npm - @wildo-ai/saas-models - Versions diffs - 1.1.3 → 1.1.5 - Mend

@wildo-ai/saas-models 1.1.3 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (890) hide show

package/dist/esm/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.js CHANGED Viewed

@@ -4,13 +4,14 @@
  * Resource configuration for managing organization-scoped registered OAuth
  * clients. FAITHFUL MIRROR of `api-keys-organization.shared.resources-config.schemas.ts`
  * with a FOCUSED operation set: core READ/LIST/SEARCH/CREATE/DELETE/COUNT plus
- * custom ROTATE/REGENERATE. The DEACTIVATE/REACTIVATE/EXTEND_EXPIRY/USAGE_STATS
- * custom ops from api-keys are intentionally deferred to the OIDC branch.
+ * custom ROTATE/REGENERATE, the operator pair DEACTIVATE/REACTIVATE (#1028) and the
+ * sweep-driven EXPIRE. EXTEND_EXPIRY and USAGE_STATS from api-keys are not ported: a
+ * client's validity is fixed at registration, and no usage accounting is recorded for clients.
  */
 import { z } from 'zod';
 import { OAuthClientOrganizationSchema, OAuthClientStatus, } from './oauth-clients.shared.schemas.js';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions.js';
-import { ResourceOperationRiskLevel } from '../../resources/resources.shared.schemas.js';
+import { ResourceOperationRiskLevel, ResourceOperationReversibility } from '../../resources/resources.shared.schemas.js';
 import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas.js';
@@ -40,6 +41,8 @@ export var OrgOAuthClients_Operations;
 (function (OrgOAuthClients_Operations) {
     OrgOAuthClients_Operations["ROTATE"] = "rotate";
     OrgOAuthClients_Operations["REGENERATE"] = "regenerate";
+    OrgOAuthClients_Operations["DEACTIVATE"] = "deactivate";
+    OrgOAuthClients_Operations["REACTIVATE"] = "reactivate";
     OrgOAuthClients_Operations["EXPIRE"] = "expire";
 })(OrgOAuthClients_Operations || (OrgOAuthClients_Operations = {}));
 /*
@@ -205,6 +208,102 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                 }
             ],
         },
+        /**
+         * ACTIVE → INACTIVE, the operator's suspension door (#1028). Until it existed the only ways to
+         * stop a registered client were regenerating its secret — rotation, not suspension, and it
+         * hands the caller a new credential to distribute — or waiting for `expiresAt`.
+         *
+         * WHAT IT STOPS, stated so the contract does not imply instant revocation: the direct-secret
+         * path re-reads the client and requires ACTIVE, and so does every new token mint. A
+         * client-credentials JWT already minted is NOT re-checked against the client until it expires,
+         * so deactivation ends new access and leaves an issued token to run out its own lifetime.
+         *
+         * The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE selects the
+         * core path that persists; it must NOT also hand the caller UPDATE's request contract — this
+         * resource exposes no core UPDATE, and an auto-derived one would let `PUT .../deactivate` carry
+         * `status: active` or rewrite `roles` past the mint-time ceiling. `status` is forced by the
+         * paired prefix implementation (`oauth-clients.custom-impl.backend.service.ts`), whose
+         * ACTIVE-only precondition is the real enforcement; `enabledCondition` is a display affordance
+         * and the cross-tenant `admin` variant carries none.
+         */
+        [OrgOAuthClients_Operations.DEACTIVATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate clients
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({}),
+                    enabledCondition: ({ currentObject }) => {
+                        return currentObject.status === OAuthClientStatus.ACTIVE;
+                    }
+                },
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: false,
+                    variantKey: "admin",
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org clients
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // Per-variant DTOs are NOT inherited from the default variant — each variant builds
+                    // its own, so this cross-tenant variant needs its own narrowing or it re-derives the
+                    // full UPDATE contract. It also carries NO `enabledCondition`, so the transition
+                    // precondition is enforced solely by the prefix implementation's 409 guard.
+                    requestDto: z.object({}),
+                }
+            ],
+            userNotifications: [
+                {
+                    target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,
+                    channel: CoreUserNotificationChannel.EMAIL,
+                },
+                {
+                    target: CoreUserNotificationTarget.USER_SELF,
+                    channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,
+                }
+            ]
+        },
+        /**
+         * INACTIVE → ACTIVE, lifting a suspension. An EXPIRED client is NOT revivable: its expiry was
+         * the thing retiring it, and the prefix implementation refuses with 409 so a status flip cannot
+         * undo a validity window. See DEACTIVATE for why the request contract is empty.
+         */
+        [OrgOAuthClients_Operations.REACTIVATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate clients
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({}),
+                    enabledCondition: ({ currentObject }) => {
+                        return currentObject.status === OAuthClientStatus.INACTIVE;
+                    }
+                },
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: false,
+                    variantKey: "admin",
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org clients
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // See DEACTIVATE's `admin` variant: its own narrowing, and no `enabledCondition`.
+                    requestDto: z.object({}),
+                }
+            ],
+            userNotifications: [
+                {
+                    target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,
+                    channel: CoreUserNotificationChannel.EMAIL,
+                },
+                {
+                    target: CoreUserNotificationTarget.USER_SELF,
+                    channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,
+                }
+            ]
+        },
         [OrgOAuthClients_Operations.ROTATE]: {
             variants: [
                 {
@@ -212,6 +311,9 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     isDefault: true,
                     roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate secrets
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // IRREVERSIBLE: Replaces the client secret; the previous value is not stored in recoverable form.
+                    // This is what admits it to the danger zone; risk alone no longer does.
+                    reversibility: ResourceOperationReversibility.IRREVERSIBLE,
                     // ROTATE is a secret handback plus a caller-chosen cutover. The default
                     // invalidation boundary is now, while a future boundary creates a bounded
                     // overlap. Once that boundary passes, the previous secret cannot be

package/dist/esm/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-clients-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,wDAAwD;AACxD,MAAM,6BAA6B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAE7G,sCAAsC;AACtC,MAAM,+BAA+B,GAAG;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;AAEF,qEAAqE;AACrE,MAAM,qCAAqC,GAAG;IAC5C,GAAG,+BAA+B;IAClC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,mCAAmC,GAAG,CAAC,GAAG,6BAA6B,EAAE,QAAQ,CAAU,CAAC;AAElG,wDAAwD;AACxD,MAAM,CAAN,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,+CAAiB,CAAA;IACjB,uDAAyB,CAAA;IACzB,+CAAiB,CAAA;AACnB,CAAC,EAJW,0BAA0B,KAA1B,0BAA0B,QAIrC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAItK;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,wDAAwD;IAEhF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,0BAA0B;IAE3C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,gEAAgE;oBAChE,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;oBAClE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,yEAAyE;oBACzE,0EAA0E;oBAC1E,0EAA0E;oBAC1E,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED;;;;;;;;;;WAUG;QACH,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,wEAAwE;oBACxE,oEAAoE;oBACpE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAChI,CAAC;oBACF,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;wBACvB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,wEAAwE;oBACxE,oEAAoE;oBACpE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,WAAW;oBACX,+DAA+D;oBAC/D,wEAAwE;oBACxE,sEAAsE;oBACtE,0EAA0E;oBAC1E,6CAA6C;oBAC7C,oEAAoE;oBACpE,2EAA2E;oBAC3E,yEAAyE;oBACzE,oEAAoE;oBACpE,gDAAgD;oBAChD,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAChI,CAAC;oBACF,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;wBACvB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,yCAAyC;oBAC5E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,iFAAiF;oBACjF,uEAAuE;oBACvE,iFAAiF;oBACjF,qFAAqF;oBACrF,mFAAmF;oBACnF,uEAAuE;oBACvE,+EAA+E;oBAC/E,wEAAwE;oBACxE,0BAA0B;oBAC1B,2FAA2F;oBAC3F,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,4CAA4C;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,wEAAwE;oBACxE,sEAAsE;oBACtE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,qFAAqF;oBACrF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,+BAA+B;oBAC7C,UAAU,EAAE,6BAA6B;oBACzC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC;oBACrD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,qCAAqC;oBACnD,UAAU,EAAE,mCAAmC;oBAC/C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization OAuth Clients Shared Resource Configuration\n \n Resource configuration for managing organization-scoped registered OAuth\n * clients. FAITHFUL MIRROR of `api-keys-organization.shared.resources-config.schemas.ts`\n * with a FOCUSED operation set: core READ/LIST/SEARCH/CREATE/DELETE/COUNT plus\n * custom ROTATE/REGENERATE. The DEACTIVATE/REACTIVATE/EXTEND_EXPIRY/USAGE_STATS\n * custom ops from api-keys are intentionally deferred to the OIDC branch.\n /\n\nimport { z } from 'zod';\nimport {\n OAuthClientOrganizationSchema,\n OAuthClientStatus,\n} from './oauth-clients.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization OAuth clients\nconst ORG_OAUTH_CLIENTS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// Org members get basic filter fields\nconst ORG_OAUTH_CLIENTS_FILTER_FIELDS = {\n status: z.enum(OAuthClientStatus),\n name: z.string(),\n organizationId: z.string(),\n hasExpiration: z.boolean(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS = {\n ...ORG_OAUTH_CLIENTS_FILTER_FIELDS,\n lastUsedAt: z.date(), // Admin can filter by last usage\n expiresAt: z.date(), // Admin can filter by expiration\n createdAt: z.date(), // Admin can filter by creation date\n updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_OAUTH_CLIENTS_ADMIN_SORT_FIELDS = [...ORG_OAUTH_CLIENTS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization OAuth clients\nexport enum OrgOAuthClients_Operations {\n ROTATE = 'rotate', // Generate new secret and invalidate old one\n REGENERATE = 'regenerate', // Generate new secret without invalidating old one\n EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n}\n\ntype OrgOAuthClientsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.COUNT;\n\n/\nOrganization OAuth Clients Resource Configuration Factory\n/\nexport const orgOAuthClientsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof OrgOAuthClients_Operations,\n OrgOAuthClientsCoreOperations,\n typeof OAuthClientOrganizationSchema\n>({\n mainSchema: OAuthClientOrganizationSchema,\n resourceIdentifier: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.OAUTH_CLIENTS_ORGANIZATION],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Organization OAuth clients are a core system resource\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.DELETE,\n CoreResourceOperation.COUNT,\n ],\n\n customOperation: OrgOAuthClients_Operations,\n\n operationsConfiguration: {\n [CoreResourceOperation.COUNT]: {\n variants: [\n {\n // Feature usage accounting counts org OAuth clients through the\n // repository layer. This operation does not need public HTTP exposure.\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Organization admins can view\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see clients\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create clients\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // requestDto auto-derived from decorators\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainSecret` (it exists\n // nowhere else after this response — only its SHA-256 hash is persisted).\n // Security decision: an app-super-admin creating a client for another org\n // DOES receive the plaintext so they can relay it to the org. Mirror of\n // the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can delete clients\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org clients\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n /\n ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n * the sweep is the only caller, and there is no reason for a human to declare that a date has\n * passed.\n \n It exists so the sweep writes through a guarded door rather than setting `status` directly.\n * The ACTIVE-only precondition lives in the paired prefix implementation\n * (`oauth-clients.custom-impl.backend.service.ts`) — an INACTIVE client was retired by an\n * administrator, and relabelling it EXPIRED would erase who ended it.\n */\n [OrgOAuthClients_Operations.EXPIRE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n // and the paired prefix implementation forces the status transition itself, so there is no field\n // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n requestDto: z.object({}),\n }\n ],\n },\n\n [OrgOAuthClients_Operations.ROTATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate secrets\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // ROTATE is a secret handback plus a caller-chosen cutover. The default\n // invalidation boundary is now, while a future boundary creates a bounded\n // overlap. Once that boundary passes, the previous secret cannot be\n // restored. An unauthorized caller also walks away with the replacement\n // credential, so a live session alone is deliberately insufficient.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral(),\n oldClientId: z.string(),\n oldSecretInvalidationDate: z.date()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org clients\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // ROTATE is a secret handback plus a caller-chosen cutover. The default\n // invalidation boundary is now, while a future boundary creates a bounded\n // overlap. Once that boundary passes, the previous secret cannot be\n // restored. An unauthorized caller also walks away with the replacement\n // credential, so a live session alone is deliberately insufficient.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Request AND response both MIRROR the org-admin\n // default:\n // - requestDto: an app-super-admin can choose the same future\n // `oldSecretInvalidationDate` window as an org admin. Without it the\n // admin variant would build no request DTO and the impl could only\n // default the invalidation to now — silently denying the future-window\n // capability the default variant exposes.\n // - customResponseDto: without it the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainSecret` (plus the\n // rotated-out client's id + invalidation date). Security decision: an\n // app-super-admin rotating another org's client DOES receive the\n // plaintext so they can relay it to the org.\n // Keep both in sync with the default variant above.\n requestDto: z.object({\n oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral(),\n oldClientId: z.string(),\n oldSecretInvalidationDate: z.date()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgOAuthClients_Operations.REGENERATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate secrets\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // REGENERATE reissues the secret and nothing else — it takes no caller input\n // (contrast ROTATE, which accepts `oldSecretInvalidationDate`). Without this the\n // auto-derived UPDATE contract would apply: the reissue prefix returns\n // `{ ...input, hashedSecret, … }` and the dispatcher MERGES that onto the caller\n // payload, so `redirectUris`, `allowedScopes`, `allowedGrants` and `roles` would all\n // be writable through \"regenerate\". This resource exposes NO core UPDATE, so those\n // fields are meant to be immutable after minting, and the ceiling gate\n // (`assertRequestedRolesWithinCallerCeiling`) runs in the CREATE handler only.\n // A rewritable `redirectUris` on a secret-reissue route is an auth-code\n // exfiltration primitive.\n // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on client credentials.\n requestDto: z.object({}),\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral(),\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org clients\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainSecret`. Security\n // decision: an app-super-admin regenerating another org's client DOES\n // receive the plaintext so they can relay it to the org. Mirror of the\n // default variant's `customResponseDto` above — keep in sync.\n // `requestDto` mirrors the default variant too: no caller input, so the\n // cross-tenant variant cannot rewrite `redirectUris` / `roles` through \"regenerate\".\n requestDto: z.object({}),\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral(),\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_OAUTH_CLIENTS_FILTER_FIELDS,\n sortFields: ORG_OAUTH_CLIENTS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description', 'clientId'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS,\n sortFields: ORG_OAUTH_CLIENTS_ADMIN_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"oauth-clients-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,0CAA0C,CAAC;AAClK,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,wDAAwD;AACxD,MAAM,6BAA6B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAE7G,sCAAsC;AACtC,MAAM,+BAA+B,GAAG;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;AAEF,qEAAqE;AACrE,MAAM,qCAAqC,GAAG;IAC5C,GAAG,+BAA+B;IAClC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,mCAAmC,GAAG,CAAC,GAAG,6BAA6B,EAAE,QAAQ,CAAU,CAAC;AAElG,wDAAwD;AACxD,MAAM,CAAN,IAAY,0BAMX;AAND,WAAY,0BAA0B;IACpC,+CAAiB,CAAA;IACjB,uDAAyB,CAAA;IACzB,uDAAyB,CAAA;IACzB,uDAAyB,CAAA;IACzB,+CAAiB,CAAA;AACnB,CAAC,EANW,0BAA0B,KAA1B,0BAA0B,QAMrC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAItK;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,wDAAwD;IAEhF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,0BAA0B;IAE3C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,gEAAgE;oBAChE,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;oBAClE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,yEAAyE;oBACzE,0EAA0E;oBAC1E,0EAA0E;oBAC1E,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED;;;;;;;;;;WAUG;QACH,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;QAED;;;;;;;;;;;;;;;;;WAiBG;QACH,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,yCAAyC;oBAC5E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,CAAC;oBAC3D,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,4CAA4C;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,oFAAoF;oBACpF,qFAAqF;oBACrF,iFAAiF;oBACjF,4EAA4E;oBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED;;;;WAIG;QACH,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,yCAAyC;oBAC5E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,iBAAiB,CAAC,QAAQ,CAAC;oBAC7D,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,4CAA4C;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,kFAAkF;oBAClF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,kGAAkG;oBAClG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,wEAAwE;oBACxE,oEAAoE;oBACpE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAChI,CAAC;oBACF,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;wBACvB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,wEAAwE;oBACxE,oEAAoE;oBACpE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,WAAW;oBACX,+DAA+D;oBAC/D,wEAAwE;oBACxE,sEAAsE;oBACtE,0EAA0E;oBAC1E,6CAA6C;oBAC7C,oEAAoE;oBACpE,2EAA2E;oBAC3E,yEAAyE;oBACzE,oEAAoE;oBACpE,gDAAgD;oBAChD,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAChI,CAAC;oBACF,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;wBACvB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,yCAAyC;oBAC5E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,iFAAiF;oBACjF,uEAAuE;oBACvE,iFAAiF;oBACjF,qFAAqF;oBACrF,mFAAmF;oBACnF,uEAAuE;oBACvE,+EAA+E;oBAC/E,wEAAwE;oBACxE,0BAA0B;oBAC1B,2FAA2F;oBAC3F,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,4CAA4C;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,wEAAwE;oBACxE,sEAAsE;oBACtE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,qFAAqF;oBACrF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,+BAA+B;oBAC7C,UAAU,EAAE,6BAA6B;oBACzC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC;oBACrD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,qCAAqC;oBACnD,UAAU,EAAE,mCAAmC;oBAC/C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n Organization OAuth Clients Shared Resource Configuration\n \n Resource configuration for managing organization-scoped registered OAuth\n * clients. FAITHFUL MIRROR of `api-keys-organization.shared.resources-config.schemas.ts`\n * with a FOCUSED operation set: core READ/LIST/SEARCH/CREATE/DELETE/COUNT plus\n * custom ROTATE/REGENERATE, the operator pair DEACTIVATE/REACTIVATE (#1028) and the\n * sweep-driven EXPIRE. EXTEND_EXPIRY and USAGE_STATS from api-keys are not ported: a\n * client's validity is fixed at registration, and no usage accounting is recorded for clients.\n /\n\nimport { z } from 'zod';\nimport {\n OAuthClientOrganizationSchema,\n OAuthClientStatus,\n} from './oauth-clients.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization OAuth clients\nconst ORG_OAUTH_CLIENTS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// Org members get basic filter fields\nconst ORG_OAUTH_CLIENTS_FILTER_FIELDS = {\n status: z.enum(OAuthClientStatus),\n name: z.string(),\n organizationId: z.string(),\n hasExpiration: z.boolean(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS = {\n ...ORG_OAUTH_CLIENTS_FILTER_FIELDS,\n lastUsedAt: z.date(), // Admin can filter by last usage\n expiresAt: z.date(), // Admin can filter by expiration\n createdAt: z.date(), // Admin can filter by creation date\n updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_OAUTH_CLIENTS_ADMIN_SORT_FIELDS = [...ORG_OAUTH_CLIENTS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization OAuth clients\nexport enum OrgOAuthClients_Operations {\n ROTATE = 'rotate', // Generate new secret and invalidate old one\n REGENERATE = 'regenerate', // Generate new secret without invalidating old one\n DEACTIVATE = 'deactivate', // ACTIVE → INACTIVE, an administrator suspends the client (#1028)\n REACTIVATE = 'reactivate', // INACTIVE → ACTIVE, an administrator lifts the suspension; an EXPIRED client is not revived\n EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n}\n\ntype OrgOAuthClientsCoreOperations =\n \| CoreResourceOperation.READ\n \| CoreResourceOperation.LIST\n \| CoreResourceOperation.SEARCH\n \| CoreResourceOperation.CREATE\n \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.COUNT;\n\n/\nOrganization OAuth Clients Resource Configuration Factory\n/\nexport const orgOAuthClientsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n typeof OrgOAuthClients_Operations,\n OrgOAuthClientsCoreOperations,\n typeof OAuthClientOrganizationSchema\n>({\n mainSchema: OAuthClientOrganizationSchema,\n resourceIdentifier: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.OAUTH_CLIENTS_ORGANIZATION],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true, // Organization OAuth clients are a core system resource\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.SEARCH,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.DELETE,\n CoreResourceOperation.COUNT,\n ],\n\n customOperation: OrgOAuthClients_Operations,\n\n operationsConfiguration: {\n [CoreResourceOperation.COUNT]: {\n variants: [\n {\n // Feature usage accounting counts org OAuth clients through the\n // repository layer. This operation does not need public HTTP exposure.\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n ],\n },\n\n [CoreResourceOperation.READ]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Organization admins can view\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.LIST]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see clients\n riskLevel: ResourceOperationRiskLevel.LOW,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n riskLevel: ResourceOperationRiskLevel.LOW,\n }\n ]\n },\n\n [CoreResourceOperation.CREATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create clients\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // requestDto auto-derived from decorators\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainSecret` (it exists\n // nowhere else after this response — only its SHA-256 hash is persisted).\n // Security decision: an app-super-admin creating a client for another org\n // DOES receive the plaintext so they can relay it to the org. Mirror of\n // the default variant's `customResponseDto` above — keep in sync.\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [CoreResourceOperation.DELETE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can delete clients\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org clients\n riskLevel: ResourceOperationRiskLevel.HIGH,\n haveBulkOperation: true,\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n /\n ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n * the sweep is the only caller, and there is no reason for a human to declare that a date has\n * passed.\n \n It exists so the sweep writes through a guarded door rather than setting `status` directly.\n * The ACTIVE-only precondition lives in the paired prefix implementation\n * (`oauth-clients.custom-impl.backend.service.ts`) — an INACTIVE client was retired by an\n * administrator, and relabelling it EXPIRED would erase who ended it.\n /\n [OrgOAuthClients_Operations.EXPIRE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n // and the paired prefix implementation forces the status transition itself, so there is no field\n // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n requestDto: z.object({}),\n }\n ],\n },\n\n /\n ACTIVE → INACTIVE, the operator's suspension door (#1028). Until it existed the only ways to\n * stop a registered client were regenerating its secret — rotation, not suspension, and it\n * hands the caller a new credential to distribute — or waiting for `expiresAt`.\n \n WHAT IT STOPS, stated so the contract does not imply instant revocation: the direct-secret\n * path re-reads the client and requires ACTIVE, and so does every new token mint. A\n * client-credentials JWT already minted is NOT re-checked against the client until it expires,\n * so deactivation ends new access and leaves an issued token to run out its own lifetime.\n \n The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE selects the\n * core path that persists; it must NOT also hand the caller UPDATE's request contract — this\n * resource exposes no core UPDATE, and an auto-derived one would let `PUT .../deactivate` carry\n * `status: active` or rewrite `roles` past the mint-time ceiling. `status` is forced by the\n * paired prefix implementation (`oauth-clients.custom-impl.backend.service.ts`), whose\n * ACTIVE-only precondition is the real enforcement; `enabledCondition` is a display affordance\n * and the cross-tenant `admin` variant carries none.\n /\n [OrgOAuthClients_Operations.DEACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate clients\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === OAuthClientStatus.ACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org clients\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each variant builds\n // its own, so this cross-tenant variant needs its own narrowing or it re-derives the\n // full UPDATE contract. It also carries NO `enabledCondition`, so the transition\n // precondition is enforced solely by the prefix implementation's 409 guard.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n /\n INACTIVE → ACTIVE, lifting a suspension. An EXPIRED client is NOT revivable: its expiry was\n * the thing retiring it, and the prefix implementation refuses with 409 so a status flip cannot\n * undo a validity window. See DEACTIVATE for why the request contract is empty.\n */\n [OrgOAuthClients_Operations.REACTIVATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate clients\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({}),\n enabledCondition: ({ currentObject }) => {\n return currentObject.status === OAuthClientStatus.INACTIVE;\n }\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org clients\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // See DEACTIVATE's `admin` variant: its own narrowing, and no `enabledCondition`.\n requestDto: z.object({}),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgOAuthClients_Operations.ROTATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate secrets\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // IRREVERSIBLE: Replaces the client secret; the previous value is not stored in recoverable form.\n // This is what admits it to the danger zone; risk alone no longer does.\n reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n // ROTATE is a secret handback plus a caller-chosen cutover. The default\n // invalidation boundary is now, while a future boundary creates a bounded\n // overlap. Once that boundary passes, the previous secret cannot be\n // restored. An unauthorized caller also walks away with the replacement\n // credential, so a live session alone is deliberately insufficient.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: z.object({\n oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral(),\n oldClientId: z.string(),\n oldSecretInvalidationDate: z.date()\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org clients\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // ROTATE is a secret handback plus a caller-chosen cutover. The default\n // invalidation boundary is now, while a future boundary creates a bounded\n // overlap. Once that boundary passes, the previous secret cannot be\n // restored. An unauthorized caller also walks away with the replacement\n // credential, so a live session alone is deliberately insufficient.\n //\n // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n // and recoverable. Gate the irreversible, not merely the sensitive.\n //\n // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n // high-impact action.\n requiresStepUpAuthentication: true,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Request AND response both MIRROR the org-admin\n // default:\n // - requestDto: an app-super-admin can choose the same future\n // `oldSecretInvalidationDate` window as an org admin. Without it the\n // admin variant would build no request DTO and the impl could only\n // default the invalidation to now — silently denying the future-window\n // capability the default variant exposes.\n // - customResponseDto: without it the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainSecret` (plus the\n // rotated-out client's id + invalidation date). Security decision: an\n // app-super-admin rotating another org's client DOES receive the\n // plaintext so they can relay it to the org.\n // Keep both in sync with the default variant above.\n requestDto: z.object({\n oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n }),\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral(),\n oldClientId: z.string(),\n oldSecretInvalidationDate: z.date()\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n },\n {\n target: CoreUserNotificationTarget.USER_SELF,\n channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n }\n ]\n },\n\n [OrgOAuthClients_Operations.REGENERATE]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate secrets\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // REGENERATE reissues the secret and nothing else — it takes no caller input\n // (contrast ROTATE, which accepts `oldSecretInvalidationDate`). Without this the\n // auto-derived UPDATE contract would apply: the reissue prefix returns\n // `{ ...input, hashedSecret, … }` and the dispatcher MERGES that onto the caller\n // payload, so `redirectUris`, `allowedScopes`, `allowedGrants` and `roles` would all\n // be writable through \"regenerate\". This resource exposes NO core UPDATE, so those\n // fields are meant to be immutable after minting, and the ceiling gate\n // (`assertRequestedRolesWithinCallerCeiling`) runs in the CREATE handler only.\n // A rewritable `redirectUris` on a secret-reissue route is an auth-code\n // exfiltration primitive.\n // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on client credentials.\n requestDto: z.object({}),\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral(),\n }),\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org clients\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n // verb's danger. Same reasoning as `organizationMembers \| UPDATE`.\n // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n auditableEvent: { auditBelowRiskFloor: true },\n // Per-variant DTOs are NOT inherited from the default variant — each\n // variant builds its own. Without this, the admin response falls back to\n // `mainSchema` and silently strips the one-time `plainSecret`. Security\n // decision: an app-super-admin regenerating another org's client DOES\n // receive the plaintext so they can relay it to the org. Mirror of the\n // default variant's `customResponseDto` above — keep in sync.\n // `requestDto` mirrors the default variant too: no caller input, so the\n // cross-tenant variant cannot rewrite `redirectUris` / `roles` through \"regenerate\".\n requestDto: z.object({}),\n customResponseDto: OAuthClientOrganizationSchema.extend({\n plainSecret: z.string().min(1).isEphemeral(),\n }),\n }\n ],\n userNotifications: [\n {\n target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n channel: CoreUserNotificationChannel.EMAIL,\n }\n ]\n },\n\n [CoreResourceOperation.SEARCH]: {\n variants: [\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n roles: [CORE_ORG_ROLES.ORG_MEMBER],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_OAUTH_CLIENTS_FILTER_FIELDS,\n sortFields: ORG_OAUTH_CLIENTS_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 50,\n },\n {\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: false,\n variantKey: \"admin\",\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.LOW,\n isSearchable: true,\n searchableFields: ['name', 'description', 'clientId'],\n searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n filterFields: ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS,\n sortFields: ORG_OAUTH_CLIENTS_ADMIN_SORT_FIELDS,\n maxPaginatedResultPerPageLimit: 100,\n }\n ],\n },\n },\n});\n"]}

package/dist/esm/security/outbound-target-control.shared.schemas.d.ts ADDED Viewed

@@ -0,0 +1,67 @@
+/**
+ * The classes of server-side request whose DESTINATION is chosen by somebody other than the
+ * deployment that makes the request — and how much of the private network each may reach.
+ *
+ * ## Why the class, and not the call site, is the unit
+ *
+ * The request-forgery question is never "is this URL safe?" in the abstract. It is "who picked this
+ * destination, and are they allowed to point this server at its own network?". An organization
+ * administrator who authors a webhook endpoint, an A2A client registering a push target, and an
+ * unauthenticated stranger presenting an OAuth `client_id` URL all answer it differently — and the
+ * application developer who writes a provider endpoint into the backend's own configuration is not a
+ * request-forgery threat at all, because they already own the server.
+ *
+ * So the vocabulary names the CLASS of destination, by who authors it. Every engine site that issues
+ * such a request declares which class it is serving, and the admission follows from the class plus
+ * the operator-declared runtime environment — never from anything the destination's author can set.
+ *
+ * ## What is deliberately NOT a class
+ *
+ * Destinations the application's own code declares — a provider API endpoint, an `httpApiBinding`
+ * base URL — are trusted as authored. What those sites must still refuse is a REMOTE server
+ * re-pointing the request (a redirect), which is a property of the transport, not an admission.
+ * Platform topology (the apps-manager, the module registry, infrastructure sidecars) is operator
+ * configuration and private by design.
+ */
+export declare enum OutboundTargetClass {
+    /** An M2M webhook endpoint. Authored by an organization administrator. */
+    M2M_WEBHOOK_ENDPOINT = "m2m_webhook_endpoint",
+    /** An A2A push-notification target. Supplied by the external A2A client that registered it. */
+    A2A_PUSH_NOTIFICATION_ENDPOINT = "a2a_push_notification_endpoint",
+    /**
+     * A SIEM collector. Authored by an organization administrator; the one class the operator may
+     * admit onto a private network, because a self-hosted collector on the same network is a supported
+     * deployment shape.
+     */
+    SIEM_COLLECTOR = "siem_collector",
+    /** An OAuth client metadata document. Its URL is presented by an UNAUTHENTICATED stranger. */
+    OAUTH_CLIENT_METADATA_DOCUMENT = "oauth_client_metadata_document",
+    /**
+     * A federated identity provider's endpoints — OIDC discovery, token, userinfo, profile extension,
+     * JWKS, SAML metadata and the SAML SSO/SLO reachability checks. Authored by an organization
+     * administrator on an SSO connection, or discovered from a document that administrator's IdP serves.
+     */
+    FEDERATED_IDENTITY_PROVIDER = "federated_identity_provider",
+    /**
+     * A remote MCP server an agent calls. Declared by the application, but it is a THIRD PARTY's
+     * service, reached with the agent's delegated credentials, and its answers can re-point a request.
+     */
+    MCP_SERVER = "mcp_server"
+}
+/**
+ * How much of the network an outbound request may reach beyond the public internet.
+ *
+ * Three members rather than a boolean, because the useful middle is not "private" and not "public":
+ * local development and automated test runs legitimately reach doubles on LOOPBACK, and nothing about
+ * that justifies reaching the cloud instance-metadata address (link-local) or a cluster-internal
+ * service (RFC 1918), which are the addresses a request-forgery attack actually wants.
+ */
+export declare enum OutboundPrivateAddressAdmission {
+    /** Public addresses only. The default, and the only posture a stranger-supplied destination ever gets. */
+    NONE = "none",
+    /** Public addresses plus loopback (`127.0.0.0/8`, `::1`, `localhost`). Never link-local, never RFC 1918. */
+    LOOPBACK_ONLY = "loopback_only",
+    /** Any address. Only by an explicit operator declaration, and only for a class the operator may admit. */
+    PRIVATE_NETWORK = "private_network"
+}
+//# sourceMappingURL=outbound-target-control.shared.schemas.d.ts.map

package/dist/esm/security/outbound-target-control.shared.schemas.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"outbound-target-control.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oBAAoB,yBAAyB;IAC7C,+FAA+F;IAC/F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,cAAc,mBAAmB;IACjC,8FAA8F;IAC9F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,UAAU,eAAe;CAC1B;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,0GAA0G;IAC1G,IAAI,SAAS;IACb,4GAA4G;IAC5G,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,eAAe,oBAAoB;CACpC"}

package/dist/esm/security/outbound-target-control.shared.schemas.js ADDED Viewed

@@ -0,0 +1,69 @@
+/**
+ * The classes of server-side request whose DESTINATION is chosen by somebody other than the
+ * deployment that makes the request — and how much of the private network each may reach.
+ *
+ * ## Why the class, and not the call site, is the unit
+ *
+ * The request-forgery question is never "is this URL safe?" in the abstract. It is "who picked this
+ * destination, and are they allowed to point this server at its own network?". An organization
+ * administrator who authors a webhook endpoint, an A2A client registering a push target, and an
+ * unauthenticated stranger presenting an OAuth `client_id` URL all answer it differently — and the
+ * application developer who writes a provider endpoint into the backend's own configuration is not a
+ * request-forgery threat at all, because they already own the server.
+ *
+ * So the vocabulary names the CLASS of destination, by who authors it. Every engine site that issues
+ * such a request declares which class it is serving, and the admission follows from the class plus
+ * the operator-declared runtime environment — never from anything the destination's author can set.
+ *
+ * ## What is deliberately NOT a class
+ *
+ * Destinations the application's own code declares — a provider API endpoint, an `httpApiBinding`
+ * base URL — are trusted as authored. What those sites must still refuse is a REMOTE server
+ * re-pointing the request (a redirect), which is a property of the transport, not an admission.
+ * Platform topology (the apps-manager, the module registry, infrastructure sidecars) is operator
+ * configuration and private by design.
+ */
+export var OutboundTargetClass;
+(function (OutboundTargetClass) {
+    /** An M2M webhook endpoint. Authored by an organization administrator. */
+    OutboundTargetClass["M2M_WEBHOOK_ENDPOINT"] = "m2m_webhook_endpoint";
+    /** An A2A push-notification target. Supplied by the external A2A client that registered it. */
+    OutboundTargetClass["A2A_PUSH_NOTIFICATION_ENDPOINT"] = "a2a_push_notification_endpoint";
+    /**
+     * A SIEM collector. Authored by an organization administrator; the one class the operator may
+     * admit onto a private network, because a self-hosted collector on the same network is a supported
+     * deployment shape.
+     */
+    OutboundTargetClass["SIEM_COLLECTOR"] = "siem_collector";
+    /** An OAuth client metadata document. Its URL is presented by an UNAUTHENTICATED stranger. */
+    OutboundTargetClass["OAUTH_CLIENT_METADATA_DOCUMENT"] = "oauth_client_metadata_document";
+    /**
+     * A federated identity provider's endpoints — OIDC discovery, token, userinfo, profile extension,
+     * JWKS, SAML metadata and the SAML SSO/SLO reachability checks. Authored by an organization
+     * administrator on an SSO connection, or discovered from a document that administrator's IdP serves.
+     */
+    OutboundTargetClass["FEDERATED_IDENTITY_PROVIDER"] = "federated_identity_provider";
+    /**
+     * A remote MCP server an agent calls. Declared by the application, but it is a THIRD PARTY's
+     * service, reached with the agent's delegated credentials, and its answers can re-point a request.
+     */
+    OutboundTargetClass["MCP_SERVER"] = "mcp_server";
+})(OutboundTargetClass || (OutboundTargetClass = {}));
+/**
+ * How much of the network an outbound request may reach beyond the public internet.
+ *
+ * Three members rather than a boolean, because the useful middle is not "private" and not "public":
+ * local development and automated test runs legitimately reach doubles on LOOPBACK, and nothing about
+ * that justifies reaching the cloud instance-metadata address (link-local) or a cluster-internal
+ * service (RFC 1918), which are the addresses a request-forgery attack actually wants.
+ */
+export var OutboundPrivateAddressAdmission;
+(function (OutboundPrivateAddressAdmission) {
+    /** Public addresses only. The default, and the only posture a stranger-supplied destination ever gets. */
+    OutboundPrivateAddressAdmission["NONE"] = "none";
+    /** Public addresses plus loopback (`127.0.0.0/8`, `::1`, `localhost`). Never link-local, never RFC 1918. */
+    OutboundPrivateAddressAdmission["LOOPBACK_ONLY"] = "loopback_only";
+    /** Any address. Only by an explicit operator declaration, and only for a class the operator may admit. */
+    OutboundPrivateAddressAdmission["PRIVATE_NETWORK"] = "private_network";
+})(OutboundPrivateAddressAdmission || (OutboundPrivateAddressAdmission = {}));
+//# sourceMappingURL=outbound-target-control.shared.schemas.js.map

package/dist/esm/security/outbound-target-control.shared.schemas.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"outbound-target-control.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,mBAwBX;AAxBD,WAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oEAA6C,CAAA;IAC7C,+FAA+F;IAC/F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,wDAAiC,CAAA;IACjC,8FAA8F;IAC9F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,kFAA2D,CAAA;IAC3D;;;OAGG;IACH,gDAAyB,CAAA;AAC3B,CAAC,EAxBW,mBAAmB,KAAnB,mBAAmB,QAwB9B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,0GAA0G;IAC1G,gDAAa,CAAA;IACb,4GAA4G;IAC5G,kEAA+B,CAAA;IAC/B,0GAA0G;IAC1G,sEAAmC,CAAA;AACrC,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C","sourcesContent":["/**\n * The classes of server-side request whose DESTINATION is chosen by somebody other than the\n * deployment that makes the request — and how much of the private network each may reach.\n *\n * ## Why the class, and not the call site, is the unit\n *\n * The request-forgery question is never \"is this URL safe?\" in the abstract. It is \"who picked this\n * destination, and are they allowed to point this server at its own network?\". An organization\n * administrator who authors a webhook endpoint, an A2A client registering a push target, and an\n * unauthenticated stranger presenting an OAuth `client_id` URL all answer it differently — and the\n * application developer who writes a provider endpoint into the backend's own configuration is not a\n * request-forgery threat at all, because they already own the server.\n *\n * So the vocabulary names the CLASS of destination, by who authors it. Every engine site that issues\n * such a request declares which class it is serving, and the admission follows from the class plus\n * the operator-declared runtime environment — never from anything the destination's author can set.\n *\n * ## What is deliberately NOT a class\n *\n * Destinations the application's own code declares — a provider API endpoint, an `httpApiBinding`\n * base URL — are trusted as authored. What those sites must still refuse is a REMOTE server\n * re-pointing the request (a redirect), which is a property of the transport, not an admission.\n * Platform topology (the apps-manager, the module registry, infrastructure sidecars) is operator\n * configuration and private by design.\n */\nexport enum OutboundTargetClass {\n /** An M2M webhook endpoint. Authored by an organization administrator. */\n M2M_WEBHOOK_ENDPOINT = 'm2m_webhook_endpoint',\n /** An A2A push-notification target. Supplied by the external A2A client that registered it. */\n A2A_PUSH_NOTIFICATION_ENDPOINT = 'a2a_push_notification_endpoint',\n /**\n * A SIEM collector. Authored by an organization administrator; the one class the operator may\n * admit onto a private network, because a self-hosted collector on the same network is a supported\n * deployment shape.\n */\n SIEM_COLLECTOR = 'siem_collector',\n /** An OAuth client metadata document. Its URL is presented by an UNAUTHENTICATED stranger. */\n OAUTH_CLIENT_METADATA_DOCUMENT = 'oauth_client_metadata_document',\n /**\n * A federated identity provider's endpoints — OIDC discovery, token, userinfo, profile extension,\n * JWKS, SAML metadata and the SAML SSO/SLO reachability checks. Authored by an organization\n * administrator on an SSO connection, or discovered from a document that administrator's IdP serves.\n */\n FEDERATED_IDENTITY_PROVIDER = 'federated_identity_provider',\n /**\n * A remote MCP server an agent calls. Declared by the application, but it is a THIRD PARTY's\n * service, reached with the agent's delegated credentials, and its answers can re-point a request.\n */\n MCP_SERVER = 'mcp_server',\n}\n\n/**\n * How much of the network an outbound request may reach beyond the public internet.\n *\n * Three members rather than a boolean, because the useful middle is not \"private\" and not \"public\":\n * local development and automated test runs legitimately reach doubles on LOOPBACK, and nothing about\n * that justifies reaching the cloud instance-metadata address (link-local) or a cluster-internal\n * service (RFC 1918), which are the addresses a request-forgery attack actually wants.\n */\nexport enum OutboundPrivateAddressAdmission {\n /** Public addresses only. The default, and the only posture a stranger-supplied destination ever gets. */\n NONE = 'none',\n /** Public addresses plus loopback (`127.0.0.0/8`, `::1`, `localhost`). Never link-local, never RFC 1918. */\n LOOPBACK_ONLY = 'loopback_only',\n /** Any address. Only by an explicit operator declaration, and only for a class the operator may admit. */\n PRIVATE_NETWORK = 'private_network',\n}\n"]}

package/dist/esm/systems-of-record/system-of-record-credential-kind.shared.d.ts ADDED Viewed

@@ -0,0 +1,159 @@
+/**
+ * `SystemOfRecordCredentialKind` — HOW the engine authenticates to a system of record.
+ *
+ * A root-exported boundary module, for the same package-contract reason as its sibling
+ * `HttpApiTransportDialect` (#1055 R3): the ROOT-exported application-configuration contract
+ * (`systemsOfRecord.<name>.credential.kind`) names this vocabulary, and a TypeScript `enum` is
+ * NOMINAL — a root-only consumer that cannot reach the declaring module through a public specifier
+ * gets `TS2742`/`TS2883`. `.claude/rules/package-public-entrypoints.md` prescribes moving the
+ * boundary rather than re-exporting across it, so the `external-data` subpath does NOT re-export
+ * this module.
+ *
+ * ## Why it is a separate vocabulary from the dialect
+ *
+ * A dialect says how to SPEAK (query protocol, envelope, filter language); a credential kind says
+ * how to PROVE WHO YOU ARE. Odoo happens to pair one with the other today, and that coincidence is
+ * exactly what `CLAUDE.md` forbids merging on: an OData v4 service reached with a bearer token and
+ * the same service reached with client-credentials OAuth2 differ in the second axis and not the
+ * first. Keeping them apart costs one enum and stops the pairing from being baked into the model.
+ *
+ * ## What a kind OWNS (#1055 R15, the slot-ownership decision)
+ *
+ * The kind owns the inputs IT needs — its secret slots, and any address slot that exists only
+ * because of the kind. `OAUTH2_CLIENT_CREDENTIALS_SECRET` owns `tokenUrl`, which no vendor would
+ * declare if it were reached with a static key. The FACET owns the vendor's own address slots and
+ * the OFFERS it makes (a kind plus that vendor's policy for it); the INSTANCE chooses one offer.
+ *
+ * A third owner arrived with #1056 and is worth naming, because two of the three are easy to
+ * confuse: the FACET also owns everything about a kind that varies BY VENDOR but not by deployment —
+ * which header carries a static key, whether a token answer omits `expires_in`, whether an assertion
+ * header needs a supplied `kid` or a derived `x5t`. Those are not slots: nobody types them per
+ * environment, and asking an operator for them would be asking a question the facet already holds
+ * the answer to (`derive-before-you-ask.md`).
+ * The contracts themselves live beside the facet schema, on the `external-data` subpath, because
+ * nothing root-exported needs to name a slot SHAPE — only the kind's NAME.
+ *
+ * ## How the catalogue grew, and what is still missing from it
+ *
+ * #1055 shipped ONE member, the one kind its one facet offered. #1056 added the six a service
+ * identity actually needs across the vendors epic #1049 §4.6 surveyed — two static-key placements,
+ * HTTP Basic, and three OAuth2 shapes. A member here with no entry in
+ * `SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS` is a compile error, so the two cannot drift.
+ *
+ * `MTLS_CLIENT_CERTIFICATE` is deliberately ABSENT and is #1263. It is not a seventh variation on
+ * composing a request: every kind here decides what to put IN a request, and mTLS decides how the
+ * CONNECTION is made, which `HttpApiFetchLike` has no channel for (its `init` carries no
+ * dispatcher). Adding it means widening the one outbound seam both this lane and the connector lane
+ * run on — a different blast radius, and the reason SAP is declared unsupported-by-kind in #1057
+ * rather than every other vendor waiting behind it.
+ *
+ * ## The root-only probe, measured 2026-09-15
+ *
+ * `package-public-entrypoints.md` asks for a measurement rather than a category judgement. A
+ * consumer importing ONLY the package root, deriving values from this enum and emitting with
+ * `declaration: true`:
+ *
+ * ```
+ * export declare const declaredKind = SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS;
+ * export declare function pickInstance(): { kind: SystemOfRecordCredentialKind; dialect: HttpApiTransportDialect };
+ * ```
+ *
+ * Zero errors, and the emitted declaration NAMES the enum through the root specifier rather than a
+ * `node_modules/.../dist/esm/...` path. The probe's negative control — importing
+ * `SystemOfRecordVendorFacetSchema`, which is deliberately subpath-only — fails with `TS2305`, so
+ * the probe discriminates rather than passing everything.
+ */
+/**
+ * How the engine proves its identity to a system of record. Closed vocabulary — a system of record
+ * spends the APPLICATION's own service identity (D12), so nothing here is ever a person's lent
+ * credential; those live on the connected-accounts lane and are deliberately not reachable from
+ * this one (`pnpm check:systems-of-record-separation`).
+ */
+export declare enum SystemOfRecordCredentialKind {
+    /**
+     * Odoo's classic external API: the credential travels INSIDE the RPC arguments rather than in an
+     * HTTP header. The adapter performs `common.authenticate(db, login, apiKey, {})` for a uid and
+     * then passes `(db, uid, apiKey, …)` as the leading positional arguments of every `execute_kw`.
+     *
+     * Its inputs are the API key (a secret slot, owned here) plus the database and login (vendor
+     * address slots, owned by the Odoo facet — they identify WHICH Odoo and WHICH user, and would
+     * still be needed by a hypothetical second Odoo credential kind).
+     */
+    ODOO_API_KEY_IN_ARGS = "odoo-api-key-in-args",
+    /**
+     * A static key presented in an HTTP request header.
+     *
+     * The SECRET is the key; WHICH header carries it and what prefixes it (`Bearer `, `ApiKey `, or
+     * nothing at all) are the VENDOR's facts, so they are declared on the facet's offer rather than
+     * asked of the operator who authors an instance. An operator who has to be told their vendor's
+     * header name is being asked a question the facet already holds the answer to
+     * (`derive-before-you-ask.md`).
+     */
+    API_KEY_HEADER = "api-key-header",
+    /**
+     * A static key presented as a query-string parameter.
+     *
+     * Weaker than a header by construction — a URL reaches access logs, proxy logs and `Referer`
+     * headers — and offered only because some vendors accept nothing else. The parameter NAME is the
+     * vendor's fact, like the header name above.
+     *
+     * The key is appended by the transport at dispatch, never baked into a stored `baseUrl`: a base
+     * URL is printed in diagnostics and a credential must not ride in it.
+     */
+    API_KEY_QUERY = "api-key-query",
+    /**
+     * HTTP Basic (RFC 7617): `Authorization: Basic base64(username ":" password)`.
+     *
+     * SAP's communication user is the case this exists for. The username is a SECRET slot rather than
+     * an address slot even though it is not confidential on its own — it is half of one credential,
+     * it is rotated with the other half, and splitting a credential across the address channel and
+     * the secret channel makes rotation two operations that can disagree.
+     *
+     * A username containing `:` is unrepresentable in this scheme (the colon is the delimiter and the
+     * RFC forbids it), so it is refused where it is authored rather than producing a credential that
+     * decodes to a different pair than the one typed.
+     */
+    BASIC = "basic",
+    /**
+     * OAuth 2.0 client credentials (RFC 6749 §4.4) with a shared secret: `grant_type=client_credentials`
+     * plus `client_id` and `client_secret`.
+     *
+     * An APP-ONLY identity — no person, no consent screen, no refresh token. That is the whole of D12:
+     * a system of record is the operator's own deployment, reached as the application, so a
+     * user-delegated flow would be authenticating the wrong party. The connector lane owns the
+     * authorization-code exchange and is not reachable from here.
+     */
+    OAUTH2_CLIENT_CREDENTIALS_SECRET = "oauth2-client-credentials-secret",
+    /**
+     * OAuth 2.0 client credentials with a CLIENT ASSERTION signed by a private key (RFC 7523 §2.2):
+     * `grant_type=client_credentials` with
+     * `client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.
+     *
+     * NetSuite and Microsoft Entra's certificate credential are both this, and NetSuite is the reason
+     * it is separate from {@link OAUTH2_JWT_BEARER}: its documentation states the grant type is
+     * *always* `client_credentials`, so it is client AUTHENTICATION by assertion rather than the
+     * assertion GRANT (#1056 R1 corrected an earlier reading that had NetSuite under the grant).
+     *
+     * spec-cite: RFC 7523 §2.2 (Using JWTs for Client Authentication); NetSuite OAuth 2.0
+     * client-credentials help, https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162755359851.html
+     *
+     * The assertion's protected HEADER differs by vendor — NetSuite carries a vendor-assigned `kid`,
+     * Entra wants an `x5t` thumbprint — so the header policy is declared on the facet's offer (R2). A
+     * generic "sign it with the private key" is rejected by both.
+     */
+    OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE = "oauth2-client-credentials-certificate",
+    /**
+     * The OAuth 2.0 JWT BEARER GRANT (RFC 7523 §2.1):
+     * `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer` with a signed `assertion`.
+     *
+     * Salesforce only, among the vendors surveyed. Distinct from the kind above in the one field that
+     * decides how the token endpoint reads the request — the grant type — which is exactly the kind of
+     * distinction `CLAUDE.md` forbids collapsing because two shapes look similar.
+     *
+     * spec-cite: RFC 7523 §2.1 (Using JWTs as Authorization Grants).
+     */
+    OAUTH2_JWT_BEARER = "oauth2-jwt-bearer"
+}
+/** Whether a kind obtains a token from a token endpoint — the three that need a minter and a cache. */
+export declare function systemOfRecordCredentialKindMintsToken(kind: SystemOfRecordCredentialKind): boolean;
+//# sourceMappingURL=system-of-record-credential-kind.shared.d.ts.map

package/dist/esm/systems-of-record/system-of-record-credential-kind.shared.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"system-of-record-credential-kind.shared.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-credential-kind.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH;;;;;GAKG;AACH,oBAAY,4BAA4B;IACtC;;;;;;;;OAQG;IACH,oBAAoB,yBAAyB;IAE7C;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;;;OASG;IACH,aAAa,kBAAkB;IAE/B;;;;;;;;;;;OAWG;IACH,KAAK,UAAU;IAEf;;;;;;;;OAQG;IACH,gCAAgC,qCAAqC;IAErE;;;;;;;;;;;;;;;;OAgBG;IACH,qCAAqC,0CAA0C;IAE/E;;;;;;;;;OASG;IACH,iBAAiB,sBAAsB;CACxC;AAED,uGAAuG;AACvG,wBAAgB,sCAAsC,CAAC,IAAI,EAAE,4BAA4B,GAAG,OAAO,CAIlG"}