@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.js

@@ -117,7 +117,7 @@ export const platformAccessGrantsResourceConfiguration_InitializationFactory = (
                     // cannot see it), and the platform sees the ones it raised. The ORGANIZATIONS scope does
                     // the tenant separation; the platform reaches it through the cross-tenant admission on
                     // the verbs below.
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 },
             ],
@@ -127,7 +127,7 @@ export const platformAccessGrantsResourceConfiguration_InitializationFactory = (
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 },
             ],
@@ -137,7 +137,7 @@ export const platformAccessGrantsResourceConfiguration_InitializationFactory = (
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 },
             ],
@@ -209,7 +209,7 @@ export const platformAccessGrantsResourceConfiguration_InitializationFactory = (
                     requestDto: z.object({
                         justification: z.string().min(1).max(1000),
                         /** Minutes. Clamped server-side to the 4h ceiling; a longer ask is not refused. */
-                        requestedDurationMinutes: z.number().int().positive().optional(),
+                        requestedDurationMinutes: z.number().int().positive().optional().describe("How long the access lasts, in whole minutes, counted from this request rather than from approval. Defaults to 60; a longer request is reduced to 240 rather than refused."),
                     }),
                 },
             ],
@@ -234,7 +234,7 @@ export const platformAccessGrantsResourceConfiguration_InitializationFactory = (
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({
@@ -251,7 +251,7 @@ export const platformAccessGrantsResourceConfiguration_InitializationFactory = (
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({
@@ -301,7 +301,7 @@ export const platformAccessGrantsResourceConfiguration_InitializationFactory = (
                 {
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
-                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     admitsCrossTenantPlatformAdministration: true,

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAW1H,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAChI,0CAA0C,CAIxC;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;OAQG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QAEtC;;;;;;;;;;;;;;;WAeG;QACH,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;QACjC,uFAAuF;QACvF,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB;;;;;;;;WAQG;QAEH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,mBAAmB;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;WAaG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,+BAA+B,CAAC,cAAc,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C;;;;;;;;;;;;;;;uBAeG;oBACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;qBACjE,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,uFAAuF;oBACvF,sFAAsF;oBACtF,iEAAiE;oBACjE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,0FAA0F;oBAC1F,sEAAsE;oBACtE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE;YACtC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED;;;;;;;WAOG;QACH;;;;;;;;;WASG;QACH,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;KACF;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,+FAA+F;IAC/F,wEAAwE;CACzE,CAAC,CAAC","sourcesContent":["/**\n * Platform Access Grants — resource configuration.\n *\n * The operation set is unusual and the asymmetry is the point: the PLATFORM requests, the TENANT\n * decides. No verb lets one side do the other's job.\n *\n *   requestAccess  — platform-tier, crosses the tenant boundary\n *   approve / deny — the TARGET tenant's own administrators, never platform-tier\n *   revoke         — either side, because either may end an elevation early\n *\n * See `platform-access-grants.shared.schemas.ts` for why the resource exists at all (rungs 4–5 of\n * the operator-access ladder in `.claude/rules/administrative-continuity-floors.md`) and\n * `.claude/plans/platform-access-grants-jit-elevation.md` for the remaining steps.\n */\n\nimport { z } from 'zod';\nimport { PlatformAccessGrantSchema, PlatformAccessGrantStatus, PlatformAccessGrants_Operations } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n\ntype PlatformAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const platformAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof PlatformAccessGrants_Operations,\n    PlatformAccessGrantsCoreOperations,\n    typeof PlatformAccessGrantSchema\n  >({\n    mainSchema: PlatformAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.PLATFORM_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.PLATFORM_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` are ALLOWED for the trusted path because the authorization layer itself has to\n     * resolve a caller's usable grant before admitting a crossing, and it does so on a system context\n     * — the caller is by definition not a member of the tenant whose grants are being read.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the tenant policy and the continuity-floor measurement. A system door around those would be a\n     * second way to mint an elevation, which is the one thing this resource exists to prevent.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n\n      /**\n       * Subject-export disclosure — FORBIDDEN, and the declaration is REQUIRED rather than optional.\n       *\n       * `operatorUserId` and `approvedByUserId` are foreign keys back to USERS, so\n       * `classifySubjectExportDisposition` puts these rows on a user's Art. 15 graph as\n       * `INCLUDED_REFERENCES_SUBJECT` — personal data CONCERNING the subject even though the subject\n       * does not own it. An included resource carrying NO declaration REFUSES the entire export, so\n       * omitting this would trade a frontend boot failure for a broken disclosure right.\n       *\n       * FORBIDDEN for the reason AUDIT_LOGS is: this is a security/operational monitoring record, and\n       * handing the monitoring trail to the person it monitors is self-defeating. It is also not only\n       * about them — a grant names the TENANT's approver and carries the tenant's decision reason, so\n       * disclosing it to the operator would expose another data subject's decision (Art. 15(4)).\n       * FORBIDDEN rows are left OUT of the bundle and RECORDED with that reason, never silently\n       * dropped, so the report still answers \"why is this missing?\".\n       */\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text.\n     *\n     * Note this is a DIFFERENT question from the `exportSubject: FORBIDDEN` above, and the two answers\n     * differ deliberately. That one asks whether the monitored operator may READ the monitoring trail —\n     * no. This one asks what erasure DOES to the row, and nothing here says erasure must not reach it.\n     *\n     * The grant survives because its security value is WHO reached WHICH tenant, WHEN, and under whose\n     * approval — none of which is scrubbed. What does not survive is `justification` and `decisionReason`:\n     * operator- and approver-written prose, and the surface most likely to name a third party in passing.\n     * That makes the erasure narrow rather than destructive of the record.\n     *\n     * Contrast `auditLogs`, which is exempt outright: it is the immutable ledger of what happened,\n     * including this erasure, so scrubbing it would destroy the evidence the erasure was performed.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The grant is a record ABOUT an operator's access, not\n     * the operator; their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n      // Present for the tenant-purge cascade ONLY — see the operation's configuration below.\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be REPOSITORY_ONLY: the\n\n       * retention primitives resolve through `getServiceOperationPathDefault`, which matches only\n\n       * INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize writer uses to stamp markers.\n\n       */\n\n      [CoreResourceOperation.UPDATE_MANY]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n        }],\n\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            // Both sides read the same row through the same door: a tenant admin sees elevations\n            // raised against their tenant (the consent record is worthless if the consenting party\n            // cannot see it), and the platform sees the ones it raised. The ORGANIZATIONS scope does\n            // the tenant separation; the platform reaches it through the cross-tenant admission on\n            // the verbs below.\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * PURGE ONLY — there is deliberately no `API_CALL` variant, so no client can delete a grant.\n       *\n       * The verb exists because grants are a COMPOSITION child of ORGANIZATIONS with\n       * `onParentDelete` enabled, and a cascade can only call an operation the child actually\n       * declares. Without it the registry's composition-cascade-deletability guard fails — correctly:\n       * the cascade would have been declared and then silently unable to run, leaving grant rows\n       * behind after their tenant was purged.\n       *\n       * Route-less is the whole point of the shape. `INTERNAL_CALL` mirrors `organizations.delete`'s\n       * own default: the tenant purge may remove these rows, and nobody else may. Erasing a consent\n       * record through an API would let either party rewrite the history of an access decision, which\n       * is exactly what this resource exists to make impossible.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb, and the ONE operation here that must stay reachable without an existing\n       * grant — otherwise the mechanism cannot start: an operator would need an elevation to request\n       * an elevation. It therefore declares `admitsCrossTenantPlatformAdministration` and must be\n       * explicitly exempted when the admission predicate later starts requiring a usable grant\n       * (Step 4 of the plan). That exemption is load-bearing and gets its own pin.\n       *\n       * What keeps the exemption safe is that requesting is not accessing: this verb writes a row in\n       * `PENDING_APPROVAL` (or `ACTIVE` when the tenant has not opted into approval) and touches\n       * nothing else in the tenant. The blast radius of an abused request is a notification and an\n       * audit row naming the operator.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — elevation is requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [PlatformAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            admitsCrossTenantPlatformAdministration: true,\n            /**\n             * `organizationId` deliberately does NOT appear in this body DTO. The organization is\n             * already the mandatory primary-scope path segment and the execution-context creator\n             * validates that URL value before dispatch. Requiring it again in JSON made clients\n             * author the same security-critical target twice and created an avoidable mismatch case.\n             *\n             * WHERE AN OPERATOR GETS the path id is still a deliberate product decision. There is\n             * no in-product surface that lists organizations the operator does not belong to:\n             * `organizations | LIST` is confined to the caller's own memberships. The id therefore\n             * arrives with the customer support case, where it is also present in support URLs,\n             * organization notifications and the audit trail.\n             *\n             * Do not widen `organizations | LIST` to make discovery convenient: a browsable\n             * directory is the customer list and would restore the standing cross-tenant\n             * visibility this workflow exists to avoid.\n             */\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 4h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional(),\n            }),\n          },\n        ],\n        userNotifications: [\n          {\n            // The tenant learns immediately that an operator asked for access — before it happens,\n            // not after. Under the approval posture this notification IS the request; without it,\n            // opting in would give a tenant a decision it never hears about.\n            target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n            channel: CoreUserNotificationChannel.EMAIL,\n          },\n        ],\n      },\n\n      /**\n       * The tenant's decision. Gated on the TENANT's own roles and deliberately NOT reachable by the\n       * platform: an operator who could approve their own request would make the whole Lockbox\n       * posture ceremonial. Note the absence of `admitsCrossTenantPlatformAdministration` here — that\n       * absence is the control, so do not add it \"for symmetry\".\n       */\n      [PlatformAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            // Only a request still awaiting a decision can be decided. Fails closed server-side, so a\n            // replayed approval cannot revive a denied, revoked or expired grant.\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      [PlatformAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /**\n       * Ending an elevation early. Reachable by BOTH sides, which is why it carries the cross-tenant\n       * admission while `approve`/`deny` do not: a tenant revokes access it granted, and an operator\n       * closes out their own session rather than leaving a live window open until it lapses.\n       *\n       * Revoking is monotonic — it only ever removes authority — so admitting the platform side costs\n       * nothing the reversibility test would object to.\n       */\n      /**\n       * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and\n       * by nothing else (#413). INTERNAL_CALL: no route, no frontend affordance, and therefore no\n       * `admitsCrossTenantPlatformAdministration` — the tenant-boundary question does not arise for\n       * an operation no request can reach.\n       *\n       * The transition precondition lives in the paired implementation, which permits it only from\n       * ACTIVE: a grant the tenant DENIED or REVOKED must keep saying so, and relabelling a\n       * terminal grant would rewrite the decision history a customer audit reads.\n       */\n      [PlatformAccessGrants_Operations.EXPIRE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n            // and the paired prefix implementation forces the status transition itself, so there is no field\n            // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n            // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n            // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n            requestDto: z.object({}),\n          },\n        ],\n      },\n\n      [PlatformAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            admitsCrossTenantPlatformAdministration: true,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n    },\n    // NOTE: the ORGANIZATIONS primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (ORGANIZATIONS → PLATFORM_ACCESS_GRANTS), which is\n    // the single place scope is expressed for every resource. Declaring it twice would let the two\n    // drift, and the relationship is the one the authorizer actually reads.\n  });\n"]}
+{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAW1H,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAChI,0CAA0C,CAIxC;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;OAQG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QAEtC;;;;;;;;;;;;;;;WAeG;QACH,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;QACjC,uFAAuF;QACvF,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB;;;;;;;;WAQG;QAEH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,mBAAmB;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;WAaG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,+BAA+B,CAAC,cAAc,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C;;;;;;;;;;;;;;;uBAeG;oBACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBACvP,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,uFAAuF;oBACvF,sFAAsF;oBACtF,iEAAiE;oBACjE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,0FAA0F;oBAC1F,sEAAsE;oBACtE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE;YACtC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED;;;;;;;WAOG;QACH;;;;;;;;;WASG;QACH,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;KACF;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,+FAA+F;IAC/F,wEAAwE;CACzE,CAAC,CAAC","sourcesContent":["/**\n * Platform Access Grants — resource configuration.\n *\n * The operation set is unusual and the asymmetry is the point: the PLATFORM requests, the TENANT\n * decides. No verb lets one side do the other's job.\n *\n *   requestAccess  — platform-tier, crosses the tenant boundary\n *   approve / deny — the TARGET tenant's own administrators, never platform-tier\n *   revoke         — either side, because either may end an elevation early\n *\n * See `platform-access-grants.shared.schemas.ts` for why the resource exists at all (rungs 4–5 of\n * the operator-access ladder in `.claude/rules/administrative-continuity-floors.md`) and\n * `.claude/plans/platform-access-grants-jit-elevation.md` for the remaining steps.\n */\n\nimport { z } from 'zod';\nimport { PlatformAccessGrantSchema, PlatformAccessGrantStatus, PlatformAccessGrants_Operations } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n\ntype PlatformAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const platformAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof PlatformAccessGrants_Operations,\n    PlatformAccessGrantsCoreOperations,\n    typeof PlatformAccessGrantSchema\n  >({\n    mainSchema: PlatformAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.PLATFORM_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.PLATFORM_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` are ALLOWED for the trusted path because the authorization layer itself has to\n     * resolve a caller's usable grant before admitting a crossing, and it does so on a system context\n     * — the caller is by definition not a member of the tenant whose grants are being read.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the tenant policy and the continuity-floor measurement. A system door around those would be a\n     * second way to mint an elevation, which is the one thing this resource exists to prevent.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n\n      /**\n       * Subject-export disclosure — FORBIDDEN, and the declaration is REQUIRED rather than optional.\n       *\n       * `operatorUserId` and `approvedByUserId` are foreign keys back to USERS, so\n       * `classifySubjectExportDisposition` puts these rows on a user's Art. 15 graph as\n       * `INCLUDED_REFERENCES_SUBJECT` — personal data CONCERNING the subject even though the subject\n       * does not own it. An included resource carrying NO declaration REFUSES the entire export, so\n       * omitting this would trade a frontend boot failure for a broken disclosure right.\n       *\n       * FORBIDDEN for the reason AUDIT_LOGS is: this is a security/operational monitoring record, and\n       * handing the monitoring trail to the person it monitors is self-defeating. It is also not only\n       * about them — a grant names the TENANT's approver and carries the tenant's decision reason, so\n       * disclosing it to the operator would expose another data subject's decision (Art. 15(4)).\n       * FORBIDDEN rows are left OUT of the bundle and RECORDED with that reason, never silently\n       * dropped, so the report still answers \"why is this missing?\".\n       */\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text.\n     *\n     * Note this is a DIFFERENT question from the `exportSubject: FORBIDDEN` above, and the two answers\n     * differ deliberately. That one asks whether the monitored operator may READ the monitoring trail —\n     * no. This one asks what erasure DOES to the row, and nothing here says erasure must not reach it.\n     *\n     * The grant survives because its security value is WHO reached WHICH tenant, WHEN, and under whose\n     * approval — none of which is scrubbed. What does not survive is `justification` and `decisionReason`:\n     * operator- and approver-written prose, and the surface most likely to name a third party in passing.\n     * That makes the erasure narrow rather than destructive of the record.\n     *\n     * Contrast `auditLogs`, which is exempt outright: it is the immutable ledger of what happened,\n     * including this erasure, so scrubbing it would destroy the evidence the erasure was performed.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The grant is a record ABOUT an operator's access, not\n     * the operator; their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n      // Present for the tenant-purge cascade ONLY — see the operation's configuration below.\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be REPOSITORY_ONLY: the\n\n       * retention primitives resolve through `getServiceOperationPathDefault`, which matches only\n\n       * INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize writer uses to stamp markers.\n\n       */\n\n      [CoreResourceOperation.UPDATE_MANY]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n        }],\n\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            // Both sides read the same row through the same door: a tenant admin sees elevations\n            // raised against their tenant (the consent record is worthless if the consenting party\n            // cannot see it), and the platform sees the ones it raised. The ORGANIZATIONS scope does\n            // the tenant separation; the platform reaches it through the cross-tenant admission on\n            // the verbs below.\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * PURGE ONLY — there is deliberately no `API_CALL` variant, so no client can delete a grant.\n       *\n       * The verb exists because grants are a COMPOSITION child of ORGANIZATIONS with\n       * `onParentDelete` enabled, and a cascade can only call an operation the child actually\n       * declares. Without it the registry's composition-cascade-deletability guard fails — correctly:\n       * the cascade would have been declared and then silently unable to run, leaving grant rows\n       * behind after their tenant was purged.\n       *\n       * Route-less is the whole point of the shape. `INTERNAL_CALL` mirrors `organizations.delete`'s\n       * own default: the tenant purge may remove these rows, and nobody else may. Erasing a consent\n       * record through an API would let either party rewrite the history of an access decision, which\n       * is exactly what this resource exists to make impossible.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb, and the ONE operation here that must stay reachable without an existing\n       * grant — otherwise the mechanism cannot start: an operator would need an elevation to request\n       * an elevation. It therefore declares `admitsCrossTenantPlatformAdministration` and must be\n       * explicitly exempted when the admission predicate later starts requiring a usable grant\n       * (Step 4 of the plan). That exemption is load-bearing and gets its own pin.\n       *\n       * What keeps the exemption safe is that requesting is not accessing: this verb writes a row in\n       * `PENDING_APPROVAL` (or `ACTIVE` when the tenant has not opted into approval) and touches\n       * nothing else in the tenant. The blast radius of an abused request is a notification and an\n       * audit row naming the operator.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — elevation is requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [PlatformAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            admitsCrossTenantPlatformAdministration: true,\n            /**\n             * `organizationId` deliberately does NOT appear in this body DTO. The organization is\n             * already the mandatory primary-scope path segment and the execution-context creator\n             * validates that URL value before dispatch. Requiring it again in JSON made clients\n             * author the same security-critical target twice and created an avoidable mismatch case.\n             *\n             * WHERE AN OPERATOR GETS the path id is still a deliberate product decision. There is\n             * no in-product surface that lists organizations the operator does not belong to:\n             * `organizations | LIST` is confined to the caller's own memberships. The id therefore\n             * arrives with the customer support case, where it is also present in support URLs,\n             * organization notifications and the audit trail.\n             *\n             * Do not widen `organizations | LIST` to make discovery convenient: a browsable\n             * directory is the customer list and would restore the standing cross-tenant\n             * visibility this workflow exists to avoid.\n             */\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 4h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional().describe(\"How long the access lasts, in whole minutes, counted from this request rather than from approval. Defaults to 60; a longer request is reduced to 240 rather than refused.\"),\n            }),\n          },\n        ],\n        userNotifications: [\n          {\n            // The tenant learns immediately that an operator asked for access — before it happens,\n            // not after. Under the approval posture this notification IS the request; without it,\n            // opting in would give a tenant a decision it never hears about.\n            target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n            channel: CoreUserNotificationChannel.EMAIL,\n          },\n        ],\n      },\n\n      /**\n       * The tenant's decision. Gated on the TENANT's own roles and deliberately NOT reachable by the\n       * platform: an operator who could approve their own request would make the whole Lockbox\n       * posture ceremonial. Note the absence of `admitsCrossTenantPlatformAdministration` here — that\n       * absence is the control, so do not add it \"for symmetry\".\n       */\n      [PlatformAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            // Only a request still awaiting a decision can be decided. Fails closed server-side, so a\n            // replayed approval cannot revive a denied, revoked or expired grant.\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      [PlatformAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /**\n       * Ending an elevation early. Reachable by BOTH sides, which is why it carries the cross-tenant\n       * admission while `approve`/`deny` do not: a tenant revokes access it granted, and an operator\n       * closes out their own session rather than leaving a live window open until it lapses.\n       *\n       * Revoking is monotonic — it only ever removes authority — so admitting the platform side costs\n       * nothing the reversibility test would object to.\n       */\n      /**\n       * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and\n       * by nothing else (#413). INTERNAL_CALL: no route, no frontend affordance, and therefore no\n       * `admitsCrossTenantPlatformAdministration` — the tenant-boundary question does not arise for\n       * an operation no request can reach.\n       *\n       * The transition precondition lives in the paired implementation, which permits it only from\n       * ACTIVE: a grant the tenant DENIED or REVOKED must keep saying so, and relabelling a\n       * terminal grant would rewrite the decision history a customer audit reads.\n       */\n      [PlatformAccessGrants_Operations.EXPIRE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n            // and the paired prefix implementation forces the status transition itself, so there is no field\n            // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n            // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n            // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n            requestDto: z.object({}),\n          },\n        ],\n      },\n\n      [PlatformAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            admitsCrossTenantPlatformAdministration: true,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n    },\n    // NOTE: the ORGANIZATIONS primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (ORGANIZATIONS → PLATFORM_ACCESS_GRANTS), which is\n    // the single place scope is expressed for every resource. Declaring it twice would let the two\n    // drift, and the relationship is the one the authorizer actually reads.\n  });\n"]}

package/dist/esm/security/authorizations/roles.shared.defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.shared.defaults.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAkC,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5F,eAAO,MAAM,8BAA8B,EAAE,kBA8C5C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,kBA8BxC,CAAC"}
+{"version":3,"file":"roles.shared.defaults.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAkC,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5F,eAAO,MAAM,8BAA8B,EAAE,kBA0D5C,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,kBA0ExC,CAAC"}

package/dist/esm/security/authorizations/roles.shared.defaults.js

@@ -47,6 +47,18 @@ export const DEFAULT_APP_ROLE_CONFIGURATION = {
         isSystemRole: true,
         relatedPrimaryScope: ResourcePrimaryScope.APPLICATION
     },
+    // No `inheritFrom`: handler-only, confers exactly the billing operations that name it (#1629).
+    [CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS]: {
+        role: CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.APPLICATION
+    },
+    // No `inheritFrom`: handler-only, and no operation names it — the email intake writes as the engine (#1600).
+    [CORE_APP_ROLES.APP_EMAIL_INBOUND_INTAKE]: {
+        role: CORE_APP_ROLES.APP_EMAIL_INBOUND_INTAKE,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.APPLICATION
+    },
     [CORE_APP_ROLES.APP_ANONYMOUS]: {
         role: CORE_APP_ROLES.APP_ANONYMOUS,
         isSystemRole: true,
@@ -65,6 +77,12 @@ export const DEFAULT_ORGANIZATION_ROLES = {
         isSystemRole: true,
         relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
     },
+    [CORE_ORG_ROLES.ORG_SERVICE_PROVIDER]: {
+        role: CORE_ORG_ROLES.ORG_SERVICE_PROVIDER,
+        inheritFrom: CORE_ORG_ROLES.ORG_MEMBER,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
     [CORE_ORG_ROLES.ORG_MANAGER]: {
         role: CORE_ORG_ROLES.ORG_MANAGER,
         inheritFrom: CORE_ORG_ROLES.ORG_MEMBER,
@@ -82,6 +100,44 @@ export const DEFAULT_ORGANIZATION_ROLES = {
         inheritFrom: CORE_ORG_ROLES.ORG_ADMIN,
         isSystemRole: true,
         relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
+    // No `inheritFrom`: handler-only, confers exactly the billing operations that name it (#1629).
+    [CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS]: {
+        role: CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
+    // No `inheritFrom` on any delegated capability (#1631): each confers exactly the operations that name it, and
+    // inheriting anything would make a lent capability's reach a function of what that role grows into later.
+    [CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS]: {
+        role: CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
+    [CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS]: {
+        role: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
+    [CORE_ORG_ROLES.ORG_DELEGATED_READ_AUDIT_TRAIL]: {
+        role: CORE_ORG_ROLES.ORG_DELEGATED_READ_AUDIT_TRAIL,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
+    [CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM]: {
+        role: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
+    [CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS]: {
+        role: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
+    },
+    [CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS]: {
+        role: CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS,
+        isSystemRole: true,
+        relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS
     }
 };
 //# sourceMappingURL=roles.shared.defaults.js.map

package/dist/esm/security/authorizations/roles.shared.defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.shared.defaults.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAsB,MAAM,wBAAwB,CAAC;AAE5F,MAAM,CAAC,MAAM,8BAA8B,GAAuB;IAChE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;QAC3B,IAAI,EAAE,cAAc,CAAC,UAAU;QAC/B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,IAAI,EAAE,cAAc,CAAC,QAAQ;QAC7B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE;QACjC,IAAI,EAAE,cAAc,CAAC,gBAAgB;QACrC,WAAW,EAAE,cAAc,CAAC,QAAQ;QACpC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;QAC3C,IAAI,EAAE,cAAc,CAAC,0BAA0B;QAC/C,WAAW,EAAE,cAAc,CAAC,gBAAgB;QAC5C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE;QAC1C,IAAI,EAAE,cAAc,CAAC,yBAAyB;QAC9C,WAAW,EAAE,cAAc,CAAC,gBAAgB;QAC5C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE;QACtC,IAAI,EAAE,cAAc,CAAC,qBAAqB;QAC1C,WAAW,EAAE,cAAc,CAAC,yBAAyB;QACrD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,iGAAiG;IACjG,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE;QAC1C,IAAI,EAAE,cAAc,CAAC,yBAAyB;QAC9C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE;QAC9B,IAAI,EAAE,cAAc,CAAC,aAAa;QAClC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAuB;IAC5D,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;QAC3B,IAAI,EAAE,cAAc,CAAC,UAAU;QAC/B,WAAW,EAAE,cAAc,CAAC,SAAS;QACrC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE;QAC5B,IAAI,EAAE,cAAc,CAAC,WAAW;QAChC,WAAW,EAAE,cAAc,CAAC,UAAU;QACtC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,WAAW,EAAE,cAAc,CAAC,WAAW;QACvC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,WAAW,EAAE,cAAc,CAAC,SAAS;QACrC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;CACF,CAAC","sourcesContent":["/**\n * App Roles Shared Schemas\n *\n * Application-level roles directly linked to users (not organization-specific)\n * Similar behavior to OrganizationRole but for app-wide permissions\n */\n\nimport { ResourcePrimaryScope } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES, RolesConfiguration } from './roles.shared.schemas';\n\nexport const DEFAULT_APP_ROLE_CONFIGURATION: RolesConfiguration = {\n  [CORE_APP_ROLES.APP_PUBLIC]: {\n    role: CORE_APP_ROLES.APP_PUBLIC,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_USER]: {\n    role: CORE_APP_ROLES.APP_USER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_VIEWER]: {\n    role: CORE_APP_ROLES.APP_ADMIN_VIEWER,\n    inheritFrom: CORE_APP_ROLES.APP_USER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR]: {\n    role: CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR,\n    inheritFrom: CORE_APP_ROLES.APP_ADMIN_VIEWER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER]: {\n    role: CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,\n    inheritFrom: CORE_APP_ROLES.APP_ADMIN_VIEWER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN]: {\n    role: CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,\n    inheritFrom: CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  // No `inheritFrom`: the reader confers exactly the operations that name it. See the enum member.\n  [CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER]: {\n    role: CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ANONYMOUS]: {\n    role: CORE_APP_ROLES.APP_ANONYMOUS,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n};\n\nexport const DEFAULT_ORGANIZATION_ROLES: RolesConfiguration = {\n  [CORE_ORG_ROLES.ORG_GUEST]: {\n    role: CORE_ORG_ROLES.ORG_GUEST,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_MEMBER]: {\n    role: CORE_ORG_ROLES.ORG_MEMBER,\n    inheritFrom: CORE_ORG_ROLES.ORG_GUEST,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_MANAGER]: {\n    role: CORE_ORG_ROLES.ORG_MANAGER,\n    inheritFrom: CORE_ORG_ROLES.ORG_MEMBER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_ADMIN]: {\n    role: CORE_ORG_ROLES.ORG_ADMIN,\n    inheritFrom: CORE_ORG_ROLES.ORG_MANAGER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_OWNER]: {\n    role: CORE_ORG_ROLES.ORG_OWNER,\n    inheritFrom: CORE_ORG_ROLES.ORG_ADMIN,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  }\n};\n\n"]}
+{"version":3,"file":"roles.shared.defaults.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAsB,MAAM,wBAAwB,CAAC;AAE5F,MAAM,CAAC,MAAM,8BAA8B,GAAuB;IAChE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;QAC3B,IAAI,EAAE,cAAc,CAAC,UAAU;QAC/B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,IAAI,EAAE,cAAc,CAAC,QAAQ;QAC7B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE;QACjC,IAAI,EAAE,cAAc,CAAC,gBAAgB;QACrC,WAAW,EAAE,cAAc,CAAC,QAAQ;QACpC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;QAC3C,IAAI,EAAE,cAAc,CAAC,0BAA0B;QAC/C,WAAW,EAAE,cAAc,CAAC,gBAAgB;QAC5C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE;QAC1C,IAAI,EAAE,cAAc,CAAC,yBAAyB;QAC9C,WAAW,EAAE,cAAc,CAAC,gBAAgB;QAC5C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE;QACtC,IAAI,EAAE,cAAc,CAAC,qBAAqB;QAC1C,WAAW,EAAE,cAAc,CAAC,yBAAyB;QACrD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,iGAAiG;IACjG,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE;QAC1C,IAAI,EAAE,cAAc,CAAC,yBAAyB;QAC9C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,+FAA+F;IAC/F,CAAC,cAAc,CAAC,2BAA2B,CAAC,EAAE;QAC5C,IAAI,EAAE,cAAc,CAAC,2BAA2B;QAChD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,6GAA6G;IAC7G,CAAC,cAAc,CAAC,wBAAwB,CAAC,EAAE;QACzC,IAAI,EAAE,cAAc,CAAC,wBAAwB;QAC7C,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;IACD,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE;QAC9B,IAAI,EAAE,cAAc,CAAC,aAAa;QAClC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,WAAW;KACtD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAuB;IAC5D,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;QAC3B,IAAI,EAAE,cAAc,CAAC,UAAU;QAC/B,WAAW,EAAE,cAAc,CAAC,SAAS;QACrC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE;QACrC,IAAI,EAAE,cAAc,CAAC,oBAAoB;QACzC,WAAW,EAAE,cAAc,CAAC,UAAU;QACtC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE;QAC5B,IAAI,EAAE,cAAc,CAAC,WAAW;QAChC,WAAW,EAAE,cAAc,CAAC,UAAU;QACtC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,WAAW,EAAE,cAAc,CAAC,WAAW;QACvC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC1B,IAAI,EAAE,cAAc,CAAC,SAAS;QAC9B,WAAW,EAAE,cAAc,CAAC,SAAS;QACrC,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,+FAA+F;IAC/F,CAAC,cAAc,CAAC,2BAA2B,CAAC,EAAE;QAC5C,IAAI,EAAE,cAAc,CAAC,2BAA2B;QAChD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,8GAA8G;IAC9G,0GAA0G;IAC1G,CAAC,cAAc,CAAC,4BAA4B,CAAC,EAAE;QAC7C,IAAI,EAAE,cAAc,CAAC,4BAA4B;QACjD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,yCAAyC,CAAC,EAAE;QAC1D,IAAI,EAAE,cAAc,CAAC,yCAAyC;QAC9D,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,8BAA8B,CAAC,EAAE;QAC/C,IAAI,EAAE,cAAc,CAAC,8BAA8B;QACnD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,6BAA6B,CAAC,EAAE;QAC9C,IAAI,EAAE,cAAc,CAAC,6BAA6B;QAClD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,6BAA6B,CAAC,EAAE;QAC9C,IAAI,EAAE,cAAc,CAAC,6BAA6B;QAClD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;IACD,CAAC,cAAc,CAAC,mCAAmC,CAAC,EAAE;QACpD,IAAI,EAAE,cAAc,CAAC,mCAAmC;QACxD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;KACxD;CACF,CAAC","sourcesContent":["/**\n * App Roles Shared Schemas\n *\n * Application-level roles directly linked to users (not organization-specific)\n * Similar behavior to OrganizationRole but for app-wide permissions\n */\n\nimport { ResourcePrimaryScope } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES, RolesConfiguration } from './roles.shared.schemas';\n\nexport const DEFAULT_APP_ROLE_CONFIGURATION: RolesConfiguration = {\n  [CORE_APP_ROLES.APP_PUBLIC]: {\n    role: CORE_APP_ROLES.APP_PUBLIC,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_USER]: {\n    role: CORE_APP_ROLES.APP_USER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_VIEWER]: {\n    role: CORE_APP_ROLES.APP_ADMIN_VIEWER,\n    inheritFrom: CORE_APP_ROLES.APP_USER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR]: {\n    role: CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR,\n    inheritFrom: CORE_APP_ROLES.APP_ADMIN_VIEWER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER]: {\n    role: CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,\n    inheritFrom: CORE_APP_ROLES.APP_ADMIN_VIEWER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN]: {\n    role: CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,\n    inheritFrom: CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  // No `inheritFrom`: the reader confers exactly the operations that name it. See the enum member.\n  [CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER]: {\n    role: CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  // No `inheritFrom`: handler-only, confers exactly the billing operations that name it (#1629).\n  [CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS]: {\n    role: CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  // No `inheritFrom`: handler-only, and no operation names it — the email intake writes as the engine (#1600).\n  [CORE_APP_ROLES.APP_EMAIL_INBOUND_INTAKE]: {\n    role: CORE_APP_ROLES.APP_EMAIL_INBOUND_INTAKE,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n  [CORE_APP_ROLES.APP_ANONYMOUS]: {\n    role: CORE_APP_ROLES.APP_ANONYMOUS,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.APPLICATION\n  },\n};\n\nexport const DEFAULT_ORGANIZATION_ROLES: RolesConfiguration = {\n  [CORE_ORG_ROLES.ORG_GUEST]: {\n    role: CORE_ORG_ROLES.ORG_GUEST,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_MEMBER]: {\n    role: CORE_ORG_ROLES.ORG_MEMBER,\n    inheritFrom: CORE_ORG_ROLES.ORG_GUEST,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_SERVICE_PROVIDER]: {\n    role: CORE_ORG_ROLES.ORG_SERVICE_PROVIDER,\n    inheritFrom: CORE_ORG_ROLES.ORG_MEMBER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_MANAGER]: {\n    role: CORE_ORG_ROLES.ORG_MANAGER,\n    inheritFrom: CORE_ORG_ROLES.ORG_MEMBER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_ADMIN]: {\n    role: CORE_ORG_ROLES.ORG_ADMIN,\n    inheritFrom: CORE_ORG_ROLES.ORG_MANAGER,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_OWNER]: {\n    role: CORE_ORG_ROLES.ORG_OWNER,\n    inheritFrom: CORE_ORG_ROLES.ORG_ADMIN,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  // No `inheritFrom`: handler-only, confers exactly the billing operations that name it (#1629).\n  [CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS]: {\n    role: CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  // No `inheritFrom` on any delegated capability (#1631): each confers exactly the operations that name it, and\n  // inheriting anything would make a lent capability's reach a function of what that role grows into later.\n  [CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS]: {\n    role: CORE_ORG_ROLES.ORG_DELEGATED_INVITE_MEMBERS,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS]: {\n    role: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_DELEGATED_READ_AUDIT_TRAIL]: {\n    role: CORE_ORG_ROLES.ORG_DELEGATED_READ_AUDIT_TRAIL,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM]: {\n    role: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS]: {\n    role: CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_API_KEYS,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  },\n  [CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS]: {\n    role: CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS,\n    isSystemRole: true,\n    relatedPrimaryScope: ResourcePrimaryScope.ORGANIZATIONS\n  }\n};\n\n"]}

package/dist/esm/security/authorizations/roles.shared.schemas.d.ts

@@ -36,6 +36,26 @@ export declare enum CORE_APP_ROLES {
      * application audit-log door's read verbs (`APPLICATION_AUDIT_LOG_READ_ROLES`).
      */
     APP_AUDIT_EVIDENCE_READER = "APP_AUDIT_EVIDENCE_READER",
+    /**
+     * The engine's billing inbound handler, acting on a signature-verified provider event that belongs to ONE
+     * person's billing account (#1629). The user-scope twin of `ORG_BILLING_PROVIDER_EVENTS`: personal
+     * (`USER_SELF`) billing variants gate on application roles, so the handler's authority there is an
+     * application role, confined to the delivery's scope user by the ownership check.
+     *
+     * HANDLER-ONLY — a member of {@link INBOUND_HANDLER_ONLY_ROLES}. It confers nothing to a person, an API
+     * key or an OAuth client, and inherits from nothing: it grants exactly the billing operations that name it.
+     */
+    APP_BILLING_PROVIDER_EVENTS = "APP_BILLING_PROVIDER_EVENTS",
+    /**
+     * The engine's email intake (#1600): the stage-1 handler that fetches a received message from the provider,
+     * routes each recipient address to an organization, stores the message and hands it to the email channel.
+     * It writes as the engine's infrastructure and calls NO resource operation, so no operation names this role
+     * and it grants nothing — it exists because an application-scope delivery must run as SOME role, and every
+     * other role would grant something.
+     *
+     * HANDLER-ONLY — a member of {@link INBOUND_HANDLER_ONLY_ROLES}. Inherits from nothing.
+     */
+    APP_EMAIL_INBOUND_INTAKE = "APP_EMAIL_INBOUND_INTAKE",
     APP_USER = "APP_USER",
     /** Anonymous session access. Operations with APP_ANONYMOUS are accessible to anonymous users. */
     APP_ANONYMOUS = "APP_ANONYMOUS"
@@ -54,8 +74,64 @@ export declare enum CORE_ORG_ROLES {
     ORG_OWNER = "ORG_OWNER",
     ORG_ADMIN = "ORG_ADMIN",
     ORG_MANAGER = "ORG_MANAGER",
-    ORG_MEMBER = "ORG_MEMBER"
+    ORG_MEMBER = "ORG_MEMBER",
+    /**
+     * An expert of a SERVICE FIRM working inside this organization under a service-provider relationship
+     * the organization controls (`SERVICE_PROVIDER_RELATIONSHIPS`). Inherits `ORG_MEMBER`, never more:
+     * the relationship's role may be any role the client type makes available EXCEPT one that leads up to
+     * `ORG_ADMIN`, which startup refuses. Administrative authority is never conferred by a relationship by
+     * default (delegated administration is a separate, narrow, time-bound grant).
+     */
+    ORG_SERVICE_PROVIDER = "ORG_SERVICE_PROVIDER",
+    /**
+     * The engine's billing inbound handler, acting on a signature-verified provider event that belongs to ONE
+     * organization's billing account (#1629). It replaced the role-free `WEBHOOK_CALLBACK` bypass, under which
+     * every billing webhook write ran with no role check and no tenant filter.
+     *
+     * Grants exactly what the event handlers do and nothing more: read the organization's billing account,
+     * subscriptions, invoice references and credit pools; create and update subscriptions and invoice
+     * references; create a credit pool and top it up; deactivate the billing account. Inherits from nothing.
+     *
+     * HANDLER-ONLY — a member of {@link INBOUND_HANDLER_ONLY_ROLES}. It confers nothing to a person, an API
+     * key or an OAuth client.
+     */
+    ORG_BILLING_PROVIDER_EVENTS = "ORG_BILLING_PROVIDER_EVENTS",
+    /** Invite people into the organization, resend an invitation, revoke one. */
+    ORG_DELEGATED_INVITE_MEMBERS = "ORG_DELEGATED_INVITE_MEMBERS",
+    /** Suspend, reactivate or remove the delegating firm's OWN experts under the same relationship. */
+    ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS = "ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS",
+    /** Read the organization's audit trail. */
+    ORG_DELEGATED_READ_AUDIT_TRAIL = "ORG_DELEGATED_READ_AUDIT_TRAIL",
+    /** Configure the organization's SSO and SCIM provisioning. Security-critical: owner-granted, time-bound. */
+    ORG_DELEGATED_MANAGE_SSO_SCIM = "ORG_DELEGATED_MANAGE_SSO_SCIM",
+    /** Manage the organization's API keys. Security-critical: owner-granted, time-bound. */
+    ORG_DELEGATED_MANAGE_API_KEYS = "ORG_DELEGATED_MANAGE_API_KEYS",
+    /** Approve or deny, as the tenant, a platform operator's access request. Security-critical: owner-granted, time-bound. */
+    ORG_DELEGATED_APPROVE_ACCESS_GRANTS = "ORG_DELEGATED_APPROVE_ACCESS_GRANTS"
 }
+/**
+ * Roles only an ENGINE inbound handler may act with (#1629) — never a person, an API key, an OAuth client or
+ * an application's own handler.
+ *
+ * ## Why a named set, and where it is enforced
+ *
+ * A role is granted through many doors — organization and unit memberships, a user's application roles,
+ * invitations, SSO and SCIM mappings, machine credentials — and several of them accept any string (the
+ * member-role check is skipped entirely when an application declares no organization types). Guarding each
+ * door would be the one-of-N shape `invariant-call-site-enumeration.md` records. So the set is enforced where
+ * every principal converges instead:
+ *
+ * - the `ExecutionContext` constructor refuses a context carrying one of these roles unless it is an
+ *   `INBOUND_DELIVERY` context, so a grant that slipped through any door cannot confer anything;
+ * - the inbound handler registry refuses them in an application handler's `actingRoles`, so only the engine's
+ *   own handler, which declares the engine capability, may act with them.
+ *
+ * The write doors that are cheap to guard (the organization member roles) refuse them too, so a mistaken grant
+ * is answered where it is made rather than when the member next signs in.
+ */
+export declare const INBOUND_HANDLER_ONLY_ROLES: ReadonlySet<string>;
+/** Whether `role` is one only an engine inbound handler may act with. */
+export declare function isInboundHandlerOnlyRole(role: string): boolean;
 export declare const CoreRolesSchema: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>]>;
 export declare const RolesSchema: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodEnum<typeof CORE_ORG_ROLES>, z.ZodString]>;
 export declare const AppRolesSchema: z.ZodUnion<readonly [z.ZodEnum<typeof CORE_APP_ROLES>, z.ZodString]>;

package/dist/esm/security/authorizations/roles.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAEhF,oBAAY,cAAc;IACxB;;;;;;;;;;;;;;;OAeG;IACH,UAAU,eAAe;IACzB,qBAAqB,0BAA0B;IAC/C,yBAAyB,8BAA8B;IACvD,0BAA0B,+BAA+B;IACzD,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;OAYG;IACH,yBAAyB,8BAA8B;IACvD,QAAQ,aAAa;IACrB,iGAAiG;IACjG,aAAa,kBAAkB;CAChC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC,EAAE,SAAS,cAAc,EAUzE,CAAC;AAEH,oBAAY,cAAc;IACxB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;CAC1B;AAGD,eAAO,MAAM,eAAe,2FAG1B,CAAC;AAEH,eAAO,MAAM,WAAW,wGAItB,CAAC;AAEH,eAAO,MAAM,cAAc,sEAGzB,CAAC;AAEH,eAAO,MAAM,cAAc,sEAGzB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;kBAYpC,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAChD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"roles.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAEhF,oBAAY,cAAc;IACxB;;;;;;;;;;;;;;;OAeG;IACH,UAAU,eAAe;IACzB,qBAAqB,0BAA0B;IAC/C,yBAAyB,8BAA8B;IACvD,0BAA0B,+BAA+B;IACzD,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;OAYG;IACH,yBAAyB,8BAA8B;IACvD;;;;;;;;OAQG;IACH,2BAA2B,gCAAgC;IAC3D;;;;;;;;OAQG;IACH,wBAAwB,6BAA6B;IACrD,QAAQ,aAAa;IACrB,iGAAiG;IACjG,aAAa,kBAAkB;CAChC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC,EAAE,SAAS,cAAc,EAUzE,CAAC;AAEH,oBAAY,cAAc;IACxB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,UAAU,eAAe;IACzB;;;;;;OAMG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;;;;;;;OAWG;IACH,2BAA2B,gCAAgC;IAQ3D,6EAA6E;IAC7E,4BAA4B,iCAAiC;IAC7D,mGAAmG;IACnG,yCAAyC,8CAA8C;IACvF,2CAA2C;IAC3C,8BAA8B,mCAAmC;IACjE,4GAA4G;IAC5G,6BAA6B,kCAAkC;IAC/D,wFAAwF;IACxF,6BAA6B,kCAAkC;IAC/D,0HAA0H;IAC1H,mCAAmC,wCAAwC;CAC5E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAIzD,CAAC;AAEH,yEAAyE;AACzE,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D;AAGD,eAAO,MAAM,eAAe,2FAG1B,CAAC;AAEH,eAAO,MAAM,WAAW,wGAItB,CAAC;AAEH,eAAO,MAAM,cAAc,sEAGzB,CAAC;AAEH,eAAO,MAAM,cAAc,sEAGzB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AAGH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;kBAYpC,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAChD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/esm/security/authorizations/roles.shared.schemas.js

@@ -37,6 +37,26 @@ export var CORE_APP_ROLES;
      * application audit-log door's read verbs (`APPLICATION_AUDIT_LOG_READ_ROLES`).
      */
     CORE_APP_ROLES["APP_AUDIT_EVIDENCE_READER"] = "APP_AUDIT_EVIDENCE_READER";
+    /**
+     * The engine's billing inbound handler, acting on a signature-verified provider event that belongs to ONE
+     * person's billing account (#1629). The user-scope twin of `ORG_BILLING_PROVIDER_EVENTS`: personal
+     * (`USER_SELF`) billing variants gate on application roles, so the handler's authority there is an
+     * application role, confined to the delivery's scope user by the ownership check.
+     *
+     * HANDLER-ONLY — a member of {@link INBOUND_HANDLER_ONLY_ROLES}. It confers nothing to a person, an API
+     * key or an OAuth client, and inherits from nothing: it grants exactly the billing operations that name it.
+     */
+    CORE_APP_ROLES["APP_BILLING_PROVIDER_EVENTS"] = "APP_BILLING_PROVIDER_EVENTS";
+    /**
+     * The engine's email intake (#1600): the stage-1 handler that fetches a received message from the provider,
+     * routes each recipient address to an organization, stores the message and hands it to the email channel.
+     * It writes as the engine's infrastructure and calls NO resource operation, so no operation names this role
+     * and it grants nothing — it exists because an application-scope delivery must run as SOME role, and every
+     * other role would grant something.
+     *
+     * HANDLER-ONLY — a member of {@link INBOUND_HANDLER_ONLY_ROLES}. Inherits from nothing.
+     */
+    CORE_APP_ROLES["APP_EMAIL_INBOUND_INTAKE"] = "APP_EMAIL_INBOUND_INTAKE";
     CORE_APP_ROLES["APP_USER"] = "APP_USER";
     /** Anonymous session access. Operations with APP_ANONYMOUS are accessible to anonymous users. */
     CORE_APP_ROLES["APP_ANONYMOUS"] = "APP_ANONYMOUS";
@@ -67,7 +87,77 @@ export var CORE_ORG_ROLES;
     CORE_ORG_ROLES["ORG_ADMIN"] = "ORG_ADMIN";
     CORE_ORG_ROLES["ORG_MANAGER"] = "ORG_MANAGER";
     CORE_ORG_ROLES["ORG_MEMBER"] = "ORG_MEMBER";
+    /**
+     * An expert of a SERVICE FIRM working inside this organization under a service-provider relationship
+     * the organization controls (`SERVICE_PROVIDER_RELATIONSHIPS`). Inherits `ORG_MEMBER`, never more:
+     * the relationship's role may be any role the client type makes available EXCEPT one that leads up to
+     * `ORG_ADMIN`, which startup refuses. Administrative authority is never conferred by a relationship by
+     * default (delegated administration is a separate, narrow, time-bound grant).
+     */
+    CORE_ORG_ROLES["ORG_SERVICE_PROVIDER"] = "ORG_SERVICE_PROVIDER";
+    /**
+     * The engine's billing inbound handler, acting on a signature-verified provider event that belongs to ONE
+     * organization's billing account (#1629). It replaced the role-free `WEBHOOK_CALLBACK` bypass, under which
+     * every billing webhook write ran with no role check and no tenant filter.
+     *
+     * Grants exactly what the event handlers do and nothing more: read the organization's billing account,
+     * subscriptions, invoice references and credit pools; create and update subscriptions and invoice
+     * references; create a credit pool and top it up; deactivate the billing account. Inherits from nothing.
+     *
+     * HANDLER-ONLY — a member of {@link INBOUND_HANDLER_ONLY_ROLES}. It confers nothing to a person, an API
+     * key or an OAuth client.
+     */
+    CORE_ORG_ROLES["ORG_BILLING_PROVIDER_EVENTS"] = "ORG_BILLING_PROVIDER_EVENTS";
+    /*
+     * DELEGATED ADMINISTRATIVE CAPABILITIES (#1631) — one role per `DelegatedAdministrativeCapability`, conferred ONLY by
+     * a live `SERVICE_PROVIDER_CAPABILITY_GRANTS` row to a service firm's experts, through the execution-context live
+     * filter; the member role doors refuse them on any membership row. Each inherits from NOTHING and is listed
+     * explicitly, beside `ORG_ADMIN`, in the `roles` of exactly the core operations it opens — so it confers those
+     * operations and no others, and never leads to `ORG_ADMIN` / `ORG_OWNER` (startup refuses a capability role that does).
+     */
+    /** Invite people into the organization, resend an invitation, revoke one. */
+    CORE_ORG_ROLES["ORG_DELEGATED_INVITE_MEMBERS"] = "ORG_DELEGATED_INVITE_MEMBERS";
+    /** Suspend, reactivate or remove the delegating firm's OWN experts under the same relationship. */
+    CORE_ORG_ROLES["ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS"] = "ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS";
+    /** Read the organization's audit trail. */
+    CORE_ORG_ROLES["ORG_DELEGATED_READ_AUDIT_TRAIL"] = "ORG_DELEGATED_READ_AUDIT_TRAIL";
+    /** Configure the organization's SSO and SCIM provisioning. Security-critical: owner-granted, time-bound. */
+    CORE_ORG_ROLES["ORG_DELEGATED_MANAGE_SSO_SCIM"] = "ORG_DELEGATED_MANAGE_SSO_SCIM";
+    /** Manage the organization's API keys. Security-critical: owner-granted, time-bound. */
+    CORE_ORG_ROLES["ORG_DELEGATED_MANAGE_API_KEYS"] = "ORG_DELEGATED_MANAGE_API_KEYS";
+    /** Approve or deny, as the tenant, a platform operator's access request. Security-critical: owner-granted, time-bound. */
+    CORE_ORG_ROLES["ORG_DELEGATED_APPROVE_ACCESS_GRANTS"] = "ORG_DELEGATED_APPROVE_ACCESS_GRANTS";
 })(CORE_ORG_ROLES || (CORE_ORG_ROLES = {}));
+/**
+ * Roles only an ENGINE inbound handler may act with (#1629) — never a person, an API key, an OAuth client or
+ * an application's own handler.
+ *
+ * ## Why a named set, and where it is enforced
+ *
+ * A role is granted through many doors — organization and unit memberships, a user's application roles,
+ * invitations, SSO and SCIM mappings, machine credentials — and several of them accept any string (the
+ * member-role check is skipped entirely when an application declares no organization types). Guarding each
+ * door would be the one-of-N shape `invariant-call-site-enumeration.md` records. So the set is enforced where
+ * every principal converges instead:
+ *
+ * - the `ExecutionContext` constructor refuses a context carrying one of these roles unless it is an
+ *   `INBOUND_DELIVERY` context, so a grant that slipped through any door cannot confer anything;
+ * - the inbound handler registry refuses them in an application handler's `actingRoles`, so only the engine's
+ *   own handler, which declares the engine capability, may act with them.
+ *
+ * The write doors that are cheap to guard (the organization member roles) refuse them too, so a mistaken grant
+ * is answered where it is made rather than when the member next signs in.
+ */
+// assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the roles cut for one engine handler's writes confer nothing to any other principal (#1629).
+export const INBOUND_HANDLER_ONLY_ROLES = new Set([
+    CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS,
+    CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS,
+    CORE_APP_ROLES.APP_EMAIL_INBOUND_INTAKE,
+]);
+/** Whether `role` is one only an engine inbound handler may act with. */
+export function isInboundHandlerOnlyRole(role) {
+    return INBOUND_HANDLER_ONLY_ROLES.has(role);
+}
 export const CoreRolesSchema = z.union([
     z.enum(CORE_APP_ROLES),
     z.enum(CORE_ORG_ROLES),

package/dist/esm/security/authorizations/roles.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAEhF,MAAM,CAAN,IAAY,cAuCX;AAvCD,WAAY,cAAc;IACxB;;;;;;;;;;;;;;;OAeG;IACH,2CAAyB,CAAA;IACzB,iEAA+C,CAAA;IAC/C,yEAAuD,CAAA;IACvD,2EAAyD,CAAA;IACzD,uDAAqC,CAAA;IACrC;;;;;;;;;;;;OAYG;IACH,yEAAuD,CAAA;IACvD,uCAAqB,CAAA;IACrB,iGAAiG;IACjG,iDAA+B,CAAA;AACjC,CAAC,EAvCW,cAAc,KAAd,cAAc,QAuCzB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAA8B,MAAM,CAAC,MAAM,CAAC;IAC5F,cAAc,CAAC,qBAAqB;IACpC,cAAc,CAAC,yBAAyB;IACxC,cAAc,CAAC,0BAA0B;IACzC,cAAc,CAAC,gBAAgB;IAC/B,+FAA+F;IAC/F,sFAAsF;IACtF,iGAAiG;IACjG,uDAAuD;IACvD,cAAc,CAAC,yBAAyB;CACzC,CAAC,CAAC;AAEH,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,yCAAuB,CAAA;IACvB,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,2CAAyB,CAAA;AAC3B,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AAGD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC;IACjC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,mBAAmB,EAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;CACnD,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,MAAM,CACvF,CAAC,MAAM,EAAE,EAAE;IACT,yCAAyC;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACrC,IAAI,CAAC;YACH,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC","sourcesContent":["\nimport { z } from 'zod';\nimport { ResourcePrimaryScope } from '../../resources/resources.shared.schemas';\n\nexport enum CORE_APP_ROLES {\n  /**\n   * Open access: an operation declaring `APP_PUBLIC` requires NO credential, and imposes no role\n   * requirement on one that is presented.\n   *\n   * Not a role anybody is granted — a SENTINEL on the operation's `roles`, which is why the two\n   * halves above have to be stated together. \"Accessible without auth\" was the whole comment until\n   * 2026-08-31, and it was read as *reachable only when unauthenticated*: every role gate then\n   * refused a credentialed caller, so a public price list, catalogue or i18n bundle answered 200 to\n   * an anonymous probe and 403 to a logged-in customer (#153). Authenticating must never take access\n   * away.\n   *\n   * `requiredRolesDeclarePublicAccess` in `roles.shared.utils.ts` is the runtime source of this\n   * meaning; every gate consults it rather than re-deriving the test. Scope, tenancy and the\n   * repository's contextual filter are untouched by the declaration — it says no role is required to\n   * ASK, never that no scope confines the answer.\n   */\n  APP_PUBLIC = 'APP_PUBLIC',\n  APP_ADMIN_SUPER_ADMIN = 'APP_ADMIN_SUPER_ADMIN',\n  APP_ADMIN_BILLING_MANAGER = 'APP_ADMIN_BILLING_MANAGER',\n  APP_ADMIN_MARKETING_EDITOR = 'APP_ADMIN_MARKETING_EDITOR',\n  APP_ADMIN_VIEWER = 'APP_ADMIN_VIEWER',\n  /**\n   * Reads the application-wide audit trail and NOTHING else.\n   *\n   * Exists so the party that attests the application — an assurance evidence collector's machine\n   * credential, or an external auditor — does not have to hold `APP_ADMIN_SUPER_ADMIN`, which until\n   * 2026-09-13 was the only role the application audit door accepted. An auditor holding the largest\n   * standing privilege in the deployment is the concentration `WILDO.ACCESS.PRIVILEGED_REVIEW` exists\n   * to review, so the reader must not be it.\n   *\n   * Inherits from nothing, deliberately: a collector needs no `APP_USER` capability, and inheriting one\n   * would make the role's reach a function of whatever the user tier grows later. Named only by the\n   * application audit-log door's read verbs (`APPLICATION_AUDIT_LOG_READ_ROLES`).\n   */\n  APP_AUDIT_EVIDENCE_READER = 'APP_AUDIT_EVIDENCE_READER',\n  APP_USER = 'APP_USER',\n  /** Anonymous session access. Operations with APP_ANONYMOUS are accessible to anonymous users. */\n  APP_ANONYMOUS = 'APP_ANONYMOUS',\n}\n\n/**\n * Authorities that administer the generated application itself.\n *\n * This named subset is the canonical boundary used by consumer-facing\n * products such as the API reference. It prevents each downstream consumer\n * from guessing administrative meaning from `APP_ADMIN_` spelling or copying\n * an independent list that drifts when the role vocabulary evolves.\n */\nexport const CORE_APPLICATION_ADMINISTRATION_ROLES: readonly CORE_APP_ROLES[] = Object.freeze([\n  CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,\n  CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,\n  CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR,\n  CORE_APP_ROLES.APP_ADMIN_VIEWER,\n  // Reading the application's own audit trail is oversight of the APPLICATION, not access to its\n  // customer-facing domain — and the API reference files an operation under application\n  // administration only when EVERY role it accepts is in this set, so leaving the reader out would\n  // move the audit door into the customer API reference.\n  CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER,\n]);\n\nexport enum CORE_ORG_ROLES {\n  ORG_GUEST = 'ORG_GUEST',\n  ORG_OWNER = 'ORG_OWNER',\n  ORG_ADMIN = 'ORG_ADMIN',\n  ORG_MANAGER = 'ORG_MANAGER',\n  ORG_MEMBER = 'ORG_MEMBER',\n}\n\n\nexport const CoreRolesSchema = z.union([\n  z.enum(CORE_APP_ROLES),\n  z.enum(CORE_ORG_ROLES),\n]);\n\nexport const RolesSchema = z.union([\n  z.enum(CORE_APP_ROLES),\n  z.enum(CORE_ORG_ROLES),\n  z.string().min(1),\n]);\n\nexport const AppRolesSchema = z.union([\n  z.enum(CORE_APP_ROLES),\n  z.string().min(1),\n]);\n\nexport const OrgRolesSchema = z.union([\n  z.enum(CORE_ORG_ROLES),\n  z.string().min(1),\n]);\n\nexport const RoleDefinitionSchema = z.object({\n  role: RolesSchema,\n  inheritFrom: RolesSchema.optional(),\n  isSystemRole: z.boolean().default(false),\n  relatedPrimaryScope : z.enum(ResourcePrimaryScope),\n});\n\n\nexport type RoleDefinition = z.infer<typeof RoleDefinitionSchema>;\n\nexport const RolesConfigurationSchema = z.record(z.string(), RoleDefinitionSchema).refine(\n  (record) => {\n    // Validate that all keys are valid roles\n    return Object.keys(record).every(key => {\n      try {\n        RolesSchema.parse(key);\n        return true;\n      } catch {\n        return false;\n      }\n    });\n  }\n);\n\nexport type Roles = z.infer<typeof RolesSchema>;\nexport type CoreRoles = z.infer<typeof CoreRolesSchema>;\nexport type AppRoles = z.infer<typeof AppRolesSchema>;\nexport type OrgRoles = z.infer<typeof OrgRolesSchema>;\nexport type RolesConfiguration = z.infer<typeof RolesConfigurationSchema>;\n"]}
+{"version":3,"file":"roles.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/roles.shared.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAEhF,MAAM,CAAN,IAAY,cA2DX;AA3DD,WAAY,cAAc;IACxB;;;;;;;;;;;;;;;OAeG;IACH,2CAAyB,CAAA;IACzB,iEAA+C,CAAA;IAC/C,yEAAuD,CAAA;IACvD,2EAAyD,CAAA;IACzD,uDAAqC,CAAA;IACrC;;;;;;;;;;;;OAYG;IACH,yEAAuD,CAAA;IACvD;;;;;;;;OAQG;IACH,6EAA2D,CAAA;IAC3D;;;;;;;;OAQG;IACH,uEAAqD,CAAA;IACrD,uCAAqB,CAAA;IACrB,iGAAiG;IACjG,iDAA+B,CAAA;AACjC,CAAC,EA3DW,cAAc,KAAd,cAAc,QA2DzB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAA8B,MAAM,CAAC,MAAM,CAAC;IAC5F,cAAc,CAAC,qBAAqB;IACpC,cAAc,CAAC,yBAAyB;IACxC,cAAc,CAAC,0BAA0B;IACzC,cAAc,CAAC,gBAAgB;IAC/B,+FAA+F;IAC/F,sFAAsF;IACtF,iGAAiG;IACjG,uDAAuD;IACvD,cAAc,CAAC,yBAAyB;CACzC,CAAC,CAAC;AAEH,MAAM,CAAN,IAAY,cA8CX;AA9CD,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,yCAAuB,CAAA;IACvB,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,2CAAyB,CAAA;IACzB;;;;;;OAMG;IACH,+DAA6C,CAAA;IAC7C;;;;;;;;;;;OAWG;IACH,6EAA2D,CAAA;IAC3D;;;;;;OAMG;IACH,6EAA6E;IAC7E,+EAA6D,CAAA;IAC7D,mGAAmG;IACnG,yGAAuF,CAAA;IACvF,2CAA2C;IAC3C,mFAAiE,CAAA;IACjE,4GAA4G;IAC5G,iFAA+D,CAAA;IAC/D,wFAAwF;IACxF,iFAA+D,CAAA;IAC/D,0HAA0H;IAC1H,6FAA2E,CAAA;AAC7E,CAAC,EA9CW,cAAc,KAAd,cAAc,QA8CzB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,iJAAiJ;AACjJ,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAS;IAC7E,cAAc,CAAC,2BAA2B;IAC1C,cAAc,CAAC,2BAA2B;IAC1C,cAAc,CAAC,wBAAwB;CACxC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAGD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC;IACjC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IACtB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,mBAAmB,EAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC;CACnD,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,MAAM,CACvF,CAAC,MAAM,EAAE,EAAE;IACT,yCAAyC;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACrC,IAAI,CAAC;YACH,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CACF,CAAC","sourcesContent":["\nimport { z } from 'zod';\nimport { ResourcePrimaryScope } from '../../resources/resources.shared.schemas';\n\nexport enum CORE_APP_ROLES {\n  /**\n   * Open access: an operation declaring `APP_PUBLIC` requires NO credential, and imposes no role\n   * requirement on one that is presented.\n   *\n   * Not a role anybody is granted — a SENTINEL on the operation's `roles`, which is why the two\n   * halves above have to be stated together. \"Accessible without auth\" was the whole comment until\n   * 2026-08-31, and it was read as *reachable only when unauthenticated*: every role gate then\n   * refused a credentialed caller, so a public price list, catalogue or i18n bundle answered 200 to\n   * an anonymous probe and 403 to a logged-in customer (#153). Authenticating must never take access\n   * away.\n   *\n   * `requiredRolesDeclarePublicAccess` in `roles.shared.utils.ts` is the runtime source of this\n   * meaning; every gate consults it rather than re-deriving the test. Scope, tenancy and the\n   * repository's contextual filter are untouched by the declaration — it says no role is required to\n   * ASK, never that no scope confines the answer.\n   */\n  APP_PUBLIC = 'APP_PUBLIC',\n  APP_ADMIN_SUPER_ADMIN = 'APP_ADMIN_SUPER_ADMIN',\n  APP_ADMIN_BILLING_MANAGER = 'APP_ADMIN_BILLING_MANAGER',\n  APP_ADMIN_MARKETING_EDITOR = 'APP_ADMIN_MARKETING_EDITOR',\n  APP_ADMIN_VIEWER = 'APP_ADMIN_VIEWER',\n  /**\n   * Reads the application-wide audit trail and NOTHING else.\n   *\n   * Exists so the party that attests the application — an assurance evidence collector's machine\n   * credential, or an external auditor — does not have to hold `APP_ADMIN_SUPER_ADMIN`, which until\n   * 2026-09-13 was the only role the application audit door accepted. An auditor holding the largest\n   * standing privilege in the deployment is the concentration `WILDO.ACCESS.PRIVILEGED_REVIEW` exists\n   * to review, so the reader must not be it.\n   *\n   * Inherits from nothing, deliberately: a collector needs no `APP_USER` capability, and inheriting one\n   * would make the role's reach a function of whatever the user tier grows later. Named only by the\n   * application audit-log door's read verbs (`APPLICATION_AUDIT_LOG_READ_ROLES`).\n   */\n  APP_AUDIT_EVIDENCE_READER = 'APP_AUDIT_EVIDENCE_READER',\n  /**\n   * The engine's billing inbound handler, acting on a signature-verified provider event that belongs to ONE\n   * person's billing account (#1629). The user-scope twin of `ORG_BILLING_PROVIDER_EVENTS`: personal\n   * (`USER_SELF`) billing variants gate on application roles, so the handler's authority there is an\n   * application role, confined to the delivery's scope user by the ownership check.\n   *\n   * HANDLER-ONLY — a member of {@link INBOUND_HANDLER_ONLY_ROLES}. It confers nothing to a person, an API\n   * key or an OAuth client, and inherits from nothing: it grants exactly the billing operations that name it.\n   */\n  APP_BILLING_PROVIDER_EVENTS = 'APP_BILLING_PROVIDER_EVENTS',\n  /**\n   * The engine's email intake (#1600): the stage-1 handler that fetches a received message from the provider,\n   * routes each recipient address to an organization, stores the message and hands it to the email channel.\n   * It writes as the engine's infrastructure and calls NO resource operation, so no operation names this role\n   * and it grants nothing — it exists because an application-scope delivery must run as SOME role, and every\n   * other role would grant something.\n   *\n   * HANDLER-ONLY — a member of {@link INBOUND_HANDLER_ONLY_ROLES}. Inherits from nothing.\n   */\n  APP_EMAIL_INBOUND_INTAKE = 'APP_EMAIL_INBOUND_INTAKE',\n  APP_USER = 'APP_USER',\n  /** Anonymous session access. Operations with APP_ANONYMOUS are accessible to anonymous users. */\n  APP_ANONYMOUS = 'APP_ANONYMOUS',\n}\n\n/**\n * Authorities that administer the generated application itself.\n *\n * This named subset is the canonical boundary used by consumer-facing\n * products such as the API reference. It prevents each downstream consumer\n * from guessing administrative meaning from `APP_ADMIN_` spelling or copying\n * an independent list that drifts when the role vocabulary evolves.\n */\nexport const CORE_APPLICATION_ADMINISTRATION_ROLES: readonly CORE_APP_ROLES[] = Object.freeze([\n  CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN,\n  CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER,\n  CORE_APP_ROLES.APP_ADMIN_MARKETING_EDITOR,\n  CORE_APP_ROLES.APP_ADMIN_VIEWER,\n  // Reading the application's own audit trail is oversight of the APPLICATION, not access to its\n  // customer-facing domain — and the API reference files an operation under application\n  // administration only when EVERY role it accepts is in this set, so leaving the reader out would\n  // move the audit door into the customer API reference.\n  CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER,\n]);\n\nexport enum CORE_ORG_ROLES {\n  ORG_GUEST = 'ORG_GUEST',\n  ORG_OWNER = 'ORG_OWNER',\n  ORG_ADMIN = 'ORG_ADMIN',\n  ORG_MANAGER = 'ORG_MANAGER',\n  ORG_MEMBER = 'ORG_MEMBER',\n  /**\n   * An expert of a SERVICE FIRM working inside this organization under a service-provider relationship\n   * the organization controls (`SERVICE_PROVIDER_RELATIONSHIPS`). Inherits `ORG_MEMBER`, never more:\n   * the relationship's role may be any role the client type makes available EXCEPT one that leads up to\n   * `ORG_ADMIN`, which startup refuses. Administrative authority is never conferred by a relationship by\n   * default (delegated administration is a separate, narrow, time-bound grant).\n   */\n  ORG_SERVICE_PROVIDER = 'ORG_SERVICE_PROVIDER',\n  /**\n   * The engine's billing inbound handler, acting on a signature-verified provider event that belongs to ONE\n   * organization's billing account (#1629). It replaced the role-free `WEBHOOK_CALLBACK` bypass, under which\n   * every billing webhook write ran with no role check and no tenant filter.\n   *\n   * Grants exactly what the event handlers do and nothing more: read the organization's billing account,\n   * subscriptions, invoice references and credit pools; create and update subscriptions and invoice\n   * references; create a credit pool and top it up; deactivate the billing account. Inherits from nothing.\n   *\n   * HANDLER-ONLY — a member of {@link INBOUND_HANDLER_ONLY_ROLES}. It confers nothing to a person, an API\n   * key or an OAuth client.\n   */\n  ORG_BILLING_PROVIDER_EVENTS = 'ORG_BILLING_PROVIDER_EVENTS',\n  /*\n   * DELEGATED ADMINISTRATIVE CAPABILITIES (#1631) — one role per `DelegatedAdministrativeCapability`, conferred ONLY by\n   * a live `SERVICE_PROVIDER_CAPABILITY_GRANTS` row to a service firm's experts, through the execution-context live\n   * filter; the member role doors refuse them on any membership row. Each inherits from NOTHING and is listed\n   * explicitly, beside `ORG_ADMIN`, in the `roles` of exactly the core operations it opens — so it confers those\n   * operations and no others, and never leads to `ORG_ADMIN` / `ORG_OWNER` (startup refuses a capability role that does).\n   */\n  /** Invite people into the organization, resend an invitation, revoke one. */\n  ORG_DELEGATED_INVITE_MEMBERS = 'ORG_DELEGATED_INVITE_MEMBERS',\n  /** Suspend, reactivate or remove the delegating firm's OWN experts under the same relationship. */\n  ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS = 'ORG_DELEGATED_MANAGE_RELATIONSHIP_EXPERTS',\n  /** Read the organization's audit trail. */\n  ORG_DELEGATED_READ_AUDIT_TRAIL = 'ORG_DELEGATED_READ_AUDIT_TRAIL',\n  /** Configure the organization's SSO and SCIM provisioning. Security-critical: owner-granted, time-bound. */\n  ORG_DELEGATED_MANAGE_SSO_SCIM = 'ORG_DELEGATED_MANAGE_SSO_SCIM',\n  /** Manage the organization's API keys. Security-critical: owner-granted, time-bound. */\n  ORG_DELEGATED_MANAGE_API_KEYS = 'ORG_DELEGATED_MANAGE_API_KEYS',\n  /** Approve or deny, as the tenant, a platform operator's access request. Security-critical: owner-granted, time-bound. */\n  ORG_DELEGATED_APPROVE_ACCESS_GRANTS = 'ORG_DELEGATED_APPROVE_ACCESS_GRANTS',\n}\n\n/**\n * Roles only an ENGINE inbound handler may act with (#1629) — never a person, an API key, an OAuth client or\n * an application's own handler.\n *\n * ## Why a named set, and where it is enforced\n *\n * A role is granted through many doors — organization and unit memberships, a user's application roles,\n * invitations, SSO and SCIM mappings, machine credentials — and several of them accept any string (the\n * member-role check is skipped entirely when an application declares no organization types). Guarding each\n * door would be the one-of-N shape `invariant-call-site-enumeration.md` records. So the set is enforced where\n * every principal converges instead:\n *\n * - the `ExecutionContext` constructor refuses a context carrying one of these roles unless it is an\n *   `INBOUND_DELIVERY` context, so a grant that slipped through any door cannot confer anything;\n * - the inbound handler registry refuses them in an application handler's `actingRoles`, so only the engine's\n *   own handler, which declares the engine capability, may act with them.\n *\n * The write doors that are cheap to guard (the organization member roles) refuse them too, so a mistaken grant\n * is answered where it is made rather than when the member next signs in.\n */\n// assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the roles cut for one engine handler's writes confer nothing to any other principal (#1629).\nexport const INBOUND_HANDLER_ONLY_ROLES: ReadonlySet<string> = new Set<string>([\n  CORE_ORG_ROLES.ORG_BILLING_PROVIDER_EVENTS,\n  CORE_APP_ROLES.APP_BILLING_PROVIDER_EVENTS,\n  CORE_APP_ROLES.APP_EMAIL_INBOUND_INTAKE,\n]);\n\n/** Whether `role` is one only an engine inbound handler may act with. */\nexport function isInboundHandlerOnlyRole(role: string): boolean {\n  return INBOUND_HANDLER_ONLY_ROLES.has(role);\n}\n\n\nexport const CoreRolesSchema = z.union([\n  z.enum(CORE_APP_ROLES),\n  z.enum(CORE_ORG_ROLES),\n]);\n\nexport const RolesSchema = z.union([\n  z.enum(CORE_APP_ROLES),\n  z.enum(CORE_ORG_ROLES),\n  z.string().min(1),\n]);\n\nexport const AppRolesSchema = z.union([\n  z.enum(CORE_APP_ROLES),\n  z.string().min(1),\n]);\n\nexport const OrgRolesSchema = z.union([\n  z.enum(CORE_ORG_ROLES),\n  z.string().min(1),\n]);\n\nexport const RoleDefinitionSchema = z.object({\n  role: RolesSchema,\n  inheritFrom: RolesSchema.optional(),\n  isSystemRole: z.boolean().default(false),\n  relatedPrimaryScope : z.enum(ResourcePrimaryScope),\n});\n\n\nexport type RoleDefinition = z.infer<typeof RoleDefinitionSchema>;\n\nexport const RolesConfigurationSchema = z.record(z.string(), RoleDefinitionSchema).refine(\n  (record) => {\n    // Validate that all keys are valid roles\n    return Object.keys(record).every(key => {\n      try {\n        RolesSchema.parse(key);\n        return true;\n      } catch {\n        return false;\n      }\n    });\n  }\n);\n\nexport type Roles = z.infer<typeof RolesSchema>;\nexport type CoreRoles = z.infer<typeof CoreRolesSchema>;\nexport type AppRoles = z.infer<typeof AppRolesSchema>;\nexport type OrgRoles = z.infer<typeof OrgRolesSchema>;\nexport type RolesConfiguration = z.infer<typeof RolesConfigurationSchema>;\n"]}