@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/security/credential-rotation-grace.shared.utils.js

@@ -0,0 +1,77 @@
+/**
+ * The credential-rotation rules every surface must agree on: whether a reissued credential's PREVIOUS secret still
+ * authenticates, and whether a credential has passed its expiry.
+ *
+ * They live here, in the shared models, because the backend is not their only reader. The request-auth handlers
+ * decide with them, and a screen that shows an operator a rotated key must answer the same question — "does the
+ * old secret still work?" — the same way, or it shows a dead secret as live, or a live one as nothing. Moved from
+ * `saas-backend-lib`'s `credential-rotation-grace.backend.utils.ts`, which now delegates here.
+ */
+/**
+ * Whether a credential's PREVIOUS secret — moved into the rotation-grace slot when the credential
+ * was reissued — is still inside its grace window and may therefore still authenticate.
+ *
+ * `invalidationDate` is written by the ROTATE / REGENERATE reissue handlers on both api-keys and
+ * OAuth clients, and its three states carry distinct semantics:
+ *
+ * - `null` / `undefined` → **open-ended overlap**. This is what REGENERATE writes: the reissue is
+ *   ADDITIVE — it mints a new secret WITHOUT invalidating the prior one, so the prior secret keeps
+ *   authenticating until the NEXT reissue. REGENERATE is therefore NOT a way to cut off a leaked
+ *   secret: to revoke a compromised credential you must either REVOKE it (status → non-ACTIVE,
+ *   which fails the `status === ACTIVE` gate every caller applies to the resolved record) or ROTATE
+ *   with an explicit invalidation date. This open-endedness is deliberate, not a bug.
+ * - a FUTURE date → still valid — a bounded overlap window (e.g. a ROTATE handover deadline).
+ * - `now` / a PAST date → expired.
+ *
+ * Callers MUST additionally require the resolved record's `status === ACTIVE`, so a
+ * deactivated/expired credential's previous secret never authenticates regardless of this window.
+ *
+ * SINGLE SOURCE OF TRUTH shared by the api-key request-auth handlers, the OAuth-client
+ * direct-secret handlers, the `/oauth/token` client-secret exchange, and the screens that show a
+ * rotated credential ({@link isPreviousCredentialSecretAccepted}) — they MUST agree on grace
+ * semantics, so the check lives here once rather than being copied per call site.
+ */
+export function isRotationGraceWindowOpen(invalidationDate) {
+    if (invalidationDate === null || invalidationDate === undefined)
+        return true;
+    return new Date(invalidationDate).getTime() > Date.now();
+}
+/**
+ * Whether a credential (api-key / OAuth client) has passed its `expiresAt`. `null`/`undefined` =
+ * no expiry set = never expires.
+ *
+ * Enforced at AUTH-TIME on every machine front, and that is where the enforcement STAYS.
+ *
+ * There IS an `EXPIRED` producer since 2026-09-08 — the nightly credential-expiry sweep (#413)
+ * dispatches each resource's `expire` verb — but it is BOOKKEEPING, never the control. It always
+ * lags: a credential that elapses at 09:00 still reads ACTIVE until 02:30 the next morning. This
+ * check is what makes that lag harmless, so a caller must never replace it with a `status` test.
+ * Do that and the sweep's lag becomes an authorization hole rather than a stale display, and
+ * `expiresAt` plus the `EXTEND_EXPIRY` operation go back to being decorative. Callers apply it
+ * alongside the ACTIVE gate:
+ * `!record || record.status !== ACTIVE || isCredentialExpired(record.expiresAt)`. SINGLE SOURCE OF
+ * TRUTH shared by the api-key + OAuth-client request-auth handlers and the `/oauth/token` exchange.
+ */
+export function isCredentialExpired(expiresAt) {
+    if (expiresAt === null || expiresAt === undefined)
+        return false;
+    return new Date(expiresAt).getTime() <= Date.now();
+}
+/**
+ * Whether a reissued credential's PREVIOUS secret would authenticate right now — the answer a screen owes an
+ * operator after a rotation, and the same three gates the request-auth handlers apply to a match on the previous
+ * secret: its grace window is open ({@link isRotationGraceWindowOpen}), the credential is ACTIVE, and it has not
+ * passed its expiry ({@link isCredentialExpired}).
+ *
+ * Why a screen needs it rather than the raw fields: the fields alone mislead in both directions. After a
+ * REGENERATE the invalidation date is empty and the old secret works indefinitely, so a screen that hides empty
+ * rows shows nothing at the riskiest moment; after a default ROTATE the date is the rotation instant and the old
+ * secret is dead, yet its prefix is still stored.
+ */
+export function isPreviousCredentialSecretAccepted(credential) {
+    return (credential.hasPreviousSecret
+        && credential.isActive
+        && !isCredentialExpired(credential.expiresAt)
+        && isRotationGraceWindowOpen(credential.previousSecretInvalidationDate));
+}
+//# sourceMappingURL=credential-rotation-grace.shared.utils.js.map

package/dist/esm/security/credential-rotation-grace.shared.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-rotation-grace.shared.utils.js","sourceRoot":"","sources":["../../../../src/security/credential-rotation-grace.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CAAC,gBAA8B;IACtE,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAuB;IACzD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kCAAkC,CAAC,UAKlD;IACC,OAAO,CACL,UAAU,CAAC,iBAAiB;WACzB,UAAU,CAAC,QAAQ;WACnB,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC;WAC1C,yBAAyB,CAAC,UAAU,CAAC,8BAA8B,CAAC,CACxE,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The credential-rotation rules every surface must agree on: whether a reissued credential's PREVIOUS secret still\n * authenticates, and whether a credential has passed its expiry.\n *\n * They live here, in the shared models, because the backend is not their only reader. The request-auth handlers\n * decide with them, and a screen that shows an operator a rotated key must answer the same question — \"does the\n * old secret still work?\" — the same way, or it shows a dead secret as live, or a live one as nothing. Moved from\n * `saas-backend-lib`'s `credential-rotation-grace.backend.utils.ts`, which now delegates here.\n */\n\n/**\n * Whether a credential's PREVIOUS secret — moved into the rotation-grace slot when the credential\n * was reissued — is still inside its grace window and may therefore still authenticate.\n *\n * `invalidationDate` is written by the ROTATE / REGENERATE reissue handlers on both api-keys and\n * OAuth clients, and its three states carry distinct semantics:\n *\n * - `null` / `undefined` → **open-ended overlap**. This is what REGENERATE writes: the reissue is\n *   ADDITIVE — it mints a new secret WITHOUT invalidating the prior one, so the prior secret keeps\n *   authenticating until the NEXT reissue. REGENERATE is therefore NOT a way to cut off a leaked\n *   secret: to revoke a compromised credential you must either REVOKE it (status → non-ACTIVE,\n *   which fails the `status === ACTIVE` gate every caller applies to the resolved record) or ROTATE\n *   with an explicit invalidation date. This open-endedness is deliberate, not a bug.\n * - a FUTURE date → still valid — a bounded overlap window (e.g. a ROTATE handover deadline).\n * - `now` / a PAST date → expired.\n *\n * Callers MUST additionally require the resolved record's `status === ACTIVE`, so a\n * deactivated/expired credential's previous secret never authenticates regardless of this window.\n *\n * SINGLE SOURCE OF TRUTH shared by the api-key request-auth handlers, the OAuth-client\n * direct-secret handlers, the `/oauth/token` client-secret exchange, and the screens that show a\n * rotated credential ({@link isPreviousCredentialSecretAccepted}) — they MUST agree on grace\n * semantics, so the check lives here once rather than being copied per call site.\n */\nexport function isRotationGraceWindowOpen(invalidationDate?: Date | null): boolean {\n  if (invalidationDate === null || invalidationDate === undefined) return true;\n  return new Date(invalidationDate).getTime() > Date.now();\n}\n\n/**\n * Whether a credential (api-key / OAuth client) has passed its `expiresAt`. `null`/`undefined` =\n * no expiry set = never expires.\n *\n * Enforced at AUTH-TIME on every machine front, and that is where the enforcement STAYS.\n *\n * There IS an `EXPIRED` producer since 2026-09-08 — the nightly credential-expiry sweep (#413)\n * dispatches each resource's `expire` verb — but it is BOOKKEEPING, never the control. It always\n * lags: a credential that elapses at 09:00 still reads ACTIVE until 02:30 the next morning. This\n * check is what makes that lag harmless, so a caller must never replace it with a `status` test.\n * Do that and the sweep's lag becomes an authorization hole rather than a stale display, and\n * `expiresAt` plus the `EXTEND_EXPIRY` operation go back to being decorative. Callers apply it\n * alongside the ACTIVE gate:\n * `!record || record.status !== ACTIVE || isCredentialExpired(record.expiresAt)`. SINGLE SOURCE OF\n * TRUTH shared by the api-key + OAuth-client request-auth handlers and the `/oauth/token` exchange.\n */\nexport function isCredentialExpired(expiresAt?: Date | null): boolean {\n  if (expiresAt === null || expiresAt === undefined) return false;\n  return new Date(expiresAt).getTime() <= Date.now();\n}\n\n/**\n * Whether a reissued credential's PREVIOUS secret would authenticate right now — the answer a screen owes an\n * operator after a rotation, and the same three gates the request-auth handlers apply to a match on the previous\n * secret: its grace window is open ({@link isRotationGraceWindowOpen}), the credential is ACTIVE, and it has not\n * passed its expiry ({@link isCredentialExpired}).\n *\n * Why a screen needs it rather than the raw fields: the fields alone mislead in both directions. After a\n * REGENERATE the invalidation date is empty and the old secret works indefinitely, so a screen that hides empty\n * rows shows nothing at the riskiest moment; after a default ROTATE the date is the rotation instant and the old\n * secret is dead, yet its prefix is still stored.\n */\nexport function isPreviousCredentialSecretAccepted(credential: {\n  hasPreviousSecret: boolean;\n  previousSecretInvalidationDate?: Date | null;\n  isActive: boolean;\n  expiresAt?: Date | null;\n}): boolean {\n  return (\n    credential.hasPreviousSecret\n    && credential.isActive\n    && !isCredentialExpired(credential.expiresAt)\n    && isRotationGraceWindowOpen(credential.previousSecretInvalidationDate)\n  );\n}\n"]}

package/dist/esm/security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoF,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAOlK,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAgBxE,oBAAY,0BAA0B;IACpC,MAAM,WAAW,CAAE,6CAA6C;IAChE,UAAU,eAAe,CAAE,mDAAmD;IAC9E,UAAU,eAAe,CAAE,kEAAkE;IAC7F,UAAU,eAAe,CAAE,6FAA6F;IACxH,MAAM,WAAW;CAClB;AAED,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,0DAA0D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2SvH,CAAC"}
+{"version":3,"file":"oauth-clients-application.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoF,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAOlK,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAkBxE,oBAAY,0BAA0B;IACpC,MAAM,WAAW,CAAE,6CAA6C;IAChE,UAAU,eAAe,CAAE,mDAAmD;IAC9E,UAAU,eAAe,CAAE,kEAAkE;IAC7F,UAAU,eAAe,CAAE,6FAA6F;IACxH,MAAM,WAAW;CAClB;AAED,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAKjC,eAAO,MAAM,0DAA0D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6TvH,CAAC"}

package/dist/esm/security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.js

@@ -13,7 +13,7 @@ import { z } from 'zod';
 import { OAuthClientApplicationSchema, OAuthClientStatus, } from './oauth-clients.shared.schemas.js';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationReversibility } from '../../resources/resources.shared.schemas.js';
-import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
+import { ResourceSystemAccessMode, createResourcesFilterPresenceSchema } from '../../resources/resources-config.shared.schemas.js';
 import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas.js';
@@ -23,7 +23,9 @@ import { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas.js';
 // App Admin gets enhanced filter fields with additional capabilities
 const APP_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS = {
     status: z.enum(OAuthClientStatus),
-    hasExpiration: z.boolean(),
+    // "Has an expiry", i.e. `expiresAt` is set. Declared as a plain boolean it was passed to the database
+    // as a field no row has, and matched nothing (#1806); the presence filter carries its target.
+    hasExpiration: createResourcesFilterPresenceSchema('expiresAt'),
     lastUsedAt: z.date(), // Admin can filter by last usage
     expiresAt: z.date(), // Admin can filter by expiration
 };
@@ -122,7 +124,7 @@ export const appOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     // requestDto auto-derived from decorators
                     customResponseDto: OAuthClientApplicationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral()
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.")
                     }),
                 }
             ],
@@ -166,6 +168,12 @@ export const appOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.LOW,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`
                     // and the paired prefix implementation forces the status transition itself, so there is no field
@@ -200,6 +208,12 @@ export const appOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({}),
                     enabledCondition: ({ currentObject }) => {
@@ -226,6 +240,12 @@ export const appOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({}),
                     enabledCondition: ({ currentObject }) => {
@@ -265,12 +285,12 @@ export const appOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     requiresStepUpAuthentication: true,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({
-                        oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())
+                        oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe("When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so the client can switch over.")
                     }),
                     customResponseDto: OAuthClientApplicationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral(),
-                        oldClientId: z.string(),
-                        oldSecretInvalidationDate: z.date()
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint."),
+                        oldClientId: z.string().describe("The id of the client whose secret was rotated. Rotation reissues the secret on the same client, so this is the client's own id."),
+                        oldSecretInvalidationDate: z.date().describe("When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.")
                     }),
                 }
             ],
@@ -311,7 +331,7 @@ export const appOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on client credentials.
                     requestDto: z.object({}),
                     customResponseDto: OAuthClientApplicationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral(),
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint."),
                     }),
                 }
             ],

package/dist/esm/security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients-application.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,0CAA0C,CAAC;AAClK,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,uDAAuD;AAEvD,qEAAqE;AACrE,MAAM,qCAAqC,GAAG;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACjC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvD,CAAC;AAEF,iDAAiD;AACjD,MAAM,mCAAmC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAErH,uDAAuD;AACvD,MAAM,CAAN,IAAY,0BAMX;AAND,WAAY,0BAA0B;IACpC,+CAAiB,CAAA;IACjB,uDAAyB,CAAA;IACzB,uDAAyB,CAAA;IACzB,uDAAyB,CAAA;IACzB,+CAAiB,CAAA;AACnB,CAAC,EANW,0BAA0B,KAA1B,0BAA0B,QAMrC;AASD;;EAEE;AACF,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAItK;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,uDAAuD;IAE/E;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,0EAA0E;QAC1E,+DAA+D;QAC/D,+EAA+E;QAC/E,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,0BAA0B;IAE3C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,qCAAqC;oBACnD,UAAU,EAAE,mCAAmC;oBAC/C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,4BAA4B,CAAC,MAAM,CAAC;wBACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,yEAAyE;QACzE,gFAAgF;QAChF,iEAAiE;QACjE,8EAA8E;QAC9E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED;;;;;;;;;;WAUG;QACH,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,CAAC;oBAC3D,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;WAIG;QACH,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,iBAAiB,CAAC,QAAQ,CAAC;oBAC7D,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,kGAAkG;oBAClG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,wEAAwE;oBACxE,oEAAoE;oBACpE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;qBAChI,CAAC;oBACF,iBAAiB,EAAE,4BAA4B,CAAC,MAAM,CAAC;wBACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;wBAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;wBACvB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpC,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,iFAAiF;oBACjF,uEAAuE;oBACvE,iFAAiF;oBACjF,qFAAqF;oBACrF,mFAAmF;oBACnF,uEAAuE;oBACvE,+EAA+E;oBAC/E,wEAAwE;oBACxE,0BAA0B;oBAC1B,2FAA2F;oBAC3F,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,4BAA4B,CAAC,MAAM,CAAC;wBACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;qBAC7C,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application OAuth Clients Shared Resource Configuration\n *\n * Resource configuration for managing application-scoped registered OAuth\n * clients. FAITHFUL MIRROR of `api-keys-application.shared.resources-config.schemas.ts`\n * with a FOCUSED operation set: core READ/LIST/SEARCH/CREATE plus a REPOSITORY_ONLY\n * DELETE (onParentDelete cascade), custom ROTATE/REGENERATE, the operator pair\n * DEACTIVATE/REACTIVATE (#1028) and the sweep-driven EXPIRE. EXTEND_EXPIRY and USAGE_STATS\n * from api-keys are not ported: a client's validity is fixed at registration, and no usage\n * accounting is recorded for clients.\n */\n\nimport { z } from 'zod';\nimport {\n  OAuthClientApplicationSchema,\n  OAuthClientStatus,\n} from './oauth-clients.shared.schemas';\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for application OAuth clients\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst APP_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS = {\n  status: z.enum(OAuthClientStatus),\n  hasExpiration: z.boolean(),\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n};\n\n// App Admin gets additional sorting capabilities\nconst APP_OAUTH_CLIENTS_ADMIN_SORT_FIELDS = ['createdAt', 'updatedAt', 'lastUsedAt', 'expiresAt', 'status'] as const;\n\n// Custom operations enum for application OAuth clients\nexport enum AppOAuthClients_Operations {\n  ROTATE = 'rotate', // Generate new secret and invalidate old one\n  REGENERATE = 'regenerate', // Generate new secret without invalidating old one\n  DEACTIVATE = 'deactivate', // ACTIVE → INACTIVE, an administrator suspends the client (#1028)\n  REACTIVATE = 'reactivate', // INACTIVE → ACTIVE, an administrator lifts the suspension; an EXPIRED client is not revived\n  EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n}\n\ntype AppOAuthClientsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplication OAuth Clients Resource Configuration Factory\n*/\nexport const appOAuthClientsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof AppOAuthClients_Operations,\n  AppOAuthClientsCoreOperations,\n  typeof OAuthClientApplicationSchema\n>({\n  mainSchema: OAuthClientApplicationSchema,\n  resourceIdentifier: CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.OAUTH_CLIENTS_APPLICATION],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Application OAuth clients are a core system resource\n\n  /**\n   * CREATE only, and opened for exactly one caller: RFC 7591 dynamic client registration\n   * (`POST /oauth/register`), which has no principal to act as and therefore cannot go through the\n   * ordinary API_CALL path.\n   *\n   * Modelled on `anonymousUsers`, the closest analogue in the framework — another resource whose rows\n   * are created for an unauthenticated caller through a server-side door, and which opts into\n   * `create` and nothing else. READ / UPDATE / DELETE stay refused: a system door on a\n   * credential-bearing resource should be exactly as wide as its one use.\n   *\n   * ⚠️ KNOWN CONSEQUENCE, stated rather than discovered later: the role-ceiling gate in\n   * `buildOAuthClientMintHandlers` lives on the API_CALL CREATE variant, so it does NOT run on this\n   * door. The registration endpoint therefore carries that duty itself — it REFUSES a request that\n   * mentions `roles` and writes `roles: []` explicitly. Any FUTURE `createAsSystem` caller on this\n   * resource inherits the same obligation and gets no help from the framework in remembering it.\n   */\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so client rows are physically removed when their\n    // owning application is deleted. Without it the cascade throws\n    // ErrorType.CONFIGURATION on any application that still has OAuth-client rows.\n    CoreResourceOperation.DELETE\n  ],\n\n  customOperation: AppOAuthClients_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: false,\n          searchableFields: [],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APP_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS,\n          sortFields: APP_OAUTH_CLIENTS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: OAuthClientApplicationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so OAuth-client rows are physically removed when their\n    // owning application is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any application\n    // that still has client rows. Super-admin/HIGH: the app OAuth-client admin tier.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    /**\n     * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n     * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n     * the sweep is the only caller, and there is no reason for a human to declare that a date has\n     * passed.\n     *\n     * It exists so the sweep writes through a guarded door rather than setting `status` directly.\n     * The ACTIVE-only precondition lives in the paired prefix implementation\n     * (`oauth-clients.custom-impl.backend.service.ts`) — an INACTIVE client was retired by an\n     * administrator, and relabelling it EXPIRED would erase who ended it.\n     */\n    [AppOAuthClients_Operations.EXPIRE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n          // and the paired prefix implementation forces the status transition itself, so there is no field\n          // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n          // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n          // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n          requestDto: z.object({}),\n        }\n      ],\n    },\n\n    /**\n     * ACTIVE → INACTIVE, the operator's suspension door (#1028). Until it existed the only ways to\n     * stop a registered client were regenerating its secret — rotation, not suspension, and it\n     * hands the caller a new credential to distribute — or waiting for `expiresAt`.\n     *\n     * WHAT IT STOPS, stated so the contract does not imply instant revocation: the direct-secret\n     * path re-reads the client and requires ACTIVE, and so does every new token mint. A\n     * client-credentials JWT already minted is NOT re-checked against the client until it expires,\n     * so deactivation ends new access and leaves an issued token to run out its own lifetime.\n     *\n     * The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE selects the\n     * core path that persists; it must NOT also hand the caller UPDATE's request contract — this\n     * resource exposes no core UPDATE, and an auto-derived one would let `PUT .../deactivate` carry\n     * `status: active` or rewrite `roles` past the mint-time ceiling. `status` is forced by the\n     * paired prefix implementation (`oauth-clients.custom-impl.backend.service.ts`), whose\n     * ACTIVE-only precondition is the real enforcement; `enabledCondition` is a display affordance.\n     */\n    [AppOAuthClients_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === OAuthClientStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * INACTIVE → ACTIVE, lifting a suspension. An EXPIRED client is NOT revivable: its expiry was\n     * the thing retiring it, and the prefix implementation refuses with 409 so a status flip cannot\n     * undo a validity window. See DEACTIVATE for why the request contract is empty.\n     */\n    [AppOAuthClients_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === OAuthClientStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppOAuthClients_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: Replaces the client secret; the previous value is not stored in recoverable form.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          // ROTATE is a secret handback plus a caller-chosen cutover. The default\n          // invalidation boundary is now, while a future boundary creates a bounded\n          // overlap. Once that boundary passes, the previous secret cannot be\n          // restored. An unauthorized caller also walks away with the replacement\n          // credential, so a live session alone is deliberately insufficient.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())\n          }),\n          customResponseDto: OAuthClientApplicationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral(),\n            oldClientId: z.string(),\n            oldSecretInvalidationDate: z.date()\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppOAuthClients_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldSecretInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedSecret, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `redirectUris`, `allowedScopes`, `allowedGrants` and `roles` would all\n          // be writable through \"regenerate\". This resource exposes NO core UPDATE, so those\n          // fields are meant to be immutable after minting, and the ceiling gate\n          // (`assertRequestedRolesWithinCallerCeiling`) runs in the CREATE handler only.\n          // A rewritable `redirectUris` on a secret-reissue route is an auth-code\n          // exfiltration primitive.\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on client credentials.\n          requestDto: z.object({}),\n          customResponseDto: OAuthClientApplicationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral(),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    }\n  },\n});\n"]}
+{"version":3,"file":"oauth-clients-application.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAA8C,MAAM,0CAA0C,CAAC;AAClK,OAAO,EAAE,wBAAwB,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AAChI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAE3H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,uDAAuD;AAEvD,qEAAqE;AACrE,MAAM,qCAAqC,GAAG;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACjC,sGAAsG;IACtG,8FAA8F;IAC9F,aAAa,EAAE,mCAAmC,CAAC,WAAW,CAAC;IAC/D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvD,CAAC;AAEF,iDAAiD;AACjD,MAAM,mCAAmC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAErH,uDAAuD;AACvD,MAAM,CAAN,IAAY,0BAMX;AAND,WAAY,0BAA0B;IACpC,+CAAiB,CAAA;IACjB,uDAAyB,CAAA;IACzB,uDAAyB,CAAA;IACzB,uDAAyB,CAAA;IACzB,+CAAiB,CAAA;AACnB,CAAC,EANW,0BAA0B,KAA1B,0BAA0B,QAMrC;AASD;;EAEE;AACF,MAAM,CAAC,MAAM,0DAA0D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAItK;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI,EAAE,uDAAuD;IAE/E;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,OAAO,EAAE;IAEhE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,0EAA0E;QAC1E,+DAA+D;QAC/D,+EAA+E;QAC/E,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,0BAA0B;IAE3C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,qCAAqC;oBACnD,UAAU,EAAE,mCAAmC;oBAC/C,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;oBAC1C,iBAAiB,EAAE,4BAA4B,CAAC,MAAM,CAAC;wBACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC;qBAC3N,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,yEAAyE;QACzE,gFAAgF;QAChF,iEAAiE;QACjE,8EAA8E;QAC9E,iFAAiF;QACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED;;;;;;;;;;WAUG;QACH,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;QAED;;;;;;;;;;;;;;;;WAgBG;QACH,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,CAAC;oBAC3D,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;WAIG;QACH,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qGAAqG;oBACrG,iGAAiG;oBACjG,qGAAqG;oBACrG,2GAA2G;oBAC3G,8HAA8H;oBAC9H,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;wBACtC,OAAO,aAAa,CAAC,MAAM,KAAK,iBAAiB,CAAC,QAAQ,CAAC;oBAC7D,CAAC;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,kGAAkG;oBAClG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,wEAAwE;oBACxE,0EAA0E;oBAC1E,oEAAoE;oBACpE,wEAAwE;oBACxE,oEAAoE;oBACpE,EAAE;oBACF,oFAAoF;oBACpF,2FAA2F;oBAC3F,oEAAoE;oBACpE,EAAE;oBACF,2FAA2F;oBAC3F,sBAAsB;oBACtB,4BAA4B,EAAE,IAAI;oBAClC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,gDAAgD,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kLAAkL,CAAC;qBAC7T,CAAC;oBACF,iBAAiB,EAAE,4BAA4B,CAAC,MAAM,CAAC;wBACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC;wBAC1N,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iIAAiI,CAAC;wBACnK,yBAAyB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;qBAC7J,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE;YACvC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,uBAAuB;oBACtE,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,uFAAuF;oBACvF,wFAAwF;oBACxF,sFAAsF;oBACtF,mEAAmE;oBACnE,2FAA2F;oBAC3F,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;oBAC7C,6EAA6E;oBAC7E,iFAAiF;oBACjF,uEAAuE;oBACvE,iFAAiF;oBACjF,qFAAqF;oBACrF,mFAAmF;oBACnF,uEAAuE;oBACvE,+EAA+E;oBAC/E,wEAAwE;oBACxE,0BAA0B;oBAC1B,2FAA2F;oBAC3F,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,iBAAiB,EAAE,4BAA4B,CAAC,MAAM,CAAC;wBACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC;qBAC3N,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application OAuth Clients Shared Resource Configuration\n *\n * Resource configuration for managing application-scoped registered OAuth\n * clients. FAITHFUL MIRROR of `api-keys-application.shared.resources-config.schemas.ts`\n * with a FOCUSED operation set: core READ/LIST/SEARCH/CREATE plus a REPOSITORY_ONLY\n * DELETE (onParentDelete cascade), custom ROTATE/REGENERATE, the operator pair\n * DEACTIVATE/REACTIVATE (#1028) and the sweep-driven EXPIRE. EXTEND_EXPIRY and USAGE_STATS\n * from api-keys are not ported: a client's validity is fixed at registration, and no usage\n * accounting is recorded for clients.\n */\n\nimport { z } from 'zod';\nimport {\n  OAuthClientApplicationSchema,\n  OAuthClientStatus,\n} from './oauth-clients.shared.schemas';\nimport { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourcePrimaryScope, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode, createResourcesFilterPresenceSchema } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../../resources/resources.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\n\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\n// Sort and filter fields for application OAuth clients\n\n// App Admin gets enhanced filter fields with additional capabilities\nconst APP_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS = {\n  status: z.enum(OAuthClientStatus),\n  // \"Has an expiry\", i.e. `expiresAt` is set. Declared as a plain boolean it was passed to the database\n  // as a field no row has, and matched nothing (#1806); the presence filter carries its target.\n  hasExpiration: createResourcesFilterPresenceSchema('expiresAt'),\n  lastUsedAt: z.date(), // Admin can filter by last usage\n  expiresAt: z.date(), // Admin can filter by expiration\n};\n\n// App Admin gets additional sorting capabilities\nconst APP_OAUTH_CLIENTS_ADMIN_SORT_FIELDS = ['createdAt', 'updatedAt', 'lastUsedAt', 'expiresAt', 'status'] as const;\n\n// Custom operations enum for application OAuth clients\nexport enum AppOAuthClients_Operations {\n  ROTATE = 'rotate', // Generate new secret and invalidate old one\n  REGENERATE = 'regenerate', // Generate new secret without invalidating old one\n  DEACTIVATE = 'deactivate', // ACTIVE → INACTIVE, an administrator suspends the client (#1028)\n  REACTIVATE = 'reactivate', // INACTIVE → ACTIVE, an administrator lifts the suspension; an EXPIRED client is not revived\n  EXPIRE = 'expire', // ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)\n}\n\ntype AppOAuthClientsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE;\n\n/*\nApplication OAuth Clients Resource Configuration Factory\n*/\nexport const appOAuthClientsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof AppOAuthClients_Operations,\n  AppOAuthClientsCoreOperations,\n  typeof OAuthClientApplicationSchema\n>({\n  mainSchema: OAuthClientApplicationSchema,\n  resourceIdentifier: CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.OAUTH_CLIENTS_APPLICATION],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true, // Application OAuth clients are a core system resource\n\n  /**\n   * CREATE only, and opened for exactly one caller: RFC 7591 dynamic client registration\n   * (`POST /oauth/register`), which has no principal to act as and therefore cannot go through the\n   * ordinary API_CALL path.\n   *\n   * Modelled on `anonymousUsers`, the closest analogue in the framework — another resource whose rows\n   * are created for an unauthenticated caller through a server-side door, and which opts into\n   * `create` and nothing else. READ / UPDATE / DELETE stay refused: a system door on a\n   * credential-bearing resource should be exactly as wide as its one use.\n   *\n   * ⚠️ KNOWN CONSEQUENCE, stated rather than discovered later: the role-ceiling gate in\n   * `buildOAuthClientMintHandlers` lives on the API_CALL CREATE variant, so it does NOT run on this\n   * door. The registration endpoint therefore carries that duty itself — it REFUSES a request that\n   * mentions `roles` and writes `roles: []` explicitly. Any FUTURE `createAsSystem` caller on this\n   * resource inherits the same obligation and gets no help from the framework in remembering it.\n   */\n  systemAccessPolicy: { create: ResourceSystemAccessMode.ALLOWED },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition\n    // onParentDelete cascade so client rows are physically removed when their\n    // owning application is deleted. Without it the cascade throws\n    // ErrorType.CONFIGURATION on any application that still has OAuth-client rows.\n    CoreResourceOperation.DELETE\n  ],\n\n  customOperation: AppOAuthClients_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: false,\n          searchableFields: [],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: APP_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS,\n          sortFields: APP_OAUTH_CLIENTS_ADMIN_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n          customResponseDto: OAuthClientApplicationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral().describe(\"The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.\")\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n    // onParentDelete cascade so OAuth-client rows are physically removed when their\n    // owning application is deleted. Without a DELETE op the cascade\n    // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any application\n    // that still has client rows. Super-admin/HIGH: the app OAuth-client admin tier.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }\n      ],\n    },\n\n    /**\n     * ACTIVE → EXPIRED, dispatched by the credential-expiry sweep once `expiresAt` has passed\n     * (#413). INTERNAL_CALL, so no HTTP route is mounted and no frontend affordance is offered:\n     * the sweep is the only caller, and there is no reason for a human to declare that a date has\n     * passed.\n     *\n     * It exists so the sweep writes through a guarded door rather than setting `status` directly.\n     * The ACTIVE-only precondition lives in the paired prefix implementation\n     * (`oauth-clients.custom-impl.backend.service.ts`) — an INACTIVE client was retired by an\n     * administrator, and relabelling it EXPIRED would erase who ended it.\n     */\n    [AppOAuthClients_Operations.EXPIRE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n          // and the paired prefix implementation forces the status transition itself, so there is no field\n          // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n          // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n          // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n          requestDto: z.object({}),\n        }\n      ],\n    },\n\n    /**\n     * ACTIVE → INACTIVE, the operator's suspension door (#1028). Until it existed the only ways to\n     * stop a registered client were regenerating its secret — rotation, not suspension, and it\n     * hands the caller a new credential to distribute — or waiting for `expiresAt`.\n     *\n     * WHAT IT STOPS, stated so the contract does not imply instant revocation: the direct-secret\n     * path re-reads the client and requires ACTIVE, and so does every new token mint. A\n     * client-credentials JWT already minted is NOT re-checked against the client until it expires,\n     * so deactivation ends new access and leaves an issued token to run out its own lifetime.\n     *\n     * The transition is SERVER-DECIDED, so the verb takes no input. Borrowing UPDATE selects the\n     * core path that persists; it must NOT also hand the caller UPDATE's request contract — this\n     * resource exposes no core UPDATE, and an auto-derived one would let `PUT .../deactivate` carry\n     * `status: active` or rewrite `roles` past the mint-time ceiling. `status` is forced by the\n     * paired prefix implementation (`oauth-clients.custom-impl.backend.service.ts`), whose\n     * ACTIVE-only precondition is the real enforcement; `enabledCondition` is a display affordance.\n     */\n    [AppOAuthClients_Operations.DEACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === OAuthClientStatus.ACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    /**\n     * INACTIVE → ACTIVE, lifting a suspension. An EXPIRED client is NOT revivable: its expiry was\n     * the thing retiring it, and the prefix implementation refuses with 409 so a status flip cannot\n     * undo a validity window. See DEACTIVATE for why the request contract is empty.\n     */\n    [AppOAuthClients_Operations.REACTIVATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the\n          // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated\n          // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the\n          // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.\n          // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.\n          auditableEvent: { auditBelowRiskFloor: true },\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({}),\n          enabledCondition: ({ currentObject }) => {\n            return currentObject.status === OAuthClientStatus.INACTIVE;\n          }\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppOAuthClients_Operations.ROTATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: Replaces the client secret; the previous value is not stored in recoverable form.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          // ROTATE is a secret handback plus a caller-chosen cutover. The default\n          // invalidation boundary is now, while a future boundary creates a bounded\n          // overlap. Once that boundary passes, the previous secret cannot be\n          // restored. An unauthorized caller also walks away with the replacement\n          // credential, so a live session alone is deliberately insufficient.\n          //\n          // Its sibling REGENERATE is NOT gated, and the difference is the whole criterion: a\n          // regenerate \"keeps the prior secret working\" (see its own declaration), so it is additive\n          // and recoverable. Gate the irreversible, not merely the sensitive.\n          //\n          // assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n          // high-impact action.\n          requiresStepUpAuthentication: true,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: z.object({\n            oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe(\"When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so the client can switch over.\")\n          }),\n          customResponseDto: OAuthClientApplicationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral().describe(\"The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.\"),\n            oldClientId: z.string().describe(\"The id of the client whose secret was rotated. Rotation reissues the secret on the same client, so this is the client's own id.\"),\n            oldSecretInvalidationDate: z.date().describe(\"When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.\")\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    },\n\n    [AppOAuthClients_Operations.REGENERATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // Admin-only operation\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          // REGENERATE mints and hands over a LIVE credential, so it needs an audit row — but its\n          // MEDIUM risk sits below the automatic HIGH/CRITICAL floor, which is why it previously\n          // recorded nothing on either axis while its HIGH sibling ROTATE recorded the operation.\n          // MEDIUM is correct on the UI axis (no danger-zone affordance for a reissue that keeps\n          // the prior secret working) and wrong on the evidence axis; this declaration is exactly\n          // that divergence. Raising `riskLevel` instead would buy the row by mis-declaring the\n          // verb's danger. Same reasoning as `organizationMembers | UPDATE`.\n          // assurance-control: WILDO.SECRETS.DISCLOSURE_AUDIT — credential issuance is attributable.\n          auditableEvent: { auditBelowRiskFloor: true },\n          // REGENERATE reissues the secret and nothing else — it takes no caller input\n          // (contrast ROTATE, which accepts `oldSecretInvalidationDate`). Without this the\n          // auto-derived UPDATE contract would apply: the reissue prefix returns\n          // `{ ...input, hashedSecret, … }` and the dispatcher MERGES that onto the caller\n          // payload, so `redirectUris`, `allowedScopes`, `allowedGrants` and `roles` would all\n          // be writable through \"regenerate\". This resource exposes NO core UPDATE, so those\n          // fields are meant to be immutable after minting, and the ceiling gate\n          // (`assertRequestedRolesWithinCallerCeiling`) runs in the CREATE handler only.\n          // A rewritable `redirectUris` on a secret-reissue route is an auth-code\n          // exfiltration primitive.\n          // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on client credentials.\n          requestDto: z.object({}),\n          customResponseDto: OAuthClientApplicationSchema.extend({\n            plainSecret: z.string().min(1).isEphemeral().describe(\"The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.\"),\n          }),\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.APPLICATION_ADMINISTRATOR,\n          channel: CoreUserNotificationChannel.EMAIL,\n        }\n      ]\n    }\n  },\n});\n"]}

package/dist/esm/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.d.ts

@@ -18,7 +18,8 @@ export declare enum OrgOAuthClients_Operations {
     REGENERATE = "regenerate",// Generate new secret without invalidating old one
     DEACTIVATE = "deactivate",// ACTIVE → INACTIVE, an administrator suspends the client (#1028)
     REACTIVATE = "reactivate",// INACTIVE → ACTIVE, an administrator lifts the suspension; an EXPIRED client is not revived
-    EXPIRE = "expire"
+    EXPIRE = "expire",// ACTIVE → EXPIRED once `expiresAt` has passed (dispatched by the sweep, not by an operator)
+    SET_AUTONOMOUS_AGENTS = "setAutonomousAgents"
 }
 type OrgOAuthClientsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.SEARCH | CoreResourceOperation.CREATE | CoreResourceOperation.DELETE | CoreResourceOperation.COUNT;
 export declare const orgOAuthClientsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<typeof OrgOAuthClients_Operations, OrgOAuthClientsCoreOperations, z.ZodObject<{
@@ -47,6 +48,7 @@ export declare const orgOAuthClientsResourceConfiguration_InitializationFactory:
     registrationOrigin: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof import("./oauth-clients.shared.schemas").OAuthClientRegistrationOrigin>>>>>>>;
     scope: z.ZodLiteral<import("../..").ApiKeyScope.ORGANIZATION>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    autonomousAgentRefs: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>>>>;
 }, z.core.$strip>>;
 export {};
 //# sourceMappingURL=oauth-clients-organization.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoF,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAMlK,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AA0BxF,oBAAY,0BAA0B;IACpC,MAAM,WAAW,CAAE,6CAA6C;IAChE,UAAU,eAAe,CAAE,mDAAmD;IAC9E,UAAU,eAAe,CAAE,kEAAkE;IAC7F,UAAU,eAAe,CAAE,6FAA6F;IACxH,MAAM,WAAW;CAClB;AAED,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,KAAK,CAAC;AAKhC,eAAO,MAAM,0DAA0D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6cvH,CAAC"}
+{"version":3,"file":"oauth-clients-organization.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAoF,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAOlK,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AA6BxF,oBAAY,0BAA0B;IACpC,MAAM,WAAW,CAAE,6CAA6C;IAChE,UAAU,eAAe,CAAE,mDAAmD;IAC9E,UAAU,eAAe,CAAE,kEAAkE;IAC7F,UAAU,eAAe,CAAE,6FAA6F;IACxH,MAAM,WAAW,CAAE,6FAA6F;IAChH,qBAAqB,wBAAwB;CAC9C;AAED,KAAK,6BAA6B,GAC9B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,KAAK,CAAC;AAKhC,eAAO,MAAM,0DAA0D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAohBvH,CAAC"}

package/dist/esm/security/oauth-clients/oauth-clients-organization.shared.resources-config.schemas.js

@@ -16,7 +16,9 @@ import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../reso
 import { ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { createResourcesFilterPresenceSchema } from '../../resources/resources-config.shared.schemas.js';
 import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas.js';
+import { AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX, AutonomousAgentRefSchema } from '../../flows-actors/autonomous-agents.shared.schemas.js';
 // Sort and filter fields for organization OAuth clients
 const ORG_OAUTH_CLIENTS_SORT_FIELDS = ['createdAt', 'updatedAt', 'name', 'lastUsedAt', 'expiresAt'];
 // Org members get basic filter fields
@@ -24,7 +26,9 @@ const ORG_OAUTH_CLIENTS_FILTER_FIELDS = {
     status: z.enum(OAuthClientStatus),
     name: z.string(),
     organizationId: z.string(),
-    hasExpiration: z.boolean(),
+    // "Has an expiry", i.e. `expiresAt` is set. Declared as a plain boolean it was passed to the database
+    // as a field no row has, and matched nothing (#1806); the presence filter carries its target.
+    hasExpiration: createResourcesFilterPresenceSchema('expiresAt'),
 };
 // App Admin gets enhanced filter fields with additional capabilities
 const ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS = {
@@ -44,6 +48,7 @@ export var OrgOAuthClients_Operations;
     OrgOAuthClients_Operations["DEACTIVATE"] = "deactivate";
     OrgOAuthClients_Operations["REACTIVATE"] = "reactivate";
     OrgOAuthClients_Operations["EXPIRE"] = "expire";
+    OrgOAuthClients_Operations["SET_AUTONOMOUS_AGENTS"] = "setAutonomousAgents";
 })(OrgOAuthClients_Operations || (OrgOAuthClients_Operations = {}));
 /*
 Organization OAuth Clients Resource Configuration Factory
@@ -119,7 +124,7 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     // requestDto auto-derived from decorators
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral()
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.")
                     }),
                 },
                 {
@@ -136,7 +141,7 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     // DOES receive the plaintext so they can relay it to the org. Mirror of
                     // the default variant's `customResponseDto` above — keep in sync.
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral()
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint.")
                     }),
                 }
             ],
@@ -198,6 +203,12 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.LOW,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`
                     // and the paired prefix implementation forces the status transition itself, so there is no field
@@ -233,6 +244,12 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     isDefault: true,
                     roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can deactivate clients
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({}),
                     enabledCondition: ({ currentObject }) => {
@@ -245,6 +262,7 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     variantKey: "admin",
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can deactivate any org clients
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // Per-variant DTOs are NOT inherited from the default variant — each variant builds
                     // its own, so this cross-tenant variant needs its own narrowing or it re-derives the
@@ -276,6 +294,12 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     isDefault: true,
                     roles: [CORE_ORG_ROLES.ORG_ADMIN], // Only org admins can reactivate clients
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A machine credential's status transition is token-lifecycle evidence, but this risk sits below the
+                    // automatic HIGH/CRITICAL audit floor, so it recorded no operation row — a revoked or reinstated
+                    // credential left no classified evidence. Raising `riskLevel` would buy the row by mis-declaring the
+                    // verb's danger (it drives UI affordances); the opt-in is the evidence axis. Same reasoning as REGENERATE.
+                    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — revocation, reinstatement and expiry are attributable transitions.
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({}),
                     enabledCondition: ({ currentObject }) => {
@@ -288,6 +312,7 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     variantKey: "admin",
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], // App admins can reactivate any org clients
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    auditableEvent: { auditBelowRiskFloor: true },
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     // See DEACTIVATE's `admin` variant: its own narrowing, and no `enabledCondition`.
                     requestDto: z.object({}),
@@ -329,12 +354,12 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     requiresStepUpAuthentication: true,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: z.object({
-                        oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())
+                        oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe("When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so the client can switch over.")
                     }),
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral(),
-                        oldClientId: z.string(),
-                        oldSecretInvalidationDate: z.date()
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint."),
+                        oldClientId: z.string().describe("The id of the client whose secret was rotated. Rotation reissues the secret on the same client, so this is the client's own id."),
+                        oldSecretInvalidationDate: z.date().describe("When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.")
                     }),
                 },
                 {
@@ -372,12 +397,12 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     //    plaintext so they can relay it to the org.
                     // Keep both in sync with the default variant above.
                     requestDto: z.object({
-                        oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date())
+                        oldSecretInvalidationDate: z.date().min(new Date(), 'Invalidation date must be in the future or now').default(() => new Date()).describe("When the previous secret stops authenticating. Defaults to now, which cuts it off immediately; a later time keeps both secrets working until then so the client can switch over.")
                     }),
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral(),
-                        oldClientId: z.string(),
-                        oldSecretInvalidationDate: z.date()
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint."),
+                        oldClientId: z.string().describe("The id of the client whose secret was rotated. Rotation reissues the secret on the same client, so this is the client's own id."),
+                        oldSecretInvalidationDate: z.date().describe("When the previous secret stops authenticating. Until then both the previous and the new secret are accepted.")
                     }),
                 }
             ],
@@ -422,7 +447,7 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on client credentials.
                     requestDto: z.object({}),
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral(),
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint."),
                     }),
                 },
                 {
@@ -451,7 +476,7 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     // cross-tenant variant cannot rewrite `redirectUris` / `roles` through "regenerate".
                     requestDto: z.object({}),
                     customResponseDto: OAuthClientOrganizationSchema.extend({
-                        plainSecret: z.string().min(1).isEphemeral(),
+                        plainSecret: z.string().min(1).isEphemeral().describe("The full client secret, returned only in this response: only its hash is stored, so it cannot be read again. Present it with the client id at the token endpoint."),
                     }),
                 }
             ],
@@ -462,6 +487,54 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                 }
             ]
         },
+        /**
+         * Replace the set of application-declared autonomous agents this client runs as (#1611). Adding a ref
+         * lets a schedule tick or an inbound delivery start that agent's turns in this organization under this
+         * client's roles, with nobody on a socket; removing it stops the next turn and any decision still
+         * waiting (the principal is re-read before a decision resumes).
+         *
+         * The REQUEST carries the whole list; the paired prefix (`oauth-client-autonomous-agents.custom-impl.backend.service.ts`)
+         * validates each ref against the application's declared autonomous agents, refuses a client that is not
+         * ACTIVE or was registered dynamically, and — serialized on the organization row — refuses a ref another
+         * client of the organization already carries, so at most one client runs a given agent here. The value
+         * the prefix returns is authoritative, so nothing the caller sends is persisted unvalidated.
+         *
+         * Organization administrators only, and deliberately NO cross-tenant `admin` variant: a platform operator
+         * giving an agent authority inside a tenant is the standing reach the platform refuses (Paul, 2026-09-25).
+         *
+         * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a machine credential gains an autonomous agent only by an administrator of its own organization.
+         */
+        [OrgOAuthClients_Operations.SET_AUTONOMOUS_AGENTS]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    // A permission change: the credential gains or loses standing authority to act unattended. Below the
+                    // automatic audit floor by risk, so the evidence axis opts in, as DEACTIVATE does. The dedicated
+                    // AUTONOMOUS_AGENT_BOUND / _UNBOUND rows name each ref; this row names the operation.
+                    auditableEvent: { auditBelowRiskFloor: true },
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({
+                        autonomousAgentRefs: z.array(AutonomousAgentRefSchema).max(AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX)
+                            .describe("Every autonomous agent this client should run as, replacing the current list. Each must be an agent the application declares, and no other client of this organization may already run it. An empty list stops all of them."),
+                    }),
+                    // No `enabledCondition`: REMOVING refs must stay possible on an INACTIVE or EXPIRED client, whose
+                    // binding still holds the ref in this organization. The prefix requires ACTIVE only to ADD one.
+                },
+            ],
+            userNotifications: [
+                {
+                    target: CoreUserNotificationTarget.ORGANIZATION_ADMINISTRATIVE,
+                    channel: CoreUserNotificationChannel.EMAIL,
+                },
+                {
+                    target: CoreUserNotificationTarget.USER_SELF,
+                    channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,
+                }
+            ]
+        },
         [CoreResourceOperation.SEARCH]: {
             variants: [
                 {
@@ -483,7 +556,9 @@ export const orgOAuthClientsResourceConfiguration_InitializationFactory = (resou
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.LOW,
                     isSearchable: true,
-                    searchableFields: ['name', 'description', 'clientId'],
+                    // No `clientId` field exists (#1952), and a client's id is its `_id`, which cannot be text-searched: MongoDB
+                    // stores it as an ObjectId and refuses a regex on it. Finding one client by id is a READ.
+                    searchableFields: ['name', 'description'],
                     searchableOptions: { caseSensitive: false, fullMatchOnly: false },
                     filterFields: ORG_OAUTH_CLIENTS_ADMIN_FILTER_FIELDS,
                     sortFields: ORG_OAUTH_CLIENTS_ADMIN_SORT_FIELDS,