@wildo-ai/saas-models 1.1.3 → 1.1.4

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,2EAA2E;AAC3E,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,4BAAa,CAAA;AACf,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,gGAAgG;IAChG,0FAA0F;IAC1F,8FAA8F;IAC9F,qEAAqE;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAEvD,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,qGAAqG;IACrG,kGAAkG;IAClG,kGAAkG;IAClG,kDAAkD;IAClD,+FAA+F;IAC/F,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;YAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC;YAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC;YAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACzD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACjE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC3E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC1D,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE;QAChG,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,sGAAsG;IACtG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,0FAA0F;IAC1F,qFAAqF;IACrF,kGAAkG;IAClG,mBAAmB;IACnB,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE;QACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClD,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACnD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC7C,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACxD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C;;;;;;;;;;;;;;;;;;WAkBG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF;;;;;;;;;;WAUG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,yGAAyG;IACzG,6FAA6F;IAC7F,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAC1D,gGAAgG;IAChG,8FAA8F;IAC9F,4FAA4F;IAC5F,4EAA4E;IAC5E,4EAA4E;IAC5E,sFAAsF;IACtF,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAEpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SSO Connection Schema (Shared) — Polymorphic\n *\n * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).\n * Unified resource — `protocol` field determines which sub-object is populated.\n * Both OIDC and SAML protocol engines consume this shared discriminator.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2B\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\n/** Interactive single-sign-on protocols supported by an SSO connection. */\nexport enum SsoProtocol {\n  OIDC = 'oidc',\n  SAML = 'saml',\n}\n\nexport const SSOTemplateMode = {\n  TEMPLATE: 'template',\n  DISCOVERY: 'discovery',\n  MANUAL: 'manual',\n} as const;\n\nexport const SSOResponseType = {\n  CODE: 'code',\n  ID_TOKEN: 'id_token',\n  TOKEN: 'token',\n} as const;\n\nexport const SSOResponseMode = {\n  QUERY: 'query',\n  FRAGMENT: 'fragment',\n  FORM_POST: 'form_post',\n} as const;\n\nexport const SSOPrompt = {\n  NONE: 'none',\n  LOGIN: 'login',\n  CONSENT: 'consent',\n  SELECT_ACCOUNT: 'select_account',\n} as const;\n\nexport const SSOPKCEMethod = {\n  S256: 'S256',\n  PLAIN: 'plain',\n} as const;\n\nexport const SamlNameIdFormat = {\n  UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',\n  EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',\n  PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n  TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',\n} as const;\n\nexport const SsoConnectionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  protocol: z.enum(SsoProtocol).isSummaryField(),\n  externalProviderId: z.string().min(1).optional(),\n  displayName: z.string().min(1).isSummaryField(),\n  // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides\n  // which IdP silently receives logins. Marked individually rather than on any parent: this\n  // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records\n  // the WHOLE object into rows that replicate to an unerasable ledger.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP\n  // decide which identity provider is trusted to authenticate this tenant.\n  enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  isDefault: z.boolean().default(false).isAuditEvidence(),\n\n  // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates\n  // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,\n  // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,\n  // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed\n  // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a\n  // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the\n  // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the\n  // container would copy key material into an unerasable ledger. The two-level `attributeMapping` /\n  // `auditSettings` leaves are deliberately NOT marked — the evidence resolver reaches one level of\n  // nesting only, so a marker there would be inert.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay\n  // validation posture decide which provider is trusted to authenticate this tenant and whether its\n  // assertions are actually verified.\n  saml: z.object({\n    entityId: z.string().min(1).isAuditEvidence(),\n    ssoUrl: z.url().isAuditEvidence(),\n    sloUrl: z.url().optional().isAuditEvidence(),\n    /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */\n    x509CertificatePem: z.string().min(1).optional(),\n    x509Certificates: z.array(z.string()).min(1).isBackendOnly(),\n    attributeMapping: z.object({\n      email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),\n      firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),\n      lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    signRequests: z.boolean().default(true).isAuditEvidence(),\n    wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),\n    allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),\n    forceAuthn: z.boolean().default(false).isAuditEvidence(),\n    maxAuthAge: z.number().min(0).optional().isAuditEvidence(),\n    nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),\n    allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logAttributeMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection\n  // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /\n  // `clientId`) and HOW strictly it validates tokens (`pkceEnabled`, `pkceMethod`), plus what it\n  // requests (`scopes` / `customScopes` / `responseType` / `responseMode` / template + auth-request\n  // shaping, including the `acrValues` step-up demand). Turning `pkceEnabled` off, or repointing\n  // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the\n  // before/after — and so does a change to `acrValues`, which is an authentication-strength\n  // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is\n  // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's\n  // one-level reach.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-\n  // validation posture decide which provider is trusted and whether its tokens are actually verified.\n  oidc: z.object({\n    templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence(),\n    templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n    customScopes: z.array(z.string()).optional().isAuditEvidence(),\n    discoveryUrl: z.url().optional().isAuditEvidence(),\n    issuer: z.url().optional().isAuditEvidence(),\n    authorizationEndpoint: z.url().optional().isAuditEvidence(),\n    tokenEndpoint: z.url().optional().isAuditEvidence(),\n    userInfoEndpoint: z.url().optional().isAuditEvidence(),\n    jwksUri: z.url().optional().isAuditEvidence(),\n    endSessionEndpoint: z.url().optional().isAuditEvidence(),\n    clientId: z.string().min(1).isAuditEvidence(),\n    /**\n     * OIDC/OAuth2 client secret issued by the IdP, used by the backend token\n     * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to\n     * authenticate this connection at the provider's token endpoint.\n     *\n     * `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:\n     * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it\n     * stays in the response DTO so the UI renders a masked placeholder, but the\n     * framework redacts it to `••••••••` at the client-serialization boundary only\n     * — internal reads (`servicesRegistryHandler.read` during token exchange) keep\n     * the real value. Do NOT use `.isBackendOnly()`: that strips the field from\n     * every client DTO, so the operator could never supply it.\n     *\n     * Preservation on UPDATE is NOT automatic here: this is a nested field, and the\n     * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a\n     * round-tripped mask must be re-injected from the stored record by the SSO\n     * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The\n     * central sentinel-strip only preserves TOP-LEVEL write-only secrets.\n     */\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence(),\n    responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence(),\n    responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence(),\n    claimsMapping: z.object({\n      email: z.string().default('email'),\n      firstName: z.string().default('given_name'),\n      lastName: z.string().default('family_name'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    /*\n     * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,\n     * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,\n     * which is why they were removed rather than honoured (#419, decided 2026-09-08).\n     *\n     * `verifyIdToken` ALWAYS verifies the issuer and the audience and hardcodes a five-minute\n     * maximum token age. Honouring the three toggles could therefore only ever LOOSEN a guard that\n     * is currently unconditional — an operator could switch off issuer or audience validation and\n     * break the token trust chain from a settings screen. A configuration field whose only\n     * achievable effect is to weaken a security control should not exist.\n     */\n    acrValues: z.array(z.string()).optional().isAuditEvidence(),\n    maxAge: z.number().min(0).optional().isAuditEvidence(),\n    prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),\n    pkceEnabled: z.boolean().default(true).isAuditEvidence(),\n    pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logTokenExchange: z.boolean().default(true),\n      logClaimsMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  autoCreateUsers: z.boolean().default(true),\n  autoVerifyEmail: z.boolean().default(true),\n  /** W2.8: if true, users authenticating via this SSO connection skip the application-level MFA policy. */\n  // `.isAuditEvidence()` — an explicit escape from the application MFA policy for everyone who\n  // authenticates through this connection. Flipping it on lowers the assurance level tenant-wide.\n  bypassAppMFA: z.boolean().default(false).isAuditEvidence(),\n  // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`\n  // and the two mappings decide what authority an externally-authenticated identity lands with,\n  // and `allowedDomains` decides whose identities the connection will accept at all. A change\n  // here is an authorization change; the field NAME alone cannot evidence it.\n  // The values are role names and domains — configuration, not personal data.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an\n  // externally-authenticated identity lands with, and whose identities are accepted.\n  defaultRole: z.string().optional().isAuditEvidence(),\n  allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n  groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n// NOTE: Protocol-config discriminant enforcement (protocol=saml → saml defined, protocol=oidc → oidc defined)\n// is validated at the backend service layer, not via .refine() here.\n// Zod 4 doesn't allow .extend() on refined objects, which breaks the polymorphism engine.\n\n\nexport type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;\n\nexport const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConnections',\n  baseFieldIdentifier: 'ssoConnectionId',\n  baseEnumKey: 'SSO_CONNECTIONS',\n  baseSchema: SsoConnectionBaseSchema,\n  // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,2EAA2E;AAC3E,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,4BAAa,CAAA;AACf,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,gGAAgG;IAChG,0FAA0F;IAC1F,8FAA8F;IAC9F,qEAAqE;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAEvD,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,qGAAqG;IACrG,kGAAkG;IAClG,kGAAkG;IAClG,kDAAkD;IAClD,+FAA+F;IAC/F,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;YAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC;YAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC;YAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACzD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACjE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC3E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC1D,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE;QAChG,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,sGAAsG;IACtG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,0FAA0F;IAC1F,qFAAqF;IACrF,kGAAkG;IAClG,mBAAmB;IACnB,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE;QACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClD,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACnD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC7C,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACxD;;;;;;;;;;;;;WAaG;QACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C;;;;;;;;;;;;;;;;;;WAkBG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF;;;;;;;;;;WAUG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,yGAAyG;IACzG,6FAA6F;IAC7F,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAC1D,gGAAgG;IAChG,8FAA8F;IAC9F,4FAA4F;IAC5F,4EAA4E;IAC5E,4EAA4E;IAC5E,sFAAsF;IACtF,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAEpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SSO Connection Schema (Shared) — Polymorphic\n *\n * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).\n * Unified resource — `protocol` field determines which sub-object is populated.\n * Both OIDC and SAML protocol engines consume this shared discriminator.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2B\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\n/** Interactive single-sign-on protocols supported by an SSO connection. */\nexport enum SsoProtocol {\n  OIDC = 'oidc',\n  SAML = 'saml',\n}\n\nexport const SSOTemplateMode = {\n  TEMPLATE: 'template',\n  DISCOVERY: 'discovery',\n  MANUAL: 'manual',\n} as const;\n\nexport const SSOResponseType = {\n  CODE: 'code',\n  ID_TOKEN: 'id_token',\n  TOKEN: 'token',\n} as const;\n\nexport const SSOResponseMode = {\n  QUERY: 'query',\n  FRAGMENT: 'fragment',\n  FORM_POST: 'form_post',\n} as const;\n\nexport const SSOPrompt = {\n  NONE: 'none',\n  LOGIN: 'login',\n  CONSENT: 'consent',\n  SELECT_ACCOUNT: 'select_account',\n} as const;\n\nexport const SSOPKCEMethod = {\n  S256: 'S256',\n  PLAIN: 'plain',\n} as const;\n\nexport const SamlNameIdFormat = {\n  UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',\n  EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',\n  PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n  TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',\n} as const;\n\nexport const SsoConnectionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  protocol: z.enum(SsoProtocol).isSummaryField(),\n  externalProviderId: z.string().min(1).optional(),\n  displayName: z.string().min(1).isSummaryField(),\n  // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides\n  // which IdP silently receives logins. Marked individually rather than on any parent: this\n  // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records\n  // the WHOLE object into rows that replicate to an unerasable ledger.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP\n  // decide which identity provider is trusted to authenticate this tenant.\n  enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  isDefault: z.boolean().default(false).isAuditEvidence(),\n\n  // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates\n  // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,\n  // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,\n  // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed\n  // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a\n  // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the\n  // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the\n  // container would copy key material into an unerasable ledger. The two-level `attributeMapping` /\n  // `auditSettings` leaves are deliberately NOT marked — the evidence resolver reaches one level of\n  // nesting only, so a marker there would be inert.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay\n  // validation posture decide which provider is trusted to authenticate this tenant and whether its\n  // assertions are actually verified.\n  saml: z.object({\n    entityId: z.string().min(1).isAuditEvidence(),\n    ssoUrl: z.url().isAuditEvidence(),\n    sloUrl: z.url().optional().isAuditEvidence(),\n    /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */\n    x509CertificatePem: z.string().min(1).optional(),\n    x509Certificates: z.array(z.string()).min(1).isBackendOnly(),\n    attributeMapping: z.object({\n      email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),\n      firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),\n      lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    signRequests: z.boolean().default(true).isAuditEvidence(),\n    wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),\n    allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),\n    forceAuthn: z.boolean().default(false).isAuditEvidence(),\n    maxAuthAge: z.number().min(0).optional().isAuditEvidence(),\n    nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),\n    allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logAttributeMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection\n  // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /\n  // `clientId`) and HOW strictly it validates tokens (`pkceEnabled`, `pkceMethod`), plus what it\n  // requests (`scopes` / `customScopes` / `responseType` / `responseMode` / template + auth-request\n  // shaping, including the `acrValues` step-up demand). Turning `pkceEnabled` off, or repointing\n  // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the\n  // before/after — and so does a change to `acrValues`, which is an authentication-strength\n  // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is\n  // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's\n  // one-level reach.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-\n  // validation posture decide which provider is trusted and whether its tokens are actually verified.\n  oidc: z.object({\n    templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence(),\n    templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n    customScopes: z.array(z.string()).optional().isAuditEvidence(),\n    discoveryUrl: z.url().optional().isAuditEvidence(),\n    issuer: z.url().optional().isAuditEvidence(),\n    authorizationEndpoint: z.url().optional().isAuditEvidence(),\n    tokenEndpoint: z.url().optional().isAuditEvidence(),\n    userInfoEndpoint: z.url().optional().isAuditEvidence(),\n    jwksUri: z.url().optional().isAuditEvidence(),\n    endSessionEndpoint: z.url().optional().isAuditEvidence(),\n    /**\n     * Redirect the browser to the identity provider's `endSessionEndpoint` when this connection's\n     * user logs out of Wildo — RP-initiated logout (issue #445).\n     *\n     * OPT-IN, and `false` by default, mirroring SAML's `singleLogoutEnabled` rather than inventing a\n     * second shape for the same question. Defaulting it on would change the logout behaviour of\n     * every existing connection that merely happens to have discovered an `end_session_endpoint`,\n     * which for the DISCOVERY template mode is most of them: the endpoint is read out of the\n     * provider's own document, so its presence records what the provider CAN do, never what the\n     * operator wants.\n     *\n     * The endpoint is the CAPABILITY and this is the DECISION. Both are needed — a connection with\n     * this on and no endpoint federates nothing, and says so in the log rather than failing a logout.\n     */\n    federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence(),\n    clientId: z.string().min(1).isAuditEvidence(),\n    /**\n     * OIDC/OAuth2 client secret issued by the IdP, used by the backend token\n     * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to\n     * authenticate this connection at the provider's token endpoint.\n     *\n     * `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:\n     * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it\n     * stays in the response DTO so the UI renders a masked placeholder, but the\n     * framework redacts it to `••••••••` at the client-serialization boundary only\n     * — internal reads (`servicesRegistryHandler.read` during token exchange) keep\n     * the real value. Do NOT use `.isBackendOnly()`: that strips the field from\n     * every client DTO, so the operator could never supply it.\n     *\n     * Preservation on UPDATE is NOT automatic here: this is a nested field, and the\n     * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a\n     * round-tripped mask must be re-injected from the stored record by the SSO\n     * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The\n     * central sentinel-strip only preserves TOP-LEVEL write-only secrets.\n     */\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence(),\n    responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence(),\n    responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence(),\n    claimsMapping: z.object({\n      email: z.string().default('email'),\n      firstName: z.string().default('given_name'),\n      lastName: z.string().default('family_name'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    /*\n     * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,\n     * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,\n     * which is why they were removed rather than honoured (#419, decided 2026-09-08).\n     *\n     * `verifyIdToken` ALWAYS verifies the issuer and the audience and hardcodes a five-minute\n     * maximum token age. Honouring the three toggles could therefore only ever LOOSEN a guard that\n     * is currently unconditional — an operator could switch off issuer or audience validation and\n     * break the token trust chain from a settings screen. A configuration field whose only\n     * achievable effect is to weaken a security control should not exist.\n     */\n    acrValues: z.array(z.string()).optional().isAuditEvidence(),\n    maxAge: z.number().min(0).optional().isAuditEvidence(),\n    prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),\n    pkceEnabled: z.boolean().default(true).isAuditEvidence(),\n    pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logTokenExchange: z.boolean().default(true),\n      logClaimsMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  autoCreateUsers: z.boolean().default(true),\n  autoVerifyEmail: z.boolean().default(true),\n  /** W2.8: if true, users authenticating via this SSO connection skip the application-level MFA policy. */\n  // `.isAuditEvidence()` — an explicit escape from the application MFA policy for everyone who\n  // authenticates through this connection. Flipping it on lowers the assurance level tenant-wide.\n  bypassAppMFA: z.boolean().default(false).isAuditEvidence(),\n  // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`\n  // and the two mappings decide what authority an externally-authenticated identity lands with,\n  // and `allowedDomains` decides whose identities the connection will accept at all. A change\n  // here is an authorization change; the field NAME alone cannot evidence it.\n  // The values are role names and domains — configuration, not personal data.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an\n  // externally-authenticated identity lands with, and whose identities are accepted.\n  defaultRole: z.string().optional().isAuditEvidence(),\n  allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n  groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n// NOTE: Protocol-config discriminant enforcement (protocol=saml → saml defined, protocol=oidc → oidc defined)\n// is validated at the backend service layer, not via .refine() here.\n// Zod 4 doesn't allow .extend() on refined objects, which breaks the polymorphism engine.\n\n\nexport type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;\n\nexport const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConnections',\n  baseFieldIdentifier: 'ssoConnectionId',\n  baseEnumKey: 'SSO_CONNECTIONS',\n  baseSchema: SsoConnectionBaseSchema,\n  // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.d.ts

@@ -27,11 +27,53 @@
  * an administrative-continuity refusal" with one check and still distinguish the scope when it wants
  * to — which two unrelated enums would not.
  */
+/** @wildo_source:part:start saas.models.authorization.administrative-continuity-codes facet:layer:shared facet:audience:app-developer */
 /**
  * Which administrative population a refusal was protecting.
  *
- * A closed vocabulary with one named runtime source: schemas, comparisons and client branches all
- * derive from this enum rather than re-typing the literals.
+ * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: schemas,
+ * comparisons and client branches all derive from this enum rather than re-typing the literals.
+ *
+ * ## Where you meet it
+ *
+ * A write that would strip the last accountable administrator is refused with HTTP **409 CONFLICT**,
+ * and this value rides under the response's stable `code` key. Branch on `code`, never on the
+ * message: the message is a human remedy and is free to be reworded, and every other field a backend
+ * might have used to carry the reason is stripped from a CONFLICT before it reaches a client.
+ *
+ * `409` and not `403`/`400` is deliberate and worth handling separately: the caller IS authorised and
+ * the payload IS valid. What forbids the write is the current state, so a generic "conflict, retry"
+ * branch loops forever — the remedy is to appoint another administrator at the named scope first.
+ *
+ * ## What counts as an administrator, when you are deciding whether the remedy will work
+ *
+ * Three conditions, all of which must hold, and each resolved toward the SMALLER count so an
+ * ambiguity produces an over-refusal (recoverable) rather than a lockout (not):
+ *
+ * 1. the roles must CONFER the anchor role — `APP_ADMIN_SUPER_ADMIN` at application scope,
+ *    `ORG_OWNER` at organization scope — directly OR through an `inheritFrom` chain. The conferring
+ *    set is resolved from your application's LIVE role table at the moment of the call, so a role you
+ *    registered yourself that inherits from the anchor counts, and its holders are equally protected;
+ * 2. the membership must be `ACTIVE`. An `INVITED` row does not count even though accepting it would
+ *    flip the same row — a recoverable administrator is not a usable one, and the invitee may never
+ *    accept;
+ * 3. the linked user account must be `ACTIVE`. A suspended user cannot present the membership at all.
+ *
+ * ## Two traps
+ *
+ * **A UNIT-scoped grant does not satisfy the organization floor.** Granting the owner role inside one
+ * organization unit reaches that unit and nothing across the tenant, so the floor — which reads
+ * organization-wide membership roles and nothing else — refuses the retry exactly as before. Promote
+ * an organization-wide member instead.
+ *
+ * **Deactivating a user REPORTS rather than refuses.** Suspending an account is overwhelmingly
+ * incident response, and refusing it would mean an operator cannot lock out a hostile owner without
+ * first transferring ownership using the tenant the attacker controls. So the containment proceeds
+ * and every tenant it strands is recorded at critical severity — do not read this refusal as a
+ * guarantee that no suspension can leave a tenant ownerless.
+ *
+ * A tenant that is finished is exempt: a `CANCELLED` or `DELETED` organization, or one that has
+ * already requested deletion, may lose its last owner, so ordinary offboarding is never blocked.
  */
 export declare enum AdministrativeContinuityErrorCode {
     /**
@@ -54,4 +96,5 @@ export declare enum AdministrativeContinuityErrorCode {
      */
     LAST_ORGANIZATION_OWNER = "LAST_ORGANIZATION_OWNER"
 }
+/** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */
 //# sourceMappingURL=administrative-continuity.shared.schemas.d.ts.map

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"administrative-continuity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;GAKG;AACH,oBAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAE7D;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;CACpD"}
+{"version":3,"file":"administrative-continuity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAE7D;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;CACpD;AACD,uFAAuF"}

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.js

@@ -27,11 +27,53 @@
  * an administrative-continuity refusal" with one check and still distinguish the scope when it wants
  * to — which two unrelated enums would not.
  */
+/** @wildo_source:part:start saas.models.authorization.administrative-continuity-codes facet:layer:shared facet:audience:app-developer */
 /**
  * Which administrative population a refusal was protecting.
  *
- * A closed vocabulary with one named runtime source: schemas, comparisons and client branches all
- * derive from this enum rather than re-typing the literals.
+ * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: schemas,
+ * comparisons and client branches all derive from this enum rather than re-typing the literals.
+ *
+ * ## Where you meet it
+ *
+ * A write that would strip the last accountable administrator is refused with HTTP **409 CONFLICT**,
+ * and this value rides under the response's stable `code` key. Branch on `code`, never on the
+ * message: the message is a human remedy and is free to be reworded, and every other field a backend
+ * might have used to carry the reason is stripped from a CONFLICT before it reaches a client.
+ *
+ * `409` and not `403`/`400` is deliberate and worth handling separately: the caller IS authorised and
+ * the payload IS valid. What forbids the write is the current state, so a generic "conflict, retry"
+ * branch loops forever — the remedy is to appoint another administrator at the named scope first.
+ *
+ * ## What counts as an administrator, when you are deciding whether the remedy will work
+ *
+ * Three conditions, all of which must hold, and each resolved toward the SMALLER count so an
+ * ambiguity produces an over-refusal (recoverable) rather than a lockout (not):
+ *
+ * 1. the roles must CONFER the anchor role — `APP_ADMIN_SUPER_ADMIN` at application scope,
+ *    `ORG_OWNER` at organization scope — directly OR through an `inheritFrom` chain. The conferring
+ *    set is resolved from your application's LIVE role table at the moment of the call, so a role you
+ *    registered yourself that inherits from the anchor counts, and its holders are equally protected;
+ * 2. the membership must be `ACTIVE`. An `INVITED` row does not count even though accepting it would
+ *    flip the same row — a recoverable administrator is not a usable one, and the invitee may never
+ *    accept;
+ * 3. the linked user account must be `ACTIVE`. A suspended user cannot present the membership at all.
+ *
+ * ## Two traps
+ *
+ * **A UNIT-scoped grant does not satisfy the organization floor.** Granting the owner role inside one
+ * organization unit reaches that unit and nothing across the tenant, so the floor — which reads
+ * organization-wide membership roles and nothing else — refuses the retry exactly as before. Promote
+ * an organization-wide member instead.
+ *
+ * **Deactivating a user REPORTS rather than refuses.** Suspending an account is overwhelmingly
+ * incident response, and refusing it would mean an operator cannot lock out a hostile owner without
+ * first transferring ownership using the tenant the attacker controls. So the containment proceeds
+ * and every tenant it strands is recorded at critical severity — do not read this refusal as a
+ * guarantee that no suspension can leave a tenant ownerless.
+ *
+ * A tenant that is finished is exempt: a `CANCELLED` or `DELETED` organization, or one that has
+ * already requested deletion, may lose its last owner, so ordinary offboarding is never blocked.
  */
 export var AdministrativeContinuityErrorCode;
 (function (AdministrativeContinuityErrorCode) {
@@ -55,4 +97,5 @@ export var AdministrativeContinuityErrorCode;
      */
     AdministrativeContinuityErrorCode["LAST_ORGANIZATION_OWNER"] = "LAST_ORGANIZATION_OWNER";
 })(AdministrativeContinuityErrorCode || (AdministrativeContinuityErrorCode = {}));
+/** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */
 //# sourceMappingURL=administrative-continuity.shared.schemas.js.map

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"administrative-continuity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iCAqBX;AArBD,WAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,kGAA6D,CAAA;IAE7D;;;;;;;;OAQG;IACH,wFAAmD,CAAA;AACrD,CAAC,EArBW,iCAAiC,KAAjC,iCAAiC,QAqB5C","sourcesContent":["/**\n * Administrative-continuity refusal codes — the stable, client-branchable identity of a\n * \"you would remove the last accountable administrator\" refusal.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application, and each of its\n * tenants, must retain an accountable administrative principal.\n *\n * ## Why this exists as a shared enum rather than prose\n *\n * Both authority floors refuse with `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an\n * ALLOWLIST of context keys on a CONFLICT. The human remedy travels under `message`, which is on that\n * list — but prose is not a contract: a client wanting to tell \"you would strip the last\n * administrator\" apart from any other 409 would have to regex-parse it, and that breaks the moment\n * the wording is improved.\n *\n * The allowlist's own documented rule is that a client-branchable value rides under the stable `code`\n * key, sourced from an enum declared HERE in `@wildo-ai/saas-models` so backend and frontend share one\n * definition — and explicitly NOT under an invented `reason` / `errorKind` field (which the sanitizer\n * strips precisely so that this rule is the only way through). The backend-side `reason` codes remain,\n * unchanged and unshipped: they are the LOG/audit identity, richer than the wire and free to stay so.\n *\n * ## Why one enum for two floors\n *\n * The application floor and the organization-owner floor are distinct authorities over distinct\n * populations, but from a CLIENT's perspective they are one situation with one remedy shape: appoint\n * another administrator at the named scope, then retry. A single enum lets a caller branch on \"this is\n * an administrative-continuity refusal\" with one check and still distinguish the scope when it wants\n * to — which two unrelated enums would not.\n */\n\n/**\n * Which administrative population a refusal was protecting.\n *\n * A closed vocabulary with one named runtime source: schemas, comparisons and client branches all\n * derive from this enum rather than re-typing the literals.\n */\nexport enum AdministrativeContinuityErrorCode {\n  /**\n   * The write would leave the APPLICATION with no administratively usable super-administrator —\n   * a principal that confers `APP_ADMIN_SUPER_ADMIN` (directly or through an `inheritFrom` chain)\n   * and whose account status can still authenticate.\n   *\n   * Unrecoverable in-product once breached: every recovery door is itself gated on that role.\n   * Remedy: grant a super-administrator role to another active user, then retry.\n   */\n  LAST_APPLICATION_SUPER_ADMIN = 'LAST_APPLICATION_SUPER_ADMIN',\n\n  /**\n   * The write would leave ONE organization with no administratively usable owner — an ACTIVE\n   * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.\n   *\n   * Unrecoverable in-product once breached, and MORE absolutely than the application case:\n   * `ORGANIZATION_MEMBERS` declares no super-administrator variant, so a platform administrator who\n   * is not a member of the stranded tenant can observe and destroy it but cannot re-own it.\n   * Remedy: grant an owner role to another active member of that organization, then retry.\n   */\n  LAST_ORGANIZATION_OWNER = 'LAST_ORGANIZATION_OWNER',\n}\n"]}
+{"version":3,"file":"administrative-continuity.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAN,IAAY,iCAqBX;AArBD,WAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,kGAA6D,CAAA;IAE7D;;;;;;;;OAQG;IACH,wFAAmD,CAAA;AACrD,CAAC,EArBW,iCAAiC,KAAjC,iCAAiC,QAqB5C;AACD,uFAAuF","sourcesContent":["/**\n * Administrative-continuity refusal codes — the stable, client-branchable identity of a\n * \"you would remove the last accountable administrator\" refusal.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application, and each of its\n * tenants, must retain an accountable administrative principal.\n *\n * ## Why this exists as a shared enum rather than prose\n *\n * Both authority floors refuse with `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an\n * ALLOWLIST of context keys on a CONFLICT. The human remedy travels under `message`, which is on that\n * list — but prose is not a contract: a client wanting to tell \"you would strip the last\n * administrator\" apart from any other 409 would have to regex-parse it, and that breaks the moment\n * the wording is improved.\n *\n * The allowlist's own documented rule is that a client-branchable value rides under the stable `code`\n * key, sourced from an enum declared HERE in `@wildo-ai/saas-models` so backend and frontend share one\n * definition — and explicitly NOT under an invented `reason` / `errorKind` field (which the sanitizer\n * strips precisely so that this rule is the only way through). The backend-side `reason` codes remain,\n * unchanged and unshipped: they are the LOG/audit identity, richer than the wire and free to stay so.\n *\n * ## Why one enum for two floors\n *\n * The application floor and the organization-owner floor are distinct authorities over distinct\n * populations, but from a CLIENT's perspective they are one situation with one remedy shape: appoint\n * another administrator at the named scope, then retry. A single enum lets a caller branch on \"this is\n * an administrative-continuity refusal\" with one check and still distinguish the scope when it wants\n * to — which two unrelated enums would not.\n */\n\n/** @wildo_source:part:start saas.models.authorization.administrative-continuity-codes facet:layer:shared facet:audience:app-developer */\n/**\n * Which administrative population a refusal was protecting.\n *\n * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: schemas,\n * comparisons and client branches all derive from this enum rather than re-typing the literals.\n *\n * ## Where you meet it\n *\n * A write that would strip the last accountable administrator is refused with HTTP **409 CONFLICT**,\n * and this value rides under the response's stable `code` key. Branch on `code`, never on the\n * message: the message is a human remedy and is free to be reworded, and every other field a backend\n * might have used to carry the reason is stripped from a CONFLICT before it reaches a client.\n *\n * `409` and not `403`/`400` is deliberate and worth handling separately: the caller IS authorised and\n * the payload IS valid. What forbids the write is the current state, so a generic \"conflict, retry\"\n * branch loops forever — the remedy is to appoint another administrator at the named scope first.\n *\n * ## What counts as an administrator, when you are deciding whether the remedy will work\n *\n * Three conditions, all of which must hold, and each resolved toward the SMALLER count so an\n * ambiguity produces an over-refusal (recoverable) rather than a lockout (not):\n *\n * 1. the roles must CONFER the anchor role — `APP_ADMIN_SUPER_ADMIN` at application scope,\n *    `ORG_OWNER` at organization scope — directly OR through an `inheritFrom` chain. The conferring\n *    set is resolved from your application's LIVE role table at the moment of the call, so a role you\n *    registered yourself that inherits from the anchor counts, and its holders are equally protected;\n * 2. the membership must be `ACTIVE`. An `INVITED` row does not count even though accepting it would\n *    flip the same row — a recoverable administrator is not a usable one, and the invitee may never\n *    accept;\n * 3. the linked user account must be `ACTIVE`. A suspended user cannot present the membership at all.\n *\n * ## Two traps\n *\n * **A UNIT-scoped grant does not satisfy the organization floor.** Granting the owner role inside one\n * organization unit reaches that unit and nothing across the tenant, so the floor — which reads\n * organization-wide membership roles and nothing else — refuses the retry exactly as before. Promote\n * an organization-wide member instead.\n *\n * **Deactivating a user REPORTS rather than refuses.** Suspending an account is overwhelmingly\n * incident response, and refusing it would mean an operator cannot lock out a hostile owner without\n * first transferring ownership using the tenant the attacker controls. So the containment proceeds\n * and every tenant it strands is recorded at critical severity — do not read this refusal as a\n * guarantee that no suspension can leave a tenant ownerless.\n *\n * A tenant that is finished is exempt: a `CANCELLED` or `DELETED` organization, or one that has\n * already requested deletion, may lose its last owner, so ordinary offboarding is never blocked.\n */\nexport enum AdministrativeContinuityErrorCode {\n  /**\n   * The write would leave the APPLICATION with no administratively usable super-administrator —\n   * a principal that confers `APP_ADMIN_SUPER_ADMIN` (directly or through an `inheritFrom` chain)\n   * and whose account status can still authenticate.\n   *\n   * Unrecoverable in-product once breached: every recovery door is itself gated on that role.\n   * Remedy: grant a super-administrator role to another active user, then retry.\n   */\n  LAST_APPLICATION_SUPER_ADMIN = 'LAST_APPLICATION_SUPER_ADMIN',\n\n  /**\n   * The write would leave ONE organization with no administratively usable owner — an ACTIVE\n   * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.\n   *\n   * Unrecoverable in-product once breached, and MORE absolutely than the application case:\n   * `ORGANIZATION_MEMBERS` declares no super-administrator variant, so a platform administrator who\n   * is not a member of the stranded tenant can observe and destroy it but cannot re-own it.\n   * Remedy: grant an owner role to another active member of that organization, then retry.\n   */\n  LAST_ORGANIZATION_OWNER = 'LAST_ORGANIZATION_OWNER',\n}\n/** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */\n"]}

package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Application Access Grants — resource configuration.
+ *
+ * The operation set mirrors `platformAccessGrants` verb for verb, and the ONE difference is the whole
+ * feature: `approve` is gated on the PLATFORM's own administrators rather than a tenant's, and refuses
+ * the requester. On the tenant resource the ABSENCE of `admitsCrossTenantPlatformAdministration` on
+ * `approve` is what stops an operator approving their own request; here every verb is platform-tier by
+ * construction, so that absence buys nothing and the refusal has to be a MEASUREMENT the
+ * implementation makes — `applicationAccessGrantApproverIsDistinct`.
+ *
+ * See `application-access-grants.shared.schemas.ts` for why the resource exists and why it is a
+ * sibling type rather than a field, and `.claude/rules/administrative-continuity-floors.md` for the
+ * ladder it sits on.
+ */
+import { z } from 'zod';
+import { ApplicationAccessGrants_Operations } from './application-access-grants.shared.schemas';
+import { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';
+import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
+import { type ResourceRelationship } from '../../resources/resources.shared.schemas';
+type ApplicationAccessGrantsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.COUNT | CoreResourceOperation.UPDATE_MANY;
+export declare const applicationAccessGrantsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<typeof ApplicationAccessGrants_Operations, ApplicationAccessGrantsCoreOperations, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
+    operatorUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    justification: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof PlatformAccessGrantStatus>>>>>>>>;
+    expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>>>;
+    approvedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>>;
+    approvedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    decisionReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>>;
+export {};
+//# sourceMappingURL=application-access-grants.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,kCAAkC,EAEnC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAE3B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,kEAAkE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;kBA6P7H,CAAC"}

package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.js

@@ -0,0 +1,257 @@
+/**
+ * Application Access Grants — resource configuration.
+ *
+ * The operation set mirrors `platformAccessGrants` verb for verb, and the ONE difference is the whole
+ * feature: `approve` is gated on the PLATFORM's own administrators rather than a tenant's, and refuses
+ * the requester. On the tenant resource the ABSENCE of `admitsCrossTenantPlatformAdministration` on
+ * `approve` is what stops an operator approving their own request; here every verb is platform-tier by
+ * construction, so that absence buys nothing and the refusal has to be a MEASUREMENT the
+ * implementation makes — `applicationAccessGrantApproverIsDistinct`.
+ *
+ * See `application-access-grants.shared.schemas.ts` for why the resource exists and why it is a
+ * sibling type rather than a field, and `.claude/rules/administrative-continuity-floors.md` for the
+ * ladder it sits on.
+ */
+import { z } from 'zod';
+import { ApplicationAccessGrantSchema, ApplicationAccessGrants_Operations, applicationAccessGrantApproverIsDistinct, } from './application-access-grants.shared.schemas.js';
+import { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../resources/resources.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
+import { CORE_APP_ROLES } from './roles.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas.js';
+export const applicationAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: ApplicationAccessGrantSchema,
+    resourceIdentifier: CoreResourceType.APPLICATION_ACCESS_GRANTS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_ACCESS_GRANTS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /**
+     * `read`/`list` ALLOWED for the trusted path, and for exactly the reason the tenant resource
+     * allows them: the authorization layer itself resolves a caller's usable grant on a system
+     * context, before the caller's own authority has been established for the read it is gating.
+     *
+     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies
+     * the two-person measurement. A system door around those would be a second way to mint an
+     * application-wide elevation, which is the one thing this resource exists to prevent.
+     *
+     * `exportSubject: FORBIDDEN`, mirrored from the tenant resource. `operatorUserId` and
+     * `approvedByUserId` are foreign keys back to USERS, so these rows sit on a user's Art. 15 graph
+     * as `INCLUDED_REFERENCES_SUBJECT`; an included resource carrying NO declaration REFUSES the whole
+     * export, so omitting this would trade a boot failure for a broken disclosure right. FORBIDDEN
+     * because this is a security-monitoring record and handing the monitoring trail to the person it
+     * monitors is self-defeating — and because it names ANOTHER data subject's decision (the second
+     * administrator), which Art. 15(4) protects.
+     */
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        exportSubject: ResourceSystemAccessMode.FORBIDDEN,
+    },
+    /**
+     * Subject erasure RETAINS this row and scrubs its free text — mirrored from the tenant resource
+     * because it is the same kind of record. What survives is WHO reached application-wide, WHEN, and
+     * who signed for it; what does not is `justification` and `decisionReason`, the operator- and
+     * approver-written prose most likely to name a third party in passing.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,
+    },
+    /**
+     * Erasing one of these revokes NO session: the grant is a record ABOUT an operator's access, not
+     * the operator. Their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.COUNT,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
+    ],
+    operationsConfiguration: {
+        /*
+         * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be
+         * REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,
+         * which matches only INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize
+         * writer uses to stamp markers.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
+        /**
+         * The pending queue a second administrator works from, and the record of what was granted.
+         *
+         * `APP_ADMIN_SUPER_ADMIN` on every read: the rows name operator reach across every tenant, and
+         * there is no tenant-side reader here as there is on the platform resource — an application-wide
+         * grant has no customer to show it to. That absence is precisely why the approval had to become
+         * a second signature.
+         */
+        [CoreResourceOperation.READ]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.COUNT]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        /**
+         * The bootstrap verb.
+         *
+         * Note what it deliberately does NOT declare: `admitsCrossTenantPlatformAdministration`. On the
+         * tenant resource that flag is what lets a non-member operator write a row inside someone else's
+         * tenant, and `requestAccess` there is exempted from the grant requirement it bootstraps. Here
+         * the resource is APPLICATION-scoped — there is no tenant boundary to cross — so the flag would
+         * be meaningless and the exemption has a different shape: the ADMISSION gate exempts this
+         * resource entirely, because an operator would otherwise need an application-wide grant in order
+         * to ask for one.
+         *
+         * What keeps that safe is the same argument the tenant resource makes: requesting is not
+         * accessing. This writes one PENDING row and reads nothing. The blast radius of an abused
+         * request is an entry in a queue that another administrator must sign.
+         *
+         * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — application-wide reach is
+         * requested, never assumed.
+         * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+         */
+        [ApplicationAccessGrants_Operations.REQUEST_ACCESS]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requestDto: z.object({
+                        justification: z.string().min(1).max(1000),
+                        /** Minutes. Clamped server-side to the 1h ceiling; a longer ask is not refused. */
+                        requestedDurationMinutes: z.number().int().positive().optional(),
+                    }),
+                },
+            ],
+        },
+        /**
+         * The SECOND SIGNATURE.
+         *
+         * `enabledCondition` refuses a self-approval here as well as in the implementation, and the
+         * duplication is deliberate rather than redundant — they are two different guarantees. This one
+         * makes the affordance DISAPPEAR for the requester, so a platform console never renders an
+         * Approve button on one's own request; the implementation's `assert…` is the fail-closed half,
+         * because `enabledCondition` is evaluated against the row the framework fetched and a future
+         * variant authored without one would otherwise transition silently.
+         *
+         * Neutering either alone must not admit a self-approval. That is what the two pins assert.
+         *
+         * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation requires
+         * a second, distinct platform administrator's signature.
+         */
+        [ApplicationAccessGrants_Operations.APPROVE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({
+                        decisionReason: z.string().max(1000).optional(),
+                    }),
+                    enabledCondition: ({ currentObject, initiatorIds }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL
+                        && applicationAccessGrantApproverIsDistinct({
+                            operatorUserId: currentObject.operatorUserId,
+                            approverUserId: initiatorIds?.userId,
+                        }),
+                },
+            ],
+        },
+        /**
+         * Refusing a request. NOT gated on being a different person: an operator who thinks better of
+         * their own request should be able to withdraw it, and a denial only ever removes authority.
+         * The two-person rule constrains what an operator can GRANT themselves, never what they can
+         * refuse themselves.
+         */
+        [ApplicationAccessGrants_Operations.DENY]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({
+                        decisionReason: z.string().max(1000).optional(),
+                    }),
+                    enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,
+                },
+            ],
+        },
+        /** Ending an elevation early. Monotonic — it only ever removes authority — so it is unrestricted among platform administrators. */
+        [ApplicationAccessGrants_Operations.REVOKE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({
+                        decisionReason: z.string().max(1000).optional(),
+                    }),
+                    enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL
+                        || currentObject.status === PlatformAccessGrantStatus.ACTIVE,
+                },
+            ],
+        },
+        /**
+         * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and by
+         * nothing else. INTERNAL_CALL: no route, no affordance.
+         *
+         * `requestDto: z.object({})` is EMPTY BY CONTRACT, not by omission — an operation without a
+         * `requestDto` inherits the resource's entire update contract, which would let a verb that
+         * accepts nothing advertise every field, `status` included.
+         */
+        [ApplicationAccessGrants_Operations.EXPIRE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({}),
+                },
+            ],
+        },
+    },
+    // NOTE: the APPLICATION primary scope is NOT declared here. It is derived from the registry
+    // relationship carrying `isPrimaryScope: true` (APPLICATION → APPLICATION_ACCESS_GRANTS).
+});
+//# sourceMappingURL=application-access-grants.shared.resources-config.schemas.js.map

package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,wCAAwC,GACzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAS1H,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACnI,0CAA0C,CAIxC;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;OAKG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,kCAAkC,CAAC,cAAc,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;qBACjE,CAAC;iBACH;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,kCAAkC,CAAC,OAAO,CAAC,EAAE;YAC5C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,CACpD,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,wCAAwC,CAAC;4BAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;4BAC5C,cAAc,EAAE,YAAY,EAAE,MAAM;yBACrC,CAAC;iBACL;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,kCAAkC,CAAC,IAAI,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,mIAAmI;QACnI,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;KACF;IACD,4FAA4F;IAC5F,0FAA0F;CAC3F,CAAC,CAAC","sourcesContent":["/**\n * Application Access Grants — resource configuration.\n *\n * The operation set mirrors `platformAccessGrants` verb for verb, and the ONE difference is the whole\n * feature: `approve` is gated on the PLATFORM's own administrators rather than a tenant's, and refuses\n * the requester. On the tenant resource the ABSENCE of `admitsCrossTenantPlatformAdministration` on\n * `approve` is what stops an operator approving their own request; here every verb is platform-tier by\n * construction, so that absence buys nothing and the refusal has to be a MEASUREMENT the\n * implementation makes — `applicationAccessGrantApproverIsDistinct`.\n *\n * See `application-access-grants.shared.schemas.ts` for why the resource exists and why it is a\n * sibling type rather than a field, and `.claude/rules/administrative-continuity-floors.md` for the\n * ladder it sits on.\n */\n\nimport { z } from 'zod';\nimport {\n  ApplicationAccessGrantSchema,\n  ApplicationAccessGrants_Operations,\n  applicationAccessGrantApproverIsDistinct,\n} from './application-access-grants.shared.schemas';\nimport { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\ntype ApplicationAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const applicationAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ApplicationAccessGrants_Operations,\n    ApplicationAccessGrantsCoreOperations,\n    typeof ApplicationAccessGrantSchema\n  >({\n    mainSchema: ApplicationAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.APPLICATION_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` ALLOWED for the trusted path, and for exactly the reason the tenant resource\n     * allows them: the authorization layer itself resolves a caller's usable grant on a system\n     * context, before the caller's own authority has been established for the read it is gating.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the two-person measurement. A system door around those would be a second way to mint an\n     * application-wide elevation, which is the one thing this resource exists to prevent.\n     *\n     * `exportSubject: FORBIDDEN`, mirrored from the tenant resource. `operatorUserId` and\n     * `approvedByUserId` are foreign keys back to USERS, so these rows sit on a user's Art. 15 graph\n     * as `INCLUDED_REFERENCES_SUBJECT`; an included resource carrying NO declaration REFUSES the whole\n     * export, so omitting this would trade a boot failure for a broken disclosure right. FORBIDDEN\n     * because this is a security-monitoring record and handing the monitoring trail to the person it\n     * monitors is self-defeating — and because it names ANOTHER data subject's decision (the second\n     * administrator), which Art. 15(4) protects.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text — mirrored from the tenant resource\n     * because it is the same kind of record. What survives is WHO reached application-wide, WHEN, and\n     * who signed for it; what does not is `justification` and `decisionReason`, the operator- and\n     * approver-written prose most likely to name a third party in passing.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these revokes NO session: the grant is a record ABOUT an operator's access, not\n     * the operator. Their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be\n       * REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize\n       * writer uses to stamp markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      /**\n       * The pending queue a second administrator works from, and the record of what was granted.\n       *\n       * `APP_ADMIN_SUPER_ADMIN` on every read: the rows name operator reach across every tenant, and\n       * there is no tenant-side reader here as there is on the platform resource — an application-wide\n       * grant has no customer to show it to. That absence is precisely why the approval had to become\n       * a second signature.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb.\n       *\n       * Note what it deliberately does NOT declare: `admitsCrossTenantPlatformAdministration`. On the\n       * tenant resource that flag is what lets a non-member operator write a row inside someone else's\n       * tenant, and `requestAccess` there is exempted from the grant requirement it bootstraps. Here\n       * the resource is APPLICATION-scoped — there is no tenant boundary to cross — so the flag would\n       * be meaningless and the exemption has a different shape: the ADMISSION gate exempts this\n       * resource entirely, because an operator would otherwise need an application-wide grant in order\n       * to ask for one.\n       *\n       * What keeps that safe is the same argument the tenant resource makes: requesting is not\n       * accessing. This writes one PENDING row and reads nothing. The blast radius of an abused\n       * request is an entry in a queue that another administrator must sign.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — application-wide reach is\n       * requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [ApplicationAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 1h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional(),\n            }),\n          },\n        ],\n      },\n\n      /**\n       * The SECOND SIGNATURE.\n       *\n       * `enabledCondition` refuses a self-approval here as well as in the implementation, and the\n       * duplication is deliberate rather than redundant — they are two different guarantees. This one\n       * makes the affordance DISAPPEAR for the requester, so a platform console never renders an\n       * Approve button on one's own request; the implementation's `assert…` is the fail-closed half,\n       * because `enabledCondition` is evaluated against the row the framework fetched and a future\n       * variant authored without one would otherwise transition silently.\n       *\n       * Neutering either alone must not admit a self-approval. That is what the two pins assert.\n       *\n       * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation requires\n       * a second, distinct platform administrator's signature.\n       */\n      [ApplicationAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject, initiatorIds }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              && applicationAccessGrantApproverIsDistinct({\n                operatorUserId: currentObject.operatorUserId,\n                approverUserId: initiatorIds?.userId,\n              }),\n          },\n        ],\n      },\n\n      /**\n       * Refusing a request. NOT gated on being a different person: an operator who thinks better of\n       * their own request should be able to withdraw it, and a denial only ever removes authority.\n       * The two-person rule constrains what an operator can GRANT themselves, never what they can\n       * refuse themselves.\n       */\n      [ApplicationAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /** Ending an elevation early. Monotonic — it only ever removes authority — so it is unrestricted among platform administrators. */\n      [ApplicationAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n\n      /**\n       * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and by\n       * nothing else. INTERNAL_CALL: no route, no affordance.\n       *\n       * `requestDto: z.object({})` is EMPTY BY CONTRACT, not by omission — an operation without a\n       * `requestDto` inherits the resource's entire update contract, which would let a verb that\n       * accepts nothing advertise every field, `status` included.\n       */\n      [ApplicationAccessGrants_Operations.EXPIRE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({}),\n          },\n        ],\n      },\n    },\n    // NOTE: the APPLICATION primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (APPLICATION → APPLICATION_ACCESS_GRANTS).\n  });\n"]}