@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/security/authentications/siem/siem-export-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,eAAe,EAAE,iBAAiB;IAClC,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAE,eAAe;IAC9B,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;CAClB,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IAEpD,4EAA4E;IAC5E,6EAA6E;IAC7E,qEAAqE;IACrE,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC;IAC/D;;;;;;;;;;;;;;OAcG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IACzD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC;IAE3D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC;IAE7E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;YACrD,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,WAAW;SAC9B,CAAC;QACF,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC5E,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACnD,CAAC;IAEF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACtD,CAAC;IAEF,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE/C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sCAAsC,GAAG,yBAAyB,CAAC;IAC9E,gBAAgB,EAAE,kBAAkB;IACpC,mBAAmB,EAAE,oBAAoB;IACzC,WAAW,EAAE,oBAAoB;IACjC,UAAU,EAAE,0BAA0B;IACtC,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SIEM Export Config Schema (Shared) — Polymorphic\n *\n * Webhook configuration for exporting security audit events to external SIEM.\n * Nested sub-objects: eventFilter{}, delivery{}.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * ── ORG variant is live; the APPLICATION variant is settable but INERT ─────────────\n * The polymorphism below emits both an ORGANIZATION and an APPLICATION variant. Only the\n * ORGANIZATION variant drives delivery today: the sole SIEM producer\n * (`AuditEventDispatcherBackendService`) fans out per authenticated tenant (org) and reads\n * this config via `loadSiemExportConfig(ec, ORGANIZATION, orgId)`. An app super-admin CAN\n * create/enable `APPLICATION_SIEM_EXPORT_CONFIG` (it has its own custom-impl +\n * APP_ADMIN_SUPER_ADMIN roles), but NO producer emits app-scoped deliveries, so an enabled\n * app config silently delivers nothing. The APP variant is RESERVED / DORMANT until an\n * app-scoped producer is built — see `AuditEventDispatcherBackendService.\n * dispatchToOrganizationAuditSinks` for the rationale + the wiring it would need. (When\n * that producer lands, or if this trap is hardened sooner, the app config surface should\n * be gated/hidden until delivery actually works.)\n *\n * @see auth-data-model-audit.md §2D\n */\n\nimport { z } from 'zod';\nimport { WildoHeaderKeys } from '../../../requests/header-keys.shared';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const SIEMAuthMethod = {\n  BEARER_TOKEN: 'bearer_token',\n  API_KEY_HEADER: 'api_key_header',\n  HMAC_SHA256: 'hmac_sha256',\n  NONE: 'none',\n} as const;\n\n/**\n * The wire formats a tenant's SIEM export can request.\n *\n * `OCSF` is the JSON-native security schema the category has standardised on (ITU ratification track\n * to June 2026), and it is a PEER of the two text formats rather than a replacement: CEF and LEEF stay\n * for tenants whose SIEM wants them. The difference that matters is representational — a\n * security-audit envelope maps onto an OCSF CLASS natively, where CEF can only force it into a\n * `csN` custom-string slot.\n */\nexport const SIEMEventFormat = {\n  JSON_STRUCTURED: 'json_structured',\n  CEF: 'cef',\n  LEEF: 'leef',\n  OCSF: 'ocsf',\n} as const;\n\nexport const SIEMEventCategory = {\n  AUTHENTICATION: 'authentication',\n  AUTHORIZATION: 'authorization',\n  USER_LIFECYCLE: 'user_lifecycle',\n  ORG_MANAGEMENT: 'org_management',\n  DATA_ACCESS: 'data_access',\n} as const;\n\nexport const SIEMFilterSeverity = {\n  INFO: 'info',\n  WARNING: 'warning',\n  CRITICAL: 'critical',\n} as const;\n\nexport const SiemExportConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  enabled: z.boolean().default(false).isSummaryField(),\n\n  // Destination for exported audit events. The empty string is the DISABLED /\n  // not-yet-configured state (paired with `enabled: false`) and is the default\n  // for a freshly-seeded config — so the union MUST admit `''`. A bare\n  // `z.url().default('')` is self-contradictory: `z.url()` rejects `''`, so the\n  // default value fails output re-validation and every unconfigured row 500s on\n  // READ (`transformOutput`). Accept a real URL OR the empty sentinel.\n  webhookUrl: z.url().or(z.literal('')).default(''),\n\n  authMethod: z.enum(SIEMAuthMethod).default(SIEMAuthMethod.NONE),\n  /**\n   * User-provided secret used to authenticate outbound webhook deliveries to the\n   * customer's SIEM endpoint (bearer token, API-key value, etc.).\n   *\n   * `.isWriteOnlySecret()` gives this the framework's write-then-masked-secret\n   * contract: it stays in the CREATE/UPDATE request DTO (the operator supplies\n   * and rotates it) and in the response DTO (so the UI renders a masked\n   * placeholder), but the framework redacts it to `••••••••` at the client\n   * boundary and treats a round-tripped `••••••••` on write as \"keep the existing\n   * secret\". The real value is retained for backend internal reads only — the\n   * webhook dispatcher reads it via `readAsSystem` to sign deliveries. Do NOT use\n   * `.isBackendOnly()` here: that strips the field from every client DTO, dropping\n   * the operator's typed value before it is stored and leaving the presets a field\n   * they cannot resolve.\n   */\n  authCredential: z.string().optional().isWriteOnlySecret(),\n  authHeaderName: z.string().default(WildoHeaderKeys.API_KEY),\n\n  eventFormat: z.enum(SIEMEventFormat).default(SIEMEventFormat.JSON_STRUCTURED),\n\n  eventFilter: z.object({\n    categories: z.array(z.enum(SIEMEventCategory)).default([\n      SIEMEventCategory.AUTHENTICATION,\n      SIEMEventCategory.AUTHORIZATION,\n      SIEMEventCategory.USER_LIFECYCLE,\n      SIEMEventCategory.ORG_MANAGEMENT,\n      SIEMEventCategory.DATA_ACCESS,\n    ]),\n    severityMinimum: z.enum(SIEMFilterSeverity).default(SIEMFilterSeverity.INFO),\n    specificEventTypes: z.array(z.string()).optional(),\n  }),\n\n  delivery: z.object({\n    batchSize: z.number().min(1).max(100).default(1),\n    batchWindowSeconds: z.number().min(0).max(60).default(0),\n    retryAttempts: z.number().min(0).max(5).default(3),\n    retryBackoffSeconds: z.number().min(1).max(300).default(30),\n    timeoutSeconds: z.number().min(1).max(60).default(10),\n  }),\n\n  customHeaders: z.record(z.string(), z.string()).optional(),\n  includeRawEventData: z.boolean().default(true),\n  includeDeviceContext: z.boolean().default(true),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SiemExportConfigBase = z.infer<typeof SiemExportConfigBaseSchema>;\n\nexport const siemExportConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'siemExportConfig',\n  baseFieldIdentifier: 'siemExportConfigId',\n  baseEnumKey: 'SIEM_EXPORT_CONFIG',\n  baseSchema: SiemExportConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}
+{"version":3,"file":"siem-export-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qCAAqC,EAAE,MAAM,yEAAyE,CAAC;AAChI,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,eAAe,EAAE,iBAAiB;IAClC,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAE,eAAe;IAC9B,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;CAClB,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IAEpD,4EAA4E;IAC5E,6EAA6E;IAC7E,qEAAqE;IACrE,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC;IAC/D;;;;;;;;;;;;;;OAcG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IACzD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC;IAE3D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC;IAE7E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;YACrD,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,WAAW;SAC9B,CAAC;QACF,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC5E,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACnD,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB;;;;;;;;;;;;;;WAcG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD;;;;;;;;;;WAUG;QACH,kBAAkB,EAAE,CAAC,CAAC,UAAU;QAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAoCG;QACH,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAC5C,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAC3C;QACD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACtD,CAAC;IAEF,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE1D;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IAElE;;;;;;;;;;;;;;;;;;;;;OAqBG;IAEH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sCAAsC,GAAG,yBAAyB,CAAC;IAC9E,gBAAgB,EAAE,kBAAkB;IACpC,mBAAmB,EAAE,oBAAoB;IACzC,WAAW,EAAE,oBAAoB;IACjC,UAAU,EAAE,0BAA0B;IACtC,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SIEM Export Config Schema (Shared) — Polymorphic\n *\n * Webhook configuration for exporting security audit events to external SIEM.\n * Nested sub-objects: eventFilter{}, delivery{}.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * ── ORG variant is live; the APPLICATION variant is settable but INERT ─────────────\n * The polymorphism below emits both an ORGANIZATION and an APPLICATION variant. Only the\n * ORGANIZATION variant drives delivery today: the sole SIEM producer\n * (`AuditEventDispatcherBackendService`) fans out per authenticated tenant (org) and reads\n * this config via `loadSiemExportConfig(ec, ORGANIZATION, orgId)`. An app super-admin CAN\n * create/enable `APPLICATION_SIEM_EXPORT_CONFIG` (it has its own custom-impl +\n * APP_ADMIN_SUPER_ADMIN roles), but NO producer emits app-scoped deliveries, so an enabled\n * app config silently delivers nothing. The APP variant is RESERVED / DORMANT until an\n * app-scoped producer is built — see `AuditEventDispatcherBackendService.\n * dispatchToOrganizationAuditSinks` for the rationale + the wiring it would need. (When\n * that producer lands, or if this trap is hardened sooner, the app config surface should\n * be gated/hidden until delivery actually works.)\n *\n * @see auth-data-model-audit.md §2D\n */\n\nimport { z } from 'zod';\nimport { SiemExportProjectionDeclarationSchema } from '../../../compliance/audit-trails/audit-export-projection.shared.schemas';\nimport { WildoHeaderKeys } from '../../../requests/header-keys.shared';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const SIEMAuthMethod = {\n  BEARER_TOKEN: 'bearer_token',\n  API_KEY_HEADER: 'api_key_header',\n  HMAC_SHA256: 'hmac_sha256',\n  NONE: 'none',\n} as const;\n\n/**\n * The wire formats a tenant's SIEM export can request.\n *\n * `OCSF` is the JSON-native security schema the category has standardised on (ITU ratification track\n * to June 2026), and it is a PEER of the two text formats rather than a replacement: CEF and LEEF stay\n * for tenants whose SIEM wants them. The difference that matters is representational — a\n * security-audit envelope maps onto an OCSF CLASS natively, where CEF can only force it into a\n * `csN` custom-string slot.\n */\nexport const SIEMEventFormat = {\n  JSON_STRUCTURED: 'json_structured',\n  CEF: 'cef',\n  LEEF: 'leef',\n  OCSF: 'ocsf',\n} as const;\n\nexport const SIEMEventCategory = {\n  AUTHENTICATION: 'authentication',\n  AUTHORIZATION: 'authorization',\n  USER_LIFECYCLE: 'user_lifecycle',\n  ORG_MANAGEMENT: 'org_management',\n  DATA_ACCESS: 'data_access',\n} as const;\n\nexport const SIEMFilterSeverity = {\n  INFO: 'info',\n  WARNING: 'warning',\n  CRITICAL: 'critical',\n} as const;\n\nexport const SiemExportConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  enabled: z.boolean().default(false).isSummaryField(),\n\n  // Destination for exported audit events. The empty string is the DISABLED /\n  // not-yet-configured state (paired with `enabled: false`) and is the default\n  // for a freshly-seeded config — so the union MUST admit `''`. A bare\n  // `z.url().default('')` is self-contradictory: `z.url()` rejects `''`, so the\n  // default value fails output re-validation and every unconfigured row 500s on\n  // READ (`transformOutput`). Accept a real URL OR the empty sentinel.\n  webhookUrl: z.url().or(z.literal('')).default(''),\n\n  authMethod: z.enum(SIEMAuthMethod).default(SIEMAuthMethod.NONE),\n  /**\n   * User-provided secret used to authenticate outbound webhook deliveries to the\n   * customer's SIEM endpoint (bearer token, API-key value, etc.).\n   *\n   * `.isWriteOnlySecret()` gives this the framework's write-then-masked-secret\n   * contract: it stays in the CREATE/UPDATE request DTO (the operator supplies\n   * and rotates it) and in the response DTO (so the UI renders a masked\n   * placeholder), but the framework redacts it to `••••••••` at the client\n   * boundary and treats a round-tripped `••••••••` on write as \"keep the existing\n   * secret\". The real value is retained for backend internal reads only — the\n   * webhook dispatcher reads it via `readAsSystem` to sign deliveries. Do NOT use\n   * `.isBackendOnly()` here: that strips the field from every client DTO, dropping\n   * the operator's typed value before it is stored and leaving the presets a field\n   * they cannot resolve.\n   */\n  authCredential: z.string().optional().isWriteOnlySecret(),\n  authHeaderName: z.string().default(WildoHeaderKeys.API_KEY),\n\n  eventFormat: z.enum(SIEMEventFormat).default(SIEMEventFormat.JSON_STRUCTURED),\n\n  eventFilter: z.object({\n    categories: z.array(z.enum(SIEMEventCategory)).default([\n      SIEMEventCategory.AUTHENTICATION,\n      SIEMEventCategory.AUTHORIZATION,\n      SIEMEventCategory.USER_LIFECYCLE,\n      SIEMEventCategory.ORG_MANAGEMENT,\n      SIEMEventCategory.DATA_ACCESS,\n    ]),\n    severityMinimum: z.enum(SIEMFilterSeverity).default(SIEMFilterSeverity.INFO),\n    specificEventTypes: z.array(z.string()).optional(),\n  }),\n\n  /*\n   * Three knobs, and the two that were removed are the reason to read this.\n   *\n   * `retryAttempts`, `retryBackoffSeconds` and `timeoutSeconds` are honoured — the delivery worker\n   * reads all three (`siem-webhook-delivery.backend.service`, at the retry ceiling, the exponential\n   * backoff and the request deadline).\n   *\n   * `batchSize` and `batchWindowSeconds` are honoured TOO, as of #1379 — but they were not always,\n   * and the history is the reason to read this rather than trivia. They spent months appearing in\n   * the delivery service only as fields of its parameter TYPE: declared, passed, never consulted.\n   * That is the shape which makes an inert knob hardest to see, because it has a \"reader\" that\n   * decides nothing. The worker posted ONE event per HTTP request whatever they said, and the\n   * customer documentation warned an operator not to size a receiver or a billing estimate on\n   * either — a warning being what you write when the control is missing.\n   *\n   * They were deleted in `be001548` rather than kept as a disclosed \"reserved\" knob, on the\n   * principle that a receiver sized on `batchSize: 100` is sized wrong and a documented warning is\n   * not a control. They are back now because the control exists: a durable collector groups pending\n   * events per destination and sends them as one request, so the two numbers decide how many events\n   * a request may carry and how long a partly-filled one waits.\n   *\n   * The pairing that matters: `batchSize: 1` — the DEFAULT — means no batching at all, the window is\n   * never consulted, and the wire is byte-for-byte what it was before any of this existed.\n   */\n  delivery: z.object({\n    /**\n     * The MOST events one HTTP request may carry. `1` — the default — is one request per event,\n     * which is what this destination gets until its operator asks for anything else.\n     *\n     * The number means what it says: the collector claims at most this many pending events for one\n     * request and sends no more, so a receiver sized on `batchSize: 50` receives at most fifty. A\n     * burst larger than this becomes several requests of this size rather than one oversized body.\n     *\n     * Capped at 100 because the body is the sum of its events and collector endpoints commonly\n     * refuse a payload around a megabyte: a hundred CEF lines sits comfortably under that, where a\n     * thousand would not. Raising the cap is a decision about the receiver, not about this engine.\n     *\n     * At `1` the delivery path is byte-for-byte what it was before batching existed — the event is\n     * sent alone, framed as itself, and {@link batchWindowSeconds} is never consulted.\n     */\n    batchSize: z.number().int().min(1).max(100).default(1),\n    /**\n     * How long a partly-filled batch waits for company before it is sent anyway.\n     *\n     * ONLY consulted when {@link batchSize} is greater than 1 — at the default of 1 there is no\n     * batch to fill, so a lone event is never held. That is the pairing to know: this field cannot\n     * delay anything on a destination that has not opted into batching.\n     *\n     * It bounds how stale an exported security event may be, which is why the ceiling is a minute\n     * rather than the five that the retry backoff allows. A SOC's detection latency is the thing\n     * being spent here.\n     */\n    batchWindowSeconds: z.preprocess(\n      /*\n       * A stored value BELOW the floor is LEGACY, and is normalised to the default rather than\n       * refused. Measured 2026-09-21 on the dogfood application: 17 of 17 rows carry\n       * `batchWindowSeconds: 0`, and so do wonder-crm's and the platform's.\n       *\n       * They were written by the seed's `delivery: {}` under the PRE-`be001548` schema, whose\n       * default for this field was 0 — back when nothing read it. Re-adding the field in #1379 with\n       * a floor of 1 made every one of those rows unreadable: `transformOutput` re-validates stored\n       * data against the CURRENT schema, so every read of every organization's SIEM export config\n       * threw, which is `loadSiemExportConfig` — the per-organization audit routing lookup.\n       *\n       * **The floor cannot simply be widened to 0, and the reason is in the collector**: \"A window\n       * of 0 would make the flush job race the append's own transaction; the window is floored at 1\n       * second by the schema\". `.min(1)` is load-bearing, so 0 is not a value this contract may\n       * hold — which is exactly why coercing it is honest rather than lax. It cannot be WRITTEN\n       * either: a create or update carrying 0 still fails the inner schema, because preprocess only\n       * substitutes the value that reaches it and the floor below still judges everything else.\n       *\n       * Neither of the framework's two repair mechanisms can reach these rows, which is why the\n       * normalisation lives here. A seed version bump does not: `AFTER_CREATE` \"fires once and\n       * cannot reach backwards\", and the lazy backfill is \"first access creates the row, never\n       * re-applied\". A SQL data migration would cover the three PostgreSQL surfaces and leave every\n       * Mongo-backed application broken.\n       *\n       * Matched on EXACTLY 0, never `< 1`. The first version of this coercion took anything below\n       * the floor, and a probe immediately showed it accepting `-3` as 5 — a coercion that had\n       * quietly become permission, which is the shape this repository forbids under \"never present\n       * suppression as repair\". A negative, a fraction and anything above the ceiling are still\n       * refused outright; 0 alone is the value the old schema actually wrote.\n       *\n       * The residual, stated rather than hidden: read and write share this schema, so an operator\n       * who TYPES 0 gets 5 instead of a validation error. That is the cost of the trade, and it is\n       * the right way round against every read of every organization's export config throwing.\n       *\n       * Mapped to `undefined` rather than to a literal so `.default(5)` stays the single source of\n       * the value. Removable once no deployment can hold a pre-#1379 row.\n       */\n      (value) => (value === 0 ? undefined : value),\n      z.number().int().min(1).max(60).default(5),\n    ),\n    retryAttempts: z.number().min(0).max(5).default(3),\n    retryBackoffSeconds: z.number().min(1).max(300).default(30),\n    timeoutSeconds: z.number().min(1).max(60).default(10),\n  }),\n\n  customHeaders: z.record(z.string(), z.string()).optional(),\n\n  /**\n   * What this destination may RECEIVE — the per-destination half of the audit-export projection\n   * (#1380). The vocabulary, the floor and the resolution live in\n   * `compliance/audit-trails/audit-export-projection.shared.schemas`; this field is only where a\n   * tenant declares its own narrowing.\n   *\n   * **`.optional()` on purpose, and the absent case is FULL disclosure.** Two destinations on one\n   * tenant can hold different agreements, so the declaration belongs here rather than on the\n   * application — but every row that exists today has none, and reading an absent declaration as\n   * \"disclose nothing\" would silently strip live feeds down to the floor. An operator narrows\n   * deliberately; the framework does not narrow on their behalf. See `FULL_AUDIT_EXPORT_PROJECTION`\n   * for why that fail-OPEN is right in this one place.\n   *\n   * This is NOT the revival of `includeRawEventData` / `includeDeviceContext` below. Those were two\n   * booleans beside the retry policy that nothing read; this resolves against a contract that is\n   * total over the envelope AND total over the event vocabulary, is applied once at the ENQUEUE\n   * SEAM — before the event is signed and queued, so all four wire formats carry it identically and\n   * no producer can reach the queue around it — and cannot trim the floor.\n   */\n  exportProjection: SiemExportProjectionDeclarationSchema.optional(),\n\n  /*\n   * `includeRawEventData` and `includeDeviceContext` were REMOVED here, and neither was ever read.\n   *\n   * Both defaulted `true`, both rendered as switches on the SIEM pane with a description underneath,\n   * and the complete set of mentions was: this declaration, the display and edit templates, the\n   * specification, the customer documentation, the i18n labels — and FOUR test files, where each\n   * appears as a field of a config FIXTURE rather than as a behaviour under assertion. The envelope\n   * builders in `compliance/audit-trails` contain no `includeRaw`, no `rawEvent` and no\n   * `deviceContext` at all: what an exported event carries is decided by the projection contract,\n   * the same shape for every sink.\n   *\n   * They are worth naming apart from the other dead switches on these panes, because these two had\n   * `booleanUI({ showDescription: true })` — so an operator got a switch, a label AND a sentence\n   * explaining what it did, for a flag that did nothing. Being the best-presented control on the\n   * page is not evidence of being one.\n   *\n   * Removing them is not a loss of the capability they named. Choosing what an export carries is a\n   * real feature with a design — a projection the application declares — and it would be built on\n   * the envelope contract, not on two booleans beside the retry policy.\n   *\n   * Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n   */\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SiemExportConfigBase = z.infer<typeof SiemExportConfigBaseSchema>;\n\nexport const siemExportConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'siemExportConfig',\n  baseFieldIdentifier: 'siemExportConfigId',\n  baseEnumKey: 'SIEM_EXPORT_CONFIG',\n  baseSchema: SiemExportConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.d.ts

@@ -7,6 +7,7 @@
  */
 import { z } from 'zod';
 import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions';
+import { ResourceOperationVariantType } from '../../../resources/resources.shared.schemas';
 export declare enum SsoConfig_Operations {
     CLAIM_DOMAIN = "claimDomain",
     VERIFY_DOMAIN = "verifyDomain",
@@ -14,13 +15,13 @@ export declare enum SsoConfig_Operations {
 }
 export declare const SsoConfig_ClaimDomainRequestDto: z.ZodObject<{
     domain: z.ZodString;
-}, z.core.$strict>;
+}, z.core.$strip>;
 export declare const SsoConfig_VerifyDomainRequestDto: z.ZodObject<{
     domain: z.ZodString;
-}, z.core.$strict>;
+}, z.core.$strip>;
 export declare const SsoConfig_RevokeDomainRequestDto: z.ZodObject<{
     domain: z.ZodString;
-}, z.core.$strict>;
+}, z.core.$strip>;
 /**
  * The claim response is the ONLY disclosure of the challenge nonce.
  *
@@ -66,5 +67,30 @@ export declare const SsoConfig_RevokeDomainResponseDto: z.ZodObject<{
 export type SsoConfig_ClaimDomainResponse = z.infer<typeof SsoConfig_ClaimDomainResponseDto>;
 export type SsoConfig_VerifyDomainResponse = z.infer<typeof SsoConfig_VerifyDomainResponseDto>;
 export type SsoConfig_RevokeDomainResponse = z.infer<typeof SsoConfig_RevokeDomainResponseDto>;
+/**
+ * The variant type the SSO-config UPDATE runs on — the one named source read by this configuration and
+ * by the `socialCredentialOverrides` secret-preservation custom-impl registered on that write.
+ *
+ * A custom implementation is keyed by `(resource, operation, variantType)`, so the two restating the
+ * value by hand is the drift this removes: the dispatch silently stops finding the PREFIX, and every
+ * save wipes the per-override `clientSecret` and signedJwt ids. Same shape, and the same reason, as
+ * `SIEM_EXPORT_CONFIG_WRITE_VARIANT_TYPE` (#953).
+ *
+ * `UPDATE` is `API_CALL`: the administrator's edit door. It was `INTERNAL_CALL` — route-less — which
+ * made an SSO policy something only a backend service could change, and the comment there said only
+ * that no public surface had been BUILT, never that one would be wrong. Three public PUTs already
+ * mutate this row (`claimDomain` / `verifyDomain` / `revokeDomain`, #424) under the same roles, and
+ * SIEM export config — a scope-level security record holding sealed credentials — has carried this
+ * door since #953. Field-level protection is variant-agnostic: `.isWriteOnlySecret()` and
+ * `.isBackendOnly()` hold identically on either path.
+ *
+ * The route-less state was not merely a missing feature. `pickInlineFieldWriteOperation`'s pins record
+ * what it cost: with no addressable literal `update`, the frontend's update resolution fell through to
+ * whatever custom verb borrowed UPDATE semantics, so every writable field on the SSO settings pane
+ * rendered as a live control bound to `claimDomain`.
+ */
+export declare const SSO_CONFIG_WRITE_VARIANT_TYPE: Readonly<{
+    [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL;
+}>;
 export declare const ssoConfigPolymorphicFactories: Record<string, import("../../..").ResourceConfiguration_InitializationFactory<typeof SsoConfig_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
 //# sourceMappingURL=sso-config.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAsB/G,oBAAY,oBAAoB;IAC9B,YAAY,gBAAgB;IAC5B,aAAa,iBAAiB;IAC9B,aAAa,iBAAiB;CAC/B;AAiBD,eAAO,MAAM,+BAA+B;;kBAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;kBAE3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;kBAE3C,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;IAG3C,2EAA2E;;IAE3E,qDAAqD;;kBAErD,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;IAI5C;;;;OAIG;;kBAEH,CAAC;AAEH,eAAO,MAAM,iCAAiC;;IAE5C,iFAAiF;;kBAEjF,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC7F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC/F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAI/F,eAAO,MAAM,6BAA6B,wQAyOzC,CAAC"}
+{"version":3,"file":"sso-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EAEL,4BAA4B,EAC7B,MAAM,6CAA6C,CAAC;AAkBrD,oBAAY,oBAAoB;IAC9B,YAAY,gBAAgB;IAC5B,aAAa,iBAAiB;IAC9B,aAAa,iBAAiB;CAC/B;AAkCD,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;IAG3C,2EAA2E;;IAE3E,qDAAqD;;kBAErD,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;IAI5C;;;;OAIG;;kBAEH,CAAC;AAEH,eAAO,MAAM,iCAAiC;;IAE5C,iFAAiF;;kBAEjF,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC7F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC/F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,6BAA6B,EAAE,QAAQ,CAAC;IAGnD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,QAAQ,CAAC;CACvE,CAEA,CAAC;AAIF,eAAO,MAAM,6BAA6B,wQA0PzC,CAAC"}

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.js

@@ -42,13 +42,30 @@ const SsoConfig_DomainSelector = z.string()
     .min(4)
     .max(253)
     .regex(SSO_DOMAIN_PATTERN, 'Provide a DNS hostname with at least two labels, e.g. "customer.com".');
-export const SsoConfig_ClaimDomainRequestDto = z.strictObject({
+/*
+ * ── `z.object`, NOT `z.strictObject` — and that is a CONTRACT, not a relaxation ────────────────
+ *
+ * These three shipped as `strictObject` and every claim answered **400 `unrecognized_keys:
+ * ["domains"]`**, measured over HTTP on 2026-09-09. The framework MERGES a PREFIX hook's returned
+ * patch into the request payload and re-parses the result against THIS schema — so the `domains`
+ * block the planner just computed arrived at a schema that knows only `domain`, and a strict schema
+ * refuses what it does not recognise. A prefix that contributes a persisted field is therefore
+ * structurally incompatible with a strict request DTO; every sibling lifecycle verb in the engine
+ * (`organizations.requestDeletion`, `activate`, `restore`) uses `z.object` for exactly this reason.
+ *
+ * `z.object` STRIPS the unrecognised key instead of refusing it, which on its own would turn the
+ * 400 into the quieter defect — 200 having persisted nothing. What closes that half is
+ * `authoritativeFields: ['domains']` on each custom-implementation registration, which re-attaches
+ * the hook's value after the strip and makes a caller-supplied `domains` be overwritten rather than
+ * honoured. The two halves are one decision; neither works alone.
+ */
+export const SsoConfig_ClaimDomainRequestDto = z.object({
     domain: SsoConfig_DomainSelector,
 });
-export const SsoConfig_VerifyDomainRequestDto = z.strictObject({
+export const SsoConfig_VerifyDomainRequestDto = z.object({
     domain: SsoConfig_DomainSelector,
 });
-export const SsoConfig_RevokeDomainRequestDto = z.strictObject({
+export const SsoConfig_RevokeDomainRequestDto = z.object({
     domain: SsoConfig_DomainSelector,
 });
 /**
@@ -83,6 +100,31 @@ export const SsoConfig_RevokeDomainResponseDto = z.strictObject({
     /** True once the domain holds no claim, no status and no nonce in this scope. */
     revoked: z.boolean(),
 });
+/**
+ * The variant type the SSO-config UPDATE runs on — the one named source read by this configuration and
+ * by the `socialCredentialOverrides` secret-preservation custom-impl registered on that write.
+ *
+ * A custom implementation is keyed by `(resource, operation, variantType)`, so the two restating the
+ * value by hand is the drift this removes: the dispatch silently stops finding the PREFIX, and every
+ * save wipes the per-override `clientSecret` and signedJwt ids. Same shape, and the same reason, as
+ * `SIEM_EXPORT_CONFIG_WRITE_VARIANT_TYPE` (#953).
+ *
+ * `UPDATE` is `API_CALL`: the administrator's edit door. It was `INTERNAL_CALL` — route-less — which
+ * made an SSO policy something only a backend service could change, and the comment there said only
+ * that no public surface had been BUILT, never that one would be wrong. Three public PUTs already
+ * mutate this row (`claimDomain` / `verifyDomain` / `revokeDomain`, #424) under the same roles, and
+ * SIEM export config — a scope-level security record holding sealed credentials — has carried this
+ * door since #953. Field-level protection is variant-agnostic: `.isWriteOnlySecret()` and
+ * `.isBackendOnly()` hold identically on either path.
+ *
+ * The route-less state was not merely a missing feature. `pickInlineFieldWriteOperation`'s pins record
+ * what it cost: with no addressable literal `update`, the frontend's update resolution fell through to
+ * whatever custom verb borrowed UPDATE semantics, so every writable field on the SSO settings pane
+ * rendered as a live control bound to `claimDomain`.
+ */
+export const SSO_CONFIG_WRITE_VARIANT_TYPE = {
+    [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL,
+};
 // ── Polymorphic Factory ──────────────────────────────────────────────
 export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurations(ssoConfigPolymorphicDeclaration, {
     isSystemResource: true,
@@ -155,7 +197,20 @@ export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurat
         // REPOSITORY_ONLY. There is deliberately no API_CALL variant — one tenant enumerating every
         // other tenant's SSO policy is the opposite of what this resource is for, and the probe that
         // needs the enumeration answers a single yes/no question and returns no row to a caller.
-        // Admin tier / HIGH.
+        //
+        // Admin tier / MEDIUM — and MEDIUM rather than HIGH is a correction, not a downgrade. This
+        // shipped at HIGH and was the FIRST read-shaped HIGH operation in the catalogue, which broke
+        // the measurement `resource-operation-audit-emission.backend.test.ts` calls "the one the whole
+        // design rests on": `RESOURCE_OPERATION_PERFORMED` is deliberately not emitted for a read, and
+        // `FIELD_ACCESS` fires only on a disclosed marked field — so a read declared inside
+        // `AUTOMATIC_AUDIT_RISK_FLOOR` promises evidence that CANNOT exist on either axis, and the
+        // most dangerous read in the catalogue would be the one leaving no trace.
+        //
+        // The crossing is nonetheless recorded, on the axis that can carry it: the probe reaches this
+        // verb through `SystemAccessService.listAsSystem`, which emits its own `SYSTEM_CONTEXT_*`
+        // event — that is precisely why the comment on `systemAccessPolicy.list` above refuses the
+        // repository shortcut. So the declaration moves to where the evidence actually is instead of
+        // claiming a row nothing writes.
         [CoreResourceOperation.LIST]: {
             variants: [{
                     variantType: ResourceOperationVariantType.INTERNAL_CALL,
@@ -164,34 +219,38 @@ export const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurat
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
-                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
                 }],
         },
-        // Internal-only (INTERNAL_CALL, NO HTTP route): admin policy edits reach this
-        // through the config service path — `AuthOrganizationConfigurationService.saveSSOConfig`
-        // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC,
-        // preserving admin audit attribution. The comment here used to say the path was
-        // "correct-but-dormant" because `DomainVerificationBackendService` had no public operation
-        // wired to it, and warned against "simplifying" the variant on the theory that nothing calls
-        // it. That warning was right and is now moot: the domain workflow it was holding the door
-        // open for exists (`claimDomain` / `verifyDomain` / `revokeDomain` below), and
-        // `initiateDomainVerification` / `verifyDomainOwnership` still reach this INTERNAL_CALL path
-        // for callers that hold no operation.
+        // The administrator's edit door, and the only write path for this policy row. Two kinds of
+        // caller reach it and both resolve the SAME default: an admin editing the settings pane, over
+        // the HTTP route this variant now carries; and a backend caller holding no operation —
+        // `AuthOrganizationConfigurationService.saveSSOConfig`, `initiateDomainVerification`,
+        // `verifyDomainOwnership` — dispatching via `ServicesRegistryHandler.update` with the ADMIN's
+        // EC, preserving admin audit attribution. `getServiceOperationPathDefault` honours API_CALL
+        // exactly as it honoured INTERNAL_CALL, so nothing on the service path changes.
+        //
+        // It WAS `INTERNAL_CALL` — route-less — and the comment here recorded only that no public
+        // surface had been built, never an argument that one would be wrong. See
+        // `SSO_CONFIG_WRITE_VARIANT_TYPE` for why it moved, and for what the missing route cost the
+        // settings pane. An earlier note warned against "simplifying" the variant on the theory that
+        // nothing called it; that warning was right and is moot — the domain workflow it was holding
+        // the door open for exists (`claimDomain` / `verifyDomain` / `revokeDomain` below).
         // Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via
         // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT
         // REPOSITORY_ONLY — a repository-only UPDATE throws
         // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) on any admin
         // domain edit (and, post lazy-create fix, `loadSSOConfig` always materialises a row,
-        // so `saveSSOConfig` reliably hits THIS update branch). No public HTTP update surface
-        // (future supported edits flow through this internal service path). The
-        // `socialCredentialOverrides` write-only-secret-preservation custom-impl
-        // (`createSsoConfigUpdateFactories`) is keyed on this variant and MOVES IN LOCKSTEP —
-        // the custom-impl dispatch key encodes variantType, so a REPOSITORY_ONLY drift on
-        // either side silently drops the PREFIX and wipes per-override secrets on every save.
+        // so `saveSSOConfig` reliably hits THIS update branch). The variant type is read from
+        // `SSO_CONFIG_WRITE_VARIANT_TYPE`, which the `socialCredentialOverrides`
+        // write-only-secret-preservation custom-impl (`createSsoConfigUpdateFactories`) reads too, so
+        // they move together — the custom-impl dispatch key encodes variantType, and a drift on either
+        // side silently drops the PREFIX and wipes per-override secrets on every save. Hard-code a
+        // variant type here instead and that lockstep is a comment again.
         // Same fix as the CREATE above + the SCIM-tokens READ/UPDATE. Admin tier / HIGH.
         [CoreResourceOperation.UPDATE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    variantType: SSO_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.UPDATE],
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAExG,wEAAwE;AACxE,EAAE;AACF,4FAA4F;AAC5F,kGAAkG;AAClG,8FAA8F;AAC9F,EAAE;AACF,mGAAmG;AACnG,qFAAqF;AACrF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAElE,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,oDAA4B,CAAA;IAC5B,sDAA8B,CAAA;IAC9B,sDAA8B,CAAA;AAChC,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,mEAAmE,CAAC;AAE/F,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,EAAE;KACxC,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,kBAAkB,EAAE,uEAAuE,CAAC,CAAC;AAEtG,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,2EAA2E;IAC3E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,qDAAqD;IACrD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,iFAAiF;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAMH,wEAAwE;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAAG,uCAAuC,CAClF,+BAA+B,EAC/B;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,oBAAoB;IACrC,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,oEAAoE;IACpE,2EAA2E;IAC3E,gFAAgF;IAChF,8EAA8E;IAC9E,iBAAiB;IACjB,EAAE;IACF,+FAA+F;IAC/F,0FAA0F;IAC1F,4FAA4F;IAC5F,8FAA8F;IAC9F,cAAc;IACd,6FAA6F;IAC7F,8FAA8F;IAC9F,sFAAsF;IACtF,uFAAuF;IACvF,wFAAwF;IACxF,sFAAsF;IACtF,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IAClK,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yFAAyF;QACzF,sEAAsE;QACtE,6FAA6F;QAC7F,4EAA4E;QAC5E,uFAAuF;QACvF,4FAA4F;QAC5F,6FAA6F;QAC7F,yFAAyF;QACzF,qBAAqB;QACrB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,8EAA8E;QAC9E,yFAAyF;QACzF,iFAAiF;QACjF,gFAAgF;QAChF,2FAA2F;QAC3F,6FAA6F;QAC7F,0FAA0F;QAC1F,+EAA+E;QAC/E,6FAA6F;QAC7F,sCAAsC;QACtC,+DAA+D;QAC/D,mFAAmF;QACnF,oDAAoD;QACpD,mFAAmF;QACnF,qFAAqF;QACrF,sFAAsF;QACtF,wEAAwE;QACxE,yEAAyE;QACzE,sFAAsF;QACtF,kFAAkF;QAClF,sFAAsF;QACtF,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,6EAA6E;QAC7E,qEAAqE;QACrE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2CG;QACH,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,0FAA0F;oBAC1F,uFAAuF;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,+BAA+B;oBAC3C,iBAAiB,EAAE,gCAAgC;iBACpD,CAAC;SACH;QAED,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,sFAAsF;oBACtF,wFAAwF;oBACxF,oBAAoB;oBACpB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;QAED,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,0FAA0F;oBAC1F,gFAAgF;oBAChF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SSO Config Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...ssoConfigPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { DomainVerificationStatus, ssoConfigPolymorphicDeclaration } from './sso-config.shared.schemas';\n\n// ── Domain-ownership operations ──────────────────────────────────────\n//\n// Enterprise domain routing sends every `@customer.com` sign-in to that customer's identity\n// provider. Reaching the VERIFIED state used to require an out-of-band database write, which made\n// enterprise onboarding a support ticket forever (#424). These three operations are the door.\n//\n// They are entity-level operations on a resource that is a ONE-to-ONE COMPOSITION under its scope,\n// so the URL builder omits the id segment and the scope in the path selects the row:\n//   PUT /organizations/{organizationId}/sso-configs/claim-domain\n//   PUT /organizations/{organizationId}/sso-configs/verify-domain\n//   PUT /organizations/{organizationId}/sso-configs/revoke-domain\n\nexport enum SsoConfig_Operations {\n  CLAIM_DOMAIN = 'claimDomain',\n  VERIFY_DOMAIN = 'verifyDomain',\n  REVOKE_DOMAIN = 'revokeDomain',\n}\n\n/**\n * A DNS hostname, syntactically. Two labels minimum — a single label is not a domain anyone can\n * publish a TXT record under, and accepting one would mint a challenge that can never be answered.\n *\n * Case is NOT normalised here. The backend lowercases before every read and every write, because\n * that is where the stored map keys are decided; doing it in two places would make the request\n * contract look like the authority when it is not.\n */\nconst SSO_DOMAIN_PATTERN = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))+$/;\n\nconst SsoConfig_DomainSelector = z.string()\n  .min(4)\n  .max(253)\n  .regex(SSO_DOMAIN_PATTERN, 'Provide a DNS hostname with at least two labels, e.g. \"customer.com\".');\n\nexport const SsoConfig_ClaimDomainRequestDto = z.strictObject({\n  domain: SsoConfig_DomainSelector,\n});\n\nexport const SsoConfig_VerifyDomainRequestDto = z.strictObject({\n  domain: SsoConfig_DomainSelector,\n});\n\nexport const SsoConfig_RevokeDomainRequestDto = z.strictObject({\n  domain: SsoConfig_DomainSelector,\n});\n\n/**\n * The claim response is the ONLY disclosure of the challenge nonce.\n *\n * `domainVerificationTokens` is `.isBackendOnly()`, so no READ of the config ever returns it — an\n * operator who loses this response claims again, which mints a new nonce and invalidates the old\n * one. `.isEphemeral()` marks `dnsRecordValue` as a revealed-once secret, the same contract the\n * SCIM token mint uses for its one-time plaintext.\n */\nexport const SsoConfig_ClaimDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  status: z.enum(DomainVerificationStatus),\n  /** The DNS name the TXT record goes on: `_wildo-verification.<domain>`. */\n  dnsName: z.string(),\n  /** The exact TXT value to publish. Revealed once. */\n  dnsRecordValue: z.string().isEphemeral(),\n});\n\nexport const SsoConfig_VerifyDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  status: z.enum(DomainVerificationStatus),\n  dnsName: z.string(),\n  /**\n   * Every TXT record found at `dnsName`, so a failed check is diagnosable without a second tool.\n   * These are public DNS records of a domain the caller is claiming to own — echoing them discloses\n   * nothing the caller could not resolve themselves.\n   */\n  dnsRecordsFound: z.array(z.string()),\n});\n\nexport const SsoConfig_RevokeDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  /** True once the domain holds no claim, no status and no nonce in this scope. */\n  revoked: z.boolean(),\n});\n\nexport type SsoConfig_ClaimDomainResponse = z.infer<typeof SsoConfig_ClaimDomainResponseDto>;\nexport type SsoConfig_VerifyDomainResponse = z.infer<typeof SsoConfig_VerifyDomainResponseDto>;\nexport type SsoConfig_RevokeDomainResponse = z.infer<typeof SsoConfig_RevokeDomainResponseDto>;\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n  ssoConfigPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: SsoConfig_Operations,\n    // The auth runtime loads the org SSO config via `readAsSystem` during login,\n    // before the user's roles/membership are established (READ). When the row is\n    // absent — a provisioned / migrated / pre-seed org that bypassed the\n    // `afterCreate` default-seed — that same userless login path lazily\n    // materialises the disabled-default row via `createAsSystem` (CREATE); see\n    // `AuthOrganizationConfigurationService.loadSSOConfig`. Both are system-context\n    // (the logging-in user is not the config's admin owner), so the resource opts\n    // BOTH verbs in.\n    //\n    // `list` is the DOMAIN-EXCLUSIVITY probe and nothing else (#424). At most one scope may hold a\n    // domain VERIFIED, or a `@customer.com` sign-in routes non-deterministically to whichever\n    // config the lookup happens to reach first. Answering \"does another scope already hold this\n    // domain\" is unavoidably a cross-scope read, and the two candidates that avoid this grant are\n    // both worse:\n    //   - `AuthOrganizationConfigurationService.getAllOrganizationIds()` enumerates an IN-MEMORY\n    //     CACHE of scopes whose config has been loaded, so it under-reports on a cold process. An\n    //     exclusivity check built on it answers \"nobody else holds it\" from an incomplete\n    //     population — the negative-result failure that produces a confident wrong answer;\n    //   - reaching the repository directly bypasses the `systemAccessPolicy` opt-in AND the\n    //     `SYSTEM_CONTEXT_*` audit event, which is a bigger grant wearing a smaller name.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n      // materialised by the framework default-seed (repository tier) OR — when that\n      // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n      // userless login path via `createAsSystem` (`systemAccessPolicy.create` opts\n      // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n      // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n      // self-alerting on mere construction) on every login for a config-less org.\n      // No public HTTP create surface (config is seeded/bootstrapped, never\n      // self-serve). Same fix as the SCIM-tokens READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the ONE caller is the domain-exclusivity\n      // probe described on `systemAccessPolicy.list` above, reached through\n      // `SystemAccessService.listAsSystem`. It must NOT be REPOSITORY_ONLY for the same reason the\n      // CREATE and UPDATE below are not: `listAsSystem` resolves the verb through\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL and rejects\n      // REPOSITORY_ONLY. There is deliberately no API_CALL variant — one tenant enumerating every\n      // other tenant's SSO policy is the opposite of what this resource is for, and the probe that\n      // needs the enumeration answers a single yes/no question and returns no row to a caller.\n      // Admin tier / HIGH.\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): admin policy edits reach this\n      // through the config service path — `AuthOrganizationConfigurationService.saveSSOConfig`\n      // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC,\n      // preserving admin audit attribution. The comment here used to say the path was\n      // \"correct-but-dormant\" because `DomainVerificationBackendService` had no public operation\n      // wired to it, and warned against \"simplifying\" the variant on the theory that nothing calls\n      // it. That warning was right and is now moot: the domain workflow it was holding the door\n      // open for exists (`claimDomain` / `verifyDomain` / `revokeDomain` below), and\n      // `initiateDomainVerification` / `verifyDomainOwnership` still reach this INTERNAL_CALL path\n      // for callers that hold no operation.\n      // Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT\n      // REPOSITORY_ONLY — a repository-only UPDATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) on any admin\n      // domain edit (and, post lazy-create fix, `loadSSOConfig` always materialises a row,\n      // so `saveSSOConfig` reliably hits THIS update branch). No public HTTP update surface\n      // (future supported edits flow through this internal service path). The\n      // `socialCredentialOverrides` write-only-secret-preservation custom-impl\n      // (`createSsoConfigUpdateFactories`) is keyed on this variant and MOVES IN LOCKSTEP —\n      // the custom-impl dispatch key encodes variantType, so a REPOSITORY_ONLY drift on\n      // either side silently drops the PREFIX and wipes per-override secrets on every save.\n      // Same fix as the CREATE above + the SCIM-tokens READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n      // onParentDelete cascade so this one-per-scope SSO-config row is physically\n      // removed when its owning org/app is deleted. Without a DELETE op the cascade\n      // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a\n      // config row. This deletes the whole row; domain mutation is not currently a\n      // public operation. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n\n      /*\n       * ─── The three domain-ownership doors (#424) ────────────────────────────────────────────\n       *\n       * ## Why the tenant's own admin, and NOT a platform operator\n       *\n       * None of the three declares `admitsCrossTenantPlatformAdministration`, and that is a\n       * decision rather than an omission. A platform operator crossing into a tenant is justified\n       * when the tenant CANNOT act for itself — `organizationMembers.grantOwnership` repairs a\n       * tenant with no owner. Domain ownership is the opposite shape: the party who must prove it\n       * is the party who controls the DNS, and the operator controls neither the DNS nor the\n       * business relationship. A crossing here would let a platform administrator hand one tenant\n       * routing control over every sign-in at a domain, with the tenant's own admins unable to see\n       * why. The ambient reach `.claude/rules/administrative-continuity-floors.md` forbids is\n       * exactly this.\n       *\n       * ## Why each is UPDATE-like\n       *\n       * All three mutate `domains` on the scope's single config row, so they borrow UPDATE and get\n       * a PUT that carries a body. The domain travels in the BODY, never in the URL: a domain name\n       * is a customer identity, and a GET would write it into every access log between the operator\n       * and the server.\n       *\n       * ## Where the work happens\n       *\n       * Each is implemented as a PREFIX that returns the new `domains` object, which the core\n       * UPDATE persists — the organization-units MOVE/ARCHIVE shape. Deliberately NOT `OVERRIDE_ALL`:\n       * that mode returns before the framework's post-operation lane and would therefore emit NO\n       * `RESOURCE_OPERATION_PERFORMED` audit event, which is the one control that makes a\n       * privileged configuration change with cross-tenant reach accountable. See\n       * `sso-config-domain-verification.custom-impl.backend.service.ts`.\n       *\n       * ## What the trail carries\n       *\n       * All three sit at or above `AUTOMATIC_AUDIT_RISK_FLOOR`, so no `auditableEvent` declaration\n       * is needed. `domains.verifiedDomains`, `domains.ssoEnabledDomains` and\n       * `domains.domainVerificationStatus` are `.isAuditEvidence()`, so the row carries the\n       * before/after of the claimed set and the status map — i.e. WHICH domain moved, and to what.\n       * `domains.domainVerificationTokens` is not marked and must never be: it is the challenge\n       * nonce, and the ledger it would land in cannot be scrubbed.\n       *\n       * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a verified domain decides which\n       * identity provider authenticates every principal at that domain.\n       * assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — the domain-ownership trail.\n       */\n      [SsoConfig_Operations.CLAIM_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // HIGH, not CRITICAL: a claim grants NOTHING. It records `pending` and mints a nonce, and\n          // every routing reader gates on `verified`. The step that confers authority is VERIFY.\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_ClaimDomainRequestDto,\n          customResponseDto: SsoConfig_ClaimDomainResponseDto,\n        }],\n      },\n\n      [SsoConfig_Operations.VERIFY_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // CRITICAL: this is the transition that hands a tenant SSO routing control over EVERY\n          // person who signs in with an address at the domain — including people who are not that\n          // tenant's members.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_VerifyDomainRequestDto,\n          customResponseDto: SsoConfig_VerifyDomainResponseDto,\n        }],\n      },\n\n      [SsoConfig_Operations.REVOKE_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // CRITICAL for the same reason as VERIFY, from the other side: revocation is what makes a\n          // domain claimable by a different scope, so it is the hinge of every hand-over.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_RevokeDomainRequestDto,\n          customResponseDto: SsoConfig_RevokeDomainResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"sso-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAExG,wEAAwE;AACxE,EAAE;AACF,4FAA4F;AAC5F,kGAAkG;AAClG,8FAA8F;AAC9F,EAAE;AACF,mGAAmG;AACnG,qFAAqF;AACrF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAElE,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,oDAA4B,CAAA;IAC5B,sDAA8B,CAAA;IAC9B,sDAA8B,CAAA;AAChC,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,mEAAmE,CAAC;AAE/F,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,EAAE;KACxC,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,kBAAkB,EAAE,uEAAuE,CAAC,CAAC;AAEtG;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE,wBAAwB;CACjC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,2EAA2E;IAC3E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,qDAAqD;IACrD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,iFAAiF;IACjF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAMH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAIrC;IACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,QAAQ;CACtE,CAAC;AAEF,wEAAwE;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAAG,uCAAuC,CAClF,+BAA+B,EAC/B;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,oBAAoB;IACrC,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,oEAAoE;IACpE,2EAA2E;IAC3E,gFAAgF;IAChF,8EAA8E;IAC9E,iBAAiB;IACjB,EAAE;IACF,+FAA+F;IAC/F,0FAA0F;IAC1F,4FAA4F;IAC5F,8FAA8F;IAC9F,cAAc;IACd,6FAA6F;IAC7F,8FAA8F;IAC9F,sFAAsF;IACtF,uFAAuF;IACvF,wFAAwF;IACxF,sFAAsF;IACtF,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IAClK,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yFAAyF;QACzF,sEAAsE;QACtE,6FAA6F;QAC7F,4EAA4E;QAC5E,uFAAuF;QACvF,4FAA4F;QAC5F,6FAA6F;QAC7F,yFAAyF;QACzF,EAAE;QACF,2FAA2F;QAC3F,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,oFAAoF;QACpF,2FAA2F;QAC3F,0EAA0E;QAC1E,EAAE;QACF,8FAA8F;QAC9F,0FAA0F;QAC1F,2FAA2F;QAC3F,6FAA6F;QAC7F,iCAAiC;QACjC,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,2FAA2F;QAC3F,8FAA8F;QAC9F,uFAAuF;QACvF,sFAAsF;QACtF,8FAA8F;QAC9F,4FAA4F;QAC5F,gFAAgF;QAChF,EAAE;QACF,0FAA0F;QAC1F,yEAAyE;QACzE,4FAA4F;QAC5F,6FAA6F;QAC7F,6FAA6F;QAC7F,oFAAoF;QACpF,+DAA+D;QAC/D,mFAAmF;QACnF,oDAAoD;QACpD,mFAAmF;QACnF,qFAAqF;QACrF,sFAAsF;QACtF,yEAAyE;QACzE,8FAA8F;QAC9F,+FAA+F;QAC/F,2FAA2F;QAC3F,kEAAkE;QAClE,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,6BAA6B,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBACxE,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,6EAA6E;QAC7E,qEAAqE;QACrE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2CG;QACH,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,0FAA0F;oBAC1F,uFAAuF;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,+BAA+B;oBAC3C,iBAAiB,EAAE,gCAAgC;iBACpD,CAAC;SACH;QAED,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,sFAAsF;oBACtF,wFAAwF;oBACxF,oBAAoB;oBACpB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;QAED,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,0FAA0F;oBAC1F,gFAAgF;oBAChF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SSO Config Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...ssoConfigPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { DomainVerificationStatus, ssoConfigPolymorphicDeclaration } from './sso-config.shared.schemas';\n\n// ── Domain-ownership operations ──────────────────────────────────────\n//\n// Enterprise domain routing sends every `@customer.com` sign-in to that customer's identity\n// provider. Reaching the VERIFIED state used to require an out-of-band database write, which made\n// enterprise onboarding a support ticket forever (#424). These three operations are the door.\n//\n// They are entity-level operations on a resource that is a ONE-to-ONE COMPOSITION under its scope,\n// so the URL builder omits the id segment and the scope in the path selects the row:\n//   PUT /organizations/{organizationId}/sso-configs/claim-domain\n//   PUT /organizations/{organizationId}/sso-configs/verify-domain\n//   PUT /organizations/{organizationId}/sso-configs/revoke-domain\n\nexport enum SsoConfig_Operations {\n  CLAIM_DOMAIN = 'claimDomain',\n  VERIFY_DOMAIN = 'verifyDomain',\n  REVOKE_DOMAIN = 'revokeDomain',\n}\n\n/**\n * A DNS hostname, syntactically. Two labels minimum — a single label is not a domain anyone can\n * publish a TXT record under, and accepting one would mint a challenge that can never be answered.\n *\n * Case is NOT normalised here. The backend lowercases before every read and every write, because\n * that is where the stored map keys are decided; doing it in two places would make the request\n * contract look like the authority when it is not.\n */\nconst SSO_DOMAIN_PATTERN = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))+$/;\n\nconst SsoConfig_DomainSelector = z.string()\n  .min(4)\n  .max(253)\n  .regex(SSO_DOMAIN_PATTERN, 'Provide a DNS hostname with at least two labels, e.g. \"customer.com\".');\n\n/*\n * ── `z.object`, NOT `z.strictObject` — and that is a CONTRACT, not a relaxation ────────────────\n *\n * These three shipped as `strictObject` and every claim answered **400 `unrecognized_keys:\n * [\"domains\"]`**, measured over HTTP on 2026-09-09. The framework MERGES a PREFIX hook's returned\n * patch into the request payload and re-parses the result against THIS schema — so the `domains`\n * block the planner just computed arrived at a schema that knows only `domain`, and a strict schema\n * refuses what it does not recognise. A prefix that contributes a persisted field is therefore\n * structurally incompatible with a strict request DTO; every sibling lifecycle verb in the engine\n * (`organizations.requestDeletion`, `activate`, `restore`) uses `z.object` for exactly this reason.\n *\n * `z.object` STRIPS the unrecognised key instead of refusing it, which on its own would turn the\n * 400 into the quieter defect — 200 having persisted nothing. What closes that half is\n * `authoritativeFields: ['domains']` on each custom-implementation registration, which re-attaches\n * the hook's value after the strip and makes a caller-supplied `domains` be overwritten rather than\n * honoured. The two halves are one decision; neither works alone.\n */\nexport const SsoConfig_ClaimDomainRequestDto = z.object({\n  domain: SsoConfig_DomainSelector,\n});\n\nexport const SsoConfig_VerifyDomainRequestDto = z.object({\n  domain: SsoConfig_DomainSelector,\n});\n\nexport const SsoConfig_RevokeDomainRequestDto = z.object({\n  domain: SsoConfig_DomainSelector,\n});\n\n/**\n * The claim response is the ONLY disclosure of the challenge nonce.\n *\n * `domainVerificationTokens` is `.isBackendOnly()`, so no READ of the config ever returns it — an\n * operator who loses this response claims again, which mints a new nonce and invalidates the old\n * one. `.isEphemeral()` marks `dnsRecordValue` as a revealed-once secret, the same contract the\n * SCIM token mint uses for its one-time plaintext.\n */\nexport const SsoConfig_ClaimDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  status: z.enum(DomainVerificationStatus),\n  /** The DNS name the TXT record goes on: `_wildo-verification.<domain>`. */\n  dnsName: z.string(),\n  /** The exact TXT value to publish. Revealed once. */\n  dnsRecordValue: z.string().isEphemeral(),\n});\n\nexport const SsoConfig_VerifyDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  status: z.enum(DomainVerificationStatus),\n  dnsName: z.string(),\n  /**\n   * Every TXT record found at `dnsName`, so a failed check is diagnosable without a second tool.\n   * These are public DNS records of a domain the caller is claiming to own — echoing them discloses\n   * nothing the caller could not resolve themselves.\n   */\n  dnsRecordsFound: z.array(z.string()),\n});\n\nexport const SsoConfig_RevokeDomainResponseDto = z.strictObject({\n  domain: z.string(),\n  /** True once the domain holds no claim, no status and no nonce in this scope. */\n  revoked: z.boolean(),\n});\n\nexport type SsoConfig_ClaimDomainResponse = z.infer<typeof SsoConfig_ClaimDomainResponseDto>;\nexport type SsoConfig_VerifyDomainResponse = z.infer<typeof SsoConfig_VerifyDomainResponseDto>;\nexport type SsoConfig_RevokeDomainResponse = z.infer<typeof SsoConfig_RevokeDomainResponseDto>;\n\n/**\n * The variant type the SSO-config UPDATE runs on — the one named source read by this configuration and\n * by the `socialCredentialOverrides` secret-preservation custom-impl registered on that write.\n *\n * A custom implementation is keyed by `(resource, operation, variantType)`, so the two restating the\n * value by hand is the drift this removes: the dispatch silently stops finding the PREFIX, and every\n * save wipes the per-override `clientSecret` and signedJwt ids. Same shape, and the same reason, as\n * `SIEM_EXPORT_CONFIG_WRITE_VARIANT_TYPE` (#953).\n *\n * `UPDATE` is `API_CALL`: the administrator's edit door. It was `INTERNAL_CALL` — route-less — which\n * made an SSO policy something only a backend service could change, and the comment there said only\n * that no public surface had been BUILT, never that one would be wrong. Three public PUTs already\n * mutate this row (`claimDomain` / `verifyDomain` / `revokeDomain`, #424) under the same roles, and\n * SIEM export config — a scope-level security record holding sealed credentials — has carried this\n * door since #953. Field-level protection is variant-agnostic: `.isWriteOnlySecret()` and\n * `.isBackendOnly()` hold identically on either path.\n *\n * The route-less state was not merely a missing feature. `pickInlineFieldWriteOperation`'s pins record\n * what it cost: with no addressable literal `update`, the frontend's update resolution fell through to\n * whatever custom verb borrowed UPDATE semantics, so every writable field on the SSO settings pane\n * rendered as a live control bound to `claimDomain`.\n */\nexport const SSO_CONFIG_WRITE_VARIANT_TYPE: Readonly<{\n  // Exact members, not the enum: a variant is a union DISCRIMINATED by `variantType`, so a value typed\n  // as the whole enum matches no member of it.\n  [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL;\n}> = {\n  [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL,\n};\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n  ssoConfigPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: SsoConfig_Operations,\n    // The auth runtime loads the org SSO config via `readAsSystem` during login,\n    // before the user's roles/membership are established (READ). When the row is\n    // absent — a provisioned / migrated / pre-seed org that bypassed the\n    // `afterCreate` default-seed — that same userless login path lazily\n    // materialises the disabled-default row via `createAsSystem` (CREATE); see\n    // `AuthOrganizationConfigurationService.loadSSOConfig`. Both are system-context\n    // (the logging-in user is not the config's admin owner), so the resource opts\n    // BOTH verbs in.\n    //\n    // `list` is the DOMAIN-EXCLUSIVITY probe and nothing else (#424). At most one scope may hold a\n    // domain VERIFIED, or a `@customer.com` sign-in routes non-deterministically to whichever\n    // config the lookup happens to reach first. Answering \"does another scope already hold this\n    // domain\" is unavoidably a cross-scope read, and the two candidates that avoid this grant are\n    // both worse:\n    //   - `AuthOrganizationConfigurationService.getAllOrganizationIds()` enumerates an IN-MEMORY\n    //     CACHE of scopes whose config has been loaded, so it under-reports on a cold process. An\n    //     exclusivity check built on it answers \"nobody else holds it\" from an incomplete\n    //     population — the negative-result failure that produces a confident wrong answer;\n    //   - reaching the repository directly bypasses the `systemAccessPolicy` opt-in AND the\n    //     `SYSTEM_CONTEXT_*` audit event, which is a bigger grant wearing a smaller name.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.LIST, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n      // materialised by the framework default-seed (repository tier) OR — when that\n      // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n      // userless login path via `createAsSystem` (`systemAccessPolicy.create` opts\n      // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n      // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n      // self-alerting on mere construction) on every login for a config-less org.\n      // No public HTTP create surface (config is seeded/bootstrapped, never\n      // self-serve). Same fix as the SCIM-tokens READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the ONE caller is the domain-exclusivity\n      // probe described on `systemAccessPolicy.list` above, reached through\n      // `SystemAccessService.listAsSystem`. It must NOT be REPOSITORY_ONLY for the same reason the\n      // CREATE and UPDATE below are not: `listAsSystem` resolves the verb through\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL and rejects\n      // REPOSITORY_ONLY. There is deliberately no API_CALL variant — one tenant enumerating every\n      // other tenant's SSO policy is the opposite of what this resource is for, and the probe that\n      // needs the enumeration answers a single yes/no question and returns no row to a caller.\n      //\n      // Admin tier / MEDIUM — and MEDIUM rather than HIGH is a correction, not a downgrade. This\n      // shipped at HIGH and was the FIRST read-shaped HIGH operation in the catalogue, which broke\n      // the measurement `resource-operation-audit-emission.backend.test.ts` calls \"the one the whole\n      // design rests on\": `RESOURCE_OPERATION_PERFORMED` is deliberately not emitted for a read, and\n      // `FIELD_ACCESS` fires only on a disclosed marked field — so a read declared inside\n      // `AUTOMATIC_AUDIT_RISK_FLOOR` promises evidence that CANNOT exist on either axis, and the\n      // most dangerous read in the catalogue would be the one leaving no trace.\n      //\n      // The crossing is nonetheless recorded, on the axis that can carry it: the probe reaches this\n      // verb through `SystemAccessService.listAsSystem`, which emits its own `SYSTEM_CONTEXT_*`\n      // event — that is precisely why the comment on `systemAccessPolicy.list` above refuses the\n      // repository shortcut. So the declaration moves to where the evidence actually is instead of\n      // claiming a row nothing writes.\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      // The administrator's edit door, and the only write path for this policy row. Two kinds of\n      // caller reach it and both resolve the SAME default: an admin editing the settings pane, over\n      // the HTTP route this variant now carries; and a backend caller holding no operation —\n      // `AuthOrganizationConfigurationService.saveSSOConfig`, `initiateDomainVerification`,\n      // `verifyDomainOwnership` — dispatching via `ServicesRegistryHandler.update` with the ADMIN's\n      // EC, preserving admin audit attribution. `getServiceOperationPathDefault` honours API_CALL\n      // exactly as it honoured INTERNAL_CALL, so nothing on the service path changes.\n      //\n      // It WAS `INTERNAL_CALL` — route-less — and the comment here recorded only that no public\n      // surface had been built, never an argument that one would be wrong. See\n      // `SSO_CONFIG_WRITE_VARIANT_TYPE` for why it moved, and for what the missing route cost the\n      // settings pane. An earlier note warned against \"simplifying\" the variant on the theory that\n      // nothing called it; that warning was right and is moot — the domain workflow it was holding\n      // the door open for exists (`claimDomain` / `verifyDomain` / `revokeDomain` below).\n      // Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT\n      // REPOSITORY_ONLY — a repository-only UPDATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) on any admin\n      // domain edit (and, post lazy-create fix, `loadSSOConfig` always materialises a row,\n      // so `saveSSOConfig` reliably hits THIS update branch). The variant type is read from\n      // `SSO_CONFIG_WRITE_VARIANT_TYPE`, which the `socialCredentialOverrides`\n      // write-only-secret-preservation custom-impl (`createSsoConfigUpdateFactories`) reads too, so\n      // they move together — the custom-impl dispatch key encodes variantType, and a drift on either\n      // side silently drops the PREFIX and wipes per-override secrets on every save. Hard-code a\n      // variant type here instead and that lockstep is a comment again.\n      // Same fix as the CREATE above + the SCIM-tokens READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: SSO_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.UPDATE],\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n      // onParentDelete cascade so this one-per-scope SSO-config row is physically\n      // removed when its owning org/app is deleted. Without a DELETE op the cascade\n      // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a\n      // config row. This deletes the whole row; domain mutation is not currently a\n      // public operation. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n\n      /*\n       * ─── The three domain-ownership doors (#424) ────────────────────────────────────────────\n       *\n       * ## Why the tenant's own admin, and NOT a platform operator\n       *\n       * None of the three declares `admitsCrossTenantPlatformAdministration`, and that is a\n       * decision rather than an omission. A platform operator crossing into a tenant is justified\n       * when the tenant CANNOT act for itself — `organizationMembers.grantOwnership` repairs a\n       * tenant with no owner. Domain ownership is the opposite shape: the party who must prove it\n       * is the party who controls the DNS, and the operator controls neither the DNS nor the\n       * business relationship. A crossing here would let a platform administrator hand one tenant\n       * routing control over every sign-in at a domain, with the tenant's own admins unable to see\n       * why. The ambient reach `.claude/rules/administrative-continuity-floors.md` forbids is\n       * exactly this.\n       *\n       * ## Why each is UPDATE-like\n       *\n       * All three mutate `domains` on the scope's single config row, so they borrow UPDATE and get\n       * a PUT that carries a body. The domain travels in the BODY, never in the URL: a domain name\n       * is a customer identity, and a GET would write it into every access log between the operator\n       * and the server.\n       *\n       * ## Where the work happens\n       *\n       * Each is implemented as a PREFIX that returns the new `domains` object, which the core\n       * UPDATE persists — the organization-units MOVE/ARCHIVE shape. Deliberately NOT `OVERRIDE_ALL`:\n       * that mode returns before the framework's post-operation lane and would therefore emit NO\n       * `RESOURCE_OPERATION_PERFORMED` audit event, which is the one control that makes a\n       * privileged configuration change with cross-tenant reach accountable. See\n       * `sso-config-domain-verification.custom-impl.backend.service.ts`.\n       *\n       * ## What the trail carries\n       *\n       * All three sit at or above `AUTOMATIC_AUDIT_RISK_FLOOR`, so no `auditableEvent` declaration\n       * is needed. `domains.verifiedDomains`, `domains.ssoEnabledDomains` and\n       * `domains.domainVerificationStatus` are `.isAuditEvidence()`, so the row carries the\n       * before/after of the claimed set and the status map — i.e. WHICH domain moved, and to what.\n       * `domains.domainVerificationTokens` is not marked and must never be: it is the challenge\n       * nonce, and the ledger it would land in cannot be scrubbed.\n       *\n       * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — a verified domain decides which\n       * identity provider authenticates every principal at that domain.\n       * assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — the domain-ownership trail.\n       */\n      [SsoConfig_Operations.CLAIM_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // HIGH, not CRITICAL: a claim grants NOTHING. It records `pending` and mints a nonce, and\n          // every routing reader gates on `verified`. The step that confers authority is VERIFY.\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_ClaimDomainRequestDto,\n          customResponseDto: SsoConfig_ClaimDomainResponseDto,\n        }],\n      },\n\n      [SsoConfig_Operations.VERIFY_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // CRITICAL: this is the transition that hands a tenant SSO routing control over EVERY\n          // person who signs in with an address at the domain — including people who are not that\n          // tenant's members.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_VerifyDomainRequestDto,\n          customResponseDto: SsoConfig_VerifyDomainResponseDto,\n        }],\n      },\n\n      [SsoConfig_Operations.REVOKE_DOMAIN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          // CRITICAL for the same reason as VERIFY, from the other side: revocation is what makes a\n          // domain claimable by a different scope, so it is the hinge of every hand-over.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: SsoConfig_RevokeDomainRequestDto,\n          customResponseDto: SsoConfig_RevokeDomainResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.d.ts

@@ -25,8 +25,6 @@ export declare const SsoConfigBaseSchema: z.ZodObject<{
     domains: z.ZodObject<{
         verifiedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
         ssoEnabledDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-        domainHinting: z.ZodDefault<z.ZodBoolean>;
-        allowExternalDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         domainVerificationStatus: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
             readonly PENDING: "pending";
             readonly VERIFIED: "verified";
@@ -35,26 +33,8 @@ export declare const SsoConfigBaseSchema: z.ZodObject<{
         }>>>>;
         domainVerificationTokens: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>>;
     }, z.core.$strip>;
-    provisioning: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
-        autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
-        autoUpdateUsers: z.ZodDefault<z.ZodBoolean>;
-        autoDeactivateUsers: z.ZodDefault<z.ZodBoolean>;
-        defaultRole: z.ZodOptional<z.ZodString>;
-        requiredAttributes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip>>;
     sessionSettings: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
-        ssoSessionDurationMinutes: z.ZodDefault<z.ZodNumber>;
-        requireReauthForSensitive: z.ZodDefault<z.ZodBoolean>;
         singleLogoutEnabled: z.ZodDefault<z.ZodBoolean>;
-        maxConcurrentSessions: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip>>;
-    auditConfig: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
-        logAllSSOEvents: z.ZodDefault<z.ZodBoolean>;
-        logProviderSwitching: z.ZodDefault<z.ZodBoolean>;
-        logRoleMapping: z.ZodDefault<z.ZodBoolean>;
-        complianceReporting: z.ZodDefault<z.ZodBoolean>;
-        retentionDays: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
     emergencyAccess: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -117,8 +97,6 @@ export declare const ssoConfigPolymorphicDeclaration: import("../../..").Polymor
     domains: z.ZodObject<{
         verifiedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
         ssoEnabledDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-        domainHinting: z.ZodDefault<z.ZodBoolean>;
-        allowExternalDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         domainVerificationStatus: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
             readonly PENDING: "pending";
             readonly VERIFIED: "verified";
@@ -127,26 +105,8 @@ export declare const ssoConfigPolymorphicDeclaration: import("../../..").Polymor
         }>>>>;
         domainVerificationTokens: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>>;
     }, z.core.$strip>;
-    provisioning: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
-        autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
-        autoUpdateUsers: z.ZodDefault<z.ZodBoolean>;
-        autoDeactivateUsers: z.ZodDefault<z.ZodBoolean>;
-        defaultRole: z.ZodOptional<z.ZodString>;
-        requiredAttributes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip>>;
     sessionSettings: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
-        ssoSessionDurationMinutes: z.ZodDefault<z.ZodNumber>;
-        requireReauthForSensitive: z.ZodDefault<z.ZodBoolean>;
         singleLogoutEnabled: z.ZodDefault<z.ZodBoolean>;
-        maxConcurrentSessions: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip>>;
-    auditConfig: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
-        logAllSSOEvents: z.ZodDefault<z.ZodBoolean>;
-        logProviderSwitching: z.ZodDefault<z.ZodBoolean>;
-        logRoleMapping: z.ZodDefault<z.ZodBoolean>;
-        complianceReporting: z.ZodDefault<z.ZodBoolean>;
-        retentionDays: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
     emergencyAccess: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;;;;CAK3B,CAAC;AAEX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoO9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE,GAAG,SAAS,GAAG,MAAM,EAAE,CAKvB;AAED,gGAAgG;AAChG,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IACP,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE,GAAG,SAAS,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAGT;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1C,CAAC"}
+{"version":3,"file":"sso-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;;;;CAK3B,CAAC;AAEX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8S9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE,GAAG,SAAS,GAAG,MAAM,EAAE,CAKvB;AAED,gGAAgG;AAChG,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IACP,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE,GAAG,SAAS,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAGT;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1C,CAAC"}