@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.js

@@ -32,14 +32,14 @@ export const ScimTokens_RevokeTokenRequestDto = z.strictObject({});
 export const ScimTokens_RotateTokenRequestDto = z.strictObject({});
 export const ScimTokens_RevokeTokenResponseDto = z.strictObject({
     isActive: z.boolean(),
-    revokedAt: z.date(),
-    message: z.string(),
+    revokedAt: z.date().describe("When this request revoked the token. The time is not stored on the token, so later reads do not show it."),
+    message: z.string().describe("A fixed confirmation: `Token revoked`."),
 });
 export const ScimTokens_RotateTokenResponseDto = z.strictObject({
-    newToken: z.string().isEphemeral(),
-    newTokenId: z.string(),
-    newTokenHash: z.string(),
-    message: z.string(),
+    newToken: z.string().isEphemeral().describe("The new token value, returned only in this response: only its hash is stored, so it cannot be read again. The previous value stops working immediately; the directory sends this one as a bearer token instead."),
+    newTokenId: z.string().describe("The id of the rotated token. Rotation replaces the value on the same token, so this is the token's own id."),
+    newTokenHash: z.string().describe("The SHA-256 hash of the new token value, in hex: the form in which it is stored."),
+    message: z.string().describe("A fixed confirmation: `Token rotated`."),
 });
 // ── Polymorphic Factory ──────────────────────────────────────────────
 export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigurations(scimTokensPolymorphicDeclaration, {
@@ -83,7 +83,7 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                     },
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 }],
@@ -129,7 +129,7 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     resourceOperationLike: CoreResourceOperation.CREATE,
@@ -145,7 +145,7 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     // `token` is `.isEphemeral()` (secret display, revealed once, not
                     // persisted — same decorator api-key `plainKey` uses).
                     customResponseDto: ScimTokenBaseSchema.extend({
-                        token: z.string().isEphemeral(),
+                        token: z.string().isEphemeral().describe("The token value, returned only in this response: only its hash is stored, so it cannot be read again. The directory sends it as a bearer token in the `Authorization` header of its SCIM requests."),
                     }),
                 }],
         },
@@ -154,7 +154,7 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     // IRREVERSIBLE: A revoked token can never be un-revoked; the integration must be issued a new one.
@@ -178,7 +178,7 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     // IRREVERSIBLE: Replaces the token value. The previous one is gone the moment this returns.

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAErG,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,yDAAgC,CAAA;IAChC,qDAA4B,CAAA;IAC5B,qDAA4B,CAAA;AAC9B,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uCAAuC,CACnF,gCAAgC,EAChC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,+EAA+E;IAC/E,6DAA6D;IAC7D,sFAAsF;IACtF,mFAAmF;IACnF,qFAAqF;IACrF,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,oEAAoE;oBACpE,6EAA6E;oBAC7E,yEAAyE;oBACzE,iFAAiF;oBACjF,oEAAoE;oBACpE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,+EAA+E;oBAC/E,kFAAkF;oBAClF,uFAAuF;oBACvF,kFAAkF;oBAClF,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,kCAAkC;oBAC9C,wEAAwE;oBACxE,yEAAyE;oBACzE,2EAA2E;oBAC3E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,iEAAiE;oBACjE,yEAAyE;oBACzE,uEAAuE;oBACvE,kEAAkE;oBAClE,uDAAuD;oBACvD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC;wBAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;qBAChC,CAAC;iBACH,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,mGAAmG;oBACnG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iFAAiF;oBACjF,iFAAiF;oBACjF,qFAAqF;oBACrF,oFAAoF;oBACpF,yEAAyE;oBACzE,qFAAqF;oBACrF,mFAAmF;oBACnF,+DAA+D;oBAC/D,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,4FAA4F;oBAC5F,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,qFAAqF;oBACrF,qFAAqF;oBACrF,0EAA0E;oBAC1E,mFAAmF;oBACnF,uFAAuF;oBACvF,kFAAkF;oBAClF,yDAAyD;oBACzD,EAAE;oBACF,uFAAuF;oBACvF,mFAAmF;oBACnF,iFAAiF;oBACjF,uFAAuF;oBACvF,6CAA6C;oBAC7C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SCIM Tokens Resource Configuration — Polymorphic\n *\n * Produces the organization-scoped factory used by the SCIM bearer protocol.\n * Spread into the registry factory map:\n *   ...scimTokensPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationReversibility,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimTokensPolymorphicDeclaration, ScimTokenBaseSchema } from './scim-tokens.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum ScimTokens_Operations {\n  GENERATE_TOKEN = 'generateToken',\n  REVOKE_TOKEN = 'revokeToken',\n  ROTATE_TOKEN = 'rotateToken',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const ScimTokens_GenerateTokenRequestDto = z.strictObject({\n  displayName: z.string().min(1),\n  expiresAt: z.string().datetime().optional(),\n});\n\nexport const ScimTokens_RevokeTokenRequestDto = z.strictObject({});\n\n/**\n * Rotation is an immediate cutover because the persisted token schema has no previous-hash grace slot.\n * Keep the request strictly empty rather than accepting a migration-window option the runtime cannot honor.\n */\nexport const ScimTokens_RotateTokenRequestDto = z.strictObject({});\n\nexport const ScimTokens_RevokeTokenResponseDto = z.strictObject({\n  isActive: z.boolean(),\n  revokedAt: z.date(),\n  message: z.string(),\n});\n\nexport const ScimTokens_RotateTokenResponseDto = z.strictObject({\n  newToken: z.string().isEphemeral(),\n  newTokenId: z.string(),\n  newTokenHash: z.string(),\n  message: z.string(),\n});\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimTokensPolymorphicFactories = createPolymorphicResourceConfigurations(\n  scimTokensPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: ScimTokens_Operations,\n    // The SCIM bearer-auth middleware resolves an inbound token by its `tokenHash`\n    // on EVERY /scim/v2/* request via a system-context read (see\n    // `scim.backend.controller.ts` `_authenticateBearer` → `servicesRegistryHandler.read`\n    // with the `createForSystemAuthOperation` EC). That read is PRE-USER (the token IS\n    // the credential), so it opts into `systemAccessPolicy.read = ALLOWED` — mirrors the\n    // enterprise SSO-connection resolver's pre-auth read.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n          // The bearer-auth token lookup reads this through the service layer\n          // (`servicesRegistryHandler.read` → `getServiceOperationPathDefault`), which\n          // honours INTERNAL_CALL / API_CALL defaults but NOT `REPOSITORY_ONLY`; a\n          // repository-only READ here throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n          // and 500s every SCIM request. Same fix as the SSO-connection READ.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n          // The SCIM bearer-auth middleware stamps `lastUsedAt` on the resolved token on\n          // every /scim/v2/* request via a fire-and-forget system-context update. Without a\n          // resolvable UPDATE op that write throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n          // (logged FATAL, though swallowed) on every SCIM call. Token metadata mutation is\n          // internal-only; operators rotate/revoke via the dedicated custom ops.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [ScimTokens_Operations.GENERATE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: ScimTokens_GenerateTokenRequestDto,\n          // GENERATE_TOKEN borrows CREATE and PERSISTS a real SCIM-token row (the\n          // SCIM bearer-auth middleware resolves inbound tokens by their persisted\n          // `tokenHash`), then returns that row PLUS the one-time plaintext `token`.\n          // This mirrors the api-key mint contract exactly: the response DTO is the\n          // resource schema extended with an ephemeral secret field — NOT a bespoke\n          // shape. The mint runs as a CREATE prefix (injects `tokenHash` +\n          // `createdByUserId` so the core create persists) + postfix (attaches the\n          // one-time `token`); see `scim-tokens.custom-impl.backend.service.ts`.\n          // `token` is `.isEphemeral()` (secret display, revealed once, not\n          // persisted — same decorator api-key `plainKey` uses).\n          customResponseDto: ScimTokenBaseSchema.extend({\n            token: z.string().isEphemeral(),\n          }),\n        }],\n      },\n      [ScimTokens_Operations.REVOKE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: A revoked token can never be un-revoked; the integration must be issued a new one.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ScimTokens_RevokeTokenRequestDto,\n          // Borrows UPDATE (NOT DELETE) for its route/verb: revocation RETAINS the row for\n          // audit and merely flips `isActive` to false — so the borrowed core op must be a\n          // persisting UPDATE, not a DELETE. (Borrowing DELETE physically removed the row: the\n          // dispatch runs the borrowed core op FIRST, before any replace/postfix, so the core\n          // DELETE deleted the token before the handler could intervene — the same\n          // `replaceCoreOperations`-runs-after-core antipattern fixed for GENERATE_TOKEN.) The\n          // custom impl marks the row inactive via a CREATE-like UPDATE prefix and returns a\n          // revocation acknowledgement, NOT the SCIM-token resource row.\n          customResponseDto: ScimTokens_RevokeTokenResponseDto,\n        }],\n      },\n      [ScimTokens_Operations.ROTATE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: Replaces the token value. The previous one is gone the moment this returns.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ScimTokens_RotateTokenRequestDto,\n          // Borrows UPDATE and re-mints the secret IN PLACE on the same row: the custom impl's\n          // UPDATE prefix injects a fresh `tokenHash` (mirroring the api-key rotate contract —\n          // `tokenHash` is `.excludeFromUpdate()`, carried past the strict parse by\n          // `preserveServerInjectedFields`) and the postfix surfaces the one-time plaintext.\n          // Returns the newly-rotated token (plaintext + hash), NOT the SCIM-token resource row.\n          // `newToken` is the one-time secret → `.isEphemeral()` (secret display, initially\n          // revealed, not editable), mirroring api-key `plainKey`.\n          //\n          // Unlike api-keys (which keep the outgoing secret alive in a `previousHashedKey` grace\n          // slot), the SCIM-token schema has NO previous-hash slot. Rotation is therefore an\n          // IMMEDIATE cutover: the new hash replaces the old and the prior plaintext stops\n          // authenticating at once. Do not expose a migration-window request or response until a\n          // real persisted grace-slot contract exists.\n          customResponseDto: ScimTokens_RotateTokenResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"scim-tokens.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAErG,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,yDAAgC,CAAA;IAChC,qDAA4B,CAAA;IAC5B,qDAA4B,CAAA;AAC9B,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,0GAA0G,CAAC;IACxI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CACvE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iNAAiN,CAAC;IAC9P,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4GAA4G,CAAC;IAC7I,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;IACrH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CACvE,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uCAAuC,CACnF,gCAAgC,EAChC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,+EAA+E;IAC/E,6DAA6D;IAC7D,sFAAsF;IACtF,mFAAmF;IACnF,qFAAqF;IACrF,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,oEAAoE;oBACpE,6EAA6E;oBAC7E,yEAAyE;oBACzE,iFAAiF;oBACjF,oEAAoE;oBACpE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,+EAA+E;oBAC/E,kFAAkF;oBAClF,uFAAuF;oBACvF,kFAAkF;oBAClF,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,kCAAkC;oBAC9C,wEAAwE;oBACxE,yEAAyE;oBACzE,2EAA2E;oBAC3E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,iEAAiE;oBACjE,yEAAyE;oBACzE,uEAAuE;oBACvE,kEAAkE;oBAClE,uDAAuD;oBACvD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC;wBAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,oMAAoM,CAAC;qBAC/O,CAAC;iBACH,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,mGAAmG;oBACnG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iFAAiF;oBACjF,iFAAiF;oBACjF,qFAAqF;oBACrF,oFAAoF;oBACpF,yEAAyE;oBACzE,qFAAqF;oBACrF,mFAAmF;oBACnF,+DAA+D;oBAC/D,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,4FAA4F;oBAC5F,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,qFAAqF;oBACrF,qFAAqF;oBACrF,0EAA0E;oBAC1E,mFAAmF;oBACnF,uFAAuF;oBACvF,kFAAkF;oBAClF,yDAAyD;oBACzD,EAAE;oBACF,uFAAuF;oBACvF,mFAAmF;oBACnF,iFAAiF;oBACjF,uFAAuF;oBACvF,6CAA6C;oBAC7C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SCIM Tokens Resource Configuration — Polymorphic\n *\n * Produces the organization-scoped factory used by the SCIM bearer protocol.\n * Spread into the registry factory map:\n *   ...scimTokensPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationReversibility,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimTokensPolymorphicDeclaration, ScimTokenBaseSchema } from './scim-tokens.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum ScimTokens_Operations {\n  GENERATE_TOKEN = 'generateToken',\n  REVOKE_TOKEN = 'revokeToken',\n  ROTATE_TOKEN = 'rotateToken',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const ScimTokens_GenerateTokenRequestDto = z.strictObject({\n  displayName: z.string().min(1),\n  expiresAt: z.string().datetime().optional(),\n});\n\nexport const ScimTokens_RevokeTokenRequestDto = z.strictObject({});\n\n/**\n * Rotation is an immediate cutover because the persisted token schema has no previous-hash grace slot.\n * Keep the request strictly empty rather than accepting a migration-window option the runtime cannot honor.\n */\nexport const ScimTokens_RotateTokenRequestDto = z.strictObject({});\n\nexport const ScimTokens_RevokeTokenResponseDto = z.strictObject({\n  isActive: z.boolean(),\n  revokedAt: z.date().describe(\"When this request revoked the token. The time is not stored on the token, so later reads do not show it.\"),\n  message: z.string().describe(\"A fixed confirmation: `Token revoked`.\"),\n});\n\nexport const ScimTokens_RotateTokenResponseDto = z.strictObject({\n  newToken: z.string().isEphemeral().describe(\"The new token value, returned only in this response: only its hash is stored, so it cannot be read again. The previous value stops working immediately; the directory sends this one as a bearer token instead.\"),\n  newTokenId: z.string().describe(\"The id of the rotated token. Rotation replaces the value on the same token, so this is the token's own id.\"),\n  newTokenHash: z.string().describe(\"The SHA-256 hash of the new token value, in hex: the form in which it is stored.\"),\n  message: z.string().describe(\"A fixed confirmation: `Token rotated`.\"),\n});\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimTokensPolymorphicFactories = createPolymorphicResourceConfigurations(\n  scimTokensPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: ScimTokens_Operations,\n    // The SCIM bearer-auth middleware resolves an inbound token by its `tokenHash`\n    // on EVERY /scim/v2/* request via a system-context read (see\n    // `scim.backend.controller.ts` `_authenticateBearer` → `servicesRegistryHandler.read`\n    // with the `createForSystemAuthOperation` EC). That read is PRE-USER (the token IS\n    // the credential), so it opts into `systemAccessPolicy.read = ALLOWED` — mirrors the\n    // enterprise SSO-connection resolver's pre-auth read.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n          // The bearer-auth token lookup reads this through the service layer\n          // (`servicesRegistryHandler.read` → `getServiceOperationPathDefault`), which\n          // honours INTERNAL_CALL / API_CALL defaults but NOT `REPOSITORY_ONLY`; a\n          // repository-only READ here throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n          // and 500s every SCIM request. Same fix as the SSO-connection READ.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n          // The SCIM bearer-auth middleware stamps `lastUsedAt` on the resolved token on\n          // every /scim/v2/* request via a fire-and-forget system-context update. Without a\n          // resolvable UPDATE op that write throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n          // (logged FATAL, though swallowed) on every SCIM call. Token metadata mutation is\n          // internal-only; operators rotate/revoke via the dedicated custom ops.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [ScimTokens_Operations.GENERATE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: ScimTokens_GenerateTokenRequestDto,\n          // GENERATE_TOKEN borrows CREATE and PERSISTS a real SCIM-token row (the\n          // SCIM bearer-auth middleware resolves inbound tokens by their persisted\n          // `tokenHash`), then returns that row PLUS the one-time plaintext `token`.\n          // This mirrors the api-key mint contract exactly: the response DTO is the\n          // resource schema extended with an ephemeral secret field — NOT a bespoke\n          // shape. The mint runs as a CREATE prefix (injects `tokenHash` +\n          // `createdByUserId` so the core create persists) + postfix (attaches the\n          // one-time `token`); see `scim-tokens.custom-impl.backend.service.ts`.\n          // `token` is `.isEphemeral()` (secret display, revealed once, not\n          // persisted — same decorator api-key `plainKey` uses).\n          customResponseDto: ScimTokenBaseSchema.extend({\n            token: z.string().isEphemeral().describe(\"The token value, returned only in this response: only its hash is stored, so it cannot be read again. The directory sends it as a bearer token in the `Authorization` header of its SCIM requests.\"),\n          }),\n        }],\n      },\n      [ScimTokens_Operations.REVOKE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: A revoked token can never be un-revoked; the integration must be issued a new one.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ScimTokens_RevokeTokenRequestDto,\n          // Borrows UPDATE (NOT DELETE) for its route/verb: revocation RETAINS the row for\n          // audit and merely flips `isActive` to false — so the borrowed core op must be a\n          // persisting UPDATE, not a DELETE. (Borrowing DELETE physically removed the row: the\n          // dispatch runs the borrowed core op FIRST, before any replace/postfix, so the core\n          // DELETE deleted the token before the handler could intervene — the same\n          // `replaceCoreOperations`-runs-after-core antipattern fixed for GENERATE_TOKEN.) The\n          // custom impl marks the row inactive via a CREATE-like UPDATE prefix and returns a\n          // revocation acknowledgement, NOT the SCIM-token resource row.\n          customResponseDto: ScimTokens_RevokeTokenResponseDto,\n        }],\n      },\n      [ScimTokens_Operations.ROTATE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: Replaces the token value. The previous one is gone the moment this returns.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ScimTokens_RotateTokenRequestDto,\n          // Borrows UPDATE and re-mints the secret IN PLACE on the same row: the custom impl's\n          // UPDATE prefix injects a fresh `tokenHash` (mirroring the api-key rotate contract —\n          // `tokenHash` is `.excludeFromUpdate()`, carried past the strict parse by\n          // `preserveServerInjectedFields`) and the postfix surfaces the one-time plaintext.\n          // Returns the newly-rotated token (plaintext + hash), NOT the SCIM-token resource row.\n          // `newToken` is the one-time secret → `.isEphemeral()` (secret display, initially\n          // revealed, not editable), mirroring api-key `plainKey`.\n          //\n          // Unlike api-keys (which keep the outgoing secret alive in a `previousHashedKey` grace\n          // slot), the SCIM-token schema has NO previous-hash slot. Rotation is therefore an\n          // IMMEDIATE cutover: the new hash replaces the old and the prior plaintext stops\n          // authenticating at once. Do not expose a migration-window request or response until a\n          // real persisted grace-slot contract exists.\n          customResponseDto: ScimTokens_RotateTokenResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/scim/scim-tokens.shared.schemas.d.ts

@@ -18,6 +18,7 @@ export declare const ScimTokenBaseSchema: z.ZodObject<{
     createdByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     lastUsedAt: z.ZodOptional<z.ZodDate>;
     expiresAt: z.ZodOptional<z.ZodDate>;
+    lentUnderCapabilityGrantId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
     isActive: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
@@ -30,6 +31,7 @@ export declare const scimTokensPolymorphicDeclaration: import("../../..").Polymo
     createdByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     lastUsedAt: z.ZodOptional<z.ZodDate>;
     expiresAt: z.ZodOptional<z.ZodDate>;
+    lentUnderCapabilityGrantId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
     isActive: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;

package/dist/esm/security/authentications/scim/scim-tokens.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;;;;;iBA0B9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,gCAAgC;;;;;;;;;;kBAY3C,CAAC"}
+{"version":3,"file":"scim-tokens.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;iBAmC9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,gCAAgC;;;;;;;;;;;kBAY3C,CAAC"}

package/dist/esm/security/authentications/scim/scim-tokens.shared.schemas.js

@@ -33,6 +33,15 @@ export const ScimTokenBaseSchema = z.object({
     createdByUserId: z.string().min(1).excludeFromCreate().excludeFromUpdate(),
     lastUsedAt: z.date().optional(),
     expiresAt: z.date().optional(),
+    /**
+     * The capability grant this token was generated or rotated under (#1631), when a service firm's expert did it through
+     * a lent `MANAGE_SSO_SCIM`. Its `expiresAt` is capped at the grant's end, and it is deactivated when the grant is
+     * revoked or its relationship ends. Absent for a token the organization's own administrators handled. Server-written.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a directory credential obtained through delegated administration cannot outlive the delegation.
+     */
+    lentUnderCapabilityGrantId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence()
+        .describe('The capability grant a service firm\'s expert generated or rotated this token under, through directory administration the organization lent the firm. Such a token expires no later than the grant and is deactivated when the grant is revoked or the relationship ends. Absent for a token the organization\'s own administrators handled.'),
     // `.isAuditEvidence()` — a SCIM token governs directory provisioning for the whole tenant, so
     // whether it is live is an access-control fact. assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
     isActive: z.boolean().default(true).isSummaryField().isAuditEvidence(),

package/dist/esm/security/authentications/scim/scim-tokens.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,qEAAqE;IACrE,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,oEAAoE;IACpE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE;IACxD,8EAA8E;IAC9E,+EAA+E;IAC/E,0DAA0D;IAC1D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC1E,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,8FAA8F;IAC9F,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAEtE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gCAAgC,GAAG,yBAAyB,CAAC;IACxE,gBAAgB,EAAE,YAAY;IAC9B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,mBAAmB;IAC/B,8DAA8D;IAC9D,0DAA0D;IAC1D,kFAAkF;IAClF,sFAAsF;IACtF,QAAQ,EAAE,mBAAmB;SAC1B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,aAAa,CAAC;SAClF,GAAG,CAAC,gCAAgC,CAAC;CACzC,CAAC,CAAC","sourcesContent":["/**\n * SCIM Tokens Schema (Shared) — Polymorphic\n *\n * API bearer tokens for SCIM provisioning endpoints.\n * Naturally flat — no structural nesting needed.\n * The organization scope FK is injected by the polymorphism engine. There is deliberately\n * no application variant because the current SCIM protocol is tenant-scoped.\n *\n * Field renames from old flat schema: label → displayName, createdBy → createdByUserId.\n *\n * @see auth-data-model-audit.md §2F\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const ScimTokenBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // The SHA-256 of the plaintext bearer — the server-side lookup key the SCIM\n  // bearer-auth middleware resolves an inbound token by. The client MUST NEVER\n  // supply it (`.excludeFrom{Create,Update}()`); the `generateToken` custom op's\n  // mint prefix injects it. `isReturnedAtCreation` lets it survive the\n  // backend-only strip so the mint POSTFIX can correlate the one-time plaintext\n  // by hash — mirrors the api-key `hashedKey` contract (which minted secrets rely\n  // on identically). Without `.excludeFromCreate()`, a bare CREATE would require\n  // the client to send `tokenHash`, and without the mint prefix the CREATE that\n  // `generateToken` borrows would fail on the missing required field.\n  tokenHash: z.string().min(1).isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),\n  displayName: z.string().min(1).max(100).isSummaryField(),\n  // Server-authoritative audit field: the id of the admin who minted the token.\n  // Stamped by the `generateToken` mint prefix from the execution context, never\n  // client-supplied (the custom op's request DTO omits it).\n  createdByUserId: z.string().min(1).excludeFromCreate().excludeFromUpdate(),\n  lastUsedAt: z.date().optional(),\n  expiresAt: z.date().optional(),\n  // `.isAuditEvidence()` — a SCIM token governs directory provisioning for the whole tenant, so\n  // whether it is live is an access-control fact. assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n  isActive: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimTokenBase = z.infer<typeof ScimTokenBaseSchema>;\n\nexport const scimTokensPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'scimTokens',\n  baseFieldIdentifier: 'scimTokenId',\n  baseEnumKey: 'SCIM_TOKENS',\n  baseSchema: ScimTokenBaseSchema,\n  // Many tokens per scope (LIST/CREATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope auto-default.\n  // SCIM endpoints authenticate tenant directory credentials only. Do not derive an\n  // application variant until an application-scoped SCIM protocol and authorizer exist.\n  variants: AUTH_SCOPE_VARIANTS\n    .filter((variant) => variant.parentResourceType === CoreResourceType.ORGANIZATIONS)\n    .map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"scim-tokens.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,qEAAqE;IACrE,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,oEAAoE;IACpE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE;IACxD,8EAA8E;IAC9E,+EAA+E;IAC/E,0DAA0D;IAC1D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC1E,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;;OAMG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;SAC7H,QAAQ,CAAC,8UAA8U,CAAC;IAC3V,8FAA8F;IAC9F,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAEtE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gCAAgC,GAAG,yBAAyB,CAAC;IACxE,gBAAgB,EAAE,YAAY;IAC9B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,mBAAmB;IAC/B,8DAA8D;IAC9D,0DAA0D;IAC1D,kFAAkF;IAClF,sFAAsF;IACtF,QAAQ,EAAE,mBAAmB;SAC1B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,aAAa,CAAC;SAClF,GAAG,CAAC,gCAAgC,CAAC;CACzC,CAAC,CAAC","sourcesContent":["/**\n * SCIM Tokens Schema (Shared) — Polymorphic\n *\n * API bearer tokens for SCIM provisioning endpoints.\n * Naturally flat — no structural nesting needed.\n * The organization scope FK is injected by the polymorphism engine. There is deliberately\n * no application variant because the current SCIM protocol is tenant-scoped.\n *\n * Field renames from old flat schema: label → displayName, createdBy → createdByUserId.\n *\n * @see auth-data-model-audit.md §2F\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const ScimTokenBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // The SHA-256 of the plaintext bearer — the server-side lookup key the SCIM\n  // bearer-auth middleware resolves an inbound token by. The client MUST NEVER\n  // supply it (`.excludeFrom{Create,Update}()`); the `generateToken` custom op's\n  // mint prefix injects it. `isReturnedAtCreation` lets it survive the\n  // backend-only strip so the mint POSTFIX can correlate the one-time plaintext\n  // by hash — mirrors the api-key `hashedKey` contract (which minted secrets rely\n  // on identically). Without `.excludeFromCreate()`, a bare CREATE would require\n  // the client to send `tokenHash`, and without the mint prefix the CREATE that\n  // `generateToken` borrows would fail on the missing required field.\n  tokenHash: z.string().min(1).isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),\n  displayName: z.string().min(1).max(100).isSummaryField(),\n  // Server-authoritative audit field: the id of the admin who minted the token.\n  // Stamped by the `generateToken` mint prefix from the execution context, never\n  // client-supplied (the custom op's request DTO omits it).\n  createdByUserId: z.string().min(1).excludeFromCreate().excludeFromUpdate(),\n  lastUsedAt: z.date().optional(),\n  expiresAt: z.date().optional(),\n  /**\n   * The capability grant this token was generated or rotated under (#1631), when a service firm's expert did it through\n   * a lent `MANAGE_SSO_SCIM`. Its `expiresAt` is capped at the grant's end, and it is deactivated when the grant is\n   * revoked or its relationship ends. Absent for a token the organization's own administrators handled. Server-written.\n   *\n   * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a directory credential obtained through delegated administration cannot outlive the delegation.\n   */\n  lentUnderCapabilityGrantId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence()\n    .describe('The capability grant a service firm\\'s expert generated or rotated this token under, through directory administration the organization lent the firm. Such a token expires no later than the grant and is deactivated when the grant is revoked or the relationship ends. Absent for a token the organization\\'s own administrators handled.'),\n  // `.isAuditEvidence()` — a SCIM token governs directory provisioning for the whole tenant, so\n  // whether it is live is an access-control fact. assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n  isActive: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimTokenBase = z.infer<typeof ScimTokenBaseSchema>;\n\nexport const scimTokensPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'scimTokens',\n  baseFieldIdentifier: 'scimTokenId',\n  baseEnumKey: 'SCIM_TOKENS',\n  baseSchema: ScimTokenBaseSchema,\n  // Many tokens per scope (LIST/CREATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope auto-default.\n  // SCIM endpoints authenticate tenant directory credentials only. Do not derive an\n  // application variant until an application-scoped SCIM protocol and authorizer exist.\n  variants: AUTH_SCOPE_VARIANTS\n    .filter((variant) => variant.parentResourceType === CoreResourceType.ORGANIZATIONS)\n    .map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/security/authentications/service-provider-client-authentication.shared.schemas.d.ts

@@ -0,0 +1,169 @@
+/**
+ * A client organization's authentication policy, evaluated when a service firm's expert ACTS in it (#1633).
+ *
+ * ## The shape of the problem
+ *
+ * The firm and the client are two tenants of ONE application. An organization type's `authOverrides` are resolved at
+ * LOGIN, as a user-global most-restrictive intersection over every active membership — so a provider membership
+ * (#1597) left in that intersection would feed every client's policy into the expert's sign-in: an expert serving 200
+ * clients would be held to the strictest of 200 policies for firm-only work, and one client disabling a method the
+ * firm relies on would lock them out entirely. And no client's policy would ever be evaluated when the expert actually
+ * acts in that client.
+ *
+ * So provider memberships leave the login-time intersection, and the CLIENT's policy is evaluated per request, for the
+ * organization the request targets, against what the session has satisfied FOR THAT ORGANIZATION. The pure half of
+ * that evaluation is here; the store and the request wiring are backend.
+ *
+ * ## What counts as satisfying a client
+ *
+ * - A factor proven to THIS application FOR THIS CLIENT (a step-up answered while the request targeted it) —
+ *   {@link FactorSatisfactionSource.THIS_APPLICATION}. A factor completed at sign-in satisfied the EXPERT's own
+ *   policy, not the client's, and does not count; neither does one satisfied for another client. This is the
+ *   resource-tenant posture Microsoft Entra B2B takes when inbound MFA trust is off.
+ * - When the client trusts the firm's MFA on this relationship, a factor the FIRM's enterprise identity provider
+ *   reported in the expert's sign-in — {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED} — provided it maps to a
+ *   method the client's policy accepts. The client's minimum strength therefore still applies under trust.
+ *
+ * Every satisfied factor is recorded with the organization it counts for and where it came from, so the client can
+ * answer "was this expert's action MFA-protected, and by whom?".
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+ */
+import { z } from 'zod';
+import { AuthMethod } from './authentication.shared.schemas';
+import type { UserTypeAuthPolicy } from '../../config/entity-identity-config.shared.schemas';
+import { ServiceProviderMfaTrust } from '../../organizations/service-provider-client-controls.shared.schemas';
+/** @wildo_source:part:start saas.models.auth.service-provider-client-authentication facet:layer:shared facet:audience:app-developer */
+/** Where a factor recorded on a session, for one client organization, came from (#1633). */
+export declare enum FactorSatisfactionSource {
+    /** The expert proved the factor to this application while acting for that organization (a step-up). */
+    THIS_APPLICATION = "THIS_APPLICATION",
+    /**
+     * The firm's own enterprise identity provider reported the factor in the expert's sign-in, and the client trusts
+     * that provider's MFA on this relationship. The claim is the upstream's; this application only accepted it.
+     */
+    PROVIDER_IDP_TRUSTED = "PROVIDER_IDP_TRUSTED"
+}
+/** One factor a session has satisfied for one organization. */
+export declare const SessionSatisfiedFactorSchema: z.ZodObject<{
+    /** The organization the factor counts for — a client, never "everyone". */
+    organizationId: z.ZodString;
+    factor: z.ZodEnum<typeof AuthMethod>;
+    satisfiedAt: z.ZodCoercedDate<unknown>;
+    source: z.ZodEnum<typeof FactorSatisfactionSource>;
+    /** For {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}: the firm whose identity provider reported it. */
+    identityProviderOrganizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SessionSatisfiedFactor = z.infer<typeof SessionSatisfiedFactorSchema>;
+/**
+ * What an enterprise identity provider reported about how it authenticated the person, captured at the federated
+ * sign-in that opened the session. Evidence only: nothing reads it except the trust evaluation below, and it is
+ * never re-emitted as this application's own `amr`.
+ */
+export declare const SessionFederatedAmrEvidenceSchema: z.ZodObject<{
+    /** The organization whose enterprise connection the person signed in through. */
+    identityProviderOrganizationId: z.ZodString;
+    /** The RFC 8176 values the provider's verified ID token carried, as it carried them. */
+    amr: z.ZodArray<z.ZodString>;
+    authenticatedAt: z.ZodCoercedDate<unknown>;
+}, z.core.$strict>;
+export type SessionFederatedAmrEvidence = z.infer<typeof SessionFederatedAmrEvidenceSchema>;
+/** Everything a session records for client-policy evaluation. */
+export declare const SessionClientAuthenticationRecordSchema: z.ZodObject<{
+    satisfiedFactors: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** The organization the factor counts for — a client, never "everyone". */
+        organizationId: z.ZodString;
+        factor: z.ZodEnum<typeof AuthMethod>;
+        satisfiedAt: z.ZodCoercedDate<unknown>;
+        source: z.ZodEnum<typeof FactorSatisfactionSource>;
+        /** For {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}: the firm whose identity provider reported it. */
+        identityProviderOrganizationId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    federatedAmrEvidence: z.ZodOptional<z.ZodObject<{
+        /** The organization whose enterprise connection the person signed in through. */
+        identityProviderOrganizationId: z.ZodString;
+        /** The RFC 8176 values the provider's verified ID token carried, as it carried them. */
+        amr: z.ZodArray<z.ZodString>;
+        authenticatedAt: z.ZodCoercedDate<unknown>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type SessionClientAuthenticationRecord = z.infer<typeof SessionClientAuthenticationRecordSchema>;
+/**
+ * Which RFC 8176 `amr` values an upstream may report that name a factor this application can hold to a minimum
+ * strength — and nothing else.
+ *
+ * spec-cite: RFC 8176 "Authentication Method Reference Values", §2 (https://www.rfc-editor.org/rfc/rfc8176.html) —
+ * `otp` is defined there as a one-time password per RFC 4226 / RFC 6238 (HOTP/TOTP), `sms` as confirmation using SMS,
+ * `hwk` as proof-of-possession of a hardware-secured key.
+ *
+ * Deliberately absent, and the absence is the decision:
+ * - `mfa` names no factor. It asserts that several were used without saying which, so it cannot be held to a
+ *   minimum strength, and the session could not record which factor it accepted. It never counts on its own.
+ * - `swk` (a software-secured key) is not mapped to PASSKEY: whether a synced passkey is phishing-resistant hardware
+ *   is exactly what a client requiring hardware is asking, and an upstream's `swk` does not answer it.
+ * - `pwd` maps to nothing a second factor can be: a password is what the first factor already proved.
+ */
+export declare const UPSTREAM_AMR_SECOND_FACTOR: Readonly<Record<string, AuthMethod>>;
+/** What a client organization's effective policy asks of an expert acting in it. */
+export interface ServiceProviderClientAuthRequirement {
+    /** Whether a second factor, satisfied for this organization, is required at all. */
+    readonly requiresSecondFactor: boolean;
+    /** The factors that may satisfy it — the policy's accepted second factors, so its minimum strength included. */
+    readonly acceptedFactors: readonly AuthMethod[];
+    /**
+     * How long a satisfied factor stays valid, when the client's policy declares a step-up window. Absent: for the
+     * session, as a factor completed at sign-in holds for the session.
+     */
+    readonly windowSeconds?: number;
+}
+/**
+ * The requirement a client organization type's EFFECTIVE policy (the expert's user type resolved against the client
+ * type, `resolveAuthPolicyForOrganizationType`) places on an expert acting in it.
+ *
+ * A missing policy is not "no requirement": it is an unresolvable one, and the caller must refuse. That is why this
+ * takes the resolved policy rather than resolving it.
+ */
+export declare function resolveServiceProviderClientAuthRequirement(clientPolicy: UserTypeAuthPolicy): ServiceProviderClientAuthRequirement;
+/**
+ * The factor this session already satisfied FOR THIS ORGANIZATION that meets the requirement, if any.
+ *
+ * Keyed on the organization, so a factor satisfied for client A never satisfies client B.
+ *
+ * A factor the firm's identity provider reported ({@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}) counts only
+ * while the trust that admitted it still holds: the relationship the expert is admitted through TODAY trusts the
+ * firm's MFA, and it is THAT firm's IdP that reported the factor. The record is a memo of an earlier evaluation, not
+ * a grant. Without this check, a client withdrawing its trust would still accept the recorded factor until the
+ * session record expired (a refresh chain's lifetime), and a different firm's relationship into the same client
+ * would ride on the first firm's IdP. A factor this application verified itself needs no such condition: the client
+ * accepted it from this application directly.
+ */
+export declare function findSatisfiedClientFactor(input: {
+    readonly requirement: ServiceProviderClientAuthRequirement;
+    readonly organizationId: string;
+    readonly satisfiedFactors: readonly SessionSatisfiedFactor[];
+    /** The relationship admitting the expert on THIS request: its firm, and whether the client trusts that firm's MFA. */
+    readonly relationship: {
+        readonly providerOrganizationId: string;
+        readonly providerMfaTrust?: ServiceProviderMfaTrust;
+    };
+    readonly now: Date;
+}): SessionSatisfiedFactor | undefined;
+/**
+ * The factor a trusted upstream `amr` satisfies for this client, if any (#1633, item 3).
+ *
+ * All must hold: the client trusts the firm's MFA on this relationship; the expert signed in through the FIRM's own
+ * enterprise identity provider (not another organization's); the reported value names a factor in the client's
+ * accepted set; and, when the client declares a window, the sign-in is inside it. The strongest qualifying factor is
+ * chosen, so the record names the best proof the upstream reported.
+ */
+export declare function evaluateTrustedProviderAmr(input: {
+    readonly requirement: ServiceProviderClientAuthRequirement;
+    readonly relationship: {
+        readonly providerOrganizationId: string;
+        readonly providerMfaTrust?: ServiceProviderMfaTrust;
+    };
+    readonly evidence: SessionFederatedAmrEvidence | undefined;
+    readonly now: Date;
+}): AuthMethod | undefined;
+/** @wildo_source:part:end saas.models.auth.service-provider-client-authentication */
+//# sourceMappingURL=service-provider-client-authentication.shared.schemas.d.ts.map

package/dist/esm/security/authentications/service-provider-client-authentication.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-client-authentication.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authentications/service-provider-client-authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAE9G,uIAAuI;AACvI,4FAA4F;AAC5F,oBAAY,wBAAwB;IAClC,uGAAuG;IACvG,gBAAgB,qBAAqB;IACrC;;;OAGG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,+DAA+D;AAC/D,eAAO,MAAM,4BAA4B;IACvC,2EAA2E;;;;;IAK3E,+GAA+G;;kBAE/G,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;IAC5C,iFAAiF;;IAEjF,wFAAwF;;;kBAGxF,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,iEAAiE;AACjE,eAAO,MAAM,uCAAuC;;QAzBlD,2EAA2E;;;;;QAK3E,+GAA+G;;;;QAW/G,iFAAiF;;QAEjF,wFAAwF;;;;kBAUxF,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAI3E,CAAC;AAEF,oFAAoF;AACpF,MAAM,WAAW,oCAAoC;IACnD,oFAAoF;IACpF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,gHAAgH;IAChH,QAAQ,CAAC,eAAe,EAAE,SAAS,UAAU,EAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,2CAA2C,CAAC,YAAY,EAAE,kBAAkB,GAAG,oCAAoC,CAOlI;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;IAC3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC7D,sHAAsH;IACtH,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;KAAE,CAAC;IACxH,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB,GAAG,sBAAsB,GAAG,SAAS,CAUrC;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;IAC3D,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;KAAE,CAAC;IACxH,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB,GAAG,UAAU,GAAG,SAAS,CAWzB;AACD,qFAAqF"}

package/dist/esm/security/authentications/service-provider-client-authentication.shared.schemas.js

@@ -0,0 +1,162 @@
+/**
+ * A client organization's authentication policy, evaluated when a service firm's expert ACTS in it (#1633).
+ *
+ * ## The shape of the problem
+ *
+ * The firm and the client are two tenants of ONE application. An organization type's `authOverrides` are resolved at
+ * LOGIN, as a user-global most-restrictive intersection over every active membership — so a provider membership
+ * (#1597) left in that intersection would feed every client's policy into the expert's sign-in: an expert serving 200
+ * clients would be held to the strictest of 200 policies for firm-only work, and one client disabling a method the
+ * firm relies on would lock them out entirely. And no client's policy would ever be evaluated when the expert actually
+ * acts in that client.
+ *
+ * So provider memberships leave the login-time intersection, and the CLIENT's policy is evaluated per request, for the
+ * organization the request targets, against what the session has satisfied FOR THAT ORGANIZATION. The pure half of
+ * that evaluation is here; the store and the request wiring are backend.
+ *
+ * ## What counts as satisfying a client
+ *
+ * - A factor proven to THIS application FOR THIS CLIENT (a step-up answered while the request targeted it) —
+ *   {@link FactorSatisfactionSource.THIS_APPLICATION}. A factor completed at sign-in satisfied the EXPERT's own
+ *   policy, not the client's, and does not count; neither does one satisfied for another client. This is the
+ *   resource-tenant posture Microsoft Entra B2B takes when inbound MFA trust is off.
+ * - When the client trusts the firm's MFA on this relationship, a factor the FIRM's enterprise identity provider
+ *   reported in the expert's sign-in — {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED} — provided it maps to a
+ *   method the client's policy accepts. The client's minimum strength therefore still applies under trust.
+ *
+ * Every satisfied factor is recorded with the organization it counts for and where it came from, so the client can
+ * answer "was this expert's action MFA-protected, and by whom?".
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.
+ */
+import { z } from 'zod';
+import { AuthMethod } from './authentication.shared.schemas.js';
+import { resolveAcceptedSecondFactorMethods } from '../../config/auth-config-resolution.shared.utils.js';
+import { ServiceProviderMfaTrust } from '../../organizations/service-provider-client-controls.shared.schemas.js';
+/** @wildo_source:part:start saas.models.auth.service-provider-client-authentication facet:layer:shared facet:audience:app-developer */
+/** Where a factor recorded on a session, for one client organization, came from (#1633). */
+export var FactorSatisfactionSource;
+(function (FactorSatisfactionSource) {
+    /** The expert proved the factor to this application while acting for that organization (a step-up). */
+    FactorSatisfactionSource["THIS_APPLICATION"] = "THIS_APPLICATION";
+    /**
+     * The firm's own enterprise identity provider reported the factor in the expert's sign-in, and the client trusts
+     * that provider's MFA on this relationship. The claim is the upstream's; this application only accepted it.
+     */
+    FactorSatisfactionSource["PROVIDER_IDP_TRUSTED"] = "PROVIDER_IDP_TRUSTED";
+})(FactorSatisfactionSource || (FactorSatisfactionSource = {}));
+/** One factor a session has satisfied for one organization. */
+export const SessionSatisfiedFactorSchema = z.strictObject({
+    /** The organization the factor counts for — a client, never "everyone". */
+    organizationId: z.string().min(1),
+    factor: z.enum(AuthMethod),
+    satisfiedAt: z.coerce.date(),
+    source: z.enum(FactorSatisfactionSource),
+    /** For {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}: the firm whose identity provider reported it. */
+    identityProviderOrganizationId: z.string().min(1).optional(),
+});
+/**
+ * What an enterprise identity provider reported about how it authenticated the person, captured at the federated
+ * sign-in that opened the session. Evidence only: nothing reads it except the trust evaluation below, and it is
+ * never re-emitted as this application's own `amr`.
+ */
+export const SessionFederatedAmrEvidenceSchema = z.strictObject({
+    /** The organization whose enterprise connection the person signed in through. */
+    identityProviderOrganizationId: z.string().min(1),
+    /** The RFC 8176 values the provider's verified ID token carried, as it carried them. */
+    amr: z.array(z.string().min(1).max(64)).max(32),
+    authenticatedAt: z.coerce.date(),
+});
+/** Everything a session records for client-policy evaluation. */
+export const SessionClientAuthenticationRecordSchema = z.strictObject({
+    satisfiedFactors: z.array(SessionSatisfiedFactorSchema).max(256).default([]),
+    federatedAmrEvidence: SessionFederatedAmrEvidenceSchema.optional(),
+});
+/**
+ * Which RFC 8176 `amr` values an upstream may report that name a factor this application can hold to a minimum
+ * strength — and nothing else.
+ *
+ * spec-cite: RFC 8176 "Authentication Method Reference Values", §2 (https://www.rfc-editor.org/rfc/rfc8176.html) —
+ * `otp` is defined there as a one-time password per RFC 4226 / RFC 6238 (HOTP/TOTP), `sms` as confirmation using SMS,
+ * `hwk` as proof-of-possession of a hardware-secured key.
+ *
+ * Deliberately absent, and the absence is the decision:
+ * - `mfa` names no factor. It asserts that several were used without saying which, so it cannot be held to a
+ *   minimum strength, and the session could not record which factor it accepted. It never counts on its own.
+ * - `swk` (a software-secured key) is not mapped to PASSKEY: whether a synced passkey is phishing-resistant hardware
+ *   is exactly what a client requiring hardware is asking, and an upstream's `swk` does not answer it.
+ * - `pwd` maps to nothing a second factor can be: a password is what the first factor already proved.
+ */
+export const UPSTREAM_AMR_SECOND_FACTOR = {
+    hwk: AuthMethod.PASSKEY,
+    otp: AuthMethod.TOTP,
+    sms: AuthMethod.SMS_OTP,
+};
+/**
+ * The requirement a client organization type's EFFECTIVE policy (the expert's user type resolved against the client
+ * type, `resolveAuthPolicyForOrganizationType`) places on an expert acting in it.
+ *
+ * A missing policy is not "no requirement": it is an unresolvable one, and the caller must refuse. That is why this
+ * takes the resolved policy rather than resolving it.
+ */
+export function resolveServiceProviderClientAuthRequirement(clientPolicy) {
+    const stepUp = clientPolicy.stepUpAuth;
+    return {
+        requiresSecondFactor: clientPolicy.mfaPolicy?.requireMFA === true,
+        acceptedFactors: resolveAcceptedSecondFactorMethods(clientPolicy),
+        ...(stepUp?.enabled ? { windowSeconds: stepUp.maxAgeSeconds } : {}),
+    };
+}
+/** Is a moment still inside the requirement's window? */
+function withinWindow(requirement, at, now) {
+    if (requirement.windowSeconds === undefined)
+        return true;
+    return now.getTime() - at.getTime() <= requirement.windowSeconds * 1000;
+}
+/**
+ * The factor this session already satisfied FOR THIS ORGANIZATION that meets the requirement, if any.
+ *
+ * Keyed on the organization, so a factor satisfied for client A never satisfies client B.
+ *
+ * A factor the firm's identity provider reported ({@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}) counts only
+ * while the trust that admitted it still holds: the relationship the expert is admitted through TODAY trusts the
+ * firm's MFA, and it is THAT firm's IdP that reported the factor. The record is a memo of an earlier evaluation, not
+ * a grant. Without this check, a client withdrawing its trust would still accept the recorded factor until the
+ * session record expired (a refresh chain's lifetime), and a different firm's relationship into the same client
+ * would ride on the first firm's IdP. A factor this application verified itself needs no such condition: the client
+ * accepted it from this application directly.
+ */
+export function findSatisfiedClientFactor(input) {
+    const trustStillHolds = (recorded) => recorded.source !== FactorSatisfactionSource.PROVIDER_IDP_TRUSTED
+        || (input.relationship.providerMfaTrust === ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA
+            && recorded.identityProviderOrganizationId === input.relationship.providerOrganizationId);
+    return input.satisfiedFactors.find((recorded) => recorded.organizationId === input.organizationId
+        && input.requirement.acceptedFactors.includes(recorded.factor)
+        && withinWindow(input.requirement, recorded.satisfiedAt, input.now)
+        && trustStillHolds(recorded));
+}
+/**
+ * The factor a trusted upstream `amr` satisfies for this client, if any (#1633, item 3).
+ *
+ * All must hold: the client trusts the firm's MFA on this relationship; the expert signed in through the FIRM's own
+ * enterprise identity provider (not another organization's); the reported value names a factor in the client's
+ * accepted set; and, when the client declares a window, the sign-in is inside it. The strongest qualifying factor is
+ * chosen, so the record names the best proof the upstream reported.
+ */
+export function evaluateTrustedProviderAmr(input) {
+    const { requirement, relationship, evidence, now } = input;
+    if (relationship.providerMfaTrust !== ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA)
+        return undefined;
+    if (!evidence || evidence.identityProviderOrganizationId !== relationship.providerOrganizationId)
+        return undefined;
+    if (!withinWindow(requirement, evidence.authenticatedAt, now))
+        return undefined;
+    // `hasOwn`: the values are an upstream's strings, and `__proto__` must name nothing rather than the prototype.
+    const reported = new Set(evidence.amr
+        .filter((value) => Object.hasOwn(UPSTREAM_AMR_SECOND_FACTOR, value))
+        .map((value) => UPSTREAM_AMR_SECOND_FACTOR[value]));
+    return [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.SMS_OTP]
+        .find((method) => reported.has(method) && requirement.acceptedFactors.includes(method));
+}
+/** @wildo_source:part:end saas.models.auth.service-provider-client-authentication */
+//# sourceMappingURL=service-provider-client-authentication.shared.schemas.js.map

package/dist/esm/security/authentications/service-provider-client-authentication.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-provider-client-authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/service-provider-client-authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,kCAAkC,EAAE,MAAM,kDAAkD,CAAC;AAEtG,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAE9G,uIAAuI;AACvI,4FAA4F;AAC5F,MAAM,CAAN,IAAY,wBAQX;AARD,WAAY,wBAAwB;IAClC,uGAAuG;IACvG,iEAAqC,CAAA;IACrC;;;OAGG;IACH,yEAA6C,CAAA;AAC/C,CAAC,EARW,wBAAwB,KAAxB,wBAAwB,QAQnC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,2EAA2E;IAC3E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,+GAA+G;IAC/G,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,iFAAiF;IACjF,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,wFAAwF;IACxF,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;CACjC,CAAC,CAAC;AAGH,iEAAiE;AACjE,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5E,oBAAoB,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAyC;IAC9E,GAAG,EAAE,UAAU,CAAC,OAAO;IACvB,GAAG,EAAE,UAAU,CAAC,IAAI;IACpB,GAAG,EAAE,UAAU,CAAC,OAAO;CACxB,CAAC;AAeF;;;;;;GAMG;AACH,MAAM,UAAU,2CAA2C,CAAC,YAAgC;IAC1F,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC;IACvC,OAAO;QACL,oBAAoB,EAAE,YAAY,CAAC,SAAS,EAAE,UAAU,KAAK,IAAI;QACjE,eAAe,EAAE,kCAAkC,CAAC,YAAY,CAAC;QACjE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,WAAiD,EAAE,EAAQ,EAAE,GAAS;IAC1F,IAAI,WAAW,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,WAAW,CAAC,aAAa,GAAG,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAOzC;IACC,MAAM,eAAe,GAAG,CAAC,QAAgC,EAAW,EAAE,CACpE,QAAQ,CAAC,MAAM,KAAK,wBAAwB,CAAC,oBAAoB;WAC9D,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,KAAK,uBAAuB,CAAC,sBAAsB;eACrF,QAAQ,CAAC,8BAA8B,KAAK,KAAK,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC9C,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;WAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;WAC3D,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC;WAChE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC3D,IAAI,YAAY,CAAC,gBAAgB,KAAK,uBAAuB,CAAC,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACvG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,8BAA8B,KAAK,YAAY,CAAC,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACnH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChF,+GAA+G;IAC/G,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;SAC7D,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5F,CAAC;AACD,qFAAqF","sourcesContent":["/**\n * A client organization's authentication policy, evaluated when a service firm's expert ACTS in it (#1633).\n *\n * ## The shape of the problem\n *\n * The firm and the client are two tenants of ONE application. An organization type's `authOverrides` are resolved at\n * LOGIN, as a user-global most-restrictive intersection over every active membership — so a provider membership\n * (#1597) left in that intersection would feed every client's policy into the expert's sign-in: an expert serving 200\n * clients would be held to the strictest of 200 policies for firm-only work, and one client disabling a method the\n * firm relies on would lock them out entirely. And no client's policy would ever be evaluated when the expert actually\n * acts in that client.\n *\n * So provider memberships leave the login-time intersection, and the CLIENT's policy is evaluated per request, for the\n * organization the request targets, against what the session has satisfied FOR THAT ORGANIZATION. The pure half of\n * that evaluation is here; the store and the request wiring are backend.\n *\n * ## What counts as satisfying a client\n *\n * - A factor proven to THIS application FOR THIS CLIENT (a step-up answered while the request targeted it) —\n *   {@link FactorSatisfactionSource.THIS_APPLICATION}. A factor completed at sign-in satisfied the EXPERT's own\n *   policy, not the client's, and does not count; neither does one satisfied for another client. This is the\n *   resource-tenant posture Microsoft Entra B2B takes when inbound MFA trust is off.\n * - When the client trusts the firm's MFA on this relationship, a factor the FIRM's enterprise identity provider\n *   reported in the expert's sign-in — {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED} — provided it maps to a\n *   method the client's policy accepts. The client's minimum strength therefore still applies under trust.\n *\n * Every satisfied factor is recorded with the organization it counts for and where it came from, so the client can\n * answer \"was this expert's action MFA-protected, and by whom?\".\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.\n */\n\nimport { z } from 'zod';\nimport { AuthMethod } from './authentication.shared.schemas';\nimport { resolveAcceptedSecondFactorMethods } from '../../config/auth-config-resolution.shared.utils';\nimport type { UserTypeAuthPolicy } from '../../config/entity-identity-config.shared.schemas';\nimport { ServiceProviderMfaTrust } from '../../organizations/service-provider-client-controls.shared.schemas';\n\n/** @wildo_source:part:start saas.models.auth.service-provider-client-authentication facet:layer:shared facet:audience:app-developer */\n/** Where a factor recorded on a session, for one client organization, came from (#1633). */\nexport enum FactorSatisfactionSource {\n  /** The expert proved the factor to this application while acting for that organization (a step-up). */\n  THIS_APPLICATION = 'THIS_APPLICATION',\n  /**\n   * The firm's own enterprise identity provider reported the factor in the expert's sign-in, and the client trusts\n   * that provider's MFA on this relationship. The claim is the upstream's; this application only accepted it.\n   */\n  PROVIDER_IDP_TRUSTED = 'PROVIDER_IDP_TRUSTED',\n}\n\n/** One factor a session has satisfied for one organization. */\nexport const SessionSatisfiedFactorSchema = z.strictObject({\n  /** The organization the factor counts for — a client, never \"everyone\". */\n  organizationId: z.string().min(1),\n  factor: z.enum(AuthMethod),\n  satisfiedAt: z.coerce.date(),\n  source: z.enum(FactorSatisfactionSource),\n  /** For {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}: the firm whose identity provider reported it. */\n  identityProviderOrganizationId: z.string().min(1).optional(),\n});\nexport type SessionSatisfiedFactor = z.infer<typeof SessionSatisfiedFactorSchema>;\n\n/**\n * What an enterprise identity provider reported about how it authenticated the person, captured at the federated\n * sign-in that opened the session. Evidence only: nothing reads it except the trust evaluation below, and it is\n * never re-emitted as this application's own `amr`.\n */\nexport const SessionFederatedAmrEvidenceSchema = z.strictObject({\n  /** The organization whose enterprise connection the person signed in through. */\n  identityProviderOrganizationId: z.string().min(1),\n  /** The RFC 8176 values the provider's verified ID token carried, as it carried them. */\n  amr: z.array(z.string().min(1).max(64)).max(32),\n  authenticatedAt: z.coerce.date(),\n});\nexport type SessionFederatedAmrEvidence = z.infer<typeof SessionFederatedAmrEvidenceSchema>;\n\n/** Everything a session records for client-policy evaluation. */\nexport const SessionClientAuthenticationRecordSchema = z.strictObject({\n  satisfiedFactors: z.array(SessionSatisfiedFactorSchema).max(256).default([]),\n  federatedAmrEvidence: SessionFederatedAmrEvidenceSchema.optional(),\n});\nexport type SessionClientAuthenticationRecord = z.infer<typeof SessionClientAuthenticationRecordSchema>;\n\n/**\n * Which RFC 8176 `amr` values an upstream may report that name a factor this application can hold to a minimum\n * strength — and nothing else.\n *\n * spec-cite: RFC 8176 \"Authentication Method Reference Values\", §2 (https://www.rfc-editor.org/rfc/rfc8176.html) —\n * `otp` is defined there as a one-time password per RFC 4226 / RFC 6238 (HOTP/TOTP), `sms` as confirmation using SMS,\n * `hwk` as proof-of-possession of a hardware-secured key.\n *\n * Deliberately absent, and the absence is the decision:\n * - `mfa` names no factor. It asserts that several were used without saying which, so it cannot be held to a\n *   minimum strength, and the session could not record which factor it accepted. It never counts on its own.\n * - `swk` (a software-secured key) is not mapped to PASSKEY: whether a synced passkey is phishing-resistant hardware\n *   is exactly what a client requiring hardware is asking, and an upstream's `swk` does not answer it.\n * - `pwd` maps to nothing a second factor can be: a password is what the first factor already proved.\n */\nexport const UPSTREAM_AMR_SECOND_FACTOR: Readonly<Record<string, AuthMethod>> = {\n  hwk: AuthMethod.PASSKEY,\n  otp: AuthMethod.TOTP,\n  sms: AuthMethod.SMS_OTP,\n};\n\n/** What a client organization's effective policy asks of an expert acting in it. */\nexport interface ServiceProviderClientAuthRequirement {\n  /** Whether a second factor, satisfied for this organization, is required at all. */\n  readonly requiresSecondFactor: boolean;\n  /** The factors that may satisfy it — the policy's accepted second factors, so its minimum strength included. */\n  readonly acceptedFactors: readonly AuthMethod[];\n  /**\n   * How long a satisfied factor stays valid, when the client's policy declares a step-up window. Absent: for the\n   * session, as a factor completed at sign-in holds for the session.\n   */\n  readonly windowSeconds?: number;\n}\n\n/**\n * The requirement a client organization type's EFFECTIVE policy (the expert's user type resolved against the client\n * type, `resolveAuthPolicyForOrganizationType`) places on an expert acting in it.\n *\n * A missing policy is not \"no requirement\": it is an unresolvable one, and the caller must refuse. That is why this\n * takes the resolved policy rather than resolving it.\n */\nexport function resolveServiceProviderClientAuthRequirement(clientPolicy: UserTypeAuthPolicy): ServiceProviderClientAuthRequirement {\n  const stepUp = clientPolicy.stepUpAuth;\n  return {\n    requiresSecondFactor: clientPolicy.mfaPolicy?.requireMFA === true,\n    acceptedFactors: resolveAcceptedSecondFactorMethods(clientPolicy),\n    ...(stepUp?.enabled ? { windowSeconds: stepUp.maxAgeSeconds } : {}),\n  };\n}\n\n/** Is a moment still inside the requirement's window? */\nfunction withinWindow(requirement: ServiceProviderClientAuthRequirement, at: Date, now: Date): boolean {\n  if (requirement.windowSeconds === undefined) return true;\n  return now.getTime() - at.getTime() <= requirement.windowSeconds * 1000;\n}\n\n/**\n * The factor this session already satisfied FOR THIS ORGANIZATION that meets the requirement, if any.\n *\n * Keyed on the organization, so a factor satisfied for client A never satisfies client B.\n *\n * A factor the firm's identity provider reported ({@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}) counts only\n * while the trust that admitted it still holds: the relationship the expert is admitted through TODAY trusts the\n * firm's MFA, and it is THAT firm's IdP that reported the factor. The record is a memo of an earlier evaluation, not\n * a grant. Without this check, a client withdrawing its trust would still accept the recorded factor until the\n * session record expired (a refresh chain's lifetime), and a different firm's relationship into the same client\n * would ride on the first firm's IdP. A factor this application verified itself needs no such condition: the client\n * accepted it from this application directly.\n */\nexport function findSatisfiedClientFactor(input: {\n  readonly requirement: ServiceProviderClientAuthRequirement;\n  readonly organizationId: string;\n  readonly satisfiedFactors: readonly SessionSatisfiedFactor[];\n  /** The relationship admitting the expert on THIS request: its firm, and whether the client trusts that firm's MFA. */\n  readonly relationship: { readonly providerOrganizationId: string; readonly providerMfaTrust?: ServiceProviderMfaTrust };\n  readonly now: Date;\n}): SessionSatisfiedFactor | undefined {\n  const trustStillHolds = (recorded: SessionSatisfiedFactor): boolean =>\n    recorded.source !== FactorSatisfactionSource.PROVIDER_IDP_TRUSTED\n    || (input.relationship.providerMfaTrust === ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA\n      && recorded.identityProviderOrganizationId === input.relationship.providerOrganizationId);\n  return input.satisfiedFactors.find((recorded) =>\n    recorded.organizationId === input.organizationId\n    && input.requirement.acceptedFactors.includes(recorded.factor)\n    && withinWindow(input.requirement, recorded.satisfiedAt, input.now)\n    && trustStillHolds(recorded));\n}\n\n/**\n * The factor a trusted upstream `amr` satisfies for this client, if any (#1633, item 3).\n *\n * All must hold: the client trusts the firm's MFA on this relationship; the expert signed in through the FIRM's own\n * enterprise identity provider (not another organization's); the reported value names a factor in the client's\n * accepted set; and, when the client declares a window, the sign-in is inside it. The strongest qualifying factor is\n * chosen, so the record names the best proof the upstream reported.\n */\nexport function evaluateTrustedProviderAmr(input: {\n  readonly requirement: ServiceProviderClientAuthRequirement;\n  readonly relationship: { readonly providerOrganizationId: string; readonly providerMfaTrust?: ServiceProviderMfaTrust };\n  readonly evidence: SessionFederatedAmrEvidence | undefined;\n  readonly now: Date;\n}): AuthMethod | undefined {\n  const { requirement, relationship, evidence, now } = input;\n  if (relationship.providerMfaTrust !== ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA) return undefined;\n  if (!evidence || evidence.identityProviderOrganizationId !== relationship.providerOrganizationId) return undefined;\n  if (!withinWindow(requirement, evidence.authenticatedAt, now)) return undefined;\n  // `hasOwn`: the values are an upstream's strings, and `__proto__` must name nothing rather than the prototype.\n  const reported = new Set(evidence.amr\n    .filter((value) => Object.hasOwn(UPSTREAM_AMR_SECOND_FACTOR, value))\n    .map((value) => UPSTREAM_AMR_SECOND_FACTOR[value]!));\n  return [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.SMS_OTP]\n    .find((method) => reported.has(method) && requirement.acceptedFactors.includes(method));\n}\n/** @wildo_source:part:end saas.models.auth.service-provider-client-authentication */\n"]}

package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,oBAAY,0BAA0B;IACpC,YAAY,gBAAgB;IAC5B,SAAS,aAAa;IACtB,SAAS,aAAa;CACvB;AAID,eAAO,MAAM,qCAAqC;;iBAEhD,CAAC;AAEH,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAE/D,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAI/D,eAAO,MAAM,mCAAmC,mRAyK/C,CAAC"}
+{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,oBAAY,0BAA0B;IACpC,YAAY,gBAAgB;IAC5B,SAAS,aAAa;IACtB,SAAS,aAAa;CACvB;AAID,eAAO,MAAM,qCAAqC;;iBAEhD,CAAC;AAEH,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAE/D,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAI/D,eAAO,MAAM,mCAAmC,mRA2K/C,CAAC"}