npm - @wildo-ai/saas-models - Versions diffs - 1.1.5 → 1.1.7 - Mend

@wildo-ai/saas-models 1.1.5 → 1.1.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1295) hide show

package/dist/esm/security/oauth-clients/oauth-clients.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-clients.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/oauth-clients/oauth-clients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;~~AAExB~~,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAMlE;;;GAGG;AACH,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,QAAQ,aAAa;IACrB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED,oBAAY,cAAc;IACxB,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;CAChC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,4BAA4B;IACtC,IAAI,SAAS;IACb,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;CAC1C;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,4BAA4B,GAAG,OAAO,CAEnG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAaH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAiB7D,CAAC;AAeH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAsB7D;AAMD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;~~iBA0LhC~~,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,6BAA6B~~;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGxC~~,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
1	+ {"version":3,"file":"oauth-clients.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-clients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAMlE;;;GAGG;AACH,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACpB;AAED;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,QAAQ,aAAa;IACrB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AAED,oBAAY,cAAc;IACxB,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;CAChC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,4BAA4B;IACtC,IAAI,SAAS;IACb,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;CAC1C;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,4BAA4B,GAAG,OAAO,CAEnG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAaH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAiB7D,CAAC;AAeH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAsB7D;AAMD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;iBA4LhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/esm/security/oauth-clients/oauth-clients.shared.schemas.js CHANGED Viewed

@@ -22,6 +22,7 @@
  * codes, tokens and user consent records have their own runtime/storage owners.
  */
 import { z } from 'zod';
+import { AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX, AutonomousAgentRefSchema } from '../../flows-actors/autonomous-agents.shared.schemas.js';
 import { RolesSchema } from '../authorizations/roles.shared.schemas.js';
 import { ApiKeyScope } from '../api-keys/api-keys.shared.schemas.js';
 // ===============================
@@ -329,7 +330,8 @@ export const OAuthClientSchemaBase = z.object({
     // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
     status: z.enum(OAuthClientStatus).default(OAuthClientStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),
     expiresAt: z.date().optional().isDBIndexed().isSummaryField(),
-    lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),
+    lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate()
+        .describe('When the client was last accepted, to the minute: at the token endpoint, with its secret, or through one of its access tokens. Absent until it is first used.'),
     createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),
     // ── Client secret ─────────────────────────────────────────────────────────
@@ -343,7 +345,8 @@ export const OAuthClientSchemaBase = z.object({
     // once at creation via `isReturnedAtCreation`, which the mint postfix correlates
     // the one-time plaintext against). `.excludeFrom{Create,Update}()` — the client
     // never supplies it; the mint impl is the single server-side choke point.
-    hashedSecret: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),
+    hashedSecret: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate()
+        .describe('The SHA-256 hash of the client secret, the only form the application keeps. Returned in the creation response only; the secret itself is `plainSecret`, shown that once.'),
     // First 8 chars of the plaintext secret — persisted + shown in lists
     // (`.isSummaryField()`) so an admin can identify a client without revealing the
     // secret. Server-managed.
@@ -434,11 +437,29 @@ export const OAuthClientSchemaBase = z.object({
         .isAuditEvidence(),
 });
 export const OAuthClientOrganizationSchema = OAuthClientSchemaBase.extend({
-    scope: z.literal(ApiKeyScope.ORGANIZATION),
+    scope: z.literal(ApiKeyScope.ORGANIZATION).describe("Always `organization`: the client is registered by one organization and acts within it."),
     organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
+    /**
+     * The application-declared autonomous agents this client runs as (#1611). A schedule tick or an inbound
+     * delivery for one of these refs starts a turn in this organization under THIS client's current roles,
+     * with nobody on a socket.
+     *
+     * On the credential, so revocation, expiry and binding are ONE row, re-read when a turn starts and again
+     * before a reviewer's decision resumes it. A separate binding resource was rejected: two rows that drift.
+     * ORGANIZATION variant only, by decision (Paul, 2026-09-25): an application-wide client acting in every
+     * tenant is the ambient reach the platform refuses; a firm acting in a client organization does so
+     * through a service-provider relationship that admits its client.
+     *
+     * Written only by the `setAutonomousAgents` operation, which serializes on the organization row so that
+     * at most one client in the organization carries a given ref; CREATE never sets it.
+     *
+     * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — which agents a credential runs is a grant of authority, recorded before and after.
+     */
+    autonomousAgentRefs: z.array(AutonomousAgentRefSchema).max(AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX).default([])
+        .isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),
 });
 export const OAuthClientApplicationSchema = OAuthClientSchemaBase.extend({
-    scope: z.literal(ApiKeyScope.APPLICATION),
+    scope: z.literal(ApiKeyScope.APPLICATION).describe("Always `application`: the client is registered for the application as a whole rather than by an organization."),
     applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),
 });
 //# sourceMappingURL=oauth-clients.shared.schemas.js.map

package/dist/esm/security/oauth-clients/oauth-clients.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-clients.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAElE,kCAAkC;AAClC,qBAAqB;AACrB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,0CAAqB,CAAA;IACrB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,KAAjB,iBAAiB,QAI5B;AAED;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,6BAcX;AAdD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,sDAAqB,CAAA;IACrB;;;;;OAKG;IACH,oDAAmB,CAAA;AACrB,CAAC,EAdW,6BAA6B,KAA7B,6BAA6B,QAcxC;AAED,MAAM,CAAN,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,2DAAyC,CAAA;IACzC,2DAAyC,CAAA;IACzC,iDAA+B,CAAA;AACjC,CAAC,EAJW,cAAc,KAAd,cAAc,QAIzB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,4BAIX;AAJD,WAAY,4BAA4B;IACtC,6CAAa,CAAA;IACb,2EAA2C,CAAA;IAC3C,yEAAyC,CAAA;AAC3C,CAAC,EAJW,4BAA4B,KAA5B,4BAA4B,QAIvC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAAoC;IACxF,OAAO,MAAM,KAAK,4BAA4B,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,mGAAmG;IACnG,YAAY;IACZ,aAAa;IACb,WAAW;IACX,kFAAkF;IAClF,OAAO;IACP,OAAO;IACP,oEAAoE;IACpE,OAAO;IACP,aAAa;IACb,4DAA4D;IAC5D,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpG,wGAAwG;AACxG,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AAEtD,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;IAC5F,CAAC;IACD,iGAAiG;IACjG,gGAAgG;IAChG,6FAA6F;IAC7F,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,4BAA4B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,kCAAkC;AAClC,4BAA4B;AAC5B,kCAAkC;AAElC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,EAAE,cAAc;IACtE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACzD,4FAA4F;IAC5F,yFAAyF;IACzF,+DAA+D;IAC/D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACzD,8FAA8F;IAC9F,4FAA4F;IAC5F,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAC3F,kFAAkF;IAClF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,kGAAkG;IAClG,iGAAiG;IACjG,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE;QACxC,OAAO,EAAE,+GAA+G;KACzH,CAAC,CACH;QACD,iGAAiG;QACjG,iGAAiG;QACjG,kGAAkG;QAClG,iGAAiG;QACjG,qFAAqF;QACrF,kFAAkF;SACjF,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,EAAE,CAAC;IACd,wGAAwG;IACxG,yGAAyG;IACzG,qGAAqG;IACrG,0GAA0G;IAC1G,kGAAkG;IAClG,2FAA2F;IAC3F,yGAAyG;IACzG,2GAA2G;IAC3G,kGAAkG;IAClG,2BAA2B;IAC3B,sBAAsB,EAAE,CAAC;SACtB,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE;QACxC,OAAO,EAAE,2HAA2H;KACrI,CAAC,CACH;SACA,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,EAAE,CAAC;IACd,+FAA+F;IAC/F,oGAAoG;IACpG,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,mGAAmG;IACnG,2FAA2F;IAC3F,6FAA6F;IAC7F,mCAAmC;IACnC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,qGAAqG;IACrG,qGAAqG;IACrG,qGAAqG;IACrG,8EAA8E;IAC9E,qDAAqD;IACrD,mGAAmG;IACnG,uEAAuE;IACvE,kFAAkF;IAClF,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;IACzH,yEAAyE;IACzE,qDAAqD;IACrD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6EAA6E;IAC7E,6EAA6E;IAC7E,gFAAgF;IAChF,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,gFAAgF;IAChF,0EAA0E;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9I,qEAAqE;IACrE,gFAAgF;IAChF,0BAA0B;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAE3F,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,4EAA4E;IAC5E,yEAAyE;IACzE,oFAAoF;IACpF,mFAAmF;IACnF,8DAA8D;IAC9D,gDAAgD;IAChD,EAAE;IACF,+EAA+E;IAC/E,6EAA6E;IAC7E,iEAAiE;IACjE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACxH,+EAA+E;IAC/E,iFAAiF;IACjF,qBAAqB;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC7F,8EAA8E;IAC9E,iFAAiF;IACjF,gFAAgF;IAChF,6EAA6E;IAC7E,0DAA0D;IAC1D,8BAA8B,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAE3F,6EAA6E;IAC7E,gFAAgF;IAChF,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE;IACF,iFAAiF;IACjF,kFAAkF;IAClF,iFAAiF;IACjF,+DAA+D;IAC/D,+FAA+F;IAC/F,EAAE;IACF,gFAAgF;IAChF,mFAAmF;IACnF,iFAAiF;IACjF,uEAAuE;IACvE,mFAAmF;IACnF,yEAAyE;IACzE,gEAAgE;IAChE,EAAE;IACF,8EAA8E;IAC9E,oFAAoF;IACpF,0CAA0C;IAC1C,EAAE;IACF,iFAAiF;IACjF,mFAAmF;IACnF,uDAAuD;IACvD,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC/H,iFAAiF;IACjF,mFAAmF;IACnF,6CAA6C;IAC7C,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEtG,6EAA6E;IAC7E,sFAAsF;IACtF,EAAE;IACF,kGAAkG;IAClG,4FAA4F;IAC5F,0FAA0F;IAC1F,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,iGAAiG;IACjG,gGAAgG;IAChG,iFAAiF;IACjF,iGAAiG;IACjG,wCAAwC;IACxC,EAAE;IACF,2FAA2F;IAC3F,wFAAwF;IACxF,0EAA0E;IAC1E,wEAAwE;IACxE,wCAAwC;IACxC,gFAAgF;IAChF,qDAAqD;IACrD,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;SACtD,OAAO,CAAC,6BAA6B,CAAC,QAAQ,CAAC;SAC/C,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;CAErB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACxE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACvE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;CACnG,CAAC,CAAC","sourcesContent":["/*\n OAuth Client Shared Schemas\n \n Frontend/backend shared schemas + DTOs for the registered OAuth-client\n * credential resource (`organizationOAuthClients`, `applicationOAuthClients`).\n * Backend-specific logic (secret minting/hashing, mint pipeline) stays in\n * saas-backend-lib.\n \n This resource is a FAITHFUL MIRROR of the api-keys resource\n * (`api-keys.shared.schemas.ts`): the same long-lived secret + rotation-grace\n * shape, the same server-managed strip-seam contract, the same org\|app scope\n * split. It exists as its OWN resource (not a variant of api-keys) because the\n * request-auth choke point routes a presented secret to a DISTINCT principal\n * by the plaintext prefix (`oc_org_`/`oc_app_` vs the api-key `sk_org_`/`sk_app_`)\n * — an OAuth client and an api-key both authenticate the SAME machine principal\n * (`ORGANIZATION_MACHINE` / `APPLICATION_MACHINE`); they are distinct credential types, an api-key acts\n * as an api-key principal.\n \n OIDC authorization code, interactive consent, persistent consent grants,\n * exact redirect allowlists and public/confidential client classification are\n * implemented. The resource remains the registered-client authority; issued\n * codes, tokens and user consent records have their own runtime/storage owners.\n /\n\nimport { z } from 'zod';\nimport { RolesSchema } from '../authorizations/roles.shared.schemas';\nimport { ApiKeyScope } from '../api-keys/api-keys.shared.schemas';\n\n// ===============================\n// OAUTH CLIENT ENUMS\n// ===============================\n\n/\n Lifecycle status of a registered OAuth client. Mirrors `ApiKeyStatus`: an\n * INACTIVE or EXPIRED client cannot mint tokens at the request-auth choke point.\n /\nexport enum OAuthClientStatus {\n ACTIVE = 'active',\n INACTIVE = 'inactive',\n EXPIRED = 'expired',\n}\n\n/\n OAuth 2.0 grant types a registered client may be authorized to use. The trunk\n * resource ships CLIENT_CREDENTIALS (the machine-to-machine front); the\n * AUTHORIZATION_CODE / REFRESH_TOKEN arms are declared here so the OIDC branch can\n * enable them per-client via `allowedGrants` without a schema reshape.\n /\n/\n How a client got registered — a TRUST classification, not a bookkeeping detail.\n \n Kept separate from `ApiKeyScope` on purpose. `scope` answers \"which of this application's scopes\n * owns the credential\", and both of its members imply someone with standing inside the application\n * created it. This enum answers \"did anyone vouch for this client at all\", and the two questions\n * became independent the moment an anonymous caller could register one.\n \n semantic-literal-boundary: a closed Wildo vocabulary with one named runtime source. Every schema,\n * default, comparison and mapping over registration provenance derives from THIS enum.\n /\nexport enum OAuthClientRegistrationOrigin {\n /\n Created by a principal with standing in this application — an organization administrator\n * through the org-clients API, a platform operator, or a seed. The default, so nothing that\n * existed before dynamic registration changes posture.\n /\n OPERATOR = 'operator',\n /\n Self-registered by an anonymous caller at the RFC 7591 `/register` endpoint.\n \n The client asserted its own name and redirect URIs and proved nothing. It is granted no roles,\n * capped at identity scopes, and always faces the user's consent prompt.\n /\n DYNAMIC = 'dynamic',\n}\n\nexport enum OAuthGrantType {\n CLIENT_CREDENTIALS = 'client_credentials',\n AUTHORIZATION_CODE = 'authorization_code',\n REFRESH_TOKEN = 'refresh_token',\n}\n\n/\n How a registered OAuth client authenticates AT THIS APP'S token endpoint (OIDC\n * `token_endpoint_auth_method`) — the PROVIDER-side classification of OUR clients. Deliberately\n * DISTINCT from `OAuth2_TokenEndpoint_AuthMethod` in `external-connectors-models`, which describes how\n * Wildo-as-CLIENT authenticates to an EXTERNAL IdP's token endpoint (the opposite direction); the two\n * are separate concepts even though they share the OAuth wire vocabulary. Values are the OIDC-registered\n * method names advertised in the discovery document's `token_endpoint_auth_methods_supported`.\n \n - `NONE` — a PUBLIC client: no client secret at the token endpoint; the authorization_code exchange\n * relies on mandatory PKCE (S256) + exact redirect_uri (the OAuth 2.1 baseline for SPA / native /\n * agent clients). This is the default because a client is public unless its\n * server-side secret-retention and token authentication method are explicit.\n * - `CLIENT_SECRET_BASIC` / `CLIENT_SECRET_POST` — a CONFIDENTIAL client: it MUST present its\n * `client_secret` (via HTTP Basic, or the request body, respectively) at the token endpoint, as\n * defense-in-depth on top of PKCE. Both map to \"confidential\" for enforcement — the basic-vs-body\n * distinction is a per-request transport choice the token endpoint already accepts either way.\n /\nexport enum OAuthTokenEndpointAuthMethod {\n NONE = 'none',\n CLIENT_SECRET_BASIC = 'client_secret_basic',\n CLIENT_SECRET_POST = 'client_secret_post',\n}\n\n/\n The single semantic authority for the public-vs-confidential decision: a client is CONFIDENTIAL\n * (must present its secret at the token endpoint) iff its `tokenEndpointAuthMethod` is not `NONE`.\n * Every enforcement site (authorization_code secret check, revocation client-auth) derives from this\n * helper rather than re-deciding, so the classification never drifts.\n /\nexport function isConfidentialTokenEndpointAuthMethod(method: OAuthTokenEndpointAuthMethod): boolean {\n return method !== OAuthTokenEndpointAuthMethod.NONE;\n}\n\n/\n Safe redirect-URI policy for a registered OAuth client — the anti-open-redirect / anti-XSS gate\n * on every entry of the `redirectUris` allowlist.\n \n The authorization_code flow matches a request's `redirect_uri` by EXACT string against this\n * allowlist, and the authorize handler then emits the matched value as the browser's navigation\n * target (`redirect_to`). A registered entry is therefore a literal, user-navigated URL, so the\n * allowlist must never contain a scheme or shape that can execute script or redirect off-origin:\n \n - `https:` — allowed for any host/port (the standard for web / SPA / agent RPs).\n * - `http:` — allowed ONLY for a loopback host (`localhost` / `127.0.0.1` / `::1`), per OAuth 2.1\n * + RFC 8252 (native / CLI / dev clients); loopback is unreachable by a network\n * attacker, so plain http there is safe.\n * - a PRIVATE-USE URI scheme (`cursor:`, `com.example.app:`) — allowed, because that is how a native\n * app receives the code on a platform with no loopback listener. See below.\n * - everything else — `javascript:`, `data:`, `vbscript:`, `file:`, and plain `http:` to a\n * NON-loopback host — is REJECTED.\n * - a fragment (`#…`) is REJECTED (RFC 6749 §3.1.2: a redirect endpoint URI MUST NOT include one).\n * - embedded credentials (`https://user:pass@host`) are REJECTED (a phishing / host-confusion vector).\n * - leading/trailing whitespace is REJECTED — the WHATWG `URL` constructor silently trims it, so a\n * padded value would parse to a different string than the one exact-matched at authorize time.\n \n ## Private-use schemes: why they were added on 2026-08-11\n \n This policy previously refused every non-http(s) scheme, and the note here said to extend it\n * \"deliberately\" if an app ever needed one. A real client made that concrete: Cursor registered\n * `cursor://anysphere.cursor-mcp/oauth/callback` and was refused, which means *no native MCP client\n using a custom-scheme callback could register with a Wildo application at all.** None of our own\n * lanes could have found it — every one of them registers `http://localhost/...`.\n \n The standard sanctions the pattern: native apps \"MAY use whichever redirect option suits their\n * needs best, taking into account platform-specific implementation details\", and private-use URI\n * scheme redirection is one of the three named options.\n * spec-cite: RFC 8252 § 7 and § 7.1 (Private-Use URI Scheme Redirection).\n \n The known weakness is NOT that such a URI is unsafe to navigate to — it is that the code may reach\n * the wrong recipient: \"A limitation of using private-use URI schemes for redirect URIs is that\n * multiple apps can typically register the same scheme, which makes it indeterminate as to which app\n * will receive the authorization code.\"\n * spec-cite: RFC 8252 § 8.1 (Protecting the Authorization Code).\n \n That is an interception risk, and PKCE is the mitigation the same section prescribes. This server\n * REQUIRES PKCE and advertises `S256` alone, so a code delivered to the wrong app is unusable without\n * the verifier. Refusing the scheme outright bought no protection PKCE does not already provide, and\n * cost the entire native-client ecosystem.\n \n What is still refused is what actually executes or reads local state — the danger is the SCHEME's\n * capability, not its unfamiliarity, so the check is a denylist of dangerous schemes rather than an\n * allowlist of known apps. An allowlist is impossible here by construction: the set of legitimate app\n * schemes is open, and every entry would be a new client the framework has to be taught about.\n \n Rejected alternatives: `z.string().url()` (the original guard) accepts every dangerous scheme; a\n * strict https-only rule is too tight for the native/CLI loopback flow; requiring a reverse-DNS\n * scheme (`com.example.app:`, which RFC 8252 § 7.1 RECOMMENDS) was rejected because it would still\n * refuse `cursor:` — the recommendation binds the app author, not the authorization server, and a\n * server that enforces it rejects conformant clients for a style violation.\n \n assurance-control: WILDO.IDENTITY.REDIRECT_TARGET_VALIDATION — registered OAuth redirect targets are constrained to\n * safe absolute URLs, closing an open-redirect / stored-XSS delegation primitive.\n /\n/\n * EXPORTED as of 2026-09-02, and the export is the point rather than a convenience.\n \n This is a closed vocabulary with one named runtime source — the shape `CLAUDE.md` asks for — and it\n * was reachable by nothing outside this file, so the assurance authority basis could not attest\n * `WILDO.IDENTITY.REDIRECT_TARGET_VALIDATION` against the set the guard actually branches on. It would\n * have had to transcribe the schemes into a second list, free to drift from this one, which is the\n * failure the single-source rule exists to prevent.\n \n Nothing else may BRANCH on it: the validator below is the only enforcement site. A reader is a\n * reader — the basis names the members so a programme can say which schemes are refused.\n /\nexport const DANGEROUS_REDIRECT_URI_SCHEMES: ReadonlySet<string> = new Set([\n // Executes script in the navigating context — the open-redirect-to-XSS primitive this guard exists\n // to close.\n 'javascript:',\n 'vbscript:',\n // Carries its own payload, so the \"redirect target\" IS attacker-authored content.\n 'data:',\n 'blob:',\n // Reads local state rather than handing the code to an application.\n 'file:',\n 'filesystem:',\n // Browser-internal surfaces; never a native app's callback.\n 'about:',\n 'chrome:',\n 'chrome-extension:',\n 'moz-extension:',\n 'view-source:',\n]);\n\n/\n The WHATWG \"special\" schemes, minus the two handled explicitly above.\n \n These are web-platform schemes with defined network semantics — never a native app's private-use\n * callback. Refusing them is what keeps \"private-use scheme\" meaning what it says: an app-owned\n * scheme, not any string that happens to parse. `ftp:` in particular was pinned as refused before\n * private-use schemes were admitted, and it stays refused.\n /\nconst NON_CALLBACK_SPECIAL_SCHEMES: ReadonlySet<string> = new Set(['ftp:', 'ws:', 'wss:', 'file:']);\n\n/* RFC 3986 § 3.1 scheme grammar: ALPHA ( ALPHA / DIGIT / \"+\" / \"-\" / \".\" ), plus the WHATWG colon. /\nconst RFC3986_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]:$/;\n\nexport function isSafeOAuthRedirectUri(value: string): boolean {\n if (typeof value !== 'string' \|\| value.length === 0 \|\| value !== value.trim()) return false;\n let url: URL;\n try {\n url = new URL(value);\n } catch {\n return false;\n }\n if (url.hash) return false;\n if (url.username \|\| url.password) return false;\n if (url.protocol === 'https:') return true;\n if (url.protocol === 'http:') {\n const host = url.hostname.toLowerCase();\n return host === 'localhost' \|\| host === '127.0.0.1' \|\| host === '::1' \|\| host === '[::1]';\n }\n // A private-use scheme for a native app. Refused only when the scheme itself confers a dangerous\n // capability; the shape is otherwise held to the same rules as an https target (no fragment, no\n // embedded credentials, both checked above), and interception is answered by mandatory PKCE.\n const scheme = url.protocol.toLowerCase();\n if (DANGEROUS_REDIRECT_URI_SCHEMES.has(scheme)) return false;\n if (NON_CALLBACK_SPECIAL_SCHEMES.has(scheme)) return false;\n return RFC3986_SCHEME_PATTERN.test(scheme);\n}\n\n// ===============================\n// CORE OAUTH CLIENT SCHEMAS\n// ===============================\n\n/\n Base schema for extension (needs to be z.object for `.extend()` to work).\n \n `scope` reuses `ApiKeyScope` (ORGANIZATION\|APPLICATION) — the same primary-scope\n * split as api-keys; the org/app variants narrow it to a literal + add the FK.\n \n SECRET + ROTATION GRACE (`hashedSecret`/`secretPrefix`/`previous`) mirror the\n api-key `hashedKey`/`keyPrefix`/`previous` fields VERBATIM (same decorators,\n same server-managed strip-seam contract). Unlike api-keys — which declare\n * `hashedKey`/`keyPrefix` on the concrete org/app variant schemas — the OAuth\n * client keeps them on the base: every scope persists the identical secret shape,\n * so a single base declaration is the honest single source of truth.\n */\nexport const OAuthClientSchemaBase = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(), // == clientId\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n description: z.string().max(500).optional(),\n scope: z.enum(ApiKeyScope).isDBIndexed().isSummaryField(),\n // `.isAuditEvidence()` — the roles an OAuth client acts with. Same reasoning as the API-key\n // authority field: roles are the single authorization axis, so their before/after IS the\n // evidence. assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n roles: z.array(RolesSchema).default([]).isAuditEvidence(),\n // OIDC IDENTITY scopes this client may request in the authorization_code flow (e.g. `openid`,\n // `profile`, `email`) — validated against the requested `scope` when minting the ID token /\n // serving `/oauth/userinfo`. This is IDENTITY only: it is NOT an authorization axis. Authorization\n // is roles-only (scope-based authorization was deleted 2026-07-21 — do NOT re-introduce it). Empty\n // for pure client_credentials machine clients (they carry no scopes; their access is roles-only).\n allowedScopes: z.array(z.string()).default([]),\n // Grant types this client is authorized to use. Defaults to the machine front.\n allowedGrants: z.array(z.enum(OAuthGrantType)).default([OAuthGrantType.CLIENT_CREDENTIALS]),\n // OIDC authorization_code: exact-match allowlist of redirect URIs. Empty for pure\n // client_credentials clients. An authorization request's `redirect_uri` MUST equal one of\n // these by EXACT string match (no wildcards / no substring) — the anti-open-redirect guard.\n // Each entry is additionally constrained to a SAFE absolute URL by `isSafeOAuthRedirectUri`\n // (https anywhere · http loopback only · no javascript:/data:/fragment/embedded-credentials) so a\n // malicious registered entry cannot become a stored-XSS / off-origin redirect navigation target.\n redirectUris: z\n .array(\n z.string().refine(isSafeOAuthRedirectUri, {\n message: 'redirect_uri must be an absolute https URL (or an http loopback URL) with no fragment or embedded credentials',\n }),\n )\n // Bounded. RFC 7591 sets no limit, and one is needed here because `/oauth/register` accepts this\n // array from an ANONYMOUS caller: without a ceiling a single registration can carry an arbitrary\n // number of URIs, and the per-IP registration limit bounds how MANY registrations happen, not how\n // large each one is. 50 is far above any real client — several environments times a few loopback\n // ports — so this constrains only abuse. Every entry is independently constrained by\n // `isSafeOAuthRedirectUri`, so this is a storage bound, not an authorization one.\n .max(50)\n .default([]),\n // OIDC RP-Initiated Logout 1.0: exact-match allowlist of POST-LOGOUT redirect URIs (revocation-C). When\n // an RP calls `/oauth/end-session` with a `post_logout_redirect_uri`, that value MUST equal one of these\n // by EXACT string match — the SAME anti-open-redirect discipline as `redirectUris` (no wildcards, no\n // substring). A non-matching value is refused and the OP lands the user on its own logged-out page rather\n // than redirecting back to the RP. Empty for clients that never drive an interactive logout (pure\n // client_credentials machines). Each entry is independently held to a SAFE absolute URL by\n // `isSafeOAuthRedirectUri` (https anywhere · http loopback only · no fragment/embedded-credentials), and\n // the array is `.max(50)`-bounded for the same anonymous-`/oauth/register` abuse reason as `redirectUris`.\n // spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (`post_logout_redirect_uri` MUST have been\n // registered with the OP).\n postLogoutRedirectUris: z\n .array(\n z.string().refine(isSafeOAuthRedirectUri, {\n message: 'post_logout_redirect_uri must be an absolute https URL (or an http loopback URL) with no fragment or embedded credentials',\n }),\n )\n .max(50)\n .default([]),\n // OIDC INTERACTIVE CONSENT gate. When TRUE, the authorization_code flow requires EXPLICIT user\n // consent before a code is minted: `/oauth/authorize` returns `consent_required` (with a single-use\n // consent-request token + the client/resource/scope details) instead of auto-issuing the code, and\n // the user must approve at `/oauth/authorize/decision`. Defaults FALSE = a first-party / trusted\n // client whose consent is auto-granted (the pre-consent behavior, so machine + trusted clients are\n // UNAFFECTED). Set TRUE for a THIRD-PARTY client that acts on the user's behalf and must therefore\n // be explicitly authorized by the user before it can obtain a delegated token. The gate is\n // SERVER-owned (a client property, never a request parameter) so a third-party client cannot\n // suppress its own consent prompt.\n requiresConsent: z.boolean().default(false),\n // OIDC `token_endpoint_auth_method` — PUBLIC (`NONE`, the default: PKCE-only, no secret at the token\n // endpoint) vs CONFIDENTIAL (`CLIENT_SECRET_BASIC`/`POST`: the authorization_code exchange AND token\n // revocation REQUIRE the client to present its `client_secret`, defense-in-depth over PKCE). Default\n // `NONE` is the safe default: a server-side confidential client must opt into\n // a secret-bearing token-endpoint method explicitly.\n // Settable at create/update — flipping a client confidential simply starts requiring the secret it\n // already has. The public-vs-confidential decision is derived ONLY via\n // `isConfidentialTokenEndpointAuthMethod`, never by re-comparing the enum inline.\n tokenEndpointAuthMethod: z.enum(OAuthTokenEndpointAuthMethod).default(OAuthTokenEndpointAuthMethod.NONE).isSummaryField(),\n // `.isAuditEvidence()` — whether this client's delegated access is live.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n status: z.enum(OAuthClientStatus).default(OAuthClientStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),\n expiresAt: z.date().optional().isDBIndexed().isSummaryField(),\n lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // ── Client secret ─────────────────────────────────────────────────────────\n // `hashedSecret` is the lookup key for the client-credentials token exchange\n // (the request-auth choke point resolves a presented secret against it on every\n // exchange). Without an index this is an O(n) collection scan; the compound\n // unique guarantees only one active row per hash — cryptographically near-\n // impossible to collide by accident, but a uniqueness contract avoids two rows\n // being returned to the resolver on a hash collision and prevents shadow-client\n // duplicates during rotation. Backend-only (a secret hash, never surfaced except\n // once at creation via `isReturnedAtCreation`, which the mint postfix correlates\n // the one-time plaintext against). `.excludeFrom{Create,Update}()` — the client\n // never supplies it; the mint impl is the single server-side choke point.\n hashedSecret: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),\n // First 8 chars of the plaintext secret — persisted + shown in lists\n // (`.isSummaryField()`) so an admin can identify a client without revealing the\n // secret. Server-managed.\n secretPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n\n // ── Rotation grace window ─────────────────────────────────────────────────\n // When a client secret is ROTATED or REGENERATEd, the PRIOR secret is retained\n // here so it keeps authenticating during an overlap window — callers can migrate\n // to the new secret without a hard cutover. The client-credentials exchange\n // resolves a presented secret against the current `hashedSecret` OR this\n // `previousHashedSecret` while the window is open (`previousSecretInvalidationDate`\n // is null or in the future) AND the client is ACTIVE. All three are server-managed\n // by the rotate/regenerate impls only — never client-settable\n // (`.excludeFromCreate().excludeFromUpdate()`).\n //\n // `previousHashedSecret` — `sha256` of the prior secret; the auth path looks a\n // presented secret up against it, so it is `.isDBIndexed()`. Backend-only (a\n // secret hash, never surfaced). Absent until the first rotation.\n previousHashedSecret: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n // First 8 chars of the prior secret — retained for support/audit display while\n // the previous secret is still valid (not a secret, so surfaced). Overwritten on\n // the next rotation.\n previousSecretPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),\n // When the previous secret stops authenticating. `null`/absent = no scheduled\n // invalidation (REGENERATE overlap — the prior secret stays valid until the next\n // rotation). A future date (ROTATE `oldSecretInvalidationDate`) = honored until\n // then, then rejected. `now`/past (ROTATE default) = immediate hard cutover.\n // Surfaced so operators can see when the old secret dies.\n previousSecretInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n\n // ── Registration access token (RFC 7592) ──────────────────────────────────\n // The credential a DYNAMICALLY REGISTERED client uses to read, update or delete\n // its own registration at the client configuration endpoint. Issued once, at\n // registration, and returned exactly once in the 201 body.\n //\n // \"registration_access_token: REQUIRED. String containing the access token to be\n // used at the client configuration endpoint to perform subsequent operations upon\n // the client registration.\" … \"The client MUST use its registration access token\n // in all calls to this endpoint as an OAuth 2.0 Bearer Token.\"\n // spec-cite: RFC 7592 §3 (Client Information Response) and §2 (Client Configuration Endpoint).\n //\n // SEPARATE FROM `hashedSecret`, deliberately, and not merely for tidiness. They\n // authenticate different things: the client secret authenticates the CLIENT at the\n // token endpoint, while this authenticates a caller's standing to administer the\n // client's own REGISTRATION. A dynamically registered client is public\n // (`token_endpoint_auth_method=none`) and never uses its secret at all, so folding\n // the two together would give a credential two unrelated powers and make\n // \"rotate the secret\" silently mean \"revoke management access\".\n //\n // ABSENT on every client that is not dynamically registered — an operator- or\n // organization-registered client is administered through the ordinary authenticated\n // resource surface, not through RFC 7592.\n //\n // `sha256` hex, matching every other token in this framework: deterministic so a\n // presented Bearer token resolves by re-hashing and matching, and safe because the\n // plaintext is 32 random bytes rather than a password.\n registrationAccessTokenHash: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n // First 8 characters of the plaintext, so an operator can identify which token a\n // client holds without seeing it — the same affordance `secretPrefix` provides for\n // the client secret. Not a secret; surfaced.\n registrationAccessTokenPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),\n\n // ── How this client came to exist ─────────────────────────────────────────\n // WHO registered this client, which is a different question from WHERE the row lives.\n //\n // Every other client on this collection was created by someone with standing in this application:\n // an organization administrator, or a platform operator. A DYNAMIC client was created by an\n // anonymous caller at the RFC 7591 `/register` endpoint, and proved nothing about itself.\n //\n // The field exists because the STORAGE LOCATION can no longer carry that meaning. A dynamically\n // registered client has no organization, so it must live on the APPLICATION collection — and\n // `scope: APPLICATION` otherwise means \"platform-operator first-party\", the most trusted posture\n // there is. Without this discriminator a stranger's client would inherit that trust purely from\n // where it was filed. `ResolvedAuthorizationClient` reads it and maps DYNAMIC to\n // `AuthorizationClientTenancy.UNAFFILIATED`, so the authorize path treats it like a CIMD client:\n // always consent, identity scopes only.\n //\n // `.excludeFromCreate().excludeFromUpdate()` is load-bearing, not hygiene: this is a TRUST\n // CLASSIFICATION, and a caller who could set it could file itself as OPERATOR. Only the\n // registration endpoint writes it, through the system door. Authenticated\n // administrative registration receives OPERATOR by default because that\n // administrator vouches for the client.\n // `.isAuditEvidence()` — a change here changes how much this client is trusted.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n registrationOrigin: z.enum(OAuthClientRegistrationOrigin)\n .default(OAuthClientRegistrationOrigin.OPERATOR)\n .isDBIndexed()\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isAuditEvidence(),\n\n});\n\nexport type OAuthClientBase = z.infer<typeof OAuthClientSchemaBase>;\n\nexport const OAuthClientOrganizationSchema = OAuthClientSchemaBase.extend({\n scope: z.literal(ApiKeyScope.ORGANIZATION),\n organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n});\n\nexport type OAuthClientOrganization = z.infer<typeof OAuthClientOrganizationSchema>;\n\nexport const OAuthClientApplicationSchema = OAuthClientSchemaBase.extend({\n scope: z.literal(ApiKeyScope.APPLICATION),\n applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n});\n\nexport type OAuthClientApplication = z.infer<typeof OAuthClientApplicationSchema>;\n"]}
1	+ {"version":3,"file":"oauth-clients.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-clients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oCAAoC,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AACrI,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAElE,kCAAkC;AAClC,qBAAqB;AACrB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,0CAAqB,CAAA;IACrB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,KAAjB,iBAAiB,QAI5B;AAED;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,6BAcX;AAdD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,sDAAqB,CAAA;IACrB;;;;;OAKG;IACH,oDAAmB,CAAA;AACrB,CAAC,EAdW,6BAA6B,KAA7B,6BAA6B,QAcxC;AAED,MAAM,CAAN,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,2DAAyC,CAAA;IACzC,2DAAyC,CAAA;IACzC,iDAA+B,CAAA;AACjC,CAAC,EAJW,cAAc,KAAd,cAAc,QAIzB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,4BAIX;AAJD,WAAY,4BAA4B;IACtC,6CAAa,CAAA;IACb,2EAA2C,CAAA;IAC3C,yEAAyC,CAAA;AAC3C,CAAC,EAJW,4BAA4B,KAA5B,4BAA4B,QAIvC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAAoC;IACxF,OAAO,MAAM,KAAK,4BAA4B,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,mGAAmG;IACnG,YAAY;IACZ,aAAa;IACb,WAAW;IACX,kFAAkF;IAClF,OAAO;IACP,OAAO;IACP,oEAAoE;IACpE,OAAO;IACP,aAAa;IACb,4DAA4D;IAC5D,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpG,wGAAwG;AACxG,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AAEtD,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;IAC5F,CAAC;IACD,iGAAiG;IACjG,gGAAgG;IAChG,6FAA6F;IAC7F,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,4BAA4B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,kCAAkC;AAClC,4BAA4B;AAC5B,kCAAkC;AAElC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,EAAE,cAAc;IACtE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACzD,4FAA4F;IAC5F,yFAAyF;IACzF,+DAA+D;IAC/D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACzD,8FAA8F;IAC9F,4FAA4F;IAC5F,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAC3F,kFAAkF;IAClF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,kGAAkG;IAClG,iGAAiG;IACjG,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE;QACxC,OAAO,EAAE,+GAA+G;KACzH,CAAC,CACH;QACD,iGAAiG;QACjG,iGAAiG;QACjG,kGAAkG;QAClG,iGAAiG;QACjG,qFAAqF;QACrF,kFAAkF;SACjF,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,EAAE,CAAC;IACd,wGAAwG;IACxG,yGAAyG;IACzG,qGAAqG;IACrG,0GAA0G;IAC1G,kGAAkG;IAClG,2FAA2F;IAC3F,yGAAyG;IACzG,2GAA2G;IAC3G,kGAAkG;IAClG,2BAA2B;IAC3B,sBAAsB,EAAE,CAAC;SACtB,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE;QACxC,OAAO,EAAE,2HAA2H;KACrI,CAAC,CACH;SACA,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,EAAE,CAAC;IACd,+FAA+F;IAC/F,oGAAoG;IACpG,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,mGAAmG;IACnG,2FAA2F;IAC3F,6FAA6F;IAC7F,mCAAmC;IACnC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,qGAAqG;IACrG,qGAAqG;IACrG,qGAAqG;IACrG,8EAA8E;IAC9E,qDAAqD;IACrD,mGAAmG;IACnG,uEAAuE;IACvE,kFAAkF;IAClF,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;IACzH,yEAAyE;IACzE,qDAAqD;IACrD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SAClF,QAAQ,CAAC,+JAA+J,CAAC;IAC5K,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6EAA6E;IAC7E,6EAA6E;IAC7E,gFAAgF;IAChF,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,gFAAgF;IAChF,0EAA0E;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SAC3I,QAAQ,CAAC,0KAA0K,CAAC;IACvL,qEAAqE;IACrE,gFAAgF;IAChF,0BAA0B;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAE3F,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,4EAA4E;IAC5E,yEAAyE;IACzE,oFAAoF;IACpF,mFAAmF;IACnF,8DAA8D;IAC9D,gDAAgD;IAChD,EAAE;IACF,+EAA+E;IAC/E,6EAA6E;IAC7E,iEAAiE;IACjE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACxH,+EAA+E;IAC/E,iFAAiF;IACjF,qBAAqB;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC7F,8EAA8E;IAC9E,iFAAiF;IACjF,gFAAgF;IAChF,6EAA6E;IAC7E,0DAA0D;IAC1D,8BAA8B,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAE3F,6EAA6E;IAC7E,gFAAgF;IAChF,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE;IACF,iFAAiF;IACjF,kFAAkF;IAClF,iFAAiF;IACjF,+DAA+D;IAC/D,+FAA+F;IAC/F,EAAE;IACF,gFAAgF;IAChF,mFAAmF;IACnF,iFAAiF;IACjF,uEAAuE;IACvE,mFAAmF;IACnF,yEAAyE;IACzE,gEAAgE;IAChE,EAAE;IACF,8EAA8E;IAC9E,oFAAoF;IACpF,0CAA0C;IAC1C,EAAE;IACF,iFAAiF;IACjF,mFAAmF;IACnF,uDAAuD;IACvD,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC/H,iFAAiF;IACjF,mFAAmF;IACnF,6CAA6C;IAC7C,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEtG,6EAA6E;IAC7E,sFAAsF;IACtF,EAAE;IACF,kGAAkG;IAClG,4FAA4F;IAC5F,0FAA0F;IAC1F,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,iGAAiG;IACjG,gGAAgG;IAChG,iFAAiF;IACjF,iGAAiG;IACjG,wCAAwC;IACxC,EAAE;IACF,2FAA2F;IAC3F,wFAAwF;IACxF,0EAA0E;IAC1E,wEAAwE;IACxE,wCAAwC;IACxC,gFAAgF;IAChF,qDAAqD;IACrD,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;SACtD,OAAO,CAAC,6BAA6B,CAAC,QAAQ,CAAC;SAC/C,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;CAErB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACxE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,yFAAyF,CAAC;IAC9I,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACzG,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;CAC5F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACvE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,+GAA+G,CAAC;IACnK,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;CACnG,CAAC,CAAC","sourcesContent":["/*\n OAuth Client Shared Schemas\n \n Frontend/backend shared schemas + DTOs for the registered OAuth-client\n * credential resource (`organizationOAuthClients`, `applicationOAuthClients`).\n * Backend-specific logic (secret minting/hashing, mint pipeline) stays in\n * saas-backend-lib.\n \n This resource is a FAITHFUL MIRROR of the api-keys resource\n * (`api-keys.shared.schemas.ts`): the same long-lived secret + rotation-grace\n * shape, the same server-managed strip-seam contract, the same org\|app scope\n * split. It exists as its OWN resource (not a variant of api-keys) because the\n * request-auth choke point routes a presented secret to a DISTINCT principal\n * by the plaintext prefix (`oc_org_`/`oc_app_` vs the api-key `sk_org_`/`sk_app_`)\n * — an OAuth client and an api-key both authenticate the SAME machine principal\n * (`ORGANIZATION_MACHINE` / `APPLICATION_MACHINE`); they are distinct credential types, an api-key acts\n * as an api-key principal.\n \n OIDC authorization code, interactive consent, persistent consent grants,\n * exact redirect allowlists and public/confidential client classification are\n * implemented. The resource remains the registered-client authority; issued\n * codes, tokens and user consent records have their own runtime/storage owners.\n /\n\nimport { z } from 'zod';\nimport { AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX, AutonomousAgentRefSchema } from '../../flows-actors/autonomous-agents.shared.schemas';\nimport { RolesSchema } from '../authorizations/roles.shared.schemas';\nimport { ApiKeyScope } from '../api-keys/api-keys.shared.schemas';\n\n// ===============================\n// OAUTH CLIENT ENUMS\n// ===============================\n\n/\n Lifecycle status of a registered OAuth client. Mirrors `ApiKeyStatus`: an\n * INACTIVE or EXPIRED client cannot mint tokens at the request-auth choke point.\n /\nexport enum OAuthClientStatus {\n ACTIVE = 'active',\n INACTIVE = 'inactive',\n EXPIRED = 'expired',\n}\n\n/\n OAuth 2.0 grant types a registered client may be authorized to use. The trunk\n * resource ships CLIENT_CREDENTIALS (the machine-to-machine front); the\n * AUTHORIZATION_CODE / REFRESH_TOKEN arms are declared here so the OIDC branch can\n * enable them per-client via `allowedGrants` without a schema reshape.\n /\n/\n How a client got registered — a TRUST classification, not a bookkeeping detail.\n \n Kept separate from `ApiKeyScope` on purpose. `scope` answers \"which of this application's scopes\n * owns the credential\", and both of its members imply someone with standing inside the application\n * created it. This enum answers \"did anyone vouch for this client at all\", and the two questions\n * became independent the moment an anonymous caller could register one.\n \n semantic-literal-boundary: a closed Wildo vocabulary with one named runtime source. Every schema,\n * default, comparison and mapping over registration provenance derives from THIS enum.\n /\nexport enum OAuthClientRegistrationOrigin {\n /\n Created by a principal with standing in this application — an organization administrator\n * through the org-clients API, a platform operator, or a seed. The default, so nothing that\n * existed before dynamic registration changes posture.\n /\n OPERATOR = 'operator',\n /\n Self-registered by an anonymous caller at the RFC 7591 `/register` endpoint.\n \n The client asserted its own name and redirect URIs and proved nothing. It is granted no roles,\n * capped at identity scopes, and always faces the user's consent prompt.\n /\n DYNAMIC = 'dynamic',\n}\n\nexport enum OAuthGrantType {\n CLIENT_CREDENTIALS = 'client_credentials',\n AUTHORIZATION_CODE = 'authorization_code',\n REFRESH_TOKEN = 'refresh_token',\n}\n\n/\n How a registered OAuth client authenticates AT THIS APP'S token endpoint (OIDC\n * `token_endpoint_auth_method`) — the PROVIDER-side classification of OUR clients. Deliberately\n * DISTINCT from `OAuth2_TokenEndpoint_AuthMethod` in `external-connectors-models`, which describes how\n * Wildo-as-CLIENT authenticates to an EXTERNAL IdP's token endpoint (the opposite direction); the two\n * are separate concepts even though they share the OAuth wire vocabulary. Values are the OIDC-registered\n * method names advertised in the discovery document's `token_endpoint_auth_methods_supported`.\n \n - `NONE` — a PUBLIC client: no client secret at the token endpoint; the authorization_code exchange\n * relies on mandatory PKCE (S256) + exact redirect_uri (the OAuth 2.1 baseline for SPA / native /\n * agent clients). This is the default because a client is public unless its\n * server-side secret-retention and token authentication method are explicit.\n * - `CLIENT_SECRET_BASIC` / `CLIENT_SECRET_POST` — a CONFIDENTIAL client: it MUST present its\n * `client_secret` (via HTTP Basic, or the request body, respectively) at the token endpoint, as\n * defense-in-depth on top of PKCE. Both map to \"confidential\" for enforcement — the basic-vs-body\n * distinction is a per-request transport choice the token endpoint already accepts either way.\n /\nexport enum OAuthTokenEndpointAuthMethod {\n NONE = 'none',\n CLIENT_SECRET_BASIC = 'client_secret_basic',\n CLIENT_SECRET_POST = 'client_secret_post',\n}\n\n/\n The single semantic authority for the public-vs-confidential decision: a client is CONFIDENTIAL\n * (must present its secret at the token endpoint) iff its `tokenEndpointAuthMethod` is not `NONE`.\n * Every enforcement site (authorization_code secret check, revocation client-auth) derives from this\n * helper rather than re-deciding, so the classification never drifts.\n /\nexport function isConfidentialTokenEndpointAuthMethod(method: OAuthTokenEndpointAuthMethod): boolean {\n return method !== OAuthTokenEndpointAuthMethod.NONE;\n}\n\n/\n Safe redirect-URI policy for a registered OAuth client — the anti-open-redirect / anti-XSS gate\n * on every entry of the `redirectUris` allowlist.\n \n The authorization_code flow matches a request's `redirect_uri` by EXACT string against this\n * allowlist, and the authorize handler then emits the matched value as the browser's navigation\n * target (`redirect_to`). A registered entry is therefore a literal, user-navigated URL, so the\n * allowlist must never contain a scheme or shape that can execute script or redirect off-origin:\n \n - `https:` — allowed for any host/port (the standard for web / SPA / agent RPs).\n * - `http:` — allowed ONLY for a loopback host (`localhost` / `127.0.0.1` / `::1`), per OAuth 2.1\n * + RFC 8252 (native / CLI / dev clients); loopback is unreachable by a network\n * attacker, so plain http there is safe.\n * - a PRIVATE-USE URI scheme (`cursor:`, `com.example.app:`) — allowed, because that is how a native\n * app receives the code on a platform with no loopback listener. See below.\n * - everything else — `javascript:`, `data:`, `vbscript:`, `file:`, and plain `http:` to a\n * NON-loopback host — is REJECTED.\n * - a fragment (`#…`) is REJECTED (RFC 6749 §3.1.2: a redirect endpoint URI MUST NOT include one).\n * - embedded credentials (`https://user:pass@host`) are REJECTED (a phishing / host-confusion vector).\n * - leading/trailing whitespace is REJECTED — the WHATWG `URL` constructor silently trims it, so a\n * padded value would parse to a different string than the one exact-matched at authorize time.\n \n ## Private-use schemes: why they were added on 2026-08-11\n \n This policy previously refused every non-http(s) scheme, and the note here said to extend it\n * \"deliberately\" if an app ever needed one. A real client made that concrete: Cursor registered\n * `cursor://anysphere.cursor-mcp/oauth/callback` and was refused, which means *no native MCP client\n using a custom-scheme callback could register with a Wildo application at all.** None of our own\n * lanes could have found it — every one of them registers `http://localhost/...`.\n \n The standard sanctions the pattern: native apps \"MAY use whichever redirect option suits their\n * needs best, taking into account platform-specific implementation details\", and private-use URI\n * scheme redirection is one of the three named options.\n * spec-cite: RFC 8252 § 7 and § 7.1 (Private-Use URI Scheme Redirection).\n \n The known weakness is NOT that such a URI is unsafe to navigate to — it is that the code may reach\n * the wrong recipient: \"A limitation of using private-use URI schemes for redirect URIs is that\n * multiple apps can typically register the same scheme, which makes it indeterminate as to which app\n * will receive the authorization code.\"\n * spec-cite: RFC 8252 § 8.1 (Protecting the Authorization Code).\n \n That is an interception risk, and PKCE is the mitigation the same section prescribes. This server\n * REQUIRES PKCE and advertises `S256` alone, so a code delivered to the wrong app is unusable without\n * the verifier. Refusing the scheme outright bought no protection PKCE does not already provide, and\n * cost the entire native-client ecosystem.\n \n What is still refused is what actually executes or reads local state — the danger is the SCHEME's\n * capability, not its unfamiliarity, so the check is a denylist of dangerous schemes rather than an\n * allowlist of known apps. An allowlist is impossible here by construction: the set of legitimate app\n * schemes is open, and every entry would be a new client the framework has to be taught about.\n \n Rejected alternatives: `z.string().url()` (the original guard) accepts every dangerous scheme; a\n * strict https-only rule is too tight for the native/CLI loopback flow; requiring a reverse-DNS\n * scheme (`com.example.app:`, which RFC 8252 § 7.1 RECOMMENDS) was rejected because it would still\n * refuse `cursor:` — the recommendation binds the app author, not the authorization server, and a\n * server that enforces it rejects conformant clients for a style violation.\n \n assurance-control: WILDO.IDENTITY.REDIRECT_TARGET_VALIDATION — registered OAuth redirect targets are constrained to\n * safe absolute URLs, closing an open-redirect / stored-XSS delegation primitive.\n /\n/\n * EXPORTED as of 2026-09-02, and the export is the point rather than a convenience.\n \n This is a closed vocabulary with one named runtime source — the shape `CLAUDE.md` asks for — and it\n * was reachable by nothing outside this file, so the assurance authority basis could not attest\n * `WILDO.IDENTITY.REDIRECT_TARGET_VALIDATION` against the set the guard actually branches on. It would\n * have had to transcribe the schemes into a second list, free to drift from this one, which is the\n * failure the single-source rule exists to prevent.\n \n Nothing else may BRANCH on it: the validator below is the only enforcement site. A reader is a\n * reader — the basis names the members so a programme can say which schemes are refused.\n /\nexport const DANGEROUS_REDIRECT_URI_SCHEMES: ReadonlySet<string> = new Set([\n // Executes script in the navigating context — the open-redirect-to-XSS primitive this guard exists\n // to close.\n 'javascript:',\n 'vbscript:',\n // Carries its own payload, so the \"redirect target\" IS attacker-authored content.\n 'data:',\n 'blob:',\n // Reads local state rather than handing the code to an application.\n 'file:',\n 'filesystem:',\n // Browser-internal surfaces; never a native app's callback.\n 'about:',\n 'chrome:',\n 'chrome-extension:',\n 'moz-extension:',\n 'view-source:',\n]);\n\n/\n The WHATWG \"special\" schemes, minus the two handled explicitly above.\n \n These are web-platform schemes with defined network semantics — never a native app's private-use\n * callback. Refusing them is what keeps \"private-use scheme\" meaning what it says: an app-owned\n * scheme, not any string that happens to parse. `ftp:` in particular was pinned as refused before\n * private-use schemes were admitted, and it stays refused.\n /\nconst NON_CALLBACK_SPECIAL_SCHEMES: ReadonlySet<string> = new Set(['ftp:', 'ws:', 'wss:', 'file:']);\n\n/* RFC 3986 § 3.1 scheme grammar: ALPHA ( ALPHA / DIGIT / \"+\" / \"-\" / \".\" ), plus the WHATWG colon. /\nconst RFC3986_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]:$/;\n\nexport function isSafeOAuthRedirectUri(value: string): boolean {\n if (typeof value !== 'string' \|\| value.length === 0 \|\| value !== value.trim()) return false;\n let url: URL;\n try {\n url = new URL(value);\n } catch {\n return false;\n }\n if (url.hash) return false;\n if (url.username \|\| url.password) return false;\n if (url.protocol === 'https:') return true;\n if (url.protocol === 'http:') {\n const host = url.hostname.toLowerCase();\n return host === 'localhost' \|\| host === '127.0.0.1' \|\| host === '::1' \|\| host === '[::1]';\n }\n // A private-use scheme for a native app. Refused only when the scheme itself confers a dangerous\n // capability; the shape is otherwise held to the same rules as an https target (no fragment, no\n // embedded credentials, both checked above), and interception is answered by mandatory PKCE.\n const scheme = url.protocol.toLowerCase();\n if (DANGEROUS_REDIRECT_URI_SCHEMES.has(scheme)) return false;\n if (NON_CALLBACK_SPECIAL_SCHEMES.has(scheme)) return false;\n return RFC3986_SCHEME_PATTERN.test(scheme);\n}\n\n// ===============================\n// CORE OAUTH CLIENT SCHEMAS\n// ===============================\n\n/\n Base schema for extension (needs to be z.object for `.extend()` to work).\n \n `scope` reuses `ApiKeyScope` (ORGANIZATION\|APPLICATION) — the same primary-scope\n * split as api-keys; the org/app variants narrow it to a literal + add the FK.\n \n SECRET + ROTATION GRACE (`hashedSecret`/`secretPrefix`/`previous`) mirror the\n api-key `hashedKey`/`keyPrefix`/`previous` fields VERBATIM (same decorators,\n same server-managed strip-seam contract). Unlike api-keys — which declare\n * `hashedKey`/`keyPrefix` on the concrete org/app variant schemas — the OAuth\n * client keeps them on the base: every scope persists the identical secret shape,\n * so a single base declaration is the honest single source of truth.\n /\nexport const OAuthClientSchemaBase = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(), // == clientId\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n description: z.string().max(500).optional(),\n scope: z.enum(ApiKeyScope).isDBIndexed().isSummaryField(),\n // `.isAuditEvidence()` — the roles an OAuth client acts with. Same reasoning as the API-key\n // authority field: roles are the single authorization axis, so their before/after IS the\n // evidence. assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n roles: z.array(RolesSchema).default([]).isAuditEvidence(),\n // OIDC IDENTITY scopes this client may request in the authorization_code flow (e.g. `openid`,\n // `profile`, `email`) — validated against the requested `scope` when minting the ID token /\n // serving `/oauth/userinfo`. This is IDENTITY only: it is NOT an authorization axis. Authorization\n // is roles-only (scope-based authorization was deleted 2026-07-21 — do NOT re-introduce it). Empty\n // for pure client_credentials machine clients (they carry no scopes; their access is roles-only).\n allowedScopes: z.array(z.string()).default([]),\n // Grant types this client is authorized to use. Defaults to the machine front.\n allowedGrants: z.array(z.enum(OAuthGrantType)).default([OAuthGrantType.CLIENT_CREDENTIALS]),\n // OIDC authorization_code: exact-match allowlist of redirect URIs. Empty for pure\n // client_credentials clients. An authorization request's `redirect_uri` MUST equal one of\n // these by EXACT string match (no wildcards / no substring) — the anti-open-redirect guard.\n // Each entry is additionally constrained to a SAFE absolute URL by `isSafeOAuthRedirectUri`\n // (https anywhere · http loopback only · no javascript:/data:/fragment/embedded-credentials) so a\n // malicious registered entry cannot become a stored-XSS / off-origin redirect navigation target.\n redirectUris: z\n .array(\n z.string().refine(isSafeOAuthRedirectUri, {\n message: 'redirect_uri must be an absolute https URL (or an http loopback URL) with no fragment or embedded credentials',\n }),\n )\n // Bounded. RFC 7591 sets no limit, and one is needed here because `/oauth/register` accepts this\n // array from an ANONYMOUS caller: without a ceiling a single registration can carry an arbitrary\n // number of URIs, and the per-IP registration limit bounds how MANY registrations happen, not how\n // large each one is. 50 is far above any real client — several environments times a few loopback\n // ports — so this constrains only abuse. Every entry is independently constrained by\n // `isSafeOAuthRedirectUri`, so this is a storage bound, not an authorization one.\n .max(50)\n .default([]),\n // OIDC RP-Initiated Logout 1.0: exact-match allowlist of POST-LOGOUT redirect URIs (revocation-C). When\n // an RP calls `/oauth/end-session` with a `post_logout_redirect_uri`, that value MUST equal one of these\n // by EXACT string match — the SAME anti-open-redirect discipline as `redirectUris` (no wildcards, no\n // substring). A non-matching value is refused and the OP lands the user on its own logged-out page rather\n // than redirecting back to the RP. Empty for clients that never drive an interactive logout (pure\n // client_credentials machines). Each entry is independently held to a SAFE absolute URL by\n // `isSafeOAuthRedirectUri` (https anywhere · http loopback only · no fragment/embedded-credentials), and\n // the array is `.max(50)`-bounded for the same anonymous-`/oauth/register` abuse reason as `redirectUris`.\n // spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (`post_logout_redirect_uri` MUST have been\n // registered with the OP).\n postLogoutRedirectUris: z\n .array(\n z.string().refine(isSafeOAuthRedirectUri, {\n message: 'post_logout_redirect_uri must be an absolute https URL (or an http loopback URL) with no fragment or embedded credentials',\n }),\n )\n .max(50)\n .default([]),\n // OIDC INTERACTIVE CONSENT gate. When TRUE, the authorization_code flow requires EXPLICIT user\n // consent before a code is minted: `/oauth/authorize` returns `consent_required` (with a single-use\n // consent-request token + the client/resource/scope details) instead of auto-issuing the code, and\n // the user must approve at `/oauth/authorize/decision`. Defaults FALSE = a first-party / trusted\n // client whose consent is auto-granted (the pre-consent behavior, so machine + trusted clients are\n // UNAFFECTED). Set TRUE for a THIRD-PARTY client that acts on the user's behalf and must therefore\n // be explicitly authorized by the user before it can obtain a delegated token. The gate is\n // SERVER-owned (a client property, never a request parameter) so a third-party client cannot\n // suppress its own consent prompt.\n requiresConsent: z.boolean().default(false),\n // OIDC `token_endpoint_auth_method` — PUBLIC (`NONE`, the default: PKCE-only, no secret at the token\n // endpoint) vs CONFIDENTIAL (`CLIENT_SECRET_BASIC`/`POST`: the authorization_code exchange AND token\n // revocation REQUIRE the client to present its `client_secret`, defense-in-depth over PKCE). Default\n // `NONE` is the safe default: a server-side confidential client must opt into\n // a secret-bearing token-endpoint method explicitly.\n // Settable at create/update — flipping a client confidential simply starts requiring the secret it\n // already has. The public-vs-confidential decision is derived ONLY via\n // `isConfidentialTokenEndpointAuthMethod`, never by re-comparing the enum inline.\n tokenEndpointAuthMethod: z.enum(OAuthTokenEndpointAuthMethod).default(OAuthTokenEndpointAuthMethod.NONE).isSummaryField(),\n // `.isAuditEvidence()` — whether this client's delegated access is live.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n status: z.enum(OAuthClientStatus).default(OAuthClientStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),\n expiresAt: z.date().optional().isDBIndexed().isSummaryField(),\n lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate()\n .describe('When the client was last accepted, to the minute: at the token endpoint, with its secret, or through one of its access tokens. Absent until it is first used.'),\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // ── Client secret ─────────────────────────────────────────────────────────\n // `hashedSecret` is the lookup key for the client-credentials token exchange\n // (the request-auth choke point resolves a presented secret against it on every\n // exchange). Without an index this is an O(n) collection scan; the compound\n // unique guarantees only one active row per hash — cryptographically near-\n // impossible to collide by accident, but a uniqueness contract avoids two rows\n // being returned to the resolver on a hash collision and prevents shadow-client\n // duplicates during rotation. Backend-only (a secret hash, never surfaced except\n // once at creation via `isReturnedAtCreation`, which the mint postfix correlates\n // the one-time plaintext against). `.excludeFrom{Create,Update}()` — the client\n // never supplies it; the mint impl is the single server-side choke point.\n hashedSecret: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate()\n .describe('The SHA-256 hash of the client secret, the only form the application keeps. Returned in the creation response only; the secret itself is `plainSecret`, shown that once.'),\n // First 8 chars of the plaintext secret — persisted + shown in lists\n // (`.isSummaryField()`) so an admin can identify a client without revealing the\n // secret. Server-managed.\n secretPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n\n // ── Rotation grace window ─────────────────────────────────────────────────\n // When a client secret is ROTATED or REGENERATEd, the PRIOR secret is retained\n // here so it keeps authenticating during an overlap window — callers can migrate\n // to the new secret without a hard cutover. The client-credentials exchange\n // resolves a presented secret against the current `hashedSecret` OR this\n // `previousHashedSecret` while the window is open (`previousSecretInvalidationDate`\n // is null or in the future) AND the client is ACTIVE. All three are server-managed\n // by the rotate/regenerate impls only — never client-settable\n // (`.excludeFromCreate().excludeFromUpdate()`).\n //\n // `previousHashedSecret` — `sha256` of the prior secret; the auth path looks a\n // presented secret up against it, so it is `.isDBIndexed()`. Backend-only (a\n // secret hash, never surfaced). Absent until the first rotation.\n previousHashedSecret: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n // First 8 chars of the prior secret — retained for support/audit display while\n // the previous secret is still valid (not a secret, so surfaced). Overwritten on\n // the next rotation.\n previousSecretPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),\n // When the previous secret stops authenticating. `null`/absent = no scheduled\n // invalidation (REGENERATE overlap — the prior secret stays valid until the next\n // rotation). A future date (ROTATE `oldSecretInvalidationDate`) = honored until\n // then, then rejected. `now`/past (ROTATE default) = immediate hard cutover.\n // Surfaced so operators can see when the old secret dies.\n previousSecretInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n\n // ── Registration access token (RFC 7592) ──────────────────────────────────\n // The credential a DYNAMICALLY REGISTERED client uses to read, update or delete\n // its own registration at the client configuration endpoint. Issued once, at\n // registration, and returned exactly once in the 201 body.\n //\n // \"registration_access_token: REQUIRED. String containing the access token to be\n // used at the client configuration endpoint to perform subsequent operations upon\n // the client registration.\" … \"The client MUST use its registration access token\n // in all calls to this endpoint as an OAuth 2.0 Bearer Token.\"\n // spec-cite: RFC 7592 §3 (Client Information Response) and §2 (Client Configuration Endpoint).\n //\n // SEPARATE FROM `hashedSecret`, deliberately, and not merely for tidiness. They\n // authenticate different things: the client secret authenticates the CLIENT at the\n // token endpoint, while this authenticates a caller's standing to administer the\n // client's own REGISTRATION. A dynamically registered client is public\n // (`token_endpoint_auth_method=none`) and never uses its secret at all, so folding\n // the two together would give a credential two unrelated powers and make\n // \"rotate the secret\" silently mean \"revoke management access\".\n //\n // ABSENT on every client that is not dynamically registered — an operator- or\n // organization-registered client is administered through the ordinary authenticated\n // resource surface, not through RFC 7592.\n //\n // `sha256` hex, matching every other token in this framework: deterministic so a\n // presented Bearer token resolves by re-hashing and matching, and safe because the\n // plaintext is 32 random bytes rather than a password.\n registrationAccessTokenHash: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n // First 8 characters of the plaintext, so an operator can identify which token a\n // client holds without seeing it — the same affordance `secretPrefix` provides for\n // the client secret. Not a secret; surfaced.\n registrationAccessTokenPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),\n\n // ── How this client came to exist ─────────────────────────────────────────\n // WHO registered this client, which is a different question from WHERE the row lives.\n //\n // Every other client on this collection was created by someone with standing in this application:\n // an organization administrator, or a platform operator. A DYNAMIC client was created by an\n // anonymous caller at the RFC 7591 `/register` endpoint, and proved nothing about itself.\n //\n // The field exists because the STORAGE LOCATION can no longer carry that meaning. A dynamically\n // registered client has no organization, so it must live on the APPLICATION collection — and\n // `scope: APPLICATION` otherwise means \"platform-operator first-party\", the most trusted posture\n // there is. Without this discriminator a stranger's client would inherit that trust purely from\n // where it was filed. `ResolvedAuthorizationClient` reads it and maps DYNAMIC to\n // `AuthorizationClientTenancy.UNAFFILIATED`, so the authorize path treats it like a CIMD client:\n // always consent, identity scopes only.\n //\n // `.excludeFromCreate().excludeFromUpdate()` is load-bearing, not hygiene: this is a TRUST\n // CLASSIFICATION, and a caller who could set it could file itself as OPERATOR. Only the\n // registration endpoint writes it, through the system door. Authenticated\n // administrative registration receives OPERATOR by default because that\n // administrator vouches for the client.\n // `.isAuditEvidence()` — a change here changes how much this client is trusted.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n registrationOrigin: z.enum(OAuthClientRegistrationOrigin)\n .default(OAuthClientRegistrationOrigin.OPERATOR)\n .isDBIndexed()\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isAuditEvidence(),\n\n});\n\nexport type OAuthClientBase = z.infer<typeof OAuthClientSchemaBase>;\n\nexport const OAuthClientOrganizationSchema = OAuthClientSchemaBase.extend({\n scope: z.literal(ApiKeyScope.ORGANIZATION).describe(\"Always `organization`: the client is registered by one organization and acts within it.\"),\n organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n /\n The application-declared autonomous agents this client runs as (#1611). A schedule tick or an inbound\n * delivery for one of these refs starts a turn in this organization under THIS client's current roles,\n * with nobody on a socket.\n \n On the credential, so revocation, expiry and binding are ONE row, re-read when a turn starts and again\n * before a reviewer's decision resumes it. A separate binding resource was rejected: two rows that drift.\n * ORGANIZATION variant only, by decision (Paul, 2026-09-25): an application-wide client acting in every\n * tenant is the ambient reach the platform refuses; a firm acting in a client organization does so\n * through a service-provider relationship that admits its client.\n \n Written only by the `setAutonomousAgents` operation, which serializes on the organization row so that\n * at most one client in the organization carries a given ref; CREATE never sets it.\n \n assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — which agents a credential runs is a grant of authority, recorded before and after.\n */\n autonomousAgentRefs: z.array(AutonomousAgentRefSchema).max(AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX).default([])\n .isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n});\n\nexport type OAuthClientOrganization = z.infer<typeof OAuthClientOrganizationSchema>;\n\nexport const OAuthClientApplicationSchema = OAuthClientSchemaBase.extend({\n scope: z.literal(ApiKeyScope.APPLICATION).describe(\"Always `application`: the client is registered for the application as a whole rather than by an organization.\"),\n applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n});\n\nexport type OAuthClientApplication = z.infer<typeof OAuthClientApplicationSchema>;\n"]}

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-consent-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAK1I,eAAO,MAAM,6DAA6D,GACxE,wBAAwB,oBAAoB,EAAE;;;;;;;;;kCAsG9C,CAAC"}
1	+ {"version":3,"file":"oauth-consent-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAK1I,eAAO,MAAM,6DAA6D,GACxE,wBAAwB,oBAAoB,EAAE;;;;;;;;;kCAsG9C,CAAC"}

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-consent-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAE1H,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAC3E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAK7C;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,kGAAkG;IAClG,oGAAoG;IACpG,qGAAqG;IACrG,kGAAkG;IAClG,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF;;;;;;;;OAQG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,iGAAiG;QACjG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACrJ;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACrJ;SACF;QACD,mGAAmG;QACnG,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aAC1K;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aAC1K;SACF;QACD,gGAAgG;QAChG,qGAAqG;QACrG,yBAAyB;QACzB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aACxJ;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n OIDC Persistent Consent Grants — Resource Configuration\n \n USER_SELF-scoped (the scope is derived from the `USERS → OAUTH_CONSENT_GRANTS` composition\n * relationship). READ / LIST / DELETE are OWNER-facing (`API_CALL` + `APP_USER`): the framework's\n * USER_SELF primary-scope filter restricts every result to the authenticated caller's own grants, so a\n * user can list their \"authorized apps\" and revoke one, and nobody can see or delete another user's\n * grants. CREATE / UPDATE are SYSTEM-only (`INTERNAL_CALL`): the OIDC consent-decision endpoint is the\n * sole writer, via the `createAsSystem` / `updateAsSystem` primitives.\n \n `systemAccessPolicy` opts the write + read verbs into the `AsSystem` door (default is fail-closed\n FORBIDDEN): the decision endpoint create/updates a grant with no request-context FK to attach\n * (`userId` is re-attached from the schema allowlist on the system path), and the authorize endpoint\n * read/lists a user's grants to decide whether to skip the prompt. There is no `delete` system-access\n * verb (none exists); owner revoke goes through the `API_CALL` DELETE route, and the USERS\n * `onParentDelete` composition cascade deletes grants directly at the repository layer (variant-agnostic).\n /\n\nimport { OAuthConsentGrantSchema } from './oauth-consent-grants.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\nexport const oauthConsentGrantsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n // UPDATE_MANY is route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n CoreResourceOperation.READ \| CoreResourceOperation.LIST \| CoreResourceOperation.CREATE \| CoreResourceOperation.UPDATE \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.UPDATE_MANY,\n typeof OAuthConsentGrantSchema\n>({\n mainSchema: OAuthConsentGrantSchema,\n resourceIdentifier: CoreResourceType.OAUTH_CONSENT_GRANTS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.OAUTH_CONSENT_GRANTS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n // The OIDC consent-decision endpoint stores/updates grants via createAsSystem/updateAsSystem (the\n // client-shaped CREATE DTO strips the context FK `userId`, re-attached from the schema allowlist on\n // the system path); the authorize endpoint reads/lists a user's grants via readAsSystem/listAsSystem\n // to decide whether to skip the consent prompt. Default is fail-closed FORBIDDEN, so opt each in.\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n },\n portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n /\n Subject erasure RETAINS this row and RESETS the authorized scopes.\n \n The grant is kept deliberately: a consent decision is the evidence that access was authorized, which is\n * exactly what an operator must be able to show afterwards. But `scopes` records WHAT this person let a\n * third party reach, which its USAGE category correctly declares — so `RETAIN_ONLY` would be false. The\n * field is a defaulted array, which only `RedactionType.RESET` can scrub; it returns to the empty default,\n * so the grant remains as evidence and what it granted no longer describes the person.\n /\n retentionPolicy: {\n mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n },\n\n /\n Erasing one of these rows revokes NO session. A grant is a record ABOUT a decision, not the person, and\n * revoking a third-party client's OAuth access is a separate act from ending a login session.\n /\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n CoreResourceOperation.UPDATE_MANY,\n ],\n operationsConfiguration: {\n /\n * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n * verb the impersonalize writer uses to stamp the retention markers.\n */\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n }],\n },\n\n // Owner-facing: the USER_SELF primary-scope filter restricts results to the caller's own grants.\n [CoreResourceOperation.READ]: {\n variants: [\n { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.LOW },\n ],\n },\n [CoreResourceOperation.LIST]: {\n variants: [\n { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.LOW },\n ],\n },\n // System-only: the consent-decision endpoint is the sole writer (createAsSystem / updateAsSystem).\n [CoreResourceOperation.CREATE]: {\n variants: [\n { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n ],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [\n { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n ],\n },\n // Owner-facing revoke (USER_SELF filter → own grant only). The USERS onParentDelete composition\n // cascade also deletes grants, directly at the repository layer (variant-agnostic — it only requires\n // a DELETE op to exist).\n [CoreResourceOperation.DELETE]: {\n variants: [\n { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n ],\n },\n },\n});\n"]}
1	+ {"version":3,"file":"oauth-consent-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAE1H,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAC3E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAK7C;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,kGAAkG;IAClG,oGAAoG;IACpG,qGAAqG;IACrG,kGAAkG;IAClG,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF;;;;;;;;OAQG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,iGAAiG;QACjG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACrJ;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACrJ;SACF;QACD,mGAAmG;QACnG,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aAC1K;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aAC1K;SACF;QACD,gGAAgG;QAChG,qGAAqG;QACrG,yBAAyB;QACzB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aACxJ;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/*\n OIDC Persistent Consent Grants — Resource Configuration\n \n USER_SELF-scoped (the scope is derived from the `USERS → OAUTH_CONSENT_GRANTS` composition\n * relationship). READ / LIST / DELETE are OWNER-facing (`API_CALL` + `APP_USER`): the framework's\n * USER_SELF primary-scope filter restricts every result to the authenticated caller's own grants, so a\n * user can list their \"authorized apps\" and revoke one, and nobody can see or delete another user's\n * grants. CREATE / UPDATE are SYSTEM-only (`INTERNAL_CALL`): the OIDC consent-decision endpoint is the\n * sole writer, via the `createAsSystem` / `updateAsSystem` primitives.\n \n `systemAccessPolicy` opts the write + read verbs into the `AsSystem` door (default is fail-closed\n FORBIDDEN): the decision endpoint create/updates a grant with no request-context FK to attach\n * (`userId` is re-attached from the schema allowlist on the system path), and the authorize endpoint\n * read/lists a user's grants to decide whether to skip the prompt. There is no `delete` system-access\n * verb (none exists); owner revoke goes through the `API_CALL` DELETE route, and the USERS\n * `onParentDelete` composition cascade deletes grants directly at the repository layer (variant-agnostic).\n /\n\nimport { OAuthConsentGrantSchema } from './oauth-consent-grants.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\nexport const oauthConsentGrantsResourceConfiguration_InitializationFactory = (\n resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n // UPDATE_MANY is route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n CoreResourceOperation.READ \| CoreResourceOperation.LIST \| CoreResourceOperation.CREATE \| CoreResourceOperation.UPDATE \| CoreResourceOperation.DELETE\n \| CoreResourceOperation.UPDATE_MANY,\n typeof OAuthConsentGrantSchema\n>({\n mainSchema: OAuthConsentGrantSchema,\n resourceIdentifier: CoreResourceType.OAUTH_CONSENT_GRANTS,\n resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.OAUTH_CONSENT_GRANTS],\n resourceRelationships: resourcesRelationships,\n isSystemResource: true,\n\n // The OIDC consent-decision endpoint stores/updates grants via createAsSystem/updateAsSystem (the\n // client-shaped CREATE DTO strips the context FK `userId`, re-attached from the schema allowlist on\n // the system path); the authorize endpoint reads/lists a user's grants via readAsSystem/listAsSystem\n // to decide whether to skip the consent prompt. Default is fail-closed FORBIDDEN, so opt each in.\n systemAccessPolicy: {\n exportSubject: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n update: ResourceSystemAccessMode.ALLOWED,\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n },\n portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n /\n Subject erasure RETAINS this row and RESETS the authorized scopes.\n \n The grant is kept deliberately: a consent decision is the evidence that access was authorized, which is\n * exactly what an operator must be able to show afterwards. But `scopes` records WHAT this person let a\n * third party reach, which its USAGE category correctly declares — so `RETAIN_ONLY` would be false. The\n * field is a defaulted array, which only `RedactionType.RESET` can scrub; it returns to the empty default,\n * so the grant remains as evidence and what it granted no longer describes the person.\n /\n retentionPolicy: {\n mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n },\n\n /\n Erasing one of these rows revokes NO session. A grant is a record ABOUT a decision, not the person, and\n * revoking a third-party client's OAuth access is a separate act from ending a login session.\n /\n dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n CoreResourceOperation.UPDATE_MANY,\n ],\n operationsConfiguration: {\n /\n * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n * verb the impersonalize writer uses to stamp the retention markers.\n */\n [CoreResourceOperation.UPDATE_MANY]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n riskLevel: ResourceOperationRiskLevel.CRITICAL,\n }],\n },\n\n // Owner-facing: the USER_SELF primary-scope filter restricts results to the caller's own grants.\n [CoreResourceOperation.READ]: {\n variants: [\n { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.LOW },\n ],\n },\n [CoreResourceOperation.LIST]: {\n variants: [\n { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.LOW },\n ],\n },\n // System-only: the consent-decision endpoint is the sole writer (createAsSystem / updateAsSystem).\n [CoreResourceOperation.CREATE]: {\n variants: [\n { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n ],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [\n { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n ],\n },\n // Owner-facing revoke (USER_SELF filter → own grant only). The USERS onParentDelete composition\n // cascade also deletes grants, directly at the repository layer (variant-agnostic — it only requires\n // a DELETE op to exist).\n [CoreResourceOperation.DELETE]: {\n variants: [\n { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n ],\n },\n },\n});\n"]}

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-consent-grants.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,uBAAuB;;;;;;;;;kBAsDlC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC,MAAM,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}
1	+ {"version":3,"file":"oauth-consent-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,uBAAuB;;;;;;;;;kBAsDlC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC,MAAM,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-consent-grants.shared.schemas.js","sourceRoot":"","sources":["~~../../../../../~~src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,6EAA6E;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,iGAAiG;IACjG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE1D;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE9D;;;;;OAKG;IACH,+FAA+F;IAC/F,wFAAwF;IACxF,2IAA2I;IAC3I,iGAAiG;IACjG,iGAAiG;IACjG,wFAAwF;IACxF,MAAM,EAAE,oBAAoB,CAC5B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EACxE,aAAa,CAAC,KAAK,CACpB;IAED;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,GAAG,CAAC","sourcesContent":["/*\n OIDC Persistent Consent Grants (\"remember this app\")\n \n A durable \"user X authorized OAuth client Y for identity scopes Z (at resource R)\" record. It is\n * CREATED (via the system write primitive) when a user APPROVES an interactive-consent request AND\n * opts to remember the app, and READ at `/oauth/authorize` to SKIP re-prompting when an existing grant\n * already covers the requested scopes. The user can list their grants (\"authorized apps\") and revoke\n * one.\n \n USER-scoped: owned by `userId` (USER_SELF primary scope, derived from the `USERS → OAUTH_CONSENT_GRANTS`\n * composition relationship). One grant per `(userId, clientId, resource)` — a re-consent UPDATES the\n * granted scopes rather than creating a duplicate. `resource` participates in the grain because two\n * authorize requests from the same client for different RFC 8707 resources (distinct A2A / MCP agent\n * endpoints) are genuinely distinct delegations; an OIDC-only login carries no `resource` and yields a\n * single resource-less grant.\n /\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\nexport const OAuthConsentGrantSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n /* FK → USERS — the user who granted consent (the USER_SELF scope owner). /\n userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n /* The registered OAuth client (`_id`, `oc_`) the user authorized. Part of the business key. /\n clientId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n /*\n The RFC 8707 `resource` (the target A2A / MCP agent endpoint) this grant covers. Absent for an\n * OIDC-only login with no delegation. Part of the business key — a grant authorizes one client for\n * one resource, so different agent endpoints require separate, explicit consent.\n /\n resource: z.string().optional().isDBIndexed().isSummaryField(),\n\n /\n The IDENTITY scopes the user granted (e.g. `openid`, `profile`, `email`). A later authorize whose\n * requested scopes are a SUBSET of these skips the prompt; a request for a scope NOT in the grant\n * re-prompts (silent scope expansion is forbidden). Identity only — scopes carry no authorization\n * weight (authorization is roles-only).\n /\n // USAGE — what this person authorized a third-party client to reach on their behalf, and when.\n // A consent record is an observation of a decision they made, not an attribute of them.\n // RESET on erasure — returns this field to its schema default. It holds which scopes this person authorized a third-party client to reach,\n // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK\n // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK\n // needs a string. The value comes from the schema, so there is no second copy to drift.\n scopes: addImpersonalizeWith(\n z.array(z.string()).default([]).dataCategories(PersonalDataCategory.USAGE),\n RedactionType.RESET,\n ),\n\n /\n Expiry. The authorize lookup ignores a grant past this instant, fail-closed to a fresh consent\n * prompt.\n \n SET ON EVERY AFFIRMATIVE CONSENT since 2026-09-08 (#465) — on creation and again on every widen,\n * because a widen is the user approving again and a re-affirmation should restart the clock. It\n * was declared here with a reader and NO WRITER before that, so a remembered approval lived until\n * the person revoked it while the field read to an operator as a policy knob that existed.\n \n Still optional on the SCHEMA, for two reasons that are not the same: grants created before that\n * date carry none and must keep working (an absent expiry means \"never\", which is what they were\n * granted under), and a resource may be written by a path that has no operator policy in hand.\n /\n expiresAt: z.date().optional().isDBIndexed(),\n\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n 'userId',\n 'clientId',\n 'resource',\n]);\n\n/\n How long a remembered consent lasts when the application authors no policy of its own.\n \n 180 days, and the reasoning matters more than the number. A remembered consent is a standing\n * delegation of authority to a third party, so it should lapse on its own if nobody re-affirms it —\n * but a prompt the user meets every few weeks trains them to click through, which makes the consent\n * screen worth less rather than more. Half a year is long enough not to nag and short enough that an\n * authorization the user has forgotten about does not outlive their interest in the client by years.\n \n An application overrides it with `auth.consentGrantLifetimeDays`. There is deliberately no way to\n * express \"never expires\": that was the state this default replaced, and it was not chosen.\n */\nexport const OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS = 180;\n\nexport type OAuthConsentGrant = z.infer<typeof OAuthConsentGrantSchema>;\n"]}
1	+ {"version":3,"file":"oauth-consent-grants.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,6EAA6E;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,iGAAiG;IACjG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE1D;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE9D;;;;;OAKG;IACH,+FAA+F;IAC/F,wFAAwF;IACxF,2IAA2I;IAC3I,iGAAiG;IACjG,iGAAiG;IACjG,wFAAwF;IACxF,MAAM,EAAE,oBAAoB,CAC5B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EACxE,aAAa,CAAC,KAAK,CACpB;IAED;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,GAAG,CAAC","sourcesContent":["/*\n OIDC Persistent Consent Grants (\"remember this app\")\n \n A durable \"user X authorized OAuth client Y for identity scopes Z (at resource R)\" record. It is\n * CREATED (via the system write primitive) when a user APPROVES an interactive-consent request AND\n * opts to remember the app, and READ at `/oauth/authorize` to SKIP re-prompting when an existing grant\n * already covers the requested scopes. The user can list their grants (\"authorized apps\") and revoke\n * one.\n \n USER-scoped: owned by `userId` (USER_SELF primary scope, derived from the `USERS → OAUTH_CONSENT_GRANTS`\n * composition relationship). One grant per `(userId, clientId, resource)` — a re-consent UPDATES the\n * granted scopes rather than creating a duplicate. `resource` participates in the grain because two\n * authorize requests from the same client for different RFC 8707 resources (distinct A2A / MCP agent\n * endpoints) are genuinely distinct delegations; an OIDC-only login carries no `resource` and yields a\n * single resource-less grant.\n /\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\nexport const OAuthConsentGrantSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n /* FK → USERS — the user who granted consent (the USER_SELF scope owner). /\n userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n /* The registered OAuth client (`_id`, `oc_`) the user authorized. Part of the business key. /\n clientId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n /*\n The RFC 8707 `resource` (the target A2A / MCP agent endpoint) this grant covers. Absent for an\n * OIDC-only login with no delegation. Part of the business key — a grant authorizes one client for\n * one resource, so different agent endpoints require separate, explicit consent.\n /\n resource: z.string().optional().isDBIndexed().isSummaryField(),\n\n /\n The IDENTITY scopes the user granted (e.g. `openid`, `profile`, `email`). A later authorize whose\n * requested scopes are a SUBSET of these skips the prompt; a request for a scope NOT in the grant\n * re-prompts (silent scope expansion is forbidden). Identity only — scopes carry no authorization\n * weight (authorization is roles-only).\n /\n // USAGE — what this person authorized a third-party client to reach on their behalf, and when.\n // A consent record is an observation of a decision they made, not an attribute of them.\n // RESET on erasure — returns this field to its schema default. It holds which scopes this person authorized a third-party client to reach,\n // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK\n // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK\n // needs a string. The value comes from the schema, so there is no second copy to drift.\n scopes: addImpersonalizeWith(\n z.array(z.string()).default([]).dataCategories(PersonalDataCategory.USAGE),\n RedactionType.RESET,\n ),\n\n /\n Expiry. The authorize lookup ignores a grant past this instant, fail-closed to a fresh consent\n * prompt.\n \n SET ON EVERY AFFIRMATIVE CONSENT since 2026-09-08 (#465) — on creation and again on every widen,\n * because a widen is the user approving again and a re-affirmation should restart the clock. It\n * was declared here with a reader and NO WRITER before that, so a remembered approval lived until\n * the person revoked it while the field read to an operator as a policy knob that existed.\n \n Still optional on the SCHEMA, for two reasons that are not the same: grants created before that\n * date carry none and must keep working (an absent expiry means \"never\", which is what they were\n * granted under), and a resource may be written by a path that has no operator policy in hand.\n /\n expiresAt: z.date().optional().isDBIndexed(),\n\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n 'userId',\n 'clientId',\n 'resource',\n]);\n\n/\n How long a remembered consent lasts when the application authors no policy of its own.\n \n 180 days, and the reasoning matters more than the number. A remembered consent is a standing\n * delegation of authority to a third party, so it should lapse on its own if nobody re-affirms it —\n * but a prompt the user meets every few weeks trains them to click through, which makes the consent\n * screen worth less rather than more. Half a year is long enough not to nag and short enough that an\n * authorization the user has forgotten about does not outlive their interest in the client by years.\n \n An application overrides it with `auth.consentGrantLifetimeDays`. There is deliberately no way to\n * express \"never expires\": that was the state this default replaced, and it was not chosen.\n */\nexport const OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS = 180;\n\nexport type OAuthConsentGrant = z.infer<typeof OAuthConsentGrantSchema>;\n"]}

package/dist/esm/security/oauth-clients/oauth-resource-server.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-resource-server.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,oBAAY,kBAAkB;IAC5B,uFAAuF;IACvF,GAAG,QAAQ;IACX,gGAAgG;IAChG,GAAG,QAAQ;IACX,uGAAuG;IACvG,GAAG,QAAQ;CACZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAC9C,OAAO,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,EACnD,wBAAwB,CAIzB,CAAC;AAEF;yGACyG;AACzG,eAAO,MAAM,gCAAgC,EAAE,SAAS,kBAAkB,EAGzE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,kBAAkB,EAIvE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAGtE,CAAC;AAoEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;iBAGlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBASjC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;2BAAkF,CAAC;AAE5H,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,kEAAkE"}
1	+ {"version":3,"file":"oauth-resource-server.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,oBAAY,kBAAkB;IAC5B,uFAAuF;IACvF,GAAG,QAAQ;IACX,gGAAgG;IAChG,GAAG,QAAQ;IACX,uGAAuG;IACvG,GAAG,QAAQ;CACZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAC9C,OAAO,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,EACnD,wBAAwB,CAIzB,CAAC;AAEF;yGACyG;AACzG,eAAO,MAAM,gCAAgC,EAAE,SAAS,kBAAkB,EAGzE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,kBAAkB,EAIvE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAGtE,CAAC;AAoEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;iBAGlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBASjC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;2BAAkF,CAAC;AAE5H,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,kEAAkE"}

package/dist/esm/security/oauth-clients/oauth-resource-server.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-resource-server.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAN,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,uFAAuF;IACvF,iCAAW,CAAA;IACX,gGAAgG;IAChG,iCAAW,CAAA;IACX,uGAAuG;IACvG,iCAAW,CAAA;AACb,CAAC,EAPW,kBAAkB,KAAlB,kBAAkB,QAO7B;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAGpC;IACF,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,SAAS;IAC5D,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,YAAY;CAChE,CAAC;AAEF;yGACyG;AACzG,MAAM,CAAC,MAAM,gCAAgC,GAAkC;IAC7E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAkC;IAC3E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAkC;IAC1E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,iCAAiC,GAAG;IACxC,oGAAoG;IACpG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,gDAAgD,CAAC;IACtG,kGAAkG;IAClG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,+FAA+F;IAC/F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,iCAAiC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,iCAAiC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;IACvC;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,6GAA6G,CAAC,CAAC,QAAQ,EAAE;CACtK,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAQ5H,kEAAkE","sourcesContent":["import { z } from 'zod';\nimport { ManualControllerRouteKey } from '../../requests/manual-controllers-routes-urls';\n\n/*\n OAuth 2.0 Resource Servers exposed by a Wildo app — the token-CONSUMING surfaces, each\n * with its OWN canonical audience URI (RFC 8707 §2, \"Resource Indicators for OAuth 2.0\").\n \n ## What this is (and is NOT)\n \n A `ResourceServerKind` identifies WHICH endpoint may consume a token — it is an\n * audience / transport concept, a confused-deputy + token-replay defense\n * (RFC 8707: \"an audience-restricted access token … cannot then be taken by that resource\n * and presented elsewhere\"). It is NOT an authorization axis: it never decides WHAT a\n * token may do at a surface. Authorization at every resource server is roles-only — the\n * framework's RBAC (scope-based authorization was removed 2026-07-21). So:\n \n - Audience (this enum) answers \"at which door may this token be presented?\"\n * - Roles answer \"what may it do once through that door?\"\n \n The two compose; they are not competing vocabularies.\n \n ## The three resource servers\n \n \| Kind \| Surface \| Canonical audience (`aud`) \|\n * \|-------\|-------------------------------------------\|-------------------------------------\|\n * \| `API` \| generic HTTP resource API (CRUD) \| `<appPublicBase>/api/v1` \|\n * \| `A2A` \| Agent2Agent endpoint (external agents) \| `<API audience>/a2a` \|\n * \| `MCP` \| Model Context Protocol tool endpoint \| `<API audience>/mcp` \|\n \n ## Standards\n \n - RFC 8707 — a token is minted `aud`-bound to the resource server it targets; the AS is\n * told the target via the `resource` request parameter.\n * - RFC 9728 (Protected Resource Metadata) — each server publishes\n * `/.well-known/oauth-protected-resource` advertising its trusted authorization server.\n * - MCP / A2A authorization specs — the MCP server (and A2A agent) MUST verify a received\n * token is `aud`-restricted to ITSELF and MUST reject tokens not issued for it.\n \n Resolve a kind's canonical audience via\n * `AppConfigurationService.resolveResourceServerAudience(kind)` (backend) — the SINGLE SOURCE\n * OF TRUTH so minting and validation cannot drift.\n /\nexport enum ResourceServerKind {\n /* The generic HTTP resource API (CRUD on resources), mounted at the API base path. /\n API = 'api',\n /* The Agent2Agent (A2A) endpoint — external agents acting on behalf of a user or a machine. /\n A2A = 'a2a',\n /* The Model Context Protocol (MCP) endpoint — a curated subset of operations exposed as MCP tools. /\n MCP = 'mcp',\n}\n\n/\n The mount-path route each NON-`API` resource server appends to the API audience to form its\n * canonical audience URI (see {@link ResourceServerKind}). `API` is the API base itself, so it\n * is intentionally absent here. Keeping the mapping in `_core` next to the enum guarantees the\n * audience derivation is identical everywhere it is computed.\n /\nexport const RESOURCE_SERVER_MOUNT_ROUTE: Record<\n Exclude<ResourceServerKind, ResourceServerKind.API>,\n ManualControllerRouteKey\n> = {\n [ResourceServerKind.A2A]: ManualControllerRouteKey.A2A_TASKS,\n [ResourceServerKind.MCP]: ManualControllerRouteKey.MCP_ENDPOINT,\n};\n\n/* The resource servers that a USER-DELEGATED token may legitimately target (never the main API —\n * a delegated token must be confined to an agent surface, per B-S2 / the audience-confinement rule). /\nexport const DELEGATED_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n ResourceServerKind.A2A,\n ResourceServerKind.MCP,\n];\n\n/\n The resource servers a MACHINE (client-credentials) token may be audience-bound to — ALL of them.\n * Unlike a user-delegated token (confined to agent surfaces), a machine principal legitimately calls\n * the generic API directly AND the A2A / MCP endpoints. The `client_credentials` token endpoint\n * validates the requested RFC 8707 `resource` against this set and mints an `aud`-bound token for the\n * named surface (an absent `resource` deliberately selects the generic API audience). Each resource server then accepts\n * a token bound to its OWN audience (per-endpoint, tight) — the confused-deputy / token-passthrough\n * defense — while the main API accepts only the API audience, so a per-endpoint token cannot be\n * replayed there.\n /\nexport const MACHINE_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n ResourceServerKind.API,\n ResourceServerKind.A2A,\n ResourceServerKind.MCP,\n];\n\n/\n The resource-server kinds that support MULTIPLE NAMED INSTANCES (R-2). `API` is excluded: there is\n * exactly one generic resource API per app, so an instance ref never applies to it.\n /\nexport const INSTANCEABLE_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n ResourceServerKind.A2A,\n ResourceServerKind.MCP,\n];\n\n/\n @wildo_source:part:start saas.models.resource-server-instance facet:layer:shared facet:family:external-access\n \n A NAMED resource-server instance — one addressable external surface of a given\n * {@link ResourceServerKind}, with its OWN URL segment, RFC 8707 audience, discovery document, and\n * curated content. Declare instances on `ApplicationInitializationConfig.resourceServerInstances`\n * (your backend's initialization config). Import path: `@wildo-ai/saas-models`.\n \n This is a DISCRIMINATED UNION on `kind`, so the two surfaces cannot be confused at authoring time:\n * an MCP server has no `actorSystemRefs` (its membership is declared per-operation), and `kind: API`\n * is unrepresentable (there is exactly one generic resource API per app — see\n * {@link INSTANCEABLE_RESOURCE_SERVERS}). Both were previously only caught at startup, if at all.\n \n ## Why instances exist\n \n - MCP has no grouping primitive: a server exposes ONE flat `tools/list` and a client is\n * configured with ONE URL. Multiple named servers are therefore the only way to offer curated tool\n * subsets per consumer (e.g. a read-only `support` server vs a write-capable `ops` server) — which\n * also keeps tool counts small enough for reliable agent tool-choice.\n * - A2A groups SKILLS inside one agent card (a request targets one via `metadata.skillId`).\n * Multiple named agents therefore express distinct agent IDENTITIES (own card, own audience, own\n * skill subset) — skills remain the routing mechanism WITHIN an agent.\n \n ## What a named instance IS, and what it is NOT\n \n Each instance's canonical audience is `resolveResourceServerAudience(kind, ref)` → `…/<mount>/<ref>`.\n * An access token is RFC 8707 bound to exactly ONE instance, so *a token minted for one instance is\n REJECTED at another** (the 2026-07-29 strict-audience flip makes this real, not advisory). That is a\n * TOKEN-REPLAY boundary: a leaked or misdirected token cannot be used on a sibling surface.\n \n It is NOT a per-client capability grant. Any client the app authorizes for a grant may request any\n * audience the app declares, exactly as at the generic API. What a caller may DO once through the door is\n * decided by roles, uniformly:\n \n > MCP/A2A exposure can only ever be a SUBSET of what roles already permit — it never widens.\n * > `mcp.exposed` and `mcp.servers` are CURATION applied BEFORE authorization, never instead of it: they\n * > decide which operations are shaped as agent tools and which surface advertises them. Every\n * > `tools/call` still re-runs the same role authorization the REST API runs, and primary scope resolves\n * > identically (a USER_SELF operation reaches the delegating user's own row; an ORG/APPLICATION-scoped\n * > operation runs in the machine token's or delegating user's scope).\n \n So curate a surface to make an agent's tool-choice reliable and to confine a token — and use ROLES when\n * a caller must be unable to perform an operation at all.\n \n ## Membership (deliberately asymmetric — the units differ)\n \n - MCP: the OPERATION opts in (`operation.mcp.servers`), beside its existing `mcp.exposed`.\n * - A2A: the AGENT lists its skills ({@link A2aAgentInstance.actorSystemRefs}), because the card is\n * itself the grouping primitive and actor systems carry no a2a config.\n \n Both membership lists follow the same rule: OMITTED means \"the default\", PRESENT means \"exactly these,\n * and there must be at least one\". An empty array is rejected rather than silently meaning \"all\" on one\n * side and \"the default\" on the other.\n \n `ref` is the URL/audience segment: keep it short, stable and URL-safe — renaming it changes the\n * instance's audience and invalidates tokens minted for the old name.\n /\nconst resourceServerInstanceCommonShape = {\n /* URL + audience segment (`…/mcp/<ref>`). Short, stable, URL-safe; renaming invalidates tokens. /\n ref: z.string().min(1).regex(/^[a-z0-9][a-z0-9-]$/, 'ref must be lowercase alphanumeric with dashes'),\n /** Human/agent-facing name — surfaced in the instance's discovery document (PRM / agent card). /\n displayName: z.string().min(1),\n /* What this surface is for; surfaced in discovery so a client can pick the right instance. /\n description: z.string(),\n};\n\n/\n A named MCP server: its own `/mcp/<ref>` URL, RFC 8707 audience, protected-resource metadata and\n * curated tool catalog. Membership is declared on the OPERATION (`operation.mcp.servers`), never here —\n * which is why this branch carries no membership list of its own.\n /\nexport const McpServerInstanceSchema = z.object({\n ...resourceServerInstanceCommonShape,\n kind: z.literal(ResourceServerKind.MCP),\n});\n\n/\n A named A2A agent: its own `/a2a/<ref>` URL, RFC 8707 audience, agent card and skill subset. A\n * distinct agent IDENTITY, not a view onto the default card.\n /\nexport const A2aAgentInstanceSchema = z.object({\n ...resourceServerInstanceCommonShape,\n kind: z.literal(ResourceServerKind.A2A),\n /\n The actor systems exposed as THIS agent's skills. OMITTED ⇒ every exposable system (the default\n * single-card behavior). PRESENT ⇒ exactly these, and at least one — an empty list is rejected at\n * startup rather than being read as \"all\", which would turn a typo into a silently WIDER agent.\n /\n actorSystemRefs: z.array(z.string()).min(1, 'actorSystemRefs must name at least one actor system when present — omit it to expose every exposable system').optional(),\n});\n\nexport const ResourceServerInstanceSchema = z.discriminatedUnion('kind', [McpServerInstanceSchema, A2aAgentInstanceSchema]);\n\n/* A named MCP server instance (see {@link McpServerInstanceSchema}). /\nexport type McpServerInstance = z.infer<typeof McpServerInstanceSchema>;\n/* A named A2A agent instance (see {@link A2aAgentInstanceSchema}). /\nexport type A2aAgentInstance = z.infer<typeof A2aAgentInstanceSchema>;\n/* Any named resource-server instance — narrow on `kind` to reach the kind-specific fields. /\nexport type ResourceServerInstance = z.infer<typeof ResourceServerInstanceSchema>;\n/* @wildo_source:part:end saas.models.resource-server-instance */\n"]}
1	+ {"version":3,"file":"oauth-resource-server.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAN,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,uFAAuF;IACvF,iCAAW,CAAA;IACX,gGAAgG;IAChG,iCAAW,CAAA;IACX,uGAAuG;IACvG,iCAAW,CAAA;AACb,CAAC,EAPW,kBAAkB,KAAlB,kBAAkB,QAO7B;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAGpC;IACF,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,SAAS;IAC5D,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,YAAY;CAChE,CAAC;AAEF;yGACyG;AACzG,MAAM,CAAC,MAAM,gCAAgC,GAAkC;IAC7E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAkC;IAC3E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAkC;IAC1E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,iCAAiC,GAAG;IACxC,oGAAoG;IACpG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,gDAAgD,CAAC;IACtG,kGAAkG;IAClG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,+FAA+F;IAC/F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,iCAAiC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,iCAAiC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;IACvC;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,6GAA6G,CAAC,CAAC,QAAQ,EAAE;CACtK,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAQ5H,kEAAkE","sourcesContent":["import { z } from 'zod';\nimport { ManualControllerRouteKey } from '../../requests/manual-controllers-routes-urls';\n\n/*\n OAuth 2.0 Resource Servers exposed by a Wildo app — the token-CONSUMING surfaces, each\n * with its OWN canonical audience URI (RFC 8707 §2, \"Resource Indicators for OAuth 2.0\").\n \n ## What this is (and is NOT)\n \n A `ResourceServerKind` identifies WHICH endpoint may consume a token — it is an\n * audience / transport concept, a confused-deputy + token-replay defense\n * (RFC 8707: \"an audience-restricted access token … cannot then be taken by that resource\n * and presented elsewhere\"). It is NOT an authorization axis: it never decides WHAT a\n * token may do at a surface. Authorization at every resource server is roles-only — the\n * framework's RBAC (scope-based authorization was removed 2026-07-21). So:\n \n - Audience (this enum) answers \"at which door may this token be presented?\"\n * - Roles answer \"what may it do once through that door?\"\n \n The two compose; they are not competing vocabularies.\n \n ## The three resource servers\n \n \| Kind \| Surface \| Canonical audience (`aud`) \|\n * \|-------\|-------------------------------------------\|-------------------------------------\|\n * \| `API` \| generic HTTP resource API (CRUD) \| `<appPublicBase>/api/v1` \|\n * \| `A2A` \| Agent2Agent endpoint (external agents) \| `<API audience>/a2a` \|\n * \| `MCP` \| Model Context Protocol tool endpoint \| `<API audience>/mcp` \|\n \n ## Standards\n \n - RFC 8707 — a token is minted `aud`-bound to the resource server it targets; the AS is\n * told the target via the `resource` request parameter.\n * - RFC 9728 (Protected Resource Metadata) — each server publishes\n * `/.well-known/oauth-protected-resource` advertising its trusted authorization server.\n * - MCP / A2A authorization specs — the MCP server (and A2A agent) MUST verify a received\n * token is `aud`-restricted to ITSELF and MUST reject tokens not issued for it.\n \n Resolve a kind's canonical audience via\n * `AppConfigurationService.resolveResourceServerAudience(kind)` (backend) — the SINGLE SOURCE\n * OF TRUTH so minting and validation cannot drift.\n /\nexport enum ResourceServerKind {\n /* The generic HTTP resource API (CRUD on resources), mounted at the API base path. /\n API = 'api',\n /* The Agent2Agent (A2A) endpoint — external agents acting on behalf of a user or a machine. /\n A2A = 'a2a',\n /* The Model Context Protocol (MCP) endpoint — a curated subset of operations exposed as MCP tools. /\n MCP = 'mcp',\n}\n\n/\n The mount-path route each NON-`API` resource server appends to the API audience to form its\n * canonical audience URI (see {@link ResourceServerKind}). `API` is the API base itself, so it\n * is intentionally absent here. Keeping the mapping in `_core` next to the enum guarantees the\n * audience derivation is identical everywhere it is computed.\n /\nexport const RESOURCE_SERVER_MOUNT_ROUTE: Record<\n Exclude<ResourceServerKind, ResourceServerKind.API>,\n ManualControllerRouteKey\n> = {\n [ResourceServerKind.A2A]: ManualControllerRouteKey.A2A_TASKS,\n [ResourceServerKind.MCP]: ManualControllerRouteKey.MCP_ENDPOINT,\n};\n\n/* The resource servers that a USER-DELEGATED token may legitimately target (never the main API —\n * a delegated token must be confined to an agent surface, per B-S2 / the audience-confinement rule). /\nexport const DELEGATED_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n ResourceServerKind.A2A,\n ResourceServerKind.MCP,\n];\n\n/\n The resource servers a MACHINE (client-credentials) token may be audience-bound to — ALL of them.\n * Unlike a user-delegated token (confined to agent surfaces), a machine principal legitimately calls\n * the generic API directly AND the A2A / MCP endpoints. The `client_credentials` token endpoint\n * validates the requested RFC 8707 `resource` against this set and mints an `aud`-bound token for the\n * named surface (an absent `resource` deliberately selects the generic API audience). Each resource server then accepts\n * a token bound to its OWN audience (per-endpoint, tight) — the confused-deputy / token-passthrough\n * defense — while the main API accepts only the API audience, so a per-endpoint token cannot be\n * replayed there.\n /\nexport const MACHINE_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n ResourceServerKind.API,\n ResourceServerKind.A2A,\n ResourceServerKind.MCP,\n];\n\n/\n The resource-server kinds that support MULTIPLE NAMED INSTANCES (R-2). `API` is excluded: there is\n * exactly one generic resource API per app, so an instance ref never applies to it.\n /\nexport const INSTANCEABLE_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n ResourceServerKind.A2A,\n ResourceServerKind.MCP,\n];\n\n/\n @wildo_source:part:start saas.models.resource-server-instance facet:layer:shared facet:family:external-access\n \n A NAMED resource-server instance — one addressable external surface of a given\n * {@link ResourceServerKind}, with its OWN URL segment, RFC 8707 audience, discovery document, and\n * curated content. Declare instances on `ApplicationInitializationConfig.resourceServerInstances`\n * (your backend's initialization config). Import path: `@wildo-ai/saas-models`.\n \n This is a DISCRIMINATED UNION on `kind`, so the two surfaces cannot be confused at authoring time:\n * an MCP server has no `actorSystemRefs` (its membership is declared per-operation), and `kind: API`\n * is unrepresentable (there is exactly one generic resource API per app — see\n * {@link INSTANCEABLE_RESOURCE_SERVERS}). Both were previously only caught at startup, if at all.\n \n ## Why instances exist\n \n - MCP has no grouping primitive: a server exposes ONE flat `tools/list` and a client is\n * configured with ONE URL. Multiple named servers are therefore the only way to offer curated tool\n * subsets per consumer (e.g. a read-only `support` server vs a write-capable `ops` server) — which\n * also keeps tool counts small enough for reliable agent tool-choice.\n * - A2A groups SKILLS inside one agent card (a request targets one via `metadata.skillId`).\n * Multiple named agents therefore express distinct agent IDENTITIES (own card, own audience, own\n * skill subset) — skills remain the routing mechanism WITHIN an agent.\n \n ## What a named instance IS, and what it is NOT\n \n Each instance's canonical audience is `resolveResourceServerAudience(kind, ref)` → `…/<mount>/<ref>`.\n * An access token is RFC 8707 bound to exactly ONE instance, so *a token minted for one instance is\n REJECTED at another** (the 2026-07-29 strict-audience flip makes this real, not advisory). That is a\n * TOKEN-REPLAY boundary: a leaked or misdirected token cannot be used on a sibling surface.\n \n It is NOT a per-client capability grant. Any client the app authorizes for a grant may request any\n * audience the app declares, exactly as at the generic API. What a caller may DO once through the door is\n * decided by roles, uniformly:\n \n > MCP/A2A exposure can only ever be a SUBSET of what roles already permit — it never widens.\n * > `mcp.exposed` and `mcp.servers` are CURATION applied BEFORE authorization, never instead of it: they\n * > decide which operations are shaped as agent tools and which surface advertises them. Every\n * > `tools/call` still re-runs the same role authorization the REST API runs, and primary scope resolves\n * > identically (a USER_SELF operation reaches the delegating user's own row; an ORG/APPLICATION-scoped\n * > operation runs in the machine token's or delegating user's scope).\n \n So curate a surface to make an agent's tool-choice reliable and to confine a token — and use ROLES when\n * a caller must be unable to perform an operation at all.\n \n ## Membership (deliberately asymmetric — the units differ)\n \n - MCP: the OPERATION opts in (`operation.mcp.servers`), beside its existing `mcp.exposed`.\n * - A2A: the AGENT lists its skills ({@link A2aAgentInstance.actorSystemRefs}), because the card is\n * itself the grouping primitive and actor systems carry no a2a config.\n \n Both membership lists follow the same rule: OMITTED means \"the default\", PRESENT means \"exactly these,\n * and there must be at least one\". An empty array is rejected rather than silently meaning \"all\" on one\n * side and \"the default\" on the other.\n \n `ref` is the URL/audience segment: keep it short, stable and URL-safe — renaming it changes the\n * instance's audience and invalidates tokens minted for the old name.\n /\nconst resourceServerInstanceCommonShape = {\n /* URL + audience segment (`…/mcp/<ref>`). Short, stable, URL-safe; renaming invalidates tokens. /\n ref: z.string().min(1).regex(/^[a-z0-9][a-z0-9-]$/, 'ref must be lowercase alphanumeric with dashes'),\n /** Human/agent-facing name — surfaced in the instance's discovery document (PRM / agent card). /\n displayName: z.string().min(1),\n /* What this surface is for; surfaced in discovery so a client can pick the right instance. /\n description: z.string(),\n};\n\n/\n A named MCP server: its own `/mcp/<ref>` URL, RFC 8707 audience, protected-resource metadata and\n * curated tool catalog. Membership is declared on the OPERATION (`operation.mcp.servers`), never here —\n * which is why this branch carries no membership list of its own.\n /\nexport const McpServerInstanceSchema = z.object({\n ...resourceServerInstanceCommonShape,\n kind: z.literal(ResourceServerKind.MCP),\n});\n\n/\n A named A2A agent: its own `/a2a/<ref>` URL, RFC 8707 audience, agent card and skill subset. A\n * distinct agent IDENTITY, not a view onto the default card.\n /\nexport const A2aAgentInstanceSchema = z.object({\n ...resourceServerInstanceCommonShape,\n kind: z.literal(ResourceServerKind.A2A),\n /\n The actor systems exposed as THIS agent's skills. OMITTED ⇒ every exposable system (the default\n * single-card behavior). PRESENT ⇒ exactly these, and at least one — an empty list is rejected at\n * startup rather than being read as \"all\", which would turn a typo into a silently WIDER agent.\n /\n actorSystemRefs: z.array(z.string()).min(1, 'actorSystemRefs must name at least one actor system when present — omit it to expose every exposable system').optional(),\n});\n\nexport const ResourceServerInstanceSchema = z.discriminatedUnion('kind', [McpServerInstanceSchema, A2aAgentInstanceSchema]);\n\n/* A named MCP server instance (see {@link McpServerInstanceSchema}). /\nexport type McpServerInstance = z.infer<typeof McpServerInstanceSchema>;\n/* A named A2A agent instance (see {@link A2aAgentInstanceSchema}). /\nexport type A2aAgentInstance = z.infer<typeof A2aAgentInstanceSchema>;\n/* Any named resource-server instance — narrow on `kind` to reach the kind-specific fields. /\nexport type ResourceServerInstance = z.infer<typeof ResourceServerInstanceSchema>;\n/* @wildo_source:part:end saas.models.resource-server-instance */\n"]}

package/dist/esm/security/outbound-target-control.shared.schemas.d.ts CHANGED Viewed

@@ -46,7 +46,13 @@ export declare enum OutboundTargetClass {
      * A remote MCP server an agent calls. Declared by the application, but it is a THIRD PARTY's
      * service, reached with the agent's delegated credentials, and its answers can re-point a request.
      */
-    MCP_SERVER = "mcp_server"
+    MCP_SERVER = "mcp_server",
+    /**
+     * A download link an EMAIL provider hands back at runtime — the original bytes of a received message, an
+     * attachment (#1600). The application declared the provider, but the VENDOR chose this URL, so it is admitted
+     * only against the hosts the provider's contract declares, and never re-pointed by a redirect.
+     */
+    EMAIL_PROVIDER_CONTENT_URL = "email_provider_content_url"
 }
 /**
  * How much of the network an outbound request may reach beyond the public internet.

package/dist/esm/security/outbound-target-control.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"outbound-target-control.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oBAAoB,yBAAyB;IAC7C,+FAA+F;IAC/F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,cAAc,mBAAmB;IACjC,8FAA8F;IAC9F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,UAAU,eAAe;~~CAC1B~~;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,0GAA0G;IAC1G,IAAI,SAAS;IACb,4GAA4G;IAC5G,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,eAAe,oBAAoB;CACpC"}
1	+ {"version":3,"file":"outbound-target-control.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oBAAoB,yBAAyB;IAC7C,+FAA+F;IAC/F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,cAAc,mBAAmB;IACjC,8FAA8F;IAC9F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,UAAU,eAAe;IACzB;;;;OAIG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,0GAA0G;IAC1G,IAAI,SAAS;IACb,4GAA4G;IAC5G,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,eAAe,oBAAoB;CACpC"}

package/dist/esm/security/outbound-target-control.shared.schemas.js CHANGED Viewed

@@ -48,6 +48,12 @@ export var OutboundTargetClass;
      * service, reached with the agent's delegated credentials, and its answers can re-point a request.
      */
     OutboundTargetClass["MCP_SERVER"] = "mcp_server";
+    /**
+     * A download link an EMAIL provider hands back at runtime — the original bytes of a received message, an
+     * attachment (#1600). The application declared the provider, but the VENDOR chose this URL, so it is admitted
+     * only against the hosts the provider's contract declares, and never re-pointed by a redirect.
+     */
+    OutboundTargetClass["EMAIL_PROVIDER_CONTENT_URL"] = "email_provider_content_url";
 })(OutboundTargetClass || (OutboundTargetClass = {}));
 /**
  * How much of the network an outbound request may reach beyond the public internet.

package/dist/esm/security/outbound-target-control.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"outbound-target-control.shared.schemas.js","sourceRoot":"","sources":["~~../../../../~~src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,~~mBAwBX~~;~~AAxBD~~,WAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oEAA6C,CAAA;IAC7C,+FAA+F;IAC/F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,wDAAiC,CAAA;IACjC,8FAA8F;IAC9F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,kFAA2D,CAAA;IAC3D;;;OAGG;IACH,gDAAyB,CAAA;~~AAC3B~~,CAAC,~~EAxBW~~,mBAAmB,KAAnB,mBAAmB,~~QAwB9B~~;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,0GAA0G;IAC1G,gDAAa,CAAA;IACb,4GAA4G;IAC5G,kEAA+B,CAAA;IAC/B,0GAA0G;IAC1G,sEAAmC,CAAA;AACrC,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C","sourcesContent":["/*\n The classes of server-side request whose DESTINATION is chosen by somebody other than the\n * deployment that makes the request — and how much of the private network each may reach.\n \n ## Why the class, and not the call site, is the unit\n \n The request-forgery question is never \"is this URL safe?\" in the abstract. It is \"who picked this\n * destination, and are they allowed to point this server at its own network?\". An organization\n * administrator who authors a webhook endpoint, an A2A client registering a push target, and an\n * unauthenticated stranger presenting an OAuth `client_id` URL all answer it differently — and the\n * application developer who writes a provider endpoint into the backend's own configuration is not a\n * request-forgery threat at all, because they already own the server.\n \n So the vocabulary names the CLASS of destination, by who authors it. Every engine site that issues\n * such a request declares which class it is serving, and the admission follows from the class plus\n * the operator-declared runtime environment — never from anything the destination's author can set.\n \n ## What is deliberately NOT a class\n \n Destinations the application's own code declares — a provider API endpoint, an `httpApiBinding`\n * base URL — are trusted as authored. What those sites must still refuse is a REMOTE server\n * re-pointing the request (a redirect), which is a property of the transport, not an admission.\n * Platform topology (the apps-manager, the module registry, infrastructure sidecars) is operator\n * configuration and private by design.\n /\nexport enum OutboundTargetClass {\n /* An M2M webhook endpoint. Authored by an organization administrator. /\n M2M_WEBHOOK_ENDPOINT = 'm2m_webhook_endpoint',\n /* An A2A push-notification target. Supplied by the external A2A client that registered it. /\n A2A_PUSH_NOTIFICATION_ENDPOINT = 'a2a_push_notification_endpoint',\n /\n A SIEM collector. Authored by an organization administrator; the one class the operator may\n * admit onto a private network, because a self-hosted collector on the same network is a supported\n * deployment shape.\n /\n SIEM_COLLECTOR = 'siem_collector',\n /* An OAuth client metadata document. Its URL is presented by an UNAUTHENTICATED stranger. /\n OAUTH_CLIENT_METADATA_DOCUMENT = 'oauth_client_metadata_document',\n /\n A federated identity provider's endpoints — OIDC discovery, token, userinfo, profile extension,\n * JWKS, SAML metadata and the SAML SSO/SLO reachability checks. Authored by an organization\n * administrator on an SSO connection, or discovered from a document that administrator's IdP serves.\n /\n FEDERATED_IDENTITY_PROVIDER = 'federated_identity_provider',\n /\n A remote MCP server an agent calls. Declared by the application, but it is a THIRD PARTY's\n * service, reached with the agent's delegated credentials, and its answers can re-point a request.\n /\n MCP_SERVER = 'mcp_server',\n}\n\n/\n How much of the network an outbound request may reach beyond the public internet.\n \n Three members rather than a boolean, because the useful middle is not \"private\" and not \"public\":\n * local development and automated test runs legitimately reach doubles on LOOPBACK, and nothing about\n * that justifies reaching the cloud instance-metadata address (link-local) or a cluster-internal\n * service (RFC 1918), which are the addresses a request-forgery attack actually wants.\n /\nexport enum OutboundPrivateAddressAdmission {\n /* Public addresses only. The default, and the only posture a stranger-supplied destination ever gets. /\n NONE = 'none',\n /* Public addresses plus loopback (`127.0.0.0/8`, `::1`, `localhost`). Never link-local, never RFC 1918. /\n LOOPBACK_ONLY = 'loopback_only',\n /* Any address. Only by an explicit operator declaration, and only for a class the operator may admit. */\n PRIVATE_NETWORK = 'private_network',\n}\n"]}
1	+ {"version":3,"file":"outbound-target-control.shared.schemas.js","sourceRoot":"","sources":["../../../src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,mBA8BX;AA9BD,WAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oEAA6C,CAAA;IAC7C,+FAA+F;IAC/F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,wDAAiC,CAAA;IACjC,8FAA8F;IAC9F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,kFAA2D,CAAA;IAC3D;;;OAGG;IACH,gDAAyB,CAAA;IACzB;;;;OAIG;IACH,gFAAyD,CAAA;AAC3D,CAAC,EA9BW,mBAAmB,KAAnB,mBAAmB,QA8B9B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,0GAA0G;IAC1G,gDAAa,CAAA;IACb,4GAA4G;IAC5G,kEAA+B,CAAA;IAC/B,0GAA0G;IAC1G,sEAAmC,CAAA;AACrC,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C","sourcesContent":["/*\n The classes of server-side request whose DESTINATION is chosen by somebody other than the\n * deployment that makes the request — and how much of the private network each may reach.\n \n ## Why the class, and not the call site, is the unit\n \n The request-forgery question is never \"is this URL safe?\" in the abstract. It is \"who picked this\n * destination, and are they allowed to point this server at its own network?\". An organization\n * administrator who authors a webhook endpoint, an A2A client registering a push target, and an\n * unauthenticated stranger presenting an OAuth `client_id` URL all answer it differently — and the\n * application developer who writes a provider endpoint into the backend's own configuration is not a\n * request-forgery threat at all, because they already own the server.\n \n So the vocabulary names the CLASS of destination, by who authors it. Every engine site that issues\n * such a request declares which class it is serving, and the admission follows from the class plus\n * the operator-declared runtime environment — never from anything the destination's author can set.\n \n ## What is deliberately NOT a class\n \n Destinations the application's own code declares — a provider API endpoint, an `httpApiBinding`\n * base URL — are trusted as authored. What those sites must still refuse is a REMOTE server\n * re-pointing the request (a redirect), which is a property of the transport, not an admission.\n * Platform topology (the apps-manager, the module registry, infrastructure sidecars) is operator\n * configuration and private by design.\n /\nexport enum OutboundTargetClass {\n /* An M2M webhook endpoint. Authored by an organization administrator. /\n M2M_WEBHOOK_ENDPOINT = 'm2m_webhook_endpoint',\n /* An A2A push-notification target. Supplied by the external A2A client that registered it. /\n A2A_PUSH_NOTIFICATION_ENDPOINT = 'a2a_push_notification_endpoint',\n /\n A SIEM collector. Authored by an organization administrator; the one class the operator may\n * admit onto a private network, because a self-hosted collector on the same network is a supported\n * deployment shape.\n /\n SIEM_COLLECTOR = 'siem_collector',\n /* An OAuth client metadata document. Its URL is presented by an UNAUTHENTICATED stranger. /\n OAUTH_CLIENT_METADATA_DOCUMENT = 'oauth_client_metadata_document',\n /\n A federated identity provider's endpoints — OIDC discovery, token, userinfo, profile extension,\n * JWKS, SAML metadata and the SAML SSO/SLO reachability checks. Authored by an organization\n * administrator on an SSO connection, or discovered from a document that administrator's IdP serves.\n /\n FEDERATED_IDENTITY_PROVIDER = 'federated_identity_provider',\n /\n A remote MCP server an agent calls. Declared by the application, but it is a THIRD PARTY's\n * service, reached with the agent's delegated credentials, and its answers can re-point a request.\n /\n MCP_SERVER = 'mcp_server',\n /\n A download link an EMAIL provider hands back at runtime — the original bytes of a received message, an\n * attachment (#1600). The application declared the provider, but the VENDOR chose this URL, so it is admitted\n * only against the hosts the provider's contract declares, and never re-pointed by a redirect.\n /\n EMAIL_PROVIDER_CONTENT_URL = 'email_provider_content_url',\n}\n\n/\n How much of the network an outbound request may reach beyond the public internet.\n \n Three members rather than a boolean, because the useful middle is not \"private\" and not \"public\":\n * local development and automated test runs legitimately reach doubles on LOOPBACK, and nothing about\n * that justifies reaching the cloud instance-metadata address (link-local) or a cluster-internal\n * service (RFC 1918), which are the addresses a request-forgery attack actually wants.\n /\nexport enum OutboundPrivateAddressAdmission {\n /* Public addresses only. The default, and the only posture a stranger-supplied destination ever gets. /\n NONE = 'none',\n /* Public addresses plus loopback (`127.0.0.0/8`, `::1`, `localhost`). Never link-local, never RFC 1918. /\n LOOPBACK_ONLY = 'loopback_only',\n /* Any address. Only by an explicit operator declaration, and only for a class the operator may admit. */\n PRIVATE_NETWORK = 'private_network',\n}\n"]}