERENT authority axis than `defaultRole`, and the\n  // JSDoc above says it plainly: treat configuring it as granting the role.\n  defaultUnitRole: z.string().optional().isAuditEvidence(),\n\n  /**\n   * The API-relative path an external IdP pushes SCIM traffic to, e.g. `/api/v1/scim/v2`.\n   *\n   * VIRTUAL (computed per read, never persisted, never accepted on write) because it is\n   * derived deployment routing — not tenant data. Storing it would let a row drift from the\n   * route the server actually mounts, which is precisely the class of lie this field replaces:\n   * it supersedes a dead custom-implementation that injected a hardcoded `/api/scim/v2`,\n   * **missing the `/api/v1` mount prefix and therefore simply wrong**. Built from\n   * {@link MAIN_API_BASE_PATH} — the documented single source of truth for the prefix — so a\n   * future mount change moves this field with it instead of stranding a literal.\n   *\n   * PATH, not an absolute URL: the host lives in `runtime.endPoints.main_backend_api.publicUrl`,\n   * reachable only through `AppConfigService`, whose DI symbol lives in `saas-backend-lib` —\n   * unreachable from this shared package without inverting the dependency direction. `publicUrl`\n   * is also optional, so an absolute form would frequently resolve to nothing. Callers that need\n   * the absolute endpoint compose it against their own API base (the frontend already knows it).\n   *\n   * Identical on both scope variants: the SCIM controller mounts ONE app-global router and\n   * separates tenants by bearer token, not by path.\n   */\n  scimEndpointUrl: z.string().optional().isVirtual({\n    calculate: () => SCIM_SERVICE_BASE_PATH,\n  }),\n\n  /**\n   * The email domains SCIM provisioning will accept, mirroring the gate actually enforced at\n   * push time — `EnterpriseUserProvisioningBackendService.provisionEnterpriseUser` rejects an IdP profile\n   * whose email domain is absent from this list.\n   *\n   * VIRTUAL and read live from the scope's SSO config rather than stored here: the domains are\n   * OWNED by `SsoConfig.domains` (verified via DNS there), so persisting a copy on this row\n   * would denormalize a security-relevant allow-list and let it go stale against the owner —\n   * exactly the drift `forwardedLabel` exists to avoid. Same predicate as the enforcement path\n   * (`SCIMControllerBackendService._getProvisioningConfig`): a domain counts only once DNS\n   * verification has actually passed, so `verifiedDomains` is filtered by\n   * `domainVerificationStatus`. Deliberately NOT the looser `verifiedDomains || ssoEnabledDomains`\n   * union used by domain→org lookup — widening this list would widen a security gate.\n   *\n   * `[]` and `undefined` are DISTINCT and both meaningful:\n   * - `[]` — the SSO config exists and has no verified domain ⇒ **unrestricted** (the enforcement\n   *   check is skipped entirely when the list is empty). This is the honest reading of the value.\n   * - `undefined` — the SSO config could not be read ⇒ **undetermined**. Degrading to `[]` here\n   *   would render an unread config as \"unrestricted\", overstating what we know.\n   *\n   * Fail-safe: never throws — this is a display mirror, not the enforcement point.\n   */\n  allowedDomains: z.array(z.string()).optional().isVirtual({\n    dependencies: SCIM_SCOPE_FK_TO_SSO_CONFIG.map(([fk]) => fk),\n    calculate: async ({ currentObject, utils }) => {\n      const row = currentObject as Record<string, unknown> | undefined;\n\n      const scope = SCIM_SCOPE_FK_TO_SSO_CONFIG\n        .map(([fk, ssoResourceType]) => ({ fk, ssoResourceType, value: row?.[fk] }))\n        .find(({ value }) => value !== null && value !== undefined && String(value).length > 0);\n      if (!scope) return undefined;\n\n      const scopeId = String(scope.value);\n      const ssoRepository = utils?.repositories?.getRepository?.(scope.ssoResourceType);\n      if (!ssoRepository || typeof ssoRepository.findFieldValuesByJoinField !== 'function') return undefined;\n\n      try {\n        const rowsByScopeId: Map<string, Record<string, unknown>> =\n          await ssoRepository.findFieldValuesByJoinField(scope.fk, [scopeId], ['domains']);\n        const domains = rowsByScopeId.get(scopeId)?.['domains'] as\n          | { verifiedDomains?: string[]; domainVerificationStatus?: Record<string, string> }\n          | undefined;\n        if (!domains) return undefined;\n\n        // The one derivation (#457), not a sixth hand-written join. `undefined` above is still\n        // DISTINCT from the `[]` this can return — see the field's docstring; the helper answers\n        // \"which are verified\", and only the caller knows whether the config was readable at all.\n        return resolveVerifiedDomains(domains);\n      } catch (error) {\n        utils?.logger?.warn?.(\n          `[scimProvisioningConfig.allowedDomains] SSO config read failed for ${scope.fk}=${scopeId}; reporting undetermined`,\n          error,\n        );\n        return undefined;\n      }\n    },\n  }),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimProvisioningConfigBase = z.infer<typeof ScimProvisioningConfigBaseSchema>;\n\nexport const scimProvisioningConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'scimProvisioningConfig',\n  baseFieldIdentifier: 'scimProvisioningConfigId',\n  baseEnumKey: 'SCIM_PROVISIONING_CONFIG',\n  baseSchema: ScimProvisioningConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,oBAAY,qBAAqB;IAC/B,cAAc,kBAAkB;IAChC,YAAY,gBAAgB;IAC5B,YAAY,gBAAgB;CAC7B;AAID,eAAO,MAAM,kCAAkC;;;kBAG7C,CAAC;AAEH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE,eAAO,MAAM,iCAAiC;;;;kBAI5C,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;kBAK5C,CAAC;AAIH,eAAO,MAAM,8BAA8B,yQA8J1C,CAAC"}
+{"version":3,"file":"scim-tokens.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,oBAAY,qBAAqB;IAC/B,cAAc,kBAAkB;IAChC,YAAY,gBAAgB;IAC5B,YAAY,gBAAgB;CAC7B;AAID,eAAO,MAAM,kCAAkC;;;kBAG7C,CAAC;AAEH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE,eAAO,MAAM,iCAAiC;;;;kBAI5C,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;kBAK5C,CAAC;AAIH,eAAO,MAAM,8BAA8B,yQA8J1C,CAAC"}

package/dist/esm/security/authentications/scim/scim-tokens.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;;;;;iBA0B9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,gCAAgC;;;;;;;;;;kBAY3C,CAAC"}
+{"version":3,"file":"scim-tokens.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;;;;;iBA0B9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,gCAAgC;;;;;;;;;;kBAY3C,CAAC"}

package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAW/G,oBAAY,0BAA0B;IACpC,YAAY,gBAAgB;IAC5B,SAAS,aAAa;IACtB,SAAS,aAAa;CACvB;AAID,eAAO,MAAM,qCAAqC;;iBAEhD,CAAC;AAEH,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAE/D,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAI/D,eAAO,MAAM,mCAAmC,mRAsK/C,CAAC"}
+{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAW/G,oBAAY,0BAA0B;IACpC,YAAY,gBAAgB;IAC5B,SAAS,aAAa;IACtB,SAAS,aAAa;CACvB;AAID,eAAO,MAAM,qCAAqC;;iBAEhD,CAAC;AAEH,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAE/D,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAI/D,eAAO,MAAM,mCAAmC,mRAsK/C,CAAC"}

package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-dlq.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAC;AAEX,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;iBAqBpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;kBAQhD,CAAC"}
+{"version":3,"file":"siem-delivery-dlq.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAC;AAEX,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;iBAqBpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;kBAQhD,CAAC"}

package/dist/esm/security/authentications/siem/siem-delivery-reliability-contract.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-reliability-contract.shared.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-reliability-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;IAC7C,2FAA2F;;IAE3F,mEAAmE;;CAE3D,CAAC;AAEX,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,EAAE,MAAqF,CAAC"}
+{"version":3,"file":"siem-delivery-reliability-contract.shared.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-reliability-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;IAC7C,2FAA2F;;IAE3F,mEAAmE;;CAE3D,CAAC;AAEX,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,EAAE,MAAqF,CAAC"}

package/dist/esm/security/authentications/siem/siem-delivery-reliability-contract.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-reliability-contract.shared.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-reliability-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,2FAA2F;IAC3F,8BAA8B,EAAE,CAAC;IACjC,mEAAmE;IACnE,6BAA6B,EAAE,CAAC;CACxB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAAW,kCAAkC,CAAC,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC","sourcesContent":["/**\n * What an operator can rely on when a SIEM receiver starts failing.\n *\n * The retry count, backoff and timeout are configurable per organization and already live on\n * `SiemExportConfigBaseSchema`. The circuit breaker is not configurable: it is a fixed protection\n * against a failing receiver absorbing the delivery worker, and it was two module-private constants\n * inside the delivery service. That is why the operations page could describe the breaker's\n * existence but never say when it opens or how long it stays open — the numbers had no name the\n * documentation could cite.\n *\n * The delivery service derives from this object and the customer documentation projects it.\n */\nexport const SIEM_DELIVERY_RELIABILITY_CONTRACT = {\n  /** Consecutive delivery failures to one destination before deliveries to it are paused. */\n  circuitBreakerFailureThreshold: 5,\n  /** How long the pause lasts before one delivery is tried again. */\n  circuitBreakerCooldownMinutes: 5,\n} as const;\n\n/** The cooldown in milliseconds, for the delivery worker's own timers. */\nexport const SIEM_CIRCUIT_BREAKER_COOLDOWN_MS: number = SIEM_DELIVERY_RELIABILITY_CONTRACT.circuitBreakerCooldownMinutes * 60 * 1000;\n"]}
+{"version":3,"file":"siem-delivery-reliability-contract.shared.js","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-reliability-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,2FAA2F;IAC3F,8BAA8B,EAAE,CAAC;IACjC,mEAAmE;IACnE,6BAA6B,EAAE,CAAC;CACxB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAAW,kCAAkC,CAAC,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC","sourcesContent":["/**\n * What an operator can rely on when a SIEM receiver starts failing.\n *\n * The retry count, backoff and timeout are configurable per organization and already live on\n * `SiemExportConfigBaseSchema`. The circuit breaker is not configurable: it is a fixed protection\n * against a failing receiver absorbing the delivery worker, and it was two module-private constants\n * inside the delivery service. That is why the operations page could describe the breaker's\n * existence but never say when it opens or how long it stays open — the numbers had no name the\n * documentation could cite.\n *\n * The delivery service derives from this object and the customer documentation projects it.\n */\nexport const SIEM_DELIVERY_RELIABILITY_CONTRACT = {\n  /** Consecutive delivery failures to one destination before deliveries to it are paused. */\n  circuitBreakerFailureThreshold: 5,\n  /** How long the pause lasts before one delivery is tried again. */\n  circuitBreakerCooldownMinutes: 5,\n} as const;\n\n/** The cooldown in milliseconds, for the delivery worker's own timers. */\nexport const SIEM_CIRCUIT_BREAKER_COOLDOWN_MS: number = SIEM_DELIVERY_RELIABILITY_CONTRACT.circuitBreakerCooldownMinutes * 60 * 1000;\n"]}

package/dist/esm/security/authentications/siem/siem-export-config.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,eAAO,MAAM,oCAAoC,yNA0FhD,CAAC"}
+{"version":3,"file":"siem-export-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,eAAO,MAAM,oCAAoC,yNA0FhD,CAAC"}

package/dist/esm/security/authentications/siem/siem-export-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;CAMpB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4DrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAMjD,CAAC"}
+{"version":3,"file":"siem-export-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;CAMpB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4DrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAMjD,CAAC"}

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.d.ts

@@ -14,13 +14,13 @@ export declare enum SsoConfig_Operations {
 }
 export declare const SsoConfig_ClaimDomainRequestDto: z.ZodObject<{
     domain: z.ZodString;
-}, z.core.$strict>;
+}, z.core.$strip>;
 export declare const SsoConfig_VerifyDomainRequestDto: z.ZodObject<{
     domain: z.ZodString;
-}, z.core.$strict>;
+}, z.core.$strip>;
 export declare const SsoConfig_RevokeDomainRequestDto: z.ZodObject<{
     domain: z.ZodString;
-}, z.core.$strict>;
+}, z.core.$strip>;
 /**
  * The claim response is the ONLY disclosure of the challenge nonce.
  *

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAsB/G,oBAAY,oBAAoB;IAC9B,YAAY,gBAAgB;IAC5B,aAAa,iBAAiB;IAC9B,aAAa,iBAAiB;CAC/B;AAiBD,eAAO,MAAM,+BAA+B;;kBAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;kBAE3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;kBAE3C,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;IAG3C,2EAA2E;;IAE3E,qDAAqD;;kBAErD,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;IAI5C;;;;OAIG;;kBAEH,CAAC;AAEH,eAAO,MAAM,iCAAiC;;IAE5C,iFAAiF;;kBAEjF,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC7F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC/F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAI/F,eAAO,MAAM,6BAA6B,wQAyOzC,CAAC"}
+{"version":3,"file":"sso-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAsB/G,oBAAY,oBAAoB;IAC9B,YAAY,gBAAgB;IAC5B,aAAa,iBAAiB;IAC9B,aAAa,iBAAiB;CAC/B;AAkCD,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;IAG3C,2EAA2E;;IAE3E,qDAAqD;;kBAErD,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;IAI5C;;;;OAIG;;kBAEH,CAAC;AAEH,eAAO,MAAM,iCAAiC;;IAE5C,iFAAiF;;kBAEjF,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC7F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC/F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAI/F,eAAO,MAAM,6BAA6B,wQAsPzC,CAAC"}

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.js

@@ -42,13 +42,30 @@ const SsoConfig_DomainSelector = z.string()
     .min(4)
     .max(253)
     .regex(SSO_DOMAIN_PATTERN, 'Provide a DNS hostname with at least two labels, e.g. "customer.com".');
-export const SsoConfig_ClaimDomainRequestDto = z.strictObject({
+/*
+ * ── `z.object`, NOT `z.strictObject` — and that is a CONTRACT, not a relaxation ────────────────
+ *
+ * These three shipped as `strictObject` and every claim answered **400 `unrecognized_keys:
+ * ["domains"]`**, measured over HTTP on 2026-09-09. The framework MERGES a PREFIX hook's returned
+ * patch into the request payload and re-parses the result against THIS schema — so the `domains`
+ * block the planner just computed arrived at a schema that knows only `domain`, and a strict schema
+ * refuses what it does not recognise. A prefix that contributes a persisted field is therefore
+ * structurally incompatible with a strict request DTO; every sibling lifecycle verb in the engine
+ * (`organizations.requestDeletion`, `activate`, `restore`) uses `z.object` for exactly this reason.
+ *
+ * `z.object` STRIPS the unrecognised key instead of refusing it, which on its own would turn the
+ * 400 into the quieter defect — 200 having persisted nothing. What closes that half is
+ * `authoritativeFields: ['domains']` on each custom-implementation registration, which re-attaches
+ * the hook's value after the strip and makes a caller-supplied `domains` be overwritten rather than
+ * honoured. The two halves are one decision; neither works alone.
+ */
+export const SsoConfig_ClaimDomainRequestDto = z.object({
     domain: SsoConfig_DomainSelector,
 });
-export const SsoConfig_VerifyDomainRequestDto = z.strictObject({
+export const SsoConfig_VerifyDomainRequestDto = z.object({
     domain: SsoConfig_DomainSelector,
 });
-export const SsoConfig_RevokeDomainRequestDto = z.strictObject({
+export const SsoConfig_RevokeDomainRequestDto = z.object({
     domain: SsoConfig_DomainSelector,
 });
 /**
@@ -155,7 +172,20 @@ export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurat
         // REPOSITORY_ONLY. There is deliberately no API_CALL variant — one tenant enumerating every
         // other tenant's SSO policy is the opposite of what this resource is for, and the probe that
         // needs the enumeration answers a single yes/no question and returns no row to a caller.
-        // Admin tier / HIGH.
+        //
+        // Admin tier / MEDIUM — and MEDIUM rather than HIGH is a correction, not a downgrade. This
+        // shipped at HIGH and was the FIRST read-shaped HIGH operation in the catalogue, which broke
+        // the measurement `resource-operation-audit-emission.backend.test.ts` calls "the one the whole
+        // design rests on": `RESOURCE_OPERATION_PERFORMED` is deliberately not emitted for a read, and
+        // `FIELD_ACCESS` fires only on a disclosed marked field — so a read declared inside
+        // `AUTOMATIC_AUDIT_RISK_FLOOR` promises evidence that CANNOT exist on either axis, and the
+        // most dangerous read in the catalogue would be the one leaving no trace.
+        //
+        // The crossing is nonetheless recorded, on the axis that can carry it: the probe reaches this
+        // verb through `SystemAccessService.listAsSystem`, which emits its own `SYSTEM_CONTEXT_*`
+        // event — that is precisely why the comment on `systemAccessPolicy.list` above refuses the
+        // repository shortcut. So the declaration moves to where the evidence actually is instead of
+        // claiming a row nothing writes.
         [CoreResourceOperation.LIST]: {
             variants: [{
                     variantType: ResourceOperationVariantType.INTERNAL_CALL,
@@ -164,7 +194,7 @@ export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurat
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
-                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
                 }],
         },
         // Internal-only (INTERNAL_CALL, NO HTTP route): admin policy edits reach this

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAExG,wEAAwE;AACxE,EAAE;AACF,4FAA4F;AAC5F,kGAAkG;AAClG,8FAA8F;AAC9F,EAAE;AACF,mGAAmG;AACnG,qFAAqF;AACrF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAElE,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,oDAA4B,CAAA;IAC5B,sDAA8B,CAAA;IAC9B,sDAA8B,CAAA;AAChC,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,mEAAmE,CAAC;AAE/F,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,EAAE;KACxC,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,kBAAkB,EAAE,uEAAuE,CAAC,CAAC;AAEtG,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,2EAA2E;IAC3E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,qDAAqD;IACrD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,iFAAiF;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAMH,wEAAwE;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAAG,uCAAuC,CAClF,+BAA+B,EAC/B;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,oBAAoB;IACrC,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,oEAAoE;IACpE,2EAA2E;IAC3E,gFAAgF;IAChF,8EAA8E;IAC9E,iBAAiB;IACjB,EAAE;IACF,+FAA+F;IAC/F,0FAA0F;IAC1F,4FAA4F;IAC5F,8FAA8F;IAC9F,cAAc;IACd,6FAA6F;IAC7F,8FAA8F;IAC9F,sFAAsF;IACtF,uFAAuF;IACvF,wFAAwF;IACxF,sFAAsF;IACtF,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IAClK,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yFAAyF;QACzF,sEAAsE;QACtE,6FAA6F;QAC7F,4EAA4E;QAC5E,uFAAuF;QACvF,4FAA4F;QAC5F,6FAA6F;QAC7F,yFAAyF;QACzF,qBAAqB;QACrB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,8EAA8E;QAC9E,yFAAyF;QACzF,iFAAiF;QACjF,gFAAgF;QAChF,2FAA2F;QAC3F,6FAA6F;QAC7F,0FAA0F;QAC1F,+EAA+E;QAC/E,6FAA6F;QAC7F,sCAAsC;QACtC,+DAA+D;QAC/D,mFAAmF;QACnF,oDAAoD;QACpD,mFAAmF;QACnF,qFAAqF;QACrF,sFAAsF;QACtF,wEAAwE;QACxE,yEAAyE;QACzE,sFAAsF;QACtF,kFAAkF;QAClF,sFAAsF;QACtF,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,6EAA6E;QAC7E,qEAAqE;QACrE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2CG;QACH,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,0FAA0F;oBAC1F,uFAAuF;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,+BAA+B;oBAC3C,iBAAiB,EAAE,gCAAgC;iBACpD,CAAC;SACH;QAED,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,sFAAsF;oBACtF,wFAAwF;oBACxF,oBAAoB;oBACpB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;QAED,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,0FAA0F;oBAC1F,gFAAgF;oBAChF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SSO Config Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...ssoConfigPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { DomainVerificationStatus, ssoConfigPolymorphicDeclaration } from './sso-config.shared.schemas';\n\n// ── Domain-ownership operations ──────────────────────────────────────\n//\n// Enterprise domain routing sends every `@customer.com` sign-in to that customer's identity\n// provider. Reaching the VERIFIED state used to require an out-of-band database write, which made\n// enterprise onboarding a support ticket forever (#424). These three operations are the door.\n//\n// They are entity-level operations on a resource that is a ONE-to-ONE COMPOSITION under its scope,\n// so the URL builder omits the id segment and the scope in the path selects the row:\n//   PUT /organizations/{organizationId}/sso-configs/claim-domain\n//   PUT /organizations/{organizationId}/sso-configs/verify-domain\n//   PUT /organizations/{organizationId}/sso-configs/revoke-domain\n\nexport enum SsoConfig_Operations {\n  CLAIM_DOMAIN = 'claimDomain',\n  VERIFY_DOMAIN = 'verifyDomain',\n  REVOKE_DOMAIN = 'revokeDomain',\n}\n\n/**\n * A DNS hostname, syntactically. Two labels minimum — a single label is not a domain anyone can\n * publish a TXT record under, and accepting one would mint a challenge that can never be answered.\n *\n * Case is NOT normalised here. The backend lowercases before every read and every write, because\n * that is where the stored map keys are decided; doing it in two places would make the request\n * contract look like the authority when it is not.\n */\nconst SSO_DOMAIN_PATTERN = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))+$/;\n\nconst SsoConfig_DomainSelector = z.string()\n  .min(4)\n  .max(253)\n  .regex(SSO_DOMAIN_PATTERN, 'Provide a DNS hostname with at least two labels, e.g. \"customer.com\".');\n\nexport const SsoConfig_ClaimDomainRequestDto = z.strictObject({\n  domain: SsoConfig_DomainSelector,\n});\n\nexport const SsoConfig_VerifyDomainRequestDto = z.strictObject({\n  domain: SsoConfig_DomainSelector,\n});\n\nexport const SsoConfig_RevokeDomainRequestDto = z.strictObject({\n  domain: SsoConfig_DomainSelector,\n});\n\n/**\n * The claim response is the ONLY disclosure of the challenge nonce.\n *\n * `domainVerificationTokens` is `.isBackendOnly()`, so no READ of the config ever returns it — an\n * operator who loses this response claims again, which mints a new nonce and invalidates the old\n * one. `.isEphemeral()` marks `dnsRecordValue` as a revealed-once secret, the same contract the\n * SCIM token mint uses for its one-time plaintext.\n */\nexport const SsoConfig_ClaimDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  status: z.enum(DomainVerificationStatus),\n  /** The DNS name the TXT record goes on: `_wildo-verification.<domain>`. */\n  dnsName: z.string(),\n  /** The exact TXT value to publish. Revealed once. */\n  dnsRecordValue: z.string().isEphemeral(),\n});\n\nexport const SsoConfig_VerifyDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  status: z.enum(DomainVerificationStatus),\n  dnsName: z.string(),\n  /**\n   * Every TXT record found at `dnsName`, so a failed check is diagnosable without a second tool.\n   * These are public DNS records of a domain the caller is claiming to own — echoing them discloses\n   * nothing the caller could not resolve themselves.\n   */\n  dnsRecordsFound: z.array(z.string()),\n});\n\nexport const SsoConfig_RevokeDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  /** True once the domain holds no claim, no status and no nonce in this scope. */\n  revoked: z.boolean(),\n});\n\nexport type SsoConfig_ClaimDomainResponse = z.infer<typeof SsoConfig_ClaimDomainResponseDto>;\nexport type SsoConfig_VerifyDomainResponse = z.infer<typeof SsoConfig_VerifyDomainResponseDto>;\nexport type SsoConfig_RevokeDomainResponse = z.infer<typeof SsoConfig_RevokeDomainResponseDto>;\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n  ssoConfigPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: SsoConfig_Operations,\n    // The auth runtime loads the org SSO config via `readAsSystem` during login,\n    // before the user's roles/membership are established (READ). When the row is\n    // absent — a provisioned / migrated / pre-seed org that bypassed the\n    // `afterCreate` default-seed — that same userless login path lazily\n    // materialises the disabled-default row via `createAsSystem` (CREATE); see\n    // `AuthOrganizationConfigurationService.loadSSOConfig`. Both are system-context\n    // (the logging-in user is not the config's admin owner), so the resource opts\n    // BOTH verbs in.\n    //\n    // `list` is the DOMAIN-EXCLUSIVITY probe and nothing else (#424). At most one scope may hold a\n    // domain VERIFIED, or a `@customer.com` sign-in routes non-deterministically to whichever\n    // config the lookup happens to reach first. Answering \"does another scope already hold this\n    // domain\" is unavoidably a cross-scope read, and the two candidates that avoid this grant are\n    // both worse:\n    //   - `AuthOrganizationConfigurationService.getAllOrganizationIds()` enumerates an IN-MEMORY\n    //     CACHE of scopes whose config has been loaded, so it under-reports on a cold process. An\n    //     exclusivity check built on it answers \"nobody else holds it\" from an incomplete\n    //     population — the negative-result failure that produces a confident wrong answer;\n    //   - reaching the repository directly bypasses the `systemAccessPolicy` opt-in AND the\n    //     `SYSTEM_CONTEXT_*` audit event, which is a bigger grant wearing a smaller name.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n      // materialised by the framework default-seed (repository tier) OR — when that\n      // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n      // userless login path via `createAsSystem` (`systemAccessPolicy.create` opts\n      // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n      // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n      // self-alerting on mere construction) on every login for a config-less org.\n      // No public HTTP create surface (config is seeded/bootstrapped, never\n      // self-serve). Same fix as the SCIM-tokens READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the ONE caller is the domain-exclusivity\n      // probe described on `systemAccessPolicy.list` above, reached through\n      // `SystemAccessService.listAsSystem`. It must NOT be REPOSITORY_ONLY for the same reason the\n      // CREATE and UPDATE below are not: `listAsSystem` resolves the verb through\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL and rejects\n      // REPOSITORY_ONLY. There is deliberately no API_CALL variant — one tenant enumerating every\n      // other tenant's SSO policy is the opposite of what this resource is for, and the probe that\n      // needs the enumeration answers a single yes/no question and returns no row to a caller.\n      // Admin tier / HIGH.\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): admin policy edits reach this\n      // through the config service path — `AuthOrganizationConfigurationService.saveSSOConfig`\n      // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC,\n      // preserving admin audit attribution. The comment here used to say the path was\n      // \"correct-but-dormant\" because `DomainVerificationBackendService` had no public operation\n      // wired to it, and warned against \"simplifying\" the variant on the theory that nothing calls\n      // it. That warning was right and is now moot: the domain workflow it was holding the door\n      // open for exists (`claimDomain` / `verifyDomain` / `revokeDomain` below), and\n      // `initiateDomainVerification` / `verifyDomainOwnership` still reach this INTERNAL_CALL path\n      // for callers that hold no operation.\n      // Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT\n      // REPOSITORY_ONLY — a repository-only UPDATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) on any admin\n      // domain edit (and, post lazy-create fix, `loadSSOConfig` always materialises a row,\n      // so `saveSSOConfig` reliably hits THIS update branch). No public HTTP update surface\n      // (future supported edits flow through this internal service path). The\n      // `socialCredentialOverrides` write-only-secret-preservation custom-impl\n      // (`createSsoConfigUpdateFactories`) is keyed on this variant and MOVES IN LOCKSTEP —\n      // the custom-impl dispatch key encodes variantType, so a REPOSITORY_ONLY drift on\n      // either side silently drops the PREFIX and wipes per-override secrets on every save.\n      // Same fix as the CREATE above + the SCIM-tokens READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n      // onParentDelete cascade so this one-per-scope SSO-config row is physically\n      // removed when its owning org/app is deleted. Without a DELETE op the cascade\n      // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a\n      // config row. This deletes the whole row; domain mutation is not currently a\n      // public operation. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n\n      /*\n       * ─── The three domain-ownership doors (#424) ────────────────────────────────────────────\n       *\n       * ## Why the tenant's own admin, and NOT a platform operator\n       *\n       * None of the three declares `admitsCrossTenantPlatformAdministration`, and that is a\n       * decision rather than an omission. A platform operator crossing into a tenant is justified\n       * when the tenant CANNOT act for itself — `organizationMembers.grantOwnership` repairs a\n       * tenant with no owner. Domain ownership is the opposite shape: the party who must prove it\n       * is the party who controls the DNS, and the operator controls neither the DNS nor the\n       * business relationship. A crossing here would let a platform administrator hand one tenant\n       * routing control over every sign-in at a domain, with the tenant's own admins unable to see\n       * why. The ambient reach `.claude/rules/administrative-continuity-floors.md` forbids is\n       * exactly this.\n       *\n       * ## Why each is UPDATE-like\n       *\n       * All three mutate `domains` on the scope's single config row, so they borrow UPDATE and get\n       * a PUT that carries a body. The domain travels in the BODY, never in the URL: a domain name\n       * is a customer identity, and a GET would write it into every access log between the operator\n       * and the server.\n       *\n       * ## Where the work happens\n       *\n       * Each is implemented as a PREFIX that returns the new `domains` object, which the core\n       * UPDATE persists — the organization-units MOVE/ARCHIVE shape. Deliberately NOT `OVERRIDE_ALL`:\n       * that mode returns before the framework's post-operation lane and would therefore emit NO\n       * `RESOURCE_OPERATION_PERFORMED` audit event, which is the one control that makes a\n       * privileged configuration change with cross-tenant reach accountable. See\n       * `sso-config-domain-verification.custom-impl.backend.service.ts`.\n       *\n       * ## What the trail carries\n       *\n       * All three sit at or above `AUTOMATIC_AUDIT_RISK_FLOOR`, so no `auditableEvent` declaration\n       * is needed. `domains.verifiedDomains`, `domains.ssoEnabledDomains` and\n       * `domains.domainVerificationStatus` are `.isAuditEvidence()`, so the row carries the\n       * before/after of the claimed set and the status map — i.e. WHICH domain moved, and to what.\n       * `domains.domainVerificationTokens` is not marked and must never be: it is the challenge\n       * nonce, and the ledger it would land in cannot be scrubbed.\n       *\n       * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a verified domain decides which\n       * identity provider authenticates every principal at that domain.\n       * assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — the domain-ownership trail.\n       */\n      [SsoConfig_Operations.CLAIM_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // HIGH, not CRITICAL: a claim grants NOTHING. It records `pending` and mints a nonce, and\n          // every routing reader gates on `verified`. The step that confers authority is VERIFY.\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_ClaimDomainRequestDto,\n          customResponseDto: SsoConfig_ClaimDomainResponseDto,\n        }],\n      },\n\n      [SsoConfig_Operations.VERIFY_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // CRITICAL: this is the transition that hands a tenant SSO routing control over EVERY\n          // person who signs in with an address at the domain — including people who are not that\n          // tenant's members.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_VerifyDomainRequestDto,\n          customResponseDto: SsoConfig_VerifyDomainResponseDto,\n        }],\n      },\n\n      [SsoConfig_Operations.REVOKE_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // CRITICAL for the same reason as VERIFY, from the other side: revocation is what makes a\n          // domain claimable by a different scope, so it is the hinge of every hand-over.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_RevokeDomainRequestDto,\n          customResponseDto: SsoConfig_RevokeDomainResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"sso-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAExG,wEAAwE;AACxE,EAAE;AACF,4FAA4F;AAC5F,kGAAkG;AAClG,8FAA8F;AAC9F,EAAE;AACF,mGAAmG;AACnG,qFAAqF;AACrF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAElE,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,oDAA4B,CAAA;IAC5B,sDAA8B,CAAA;IAC9B,sDAA8B,CAAA;AAChC,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,mEAAmE,CAAC;AAE/F,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,EAAE;KACxC,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,kBAAkB,EAAE,uEAAuE,CAAC,CAAC;AAEtG;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,2EAA2E;IAC3E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,qDAAqD;IACrD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,iFAAiF;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAMH,wEAAwE;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAAG,uCAAuC,CAClF,+BAA+B,EAC/B;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,oBAAoB;IACrC,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,oEAAoE;IACpE,2EAA2E;IAC3E,gFAAgF;IAChF,8EAA8E;IAC9E,iBAAiB;IACjB,EAAE;IACF,+FAA+F;IAC/F,0FAA0F;IAC1F,4FAA4F;IAC5F,8FAA8F;IAC9F,cAAc;IACd,6FAA6F;IAC7F,8FAA8F;IAC9F,sFAAsF;IACtF,uFAAuF;IACvF,wFAAwF;IACxF,sFAAsF;IACtF,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IAClK,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yFAAyF;QACzF,sEAAsE;QACtE,6FAA6F;QAC7F,4EAA4E;QAC5E,uFAAuF;QACvF,4FAA4F;QAC5F,6FAA6F;QAC7F,yFAAyF;QACzF,EAAE;QACF,2FAA2F;QAC3F,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,oFAAoF;QACpF,2FAA2F;QAC3F,0EAA0E;QAC1E,EAAE;QACF,8FAA8F;QAC9F,0FAA0F;QAC1F,2FAA2F;QAC3F,6FAA6F;QAC7F,iCAAiC;QACjC,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,8EAA8E;QAC9E,yFAAyF;QACzF,iFAAiF;QACjF,gFAAgF;QAChF,2FAA2F;QAC3F,6FAA6F;QAC7F,0FAA0F;QAC1F,+EAA+E;QAC/E,6FAA6F;QAC7F,sCAAsC;QACtC,+DAA+D;QAC/D,mFAAmF;QACnF,oDAAoD;QACpD,mFAAmF;QACnF,qFAAqF;QACrF,sFAAsF;QACtF,wEAAwE;QACxE,yEAAyE;QACzE,sFAAsF;QACtF,kFAAkF;QAClF,sFAAsF;QACtF,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,6EAA6E;QAC7E,qEAAqE;QACrE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2CG;QACH,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,0FAA0F;oBAC1F,uFAAuF;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,+BAA+B;oBAC3C,iBAAiB,EAAE,gCAAgC;iBACpD,CAAC;SACH;QAED,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,sFAAsF;oBACtF,wFAAwF;oBACxF,oBAAoB;oBACpB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;QAED,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,0FAA0F;oBAC1F,gFAAgF;oBAChF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SSO Config Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...ssoConfigPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { DomainVerificationStatus, ssoConfigPolymorphicDeclaration } from './sso-config.shared.schemas';\n\n// ── Domain-ownership operations ──────────────────────────────────────\n//\n// Enterprise domain routing sends every `@customer.com` sign-in to that customer's identity\n// provider. Reaching the VERIFIED state used to require an out-of-band database write, which made\n// enterprise onboarding a support ticket forever (#424). These three operations are the door.\n//\n// They are entity-level operations on a resource that is a ONE-to-ONE COMPOSITION under its scope,\n// so the URL builder omits the id segment and the scope in the path selects the row:\n//   PUT /organizations/{organizationId}/sso-configs/claim-domain\n//   PUT /organizations/{organizationId}/sso-configs/verify-domain\n//   PUT /organizations/{organizationId}/sso-configs/revoke-domain\n\nexport enum SsoConfig_Operations {\n  CLAIM_DOMAIN = 'claimDomain',\n  VERIFY_DOMAIN = 'verifyDomain',\n  REVOKE_DOMAIN = 'revokeDomain',\n}\n\n/**\n * A DNS hostname, syntactically. Two labels minimum — a single label is not a domain anyone can\n * publish a TXT record under, and accepting one would mint a challenge that can never be answered.\n *\n * Case is NOT normalised here. The backend lowercases before every read and every write, because\n * that is where the stored map keys are decided; doing it in two places would make the request\n * contract look like the authority when it is not.\n */\nconst SSO_DOMAIN_PATTERN = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))+$/;\n\nconst SsoConfig_DomainSelector = z.string()\n  .min(4)\n  .max(253)\n  .regex(SSO_DOMAIN_PATTERN, 'Provide a DNS hostname with at least two labels, e.g. \"customer.com\".');\n\n/*\n * ── `z.object`, NOT `z.strictObject` — and that is a CONTRACT, not a relaxation ────────────────\n *\n * These three shipped as `strictObject` and every claim answered **400 `unrecognized_keys:\n * [\"domains\"]`**, measured over HTTP on 2026-09-09. The framework MERGES a PREFIX hook's returned\n * patch into the request payload and re-parses the result against THIS schema — so the `domains`\n * block the planner just computed arrived at a schema that knows only `domain`, and a strict schema\n * refuses what it does not recognise. A prefix that contributes a persisted field is therefore\n * structurally incompatible with a strict request DTO; every sibling lifecycle verb in the engine\n * (`organizations.requestDeletion`, `activate`, `restore`) uses `z.object` for exactly this reason.\n *\n * `z.object` STRIPS the unrecognised key instead of refusing it, which on its own would turn the\n * 400 into the quieter defect — 200 having persisted nothing. What closes that half is\n * `authoritativeFields: ['domains']` on each custom-implementation registration, which re-attaches\n * the hook's value after the strip and makes a caller-supplied `domains` be overwritten rather than\n * honoured. The two halves are one decision; neither works alone.\n */\nexport const SsoConfig_ClaimDomainRequestDto = z.object({\n  domain: SsoConfig_DomainSelector,\n});\n\nexport const SsoConfig_VerifyDomainRequestDto = z.object({\n  domain: SsoConfig_DomainSelector,\n});\n\nexport const SsoConfig_RevokeDomainRequestDto = z.object({\n  domain: SsoConfig_DomainSelector,\n});\n\n/**\n * The claim response is the ONLY disclosure of the challenge nonce.\n *\n * `domainVerificationTokens` is `.isBackendOnly()`, so no READ of the config ever returns it — an\n * operator who loses this response claims again, which mints a new nonce and invalidates the old\n * one. `.isEphemeral()` marks `dnsRecordValue` as a revealed-once secret, the same contract the\n * SCIM token mint uses for its one-time plaintext.\n */\nexport const SsoConfig_ClaimDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  status: z.enum(DomainVerificationStatus),\n  /** The DNS name the TXT record goes on: `_wildo-verification.<domain>`. */\n  dnsName: z.string(),\n  /** The exact TXT value to publish. Revealed once. */\n  dnsRecordValue: z.string().isEphemeral(),\n});\n\nexport const SsoConfig_VerifyDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  status: z.enum(DomainVerificationStatus),\n  dnsName: z.string(),\n  /**\n   * Every TXT record found at `dnsName`, so a failed check is diagnosable without a second tool.\n   * These are public DNS records of a domain the caller is claiming to own — echoing them discloses\n   * nothing the caller could not resolve themselves.\n   */\n  dnsRecordsFound: z.array(z.string()),\n});\n\nexport const SsoConfig_RevokeDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  /** True once the domain holds no claim, no status and no nonce in this scope. */\n  revoked: z.boolean(),\n});\n\nexport type SsoConfig_ClaimDomainResponse = z.infer<typeof SsoConfig_ClaimDomainResponseDto>;\nexport type SsoConfig_VerifyDomainResponse = z.infer<typeof SsoConfig_VerifyDomainResponseDto>;\nexport type SsoConfig_RevokeDomainResponse = z.infer<typeof SsoConfig_RevokeDomainResponseDto>;\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n  ssoConfigPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: SsoConfig_Operations,\n    // The auth runtime loads the org SSO config via `readAsSystem` during login,\n    // before the user's roles/membership are established (READ). When the row is\n    // absent — a provisioned / migrated / pre-seed org that bypassed the\n    // `afterCreate` default-seed — that same userless login path lazily\n    // materialises the disabled-default row via `createAsSystem` (CREATE); see\n    // `AuthOrganizationConfigurationService.loadSSOConfig`. Both are system-context\n    // (the logging-in user is not the config's admin owner), so the resource opts\n    // BOTH verbs in.\n    //\n    // `list` is the DOMAIN-EXCLUSIVITY probe and nothing else (#424). At most one scope may hold a\n    // domain VERIFIED, or a `@customer.com` sign-in routes non-deterministically to whichever\n    // config the lookup happens to reach first. Answering \"does another scope already hold this\n    // domain\" is unavoidably a cross-scope read, and the two candidates that avoid this grant are\n    // both worse:\n    //   - `AuthOrganizationConfigurationService.getAllOrganizationIds()` enumerates an IN-MEMORY\n    //     CACHE of scopes whose config has been loaded, so it under-reports on a cold process. An\n    //     exclusivity check built on it answers \"nobody else holds it\" from an incomplete\n    //     population — the negative-result failure that produces a confident wrong answer;\n    //   - reaching the repository directly bypasses the `systemAccessPolicy` opt-in AND the\n    //     `SYSTEM_CONTEXT_*` audit event, which is a bigger grant wearing a smaller name.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n      // materialised by the framework default-seed (repository tier) OR — when that\n      // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n      // userless login path via `createAsSystem` (`systemAccessPolicy.create` opts\n      // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n      // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n      // self-alerting on mere construction) on every login for a config-less org.\n      // No public HTTP create surface (config is seeded/bootstrapped, never\n      // self-serve). Same fix as the SCIM-tokens READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the ONE caller is the domain-exclusivity\n      // probe described on `systemAccessPolicy.list` above, reached through\n      // `SystemAccessService.listAsSystem`. It must NOT be REPOSITORY_ONLY for the same reason the\n      // CREATE and UPDATE below are not: `listAsSystem` resolves the verb through\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL and rejects\n      // REPOSITORY_ONLY. There is deliberately no API_CALL variant — one tenant enumerating every\n      // other tenant's SSO policy is the opposite of what this resource is for, and the probe that\n      // needs the enumeration answers a single yes/no question and returns no row to a caller.\n      //\n      // Admin tier / MEDIUM — and MEDIUM rather than HIGH is a correction, not a downgrade. This\n      // shipped at HIGH and was the FIRST read-shaped HIGH operation in the catalogue, which broke\n      // the measurement `resource-operation-audit-emission.backend.test.ts` calls \"the one the whole\n      // design rests on\": `RESOURCE_OPERATION_PERFORMED` is deliberately not emitted for a read, and\n      // `FIELD_ACCESS` fires only on a disclosed marked field — so a read declared inside\n      // `AUTOMATIC_AUDIT_RISK_FLOOR` promises evidence that CANNOT exist on either axis, and the\n      // most dangerous read in the catalogue would be the one leaving no trace.\n      //\n      // The crossing is nonetheless recorded, on the axis that can carry it: the probe reaches this\n      // verb through `SystemAccessService.listAsSystem`, which emits its own `SYSTEM_CONTEXT_*`\n      // event — that is precisely why the comment on `systemAccessPolicy.list` above refuses the\n      // repository shortcut. So the declaration moves to where the evidence actually is instead of\n      // claiming a row nothing writes.\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): admin policy edits reach this\n      // through the config service path — `AuthOrganizationConfigurationService.saveSSOConfig`\n      // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC,\n      // preserving admin audit attribution. The comment here used to say the path was\n      // \"correct-but-dormant\" because `DomainVerificationBackendService` had no public operation\n      // wired to it, and warned against \"simplifying\" the variant on the theory that nothing calls\n      // it. That warning was right and is now moot: the domain workflow it was holding the door\n      // open for exists (`claimDomain` / `verifyDomain` / `revokeDomain` below), and\n      // `initiateDomainVerification` / `verifyDomainOwnership` still reach this INTERNAL_CALL path\n      // for callers that hold no operation.\n      // Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT\n      // REPOSITORY_ONLY — a repository-only UPDATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) on any admin\n      // domain edit (and, post lazy-create fix, `loadSSOConfig` always materialises a row,\n      // so `saveSSOConfig` reliably hits THIS update branch). No public HTTP update surface\n      // (future supported edits flow through this internal service path). The\n      // `socialCredentialOverrides` write-only-secret-preservation custom-impl\n      // (`createSsoConfigUpdateFactories`) is keyed on this variant and MOVES IN LOCKSTEP —\n      // the custom-impl dispatch key encodes variantType, so a REPOSITORY_ONLY drift on\n      // either side silently drops the PREFIX and wipes per-override secrets on every save.\n      // Same fix as the CREATE above + the SCIM-tokens READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n      // onParentDelete cascade so this one-per-scope SSO-config row is physically\n      // removed when its owning org/app is deleted. Without a DELETE op the cascade\n      // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a\n      // config row. This deletes the whole row; domain mutation is not currently a\n      // public operation. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n\n      /*\n       * ─── The three domain-ownership doors (#424) ────────────────────────────────────────────\n       *\n       * ## Why the tenant's own admin, and NOT a platform operator\n       *\n       * None of the three declares `admitsCrossTenantPlatformAdministration`, and that is a\n       * decision rather than an omission. A platform operator crossing into a tenant is justified\n       * when the tenant CANNOT act for itself — `organizationMembers.grantOwnership` repairs a\n       * tenant with no owner. Domain ownership is the opposite shape: the party who must prove it\n       * is the party who controls the DNS, and the operator controls neither the DNS nor the\n       * business relationship. A crossing here would let a platform administrator hand one tenant\n       * routing control over every sign-in at a domain, with the tenant's own admins unable to see\n       * why. The ambient reach `.claude/rules/administrative-continuity-floors.md` forbids is\n       * exactly this.\n       *\n       * ## Why each is UPDATE-like\n       *\n       * All three mutate `domains` on the scope's single config row, so they borrow UPDATE and get\n       * a PUT that carries a body. The domain travels in the BODY, never in the URL: a domain name\n       * is a customer identity, and a GET would write it into every access log between the operator\n       * and the server.\n       *\n       * ## Where the work happens\n       *\n       * Each is implemented as a PREFIX that returns the new `domains` object, which the core\n       * UPDATE persists — the organization-units MOVE/ARCHIVE shape. Deliberately NOT `OVERRIDE_ALL`:\n       * that mode returns before the framework's post-operation lane and would therefore emit NO\n       * `RESOURCE_OPERATION_PERFORMED` audit event, which is the one control that makes a\n       * privileged configuration change with cross-tenant reach accountable. See\n       * `sso-config-domain-verification.custom-impl.backend.service.ts`.\n       *\n       * ## What the trail carries\n       *\n       * All three sit at or above `AUTOMATIC_AUDIT_RISK_FLOOR`, so no `auditableEvent` declaration\n       * is needed. `domains.verifiedDomains`, `domains.ssoEnabledDomains` and\n       * `domains.domainVerificationStatus` are `.isAuditEvidence()`, so the row carries the\n       * before/after of the claimed set and the status map — i.e. WHICH domain moved, and to what.\n       * `domains.domainVerificationTokens` is not marked and must never be: it is the challenge\n       * nonce, and the ledger it would land in cannot be scrubbed.\n       *\n       * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a verified domain decides which\n       * identity provider authenticates every principal at that domain.\n       * assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — the domain-ownership trail.\n       */\n      [SsoConfig_Operations.CLAIM_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // HIGH, not CRITICAL: a claim grants NOTHING. It records `pending` and mints a nonce, and\n          // every routing reader gates on `verified`. The step that confers authority is VERIFY.\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_ClaimDomainRequestDto,\n          customResponseDto: SsoConfig_ClaimDomainResponseDto,\n        }],\n      },\n\n      [SsoConfig_Operations.VERIFY_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // CRITICAL: this is the transition that hands a tenant SSO routing control over EVERY\n          // person who signs in with an address at the domain — including people who are not that\n          // tenant's members.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_VerifyDomainRequestDto,\n          customResponseDto: SsoConfig_VerifyDomainResponseDto,\n        }],\n      },\n\n      [SsoConfig_Operations.REVOKE_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // CRITICAL for the same reason as VERIFY, from the other side: revocation is what makes a\n          // domain claimable by a different scope, so it is the hinge of every hand-over.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_RevokeDomainRequestDto,\n          customResponseDto: SsoConfig_RevokeDomainResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;;;;CAK3B,CAAC;AAEX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoO9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE,GAAG,SAAS,GAAG,MAAM,EAAE,CAKvB;AAED,gGAAgG;AAChG,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IACP,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE,GAAG,SAAS,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAGT;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1C,CAAC"}
+{"version":3,"file":"sso-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;;;;CAK3B,CAAC;AAEX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoO9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE,GAAG,SAAS,GAAG,MAAM,EAAE,CAKvB;AAED,gGAAgG;AAChG,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IACP,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE,GAAG,SAAS,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAGT;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1C,CAAC"}

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,oFAAoF;IACpF,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,aAAa;IACb,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,2FAA2F;IAC3F,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,kGAAkG;IAClG,+FAA+F;IAC/F,kGAAkG;IAClG,8DAA8D;IAC9D,EAAE;IACF,2EAA2E;IAC3E,0GAA0G;IAC1G,kGAAkG;IAClG,6FAA6F;IAC7F,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;QACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACzD,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAErC,oFAAoF;IACpF,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,kGAAkG;IAClG,0EAA0E;IAC1E,EAAE;IACF,+FAA+F;IAC/F,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB;;;;;;;;;;;;;;;;WAgBG;QACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAClE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QACpE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAClE;;;;;;;;;;;;WAYG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC9G;;;;;;;WAOG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;KACvF,CAAC;IAEF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC,eAAe,EAAE;IAEpB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACpE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAC5D,CAAC,CAAC,eAAe,EAAE;IAEpB,4FAA4F;IAC5F,gGAAgG;IAChG,wCAAwC;IACxC,iGAAiG;IACjG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,kGAAkG;QAClG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC;;;;;;;WAOG;QACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC,eAAe,EAAE;IAEpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;QACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;KACvD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EACjE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAG1B;IACX,MAAM,MAAM,GAAG,OAAO,EAAE,wBAAwB,IAAI,EAAE,CAAC;IACvD,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAC/D,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAC9B,OAGa,EACb,MAAc;IAEd,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnD,OAAO,EAAE,wBAAwB,EAAE,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;IACvE,gBAAgB,EAAE,WAAW;IAC7B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SSO Config Schema (Shared) — Polymorphic\n *\n * SSO enforcement, domain verification, provider restrictions, provisioning,\n * session settings, emergency access. Policy/settings layer only —\n * provider connections are a separate resource (SsoConnection).\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2A\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const DomainVerificationStatus = {\n  PENDING: 'pending',\n  VERIFIED: 'verified',\n  FAILED: 'failed',\n  EXPIRED: 'expired',\n} as const;\n\nexport const SsoConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // ── `.isAuditEvidence()` on the authentication-authority blocks ──────────────────────────────\n  // Every block below decides WHO may authenticate into this tenant and with what standing, so a\n  // change to one is an authorization change even though no role is named: weakening `requireSSO`,\n  // re-enabling `allowPasswordFallback`, granting a `defaultRole` on auto-provision, or adding a\n  // break-glass account each widen access tenant-wide. The generic resource-operation audit event\n  // records the changed field NAMES for free; the marker is what makes the before/after VALUES\n  // survive, and without values \"someone changed the SSO enforcement\" proves nothing.\n  //\n  // These are configuration flags, domains and role names — NOT personal data — so recording their\n  // values does not conflict with the Art. 5(1)(c) / Art. 17 minimisation reasoning that keeps\n  // user-identifying fields unmarked (audit rows replicate to an immutable ledger that cannot be\n  // scrubbed).\n  //\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — SSO enforcement decides how principals are\n  // permitted to authenticate at all.\n  //\n  // `enforceForAdmins` was REMOVED here (#481). It said \"this tenant's SSO requirement also binds\n  // its administrators\", defaulted `true`, and was read by nothing — so an operator who set it\n  // `false` believed their administrators had a way in when the IdP broke, and they did not.\n  //\n  // It was not reimplemented, because a ROLE is the wrong unit for an authentication bypass. Role\n  // membership changes, and a standing exemption for \"whoever is an admin\" means compromising one\n  // administrator and promoting an account silently grants an SSO bypass to the promoted one.\n  // Microsoft Entra's emergency-access guidance is explicit about the alternative — exclude a small\n  // NAMED set through a dedicated group, never a role — and that is what `emergencyAccess` below\n  // now does. Google Workspace does take the role-shaped route for its super administrators; it was\n  // considered and rejected here for the escalation path above.\n  //\n  // spec-cite: Microsoft Entra ID — \"Manage emergency access admin accounts\"\n  // (https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access),\n  // \"Conditional Access considerations\": create a dedicated security group for the emergency access\n  // accounts and exclude THAT from policies. The reading that a role is the wrong unit is this\n  // repository's, not a quotation.\n  enforcement: z.object({\n    requireSSO: z.boolean().default(false).isSummaryField(),\n    allowPasswordFallback: z.boolean().default(true),\n    graceLoginAttempts: z.number().min(0).max(10).default(3),\n  }).isSummaryField().isAuditEvidence(),\n\n  // NOT marked, deliberately: this block carries `domainVerificationTokens`, which is\n  // `.isBackendOnly()` — a SECRET. `.isAuditEvidence()` on a parent object records the WHOLE object\n  // before/after, so marking `domains` would copy live verification tokens into audit rows that\n  // replicate to the immutable ledger and to every configured SIEM sink. The security-relevant\n  // sub-fields (`ssoEnabledDomains`, `allowExternalDomains`) are marked individually instead, which\n  // keeps the secret out by construction rather than by reviewer vigilance.\n  //\n  // Read this before marking any other container: a block is safe to mark WHOLESALE only when no\n  // descendant is `.isBackendOnly()` or personal data.\n  domains: z.object({\n    /**\n     * Every domain this organization has CLAIMED — verified and unverified alike.\n     *\n     * ⚠️ The name asserts more than the field holds. `initiateDomainVerification` pushes a domain\n     * here at CLAIM time with `domainVerificationStatus[domain] = 'pending'`, so membership means\n     * \"somebody asked\", never \"we checked\". The real answer is the join with that map, and\n     * `resolveVerifiedDomains` below is the only place it should be computed (#457).\n     *\n     * **Do not read this array directly.** A reader that does gets pending, failed and expired\n     * domains under a name that says otherwise — which `AuthOrganizationConfigurationService\n     * .getDomains` did, returning them as `verified`, with no consumer to notice.\n     *\n     * The field was NOT renamed to `claimedDomains`, and that is a decision rather than an\n     * omission: it is persisted on every SSO config row of both dogfood applications, so the rename\n     * is a schema change plus a data migration for a field whose every reader now goes through the\n     * helper. The name is no longer what a new reader reaches.\n     */\n    verifiedDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    domainHinting: z.boolean().default(true),\n    allowExternalDomains: z.boolean().default(false).isAuditEvidence(),\n    /**\n     * The half of the join that decides routing authority — and therefore the audit evidence.\n     *\n     * Marked individually rather than through the containing `domains` block, for the reason that\n     * block's own comment gives: a whole-object mark would copy `domainVerificationTokens` into the\n     * immutable ledger. This map holds domain names and one of four statuses — no secret, no\n     * personal data — and it is the only field that answers the question an auditor asks about a\n     * domain workflow: WHICH domain became verified, and when did it stop being verified.\n     *\n     * Without it the trail records `domains` as a changed field name and nothing more, which cannot\n     * distinguish \"a tenant claimed a domain\" from \"a tenant gained SSO routing control over every\n     * address at it\".\n     */\n    domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}).isAuditEvidence(),\n    /**\n     * The DNS-TXT challenge nonce per claimed domain. `.isBackendOnly()` — never leaves the backend\n     * through a resource READ, and never enters the audit trail (see the block comment above).\n     *\n     * The one place its value is disclosed is the response to `claimDomain`, which returns it once\n     * as an `.isEphemeral()` field, because the operator cannot publish a record they cannot see.\n     * A lost token is recovered by claiming again, which mints a new one — there is no re-read.\n     */\n    domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),\n  }),\n\n  provisioning: z.object({\n    autoCreateUsers: z.boolean().default(true),\n    autoUpdateUsers: z.boolean().default(true),\n    autoDeactivateUsers: z.boolean().default(false),\n    defaultRole: z.string().optional(),\n    requiredAttributes: z.array(z.string()).default(['email']),\n    syncFrequencyHours: z.number().min(1).max(168).default(24),\n  }).isAuditEvidence(),\n\n  sessionSettings: z.object({\n    ssoSessionDurationMinutes: z.number().min(15).max(1440).default(480),\n    requireReauthForSensitive: z.boolean().default(true),\n    singleLogoutEnabled: z.boolean().default(true),\n    maxConcurrentSessions: z.number().min(1).max(50).default(5),\n  }).isAuditEvidence(),\n\n  // Marked because this block governs the AUDIT TRAIL ITSELF — disabling `logAllSSOEvents` or\n  // shortening `retentionDays` is the classic pre-incident tampering move, and it must not be the\n  // one change the trail cannot evidence.\n  // assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself.\n  auditConfig: z.object({\n    logAllSSOEvents: z.boolean().default(true),\n    logProviderSwitching: z.boolean().default(true),\n    logRoleMapping: z.boolean().default(true),\n    complianceReporting: z.boolean().default(false),\n    retentionDays: z.number().min(1).max(2555).default(365),\n  }).isAuditEvidence(),\n\n  /**\n   * Break-glass: the named accounts that may still sign in with a password when the identity\n   * provider cannot be reached.\n   *\n   * Every field here is READ at runtime. It carried three more — `requireApproval`,\n   * `maxDurationHours` and `auditLevel` — and all three were removed with `enforceForAdmins` (#481,\n   * #423) rather than implemented, for reasons worth keeping:\n   *\n   * - **`requireApproval` cannot exist on this path.** Break-glass is the door for the case where\n   *   nobody can act; an approval step means the approver may be locked out too, which is the\n   *   deadlock the door exists to break. Entra's guidance asks for monitoring and a post-mortem\n   *   after each use, never for prior approval.\n   * - **`maxDurationHours`** describes a bounded break-glass SESSION, which is a real control and\n   *   is not built. A field that names a control nobody enforces is exactly what this issue was\n   *   about, so it is absent until the session cap exists.\n   * - **`auditLevel`** could not change anything: `EMERGENCY_ACCESS_USED` is CRITICAL in\n   *   `SECURITY_AUDIT_EVENT_ENVELOPE`, and a per-tenant knob that lowers the severity of a\n   *   privileged-access record is not a setting a tenant should have.\n   *\n   * ## What a listed account gets, and what it does not\n   *\n   * A listed account is exempt from the SSO enforcement refusal — including grace exhaustion — and\n   * nothing else. It authenticates with the same password, against the same lockout counters and\n   * the same rate limits, and every use emits `EMERGENCY_ACCESS_USED` at CRITICAL.\n   *\n   * ## Why the whole TENANT keeps a password field when this list is non-empty\n   *\n   * The sign-in surface must not depend on the account, or the offered methods become an oracle for\n   * \"is this address a break-glass account\". So `requiresEnterpriseSsoOnly` answers false for the\n   * whole tenant while this list is non-empty: everyone at the domain sees a password field, and\n   * everyone not on the list is refused AFTER presenting a correct credential. The cost is a\n   * password field that only two accounts can use; the alternative discloses who they are.\n   *\n   * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the authenticated bypass of this tenant's\n   * own authentication requirement.\n   */\n  emergencyAccess: z.object({\n    /** Off switch. `true` with an empty list grants nothing — the list is what confers the bypass. */\n    enabled: z.boolean().default(true),\n    /**\n     * The email addresses that may bypass SSO enforcement. An authority LIST: adding an entry grants\n     * a standing password path into a tenant that has otherwise required SSO.\n     *\n     * Keep it SMALL and keep it reviewed. Entra asks for at least two (redundancy), credentials\n     * stored apart from any individual, and a validation drill every 90 days; none of that is\n     * enforceable from here, and all of it is what makes this list safe to have.\n     */\n    breakGlassAccounts: z.array(z.email()).default([]),\n  }).isAuditEvidence(),\n\n  oauth2ProviderRestrictions: z.object({\n    allowedProviders: z.array(z.string()).default([]),\n    blockedProviders: z.array(z.string()).default([]),\n    requireEnterpriseSSOOnly: z.boolean().default(false),\n  }).isAuditEvidence(),\n\n  /**\n   * Per-scope social provider credential overrides (P3).\n   *\n   * By default, social providers (Google, GitHub, Apple, etc.) use platform-level\n   * OAuth2 credentials from AppConfiguration. This array lets an org/app override\n   * those with their own registered OAuth2 app at the identity provider.\n   *\n   * Only `clientId` + `clientSecret` are needed for most providers — the OAuth2\n   * endpoints, scopes, and profile mapping still come from the provider catalog.\n   *\n   * `signedJwtKeyId` / `signedJwtTeamId` are required only for providers that use\n   * signed-JWT client secrets (e.g. Apple Sign-In, where the \"client secret\" is a\n   * short-lived JWT signed with a private key). These correspond to the Apple\n   * Developer Team ID and Key ID that are bound to the private key.\n   * When omitted, the app-level values from the secrets store are used.\n   *\n   * Secret handling (two distinct contracts, on purpose):\n   * - `clientSecret` is `.isWriteOnlySecret()` — the operator sets/rotates it, so it\n   *   stays writable AND stays in the response DTO where the framework redacts it to\n   *   `••••••••` at the client boundary. Internal reads (`resolveSocialConnection`\n   *   via `readAsSystem`) keep the real value.\n   * - `signedJwtKeyId` / `signedJwtTeamId` are `.isBackendOnly()` — never sent to the\n   *   frontend at all (stripped from every client DTO).\n   *\n   * Because these secrets live inside an ARRAY, neither the central write-only-secret\n   * sentinel-strip NOR a whole-array `$set` preserves them on save: the repository\n   * replaces the entire array with no deep merge. The UPDATE custom-impl therefore\n   * matches each incoming override to the stored record by `providerRef` and\n   * re-injects any secret that arrived absent or as the `••••••••` mask.\n   *\n   * @see oauth2-connection-resolver — resolveSocialConnection() steps 5b/5c\n   * @see sso-config.custom-impl — prefixCoreOperations UPDATE handler\n   */\n  socialCredentialOverrides: z.array(z.object({\n    providerRef: z.string().min(1),\n    clientId: z.string().min(1),\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    signedJwtKeyId: z.string().optional().isBackendOnly(),\n    signedJwtTeamId: z.string().optional().isBackendOnly(),\n  })).default([]).refine(\n    (arr) => new Set(arr.map(o => o.providerRef)).size === arr.length,\n    { message: 'Duplicate providerRef in socialCredentialOverrides' },\n  ),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SsoConfigBase = z.infer<typeof SsoConfigBaseSchema>;\n\n/**\n * The domains this organization has actually VERIFIED — the join `verifiedDomains` does not carry.\n *\n * ## Why this exists rather than five correct joins\n *\n * The stored list holds CLAIMED domains, so safety depends on every reader filtering it by\n * `domainVerificationStatus`. Measured 2026-09-08, **five** reader sites did that by hand — the SCIM\n * controller, the SCIM virtual field, the domain-verification service, and the domain-to-org lookup\n * TWICE — and a sixth, `getDomains`, did not. It returned the raw list under the name `verified`.\n *\n * That is `.claude/rules/invariant-call-site-enumeration.md`'s exact shape: an invariant hand-applied\n * at N sites, where the next site is the one that forgets. It had already happened; it was harmless\n * only because that reader had no consumer — and claiming a domain is now reachable by tenants\n * through `SsoConfig_Operations.CLAIM_DOMAIN` (#424), so the margin that made it harmless is gone.\n *\n * So the join is computed ONCE, here, beside the field it corrects. A new reader that reaches for\n * the verified set finds this; one that reaches for the raw array finds the warning on the field.\n *\n * Takes the shape structurally rather than `SsoConfigBase` so a caller holding a partial config, a\n * DTO or a lean document can use it — the three existing shapes at the call sites — without the\n * helper forcing a cast at every one of them.\n */\nexport function resolveVerifiedDomains(domains: {\n  readonly verifiedDomains?: readonly string[];\n  readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n} | undefined): string[] {\n  const status = domains?.domainVerificationStatus ?? {};\n  return (domains?.verifiedDomains ?? []).filter(\n    domain => status[domain] === DomainVerificationStatus.VERIFIED,\n  );\n}\n\n/** Whether ONE domain is verified for this organization. The single-domain form of the join. */\nexport function isDomainVerified(\n  domains: {\n    readonly verifiedDomains?: readonly string[];\n    readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n  } | undefined,\n  domain: string,\n): boolean {\n  return (domains?.verifiedDomains ?? []).includes(domain)\n    && domains?.domainVerificationStatus?.[domain] === DomainVerificationStatus.VERIFIED;\n}\n\nexport const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConfig',\n  baseFieldIdentifier: 'ssoConfigId',\n  baseEnumKey: 'SSO_CONFIG',\n  baseSchema: SsoConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}
+{"version":3,"file":"sso-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,oFAAoF;IACpF,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,aAAa;IACb,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,2FAA2F;IAC3F,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,kGAAkG;IAClG,+FAA+F;IAC/F,kGAAkG;IAClG,8DAA8D;IAC9D,EAAE;IACF,2EAA2E;IAC3E,0GAA0G;IAC1G,kGAAkG;IAClG,6FAA6F;IAC7F,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;QACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACzD,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAErC,oFAAoF;IACpF,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,kGAAkG;IAClG,0EAA0E;IAC1E,EAAE;IACF,+FAA+F;IAC/F,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB;;;;;;;;;;;;;;;;WAgBG;QACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAClE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QACpE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAClE;;;;;;;;;;;;WAYG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC9G;;;;;;;WAOG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;KACvF,CAAC;IAEF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC,eAAe,EAAE;IAEpB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACpE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAC5D,CAAC,CAAC,eAAe,EAAE;IAEpB,4FAA4F;IAC5F,gGAAgG;IAChG,wCAAwC;IACxC,iGAAiG;IACjG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,kGAAkG;QAClG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC;;;;;;;WAOG;QACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC,eAAe,EAAE;IAEpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;QACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;KACvD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EACjE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAG1B;IACX,MAAM,MAAM,GAAG,OAAO,EAAE,wBAAwB,IAAI,EAAE,CAAC;IACvD,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAC/D,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAC9B,OAGa,EACb,MAAc;IAEd,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnD,OAAO,EAAE,wBAAwB,EAAE,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;IACvE,gBAAgB,EAAE,WAAW;IAC7B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SSO Config Schema (Shared) — Polymorphic\n *\n * SSO enforcement, domain verification, provider restrictions, provisioning,\n * session settings, emergency access. Policy/settings layer only —\n * provider connections are a separate resource (SsoConnection).\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2A\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const DomainVerificationStatus = {\n  PENDING: 'pending',\n  VERIFIED: 'verified',\n  FAILED: 'failed',\n  EXPIRED: 'expired',\n} as const;\n\nexport const SsoConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // ── `.isAuditEvidence()` on the authentication-authority blocks ──────────────────────────────\n  // Every block below decides WHO may authenticate into this tenant and with what standing, so a\n  // change to one is an authorization change even though no role is named: weakening `requireSSO`,\n  // re-enabling `allowPasswordFallback`, granting a `defaultRole` on auto-provision, or adding a\n  // break-glass account each widen access tenant-wide. The generic resource-operation audit event\n  // records the changed field NAMES for free; the marker is what makes the before/after VALUES\n  // survive, and without values \"someone changed the SSO enforcement\" proves nothing.\n  //\n  // These are configuration flags, domains and role names — NOT personal data — so recording their\n  // values does not conflict with the Art. 5(1)(c) / Art. 17 minimisation reasoning that keeps\n  // user-identifying fields unmarked (audit rows replicate to an immutable ledger that cannot be\n  // scrubbed).\n  //\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — SSO enforcement decides how principals are\n  // permitted to authenticate at all.\n  //\n  // `enforceForAdmins` was REMOVED here (#481). It said \"this tenant's SSO requirement also binds\n  // its administrators\", defaulted `true`, and was read by nothing — so an operator who set it\n  // `false` believed their administrators had a way in when the IdP broke, and they did not.\n  //\n  // It was not reimplemented, because a ROLE is the wrong unit for an authentication bypass. Role\n  // membership changes, and a standing exemption for \"whoever is an admin\" means compromising one\n  // administrator and promoting an account silently grants an SSO bypass to the promoted one.\n  // Microsoft Entra's emergency-access guidance is explicit about the alternative — exclude a small\n  // NAMED set through a dedicated group, never a role — and that is what `emergencyAccess` below\n  // now does. Google Workspace does take the role-shaped route for its super administrators; it was\n  // considered and rejected here for the escalation path above.\n  //\n  // spec-cite: Microsoft Entra ID — \"Manage emergency access admin accounts\"\n  // (https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access),\n  // \"Conditional Access considerations\": create a dedicated security group for the emergency access\n  // accounts and exclude THAT from policies. The reading that a role is the wrong unit is this\n  // repository's, not a quotation.\n  enforcement: z.object({\n    requireSSO: z.boolean().default(false).isSummaryField(),\n    allowPasswordFallback: z.boolean().default(true),\n    graceLoginAttempts: z.number().min(0).max(10).default(3),\n  }).isSummaryField().isAuditEvidence(),\n\n  // NOT marked, deliberately: this block carries `domainVerificationTokens`, which is\n  // `.isBackendOnly()` — a SECRET. `.isAuditEvidence()` on a parent object records the WHOLE object\n  // before/after, so marking `domains` would copy live verification tokens into audit rows that\n  // replicate to the immutable ledger and to every configured SIEM sink. The security-relevant\n  // sub-fields (`ssoEnabledDomains`, `allowExternalDomains`) are marked individually instead, which\n  // keeps the secret out by construction rather than by reviewer vigilance.\n  //\n  // Read this before marking any other container: a block is safe to mark WHOLESALE only when no\n  // descendant is `.isBackendOnly()` or personal data.\n  domains: z.object({\n    /**\n     * Every domain this organization has CLAIMED — verified and unverified alike.\n     *\n     * ⚠️ The name asserts more than the field holds. `initiateDomainVerification` pushes a domain\n     * here at CLAIM time with `domainVerificationStatus[domain] = 'pending'`, so membership means\n     * \"somebody asked\", never \"we checked\". The real answer is the join with that map, and\n     * `resolveVerifiedDomains` below is the only place it should be computed (#457).\n     *\n     * **Do not read this array directly.** A reader that does gets pending, failed and expired\n     * domains under a name that says otherwise — which `AuthOrganizationConfigurationService\n     * .getDomains` did, returning them as `verified`, with no consumer to notice.\n     *\n     * The field was NOT renamed to `claimedDomains`, and that is a decision rather than an\n     * omission: it is persisted on every SSO config row of both dogfood applications, so the rename\n     * is a schema change plus a data migration for a field whose every reader now goes through the\n     * helper. The name is no longer what a new reader reaches.\n     */\n    verifiedDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    domainHinting: z.boolean().default(true),\n    allowExternalDomains: z.boolean().default(false).isAuditEvidence(),\n    /**\n     * The half of the join that decides routing authority — and therefore the audit evidence.\n     *\n     * Marked individually rather than through the containing `domains` block, for the reason that\n     * block's own comment gives: a whole-object mark would copy `domainVerificationTokens` into the\n     * immutable ledger. This map holds domain names and one of four statuses — no secret, no\n     * personal data — and it is the only field that answers the question an auditor asks about a\n     * domain workflow: WHICH domain became verified, and when did it stop being verified.\n     *\n     * Without it the trail records `domains` as a changed field name and nothing more, which cannot\n     * distinguish \"a tenant claimed a domain\" from \"a tenant gained SSO routing control over every\n     * address at it\".\n     */\n    domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}).isAuditEvidence(),\n    /**\n     * The DNS-TXT challenge nonce per claimed domain. `.isBackendOnly()` — never leaves the backend\n     * through a resource READ, and never enters the audit trail (see the block comment above).\n     *\n     * The one place its value is disclosed is the response to `claimDomain`, which returns it once\n     * as an `.isEphemeral()` field, because the operator cannot publish a record they cannot see.\n     * A lost token is recovered by claiming again, which mints a new one — there is no re-read.\n     */\n    domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),\n  }),\n\n  provisioning: z.object({\n    autoCreateUsers: z.boolean().default(true),\n    autoUpdateUsers: z.boolean().default(true),\n    autoDeactivateUsers: z.boolean().default(false),\n    defaultRole: z.string().optional(),\n    requiredAttributes: z.array(z.string()).default(['email']),\n    syncFrequencyHours: z.number().min(1).max(168).default(24),\n  }).isAuditEvidence(),\n\n  sessionSettings: z.object({\n    ssoSessionDurationMinutes: z.number().min(15).max(1440).default(480),\n    requireReauthForSensitive: z.boolean().default(true),\n    singleLogoutEnabled: z.boolean().default(true),\n    maxConcurrentSessions: z.number().min(1).max(50).default(5),\n  }).isAuditEvidence(),\n\n  // Marked because this block governs the AUDIT TRAIL ITSELF — disabling `logAllSSOEvents` or\n  // shortening `retentionDays` is the classic pre-incident tampering move, and it must not be the\n  // one change the trail cannot evidence.\n  // assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself.\n  auditConfig: z.object({\n    logAllSSOEvents: z.boolean().default(true),\n    logProviderSwitching: z.boolean().default(true),\n    logRoleMapping: z.boolean().default(true),\n    complianceReporting: z.boolean().default(false),\n    retentionDays: z.number().min(1).max(2555).default(365),\n  }).isAuditEvidence(),\n\n  /**\n   * Break-glass: the named accounts that may still sign in with a password when the identity\n   * provider cannot be reached.\n   *\n   * Every field here is READ at runtime. It carried three more — `requireApproval`,\n   * `maxDurationHours` and `auditLevel` — and all three were removed with `enforceForAdmins` (#481,\n   * #423) rather than implemented, for reasons worth keeping:\n   *\n   * - **`requireApproval` cannot exist on this path.** Break-glass is the door for the case where\n   *   nobody can act; an approval step means the approver may be locked out too, which is the\n   *   deadlock the door exists to break. Entra's guidance asks for monitoring and a post-mortem\n   *   after each use, never for prior approval.\n   * - **`maxDurationHours`** describes a bounded break-glass SESSION, which is a real control and\n   *   is not built. A field that names a control nobody enforces is exactly what this issue was\n   *   about, so it is absent until the session cap exists.\n   * - **`auditLevel`** could not change anything: `EMERGENCY_ACCESS_USED` is CRITICAL in\n   *   `SECURITY_AUDIT_EVENT_ENVELOPE`, and a per-tenant knob that lowers the severity of a\n   *   privileged-access record is not a setting a tenant should have.\n   *\n   * ## What a listed account gets, and what it does not\n   *\n   * A listed account is exempt from the SSO enforcement refusal — including grace exhaustion — and\n   * nothing else. It authenticates with the same password, against the same lockout counters and\n   * the same rate limits, and every use emits `EMERGENCY_ACCESS_USED` at CRITICAL.\n   *\n   * ## Why the whole TENANT keeps a password field when this list is non-empty\n   *\n   * The sign-in surface must not depend on the account, or the offered methods become an oracle for\n   * \"is this address a break-glass account\". So `requiresEnterpriseSsoOnly` answers false for the\n   * whole tenant while this list is non-empty: everyone at the domain sees a password field, and\n   * everyone not on the list is refused AFTER presenting a correct credential. The cost is a\n   * password field that only two accounts can use; the alternative discloses who they are.\n   *\n   * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the authenticated bypass of this tenant's\n   * own authentication requirement.\n   */\n  emergencyAccess: z.object({\n    /** Off switch. `true` with an empty list grants nothing — the list is what confers the bypass. */\n    enabled: z.boolean().default(true),\n    /**\n     * The email addresses that may bypass SSO enforcement. An authority LIST: adding an entry grants\n     * a standing password path into a tenant that has otherwise required SSO.\n     *\n     * Keep it SMALL and keep it reviewed. Entra asks for at least two (redundancy), credentials\n     * stored apart from any individual, and a validation drill every 90 days; none of that is\n     * enforceable from here, and all of it is what makes this list safe to have.\n     */\n    breakGlassAccounts: z.array(z.email()).default([]),\n  }).isAuditEvidence(),\n\n  oauth2ProviderRestrictions: z.object({\n    allowedProviders: z.array(z.string()).default([]),\n    blockedProviders: z.array(z.string()).default([]),\n    requireEnterpriseSSOOnly: z.boolean().default(false),\n  }).isAuditEvidence(),\n\n  /**\n   * Per-scope social provider credential overrides (P3).\n   *\n   * By default, social providers (Google, GitHub, Apple, etc.) use platform-level\n   * OAuth2 credentials from AppConfiguration. This array lets an org/app override\n   * those with their own registered OAuth2 app at the identity provider.\n   *\n   * Only `clientId` + `clientSecret` are needed for most providers — the OAuth2\n   * endpoints, scopes, and profile mapping still come from the provider catalog.\n   *\n   * `signedJwtKeyId` / `signedJwtTeamId` are required only for providers that use\n   * signed-JWT client secrets (e.g. Apple Sign-In, where the \"client secret\" is a\n   * short-lived JWT signed with a private key). These correspond to the Apple\n   * Developer Team ID and Key ID that are bound to the private key.\n   * When omitted, the app-level values from the secrets store are used.\n   *\n   * Secret handling (two distinct contracts, on purpose):\n   * - `clientSecret` is `.isWriteOnlySecret()` — the operator sets/rotates it, so it\n   *   stays writable AND stays in the response DTO where the framework redacts it to\n   *   `••••••••` at the client boundary. Internal reads (`resolveSocialConnection`\n   *   via `readAsSystem`) keep the real value.\n   * - `signedJwtKeyId` / `signedJwtTeamId` are `.isBackendOnly()` — never sent to the\n   *   frontend at all (stripped from every client DTO).\n   *\n   * Because these secrets live inside an ARRAY, neither the central write-only-secret\n   * sentinel-strip NOR a whole-array `$set` preserves them on save: the repository\n   * replaces the entire array with no deep merge. The UPDATE custom-impl therefore\n   * matches each incoming override to the stored record by `providerRef` and\n   * re-injects any secret that arrived absent or as the `••••••••` mask.\n   *\n   * @see oauth2-connection-resolver — resolveSocialConnection() steps 5b/5c\n   * @see sso-config.custom-impl — prefixCoreOperations UPDATE handler\n   */\n  socialCredentialOverrides: z.array(z.object({\n    providerRef: z.string().min(1),\n    clientId: z.string().min(1),\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    signedJwtKeyId: z.string().optional().isBackendOnly(),\n    signedJwtTeamId: z.string().optional().isBackendOnly(),\n  })).default([]).refine(\n    (arr) => new Set(arr.map(o => o.providerRef)).size === arr.length,\n    { message: 'Duplicate providerRef in socialCredentialOverrides' },\n  ),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SsoConfigBase = z.infer<typeof SsoConfigBaseSchema>;\n\n/**\n * The domains this organization has actually VERIFIED — the join `verifiedDomains` does not carry.\n *\n * ## Why this exists rather than five correct joins\n *\n * The stored list holds CLAIMED domains, so safety depends on every reader filtering it by\n * `domainVerificationStatus`. Measured 2026-09-08, **five** reader sites did that by hand — the SCIM\n * controller, the SCIM virtual field, the domain-verification service, and the domain-to-org lookup\n * TWICE — and a sixth, `getDomains`, did not. It returned the raw list under the name `verified`.\n *\n * That is `.claude/rules/invariant-call-site-enumeration.md`'s exact shape: an invariant hand-applied\n * at N sites, where the next site is the one that forgets. It had already happened; it was harmless\n * only because that reader had no consumer — and claiming a domain is now reachable by tenants\n * through `SsoConfig_Operations.CLAIM_DOMAIN` (#424), so the margin that made it harmless is gone.\n *\n * So the join is computed ONCE, here, beside the field it corrects. A new reader that reaches for\n * the verified set finds this; one that reaches for the raw array finds the warning on the field.\n *\n * Takes the shape structurally rather than `SsoConfigBase` so a caller holding a partial config, a\n * DTO or a lean document can use it — the three existing shapes at the call sites — without the\n * helper forcing a cast at every one of them.\n */\nexport function resolveVerifiedDomains(domains: {\n  readonly verifiedDomains?: readonly string[];\n  readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n} | undefined): string[] {\n  const status = domains?.domainVerificationStatus ?? {};\n  return (domains?.verifiedDomains ?? []).filter(\n    domain => status[domain] === DomainVerificationStatus.VERIFIED,\n  );\n}\n\n/** Whether ONE domain is verified for this organization. The single-domain form of the join. */\nexport function isDomainVerified(\n  domains: {\n    readonly verifiedDomains?: readonly string[];\n    readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n  } | undefined,\n  domain: string,\n): boolean {\n  return (domains?.verifiedDomains ?? []).includes(domain)\n    && domains?.domainVerificationStatus?.[domain] === DomainVerificationStatus.VERIFIED;\n}\n\nexport const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConfig',\n  baseFieldIdentifier: 'ssoConfigId',\n  baseEnumKey: 'SSO_CONFIG',\n  baseSchema: SsoConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAQ/G,OAAO,EAAE,WAAW,EAAuC,MAAM,iCAAiC,CAAC;AAInG,oBAAY,wBAAwB;IAClC,eAAe,mBAAmB;IAClC,kBAAkB,sBAAsB;CACzC;AAED,0EAA0E;AAC1E,oBAAY,8BAA8B;IACxC,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED,2EAA2E;AAC3E,oBAAY,4BAA4B;IACtC,aAAa,kBAAkB;CAChC;AAID;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,iCAAqB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC;;;;;;oBASpD,CAAC;AAYH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;gCAoBlD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;gCAgBrD,CAAC;AAIH,eAAO,MAAM,iCAAiC,4QA0J7C,CAAC"}
+{"version":3,"file":"sso-connection.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAQ/G,OAAO,EAAE,WAAW,EAAuC,MAAM,iCAAiC,CAAC;AAInG,oBAAY,wBAAwB;IAClC,eAAe,mBAAmB;IAClC,kBAAkB,sBAAsB;CACzC;AAED,0EAA0E;AAC1E,oBAAY,8BAA8B;IACxC,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED,2EAA2E;AAC3E,oBAAY,4BAA4B;IACtC,aAAa,kBAAkB;CAChC;AAID;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,iCAAqB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC;;;;;;oBASpD,CAAC;AAYH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;gCAoBlD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;gCAgBrD,CAAC;AAIH,eAAO,MAAM,iCAAiC,4QA0J7C,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts

@@ -100,6 +100,7 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
         userInfoEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
         jwksUri: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
         endSessionEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        federatedLogoutEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         clientId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
         clientSecret: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
         scopes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
@@ -208,6 +209,7 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
         userInfoEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
         jwksUri: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
         endSessionEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        federatedLogoutEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         clientId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
         clientSecret: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
         scopes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8JlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQ9C,CAAC"}
+{"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6KlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQ9C,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js

@@ -126,6 +126,21 @@ export const SsoConnectionBaseSchema = z.object({
         userInfoEndpoint: z.url().optional().isAuditEvidence(),
         jwksUri: z.url().optional().isAuditEvidence(),
         endSessionEndpoint: z.url().optional().isAuditEvidence(),
+        /**
+         * Redirect the browser to the identity provider's `endSessionEndpoint` when this connection's
+         * user logs out of Wildo — RP-initiated logout (issue #445).
+         *
+         * OPT-IN, and `false` by default, mirroring SAML's `singleLogoutEnabled` rather than inventing a
+         * second shape for the same question. Defaulting it on would change the logout behaviour of
+         * every existing connection that merely happens to have discovered an `end_session_endpoint`,
+         * which for the DISCOVERY template mode is most of them: the endpoint is read out of the
+         * provider's own document, so its presence records what the provider CAN do, never what the
+         * operator wants.
+         *
+         * The endpoint is the CAPABILITY and this is the DECISION. Both are needed — a connection with
+         * this on and no endpoint federates nothing, and says so in the log rather than failing a logout.
+         */
+        federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence(),
         clientId: z.string().min(1).isAuditEvidence(),
         /**
          * OIDC/OAuth2 client secret issued by the IdP, used by the backend token