@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/organizations/service-provider-capability-grants.shared.resources-config.schemas.js

@@ -0,0 +1,155 @@
+/**
+ * `SERVICE_PROVIDER_CAPABILITY_GRANTS` — the client's delegated administrative capabilities, one row per grant (#1631).
+ *
+ * Stored in the CLIENT organization, which lends them; the firm has no verb on this resource and reads what it holds on
+ * its engagement mirror. There is no generic CREATE or UPDATE: the verbs author every field, which is what makes a row
+ * evidence rather than a form.
+ *
+ * Two grant verbs rather than one with a role check inside: the ordinary `grant` is a client administrator's, the
+ * security-critical `grantSecurityCritical` is the OWNER's with step-up. Declaring each as its own variant lets the
+ * framework's role gate and step-up gate enforce the split, and the implementation refuses a capability sent to the
+ * wrong verb (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`), so an administrator can never reach a security-critical
+ * capability through the ordinary door.
+ */
+import { z } from 'zod';
+import { DelegatedAdministrativeCapability, ServiceProviderCapabilityGrantSchema, ServiceProviderCapabilityGrantStatus, ServiceProviderCapabilityGrants_Operations, } from './service-provider-capability-grants.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
+import { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas.js';
+/** What a grant request carries: the relationship, the capability and when it ends. The rest is server-authored. */
+const grantRequestDto = z.object({
+    relationshipId: z.string().min(1),
+    capability: z.enum(DelegatedAdministrativeCapability),
+    /** Required: a delegation always ends. At most two years, or the security-critical cap. */
+    endsAt: z.coerce.date(),
+});
+export const serviceProviderCapabilityGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: ServiceProviderCapabilityGrantSchema,
+    resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /**
+     * `read` / `list` are ALLOWED because the execution-context live filter reads grants on a system context to decide a
+     * caller's authority — the caller is, by construction, not yet authorized. `update` is the verbs' system door for the
+     * mirror sync and the relationship-end revocation.
+     */
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+        updateMany: ResourceSystemAccessMode.ALLOWED,
+    },
+    /** A grant holds ids, a capability, dates and a status — no personal text to scrub. Kept whole as access evidence. */
+    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },
+    /**
+     * The AUDIT_LOGS class from the moment the grant ENDS (#1613): who from outside could administer what, and when, is
+     * what an access review asks years later. `endedAt` is set on revoke and on the sweep's relabel; while ACTIVE it is
+     * null and the row never expires.
+     */
+    retentionBinding: {
+        retentionClass: DataRetentionClass.AUDIT_LOGS,
+        startPoint: RetentionStartPoint.CLOSURE_EVENT,
+        closureFieldName: 'endedAt',
+    },
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.COUNT,
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.UPDATE,
+        CoreResourceOperation.UPDATE_MANY,
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        // The retention writer's verb, and the purge cascade's DELETE — no client route.
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],
+        },
+        // The system door the verbs write through. INTERNAL_CALL registers no route.
+        [CoreResourceOperation.CREATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        [CoreResourceOperation.COUNT]: {
+            variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],
+        },
+        /**
+         * A client administrator lends one ORDINARY capability to a live relationship, for at most two years. A
+         * security-critical capability sent here is refused (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`).
+         *
+         * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — delegated administration is named, time-bound and client-revocable.
+         */
+        [ServiceProviderCapabilityGrants_Operations.GRANT]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requestDto: grantRequestDto,
+                }],
+        },
+        /**
+         * The client OWNER lends one SECURITY-CRITICAL capability, with step-up, for a task-sized window (30 days at most,
+         * or the application's lower cap). There is no renewal: a new window is a new grant by an owner.
+         *
+         * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a capability that decides who can sign in or act as the client is lent only by its owner, briefly.
+         */
+        [ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_OWNER],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requiresStepUpAuthentication: true,
+                    requestDto: grantRequestDto,
+                }],
+        },
+        /** A client administrator revokes a grant — any grant, at any time, without asking the firm. Next request. */
+        [ServiceProviderCapabilityGrants_Operations.REVOKE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({}),
+                    enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderCapabilityGrantStatus.ACTIVE,
+                }],
+        },
+        /**
+         * ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. Bookkeeping: the grant already
+         * stopped conferring at `endsAt`, which is what admission reads.
+         */
+        [ServiceProviderCapabilityGrants_Operations.EXPIRE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({}),
+                }],
+        },
+    },
+});
+//# sourceMappingURL=service-provider-capability-grants.shared.resources-config.schemas.js.map

package/dist/esm/organizations/service-provider-capability-grants.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-capability-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/organizations/service-provider-capability-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iCAAiC,EACjC,oCAAoC,EACpC,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAA6B,MAAM,uCAAuC,CAAC;AAC5I,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAWlH,oHAAoH;AACpH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;IACrD,2FAA2F;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0EAA0E,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC3I,0CAA0C,CAIxC;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,kCAAkC;IACvE,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,kCAAkC,CAAC;IAChH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB;;;;OAIG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,UAAU,EAAE,wBAAwB,CAAC,OAAO;KAC7C;IACD,sHAAsH;IACtH,eAAe,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE;IAC3D;;;;OAIG;IACH,gBAAgB,EAAE;QAChB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,UAAU,EAAE,mBAAmB,CAAC,aAAa;QAC7C,gBAAgB,EAAE,SAAS;KAC5B;IACD,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,WAAW;QACjC,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACxL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC;SACpJ;QACD,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,IAAI,EAAE,CAAC;SACpL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QACD,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE,CAAC;SAClK;QAED;;;;;WAKG;QACH,CAAC,0CAA0C,CAAC,KAAK,CAAC,EAAE;YAClD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,eAAe;iBAC5B,CAAC;SACH;QAED;;;;;WAKG;QACH,CAAC,0CAA0C,CAAC,uBAAuB,CAAC,EAAE;YACpE,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,4BAA4B,EAAE,IAAI;oBAClC,UAAU,EAAE,eAAe;iBAC5B,CAAC;SACH;QAED,8GAA8G;QAC9G,CAAC,0CAA0C,CAAC,MAAM,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,oCAAoC,CAAC,MAAM;iBAC9G,CAAC;SACH;QAED;;;WAGG;QACH,CAAC,0CAA0C,CAAC,MAAM,CAAC,EAAE;YACnD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB,CAAC;SACH;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * `SERVICE_PROVIDER_CAPABILITY_GRANTS` — the client's delegated administrative capabilities, one row per grant (#1631).\n *\n * Stored in the CLIENT organization, which lends them; the firm has no verb on this resource and reads what it holds on\n * its engagement mirror. There is no generic CREATE or UPDATE: the verbs author every field, which is what makes a row\n * evidence rather than a form.\n *\n * Two grant verbs rather than one with a role check inside: the ordinary `grant` is a client administrator's, the\n * security-critical `grantSecurityCritical` is the OWNER's with step-up. Declaring each as its own variant lets the\n * framework's role gate and step-up gate enforce the split, and the implementation refuses a capability sent to the\n * wrong verb (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`), so an administrator can never reach a security-critical\n * capability through the ordinary door.\n */\n\nimport { z } from 'zod';\nimport {\n  DelegatedAdministrativeCapability,\n  ServiceProviderCapabilityGrantSchema,\n  ServiceProviderCapabilityGrantStatus,\n  ServiceProviderCapabilityGrants_Operations,\n} from './service-provider-capability-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, type ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\nimport { DataRetentionClass, RetentionStartPoint } from '../compliance/privacy/retention-schedule.shared.schemas';\n\ntype CapabilityGrantCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.UPDATE_MANY\n  | CoreResourceOperation.DELETE;\n\n/** What a grant request carries: the relationship, the capability and when it ends. The rest is server-authored. */\nconst grantRequestDto = z.object({\n  relationshipId: z.string().min(1),\n  capability: z.enum(DelegatedAdministrativeCapability),\n  /** Required: a delegation always ends. At most two years, or the security-critical cap. */\n  endsAt: z.coerce.date(),\n});\n\nexport const serviceProviderCapabilityGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ServiceProviderCapabilityGrants_Operations,\n    CapabilityGrantCoreOperations,\n    typeof ServiceProviderCapabilityGrantSchema\n  >({\n    mainSchema: ServiceProviderCapabilityGrantSchema,\n    resourceIdentifier: CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n    /**\n     * `read` / `list` are ALLOWED because the execution-context live filter reads grants on a system context to decide a\n     * caller's authority — the caller is, by construction, not yet authorized. `update` is the verbs' system door for the\n     * mirror sync and the relationship-end revocation.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n      update: ResourceSystemAccessMode.ALLOWED,\n      updateMany: ResourceSystemAccessMode.ALLOWED,\n    },\n    /** A grant holds ids, a capability, dates and a status — no personal text to scrub. Kept whole as access evidence. */\n    retentionPolicy: { mode: ErasureRetentionMode.RETAIN_ONLY },\n    /**\n     * The AUDIT_LOGS class from the moment the grant ENDS (#1613): who from outside could administer what, and when, is\n     * what an access review asks years later. `endedAt` is set on revoke and on the sweep's relabel; while ACTIVE it is\n     * null and the row never expires.\n     */\n    retentionBinding: {\n      retentionClass: DataRetentionClass.AUDIT_LOGS,\n      startPoint: RetentionStartPoint.CLOSURE_EVENT,\n      closureFieldName: 'endedAt',\n    },\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.UPDATE_MANY,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      // The retention writer's verb, and the purge cascade's DELETE — no client route.\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [], riskLevel: ResourceOperationRiskLevel.CRITICAL }],\n      },\n      // The system door the verbs write through. INTERNAL_CALL registers no route.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{ variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.HIGH }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n      [CoreResourceOperation.COUNT]: {\n        variants: [{ variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_ORG_ROLES.ORG_ADMIN], riskLevel: ResourceOperationRiskLevel.LOW }],\n      },\n\n      /**\n       * A client administrator lends one ORDINARY capability to a live relationship, for at most two years. A\n       * security-critical capability sent here is refused (`SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB`).\n       *\n       * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — delegated administration is named, time-bound and client-revocable.\n       */\n      [ServiceProviderCapabilityGrants_Operations.GRANT]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: grantRequestDto,\n        }],\n      },\n\n      /**\n       * The client OWNER lends one SECURITY-CRITICAL capability, with step-up, for a task-sized window (30 days at most,\n       * or the application's lower cap). There is no renewal: a new window is a new grant by an owner.\n       *\n       * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a capability that decides who can sign in or act as the client is lent only by its owner, briefly.\n       */\n      [ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_OWNER],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requiresStepUpAuthentication: true,\n          requestDto: grantRequestDto,\n        }],\n      },\n\n      /** A client administrator revokes a grant — any grant, at any time, without asking the firm. Next request. */\n      [ServiceProviderCapabilityGrants_Operations.REVOKE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => currentObject.status === ServiceProviderCapabilityGrantStatus.ACTIVE,\n        }],\n      },\n\n      /**\n       * ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. Bookkeeping: the grant already\n       * stopped conferring at `endsAt`, which is what admission reads.\n       */\n      [ServiceProviderCapabilityGrants_Operations.EXPIRE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n        }],\n      },\n    },\n  });\n"]}

package/dist/esm/organizations/service-provider-capability-grants.shared.schemas.d.ts

@@ -0,0 +1,229 @@
+/**
+ * Delegated administrative capabilities (#1631) — a CLIENT organization lends one service firm's experts a NAMED,
+ * narrow, time-bound administrative capability, without ever making the firm an administrator.
+ *
+ * ## The shape, and why capabilities are ROLES
+ *
+ * Paul (2026-09-25, #1597 Q2): never admin by default; narrow, time-limited, client-revocable delegation; a
+ * security-critical capability needs the client's OWNER, is time-bound, and is never renewed automatically. Issue
+ * #1631 records the practice this follows (Microsoft's granular delegated admin privileges for partners, with a
+ * time-bound relationship that cannot be auto-extended for the highest role) with its sources; nothing here quotes
+ * them.
+ *
+ * A capability is a NAMED ROLE in the organization role table, one per {@link DelegatedAdministrativeCapability},
+ * inheriting from nothing, and listed EXPLICITLY — beside `ORG_ADMIN` — in the `roles` of exactly the core operations
+ * it opens. The rejected alternative (review F7) was an operation-id allow-list per grant: a second authority beside
+ * role resolution that the ~20 `initiatorRoles` readers and the role ceiling would not know about.
+ *
+ * ## Grants are rows, filtered live
+ *
+ * `SERVICE_PROVIDER_CAPABILITY_GRANTS` rows live in the CLIENT organization. The execution-context live filter that
+ * decides whether a provider membership confers anything (#1597) reads the relationship's grants in the same pass and
+ * adds a capability's role to the expert's entries only while {@link isServiceProviderCapabilityGrantConferring}
+ * holds — ACTIVE and `endsAt` still in the future. `EXPIRED` is sweep bookkeeping: admission reads `endsAt`.
+ *
+ * ## What delegation never does
+ *
+ * No capability confers `ORG_ADMIN` or `ORG_OWNER`, accepts a relationship, amends its scope, delegates further, or
+ * counts toward the owner floor (provider memberships never do). Startup refuses a capability role whose `inheritFrom`
+ * chain reaches an administration anchor.
+ */
+import { z } from 'zod';
+import { CORE_ORG_ROLES } from '../security/authorizations/roles.shared.schemas';
+/** @wildo_source:part:start saas.models.organizations.service-provider-capability-grants facet:layer:shared facet:audience:app-developer */
+/**
+ * The closed set of administrative capabilities a client may lend a service firm (#1631). Each is ONE role
+ * ({@link DELEGATED_CAPABILITY_ROLE}); a grant names one capability.
+ */
+export declare enum DelegatedAdministrativeCapability {
+    /** Invite people into the client, resend an invitation, revoke one. */
+    INVITE_MEMBERS = "INVITE_MEMBERS",
+    /**
+     * Suspend or remove the firm's OWN experts under this relationship — never an ordinary member, never another firm's.
+     * Deliberately not reactivate: lifting a suspension would let the firm undo the client's bar against one person (#1597).
+     */
+    MANAGE_RELATIONSHIP_EXPERTS = "MANAGE_RELATIONSHIP_EXPERTS",
+    /** Read the client organization's audit trail. */
+    READ_AUDIT_TRAIL = "READ_AUDIT_TRAIL",
+    /** Configure the client's single sign-on and SCIM provisioning. Security-critical. */
+    MANAGE_SSO_SCIM = "MANAGE_SSO_SCIM",
+    /** Manage the client organization's API keys. Security-critical. */
+    MANAGE_API_KEYS = "MANAGE_API_KEYS",
+    /** Approve or deny, as the tenant, a platform operator's request to access the client. Security-critical. */
+    APPROVE_ACCESS_GRANTS = "APPROVE_ACCESS_GRANTS"
+}
+/**
+ * The role each capability confers — the ONE mapping, total over the enum, so a capability added tomorrow is a compile
+ * error here rather than a grant that confers nothing.
+ */
+export declare const DELEGATED_CAPABILITY_ROLE: Readonly<Record<DelegatedAdministrativeCapability, CORE_ORG_ROLES>>;
+/** Every capability role — conferred ONLY by a live grant, never by a membership row (the member role doors refuse them). */
+export declare const DELEGATED_CAPABILITY_ROLES: ReadonlySet<string>;
+/** Whether `role` is one only a live capability grant may confer. */
+export declare function isDelegatedCapabilityRole(role: string): boolean;
+/**
+ * Whether an organization MEMBERSHIP may hold `role` at all, whatever its organization's type (#1921): not a
+ * handler-only role (an engine inbound handler's alone, #1629) and not a delegated capability role (a live grant's alone,
+ * #1631). The ONE statement of that rule for every surface that offers or names a role a person holds — the published
+ * role table a picker offers, and a setting that names one role (`contentReaderRole`). The membership write door
+ * (`validateOrgMemberRoles`) refuses each of the two kinds with its own reason; a kind added here must be refused there too.
+ */
+export declare function roleMayBeHeldByMembership(role: string): boolean;
+/**
+ * Capabilities that change who can authenticate into, or act as, the client: only the client's OWNER grants them,
+ * with step-up, for a task-sized window ({@link SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS} at most), and a renewal is
+ * a new grant — there is no `autoRenew`.
+ */
+export declare const SECURITY_CRITICAL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[];
+/**
+ * Capabilities that need an ORGANIZATION-WIDE relationship: refused at grant time on a relationship confined to
+ * organization units, because a unit-scoped relationship has no organization-wide entry (#1597 F5) to carry them.
+ *
+ * Every capability is here, and that is measured rather than assumed: each one opens operations on resources that do
+ * not narrow by organization unit (members, audit logs, SSO / SCIM, API keys, platform access grants), and the role gate
+ * on those counts only organization-wide entries. A capability granted on a unit-scoped relationship would therefore
+ * be audited, mirrored to the firm as held, and confer nothing — a grant that lies. The list stays a list (rather than
+ * a blanket rule) so a future capability that opens a unit-narrowable operation can be left off it deliberately.
+ */
+export declare const ORGANIZATION_LEVEL_DELEGATED_CAPABILITIES: readonly DelegatedAdministrativeCapability[];
+/** The longest an ordinary capability may be granted for: two years, GDAP's relationship maximum. */
+export declare const DELEGATED_CAPABILITY_MAX_DAYS = 730;
+/**
+ * The longest a security-critical capability may be granted for, unless the application declares a lower cap
+ * (`acceptsServiceProviders.securityCriticalCapabilityMaxDays`). A reversible default chosen for #1631 — a task-sized
+ * window, far below the relationship maximum — NOT a figure taken from GDAP.
+ */
+export declare const SECURITY_CRITICAL_CAPABILITY_DEFAULT_MAX_DAYS = 30;
+/** Where one grant stands. */
+export declare enum ServiceProviderCapabilityGrantStatus {
+    /** Granted and not revoked. Confers only while `endsAt` is still in the future. */
+    ACTIVE = "ACTIVE",
+    /** A client administrator revoked it, or the relationship ended. Terminal. */
+    REVOKED = "REVOKED",
+    /** The sweep relabelled it after `endsAt`. Terminal bookkeeping — admission never reads this label. */
+    EXPIRED = "EXPIRED"
+}
+/** Why a grant stopped conferring before its term — what a REVOKED audit row records (#1631 review F10). */
+export declare enum ServiceProviderCapabilityGrantEndCause {
+    /** A client administrator revoked it. */
+    REVOKED_BY_CLIENT = "REVOKED_BY_CLIENT",
+    /** Its relationship ended (terminated, withdrawn, expired, declined, or a party removed). */
+    RELATIONSHIP_ENDED = "RELATIONSHIP_ENDED",
+    /** Its relationship was narrowed to organization units, which cannot carry any capability. */
+    RELATIONSHIP_NARROWED = "RELATIONSHIP_NARROWED"
+}
+/** The client's verbs on its grants. The firm has none: it can never grant, widen or extend. */
+export declare enum ServiceProviderCapabilityGrants_Operations {
+    /** Client ORG_ADMIN lends an ORDINARY capability, for at most two years. */
+    GRANT = "grant",
+    /** Client ORG_OWNER lends a SECURITY-CRITICAL capability, with step-up, for a task-sized window. */
+    GRANT_SECURITY_CRITICAL = "grantSecurityCritical",
+    /** Client ORG_ADMIN revokes any grant, at any time, without asking the firm. Takes effect on the next request. */
+    REVOKE = "revoke",
+    /** ACTIVE → EXPIRED past `endsAt`, dispatched by the credential-expiry sweep only. */
+    EXPIRE = "expire"
+}
+/** The client-branchable codes a refused grant carries (409: authorized caller, valid payload, the STATE forbids it). */
+export declare enum ServiceProviderCapabilityGrantErrorCode {
+    /** The relationship is not ACTIVE (or SUSPENDED) — nothing can be lent to a relationship that confers nothing. */
+    SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE = "SERVICE_PROVIDER_CAPABILITY_RELATIONSHIP_NOT_LIVE",
+    /** A security-critical capability through the ordinary `grant`, or an ordinary one through the owner's verb. */
+    SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB = "SERVICE_PROVIDER_CAPABILITY_WRONG_GRANT_VERB",
+    /** `endsAt` beyond the cap for this capability, or not in the future. */
+    SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED = "SERVICE_PROVIDER_CAPABILITY_TERM_NOT_ALLOWED",
+    /** An organization-level capability on a relationship confined to organization units. */
+    SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP = "SERVICE_PROVIDER_CAPABILITY_REQUIRES_ORGANIZATION_WIDE_RELATIONSHIP",
+    /** An ACTIVE grant of this capability already exists on this relationship; revoke it first (a renewal is a new grant). */
+    SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED = "SERVICE_PROVIDER_CAPABILITY_ALREADY_GRANTED",
+    /** MANAGE_RELATIONSHIP_EXPERTS used on a membership that is not an expert of the SAME relationship. */
+    SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP = "SERVICE_PROVIDER_CAPABILITY_TARGET_OUTSIDE_RELATIONSHIP"
+}
+/** @wildo_source:part:end saas.models.organizations.service-provider-capability-grants */
+/**
+ * Does this grant confer its capability RIGHT NOW? The ONE predicate the live filter uses: ACTIVE, and `endsAt` in the
+ * future. `endsAt` is read here rather than trusting the EXPIRED label, so a grant stops working the moment its term
+ * passes whether or not the sweep has run (invariant 1).
+ */
+export declare function isServiceProviderCapabilityGrantConferring(grant: {
+    readonly status?: unknown;
+    readonly endsAt?: Date | string | null;
+} | null | undefined, now: Date): boolean;
+/**
+ * May this capability be lent on this relationship, until `endsAt`, through this verb? (#1631 invariants 3 and 5)
+ *
+ * The one rule both grant verbs apply. Pure: the caller supplies the relationship's scope and the application's
+ * declared cap. Fails closed on anything it cannot prove.
+ */
+export declare function resolveServiceProviderCapabilityGrantTerms(input: {
+    readonly capability: DelegatedAdministrativeCapability;
+    readonly verb: ServiceProviderCapabilityGrants_Operations.GRANT | ServiceProviderCapabilityGrants_Operations.GRANT_SECURITY_CRITICAL;
+    readonly endsAt: Date;
+    readonly now: Date;
+    /** The relationship's `organizationUnitIds`: non-empty ⇒ unit-scoped. */
+    readonly relationshipOrganizationUnitIds?: readonly string[] | null;
+    /** The client organization type's declared `acceptsServiceProviders.securityCriticalCapabilityMaxDays`. */
+    readonly declaredSecurityCriticalMaxDays?: number;
+}): {
+    readonly allowed: true;
+} | {
+    readonly allowed: false;
+    readonly code: ServiceProviderCapabilityGrantErrorCode;
+};
+/**
+ * One grant, stored in the CLIENT organization. Every field is server-authored: the verbs write them, and there is no
+ * generic CREATE or UPDATE.
+ */
+export declare const ServiceProviderCapabilityGrantSchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    relationshipId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
+    providerOrganizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    capability: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DelegatedAdministrativeCapability>>>>>>;
+    endsAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDate>>>>>;
+    status: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof ServiceProviderCapabilityGrantStatus>>>>>>>>;
+    grantedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    grantedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    revokedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>;
+    revokedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    endedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, z.core.$strip>;
+export type ServiceProviderCapabilityGrant = z.infer<typeof ServiceProviderCapabilityGrantSchema>;
+/** One capability the firm holds in a client, as its engagement mirror shows it. */
+export declare const ServiceEngagementDelegatedCapabilitySchema: z.ZodObject<{
+    capability: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof DelegatedAdministrativeCapability>>;
+    endsAt: z.ZodDate;
+}, z.core.$strip>;
+export type ServiceEngagementDelegatedCapability = z.infer<typeof ServiceEngagementDelegatedCapabilitySchema>;
+/** Why the organization role table was refused at startup for a delegated capability role (#1631). */
+export declare enum DelegatedCapabilityRoleViolationKind {
+    /** The capability role is not in the organization role table at all — a grant of it would confer nothing, silently. */
+    CAPABILITY_ROLE_UNDECLARED = "CAPABILITY_ROLE_UNDECLARED",
+    /** The role's `inheritFrom` chain reaches an administration anchor (ORG_ADMIN / ORG_OWNER): lending it would make the firm an administrator. */
+    CAPABILITY_ROLE_REACHES_ADMINISTRATION = "CAPABILITY_ROLE_REACHES_ADMINISTRATION",
+    /**
+     * Another organization role inherits the capability role: every holder of that role would carry the capability
+     * standing, with no grant row, no term and no revocation. A capability is conferred only by a live grant.
+     */
+    CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE = "CAPABILITY_ROLE_INHERITED_BY_ANOTHER_ROLE"
+}
+/**
+ * Validate every delegated capability role against the LIVE organization role table (#1631 invariant 2). An application
+ * may override the engine's role definitions, so the check runs on the table the authorizer actually uses: a capability
+ * role redefined to inherit from `ORG_ADMIN` (or anything that leads there) is refused at boot, exactly as a provider
+ * role that reaches `ORG_ADMIN` is.
+ */
+export declare function collectDelegatedCapabilityRoleViolations(input: {
+    /** The role's `inheritFrom` walk in the ORGANIZATIONS table, the role itself included; empty ⇒ undeclared. */
+    readonly organizationRoleHierarchy: (role: string) => readonly string[];
+    readonly administrationAnchorRoles: readonly string[];
+    /** Every key of the LIVE organization role table, so a role that inherits a capability role can be found. */
+    readonly organizationRoles?: readonly string[];
+}): {
+    capability: DelegatedAdministrativeCapability;
+    role: string;
+    kind: DelegatedCapabilityRoleViolationKind;
+    inheritedBy?: string;
+}[];
+//# sourceMappingURL=service-provider-capability-grants.shared.schemas.d.ts.map

package/dist/esm/organizations/service-provider-capability-grants.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-capability-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/organizations/service-provider-capability-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA4B,MAAM,iDAAiD,CAAC;AAE3G,4IAA4I;AAC5I;;;GAGG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,cAAc,mBAAmB;IACjC;;;OAGG;IACH,2BAA2B,gCAAgC;IAC3D,kDAAkD;IAClD,gBAAgB,qBAAqB;IACrC,sFAAsF;IACtF,eAAe,oBAAoB;IACnC,oEAAoE;IACpE,eAAe,oBAAoB;IACnC,6GAA6G;IAC7G,qBAAqB,0BAA0B;CAChD;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,iCAAiC,EAAE,cAAc,CAAC,CAOxG,CAAC;AAEH,6HAA6H;AAC7H,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAA6D,CAAC;AAEzH,qEAAqE;AACrE,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,EAAE,SAAS,iCAAiC,EAI/F,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,yCAAyC,EAAE,SAAS,iCAAiC,EAOhG,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AACjD;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAEhE,8BAA8B;AAC9B,oBAAY,oCAAoC;IAC9C,mFAAmF;IACnF,MAAM,WAAW;IACjB,8EAA8E;IAC9E,OAAO,YAAY;IACnB,uGAAuG;IACvG,OAAO,YAAY;CACpB;AAED,4GAA4G;AAC5G,oBAAY,sCAAsC;IAChD,yCAAyC;IACzC,iBAAiB,sBAAsB;IACvC,6FAA6F;IAC7F,kBAAkB,uBAAuB;IACzC,8FAA8F;IAC9F,qBAAqB,0BAA0B;CAChD;AAED,gGAAgG;AAChG,oBAAY,0CAA0C;IACpD,4EAA4E;IAC5E,KAAK,UAAU;IACf,oGAAoG;IACpG,uBAAuB,0BAA0B;IACjD,kHAAkH;IAClH,MAAM,WAAW;IACjB,sFAAsF;IACtF,MAAM,WAAW;CAClB;AAED,yHAAyH;AACzH,oBAAY,uCAAuC;IACjD,kHAAkH;IAClH,iDAAiD,sDAAsD;IACvG,gHAAgH;IAChH,4CAA4C,iDAAiD;IAC7F,yEAAyE;IACzE,4CAA4C,iDAAiD;IAC7F,yFAAyF;IACzF,mEAAmE,wEAAwE;IAC3I,0HAA0H;IAC1H,2CAA2C,gDAAgD;IAC3F,uGAAuG;IACvG,uDAAuD,4DAA4D;CACpH;AACD,0FAA0F;AAE1F;;;;GAIG;AACH,wBAAgB,0CAA0C,CACxD,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EAC/F,GAAG,EAAE,IAAI,GACR,OAAO,CAKT;AAID;;;;;GAKG;AACH,wBAAgB,0CAA0C,CAAC,KAAK,EAAE;IAChE,QAAQ,CAAC,UAAU,EAAE,iCAAiC,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,0CAA0C,CAAC,KAAK,GAAG,0CAA0C,CAAC,uBAAuB,CAAC;IACrI,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,yEAAyE;IACzE,QAAQ,CAAC,+BAA+B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACpE,2GAA2G;IAC3G,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;CACnD,GACG;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,uCAAuC,CAAA;CAAE,CAiBtF;AAED;;;GAGG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;iBAwC/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,0CAA0C;;;iBAIrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,sGAAsG;AACtG,oBAAY,oCAAoC;IAC9C,uHAAuH;IACvH,0BAA0B,+BAA+B;IACzD,gJAAgJ;IAChJ,sCAAsC,2CAA2C;IACjF;;;OAGG;IACH,yCAAyC,8CAA8C;CACxF;AAED;;;;;GAKG;AACH,wBAAgB,wCAAwC,CAAC,KAAK,EAAE;IAC9D,8GAA8G;IAC9G,QAAQ,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;IACxE,QAAQ,CAAC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,6GAA6G;IAC7G,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD,GAAG;IAAE,UAAU,EAAE,iCAAiC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,oCAAoC,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,CAmBtI"}