@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/security/authentications/service-provider-client-authentication.shared.schemas.d.ts

@@ -0,0 +1,169 @@
+/**
+ * A client organization's authentication policy, evaluated when a service firm's expert ACTS in it (#1633).
+ *
+ * ## The shape of the problem
+ *
+ * The firm and the client are two tenants of ONE application. An organization type's `authOverrides` are resolved at
+ * LOGIN, as a user-global most-restrictive intersection over every active membership — so a provider membership
+ * (#1597) left in that intersection would feed every client's policy into the expert's sign-in: an expert serving 200
+ * clients would be held to the strictest of 200 policies for firm-only work, and one client disabling a method the
+ * firm relies on would lock them out entirely. And no client's policy would ever be evaluated when the expert actually
+ * acts in that client.
+ *
+ * So provider memberships leave the login-time intersection, and the CLIENT's policy is evaluated per request, for the
+ * organization the request targets, against what the session has satisfied FOR THAT ORGANIZATION. The pure half of
+ * that evaluation is here; the store and the request wiring are backend.
+ *
+ * ## What counts as satisfying a client
+ *
+ * - A factor proven to THIS application FOR THIS CLIENT (a step-up answered while the request targeted it) —
+ *   {@link FactorSatisfactionSource.THIS_APPLICATION}. A factor completed at sign-in satisfied the EXPERT's own
+ *   policy, not the client's, and does not count; neither does one satisfied for another client. This is the
+ *   resource-tenant posture Microsoft Entra B2B takes when inbound MFA trust is off.
+ * - When the client trusts the firm's MFA on this relationship, a factor the FIRM's enterprise identity provider
+ *   reported in the expert's sign-in — {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED} — provided it maps to a
+ *   method the client's policy accepts. The client's minimum strength therefore still applies under trust.
+ *
+ * Every satisfied factor is recorded with the organization it counts for and where it came from, so the client can
+ * answer "was this expert's action MFA-protected, and by whom?".
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+ */
+import { z } from 'zod';
+import { AuthMethod } from './authentication.shared.schemas';
+import type { UserTypeAuthPolicy } from '../../config/entity-identity-config.shared.schemas';
+import { ServiceProviderMfaTrust } from '../../organizations/service-provider-client-controls.shared.schemas';
+/** @wildo_source:part:start saas.models.auth.service-provider-client-authentication facet:layer:shared facet:audience:app-developer */
+/** Where a factor recorded on a session, for one client organization, came from (#1633). */
+export declare enum FactorSatisfactionSource {
+    /** The expert proved the factor to this application while acting for that organization (a step-up). */
+    THIS_APPLICATION = "THIS_APPLICATION",
+    /**
+     * The firm's own enterprise identity provider reported the factor in the expert's sign-in, and the client trusts
+     * that provider's MFA on this relationship. The claim is the upstream's; this application only accepted it.
+     */
+    PROVIDER_IDP_TRUSTED = "PROVIDER_IDP_TRUSTED"
+}
+/** One factor a session has satisfied for one organization. */
+export declare const SessionSatisfiedFactorSchema: z.ZodObject<{
+    /** The organization the factor counts for — a client, never "everyone". */
+    organizationId: z.ZodString;
+    factor: z.ZodEnum<typeof AuthMethod>;
+    satisfiedAt: z.ZodCoercedDate<unknown>;
+    source: z.ZodEnum<typeof FactorSatisfactionSource>;
+    /** For {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}: the firm whose identity provider reported it. */
+    identityProviderOrganizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SessionSatisfiedFactor = z.infer<typeof SessionSatisfiedFactorSchema>;
+/**
+ * What an enterprise identity provider reported about how it authenticated the person, captured at the federated
+ * sign-in that opened the session. Evidence only: nothing reads it except the trust evaluation below, and it is
+ * never re-emitted as this application's own `amr`.
+ */
+export declare const SessionFederatedAmrEvidenceSchema: z.ZodObject<{
+    /** The organization whose enterprise connection the person signed in through. */
+    identityProviderOrganizationId: z.ZodString;
+    /** The RFC 8176 values the provider's verified ID token carried, as it carried them. */
+    amr: z.ZodArray<z.ZodString>;
+    authenticatedAt: z.ZodCoercedDate<unknown>;
+}, z.core.$strict>;
+export type SessionFederatedAmrEvidence = z.infer<typeof SessionFederatedAmrEvidenceSchema>;
+/** Everything a session records for client-policy evaluation. */
+export declare const SessionClientAuthenticationRecordSchema: z.ZodObject<{
+    satisfiedFactors: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** The organization the factor counts for — a client, never "everyone". */
+        organizationId: z.ZodString;
+        factor: z.ZodEnum<typeof AuthMethod>;
+        satisfiedAt: z.ZodCoercedDate<unknown>;
+        source: z.ZodEnum<typeof FactorSatisfactionSource>;
+        /** For {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}: the firm whose identity provider reported it. */
+        identityProviderOrganizationId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    federatedAmrEvidence: z.ZodOptional<z.ZodObject<{
+        /** The organization whose enterprise connection the person signed in through. */
+        identityProviderOrganizationId: z.ZodString;
+        /** The RFC 8176 values the provider's verified ID token carried, as it carried them. */
+        amr: z.ZodArray<z.ZodString>;
+        authenticatedAt: z.ZodCoercedDate<unknown>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type SessionClientAuthenticationRecord = z.infer<typeof SessionClientAuthenticationRecordSchema>;
+/**
+ * Which RFC 8176 `amr` values an upstream may report that name a factor this application can hold to a minimum
+ * strength — and nothing else.
+ *
+ * spec-cite: RFC 8176 "Authentication Method Reference Values", §2 (https://www.rfc-editor.org/rfc/rfc8176.html) —
+ * `otp` is defined there as a one-time password per RFC 4226 / RFC 6238 (HOTP/TOTP), `sms` as confirmation using SMS,
+ * `hwk` as proof-of-possession of a hardware-secured key.
+ *
+ * Deliberately absent, and the absence is the decision:
+ * - `mfa` names no factor. It asserts that several were used without saying which, so it cannot be held to a
+ *   minimum strength, and the session could not record which factor it accepted. It never counts on its own.
+ * - `swk` (a software-secured key) is not mapped to PASSKEY: whether a synced passkey is phishing-resistant hardware
+ *   is exactly what a client requiring hardware is asking, and an upstream's `swk` does not answer it.
+ * - `pwd` maps to nothing a second factor can be: a password is what the first factor already proved.
+ */
+export declare const UPSTREAM_AMR_SECOND_FACTOR: Readonly<Record<string, AuthMethod>>;
+/** What a client organization's effective policy asks of an expert acting in it. */
+export interface ServiceProviderClientAuthRequirement {
+    /** Whether a second factor, satisfied for this organization, is required at all. */
+    readonly requiresSecondFactor: boolean;
+    /** The factors that may satisfy it — the policy's accepted second factors, so its minimum strength included. */
+    readonly acceptedFactors: readonly AuthMethod[];
+    /**
+     * How long a satisfied factor stays valid, when the client's policy declares a step-up window. Absent: for the
+     * session, as a factor completed at sign-in holds for the session.
+     */
+    readonly windowSeconds?: number;
+}
+/**
+ * The requirement a client organization type's EFFECTIVE policy (the expert's user type resolved against the client
+ * type, `resolveAuthPolicyForOrganizationType`) places on an expert acting in it.
+ *
+ * A missing policy is not "no requirement": it is an unresolvable one, and the caller must refuse. That is why this
+ * takes the resolved policy rather than resolving it.
+ */
+export declare function resolveServiceProviderClientAuthRequirement(clientPolicy: UserTypeAuthPolicy): ServiceProviderClientAuthRequirement;
+/**
+ * The factor this session already satisfied FOR THIS ORGANIZATION that meets the requirement, if any.
+ *
+ * Keyed on the organization, so a factor satisfied for client A never satisfies client B.
+ *
+ * A factor the firm's identity provider reported ({@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}) counts only
+ * while the trust that admitted it still holds: the relationship the expert is admitted through TODAY trusts the
+ * firm's MFA, and it is THAT firm's IdP that reported the factor. The record is a memo of an earlier evaluation, not
+ * a grant. Without this check, a client withdrawing its trust would still accept the recorded factor until the
+ * session record expired (a refresh chain's lifetime), and a different firm's relationship into the same client
+ * would ride on the first firm's IdP. A factor this application verified itself needs no such condition: the client
+ * accepted it from this application directly.
+ */
+export declare function findSatisfiedClientFactor(input: {
+    readonly requirement: ServiceProviderClientAuthRequirement;
+    readonly organizationId: string;
+    readonly satisfiedFactors: readonly SessionSatisfiedFactor[];
+    /** The relationship admitting the expert on THIS request: its firm, and whether the client trusts that firm's MFA. */
+    readonly relationship: {
+        readonly providerOrganizationId: string;
+        readonly providerMfaTrust?: ServiceProviderMfaTrust;
+    };
+    readonly now: Date;
+}): SessionSatisfiedFactor | undefined;
+/**
+ * The factor a trusted upstream `amr` satisfies for this client, if any (#1633, item 3).
+ *
+ * All must hold: the client trusts the firm's MFA on this relationship; the expert signed in through the FIRM's own
+ * enterprise identity provider (not another organization's); the reported value names a factor in the client's
+ * accepted set; and, when the client declares a window, the sign-in is inside it. The strongest qualifying factor is
+ * chosen, so the record names the best proof the upstream reported.
+ */
+export declare function evaluateTrustedProviderAmr(input: {
+    readonly requirement: ServiceProviderClientAuthRequirement;
+    readonly relationship: {
+        readonly providerOrganizationId: string;
+        readonly providerMfaTrust?: ServiceProviderMfaTrust;
+    };
+    readonly evidence: SessionFederatedAmrEvidence | undefined;
+    readonly now: Date;
+}): AuthMethod | undefined;
+/** @wildo_source:part:end saas.models.auth.service-provider-client-authentication */
+//# sourceMappingURL=service-provider-client-authentication.shared.schemas.d.ts.map

package/dist/esm/security/authentications/service-provider-client-authentication.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-client-authentication.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/service-provider-client-authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAE9G,uIAAuI;AACvI,4FAA4F;AAC5F,oBAAY,wBAAwB;IAClC,uGAAuG;IACvG,gBAAgB,qBAAqB;IACrC;;;OAGG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,+DAA+D;AAC/D,eAAO,MAAM,4BAA4B;IACvC,2EAA2E;;;;;IAK3E,+GAA+G;;kBAE/G,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;IAC5C,iFAAiF;;IAEjF,wFAAwF;;;kBAGxF,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,iEAAiE;AACjE,eAAO,MAAM,uCAAuC;;QAzBlD,2EAA2E;;;;;QAK3E,+GAA+G;;;;QAW/G,iFAAiF;;QAEjF,wFAAwF;;;;kBAUxF,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAI3E,CAAC;AAEF,oFAAoF;AACpF,MAAM,WAAW,oCAAoC;IACnD,oFAAoF;IACpF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,gHAAgH;IAChH,QAAQ,CAAC,eAAe,EAAE,SAAS,UAAU,EAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,2CAA2C,CAAC,YAAY,EAAE,kBAAkB,GAAG,oCAAoC,CAOlI;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;IAC3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC7D,sHAAsH;IACtH,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;KAAE,CAAC;IACxH,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB,GAAG,sBAAsB,GAAG,SAAS,CAUrC;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;IAC3D,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;KAAE,CAAC;IACxH,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB,GAAG,UAAU,GAAG,SAAS,CAWzB;AACD,qFAAqF"}

package/dist/esm/security/authentications/service-provider-client-authentication.shared.schemas.js

@@ -0,0 +1,162 @@
+/**
+ * A client organization's authentication policy, evaluated when a service firm's expert ACTS in it (#1633).
+ *
+ * ## The shape of the problem
+ *
+ * The firm and the client are two tenants of ONE application. An organization type's `authOverrides` are resolved at
+ * LOGIN, as a user-global most-restrictive intersection over every active membership — so a provider membership
+ * (#1597) left in that intersection would feed every client's policy into the expert's sign-in: an expert serving 200
+ * clients would be held to the strictest of 200 policies for firm-only work, and one client disabling a method the
+ * firm relies on would lock them out entirely. And no client's policy would ever be evaluated when the expert actually
+ * acts in that client.
+ *
+ * So provider memberships leave the login-time intersection, and the CLIENT's policy is evaluated per request, for the
+ * organization the request targets, against what the session has satisfied FOR THAT ORGANIZATION. The pure half of
+ * that evaluation is here; the store and the request wiring are backend.
+ *
+ * ## What counts as satisfying a client
+ *
+ * - A factor proven to THIS application FOR THIS CLIENT (a step-up answered while the request targeted it) —
+ *   {@link FactorSatisfactionSource.THIS_APPLICATION}. A factor completed at sign-in satisfied the EXPERT's own
+ *   policy, not the client's, and does not count; neither does one satisfied for another client. This is the
+ *   resource-tenant posture Microsoft Entra B2B takes when inbound MFA trust is off.
+ * - When the client trusts the firm's MFA on this relationship, a factor the FIRM's enterprise identity provider
+ *   reported in the expert's sign-in — {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED} — provided it maps to a
+ *   method the client's policy accepts. The client's minimum strength therefore still applies under trust.
+ *
+ * Every satisfied factor is recorded with the organization it counts for and where it came from, so the client can
+ * answer "was this expert's action MFA-protected, and by whom?".
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+ */
+import { z } from 'zod';
+import { AuthMethod } from './authentication.shared.schemas.js';
+import { resolveAcceptedSecondFactorMethods } from '../../config/auth-config-resolution.shared.utils.js';
+import { ServiceProviderMfaTrust } from '../../organizations/service-provider-client-controls.shared.schemas.js';
+/** @wildo_source:part:start saas.models.auth.service-provider-client-authentication facet:layer:shared facet:audience:app-developer */
+/** Where a factor recorded on a session, for one client organization, came from (#1633). */
+export var FactorSatisfactionSource;
+(function (FactorSatisfactionSource) {
+    /** The expert proved the factor to this application while acting for that organization (a step-up). */
+    FactorSatisfactionSource["THIS_APPLICATION"] = "THIS_APPLICATION";
+    /**
+     * The firm's own enterprise identity provider reported the factor in the expert's sign-in, and the client trusts
+     * that provider's MFA on this relationship. The claim is the upstream's; this application only accepted it.
+     */
+    FactorSatisfactionSource["PROVIDER_IDP_TRUSTED"] = "PROVIDER_IDP_TRUSTED";
+})(FactorSatisfactionSource || (FactorSatisfactionSource = {}));
+/** One factor a session has satisfied for one organization. */
+export const SessionSatisfiedFactorSchema = z.strictObject({
+    /** The organization the factor counts for — a client, never "everyone". */
+    organizationId: z.string().min(1),
+    factor: z.enum(AuthMethod),
+    satisfiedAt: z.coerce.date(),
+    source: z.enum(FactorSatisfactionSource),
+    /** For {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}: the firm whose identity provider reported it. */
+    identityProviderOrganizationId: z.string().min(1).optional(),
+});
+/**
+ * What an enterprise identity provider reported about how it authenticated the person, captured at the federated
+ * sign-in that opened the session. Evidence only: nothing reads it except the trust evaluation below, and it is
+ * never re-emitted as this application's own `amr`.
+ */
+export const SessionFederatedAmrEvidenceSchema = z.strictObject({
+    /** The organization whose enterprise connection the person signed in through. */
+    identityProviderOrganizationId: z.string().min(1),
+    /** The RFC 8176 values the provider's verified ID token carried, as it carried them. */
+    amr: z.array(z.string().min(1).max(64)).max(32),
+    authenticatedAt: z.coerce.date(),
+});
+/** Everything a session records for client-policy evaluation. */
+export const SessionClientAuthenticationRecordSchema = z.strictObject({
+    satisfiedFactors: z.array(SessionSatisfiedFactorSchema).max(256).default([]),
+    federatedAmrEvidence: SessionFederatedAmrEvidenceSchema.optional(),
+});
+/**
+ * Which RFC 8176 `amr` values an upstream may report that name a factor this application can hold to a minimum
+ * strength — and nothing else.
+ *
+ * spec-cite: RFC 8176 "Authentication Method Reference Values", §2 (https://www.rfc-editor.org/rfc/rfc8176.html) —
+ * `otp` is defined there as a one-time password per RFC 4226 / RFC 6238 (HOTP/TOTP), `sms` as confirmation using SMS,
+ * `hwk` as proof-of-possession of a hardware-secured key.
+ *
+ * Deliberately absent, and the absence is the decision:
+ * - `mfa` names no factor. It asserts that several were used without saying which, so it cannot be held to a
+ *   minimum strength, and the session could not record which factor it accepted. It never counts on its own.
+ * - `swk` (a software-secured key) is not mapped to PASSKEY: whether a synced passkey is phishing-resistant hardware
+ *   is exactly what a client requiring hardware is asking, and an upstream's `swk` does not answer it.
+ * - `pwd` maps to nothing a second factor can be: a password is what the first factor already proved.
+ */
+export const UPSTREAM_AMR_SECOND_FACTOR = {
+    hwk: AuthMethod.PASSKEY,
+    otp: AuthMethod.TOTP,
+    sms: AuthMethod.SMS_OTP,
+};
+/**
+ * The requirement a client organization type's EFFECTIVE policy (the expert's user type resolved against the client
+ * type, `resolveAuthPolicyForOrganizationType`) places on an expert acting in it.
+ *
+ * A missing policy is not "no requirement": it is an unresolvable one, and the caller must refuse. That is why this
+ * takes the resolved policy rather than resolving it.
+ */
+export function resolveServiceProviderClientAuthRequirement(clientPolicy) {
+    const stepUp = clientPolicy.stepUpAuth;
+    return {
+        requiresSecondFactor: clientPolicy.mfaPolicy?.requireMFA === true,
+        acceptedFactors: resolveAcceptedSecondFactorMethods(clientPolicy),
+        ...(stepUp?.enabled ? { windowSeconds: stepUp.maxAgeSeconds } : {}),
+    };
+}
+/** Is a moment still inside the requirement's window? */
+function withinWindow(requirement, at, now) {
+    if (requirement.windowSeconds === undefined)
+        return true;
+    return now.getTime() - at.getTime() <= requirement.windowSeconds * 1000;
+}
+/**
+ * The factor this session already satisfied FOR THIS ORGANIZATION that meets the requirement, if any.
+ *
+ * Keyed on the organization, so a factor satisfied for client A never satisfies client B.
+ *
+ * A factor the firm's identity provider reported ({@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}) counts only
+ * while the trust that admitted it still holds: the relationship the expert is admitted through TODAY trusts the
+ * firm's MFA, and it is THAT firm's IdP that reported the factor. The record is a memo of an earlier evaluation, not
+ * a grant. Without this check, a client withdrawing its trust would still accept the recorded factor until the
+ * session record expired (a refresh chain's lifetime), and a different firm's relationship into the same client
+ * would ride on the first firm's IdP. A factor this application verified itself needs no such condition: the client
+ * accepted it from this application directly.
+ */
+export function findSatisfiedClientFactor(input) {
+    const trustStillHolds = (recorded) => recorded.source !== FactorSatisfactionSource.PROVIDER_IDP_TRUSTED
+        || (input.relationship.providerMfaTrust === ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA
+            && recorded.identityProviderOrganizationId === input.relationship.providerOrganizationId);
+    return input.satisfiedFactors.find((recorded) => recorded.organizationId === input.organizationId
+        && input.requirement.acceptedFactors.includes(recorded.factor)
+        && withinWindow(input.requirement, recorded.satisfiedAt, input.now)
+        && trustStillHolds(recorded));
+}
+/**
+ * The factor a trusted upstream `amr` satisfies for this client, if any (#1633, item 3).
+ *
+ * All must hold: the client trusts the firm's MFA on this relationship; the expert signed in through the FIRM's own
+ * enterprise identity provider (not another organization's); the reported value names a factor in the client's
+ * accepted set; and, when the client declares a window, the sign-in is inside it. The strongest qualifying factor is
+ * chosen, so the record names the best proof the upstream reported.
+ */
+export function evaluateTrustedProviderAmr(input) {
+    const { requirement, relationship, evidence, now } = input;
+    if (relationship.providerMfaTrust !== ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA)
+        return undefined;
+    if (!evidence || evidence.identityProviderOrganizationId !== relationship.providerOrganizationId)
+        return undefined;
+    if (!withinWindow(requirement, evidence.authenticatedAt, now))
+        return undefined;
+    // `hasOwn`: the values are an upstream's strings, and `__proto__` must name nothing rather than the prototype.
+    const reported = new Set(evidence.amr
+        .filter((value) => Object.hasOwn(UPSTREAM_AMR_SECOND_FACTOR, value))
+        .map((value) => UPSTREAM_AMR_SECOND_FACTOR[value]));
+    return [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.SMS_OTP]
+        .find((method) => reported.has(method) && requirement.acceptedFactors.includes(method));
+}
+/** @wildo_source:part:end saas.models.auth.service-provider-client-authentication */
+//# sourceMappingURL=service-provider-client-authentication.shared.schemas.js.map

package/dist/esm/security/authentications/service-provider-client-authentication.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-client-authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/service-provider-client-authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,kCAAkC,EAAE,MAAM,kDAAkD,CAAC;AAEtG,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAE9G,uIAAuI;AACvI,4FAA4F;AAC5F,MAAM,CAAN,IAAY,wBAQX;AARD,WAAY,wBAAwB;IAClC,uGAAuG;IACvG,iEAAqC,CAAA;IACrC;;;OAGG;IACH,yEAA6C,CAAA;AAC/C,CAAC,EARW,wBAAwB,KAAxB,wBAAwB,QAQnC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,2EAA2E;IAC3E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,+GAA+G;IAC/G,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,iFAAiF;IACjF,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,wFAAwF;IACxF,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;CACjC,CAAC,CAAC;AAGH,iEAAiE;AACjE,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5E,oBAAoB,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAyC;IAC9E,GAAG,EAAE,UAAU,CAAC,OAAO;IACvB,GAAG,EAAE,UAAU,CAAC,IAAI;IACpB,GAAG,EAAE,UAAU,CAAC,OAAO;CACxB,CAAC;AAeF;;;;;;GAMG;AACH,MAAM,UAAU,2CAA2C,CAAC,YAAgC;IAC1F,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC;IACvC,OAAO;QACL,oBAAoB,EAAE,YAAY,CAAC,SAAS,EAAE,UAAU,KAAK,IAAI;QACjE,eAAe,EAAE,kCAAkC,CAAC,YAAY,CAAC;QACjE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,WAAiD,EAAE,EAAQ,EAAE,GAAS;IAC1F,IAAI,WAAW,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,WAAW,CAAC,aAAa,GAAG,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAOzC;IACC,MAAM,eAAe,GAAG,CAAC,QAAgC,EAAW,EAAE,CACpE,QAAQ,CAAC,MAAM,KAAK,wBAAwB,CAAC,oBAAoB;WAC9D,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,KAAK,uBAAuB,CAAC,sBAAsB;eACrF,QAAQ,CAAC,8BAA8B,KAAK,KAAK,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC9C,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;WAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;WAC3D,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC;WAChE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC3D,IAAI,YAAY,CAAC,gBAAgB,KAAK,uBAAuB,CAAC,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACvG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,8BAA8B,KAAK,YAAY,CAAC,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACnH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChF,+GAA+G;IAC/G,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;SAC7D,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5F,CAAC;AACD,qFAAqF","sourcesContent":["/**\n * A client organization's authentication policy, evaluated when a service firm's expert ACTS in it (#1633).\n *\n * ## The shape of the problem\n *\n * The firm and the client are two tenants of ONE application. An organization type's `authOverrides` are resolved at\n * LOGIN, as a user-global most-restrictive intersection over every active membership — so a provider membership\n * (#1597) left in that intersection would feed every client's policy into the expert's sign-in: an expert serving 200\n * clients would be held to the strictest of 200 policies for firm-only work, and one client disabling a method the\n * firm relies on would lock them out entirely. And no client's policy would ever be evaluated when the expert actually\n * acts in that client.\n *\n * So provider memberships leave the login-time intersection, and the CLIENT's policy is evaluated per request, for the\n * organization the request targets, against what the session has satisfied FOR THAT ORGANIZATION. The pure half of\n * that evaluation is here; the store and the request wiring are backend.\n *\n * ## What counts as satisfying a client\n *\n * - A factor proven to THIS application FOR THIS CLIENT (a step-up answered while the request targeted it) —\n *   {@link FactorSatisfactionSource.THIS_APPLICATION}. A factor completed at sign-in satisfied the EXPERT's own\n *   policy, not the client's, and does not count; neither does one satisfied for another client. This is the\n *   resource-tenant posture Microsoft Entra B2B takes when inbound MFA trust is off.\n * - When the client trusts the firm's MFA on this relationship, a factor the FIRM's enterprise identity provider\n *   reported in the expert's sign-in — {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED} — provided it maps to a\n *   method the client's policy accepts. The client's minimum strength therefore still applies under trust.\n *\n * Every satisfied factor is recorded with the organization it counts for and where it came from, so the client can\n * answer \"was this expert's action MFA-protected, and by whom?\".\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.\n */\n\nimport { z } from 'zod';\nimport { AuthMethod } from './authentication.shared.schemas';\nimport { resolveAcceptedSecondFactorMethods } from '../../config/auth-config-resolution.shared.utils';\nimport type { UserTypeAuthPolicy } from '../../config/entity-identity-config.shared.schemas';\nimport { ServiceProviderMfaTrust } from '../../organizations/service-provider-client-controls.shared.schemas';\n\n/** @wildo_source:part:start saas.models.auth.service-provider-client-authentication facet:layer:shared facet:audience:app-developer */\n/** Where a factor recorded on a session, for one client organization, came from (#1633). */\nexport enum FactorSatisfactionSource {\n  /** The expert proved the factor to this application while acting for that organization (a step-up). */\n  THIS_APPLICATION = 'THIS_APPLICATION',\n  /**\n   * The firm's own enterprise identity provider reported the factor in the expert's sign-in, and the client trusts\n   * that provider's MFA on this relationship. The claim is the upstream's; this application only accepted it.\n   */\n  PROVIDER_IDP_TRUSTED = 'PROVIDER_IDP_TRUSTED',\n}\n\n/** One factor a session has satisfied for one organization. */\nexport const SessionSatisfiedFactorSchema = z.strictObject({\n  /** The organization the factor counts for — a client, never \"everyone\". */\n  organizationId: z.string().min(1),\n  factor: z.enum(AuthMethod),\n  satisfiedAt: z.coerce.date(),\n  source: z.enum(FactorSatisfactionSource),\n  /** For {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}: the firm whose identity provider reported it. */\n  identityProviderOrganizationId: z.string().min(1).optional(),\n});\nexport type SessionSatisfiedFactor = z.infer<typeof SessionSatisfiedFactorSchema>;\n\n/**\n * What an enterprise identity provider reported about how it authenticated the person, captured at the federated\n * sign-in that opened the session. Evidence only: nothing reads it except the trust evaluation below, and it is\n * never re-emitted as this application's own `amr`.\n */\nexport const SessionFederatedAmrEvidenceSchema = z.strictObject({\n  /** The organization whose enterprise connection the person signed in through. */\n  identityProviderOrganizationId: z.string().min(1),\n  /** The RFC 8176 values the provider's verified ID token carried, as it carried them. */\n  amr: z.array(z.string().min(1).max(64)).max(32),\n  authenticatedAt: z.coerce.date(),\n});\nexport type SessionFederatedAmrEvidence = z.infer<typeof SessionFederatedAmrEvidenceSchema>;\n\n/** Everything a session records for client-policy evaluation. */\nexport const SessionClientAuthenticationRecordSchema = z.strictObject({\n  satisfiedFactors: z.array(SessionSatisfiedFactorSchema).max(256).default([]),\n  federatedAmrEvidence: SessionFederatedAmrEvidenceSchema.optional(),\n});\nexport type SessionClientAuthenticationRecord = z.infer<typeof SessionClientAuthenticationRecordSchema>;\n\n/**\n * Which RFC 8176 `amr` values an upstream may report that name a factor this application can hold to a minimum\n * strength — and nothing else.\n *\n * spec-cite: RFC 8176 \"Authentication Method Reference Values\", §2 (https://www.rfc-editor.org/rfc/rfc8176.html) —\n * `otp` is defined there as a one-time password per RFC 4226 / RFC 6238 (HOTP/TOTP), `sms` as confirmation using SMS,\n * `hwk` as proof-of-possession of a hardware-secured key.\n *\n * Deliberately absent, and the absence is the decision:\n * - `mfa` names no factor. It asserts that several were used without saying which, so it cannot be held to a\n *   minimum strength, and the session could not record which factor it accepted. It never counts on its own.\n * - `swk` (a software-secured key) is not mapped to PASSKEY: whether a synced passkey is phishing-resistant hardware\n *   is exactly what a client requiring hardware is asking, and an upstream's `swk` does not answer it.\n * - `pwd` maps to nothing a second factor can be: a password is what the first factor already proved.\n */\nexport const UPSTREAM_AMR_SECOND_FACTOR: Readonly<Record<string, AuthMethod>> = {\n  hwk: AuthMethod.PASSKEY,\n  otp: AuthMethod.TOTP,\n  sms: AuthMethod.SMS_OTP,\n};\n\n/** What a client organization's effective policy asks of an expert acting in it. */\nexport interface ServiceProviderClientAuthRequirement {\n  /** Whether a second factor, satisfied for this organization, is required at all. */\n  readonly requiresSecondFactor: boolean;\n  /** The factors that may satisfy it — the policy's accepted second factors, so its minimum strength included. */\n  readonly acceptedFactors: readonly AuthMethod[];\n  /**\n   * How long a satisfied factor stays valid, when the client's policy declares a step-up window. Absent: for the\n   * session, as a factor completed at sign-in holds for the session.\n   */\n  readonly windowSeconds?: number;\n}\n\n/**\n * The requirement a client organization type's EFFECTIVE policy (the expert's user type resolved against the client\n * type, `resolveAuthPolicyForOrganizationType`) places on an expert acting in it.\n *\n * A missing policy is not \"no requirement\": it is an unresolvable one, and the caller must refuse. That is why this\n * takes the resolved policy rather than resolving it.\n */\nexport function resolveServiceProviderClientAuthRequirement(clientPolicy: UserTypeAuthPolicy): ServiceProviderClientAuthRequirement {\n  const stepUp = clientPolicy.stepUpAuth;\n  return {\n    requiresSecondFactor: clientPolicy.mfaPolicy?.requireMFA === true,\n    acceptedFactors: resolveAcceptedSecondFactorMethods(clientPolicy),\n    ...(stepUp?.enabled ? { windowSeconds: stepUp.maxAgeSeconds } : {}),\n  };\n}\n\n/** Is a moment still inside the requirement's window? */\nfunction withinWindow(requirement: ServiceProviderClientAuthRequirement, at: Date, now: Date): boolean {\n  if (requirement.windowSeconds === undefined) return true;\n  return now.getTime() - at.getTime() <= requirement.windowSeconds * 1000;\n}\n\n/**\n * The factor this session already satisfied FOR THIS ORGANIZATION that meets the requirement, if any.\n *\n * Keyed on the organization, so a factor satisfied for client A never satisfies client B.\n *\n * A factor the firm's identity provider reported ({@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}) counts only\n * while the trust that admitted it still holds: the relationship the expert is admitted through TODAY trusts the\n * firm's MFA, and it is THAT firm's IdP that reported the factor. The record is a memo of an earlier evaluation, not\n * a grant. Without this check, a client withdrawing its trust would still accept the recorded factor until the\n * session record expired (a refresh chain's lifetime), and a different firm's relationship into the same client\n * would ride on the first firm's IdP. A factor this application verified itself needs no such condition: the client\n * accepted it from this application directly.\n */\nexport function findSatisfiedClientFactor(input: {\n  readonly requirement: ServiceProviderClientAuthRequirement;\n  readonly organizationId: string;\n  readonly satisfiedFactors: readonly SessionSatisfiedFactor[];\n  /** The relationship admitting the expert on THIS request: its firm, and whether the client trusts that firm's MFA. */\n  readonly relationship: { readonly providerOrganizationId: string; readonly providerMfaTrust?: ServiceProviderMfaTrust };\n  readonly now: Date;\n}): SessionSatisfiedFactor | undefined {\n  const trustStillHolds = (recorded: SessionSatisfiedFactor): boolean =>\n    recorded.source !== FactorSatisfactionSource.PROVIDER_IDP_TRUSTED\n    || (input.relationship.providerMfaTrust === ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA\n      && recorded.identityProviderOrganizationId === input.relationship.providerOrganizationId);\n  return input.satisfiedFactors.find((recorded) =>\n    recorded.organizationId === input.organizationId\n    && input.requirement.acceptedFactors.includes(recorded.factor)\n    && withinWindow(input.requirement, recorded.satisfiedAt, input.now)\n    && trustStillHolds(recorded));\n}\n\n/**\n * The factor a trusted upstream `amr` satisfies for this client, if any (#1633, item 3).\n *\n * All must hold: the client trusts the firm's MFA on this relationship; the expert signed in through the FIRM's own\n * enterprise identity provider (not another organization's); the reported value names a factor in the client's\n * accepted set; and, when the client declares a window, the sign-in is inside it. The strongest qualifying factor is\n * chosen, so the record names the best proof the upstream reported.\n */\nexport function evaluateTrustedProviderAmr(input: {\n  readonly requirement: ServiceProviderClientAuthRequirement;\n  readonly relationship: { readonly providerOrganizationId: string; readonly providerMfaTrust?: ServiceProviderMfaTrust };\n  readonly evidence: SessionFederatedAmrEvidence | undefined;\n  readonly now: Date;\n}): AuthMethod | undefined {\n  const { requirement, relationship, evidence, now } = input;\n  if (relationship.providerMfaTrust !== ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA) return undefined;\n  if (!evidence || evidence.identityProviderOrganizationId !== relationship.providerOrganizationId) return undefined;\n  if (!withinWindow(requirement, evidence.authenticatedAt, now)) return undefined;\n  // `hasOwn`: the values are an upstream's strings, and `__proto__` must name nothing rather than the prototype.\n  const reported = new Set(evidence.amr\n    .filter((value) => Object.hasOwn(UPSTREAM_AMR_SECOND_FACTOR, value))\n    .map((value) => UPSTREAM_AMR_SECOND_FACTOR[value]!));\n  return [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.SMS_OTP]\n    .find((method) => reported.has(method) && requirement.acceptedFactors.includes(method));\n}\n/** @wildo_source:part:end saas.models.auth.service-provider-client-authentication */\n"]}

package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,oBAAY,0BAA0B;IACpC,YAAY,gBAAgB;IAC5B,SAAS,aAAa;IACtB,SAAS,aAAa;CACvB;AAID,eAAO,MAAM,qCAAqC;;iBAEhD,CAAC;AAEH,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAE/D,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAI/D,eAAO,MAAM,mCAAmC,mRAyK/C,CAAC"}
+{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,oBAAY,0BAA0B;IACpC,YAAY,gBAAgB;IAC5B,SAAS,aAAa;IACtB,SAAS,aAAa;CACvB;AAID,eAAO,MAAM,qCAAqC;;iBAEhD,CAAC;AAEH,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAE/D,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAI/D,eAAO,MAAM,mCAAmC,mRA2K/C,CAAC"}

package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.js

@@ -27,7 +27,7 @@ export var SiemDeliveryDlq_Operations;
 })(SiemDeliveryDlq_Operations || (SiemDeliveryDlq_Operations = {}));
 // ── Request DTOs ─────────────────────────────────────────────────────
 export const SiemDeliveryDlq_RetrySingleRequestDto = z.object({
-    entryId: z.string(),
+    entryId: z.string().describe('The id of the dead-letter entry to re-deliver. An entry that was already delivered cannot be retried.'),
 });
 export const SiemDeliveryDlq_RetryAllRequestDto = z.object({});
 export const SiemDeliveryDlq_PurgeAllRequestDto = z.object({});
@@ -138,8 +138,8 @@ export const siemDeliveryDlqPolymorphicFactories = createPolymorphicResourceConf
                     // NOT the DLQ resource row. Without this the service output fails
                     // `transformOutput`'s `internalDto.parse` against the resource schema → 500.
                     customResponseDto: z.object({
-                        message: z.string(),
-                        entryId: z.string(),
+                        message: z.string().describe('A human-readable confirmation that the entry was re-queued.'),
+                        entryId: z.string().describe('The entry that was re-queued for delivery.'),
                     }),
                 }],
         },
@@ -164,9 +164,11 @@ export const siemDeliveryDlqPolymorphicFactories = createPolymorphicResourceConf
                     // Returns a bulk-retry summary, NOT the borrowed bulk-update default
                     // response — customResponseDto overrides it.
                     customResponseDto: z.object({
-                        retriedCount: z.number(),
-                        skippedCount: z.number(),
-                        message: z.string(),
+                        retriedCount: z.number().describe('How many entries were re-queued for delivery. Re-queued entries leave the dead-letter queue.'),
+                        skippedCount: z
+                            .number()
+                            .describe('How many entries were not re-queued: already delivered, without a stored event, or failing to re-queue. Every entry is skipped when no SIEM destination is configured.'),
+                        message: z.string().describe('A human-readable summary of the retry.'),
                     }),
                 }],
         },
@@ -192,8 +194,8 @@ export const siemDeliveryDlqPolymorphicFactories = createPolymorphicResourceConf
                     // Returns a purge summary, NOT the borrowed bulk-delete default
                     // `{ deletedIds, deletedCount }` — customResponseDto overrides it.
                     customResponseDto: z.object({
-                        purgedCount: z.number(),
-                        message: z.string(),
+                        purgedCount: z.number().describe('How many dead-letter entries were deleted. The purge covers every entry in this scope, whatever its status.'),
+                        message: z.string().describe('A human-readable summary of the purge.'),
                     }),
                 }],
         },

package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,qCAAqC,EAAE,MAAM,oCAAoC,CAAC;AAElH,wEAAwE;AAExE,MAAM,CAAN,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,0DAA4B,CAAA;IAC5B,oDAAsB,CAAA;IACtB,oDAAsB,CAAA;AACxB,CAAC,EAJW,0BAA0B,KAA1B,0BAA0B,QAIrC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE/D,wEAAwE;AAExE,MAAM,CAAC,MAAM,mCAAmC,GAAG,uCAAuC,CACxF,qCAAqC,EACrC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,0BAA0B;IAC3C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,4EAA4E;QAC5E,gFAAgF;QAChF,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,yEAAyE;QACzE,wEAAwE;QACxE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,oEAAoE;oBACpE,sEAAsE;oBACtE,mEAAmE;oBACnE,oEAAoE;oBACpE,4BAA4B;oBAC5B,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;wBACrC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAU;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,+DAA+D;QAC/D,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,YAAY,CAAC,EAAE;YACzC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,+DAA+D;oBAC/D,mDAAmD;oBACnD,oEAAoE;oBACpE,kEAAkE;oBAClE,gEAAgE;oBAChE,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,qCAAqC;oBACjD,8EAA8E;oBAC9E,kEAAkE;oBAClE,6EAA6E;oBAC7E,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;wBACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;qBACpB,CAAC;iBACH,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iEAAiE;oBACjE,qEAAqE;oBACrE,mEAAmE;oBACnE,qEAAqE;oBACrE,kEAAkE;oBAClE,uEAAuE;oBACvE,mEAAmE;oBACnE,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,kCAAkC;oBAC9C,qEAAqE;oBACrE,6CAA6C;oBAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;wBACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;wBACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;qBACpB,CAAC;iBACH,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,gGAAgG;oBAChG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,iEAAiE;oBACjE,iEAAiE;oBACjE,mEAAmE;oBACnE,uEAAuE;oBACvE,0EAA0E;oBAC1E,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,kCAAkC;oBAC9C,gEAAgE;oBAChE,mEAAmE;oBACnE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;wBACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;qBACpB,CAAC;iBACH,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SIEM Delivery DLQ Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...siemDeliveryDlqPolymorphicFactories\n *\n * The ORG + APP operation surfaces below (READ/LIST/RETRY/PURGE, all with\n * `polymorphicRole` for both scopes) are fully wired, but only the ORGANIZATION\n * variant is ever exercised in production: no producer emits app-scoped SIEM\n * deliveries, so `APPLICATION_SIEM_DELIVERY_DLQ` is never populated. The APP variant\n * is RESERVED / DORMANT — see the note on `siem-delivery-dlq.shared.schemas.ts` and\n * `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`.\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationReversibility,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SiemDeliveryDlqStatus, siemDeliveryDlqPolymorphicDeclaration } from './siem-delivery-dlq.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SiemDeliveryDlq_Operations {\n  RETRY_SINGLE = 'retrySingle',\n  RETRY_ALL = 'retryAll',\n  PURGE_ALL = 'purgeAll',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const SiemDeliveryDlq_RetrySingleRequestDto = z.object({\n  entryId: z.string(),\n});\n\nexport const SiemDeliveryDlq_RetryAllRequestDto = z.object({});\n\nexport const SiemDeliveryDlq_PurgeAllRequestDto = z.object({});\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const siemDeliveryDlqPolymorphicFactories = createPolymorphicResourceConfigurations(\n  siemDeliveryDlqPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: SiemDeliveryDlq_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.DELETE,\n      // Bulk twin of DELETE — the write path for both `PURGE_ALL` (drop every row\n      // in the scope) and the delete-on-requeue tail of `RETRY_SINGLE` / `RETRY_ALL`.\n      // The custom impls route through `repository.deleteMany`, which resolves a\n      // DEFAULT DELETE_MANY operation. REPOSITORY_ONLY (like CREATE/DELETE): never a\n      // public HTTP surface — operators purge/retry via the custom operations, which\n      // own request validation + the summary response. Mirrors the M2M webhook\n      // delivery-log sibling, whose PURGE_OLD uses the same DELETE_MANY seam.\n      CoreResourceOperation.DELETE_MANY,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Failed-deliveries triage surface: status is the quick-filter axis\n          // (the UI promotes it to an All/Pending-retry/Exhausted/Delivered tab\n          // strip via `collectionDisplayConfig.quickFilterField`), createdAt\n          // bounds an incident window. Backend-validated: the controller only\n          // extracts declared fields.\n          filterFields: {\n            status: z.enum(SiemDeliveryDlqStatus),\n            createdAt: z.date(),\n          },\n          sortFields: ['createdAt', 'status'] as const,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Bulk delete used by PURGE_ALL (whole-scope clear) and the delete-on-requeue\n      // tail of RETRY_SINGLE/RETRY_ALL. REPOSITORY_ONLY — driven only by the custom\n      // impls' `repository.deleteMany`, never a public HTTP surface.\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [SiemDeliveryDlq_Operations.RETRY_SINGLE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // The request body owns the one target (`entryId`). Borrow the\n          // COLLECTION update verb so the generated route is\n          // `…/siem-delivery-dlq/retry-single`, with no second, independently\n          // supplied DLQ id in the URL. This is a single-row command, not a\n          // selection bulk operation, so `isBulkOperation` remains unset.\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: SiemDeliveryDlq_RetrySingleRequestDto,\n          // Borrows UPDATE_MANY for its route/verb but returns a retry acknowledgement,\n          // NOT the DLQ resource row. Without this the service output fails\n          // `transformOutput`'s `internalDto.parse` against the resource schema → 500.\n          customResponseDto: z.object({\n            message: z.string(),\n            entryId: z.string(),\n          }),\n        }],\n      },\n      [SiemDeliveryDlq_Operations.RETRY_ALL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Borrows the COLLECTION verb UPDATE_MANY (not entity UPDATE): a\n          // whole-scope retry is a collection operation, so the framework must\n          // generate a collection route (`…/siem-delivery-dlq/retry-all`, no\n          // `:id` path segment) — an operator scope-level action has no single\n          // row to address. Entity UPDATE would generate `…/:id/retry-all`,\n          // which the collection surface can never fill. `isBulkOperation` stays\n          // unset: this is collection-level, not a selection-of-ids bulk op.\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: SiemDeliveryDlq_RetryAllRequestDto,\n          // Returns a bulk-retry summary, NOT the borrowed bulk-update default\n          // response — customResponseDto overrides it.\n          customResponseDto: z.object({\n            retriedCount: z.number(),\n            skippedCount: z.number(),\n            message: z.string(),\n          }),\n        }],\n      },\n      [SiemDeliveryDlq_Operations.PURGE_ALL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // IRREVERSIBLE: Empties the dead-letter queue. Those deliveries are not retained anywhere else.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          // Borrows the COLLECTION verb DELETE_MANY (not entity DELETE): a\n          // whole-scope purge is a collection operation → collection route\n          // (`…/siem-delivery-dlq/purge-all`, no `:id`). Entity DELETE would\n          // generate `…/:id/purge-all`, unfillable from the scope-level surface.\n          // `isBulkOperation` stays unset (collection-level, not a selection bulk).\n          resourceOperationLike: CoreResourceOperation.DELETE_MANY,\n          requestDto: SiemDeliveryDlq_PurgeAllRequestDto,\n          // Returns a purge summary, NOT the borrowed bulk-delete default\n          // `{ deletedIds, deletedCount }` — customResponseDto overrides it.\n          customResponseDto: z.object({\n            purgedCount: z.number(),\n            message: z.string(),\n          }),\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,qCAAqC,EAAE,MAAM,oCAAoC,CAAC;AAElH,wEAAwE;AAExE,MAAM,CAAN,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,0DAA4B,CAAA;IAC5B,oDAAsB,CAAA;IACtB,oDAAsB,CAAA;AACxB,CAAC,EAJW,0BAA0B,KAA1B,0BAA0B,QAIrC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;CACtI,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE/D,wEAAwE;AAExE,MAAM,CAAC,MAAM,mCAAmC,GAAG,uCAAuC,CACxF,qCAAqC,EACrC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,0BAA0B;IAC3C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,4EAA4E;QAC5E,gFAAgF;QAChF,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,yEAAyE;QACzE,wEAAwE;QACxE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,oEAAoE;oBACpE,sEAAsE;oBACtE,mEAAmE;oBACnE,oEAAoE;oBACpE,4BAA4B;oBAC5B,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;wBACrC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAU;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,+DAA+D;QAC/D,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,YAAY,CAAC,EAAE;YACzC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,+DAA+D;oBAC/D,mDAAmD;oBACnD,oEAAoE;oBACpE,kEAAkE;oBAClE,gEAAgE;oBAChE,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,qCAAqC;oBACjD,8EAA8E;oBAC9E,kEAAkE;oBAClE,6EAA6E;oBAC7E,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;wBAC3F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;qBAC3E,CAAC;iBACH,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iEAAiE;oBACjE,qEAAqE;oBACrE,mEAAmE;oBACnE,qEAAqE;oBACrE,kEAAkE;oBAClE,uEAAuE;oBACvE,mEAAmE;oBACnE,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,kCAAkC;oBAC9C,qEAAqE;oBACrE,6CAA6C;oBAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8FAA8F,CAAC;wBACjI,YAAY,EAAE,CAAC;6BACZ,MAAM,EAAE;6BACR,QAAQ,CAAC,wKAAwK,CAAC;wBACrL,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;qBACvE,CAAC;iBACH,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,gGAAgG;oBAChG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,iEAAiE;oBACjE,iEAAiE;oBACjE,mEAAmE;oBACnE,uEAAuE;oBACvE,0EAA0E;oBAC1E,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,kCAAkC;oBAC9C,gEAAgE;oBAChE,mEAAmE;oBACnE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6GAA6G,CAAC;wBAC/I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;qBACvE,CAAC;iBACH,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SIEM Delivery DLQ Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...siemDeliveryDlqPolymorphicFactories\n *\n * The ORG + APP operation surfaces below (READ/LIST/RETRY/PURGE, all with\n * `polymorphicRole` for both scopes) are fully wired, but only the ORGANIZATION\n * variant is ever exercised in production: no producer emits app-scoped SIEM\n * deliveries, so `APPLICATION_SIEM_DELIVERY_DLQ` is never populated. The APP variant\n * is RESERVED / DORMANT — see the note on `siem-delivery-dlq.shared.schemas.ts` and\n * `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`.\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationReversibility,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SiemDeliveryDlqStatus, siemDeliveryDlqPolymorphicDeclaration } from './siem-delivery-dlq.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SiemDeliveryDlq_Operations {\n  RETRY_SINGLE = 'retrySingle',\n  RETRY_ALL = 'retryAll',\n  PURGE_ALL = 'purgeAll',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const SiemDeliveryDlq_RetrySingleRequestDto = z.object({\n  entryId: z.string().describe('The id of the dead-letter entry to re-deliver. An entry that was already delivered cannot be retried.'),\n});\n\nexport const SiemDeliveryDlq_RetryAllRequestDto = z.object({});\n\nexport const SiemDeliveryDlq_PurgeAllRequestDto = z.object({});\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const siemDeliveryDlqPolymorphicFactories = createPolymorphicResourceConfigurations(\n  siemDeliveryDlqPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: SiemDeliveryDlq_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.DELETE,\n      // Bulk twin of DELETE — the write path for both `PURGE_ALL` (drop every row\n      // in the scope) and the delete-on-requeue tail of `RETRY_SINGLE` / `RETRY_ALL`.\n      // The custom impls route through `repository.deleteMany`, which resolves a\n      // DEFAULT DELETE_MANY operation. REPOSITORY_ONLY (like CREATE/DELETE): never a\n      // public HTTP surface — operators purge/retry via the custom operations, which\n      // own request validation + the summary response. Mirrors the M2M webhook\n      // delivery-log sibling, whose PURGE_OLD uses the same DELETE_MANY seam.\n      CoreResourceOperation.DELETE_MANY,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Failed-deliveries triage surface: status is the quick-filter axis\n          // (the UI promotes it to an All/Pending-retry/Exhausted/Delivered tab\n          // strip via `collectionDisplayConfig.quickFilterField`), createdAt\n          // bounds an incident window. Backend-validated: the controller only\n          // extracts declared fields.\n          filterFields: {\n            status: z.enum(SiemDeliveryDlqStatus),\n            createdAt: z.date(),\n          },\n          sortFields: ['createdAt', 'status'] as const,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Bulk delete used by PURGE_ALL (whole-scope clear) and the delete-on-requeue\n      // tail of RETRY_SINGLE/RETRY_ALL. REPOSITORY_ONLY — driven only by the custom\n      // impls' `repository.deleteMany`, never a public HTTP surface.\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [SiemDeliveryDlq_Operations.RETRY_SINGLE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // The request body owns the one target (`entryId`). Borrow the\n          // COLLECTION update verb so the generated route is\n          // `…/siem-delivery-dlq/retry-single`, with no second, independently\n          // supplied DLQ id in the URL. This is a single-row command, not a\n          // selection bulk operation, so `isBulkOperation` remains unset.\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: SiemDeliveryDlq_RetrySingleRequestDto,\n          // Borrows UPDATE_MANY for its route/verb but returns a retry acknowledgement,\n          // NOT the DLQ resource row. Without this the service output fails\n          // `transformOutput`'s `internalDto.parse` against the resource schema → 500.\n          customResponseDto: z.object({\n            message: z.string().describe('A human-readable confirmation that the entry was re-queued.'),\n            entryId: z.string().describe('The entry that was re-queued for delivery.'),\n          }),\n        }],\n      },\n      [SiemDeliveryDlq_Operations.RETRY_ALL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Borrows the COLLECTION verb UPDATE_MANY (not entity UPDATE): a\n          // whole-scope retry is a collection operation, so the framework must\n          // generate a collection route (`…/siem-delivery-dlq/retry-all`, no\n          // `:id` path segment) — an operator scope-level action has no single\n          // row to address. Entity UPDATE would generate `…/:id/retry-all`,\n          // which the collection surface can never fill. `isBulkOperation` stays\n          // unset: this is collection-level, not a selection-of-ids bulk op.\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: SiemDeliveryDlq_RetryAllRequestDto,\n          // Returns a bulk-retry summary, NOT the borrowed bulk-update default\n          // response — customResponseDto overrides it.\n          customResponseDto: z.object({\n            retriedCount: z.number().describe('How many entries were re-queued for delivery. Re-queued entries leave the dead-letter queue.'),\n            skippedCount: z\n              .number()\n              .describe('How many entries were not re-queued: already delivered, without a stored event, or failing to re-queue. Every entry is skipped when no SIEM destination is configured.'),\n            message: z.string().describe('A human-readable summary of the retry.'),\n          }),\n        }],\n      },\n      [SiemDeliveryDlq_Operations.PURGE_ALL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // IRREVERSIBLE: Empties the dead-letter queue. Those deliveries are not retained anywhere else.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          // Borrows the COLLECTION verb DELETE_MANY (not entity DELETE): a\n          // whole-scope purge is a collection operation → collection route\n          // (`…/siem-delivery-dlq/purge-all`, no `:id`). Entity DELETE would\n          // generate `…/:id/purge-all`, unfillable from the scope-level surface.\n          // `isBulkOperation` stays unset (collection-level, not a selection bulk).\n          resourceOperationLike: CoreResourceOperation.DELETE_MANY,\n          requestDto: SiemDeliveryDlq_PurgeAllRequestDto,\n          // Returns a purge summary, NOT the borrowed bulk-delete default\n          // `{ deletedIds, deletedCount }` — customResponseDto overrides it.\n          customResponseDto: z.object({\n            purgedCount: z.number().describe('How many dead-letter entries were deleted. The purge covers every entry in this scope, whatever its status.'),\n            message: z.string().describe('A human-readable summary of the purge.'),\n          }),\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/siem/siem-export-config.shared.schemas.js

@@ -94,9 +94,9 @@ export const SiemExportConfigBaseSchema = z.object({
             SIEMEventCategory.USER_LIFECYCLE,
             SIEMEventCategory.ORG_MANAGEMENT,
             SIEMEventCategory.DATA_ACCESS,
-        ]),
-        severityMinimum: z.enum(SIEMFilterSeverity).default(SIEMFilterSeverity.INFO),
-        specificEventTypes: z.array(z.string()).optional(),
+        ]).describe("The event categories exported to this destination."),
+        severityMinimum: z.enum(SIEMFilterSeverity).default(SIEMFilterSeverity.INFO).describe("The least severe event exported. Less severe events are not sent."),
+        specificEventTypes: z.array(z.string()).optional().describe("An optional allow-list of event types, matched exactly: no substring or wildcard matching."),
     }),
     /*
      * Three knobs, and the two that were removed are the reason to read this.
@@ -138,7 +138,7 @@ export const SiemExportConfigBaseSchema = z.object({
          * At `1` the delivery path is byte-for-byte what it was before batching existed — the event is
          * sent alone, framed as itself, and {@link batchWindowSeconds} is never consulted.
          */
-        batchSize: z.number().int().min(1).max(100).default(1),
+        batchSize: z.number().int().min(1).max(100).default(1).describe("The most events one request may carry, up to 100. `1`, the default, sends one request per event."),
         /**
          * How long a partly-filled batch waits for company before it is sent anyway.
          *
@@ -188,10 +188,10 @@ export const SiemExportConfigBaseSchema = z.object({
          * Mapped to `undefined` rather than to a literal so `.default(5)` stays the single source of
          * the value. Removable once no deployment can hold a pre-#1379 row.
          */
-        (value) => (value === 0 ? undefined : value), z.number().int().min(1).max(60).default(5)),
-        retryAttempts: z.number().min(0).max(5).default(3),
-        retryBackoffSeconds: z.number().min(1).max(300).default(30),
-        timeoutSeconds: z.number().min(1).max(60).default(10),
+        (value) => (value === 0 ? undefined : value), z.number().int().min(1).max(60).default(5)).describe("How long, in seconds, a partly filled batch waits before it is sent anyway. Used only when `batchSize` is above 1."),
+        retryAttempts: z.number().min(0).max(5).default(3).describe("How many times a failed delivery is retried."),
+        retryBackoffSeconds: z.number().min(1).max(300).default(30).describe("The base delay before a retry, in seconds. Retries back off exponentially from it."),
+        timeoutSeconds: z.number().min(1).max(60).default(10).describe("How long one delivery request may take, in seconds."),
     }),
     customHeaders: z.record(z.string(), z.string()).optional(),
     /**