@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.js

@@ -4,18 +4,21 @@
  * Resource configuration for managing organization-scoped registered OAuth
  * clients. FAITHFUL MIRROR of `api-keys-organization.shared.resources-config.schemas.ts`
  * with a FOCUSED operation set: core READ/LIST/SEARCH/CREATE/DELETE/COUNT plus
- * custom ROTATE/REGENERATE. The DEACTIVATE/REACTIVATE/EXTEND_EXPIRY/USAGE_STATS
- * custom ops from api-keys are intentionally deferred to the OIDC branch.
+ * custom ROTATE/REGENERATE, the operator pair DEACTIVATE/REACTIVATE (#1028) and the
+ * sweep-driven EXPIRE. EXTEND_EXPIRY and USAGE_STATS from api-keys are not ported: a
+ * client's validity is fixed at registration, and no usage accounting is recorded for clients.
  */
 import { z } from 'zod';
 import { OAuthClientOrganizationSchema, OAuthClientStatus, } from './oauth-clients.shared.schemas.js';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions.js';
-import { ResourceOperationRiskLevel } from '../../resources/resources.shared.schemas.js';
+import { ResourceOperationRiskLevel, ResourceOperationReversibility } from '../../resources/resources.shared.schemas.js';
 import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { createResourcesFilterPresenceSchema } from '../../resources/resources-config.shared.schemas.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas.js';
+import { AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX, AutonomousAgentRefSchema } from '../../flows-actors/autonomous-agents.shared.schemas.js';
 // Sort and filter fields for organization OAuth clients
 const ORG_OAUTH_CLIENTS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'];
 // Org members get basic filter fields
@@ -23,7 +26,9 @@ const ORG_OAUTH_CLIENTS_FILTER_FIELDS = {
     status: z.enum(OAuthClientStatus),
     name: z.string(),
     organizationId: z.string(),
-    hasExpiration: z.boolean(),
+    // "Has an expiry", i.e. `expiresAt` is set. Declared as a plain boolean it was passed to the database
+    // as a field no row has, and matched nothing (#1806); the presence filter carries its target.
+    hasExpiration: createResourcesFilterPresenceSchema('expiresAt'),
 };
 // App Admin gets enhanced filter fields with additional capabilities
 const ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS = {
@@ -40,7 +45,10 @@ export var OrgOAuthClients_Operations;
 (function (OrgOAuthClients_Operations) {
     OrgOAuthClients_Operations["ROTATE"] = "rotate";
     OrgOAuthClients_Operations["REGENERATE"] = "regenerate";
+    OrgOAuthClients_Operations["DEACTIVATE"] = "deactivate";
+    OrgOAuthClients_Operations["REACTIVATE"] = "reactivate";
     OrgOAuthClients_Operations["EXPIRE"] = "expire";
+    OrgOAuthClients_Operations["SET_AUTONOMOUS_AGENTS"] = "setAutonomousAgents";
 })(OrgOAuthClients_Operations || (OrgOAuthClients_Operations = {}));
 /*
 Organization OAuth Clients Resource Configuration Factory
@@ -116,7 +124,7 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     // requestDto auto-derived from decorators
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral()
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.")
                     }),
                 },
                 {
@@ -133,7 +141,7 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     // DOES receive the plaintext so they can relay it to the org. Mirror of
                     // the default variant's `customResponseDto` above — keep in sync.
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral()
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.")
                     }),
                 }
             ],
@@ -195,6 +203,12 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.LOW,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`
                     // and the paired prefix implementation forces the status transition itself, so there is no field
@@ -205,6 +219,116 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                 }
             ],
         },
+        /**
+         * ACTIVE → INACTIVE, the operator's suspension door (#1028). Until it existed the only ways to
+         * stop a registered client were regenerating its secret — rotation, not suspension, and it
+         * hands the caller a new credential to distribute — or waiting for `expiresAt`.
+         *
+         * WHAT IT STOPS, stated so the contract does not imply instant revocation: the direct-secret
+         * path re-reads the client and requires ACTIVE, and so does every new token mint. A
+         * client-credentials JWT already minted is NOT re-checked against the client until it expires,
+         * so deactivation ends new access and leaves an issued token to run out its own lifetime.
+         *
+         * The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE selects the
+         * core path that persists; it must NOT also hand the caller UPDATE's request contract — this
+         * resource exposes no core UPDATE, and an auto-derived one would let `PUT .../deactivate` carry
+         * `status: active` or rewrite `roles` past the mint-time ceiling. `status` is forced by the
+         * paired prefix implementation (`oauth-clients.custom-impl.backend.service.ts`), whose
+         * ACTIVE-only precondition is the real enforcement; `enabledCondition` is a display affordance
+         * and the cross-tenant `admin` variant carries none.
+         */
+        [OrgOAuthClients_Operations.DEACTIVATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate clients
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({}),
+                    enabledCondition: ({ currentObject }) => {
+                        return currentObject.status === OAuthClientStatus.ACTIVE;
+                    }
+                },
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: false,
+                    variantKey: "admin",
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org clients
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    auditableEvent: { auditBelowRiskFloor: true },
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // Per-variant DTOs are NOT inherited from the default variant — each variant builds
+                    // its own, so this cross-tenant variant needs its own narrowing or it re-derives the
+                    // full UPDATE contract. It also carries NO `enabledCondition`, so the transition
+                    // precondition is enforced solely by the prefix implementation's 409 guard.
+                    requestDto: z.object({}),
+                }
+            ],
+            userNotifications: [
+                {
+                    target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,
+                    channel: CoreUserNotificationChannel.EMAIL,
+                },
+                {
+                    target: CoreUserNotificationTarget.USER_SELF,
+                    channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,
+                }
+            ]
+        },
+        /**
+         * INACTIVE → ACTIVE, lifting a suspension. An EXPIRED client is NOT revivable: its expiry was
+         * the thing retiring it, and the prefix implementation refuses with 409 so a status flip cannot
+         * undo a validity window. See DEACTIVATE for why the request contract is empty.
+         */
+        [OrgOAuthClients_Operations.REACTIVATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate clients
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({}),
+                    enabledCondition: ({ currentObject }) => {
+                        return currentObject.status === OAuthClientStatus.INACTIVE;
+                    }
+                },
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: false,
+                    variantKey: "admin",
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org clients
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    auditableEvent: { auditBelowRiskFloor: true },
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    // See DEACTIVATE's `admin` variant: its own narrowing, and no `enabledCondition`.
+                    requestDto: z.object({}),
+                }
+            ],
+            userNotifications: [
+                {
+                    target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,
+                    channel: CoreUserNotificationChannel.EMAIL,
+                },
+                {
+                    target: CoreUserNotificationTarget.USER_SELF,
+                    channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,
+                }
+            ]
+        },
         [OrgOAuthClients_Operations.ROTATE]: {
             variants: [
                 {
@@ -212,6 +336,9 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     isDefault: true,
                     roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate secrets
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // IRREVERSIBLE: Replaces the client secret; the previous value is not stored in recoverable form.
+                    // This is what admits it to the danger zone; risk alone no longer does.
+                    reversibility: ResourceOperationReversibility.IRREVERSIBLE,
                     // ROTATE is a secret handback plus a caller-chosen cutover. The default
                     // invalidation boundary is now, while a future boundary creates a bounded
                     // overlap. Once that boundary passes, the previous secret cannot be
@@ -227,12 +354,12 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     requiresStepUpAuthentication: true,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({
-                        oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())
+                        oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe("When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so the client can switch over.")
                     }),
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral(),
-                        oldClientId: z.string(),
-                        oldSecretInvalidationDate: z.date()
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint."),
+                        oldClientId: z.string().describe("The id of the client whose secret was rotated. Rotation reissues the secret on the same client, so this is the client's own id."),
+                        oldSecretInvalidationDate: z.date().describe("When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.")
                     }),
                 },
                 {
@@ -270,12 +397,12 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     //    plaintext so they can relay it to the org.
                     // Keep both in sync with the default variant above.
                     requestDto: z.object({
-                        oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())
+                        oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe("When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so the client can switch over.")
                     }),
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral(),
-                        oldClientId: z.string(),
-                        oldSecretInvalidationDate: z.date()
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint."),
+                        oldClientId: z.string().describe("The id of the client whose secret was rotated. Rotation reissues the secret on the same client, so this is the client's own id."),
+                        oldSecretInvalidationDate: z.date().describe("When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.")
                     }),
                 }
             ],
@@ -320,7 +447,7 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on client credentials.
                     requestDto: z.object({}),
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral(),
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint."),
                     }),
                 },
                 {
@@ -349,7 +476,7 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     // cross-tenant variant cannot rewrite `redirectUris` / `roles` through "regenerate".
                     requestDto: z.object({}),
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral(),
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint."),
                     }),
                 }
             ],
@@ -360,6 +487,54 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                 }
             ]
         },
+        /**
+         * Replace the set of application-declared autonomous agents this client runs as (#1611). Adding a ref
+         * lets a schedule tick or an inbound delivery start that agent's turns in this organization under this
+         * client's roles, with nobody on a socket; removing it stops the next turn and any decision still
+         * waiting (the principal is re-read before a decision resumes).
+         *
+         * The REQUEST carries the whole list; the paired prefix (`oauth-client-autonomous-agents.custom-impl.backend.service.ts`)
+         * validates each ref against the application's declared autonomous agents, refuses a client that is not
+         * ACTIVE or was registered dynamically, and — serialized on the organization row — refuses a ref another
+         * client of the organization already carries, so at most one client runs a given agent here. The value
+         * the prefix returns is authoritative, so nothing the caller sends is persisted unvalidated.
+         *
+         * Organization administrators only, and deliberately NO cross-tenant `admin` variant: a platform operator
+         * giving an agent authority inside a tenant is the standing reach the platform refuses (Paul, 2026-09-25).
+         *
+         * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a machine credential gains an autonomous agent only by an administrator of its own organization.
+         */
+        [OrgOAuthClients_Operations.SET_AUTONOMOUS_AGENTS]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A permission change: the credential gains or loses standing authority to act unattended. Below the
+                    // automatic audit floor by risk, so the evidence axis opts in, as DEACTIVATE does. The dedicated
+                    // AUTONOMOUS_AGENT_BOUND / _UNBOUND rows name each ref; this row names the operation.
+                    auditableEvent: { auditBelowRiskFloor: true },
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({
+                        autonomousAgentRefs: z.array(AutonomousAgentRefSchema).max(AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX)
+                            .describe("Every autonomous agent this client should run as, replacing the current list. Each must be an agent the application declares, and no other client of this organization may already run it. An empty list stops all of them."),
+                    }),
+                    // No `enabledCondition`: REMOVING refs must stay possible on an INACTIVE or EXPIRED client, whose
+                    // binding still holds the ref in this organization. The prefix requires ACTIVE only to ADD one.
+                },
+            ],
+            userNotifications: [
+                {
+                    target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,
+                    channel: CoreUserNotificationChannel.EMAIL,
+                },
+                {
+                    target: CoreUserNotificationTarget.USER_SELF,
+                    channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,
+                }
+            ]
+        },
         [CoreResourceOperation.SEARCH]: {
             variants: [
                 {
@@ -381,7 +556,9 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.LOW,
                     isSearchable: true,
-                    searchableFields: ['name', 'description', 'clientId'],
+                    // No `clientId` field exists (#1952), and a client's id is its `_id`, which cannot be text-searched: MongoDB
+                    // stores it as an ObjectId and refuses a regex on it. Finding one client by id is a READ.
+                    searchableFields: ['name', 'description'],
                     searchableOptions: { caseSensitive: false, fullMatchOnly: false },
                     filterFields: ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS,
                     sortFields: ORG_OAUTH_CLIENTS_ADMIN_SORT_FIELDS,

package/dist/esm/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAA8C,MAAM,0CAA0C,CAAC;AAClI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,wDAAwD;AACxD,MAAM,6BAA6B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAE7G,sCAAsC;AACtC,MAAM,+BAA+B,GAAG;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;CAC3B,CAAC;AAEF,qEAAqE;AACrE,MAAM,qCAAqC,GAAG;IAC5C,GAAG,+BAA+B;IAClC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,mCAAmC,GAAG,CAAC,GAAG,6BAA6B,EAAE,QAAQ,CAAU,CAAC;AAElG,wDAAwD;AACxD,MAAM,CAAN,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,+CAAiB,CAAA;IACjB,uDAAyB,CAAA;IACzB,+CAAiB,CAAA;AACnB,CAAC,EAJW,0BAA0B,KAA1B,0BAA0B,QAIrC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAItK;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,wDAAwD;IAEhF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,0BAA0B;IAE3C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,gEAAgE;oBAChE,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;oBAClE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,yEAAyE;oBACzE,0EAA0E;oBAC1E,0EAA0E;oBAC1E,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED;;;;;;;;;;WAUG;QACH,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,wEAAwE;oBACxE,oEAAoE;oBACpE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAChI,CAAC;oBACF,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;wBACvB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpC,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,wEAAwE;oBACxE,oEAAoE;oBACpE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,WAAW;oBACX,+DAA+D;oBAC/D,wEAAwE;oBACxE,sEAAsE;oBACtE,0EAA0E;oBAC1E,6CAA6C;oBAC7C,oEAAoE;oBACpE,2EAA2E;oBAC3E,yEAAyE;oBACzE,oEAAoE;oBACpE,gDAAgD;oBAChD,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAChI,CAAC;oBACF,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;wBACvB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,yCAAyC;oBAC5E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,iFAAiF;oBACjF,uEAAuE;oBACvE,iFAAiF;oBACjF,qFAAqF;oBACrF,mFAAmF;oBACnF,uEAAuE;oBACvE,+EAA+E;oBAC/E,wEAAwE;oBACxE,0BAA0B;oBAC1B,2FAA2F;oBAC3F,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,4CAA4C;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,wEAAwE;oBACxE,sEAAsE;oBACtE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,qFAAqF;oBACrF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,+BAA+B;oBAC7C,UAAU,EAAE,6BAA6B;oBACzC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC;oBACrD,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,qCAAqC;oBACnD,UAAU,EAAE,mCAAmC;oBAC/C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization OAuth Clients Shared Resource Configuration\n *\n * Resource configuration for managing organization-scoped registered OAuth\n * clients. FAITHFUL MIRROR of `api-keys-organization.shared.resources-config.schemas.ts`\n * with a FOCUSED operation set: core READ/LIST/SEARCH/CREATE/DELETE/COUNT plus\n * custom ROTATE/REGENERATE. The DEACTIVATE/REACTIVATE/EXTEND_EXPIRY/USAGE_STATS\n * custom ops from api-keys are intentionally deferred to the OIDC branch.\n */\n\nimport { z } from 'zod';\nimport {\n  OAuthClientOrganizationSchema,\n  OAuthClientStatus,\n} from './oauth-clients.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for organization OAuth clients\nconst ORG_OAUTH_CLIENTS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// Org members get basic filter fields\nconst ORG_OAUTH_CLIENTS_FILTER_FIELDS = {\n  status: z.enum(OAuthClientStatus),\n  name: z.string(),\n  organizationId: z.string(),\n  hasExpiration: z.boolean(),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS = {\n  ...ORG_OAUTH_CLIENTS_FILTER_FIELDS,\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n  createdAt: z.date(), // Admin can filter by creation date\n  updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_OAUTH_CLIENTS_ADMIN_SORT_FIELDS = [...ORG_OAUTH_CLIENTS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization OAuth clients\nexport enum OrgOAuthClients_Operations {\n  ROTATE = 'rotate', // Generate new secret and invalidate old one\n  REGENERATE = 'regenerate', // Generate new secret without invalidating old one\n  EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n}\n\ntype OrgOAuthClientsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.COUNT;\n\n/*\nOrganization OAuth Clients Resource Configuration Factory\n*/\nexport const orgOAuthClientsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof OrgOAuthClients_Operations,\n  OrgOAuthClientsCoreOperations,\n  typeof OAuthClientOrganizationSchema\n>({\n  mainSchema: OAuthClientOrganizationSchema,\n  resourceIdentifier: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.OAUTH_CLIENTS_ORGANIZATION],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Organization OAuth clients are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.DELETE,\n    CoreResourceOperation.COUNT,\n  ],\n\n  customOperation: OrgOAuthClients_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.COUNT]: {\n      variants: [\n        {\n          // Feature usage accounting counts org OAuth clients through the\n          // repository layer. This operation does not need public HTTP exposure.\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Organization admins can view\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see clients\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create clients\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral()\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` and silently strips the one-time `plainSecret` (it exists\n          // nowhere else after this response — only its SHA-256 hash is persisted).\n          // Security decision: an app-super-admin creating a client for another org\n          // DOES receive the plaintext so they can relay it to the org. Mirror of\n          // the default variant's `customResponseDto` above — keep in sync.\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can delete clients\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          haveBulkOperation: true,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org clients\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          haveBulkOperation: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    /**\n     * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n     * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n     * the sweep is the only caller, and there is no reason for a human to declare that a date has\n     * passed.\n     *\n     * It exists so the sweep writes through a guarded door rather than setting `status` directly.\n     * The ACTIVE-only precondition lives in the paired prefix implementation\n     * (`oauth-clients.custom-impl.backend.service.ts`) — an INACTIVE client was retired by an\n     * administrator, and relabelling it EXPIRED would erase who ended it.\n     */\n    [OrgOAuthClients_Operations.EXPIRE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n          // and the paired prefix implementation forces the status transition itself, so there is no field\n          // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n          // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n          // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n          requestDto: z.object({}),\n        }\n      ],\n    },\n\n    [OrgOAuthClients_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate secrets\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // ROTATE is a secret handback plus a caller-chosen cutover. The default\n          // invalidation boundary is now, while a future boundary creates a bounded\n          // overlap. Once that boundary passes, the previous secret cannot be\n          // restored. An unauthorized caller also walks away with the replacement\n          // credential, so a live session alone is deliberately insufficient.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral(),\n            oldClientId: z.string(),\n            oldSecretInvalidationDate: z.date()\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org clients\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // ROTATE is a secret handback plus a caller-chosen cutover. The default\n          // invalidation boundary is now, while a future boundary creates a bounded\n          // overlap. Once that boundary passes, the previous secret cannot be\n          // restored. An unauthorized caller also walks away with the replacement\n          // credential, so a live session alone is deliberately insufficient.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Request AND response both MIRROR the org-admin\n          // default:\n          //  - requestDto: an app-super-admin can choose the same future\n          //    `oldSecretInvalidationDate` window as an org admin. Without it the\n          //    admin variant would build no request DTO and the impl could only\n          //    default the invalidation to now — silently denying the future-window\n          //    capability the default variant exposes.\n          //  - customResponseDto: without it the admin response falls back to\n          //    `mainSchema` and silently strips the one-time `plainSecret` (plus the\n          //    rotated-out client's id + invalidation date). Security decision: an\n          //    app-super-admin rotating another org's client DOES receive the\n          //    plaintext so they can relay it to the org.\n          // Keep both in sync with the default variant above.\n          requestDto: z.object({\n            oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral(),\n            oldClientId: z.string(),\n            oldSecretInvalidationDate: z.date()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [OrgOAuthClients_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate secrets\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldSecretInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedSecret, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `redirectUris`, `allowedScopes`, `allowedGrants` and `roles` would all\n          // be writable through \"regenerate\". This resource exposes NO core UPDATE, so those\n          // fields are meant to be immutable after minting, and the ceiling gate\n          // (`assertRequestedRolesWithinCallerCeiling`) runs in the CREATE handler only.\n          // A rewritable `redirectUris` on a secret-reissue route is an auth-code\n          // exfiltration primitive.\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on client credentials.\n          requestDto: z.object({}),\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral(),\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org clients\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` and silently strips the one-time `plainSecret`. Security\n          // decision: an app-super-admin regenerating another org's client DOES\n          // receive the plaintext so they can relay it to the org. Mirror of the\n          // default variant's `customResponseDto` above — keep in sync.\n          // `requestDto` mirrors the default variant too: no caller input, so the\n          // cross-tenant variant cannot rewrite `redirectUris` / `roles` through \"regenerate\".\n          requestDto: z.object({}),\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral(),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORG_OAUTH_CLIENTS_FILTER_FIELDS,\n          sortFields: ORG_OAUTH_CLIENTS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description', 'clientId'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS,\n          sortFields: ORG_OAUTH_CLIENTS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"oauth-clients-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,0CAA0C,CAAC;AAClK,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxF,OAAO,EAAE,oCAAoC,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAErI,wDAAwD;AACxD,MAAM,6BAA6B,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAE7G,sCAAsC;AACtC,MAAM,+BAA+B,GAAG;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,sGAAsG;IACtG,8FAA8F;IAC9F,aAAa,EAAE,mCAAmC,CAAC,WAAW,CAAC;CAChE,CAAC;AAEF,qEAAqE;AACrE,MAAM,qCAAqC,GAAG;IAC5C,GAAG,+BAA+B;IAClC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACtD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,oCAAoC;IACzD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxD,CAAC;AAEF,iDAAiD;AACjD,MAAM,mCAAmC,GAAG,CAAC,GAAG,6BAA6B,EAAE,QAAQ,CAAU,CAAC;AAElG,wDAAwD;AACxD,MAAM,CAAN,IAAY,0BAOX;AAPD,WAAY,0BAA0B;IACpC,+CAAiB,CAAA;IACjB,uDAAyB,CAAA;IACzB,uDAAyB,CAAA;IACzB,uDAAyB,CAAA;IACzB,+CAAiB,CAAA;IACjB,2EAA6C,CAAA;AAC/C,CAAC,EAPW,0BAA0B,KAA1B,0BAA0B,QAOrC;AAUD;;EAEE;AACF,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAItK;IACA,UAAU,EAAE,6BAA6B;IACzC,kBAAkB,EAAE,gBAAgB,CAAC,0BAA0B;IAC/D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;IACxG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,wDAAwD;IAEhF,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,KAAK;KAC5B;IAED,eAAe,EAAE,0BAA0B;IAE3C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,gEAAgE;oBAChE,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,+BAA+B;oBAClE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,sCAAsC;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,2BAA2B;oBAC1E,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC;qBAC3N,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,oCAAoC;oBACnF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qEAAqE;oBACrE,yEAAyE;oBACzE,yEAAyE;oBACzE,0EAA0E;oBAC1E,0EAA0E;oBAC1E,wEAAwE;oBACxE,kEAAkE;oBAClE,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC;qBAC3N,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iBAAiB,EAAE,IAAI;iBACxB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED;;;;;;;;;;WAUG;QACH,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;QAED;;;;;;;;;;;;;;;;;WAiBG;QACH,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,yCAAyC;oBAC5E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,CAAC;oBAC3D,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,4CAA4C;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,oFAAoF;oBACpF,qFAAqF;oBACrF,iFAAiF;oBACjF,4EAA4E;oBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED;;;;WAIG;QACH,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,yCAAyC;oBAC5E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,iBAAiB,CAAC,QAAQ,CAAC;oBAC7D,CAAC;iBACF;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,4CAA4C;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,kFAAkF;oBAClF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,qCAAqC;oBACxE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,kGAAkG;oBAClG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,wEAAwE;oBACxE,oEAAoE;oBACpE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kLAAkL,CAAC;qBAC7T,CAAC;oBACF,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC;wBAC1N,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iIAAiI,CAAC;wBACnK,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;qBAC7J,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,wCAAwC;oBACvF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,wEAAwE;oBACxE,oEAAoE;oBACpE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,qEAAqE;oBACrE,yEAAyE;oBACzE,WAAW;oBACX,+DAA+D;oBAC/D,wEAAwE;oBACxE,sEAAsE;oBACtE,0EAA0E;oBAC1E,6CAA6C;oBAC7C,oEAAoE;oBACpE,2EAA2E;oBAC3E,yEAAyE;oBACzE,oEAAoE;oBACpE,gDAAgD;oBAChD,oDAAoD;oBACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kLAAkL,CAAC;qBAC7T,CAAC;oBACF,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC;wBAC1N,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iIAAiI,CAAC;wBACnK,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;qBAC7J,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,yCAAyC;oBAC5E,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,iFAAiF;oBACjF,uEAAuE;oBACvE,iFAAiF;oBACjF,qFAAqF;oBACrF,mFAAmF;oBACnF,uEAAuE;oBACvE,+EAA+E;oBAC/E,wEAAwE;oBACxE,0BAA0B;oBAC1B,2FAA2F;oBAC3F,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC;qBAC3N,CAAC;iBACH;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,4CAA4C;oBAC3F,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qEAAqE;oBACrE,yEAAyE;oBACzE,wEAAwE;oBACxE,sEAAsE;oBACtE,uEAAuE;oBACvE,8DAA8D;oBAC9D,wEAAwE;oBACxE,qFAAqF;oBACrF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC;wBACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC;qBAC3N,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,EAAE;YAClD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,sFAAsF;oBACtF,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC;6BAC7F,QAAQ,CAAC,6NAA6N,CAAC;qBAC3O,CAAC;oBACF,kGAAkG;oBAClG,gGAAgG;iBACjG;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,2BAA2B;oBAC9D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;gBACD;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,+BAA+B;oBAC7C,UAAU,EAAE,6BAA6B;oBACzC,8BAA8B,EAAE,EAAE;iBACnC;gBACD;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,6GAA6G;oBAC7G,0FAA0F;oBAC1F,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;oBACzC,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,qCAAqC;oBACnD,UAAU,EAAE,mCAAmC;oBAC/C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization OAuth Clients Shared Resource Configuration\n *\n * Resource configuration for managing organization-scoped registered OAuth\n * clients. FAITHFUL MIRROR of `api-keys-organization.shared.resources-config.schemas.ts`\n * with a FOCUSED operation set: core READ/LIST/SEARCH/CREATE/DELETE/COUNT plus\n * custom ROTATE/REGENERATE, the operator pair DEACTIVATE/REACTIVATE (#1028) and the\n * sweep-driven EXPIRE. EXTEND_EXPIRY and USAGE_STATS from api-keys are not ported: a\n * client's validity is fixed at registration, and no usage accounting is recorded for clients.\n */\n\nimport { z } from 'zod';\nimport {\n  OAuthClientOrganizationSchema,\n  OAuthClientStatus,\n} from './oauth-clients.shared.schemas';\n\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { createResourcesFilterPresenceSchema } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\nimport { AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX, AutonomousAgentRefSchema } from '../../flows-actors/autonomous-agents.shared.schemas';\n\n// Sort and filter fields for organization OAuth clients\nconst ORG_OAUTH_CLIENTS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'] as const;\n\n// Org members get basic filter fields\nconst ORG_OAUTH_CLIENTS_FILTER_FIELDS = {\n  status: z.enum(OAuthClientStatus),\n  name: z.string(),\n  organizationId: z.string(),\n  // \"Has an expiry\", i.e. `expiresAt` is set. Declared as a plain boolean it was passed to the database\n  // as a field no row has, and matched nothing (#1806); the presence filter carries its target.\n  hasExpiration: createResourcesFilterPresenceSchema('expiresAt'),\n};\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS = {\n  ...ORG_OAUTH_CLIENTS_FILTER_FIELDS,\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n  createdAt: z.date(), // Admin can filter by creation date\n  updatedAt: z.date(), // Admin can filter by update date\n};\n\n// App Admin gets additional sorting capabilities\nconst ORG_OAUTH_CLIENTS_ADMIN_SORT_FIELDS = [...ORG_OAUTH_CLIENTS_SORT_FIELDS, 'status'] as const;\n\n// Custom operations enum for organization OAuth clients\nexport enum OrgOAuthClients_Operations {\n  ROTATE = 'rotate', // Generate new secret and invalidate old one\n  REGENERATE = 'regenerate', // Generate new secret without invalidating old one\n  DEACTIVATE = 'deactivate', // ACTIVE → INACTIVE, an administrator suspends the client (#1028)\n  REACTIVATE = 'reactivate', // INACTIVE → ACTIVE, an administrator lifts the suspension; an EXPIRED client is not revived\n  EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n  SET_AUTONOMOUS_AGENTS = 'setAutonomousAgents', // Replace which declared autonomous agents this client runs as (#1611)\n}\n\ntype OrgOAuthClientsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.COUNT;\n\n/*\nOrganization OAuth Clients Resource Configuration Factory\n*/\nexport const orgOAuthClientsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof OrgOAuthClients_Operations,\n  OrgOAuthClientsCoreOperations,\n  typeof OAuthClientOrganizationSchema\n>({\n  mainSchema: OAuthClientOrganizationSchema,\n  resourceIdentifier: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.OAUTH_CLIENTS_ORGANIZATION],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Organization OAuth clients are a core system resource\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.DELETE,\n    CoreResourceOperation.COUNT,\n  ],\n\n  customOperation: OrgOAuthClients_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.COUNT]: {\n      variants: [\n        {\n          // Feature usage accounting counts org OAuth clients through the\n          // repository layer. This operation does not need public HTTP exposure.\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Organization admins can view\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also view\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER], // Org members can list to see clients\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can also list\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can create clients\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral().describe(\"The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.\")\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can create for any org\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` and silently strips the one-time `plainSecret` (it exists\n          // nowhere else after this response — only its SHA-256 hash is persisted).\n          // Security decision: an app-super-admin creating a client for another org\n          // DOES receive the plaintext so they can relay it to the org. Mirror of\n          // the default variant's `customResponseDto` above — keep in sync.\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral().describe(\"The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.\")\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can delete clients\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          haveBulkOperation: true,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can delete any org clients\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          haveBulkOperation: true,\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    /**\n     * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n     * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n     * the sweep is the only caller, and there is no reason for a human to declare that a date has\n     * passed.\n     *\n     * It exists so the sweep writes through a guarded door rather than setting `status` directly.\n     * The ACTIVE-only precondition lives in the paired prefix implementation\n     * (`oauth-clients.custom-impl.backend.service.ts`) — an INACTIVE client was retired by an\n     * administrator, and relabelling it EXPIRED would erase who ended it.\n     */\n    [OrgOAuthClients_Operations.EXPIRE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n          // and the paired prefix implementation forces the status transition itself, so there is no field\n          // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n          // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n          // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n          requestDto: z.object({}),\n        }\n      ],\n    },\n\n    /**\n     * ACTIVE → INACTIVE, the operator's suspension door (#1028). Until it existed the only ways to\n     * stop a registered client were regenerating its secret — rotation, not suspension, and it\n     * hands the caller a new credential to distribute — or waiting for `expiresAt`.\n     *\n     * WHAT IT STOPS, stated so the contract does not imply instant revocation: the direct-secret\n     * path re-reads the client and requires ACTIVE, and so does every new token mint. A\n     * client-credentials JWT already minted is NOT re-checked against the client until it expires,\n     * so deactivation ends new access and leaves an issued token to run out its own lifetime.\n     *\n     * The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE selects the\n     * core path that persists; it must NOT also hand the caller UPDATE's request contract — this\n     * resource exposes no core UPDATE, and an auto-derived one would let `PUT .../deactivate` carry\n     * `status: active` or rewrite `roles` past the mint-time ceiling. `status` is forced by the\n     * paired prefix implementation (`oauth-clients.custom-impl.backend.service.ts`), whose\n     * ACTIVE-only precondition is the real enforcement; `enabledCondition` is a display affordance\n     * and the cross-tenant `admin` variant carries none.\n     */\n    [OrgOAuthClients_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate clients\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === OAuthClientStatus.ACTIVE;\n          }\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org clients\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant DTOs are NOT inherited from the default variant — each variant builds\n          // its own, so this cross-tenant variant needs its own narrowing or it re-derives the\n          // full UPDATE contract. It also carries NO `enabledCondition`, so the transition\n          // precondition is enforced solely by the prefix implementation's 409 guard.\n          requestDto: z.object({}),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    /**\n     * INACTIVE → ACTIVE, lifting a suspension. An EXPIRED client is NOT revivable: its expiry was\n     * the thing retiring it, and the prefix implementation refuses with 409 so a status flip cannot\n     * undo a validity window. See DEACTIVATE for why the request contract is empty.\n     */\n    [OrgOAuthClients_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate clients\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === OAuthClientStatus.INACTIVE;\n          }\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org clients\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // See DEACTIVATE's `admin` variant: its own narrowing, and no `enabledCondition`.\n          requestDto: z.object({}),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [OrgOAuthClients_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can rotate secrets\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: Replaces the client secret; the previous value is not stored in recoverable form.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          // ROTATE is a secret handback plus a caller-chosen cutover. The default\n          // invalidation boundary is now, while a future boundary creates a bounded\n          // overlap. Once that boundary passes, the previous secret cannot be\n          // restored. An unauthorized caller also walks away with the replacement\n          // credential, so a live session alone is deliberately insufficient.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe(\"When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so the client can switch over.\")\n          }),\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral().describe(\"The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.\"),\n            oldClientId: z.string().describe(\"The id of the client whose secret was rotated. Rotation reissues the secret on the same client, so this is the client's own id.\"),\n            oldSecretInvalidationDate: z.date().describe(\"When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.\")\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can rotate any org clients\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // ROTATE is a secret handback plus a caller-chosen cutover. The default\n          // invalidation boundary is now, while a future boundary creates a bounded\n          // overlap. Once that boundary passes, the previous secret cannot be\n          // restored. An unauthorized caller also walks away with the replacement\n          // credential, so a live session alone is deliberately insufficient.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Request AND response both MIRROR the org-admin\n          // default:\n          //  - requestDto: an app-super-admin can choose the same future\n          //    `oldSecretInvalidationDate` window as an org admin. Without it the\n          //    admin variant would build no request DTO and the impl could only\n          //    default the invalidation to now — silently denying the future-window\n          //    capability the default variant exposes.\n          //  - customResponseDto: without it the admin response falls back to\n          //    `mainSchema` and silently strips the one-time `plainSecret` (plus the\n          //    rotated-out client's id + invalidation date). Security decision: an\n          //    app-super-admin rotating another org's client DOES receive the\n          //    plaintext so they can relay it to the org.\n          // Keep both in sync with the default variant above.\n          requestDto: z.object({\n            oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe(\"When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so the client can switch over.\")\n          }),\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral().describe(\"The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.\"),\n            oldClientId: z.string().describe(\"The id of the client whose secret was rotated. Rotation reissues the secret on the same client, so this is the client's own id.\"),\n            oldSecretInvalidationDate: z.date().describe(\"When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.\")\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [OrgOAuthClients_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can regenerate secrets\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldSecretInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedSecret, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `redirectUris`, `allowedScopes`, `allowedGrants` and `roles` would all\n          // be writable through \"regenerate\". This resource exposes NO core UPDATE, so those\n          // fields are meant to be immutable after minting, and the ceiling gate\n          // (`assertRequestedRolesWithinCallerCeiling`) runs in the CREATE handler only.\n          // A rewritable `redirectUris` on a secret-reissue route is an auth-code\n          // exfiltration primitive.\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on client credentials.\n          requestDto: z.object({}),\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral().describe(\"The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.\"),\n          }),\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can regenerate any org clients\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // Per-variant DTOs are NOT inherited from the default variant — each\n          // variant builds its own. Without this, the admin response falls back to\n          // `mainSchema` and silently strips the one-time `plainSecret`. Security\n          // decision: an app-super-admin regenerating another org's client DOES\n          // receive the plaintext so they can relay it to the org. Mirror of the\n          // default variant's `customResponseDto` above — keep in sync.\n          // `requestDto` mirrors the default variant too: no caller input, so the\n          // cross-tenant variant cannot rewrite `redirectUris` / `roles` through \"regenerate\".\n          requestDto: z.object({}),\n          customResponseDto: OAuthClientOrganizationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral().describe(\"The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.\"),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * Replace the set of application-declared autonomous agents this client runs as (#1611). Adding a ref\n     * lets a schedule tick or an inbound delivery start that agent's turns in this organization under this\n     * client's roles, with nobody on a socket; removing it stops the next turn and any decision still\n     * waiting (the principal is re-read before a decision resumes).\n     *\n     * The REQUEST carries the whole list; the paired prefix (`oauth-client-autonomous-agents.custom-impl.backend.service.ts`)\n     * validates each ref against the application's declared autonomous agents, refuses a client that is not\n     * ACTIVE or was registered dynamically, and — serialized on the organization row — refuses a ref another\n     * client of the organization already carries, so at most one client runs a given agent here. The value\n     * the prefix returns is authoritative, so nothing the caller sends is persisted unvalidated.\n     *\n     * Organization administrators only, and deliberately NO cross-tenant `admin` variant: a platform operator\n     * giving an agent authority inside a tenant is the standing reach the platform refuses (Paul, 2026-09-25).\n     *\n     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a machine credential gains an autonomous agent only by an administrator of its own organization.\n     */\n    [OrgOAuthClients_Operations.SET_AUTONOMOUS_AGENTS]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A permission change: the credential gains or loses standing authority to act unattended. Below the\n          // automatic audit floor by risk, so the evidence axis opts in, as DEACTIVATE does. The dedicated\n          // AUTONOMOUS_AGENT_BOUND / _UNBOUND rows name each ref; this row names the operation.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            autonomousAgentRefs: z.array(AutonomousAgentRefSchema).max(AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX)\n              .describe(\"Every autonomous agent this client should run as, replacing the current list. Each must be an agent the application declares, and no other client of this organization may already run it. An empty list stops all of them.\"),\n          }),\n          // No `enabledCondition`: REMOVING refs must stay possible on an INACTIVE or EXPIRED client, whose\n          // binding still holds the ref in this organization. The prefix requires ACTIVE only to ADD one.\n        },\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,\n          channel: CoreUserNotificationChannel.EMAIL,\n        },\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['name', 'description'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORG_OAUTH_CLIENTS_FILTER_FIELDS,\n          sortFields: ORG_OAUTH_CLIENTS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 50,\n        },\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: false,\n          variantKey: \"admin\",\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          // No `clientId` field exists (#1952), and a client's id is its `_id`, which cannot be text-searched: MongoDB\n          // stores it as an ObjectId and refuses a regex on it. Finding one client by id is a READ.\n          searchableFields: ['name', 'description'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS,\n          sortFields: ORG_OAUTH_CLIENTS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/security/oauth-clients/oauth-clients.shared.schemas.d.ts

@@ -226,6 +226,7 @@ export declare const OAuthClientOrganizationSchema: z.ZodObject<{
     registrationOrigin: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof OAuthClientRegistrationOrigin>>>>>>>;
     scope: z.ZodLiteral<ApiKeyScope.ORGANIZATION>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    autonomousAgentRefs: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>>>>;
 }, z.core.$strip>;
 export type OAuthClientOrganization = z.infer<typeof OAuthClientOrganizationSchema>;
 export declare const OAuthClientApplicationSchema: z.ZodObject<{

package/dist/esm/security/oauth-clients/oauth-clients.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-clients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAMlE;;;GAGG;AACH,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,QAAQ,aAAa;IACrB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED,oBAAY,cAAc;IACxB,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;CAChC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,4BAA4B;IACtC,IAAI,SAAS;IACb,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;CAC1C;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,4BAA4B,GAAG,OAAO,CAEnG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAaH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAiB7D,CAAC;AAeH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAsB7D;AAMD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;iBA0LhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"oauth-clients.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAMlE;;;GAGG;AACH,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,QAAQ,aAAa;IACrB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED,oBAAY,cAAc;IACxB,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;CAChC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,4BAA4B;IACtC,IAAI,SAAS;IACb,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;CAC1C;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,4BAA4B,GAAG,OAAO,CAEnG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAaH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAiB7D,CAAC;AAeH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAsB7D;AAMD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;iBA4LhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/esm/security/oauth-clients/oauth-clients.shared.schemas.js

@@ -22,6 +22,7 @@
  * codes, tokens and user consent records have their own runtime/storage owners.
  */
 import { z } from 'zod';
+import { AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX, AutonomousAgentRefSchema } from '../../flows-actors/autonomous-agents.shared.schemas.js';
 import { RolesSchema } from '../authorizations/roles.shared.schemas.js';
 import { ApiKeyScope } from '../api-keys/api-keys.shared.schemas.js';
 // ===============================
@@ -329,7 +330,8 @@ export const OAuthClientSchemaBase = z.object({
     // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
     status: z.enum(OAuthClientStatus).default(OAuthClientStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),
     expiresAt: z.date().optional().isDBIndexed().isSummaryField(),
-    lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+    lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate()
+        .describe('When the client was last accepted, to the minute: at the token endpoint, with its secret, or through one of its access tokens. Absent until it is first used.'),
     createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
     // ── Client secret ─────────────────────────────────────────────────────────
@@ -343,7 +345,8 @@ export const OAuthClientSchemaBase = z.object({
     // once at creation via `isReturnedAtCreation`, which the mint postfix correlates
     // the one-time plaintext against). `.excludeFrom{Create,Update}()` — the client
     // never supplies it; the mint impl is the single server-side choke point.
-    hashedSecret: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),
+    hashedSecret: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate()
+        .describe('The SHA-256 hash of the client secret, the only form the application keeps. Returned in the creation response only; the secret itself is `plainSecret`, shown that once.'),
     // First 8 chars of the plaintext secret — persisted + shown in lists
     // (`.isSummaryField()`) so an admin can identify a client without revealing the
     // secret. Server-managed.
@@ -434,11 +437,29 @@ export const OAuthClientSchemaBase = z.object({
         .isAuditEvidence(),
 });
 export const OAuthClientOrganizationSchema = OAuthClientSchemaBase.extend({
-    scope: z.literal(ApiKeyScope.ORGANIZATION),
+    scope: z.literal(ApiKeyScope.ORGANIZATION).describe("Always `organization`: the client is registered by one organization and acts within it."),
     organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
+    /**
+     * The application-declared autonomous agents this client runs as (#1611). A schedule tick or an inbound
+     * delivery for one of these refs starts a turn in this organization under THIS client's current roles,
+     * with nobody on a socket.
+     *
+     * On the credential, so revocation, expiry and binding are ONE row, re-read when a turn starts and again
+     * before a reviewer's decision resumes it. A separate binding resource was rejected: two rows that drift.
+     * ORGANIZATION variant only, by decision (Paul, 2026-09-25): an application-wide client acting in every
+     * tenant is the ambient reach the platform refuses; a firm acting in a client organization does so
+     * through a service-provider relationship that admits its client.
+     *
+     * Written only by the `setAutonomousAgents` operation, which serializes on the organization row so that
+     * at most one client in the organization carries a given ref; CREATE never sets it.
+     *
+     * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — which agents a credential runs is a grant of authority, recorded before and after.
+     */
+    autonomousAgentRefs: z.array(AutonomousAgentRefSchema).max(AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX).default([])
+        .isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
 });
 export const OAuthClientApplicationSchema = OAuthClientSchemaBase.extend({
-    scope: z.literal(ApiKeyScope.APPLICATION),
+    scope: z.literal(ApiKeyScope.APPLICATION).describe("Always `application`: the client is registered for the application as a whole rather than by an organization."),
     applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
 });
 //# sourceMappingURL=oauth-clients.shared.schemas.js.map