@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js

@@ -95,6 +95,23 @@ export const SsoConnectionBaseSchema = z.object({
         allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),
         forceAuthn: z.boolean().default(false).isAuditEvidence(),
         maxAuthAge: z.number().min(0).optional().isAuditEvidence(),
+        /**
+         * Whether a person linked through this connection may confirm it is them by signing in again here
+         * (#1441), when adding or removing a way to sign in. Off by default, like the OIDC flag.
+         *
+         * The request is sent with `ForceAuthn="true"` whatever `forceAuthn` says, and the assertion's
+         * `AuthnStatement/@AuthnInstant` must be no older than the request: SAML 2.0 Core §3.4.1 says an IdP
+         * receiving `ForceAuthn="true"` MUST authenticate the presenter directly rather than rely on a previous
+         * security context, and the schema makes `AuthnInstant` required on every authentication statement.
+         * Turn it on only for an IdP that honours `ForceAuthn`: one that silently reuses its session answers
+         * with an old `AuthnInstant` and every re-authentication through it is refused.
+         *
+         * spec-cite: OASIS SAML 2.0 Core (saml-core-2.0-os) §3.4.1 `ForceAuthn` ("the identity provider MUST
+         * authenticate the presenter directly rather than rely on a previous security context") and §2.7.2
+         * `AuthnInstant [Required]`, fetched 2026-09-21 from
+         * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
+         */
+        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),
         nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),
         allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),
         auditSettings: z.object({
@@ -126,6 +143,21 @@ export const SsoConnectionBaseSchema = z.object({
         userInfoEndpoint: z.url().optional().isAuditEvidence(),
         jwksUri: z.url().optional().isAuditEvidence(),
         endSessionEndpoint: z.url().optional().isAuditEvidence(),
+        /**
+         * Redirect the browser to the identity provider's `endSessionEndpoint` when this connection's
+         * user logs out of Wildo — RP-initiated logout (issue #445).
+         *
+         * OPT-IN, and `false` by default, mirroring SAML's `singleLogoutEnabled` rather than inventing a
+         * second shape for the same question. Defaulting it on would change the logout behaviour of
+         * every existing connection that merely happens to have discovered an `end_session_endpoint`,
+         * which for the DISCOVERY template mode is most of them: the endpoint is read out of the
+         * provider's own document, so its presence records what the provider CAN do, never what the
+         * operator wants.
+         *
+         * The endpoint is the CAPABILITY and this is the DECISION. Both are needed — a connection with
+         * this on and no endpoint federates nothing, and says so in the log rather than failing a logout.
+         */
+        federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence(),
         clientId: z.string().min(1).isAuditEvidence(),
         /**
          * OIDC/OAuth2 client secret issued by the IdP, used by the backend token
@@ -173,6 +205,27 @@ export const SsoConnectionBaseSchema = z.object({
         acrValues: z.array(z.string()).optional().isAuditEvidence(),
         maxAge: z.number().min(0).optional().isAuditEvidence(),
         prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),
+        /**
+         * May an account re-prove who it is through this identity provider (#1441)?
+         *
+         * When on, an account whose link to this provider is an OIDC link can answer a re-authentication
+         * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in
+         * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`
+         * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the
+         * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is
+         * refused, never trusted.
+         *
+         * OFF by default, and it should be switched on only for a provider that honours those parameters.
+         * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`
+         * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value
+         * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security
+         * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.
+         * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from
+         * https://openid.net/specs/openid-connect-core-1_0.html
+         * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched
+         * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect
+         */
+        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),
         pkceEnabled: z.boolean().default(true).isAuditEvidence(),
         pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),
         auditSettings: z.object({
@@ -184,10 +237,28 @@ export const SsoConnectionBaseSchema = z.object({
     }).optional(),
     autoCreateUsers: z.boolean().default(true),
     autoVerifyEmail: z.boolean().default(true),
-    /** W2.8: if true, users authenticating via this SSO connection skip the application-level MFA policy. */
-    // `.isAuditEvidence()` — an explicit escape from the application MFA policy for everyone who
-    // authenticates through this connection. Flipping it on lowers the assurance level tenant-wide.
-    bypassAppMFA: z.boolean().default(false).isAuditEvidence(),
+    /*
+     * `bypassAppMFA` was REMOVED (#1236), rather than wired.
+     *
+     * It was authorable, `.isAuditEvidence()`, and read by no production code — so a change to it was
+     * recorded in the trail as a change to a security setting that had no runtime effect. That is the
+     * sharp edge: the ledger asserted a posture change that did not happen, and a reviewer reading the
+     * trail would conclude a control had been relaxed.
+     *
+     * Removed rather than implemented because implementing it would re-open what #1223 had just closed.
+     * An application's declared `requireMFA` is now enforced on the federated lane too — the external
+     * assurance default derives from that declaration — and the organization policy merge is
+     * most-restrictive, so a tenant may tighten the application's posture and never loosen it. A
+     * connection-level escape hatch is the one shape that contradicts both.
+     *
+     * The framework's own shipped documentation already told operators "keep it off and do not use it as
+     * evidence that MFA was bypassed or enforced". A field whose documentation says not to use it is a
+     * field to delete.
+     *
+     * If an application ever needs a tenant to lower the application's requirement, that belongs where
+     * the requirement is DECLARED — in the user-type MFA policy — not on a connection, so that the
+     * relaxation is visible beside the thing it relaxes.
+     */
     // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`
     // and the two mappings decide what authority an externally-authenticated identity lands with,
     // and `allowedDomains` decides whose identities the connection will accept at all. A change
@@ -197,6 +268,22 @@ export const SsoConnectionBaseSchema = z.object({
     // externally-authenticated identity lands with, and whose identities are accepted.
     defaultRole: z.string().optional().isAuditEvidence(),
     allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),
+    /**
+     * The provider DIRECTORIES this connection admits — for Microsoft, the Entra tenant ids (#1230).
+     *
+     * A separate list from `allowedDomains` because the values are a different KIND. An email domain says
+     * where an address is; a directory id says which organization's directory asserted it, and only the
+     * second is a membership proof — a directory can assert an address in a domain it does not own,
+     * which is the case the whole mechanism exists to separate.
+     *
+     * Empty means no directory restriction, matching `allowedDomains` rather than inventing a second
+     * convention. The two are INDEPENDENT: a connection may restrict the directory and not the domain,
+     * and the directory check does not stop when the domain list is empty.
+     *
+     * `.isAuditEvidence()` for the same reason as its neighbours below — widening the set of directories
+     * a connection accepts is an authorization change, and the field name alone cannot evidence it.
+     */
+    allowedDirectoryIds: z.array(z.string()).default([]).isAuditEvidence(),
     roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),
     groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),
     createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,2EAA2E;AAC3E,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,4BAAa,CAAA;AACf,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,gGAAgG;IAChG,0FAA0F;IAC1F,8FAA8F;IAC9F,qEAAqE;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAEvD,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,qGAAqG;IACrG,kGAAkG;IAClG,kGAAkG;IAClG,kDAAkD;IAClD,+FAA+F;IAC/F,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;YAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC;YAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC;YAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACzD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACjE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC3E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC1D,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE;QAChG,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,sGAAsG;IACtG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,0FAA0F;IAC1F,qFAAqF;IACrF,kGAAkG;IAClG,mBAAmB;IACnB,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE;QACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClD,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACnD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC7C,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACxD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C;;;;;;;;;;;;;;;;;;WAkBG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF;;;;;;;;;;WAUG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,yGAAyG;IACzG,6FAA6F;IAC7F,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAC1D,gGAAgG;IAChG,8FAA8F;IAC9F,4FAA4F;IAC5F,4EAA4E;IAC5E,4EAA4E;IAC5E,sFAAsF;IACtF,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAEpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SSO Connection Schema (Shared) — Polymorphic\n *\n * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).\n * Unified resource — `protocol` field determines which sub-object is populated.\n * Both OIDC and SAML protocol engines consume this shared discriminator.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2B\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\n/** Interactive single-sign-on protocols supported by an SSO connection. */\nexport enum SsoProtocol {\n  OIDC = 'oidc',\n  SAML = 'saml',\n}\n\nexport const SSOTemplateMode = {\n  TEMPLATE: 'template',\n  DISCOVERY: 'discovery',\n  MANUAL: 'manual',\n} as const;\n\nexport const SSOResponseType = {\n  CODE: 'code',\n  ID_TOKEN: 'id_token',\n  TOKEN: 'token',\n} as const;\n\nexport const SSOResponseMode = {\n  QUERY: 'query',\n  FRAGMENT: 'fragment',\n  FORM_POST: 'form_post',\n} as const;\n\nexport const SSOPrompt = {\n  NONE: 'none',\n  LOGIN: 'login',\n  CONSENT: 'consent',\n  SELECT_ACCOUNT: 'select_account',\n} as const;\n\nexport const SSOPKCEMethod = {\n  S256: 'S256',\n  PLAIN: 'plain',\n} as const;\n\nexport const SamlNameIdFormat = {\n  UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',\n  EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',\n  PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n  TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',\n} as const;\n\nexport const SsoConnectionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  protocol: z.enum(SsoProtocol).isSummaryField(),\n  externalProviderId: z.string().min(1).optional(),\n  displayName: z.string().min(1).isSummaryField(),\n  // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides\n  // which IdP silently receives logins. Marked individually rather than on any parent: this\n  // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records\n  // the WHOLE object into rows that replicate to an unerasable ledger.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP\n  // decide which identity provider is trusted to authenticate this tenant.\n  enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  isDefault: z.boolean().default(false).isAuditEvidence(),\n\n  // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates\n  // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,\n  // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,\n  // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed\n  // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a\n  // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the\n  // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the\n  // container would copy key material into an unerasable ledger. The two-level `attributeMapping` /\n  // `auditSettings` leaves are deliberately NOT marked — the evidence resolver reaches one level of\n  // nesting only, so a marker there would be inert.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay\n  // validation posture decide which provider is trusted to authenticate this tenant and whether its\n  // assertions are actually verified.\n  saml: z.object({\n    entityId: z.string().min(1).isAuditEvidence(),\n    ssoUrl: z.url().isAuditEvidence(),\n    sloUrl: z.url().optional().isAuditEvidence(),\n    /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */\n    x509CertificatePem: z.string().min(1).optional(),\n    x509Certificates: z.array(z.string()).min(1).isBackendOnly(),\n    attributeMapping: z.object({\n      email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),\n      firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),\n      lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    signRequests: z.boolean().default(true).isAuditEvidence(),\n    wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),\n    allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),\n    forceAuthn: z.boolean().default(false).isAuditEvidence(),\n    maxAuthAge: z.number().min(0).optional().isAuditEvidence(),\n    nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),\n    allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logAttributeMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection\n  // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /\n  // `clientId`) and HOW strictly it validates tokens (`pkceEnabled`, `pkceMethod`), plus what it\n  // requests (`scopes` / `customScopes` / `responseType` / `responseMode` / template + auth-request\n  // shaping, including the `acrValues` step-up demand). Turning `pkceEnabled` off, or repointing\n  // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the\n  // before/after — and so does a change to `acrValues`, which is an authentication-strength\n  // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is\n  // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's\n  // one-level reach.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-\n  // validation posture decide which provider is trusted and whether its tokens are actually verified.\n  oidc: z.object({\n    templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence(),\n    templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n    customScopes: z.array(z.string()).optional().isAuditEvidence(),\n    discoveryUrl: z.url().optional().isAuditEvidence(),\n    issuer: z.url().optional().isAuditEvidence(),\n    authorizationEndpoint: z.url().optional().isAuditEvidence(),\n    tokenEndpoint: z.url().optional().isAuditEvidence(),\n    userInfoEndpoint: z.url().optional().isAuditEvidence(),\n    jwksUri: z.url().optional().isAuditEvidence(),\n    endSessionEndpoint: z.url().optional().isAuditEvidence(),\n    clientId: z.string().min(1).isAuditEvidence(),\n    /**\n     * OIDC/OAuth2 client secret issued by the IdP, used by the backend token\n     * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to\n     * authenticate this connection at the provider's token endpoint.\n     *\n     * `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:\n     * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it\n     * stays in the response DTO so the UI renders a masked placeholder, but the\n     * framework redacts it to `••••••••` at the client-serialization boundary only\n     * — internal reads (`servicesRegistryHandler.read` during token exchange) keep\n     * the real value. Do NOT use `.isBackendOnly()`: that strips the field from\n     * every client DTO, so the operator could never supply it.\n     *\n     * Preservation on UPDATE is NOT automatic here: this is a nested field, and the\n     * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a\n     * round-tripped mask must be re-injected from the stored record by the SSO\n     * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The\n     * central sentinel-strip only preserves TOP-LEVEL write-only secrets.\n     */\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence(),\n    responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence(),\n    responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence(),\n    claimsMapping: z.object({\n      email: z.string().default('email'),\n      firstName: z.string().default('given_name'),\n      lastName: z.string().default('family_name'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    /*\n     * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,\n     * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,\n     * which is why they were removed rather than honoured (#419, decided 2026-09-08).\n     *\n     * `verifyIdToken` ALWAYS verifies the issuer and the audience and hardcodes a five-minute\n     * maximum token age. Honouring the three toggles could therefore only ever LOOSEN a guard that\n     * is currently unconditional — an operator could switch off issuer or audience validation and\n     * break the token trust chain from a settings screen. A configuration field whose only\n     * achievable effect is to weaken a security control should not exist.\n     */\n    acrValues: z.array(z.string()).optional().isAuditEvidence(),\n    maxAge: z.number().min(0).optional().isAuditEvidence(),\n    prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),\n    pkceEnabled: z.boolean().default(true).isAuditEvidence(),\n    pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logTokenExchange: z.boolean().default(true),\n      logClaimsMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  autoCreateUsers: z.boolean().default(true),\n  autoVerifyEmail: z.boolean().default(true),\n  /** W2.8: if true, users authenticating via this SSO connection skip the application-level MFA policy. */\n  // `.isAuditEvidence()` — an explicit escape from the application MFA policy for everyone who\n  // authenticates through this connection. Flipping it on lowers the assurance level tenant-wide.\n  bypassAppMFA: z.boolean().default(false).isAuditEvidence(),\n  // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`\n  // and the two mappings decide what authority an externally-authenticated identity lands with,\n  // and `allowedDomains` decides whose identities the connection will accept at all. A change\n  // here is an authorization change; the field NAME alone cannot evidence it.\n  // The values are role names and domains — configuration, not personal data.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an\n  // externally-authenticated identity lands with, and whose identities are accepted.\n  defaultRole: z.string().optional().isAuditEvidence(),\n  allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n  groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n// NOTE: Protocol-config discriminant enforcement (protocol=saml → saml defined, protocol=oidc → oidc defined)\n// is validated at the backend service layer, not via .refine() here.\n// Zod 4 doesn't allow .extend() on refined objects, which breaks the polymorphism engine.\n\n\nexport type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;\n\nexport const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConnections',\n  baseFieldIdentifier: 'ssoConnectionId',\n  baseEnumKey: 'SSO_CONNECTIONS',\n  baseSchema: SsoConnectionBaseSchema,\n  // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,2EAA2E;AAC3E,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,4BAAa,CAAA;AACf,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,gGAAgG;IAChG,0FAA0F;IAC1F,8FAA8F;IAC9F,qEAAqE;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAEvD,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,qGAAqG;IACrG,kGAAkG;IAClG,kGAAkG;IAClG,kDAAkD;IAClD,+FAA+F;IAC/F,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;YAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC;YAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC;YAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACzD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACjE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC3E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC1D;;;;;;;;;;;;;;;WAeG;QACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACrE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE;QAChG,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,sGAAsG;IACtG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,0FAA0F;IAC1F,qFAAqF;IACrF,kGAAkG;IAClG,mBAAmB;IACnB,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE;QACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClD,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACnD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC7C,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACxD;;;;;;;;;;;;;WAaG;QACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C;;;;;;;;;;;;;;;;;;WAkBG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF;;;;;;;;;;WAUG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACrE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gGAAgG;IAChG,8FAA8F;IAC9F,4FAA4F;IAC5F,4EAA4E;IAC5E,4EAA4E;IAC5E,sFAAsF;IACtF,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC/E;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAEpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SSO Connection Schema (Shared) — Polymorphic\n *\n * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).\n * Unified resource — `protocol` field determines which sub-object is populated.\n * Both OIDC and SAML protocol engines consume this shared discriminator.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2B\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\n/** Interactive single-sign-on protocols supported by an SSO connection. */\nexport enum SsoProtocol {\n  OIDC = 'oidc',\n  SAML = 'saml',\n}\n\nexport const SSOTemplateMode = {\n  TEMPLATE: 'template',\n  DISCOVERY: 'discovery',\n  MANUAL: 'manual',\n} as const;\n\nexport const SSOResponseType = {\n  CODE: 'code',\n  ID_TOKEN: 'id_token',\n  TOKEN: 'token',\n} as const;\n\nexport const SSOResponseMode = {\n  QUERY: 'query',\n  FRAGMENT: 'fragment',\n  FORM_POST: 'form_post',\n} as const;\n\nexport const SSOPrompt = {\n  NONE: 'none',\n  LOGIN: 'login',\n  CONSENT: 'consent',\n  SELECT_ACCOUNT: 'select_account',\n} as const;\n\nexport const SSOPKCEMethod = {\n  S256: 'S256',\n  PLAIN: 'plain',\n} as const;\n\nexport const SamlNameIdFormat = {\n  UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',\n  EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',\n  PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n  TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',\n} as const;\n\nexport const SsoConnectionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  protocol: z.enum(SsoProtocol).isSummaryField(),\n  externalProviderId: z.string().min(1).optional(),\n  displayName: z.string().min(1).isSummaryField(),\n  // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides\n  // which IdP silently receives logins. Marked individually rather than on any parent: this\n  // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records\n  // the WHOLE object into rows that replicate to an unerasable ledger.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP\n  // decide which identity provider is trusted to authenticate this tenant.\n  enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  isDefault: z.boolean().default(false).isAuditEvidence(),\n\n  // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates\n  // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,\n  // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,\n  // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed\n  // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a\n  // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the\n  // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the\n  // container would copy key material into an unerasable ledger. The two-level `attributeMapping` /\n  // `auditSettings` leaves are deliberately NOT marked — the evidence resolver reaches one level of\n  // nesting only, so a marker there would be inert.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay\n  // validation posture decide which provider is trusted to authenticate this tenant and whether its\n  // assertions are actually verified.\n  saml: z.object({\n    entityId: z.string().min(1).isAuditEvidence(),\n    ssoUrl: z.url().isAuditEvidence(),\n    sloUrl: z.url().optional().isAuditEvidence(),\n    /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */\n    x509CertificatePem: z.string().min(1).optional(),\n    x509Certificates: z.array(z.string()).min(1).isBackendOnly(),\n    attributeMapping: z.object({\n      email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),\n      firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),\n      lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    signRequests: z.boolean().default(true).isAuditEvidence(),\n    wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),\n    allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),\n    forceAuthn: z.boolean().default(false).isAuditEvidence(),\n    maxAuthAge: z.number().min(0).optional().isAuditEvidence(),\n    /**\n     * Whether a person linked through this connection may confirm it is them by signing in again here\n     * (#1441), when adding or removing a way to sign in. Off by default, like the OIDC flag.\n     *\n     * The request is sent with `ForceAuthn=\"true\"` whatever `forceAuthn` says, and the assertion's\n     * `AuthnStatement/@AuthnInstant` must be no older than the request: SAML 2.0 Core §3.4.1 says an IdP\n     * receiving `ForceAuthn=\"true\"` MUST authenticate the presenter directly rather than rely on a previous\n     * security context, and the schema makes `AuthnInstant` required on every authentication statement.\n     * Turn it on only for an IdP that honours `ForceAuthn`: one that silently reuses its session answers\n     * with an old `AuthnInstant` and every re-authentication through it is refused.\n     *\n     * spec-cite: OASIS SAML 2.0 Core (saml-core-2.0-os) §3.4.1 `ForceAuthn` (\"the identity provider MUST\n     * authenticate the presenter directly rather than rely on a previous security context\") and §2.7.2\n     * `AuthnInstant [Required]`, fetched 2026-09-21 from\n     * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\n     */\n    reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),\n    nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),\n    allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logAttributeMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection\n  // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /\n  // `clientId`) and HOW strictly it validates tokens (`pkceEnabled`, `pkceMethod`), plus what it\n  // requests (`scopes` / `customScopes` / `responseType` / `responseMode` / template + auth-request\n  // shaping, including the `acrValues` step-up demand). Turning `pkceEnabled` off, or repointing\n  // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the\n  // before/after — and so does a change to `acrValues`, which is an authentication-strength\n  // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is\n  // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's\n  // one-level reach.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-\n  // validation posture decide which provider is trusted and whether its tokens are actually verified.\n  oidc: z.object({\n    templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence(),\n    templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n    customScopes: z.array(z.string()).optional().isAuditEvidence(),\n    discoveryUrl: z.url().optional().isAuditEvidence(),\n    issuer: z.url().optional().isAuditEvidence(),\n    authorizationEndpoint: z.url().optional().isAuditEvidence(),\n    tokenEndpoint: z.url().optional().isAuditEvidence(),\n    userInfoEndpoint: z.url().optional().isAuditEvidence(),\n    jwksUri: z.url().optional().isAuditEvidence(),\n    endSessionEndpoint: z.url().optional().isAuditEvidence(),\n    /**\n     * Redirect the browser to the identity provider's `endSessionEndpoint` when this connection's\n     * user logs out of Wildo — RP-initiated logout (issue #445).\n     *\n     * OPT-IN, and `false` by default, mirroring SAML's `singleLogoutEnabled` rather than inventing a\n     * second shape for the same question. Defaulting it on would change the logout behaviour of\n     * every existing connection that merely happens to have discovered an `end_session_endpoint`,\n     * which for the DISCOVERY template mode is most of them: the endpoint is read out of the\n     * provider's own document, so its presence records what the provider CAN do, never what the\n     * operator wants.\n     *\n     * The endpoint is the CAPABILITY and this is the DECISION. Both are needed — a connection with\n     * this on and no endpoint federates nothing, and says so in the log rather than failing a logout.\n     */\n    federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence(),\n    clientId: z.string().min(1).isAuditEvidence(),\n    /**\n     * OIDC/OAuth2 client secret issued by the IdP, used by the backend token\n     * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to\n     * authenticate this connection at the provider's token endpoint.\n     *\n     * `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:\n     * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it\n     * stays in the response DTO so the UI renders a masked placeholder, but the\n     * framework redacts it to `••••••••` at the client-serialization boundary only\n     * — internal reads (`servicesRegistryHandler.read` during token exchange) keep\n     * the real value. Do NOT use `.isBackendOnly()`: that strips the field from\n     * every client DTO, so the operator could never supply it.\n     *\n     * Preservation on UPDATE is NOT automatic here: this is a nested field, and the\n     * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a\n     * round-tripped mask must be re-injected from the stored record by the SSO\n     * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The\n     * central sentinel-strip only preserves TOP-LEVEL write-only secrets.\n     */\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence(),\n    responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence(),\n    responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence(),\n    claimsMapping: z.object({\n      email: z.string().default('email'),\n      firstName: z.string().default('given_name'),\n      lastName: z.string().default('family_name'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    /*\n     * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,\n     * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,\n     * which is why they were removed rather than honoured (#419, decided 2026-09-08).\n     *\n     * `verifyIdToken` ALWAYS verifies the issuer and the audience and hardcodes a five-minute\n     * maximum token age. Honouring the three toggles could therefore only ever LOOSEN a guard that\n     * is currently unconditional — an operator could switch off issuer or audience validation and\n     * break the token trust chain from a settings screen. A configuration field whose only\n     * achievable effect is to weaken a security control should not exist.\n     */\n    acrValues: z.array(z.string()).optional().isAuditEvidence(),\n    maxAge: z.number().min(0).optional().isAuditEvidence(),\n    prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),\n    /**\n     * May an account re-prove who it is through this identity provider (#1441)?\n     *\n     * When on, an account whose link to this provider is an OIDC link can answer a re-authentication\n     * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in\n     * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`\n     * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the\n     * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is\n     * refused, never trusted.\n     *\n     * OFF by default, and it should be switched on only for a provider that honours those parameters.\n     * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`\n     * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value\n     * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security\n     * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.\n     * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from\n     * https://openid.net/specs/openid-connect-core-1_0.html\n     * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched\n     * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect\n     */\n    reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),\n    pkceEnabled: z.boolean().default(true).isAuditEvidence(),\n    pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logTokenExchange: z.boolean().default(true),\n      logClaimsMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  autoCreateUsers: z.boolean().default(true),\n  autoVerifyEmail: z.boolean().default(true),\n  /*\n   * `bypassAppMFA` was REMOVED (#1236), rather than wired.\n   *\n   * It was authorable, `.isAuditEvidence()`, and read by no production code — so a change to it was\n   * recorded in the trail as a change to a security setting that had no runtime effect. That is the\n   * sharp edge: the ledger asserted a posture change that did not happen, and a reviewer reading the\n   * trail would conclude a control had been relaxed.\n   *\n   * Removed rather than implemented because implementing it would re-open what #1223 had just closed.\n   * An application's declared `requireMFA` is now enforced on the federated lane too — the external\n   * assurance default derives from that declaration — and the organization policy merge is\n   * most-restrictive, so a tenant may tighten the application's posture and never loosen it. A\n   * connection-level escape hatch is the one shape that contradicts both.\n   *\n   * The framework's own shipped documentation already told operators \"keep it off and do not use it as\n   * evidence that MFA was bypassed or enforced\". A field whose documentation says not to use it is a\n   * field to delete.\n   *\n   * If an application ever needs a tenant to lower the application's requirement, that belongs where\n   * the requirement is DECLARED — in the user-type MFA policy — not on a connection, so that the\n   * relaxation is visible beside the thing it relaxes.\n   */\n  // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`\n  // and the two mappings decide what authority an externally-authenticated identity lands with,\n  // and `allowedDomains` decides whose identities the connection will accept at all. A change\n  // here is an authorization change; the field NAME alone cannot evidence it.\n  // The values are role names and domains — configuration, not personal data.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an\n  // externally-authenticated identity lands with, and whose identities are accepted.\n  defaultRole: z.string().optional().isAuditEvidence(),\n  allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * The provider DIRECTORIES this connection admits — for Microsoft, the Entra tenant ids (#1230).\n   *\n   * A separate list from `allowedDomains` because the values are a different KIND. An email domain says\n   * where an address is; a directory id says which organization's directory asserted it, and only the\n   * second is a membership proof — a directory can assert an address in a domain it does not own,\n   * which is the case the whole mechanism exists to separate.\n   *\n   * Empty means no directory restriction, matching `allowedDomains` rather than inventing a second\n   * convention. The two are INDEPENDENT: a connection may restrict the directory and not the domain,\n   * and the directory check does not stop when the domain list is empty.\n   *\n   * `.isAuditEvidence()` for the same reason as its neighbours below — widening the set of directories\n   * a connection accepts is an authorization change, and the field name alone cannot evidence it.\n   */\n  allowedDirectoryIds: z.array(z.string()).default([]).isAuditEvidence(),\n  roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n  groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n// NOTE: Protocol-config discriminant enforcement (protocol=saml → saml defined, protocol=oidc → oidc defined)\n// is validated at the backend service layer, not via .refine() here.\n// Zod 4 doesn't allow .extend() on refined objects, which breaks the polymorphism engine.\n\n\nexport type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;\n\nexport const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConnections',\n  baseFieldIdentifier: 'ssoConnectionId',\n  baseEnumKey: 'SSO_CONNECTIONS',\n  baseSchema: SsoConnectionBaseSchema,\n  // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.d.ts

@@ -27,11 +27,53 @@
  * an administrative-continuity refusal" with one check and still distinguish the scope when it wants
  * to — which two unrelated enums would not.
  */
+/** @wildo_source:part:start saas.models.authorization.administrative-continuity-codes facet:layer:shared facet:audience:app-developer */
 /**
  * Which administrative population a refusal was protecting.
  *
- * A closed vocabulary with one named runtime source: schemas, comparisons and client branches all
- * derive from this enum rather than re-typing the literals.
+ * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: schemas,
+ * comparisons and client branches all derive from this enum rather than re-typing the literals.
+ *
+ * ## Where you meet it
+ *
+ * A write that would strip the last accountable administrator is refused with HTTP **409 CONFLICT**,
+ * and this value rides under the response's stable `code` key. Branch on `code`, never on the
+ * message: the message is a human remedy and is free to be reworded, and every other field a backend
+ * might have used to carry the reason is stripped from a CONFLICT before it reaches a client.
+ *
+ * `409` and not `403`/`400` is deliberate and worth handling separately: the caller IS authorised and
+ * the payload IS valid. What forbids the write is the current state, so a generic "conflict, retry"
+ * branch loops forever — the remedy is to appoint another administrator at the named scope first.
+ *
+ * ## What counts as an administrator, when you are deciding whether the remedy will work
+ *
+ * Three conditions, all of which must hold, and each resolved toward the SMALLER count so an
+ * ambiguity produces an over-refusal (recoverable) rather than a lockout (not):
+ *
+ * 1. the roles must CONFER the anchor role — `APP_ADMIN_SUPER_ADMIN` at application scope,
+ *    `ORG_OWNER` at organization scope — directly OR through an `inheritFrom` chain. The conferring
+ *    set is resolved from your application's LIVE role table at the moment of the call, so a role you
+ *    registered yourself that inherits from the anchor counts, and its holders are equally protected;
+ * 2. the membership must be `ACTIVE`. An `INVITED` row does not count even though accepting it would
+ *    flip the same row — a recoverable administrator is not a usable one, and the invitee may never
+ *    accept;
+ * 3. the linked user account must be `ACTIVE`. A suspended user cannot present the membership at all.
+ *
+ * ## Two traps
+ *
+ * **A UNIT-scoped grant does not satisfy the organization floor.** Granting the owner role inside one
+ * organization unit reaches that unit and nothing across the tenant, so the floor — which reads
+ * organization-wide membership roles and nothing else — refuses the retry exactly as before. Promote
+ * an organization-wide member instead.
+ *
+ * **Deactivating a user REPORTS rather than refuses.** Suspending an account is overwhelmingly
+ * incident response, and refusing it would mean an operator cannot lock out a hostile owner without
+ * first transferring ownership using the tenant the attacker controls. So the containment proceeds
+ * and every tenant it strands is recorded at critical severity — do not read this refusal as a
+ * guarantee that no suspension can leave a tenant ownerless.
+ *
+ * A tenant that is finished is exempt: a `CANCELLED` or `DELETED` organization, or one that has
+ * already requested deletion, may lose its last owner, so ordinary offboarding is never blocked.
  */
 export declare enum AdministrativeContinuityErrorCode {
     /**
@@ -47,11 +89,13 @@ export declare enum AdministrativeContinuityErrorCode {
      * The write would leave ONE organization with no administratively usable owner — an ACTIVE
      * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.
      *
-     * Unrecoverable in-product once breached, and MORE absolutely than the application case:
-     * `ORGANIZATION_MEMBERS` declares no super-administrator variant, so a platform administrator who
-     * is not a member of the stranded tenant can observe and destroy it but cannot re-own it.
-     * Remedy: grant an owner role to another active member of that organization, then retry.
+     * Remedy before removing the last owner: grant an owner role to another active member, then retry.
+     * If external mutation or restored data already stranded the organization, the dedicated
+     * GRANT_OWNERSHIP operation provides a repair path to an eligible ACTIVE member with an ACTIVE
+     * linked user. A crossing platform administrator still needs its declared variant and a usable
+     * tenant-access grant; ownerless request auto-approval does not bypass the repair's checks.
      */
     LAST_ORGANIZATION_OWNER = "LAST_ORGANIZATION_OWNER"
 }
+/** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */
 //# sourceMappingURL=administrative-continuity.shared.schemas.d.ts.map

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"administrative-continuity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;GAKG;AACH,oBAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAE7D;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;CACpD"}
+{"version":3,"file":"administrative-continuity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAE7D;;;;;;;;;OASG;IACH,uBAAuB,4BAA4B;CACpD;AACD,uFAAuF"}

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.js

@@ -27,11 +27,53 @@
  * an administrative-continuity refusal" with one check and still distinguish the scope when it wants
  * to — which two unrelated enums would not.
  */
+/** @wildo_source:part:start saas.models.authorization.administrative-continuity-codes facet:layer:shared facet:audience:app-developer */
 /**
  * Which administrative population a refusal was protecting.
  *
- * A closed vocabulary with one named runtime source: schemas, comparisons and client branches all
- * derive from this enum rather than re-typing the literals.
+ * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: schemas,
+ * comparisons and client branches all derive from this enum rather than re-typing the literals.
+ *
+ * ## Where you meet it
+ *
+ * A write that would strip the last accountable administrator is refused with HTTP **409 CONFLICT**,
+ * and this value rides under the response's stable `code` key. Branch on `code`, never on the
+ * message: the message is a human remedy and is free to be reworded, and every other field a backend
+ * might have used to carry the reason is stripped from a CONFLICT before it reaches a client.
+ *
+ * `409` and not `403`/`400` is deliberate and worth handling separately: the caller IS authorised and
+ * the payload IS valid. What forbids the write is the current state, so a generic "conflict, retry"
+ * branch loops forever — the remedy is to appoint another administrator at the named scope first.
+ *
+ * ## What counts as an administrator, when you are deciding whether the remedy will work
+ *
+ * Three conditions, all of which must hold, and each resolved toward the SMALLER count so an
+ * ambiguity produces an over-refusal (recoverable) rather than a lockout (not):
+ *
+ * 1. the roles must CONFER the anchor role — `APP_ADMIN_SUPER_ADMIN` at application scope,
+ *    `ORG_OWNER` at organization scope — directly OR through an `inheritFrom` chain. The conferring
+ *    set is resolved from your application's LIVE role table at the moment of the call, so a role you
+ *    registered yourself that inherits from the anchor counts, and its holders are equally protected;
+ * 2. the membership must be `ACTIVE`. An `INVITED` row does not count even though accepting it would
+ *    flip the same row — a recoverable administrator is not a usable one, and the invitee may never
+ *    accept;
+ * 3. the linked user account must be `ACTIVE`. A suspended user cannot present the membership at all.
+ *
+ * ## Two traps
+ *
+ * **A UNIT-scoped grant does not satisfy the organization floor.** Granting the owner role inside one
+ * organization unit reaches that unit and nothing across the tenant, so the floor — which reads
+ * organization-wide membership roles and nothing else — refuses the retry exactly as before. Promote
+ * an organization-wide member instead.
+ *
+ * **Deactivating a user REPORTS rather than refuses.** Suspending an account is overwhelmingly
+ * incident response, and refusing it would mean an operator cannot lock out a hostile owner without
+ * first transferring ownership using the tenant the attacker controls. So the containment proceeds
+ * and every tenant it strands is recorded at critical severity — do not read this refusal as a
+ * guarantee that no suspension can leave a tenant ownerless.
+ *
+ * A tenant that is finished is exempt: a `CANCELLED` or `DELETED` organization, or one that has
+ * already requested deletion, may lose its last owner, so ordinary offboarding is never blocked.
  */
 export var AdministrativeContinuityErrorCode;
 (function (AdministrativeContinuityErrorCode) {
@@ -48,11 +90,13 @@ export var AdministrativeContinuityErrorCode;
      * The write would leave ONE organization with no administratively usable owner — an ACTIVE
      * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.
      *
-     * Unrecoverable in-product once breached, and MORE absolutely than the application case:
-     * `ORGANIZATION_MEMBERS` declares no super-administrator variant, so a platform administrator who
-     * is not a member of the stranded tenant can observe and destroy it but cannot re-own it.
-     * Remedy: grant an owner role to another active member of that organization, then retry.
+     * Remedy before removing the last owner: grant an owner role to another active member, then retry.
+     * If external mutation or restored data already stranded the organization, the dedicated
+     * GRANT_OWNERSHIP operation provides a repair path to an eligible ACTIVE member with an ACTIVE
+     * linked user. A crossing platform administrator still needs its declared variant and a usable
+     * tenant-access grant; ownerless request auto-approval does not bypass the repair's checks.
      */
     AdministrativeContinuityErrorCode["LAST_ORGANIZATION_OWNER"] = "LAST_ORGANIZATION_OWNER";
 })(AdministrativeContinuityErrorCode || (AdministrativeContinuityErrorCode = {}));
+/** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */
 //# sourceMappingURL=administrative-continuity.shared.schemas.js.map

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"administrative-continuity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;GAKG;AACH,MAAM,CAAN,IAAY,iCAqBX;AArBD,WAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,kGAA6D,CAAA;IAE7D;;;;;;;;OAQG;IACH,wFAAmD,CAAA;AACrD,CAAC,EArBW,iCAAiC,KAAjC,iCAAiC,QAqB5C","sourcesContent":["/**\n * Administrative-continuity refusal codes — the stable, client-branchable identity of a\n * \"you would remove the last accountable administrator\" refusal.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application, and each of its\n * tenants, must retain an accountable administrative principal.\n *\n * ## Why this exists as a shared enum rather than prose\n *\n * Both authority floors refuse with `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an\n * ALLOWLIST of context keys on a CONFLICT. The human remedy travels under `message`, which is on that\n * list — but prose is not a contract: a client wanting to tell \"you would strip the last\n * administrator\" apart from any other 409 would have to regex-parse it, and that breaks the moment\n * the wording is improved.\n *\n * The allowlist's own documented rule is that a client-branchable value rides under the stable `code`\n * key, sourced from an enum declared HERE in `@wildo-ai/saas-models` so backend and frontend share one\n * definition — and explicitly NOT under an invented `reason` / `errorKind` field (which the sanitizer\n * strips precisely so that this rule is the only way through). The backend-side `reason` codes remain,\n * unchanged and unshipped: they are the LOG/audit identity, richer than the wire and free to stay so.\n *\n * ## Why one enum for two floors\n *\n * The application floor and the organization-owner floor are distinct authorities over distinct\n * populations, but from a CLIENT's perspective they are one situation with one remedy shape: appoint\n * another administrator at the named scope, then retry. A single enum lets a caller branch on \"this is\n * an administrative-continuity refusal\" with one check and still distinguish the scope when it wants\n * to — which two unrelated enums would not.\n */\n\n/**\n * Which administrative population a refusal was protecting.\n *\n * A closed vocabulary with one named runtime source: schemas, comparisons and client branches all\n * derive from this enum rather than re-typing the literals.\n */\nexport enum AdministrativeContinuityErrorCode {\n  /**\n   * The write would leave the APPLICATION with no administratively usable super-administrator —\n   * a principal that confers `APP_ADMIN_SUPER_ADMIN` (directly or through an `inheritFrom` chain)\n   * and whose account status can still authenticate.\n   *\n   * Unrecoverable in-product once breached: every recovery door is itself gated on that role.\n   * Remedy: grant a super-administrator role to another active user, then retry.\n   */\n  LAST_APPLICATION_SUPER_ADMIN = 'LAST_APPLICATION_SUPER_ADMIN',\n\n  /**\n   * The write would leave ONE organization with no administratively usable owner — an ACTIVE\n   * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.\n   *\n   * Unrecoverable in-product once breached, and MORE absolutely than the application case:\n   * `ORGANIZATION_MEMBERS` declares no super-administrator variant, so a platform administrator who\n   * is not a member of the stranded tenant can observe and destroy it but cannot re-own it.\n   * Remedy: grant an owner role to another active member of that organization, then retry.\n   */\n  LAST_ORGANIZATION_OWNER = 'LAST_ORGANIZATION_OWNER',\n}\n"]}
+{"version":3,"file":"administrative-continuity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAN,IAAY,iCAsBX;AAtBD,WAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,kGAA6D,CAAA;IAE7D;;;;;;;;;OASG;IACH,wFAAmD,CAAA;AACrD,CAAC,EAtBW,iCAAiC,KAAjC,iCAAiC,QAsB5C;AACD,uFAAuF","sourcesContent":["/**\n * Administrative-continuity refusal codes — the stable, client-branchable identity of a\n * \"you would remove the last accountable administrator\" refusal.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application, and each of its\n * tenants, must retain an accountable administrative principal.\n *\n * ## Why this exists as a shared enum rather than prose\n *\n * Both authority floors refuse with `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an\n * ALLOWLIST of context keys on a CONFLICT. The human remedy travels under `message`, which is on that\n * list — but prose is not a contract: a client wanting to tell \"you would strip the last\n * administrator\" apart from any other 409 would have to regex-parse it, and that breaks the moment\n * the wording is improved.\n *\n * The allowlist's own documented rule is that a client-branchable value rides under the stable `code`\n * key, sourced from an enum declared HERE in `@wildo-ai/saas-models` so backend and frontend share one\n * definition — and explicitly NOT under an invented `reason` / `errorKind` field (which the sanitizer\n * strips precisely so that this rule is the only way through). The backend-side `reason` codes remain,\n * unchanged and unshipped: they are the LOG/audit identity, richer than the wire and free to stay so.\n *\n * ## Why one enum for two floors\n *\n * The application floor and the organization-owner floor are distinct authorities over distinct\n * populations, but from a CLIENT's perspective they are one situation with one remedy shape: appoint\n * another administrator at the named scope, then retry. A single enum lets a caller branch on \"this is\n * an administrative-continuity refusal\" with one check and still distinguish the scope when it wants\n * to — which two unrelated enums would not.\n */\n\n/** @wildo_source:part:start saas.models.authorization.administrative-continuity-codes facet:layer:shared facet:audience:app-developer */\n/**\n * Which administrative population a refusal was protecting.\n *\n * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: schemas,\n * comparisons and client branches all derive from this enum rather than re-typing the literals.\n *\n * ## Where you meet it\n *\n * A write that would strip the last accountable administrator is refused with HTTP **409 CONFLICT**,\n * and this value rides under the response's stable `code` key. Branch on `code`, never on the\n * message: the message is a human remedy and is free to be reworded, and every other field a backend\n * might have used to carry the reason is stripped from a CONFLICT before it reaches a client.\n *\n * `409` and not `403`/`400` is deliberate and worth handling separately: the caller IS authorised and\n * the payload IS valid. What forbids the write is the current state, so a generic \"conflict, retry\"\n * branch loops forever — the remedy is to appoint another administrator at the named scope first.\n *\n * ## What counts as an administrator, when you are deciding whether the remedy will work\n *\n * Three conditions, all of which must hold, and each resolved toward the SMALLER count so an\n * ambiguity produces an over-refusal (recoverable) rather than a lockout (not):\n *\n * 1. the roles must CONFER the anchor role — `APP_ADMIN_SUPER_ADMIN` at application scope,\n *    `ORG_OWNER` at organization scope — directly OR through an `inheritFrom` chain. The conferring\n *    set is resolved from your application's LIVE role table at the moment of the call, so a role you\n *    registered yourself that inherits from the anchor counts, and its holders are equally protected;\n * 2. the membership must be `ACTIVE`. An `INVITED` row does not count even though accepting it would\n *    flip the same row — a recoverable administrator is not a usable one, and the invitee may never\n *    accept;\n * 3. the linked user account must be `ACTIVE`. A suspended user cannot present the membership at all.\n *\n * ## Two traps\n *\n * **A UNIT-scoped grant does not satisfy the organization floor.** Granting the owner role inside one\n * organization unit reaches that unit and nothing across the tenant, so the floor — which reads\n * organization-wide membership roles and nothing else — refuses the retry exactly as before. Promote\n * an organization-wide member instead.\n *\n * **Deactivating a user REPORTS rather than refuses.** Suspending an account is overwhelmingly\n * incident response, and refusing it would mean an operator cannot lock out a hostile owner without\n * first transferring ownership using the tenant the attacker controls. So the containment proceeds\n * and every tenant it strands is recorded at critical severity — do not read this refusal as a\n * guarantee that no suspension can leave a tenant ownerless.\n *\n * A tenant that is finished is exempt: a `CANCELLED` or `DELETED` organization, or one that has\n * already requested deletion, may lose its last owner, so ordinary offboarding is never blocked.\n */\nexport enum AdministrativeContinuityErrorCode {\n  /**\n   * The write would leave the APPLICATION with no administratively usable super-administrator —\n   * a principal that confers `APP_ADMIN_SUPER_ADMIN` (directly or through an `inheritFrom` chain)\n   * and whose account status can still authenticate.\n   *\n   * Unrecoverable in-product once breached: every recovery door is itself gated on that role.\n   * Remedy: grant a super-administrator role to another active user, then retry.\n   */\n  LAST_APPLICATION_SUPER_ADMIN = 'LAST_APPLICATION_SUPER_ADMIN',\n\n  /**\n   * The write would leave ONE organization with no administratively usable owner — an ACTIVE\n   * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.\n   *\n   * Remedy before removing the last owner: grant an owner role to another active member, then retry.\n   * If external mutation or restored data already stranded the organization, the dedicated\n   * GRANT_OWNERSHIP operation provides a repair path to an eligible ACTIVE member with an ACTIVE\n   * linked user. A crossing platform administrator still needs its declared variant and a usable\n   * tenant-access grant; ownerless request auto-approval does not bypass the repair's checks.\n   */\n  LAST_ORGANIZATION_OWNER = 'LAST_ORGANIZATION_OWNER',\n}\n/** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */\n"]}

package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Application Access Grants — resource configuration.
+ *
+ * The operation set mirrors `platformAccessGrants` verb for verb, and the ONE difference is the whole
+ * feature: `approve` is gated on the PLATFORM's own administrators rather than a tenant's, and refuses
+ * the requester. On the tenant resource the ABSENCE of `admitsCrossTenantPlatformAdministration` on
+ * `approve` is what stops an operator approving their own request; here every verb is platform-tier by
+ * construction, so that absence buys nothing and the refusal has to be a MEASUREMENT the
+ * implementation makes — `applicationAccessGrantApproverIsDistinct`.
+ *
+ * See `application-access-grants.shared.schemas.ts` for why the resource exists and why it is a
+ * sibling type rather than a field, and `.claude/rules/administrative-continuity-floors.md` for the
+ * ladder it sits on.
+ */
+import { z } from 'zod';
+import { ApplicationAccessGrants_Operations } from './application-access-grants.shared.schemas';
+import { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';
+import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
+import { type ResourceRelationship } from '../../resources/resources.shared.schemas';
+type ApplicationAccessGrantsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.COUNT | CoreResourceOperation.UPDATE_MANY;
+export declare const applicationAccessGrantsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<typeof ApplicationAccessGrants_Operations, ApplicationAccessGrantsCoreOperations, z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
+    operatorUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    justification: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof PlatformAccessGrantStatus>>>>>>>>;
+    expiresAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>>>;
+    approvedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>>;
+    approvedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    grantedMachineCredential: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodObject<{
+        authMethod: z.ZodEnum<typeof import("../..").MachineAuthMethod>;
+        credentialId: z.ZodString;
+    }, z.core.$strip>>>>;
+    decisionReason: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>>;
+export {};
+//# sourceMappingURL=application-access-grants.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/application-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,kCAAkC,EAEnC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAE3B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,kEAAkE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAoQ7H,CAAC"}