@wildo-ai/saas-models 1.1.7 → 1.1.8

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,2EAA2E;AAC3E,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,4BAAa,CAAA;AACf,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,gGAAgG;IAChG,0FAA0F;IAC1F,8FAA8F;IAC9F,qEAAqE;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACrE,sGAAsG;IACtG,oGAAoG;IACpG,kEAAkE;IAClE,SAAS,EAAE,CAAC;SACT,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,eAAe,EAAE;SACjB,QAAQ,CAAC,kSAAkS,CAAC;IAE/S,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,qGAAqG;IACrG,gGAAgG;IAChG,qGAAqG;IACrG,+BAA+B;IAC/B,+FAA+F;IAC/F,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8IAA8I,CAAC;QACtM,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;QAC7I,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;QAC9I,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8MAA8M,CAAC;QACzQ,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,QAAQ,CAAC,mEAAmE,CAAC;YAC7K,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,QAAQ,CAAC,gEAAgE,CAAC;YAC3K,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,QAAQ,CAAC,+DAA+D,CAAC;YACvK,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kHAAkH,CAAC;YACzJ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;YAC5G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;YAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uEAAuE,CAAC;SAChH,CAAC,CAAC,QAAQ,CAAC,8FAA8F,CAAC;QAC3G,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;QAC3J,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;QACjI,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iKAAiK,CAAC;QACvP,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,sIAAsI,CAAC;QACzM,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,0JAA0J,CAAC;QAC/N;;;;;;;;;;;;;;;WAeG;QACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,sMAAsM,CAAC;QACtR,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,kGAAkG,CAAC;QAC7M,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8JAA8J,CAAC;QACxO;;;;;;;;WAQG;KACJ,CAAC,CAAC,QAAQ,EAAE;IAEb,sGAAsG;IACtG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,0FAA0F;IAC1F,qFAAqF;IACrF,gGAAgG;IAChG,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uNAAuN,CAAC;QACzT,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2GAA2G,CAAC;QACtM,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;QACpH,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8HAA8H,CAAC;QAC3L,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;QACxJ,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8EAA8E,CAAC;QACpJ,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,mGAAmG,CAAC;QACjK,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,wFAAwF,CAAC;QACzJ,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QACnI,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QAC9I;;;;;;;;;;;;;WAaG;QACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uHAAuH,CAAC;QACtM,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;QACjH;;;;;;;;;;;;;;;;;;WAkBG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,4GAA4G,CAAC;QAC1K,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QAClI,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QACtJ,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;QAC9K,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;YACvG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,uDAAuD,CAAC;YAC7G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;YAC5G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yGAAyG,CAAC;YAChJ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;YACnG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YACpG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;SACvG,CAAC,CAAC,QAAQ,CAAC,sGAAsG,CAAC;QACnH;;;;;;;;;;WAUG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,mHAAmH,CAAC;QACzL,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QAC5I,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;QAC1H;;;;;;;;;;;;;;;;;;;WAmBG;QACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,gOAAgO,CAAC;QAChT,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,+EAA+E,CAAC;QAClJ,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;QAC3H,mFAAmF;KACpF,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gGAAgG;IAChG,8FAA8F;IAC9F,4FAA4F;IAC5F,4EAA4E;IAC5E,4EAA4E;IAC5E,sFAAsF;IACtF,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC/E;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAEpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SSO Connection Schema (Shared) — Polymorphic\n *\n * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).\n * Unified resource — `protocol` field determines which sub-object is populated.\n * Both OIDC and SAML protocol engines consume this shared discriminator.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2B\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\n/** Interactive single-sign-on protocols supported by an SSO connection. */\nexport enum SsoProtocol {\n  OIDC = 'oidc',\n  SAML = 'saml',\n}\n\nexport const SSOTemplateMode = {\n  TEMPLATE: 'template',\n  DISCOVERY: 'discovery',\n  MANUAL: 'manual',\n} as const;\n\nexport const SSOResponseType = {\n  CODE: 'code',\n  ID_TOKEN: 'id_token',\n  TOKEN: 'token',\n} as const;\n\nexport const SSOResponseMode = {\n  QUERY: 'query',\n  FRAGMENT: 'fragment',\n  FORM_POST: 'form_post',\n} as const;\n\nexport const SSOPrompt = {\n  NONE: 'none',\n  LOGIN: 'login',\n  CONSENT: 'consent',\n  SELECT_ACCOUNT: 'select_account',\n} as const;\n\nexport const SSOPKCEMethod = {\n  S256: 'S256',\n  PLAIN: 'plain',\n} as const;\n\nexport const SamlNameIdFormat = {\n  UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',\n  EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',\n  PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n  TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',\n} as const;\n\nexport const SsoConnectionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  protocol: z.enum(SsoProtocol).isSummaryField(),\n  externalProviderId: z.string().min(1).optional(),\n  displayName: z.string().min(1).isSummaryField(),\n  // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides\n  // which IdP silently receives logins. Marked individually rather than on any parent: this\n  // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records\n  // the WHOLE object into rows that replicate to an unerasable ledger.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP\n  // decide which identity provider is trusted to authenticate this tenant.\n  enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  // Read by `selectSsoConnectionForRouting` (#1800): among the eligible connections equally specific to\n  // the signing-in user's domain, the default receives the sign-in. A write that makes one connection\n  // the default demotes the scope's others in the same transaction.\n  isDefault: z\n    .boolean()\n    .default(false)\n    .isAuditEvidence()\n    .describe(\"Whether sign-ins go to this connection when several of this organization's connections could take them. A connection that names the user's email domain in `allowedDomains` still wins over a default that accepts any domain. Making a connection the default removes the flag from the others.\"),\n\n  // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates\n  // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,\n  // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,\n  // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed\n  // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a\n  // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the\n  // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the\n  // container would copy key material into an unerasable ledger. The two-level `attributeMapping`\n  // leaves are deliberately NOT marked — the evidence resolver reaches one level of nesting only, so a\n  // marker there would be inert.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay\n  // validation posture decide which provider is trusted to authenticate this tenant and whether its\n  // assertions are actually verified.\n  saml: z.object({\n    entityId: z.string().min(1).isAuditEvidence().describe(\"The identity provider's SAML entity ID: the issuer its assertions name, and how a sign-in the provider starts is matched to this connection.\"),\n    ssoUrl: z.url().isAuditEvidence().describe(\"The identity provider's single sign-on endpoint, where the application sends a sign-in request.\"),\n    sloUrl: z.url().optional().isAuditEvidence().describe(\"The identity provider's single logout endpoint. Absent when the provider offers none.\"),\n    /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */\n    x509CertificatePem: z.string().min(1).optional().describe(\"The identity provider's signing certificate or certificates, PEM-encoded, used to verify its signatures. Accepted on create and update, and stored parsed as `x509Certificates`, which no response includes.\"),\n    x509Certificates: z.array(z.string()).min(1).isBackendOnly(),\n    attributeMapping: z.object({\n      email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress').describe(\"The name of the SAML attribute carrying the user's email address.\"),\n      firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname').describe(\"The name of the SAML attribute carrying the user's first name.\"),\n      lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname').describe(\"The name of the SAML attribute carrying the user's last name.\"),\n      roles: z.string().optional().describe(\"The name of the SAML attribute carrying the user's roles, which `roleMapping` translates into application roles.\"),\n      department: z.string().optional().describe(\"The name of the SAML attribute carrying the user's department.\"),\n      employeeId: z.string().optional().describe(\"The name of the SAML attribute carrying the user's employee ID.\"),\n      groups: z.string().optional().describe(\"The name of the SAML attribute carrying the user's group memberships.\"),\n    }).describe('Which SAML attribute carries each user detail. A detail with no attribute named is not read.'),\n    signRequests: z.boolean().default(true).isAuditEvidence().describe('Whether the application signs the sign-in requests it sends to the identity provider.'),\n    wantAssertionsSigned: z.boolean().default(true).isAuditEvidence().describe('Whether an assertion must be signed to be accepted.'),\n    allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence().describe(\"How far, in seconds, the identity provider's clock may differ from the application's when an assertion's validity times and authentication instant are checked.\"),\n    forceAuthn: z.boolean().default(false).isAuditEvidence().describe('Whether every sign-in asks the identity provider to authenticate the person afresh rather than reuse its own session (`ForceAuthn`).'),\n    maxAuthAge: z.number().min(0).optional().isAuditEvidence().describe(\"The oldest, in seconds, the identity provider's own authentication may be: an assertion whose `AuthnInstant` is older is refused. Absent means no limit.\"),\n    /**\n     * Whether a person linked through this connection may confirm it is them by signing in again here\n     * (#1441), when adding or removing a way to sign in. Off by default, like the OIDC flag.\n     *\n     * The request is sent with `ForceAuthn=\"true\"` whatever `forceAuthn` says, and the assertion's\n     * `AuthnStatement/@AuthnInstant` must be no older than the request: SAML 2.0 Core §3.4.1 says an IdP\n     * receiving `ForceAuthn=\"true\"` MUST authenticate the presenter directly rather than rely on a previous\n     * security context, and the schema makes `AuthnInstant` required on every authentication statement.\n     * Turn it on only for an IdP that honours `ForceAuthn`: one that silently reuses its session answers\n     * with an old `AuthnInstant` and every re-authentication through it is refused.\n     *\n     * spec-cite: OASIS SAML 2.0 Core (saml-core-2.0-os) §3.4.1 `ForceAuthn` (\"the identity provider MUST\n     * authenticate the presenter directly rather than rely on a previous security context\") and §2.7.2\n     * `AuthnInstant [Required]`, fetched 2026-09-21 from\n     * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\n     */\n    reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence().describe('Whether a person linked through this connection may confirm it is them by signing in here again, when adding or removing a way to sign in. Turn it on only for a provider that honours `ForceAuthn`.'),\n    nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence().describe(\"The NameID format the application asks the identity provider to use for the person's identifier.\"),\n    allowIdpInitiated: z.boolean().default(false).isAuditEvidence().describe('Whether a sign-in the identity provider starts, with no request from the application, is accepted. Single logout the provider starts is accepted either way.'),\n    /*\n     * NO `auditSettings` (`logAuthAttempts` / `logAttributeMapping` / `retentionDays`), here or on the\n     * OIDC block. They were stored, shown on the settings screen, and read by nothing, so an\n     * administrator could switch authentication logging off or shorten its retention and nothing\n     * happened (#1768). Removed rather than wired, like #419 and #1236: every sign-in is recorded on the\n     * application's audit trail whatever a connection says, which is intended — a tenant switch that\n     * turns off its own authentication logging would weaken the evidence the audit trail exists for —\n     * and how long rows are kept is the application's retention schedule, not a per-connection number.\n     */\n  }).optional(),\n\n  // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection\n  // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /\n  // `clientId`) and HOW strictly it validates tokens (`pkceEnabled`, `pkceMethod`), plus what it\n  // requests (`scopes` / `customScopes` / `responseType` / `responseMode` / template + auth-request\n  // shaping, including the `acrValues` step-up demand). Turning `pkceEnabled` off, or repointing\n  // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the\n  // before/after — and so does a change to `acrValues`, which is an authentication-strength\n  // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is\n  // a write-only secret); `claimsMapping` is two-level and out of the resolver's one-level reach.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-\n  // validation posture decide which provider is trusted and whether its tokens are actually verified.\n  oidc: z.object({\n    templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence().describe(\"How the provider's endpoints are found: `template` reads them from a known provider's definition, `discovery` reads them from the provider's OpenID discovery document, and `manual` uses the endpoints entered here.\"),\n    templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence().describe(\"In `template` mode, values substituted into the provider definition's endpoint URLs, such as a tenant id.\"),\n    customScopes: z.array(z.string()).optional().isAuditEvidence().describe('Scopes requested in addition to `scopes`.'),\n    discoveryUrl: z.url().optional().isAuditEvidence().describe(\"The provider's OpenID discovery document URL. In `discovery` mode the endpoints are read from it when `issuer` is not given.\"),\n    issuer: z.url().optional().isAuditEvidence().describe(\"The provider's issuer identifier. An ID token is accepted only when its `iss` claim matches it.\"),\n    authorizationEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's authorization endpoint, where the browser is sent to sign in.\"),\n    tokenEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's token endpoint, where the application exchanges the authorization code for tokens.\"),\n    userInfoEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's userinfo endpoint, read for profile claims the ID token does not carry.\"),\n    jwksUri: z.url().optional().isAuditEvidence().describe('Where the provider publishes the keys its ID tokens are verified against.'),\n    endSessionEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's logout endpoint, used when `federatedLogoutEnabled` is on.\"),\n    /**\n     * Redirect the browser to the identity provider's `endSessionEndpoint` when this connection's\n     * user logs out of Wildo — RP-initiated logout (issue #445).\n     *\n     * OPT-IN, and `false` by default, mirroring SAML's `singleLogoutEnabled` rather than inventing a\n     * second shape for the same question. Defaulting it on would change the logout behaviour of\n     * every existing connection that merely happens to have discovered an `end_session_endpoint`,\n     * which for the DISCOVERY template mode is most of them: the endpoint is read out of the\n     * provider's own document, so its presence records what the provider CAN do, never what the\n     * operator wants.\n     *\n     * The endpoint is the CAPABILITY and this is the DECISION. Both are needed — a connection with\n     * this on and no endpoint federates nothing, and says so in the log rather than failing a logout.\n     */\n    federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence().describe(\"Whether logging out of the application also sends the browser to the provider's `endSessionEndpoint`. Off by default.\"),\n    clientId: z.string().min(1).isAuditEvidence().describe('The client ID the provider issued for this application.'),\n    /**\n     * OIDC/OAuth2 client secret issued by the IdP, used by the backend token\n     * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to\n     * authenticate this connection at the provider's token endpoint.\n     *\n     * `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:\n     * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it\n     * stays in the response DTO so the UI renders a masked placeholder, but the\n     * framework redacts it to `••••••••` at the client-serialization boundary only\n     * — internal reads (`servicesRegistryHandler.read` during token exchange) keep\n     * the real value. Do NOT use `.isBackendOnly()`: that strips the field from\n     * every client DTO, so the operator could never supply it.\n     *\n     * Preservation on UPDATE is NOT automatic here: this is a nested field, and the\n     * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a\n     * round-tripped mask must be re-injected from the stored record by the SSO\n     * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The\n     * central sentinel-strip only preserves TOP-LEVEL write-only secrets.\n     */\n    clientSecret: z.string().min(1).isWriteOnlySecret().describe('The client secret the provider issued, used at its token endpoint. Write-only: responses return it masked.'),\n    scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence().describe('The scopes requested at sign-in.'),\n    responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence().describe('The OAuth response type requested (`response_type`).'),\n    responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence().describe('How the provider returns the result to the application (`response_mode`). Absent means `query`.'),\n    claimsMapping: z.object({\n      email: z.string().default('email').describe(\"The name of the claim carrying the user's email address.\"),\n      firstName: z.string().default('given_name').describe(\"The name of the claim carrying the user's first name.\"),\n      lastName: z.string().default('family_name').describe(\"The name of the claim carrying the user's last name.\"),\n      roles: z.string().optional().describe(\"The name of the claim carrying the user's roles, which `roleMapping` translates into application roles.\"),\n      department: z.string().optional().describe(\"The name of the claim carrying the user's department.\"),\n      employeeId: z.string().optional().describe(\"The name of the claim carrying the user's employee ID.\"),\n      groups: z.string().optional().describe(\"The name of the claim carrying the user's group memberships.\"),\n    }).describe('Which ID-token or userinfo claim carries each user detail. A detail with no claim named is not read.'),\n    /*\n     * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,\n     * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,\n     * which is why they were removed rather than honoured (#419, decided 2026-09-08).\n     *\n     * `verifyIdToken` ALWAYS verifies the issuer and the audience and hardcodes a five-minute\n     * maximum token age. Honouring the three toggles could therefore only ever LOOSEN a guard that\n     * is currently unconditional — an operator could switch off issuer or audience validation and\n     * break the token trust chain from a settings screen. A configuration field whose only\n     * achievable effect is to weaken a security control should not exist.\n     */\n    acrValues: z.array(z.string()).optional().isAuditEvidence().describe('Authentication context classes requested from the provider (`acr_values`), for example a stronger sign-in method.'),\n    maxAge: z.number().min(0).optional().isAuditEvidence().describe(\"The oldest, in seconds, the provider's authentication may be (`max_age`).\"),\n    prompt: z.enum(SSOPrompt).optional().isAuditEvidence().describe('The `prompt` value sent with the authorization request.'),\n    /**\n     * May an account re-prove who it is through this identity provider (#1441)?\n     *\n     * When on, an account whose link to this provider is an OIDC link can answer a re-authentication\n     * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in\n     * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`\n     * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the\n     * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is\n     * refused, never trusted.\n     *\n     * OFF by default, and it should be switched on only for a provider that honours those parameters.\n     * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`\n     * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value\n     * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security\n     * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.\n     * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from\n     * https://openid.net/specs/openid-connect-core-1_0.html\n     * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched\n     * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect\n     */\n    reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence().describe('Whether a person linked through this connection may confirm it is them by signing in here again, when adding or removing a way to sign in. Turn it on only for a provider that honours `prompt=login` and returns `auth_time`.'),\n    pkceEnabled: z.boolean().default(true).isAuditEvidence().describe('Whether the sign-in uses PKCE to bind the authorization code to this request.'),\n    pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence().describe('The PKCE code challenge method.'),\n    // NO `auditSettings` — removed with the SAML block's, for the same reason (#1768).\n  }).optional(),\n\n  autoCreateUsers: z.boolean().default(true),\n  /*\n   * NO `autoVerifyEmail` (#1769). The only reader honours it for SCIM provisioning alone — an\n   * interactive sign-in cannot stop to send the person off to verify an address — and SCIM reads the\n   * SCIM provisioning config's own `autoVerifyEmail`, never this one. So the connection's copy was a\n   * setting nothing could ever act on. The directory's assertion of an address is trusted on an\n   * enterprise connection because the tenant configured the connection for its own domain.\n   */\n  /*\n   * `bypassAppMFA` was REMOVED (#1236), rather than wired.\n   *\n   * It was authorable, `.isAuditEvidence()`, and read by no production code — so a change to it was\n   * recorded in the trail as a change to a security setting that had no runtime effect. That is the\n   * sharp edge: the ledger asserted a posture change that did not happen, and a reviewer reading the\n   * trail would conclude a control had been relaxed.\n   *\n   * Removed rather than implemented because implementing it would re-open what #1223 had just closed.\n   * An application's declared `requireMFA` is now enforced on the federated lane too — the external\n   * assurance default derives from that declaration — and the organization policy merge is\n   * most-restrictive, so a tenant may tighten the application's posture and never loosen it. A\n   * connection-level escape hatch is the one shape that contradicts both.\n   *\n   * The framework's own shipped documentation already told operators \"keep it off and do not use it as\n   * evidence that MFA was bypassed or enforced\". A field whose documentation says not to use it is a\n   * field to delete.\n   *\n   * If an application ever needs a tenant to lower the application's requirement, that belongs where\n   * the requirement is DECLARED — in the user-type MFA policy — not on a connection, so that the\n   * relaxation is visible beside the thing it relaxes.\n   */\n  // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`\n  // and the two mappings decide what authority an externally-authenticated identity lands with,\n  // and `allowedDomains` decides whose identities the connection will accept at all. A change\n  // here is an authorization change; the field NAME alone cannot evidence it.\n  // The values are role names and domains — configuration, not personal data.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an\n  // externally-authenticated identity lands with, and whose identities are accepted.\n  defaultRole: z.string().optional().isAuditEvidence(),\n  allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * The provider DIRECTORIES this connection admits — for Microsoft, the Entra tenant ids (#1230).\n   *\n   * A separate list from `allowedDomains` because the values are a different KIND. An email domain says\n   * where an address is; a directory id says which organization's directory asserted it, and only the\n   * second is a membership proof — a directory can assert an address in a domain it does not own,\n   * which is the case the whole mechanism exists to separate.\n   *\n   * Empty means no directory restriction, matching `allowedDomains` rather than inventing a second\n   * convention. The two are INDEPENDENT: a connection may restrict the directory and not the domain,\n   * and the directory check does not stop when the domain list is empty.\n   *\n   * `.isAuditEvidence()` for the same reason as its neighbours below — widening the set of directories\n   * a connection accepts is an authorization change, and the field name alone cannot evidence it.\n   */\n  allowedDirectoryIds: z.array(z.string()).default([]).isAuditEvidence(),\n  roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n  groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n// NOTE: Protocol-config discriminant enforcement (protocol=saml → saml defined, protocol=oidc → oidc defined)\n// is validated at the backend service layer, not via .refine() here.\n// Zod 4 doesn't allow .extend() on refined objects, which breaks the polymorphism engine.\n\n\nexport type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;\n\nexport const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConnections',\n  baseFieldIdentifier: 'ssoConnectionId',\n  baseEnumKey: 'SSO_CONNECTIONS',\n  baseSchema: SsoConnectionBaseSchema,\n  // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,2EAA2E;AAC3E,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,4BAAa,CAAA;AACf,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,gGAAgG;IAChG,0FAA0F;IAC1F,8FAA8F;IAC9F,qEAAqE;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACrE,sGAAsG;IACtG,oGAAoG;IACpG,kEAAkE;IAClE,SAAS,EAAE,CAAC;SACT,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,eAAe,EAAE;SACjB,QAAQ,CAAC,kSAAkS,CAAC;IAE/S,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,qGAAqG;IACrG,gGAAgG;IAChG,qGAAqG;IACrG,+BAA+B;IAC/B,+FAA+F;IAC/F,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8IAA8I,CAAC;QACtM,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;QAC7I,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;QAC9I,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8MAA8M,CAAC;QACzQ,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,QAAQ,CAAC,mEAAmE,CAAC;YAC7K,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,QAAQ,CAAC,gEAAgE,CAAC;YAC3K,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,QAAQ,CAAC,+DAA+D,CAAC;YACvK,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kHAAkH,CAAC;YACzJ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;YAC5G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;YAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uEAAuE,CAAC;SAChH,CAAC,CAAC,QAAQ,CAAC,8FAA8F,CAAC;QAC3G,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;QAC3J,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;QACjI,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iKAAiK,CAAC;QACvP,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,sIAAsI,CAAC;QACzM,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,0JAA0J,CAAC;QAC/N;;;;;;;;;;;;;;;WAeG;QACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,sMAAsM,CAAC;QACtR,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,kGAAkG,CAAC;QAC7M,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8JAA8J,CAAC;QACxO;;;;;;;;WAQG;KACJ,CAAC,CAAC,QAAQ,EAAE;IAEb,sGAAsG;IACtG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,0FAA0F;IAC1F,qFAAqF;IACrF,gGAAgG;IAChG,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uNAAuN,CAAC;QACzT,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2GAA2G,CAAC;QACtM,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;QACpH,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8HAA8H,CAAC;QAC3L,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;QACxJ,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8EAA8E,CAAC;QACpJ,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,mGAAmG,CAAC;QACjK,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,wFAAwF,CAAC;QACzJ,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QACnI,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QAC9I;;;;;;;;;;;;;WAaG;QACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uHAAuH,CAAC;QACtM,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;QACjH;;;;;;;;;;;;;;;;;;WAkBG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,4GAA4G,CAAC;QAC1K,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QAClI,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QACtJ,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;QAC9K,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;YACvG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,uDAAuD,CAAC;YAC7G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;YAC5G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yGAAyG,CAAC;YAChJ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;YACnG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YACpG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;SACvG,CAAC,CAAC,QAAQ,CAAC,sGAAsG,CAAC;QACnH;;;;;;;;;;WAUG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,mHAAmH,CAAC;QACzL,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QAC5I,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;QAC1H;;;;;;;;;;;;;;;;;;;WAmBG;QACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,gOAAgO,CAAC;QAChT,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,+EAA+E,CAAC;QAClJ,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;QAC3H,mFAAmF;KACpF,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gGAAgG;IAChG,8FAA8F;IAC9F,4FAA4F;IAC5F,4EAA4E;IAC5E,4EAA4E;IAC5E,sFAAsF;IACtF,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC/E;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAEpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SSO Connection Schema (Shared) — Polymorphic\n *\n * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).\n * Unified resource — `protocol` field determines which sub-object is populated.\n * Both OIDC and SAML protocol engines consume this shared discriminator.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2B\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\n/** Interactive single-sign-on protocols supported by an SSO connection. */\nexport enum SsoProtocol {\n  OIDC = 'oidc',\n  SAML = 'saml',\n}\n\nexport const SSOTemplateMode = {\n  TEMPLATE: 'template',\n  DISCOVERY: 'discovery',\n  MANUAL: 'manual',\n} as const;\n\nexport const SSOResponseType = {\n  CODE: 'code',\n  ID_TOKEN: 'id_token',\n  TOKEN: 'token',\n} as const;\n\nexport const SSOResponseMode = {\n  QUERY: 'query',\n  FRAGMENT: 'fragment',\n  FORM_POST: 'form_post',\n} as const;\n\nexport const SSOPrompt = {\n  NONE: 'none',\n  LOGIN: 'login',\n  CONSENT: 'consent',\n  SELECT_ACCOUNT: 'select_account',\n} as const;\n\nexport const SSOPKCEMethod = {\n  S256: 'S256',\n  PLAIN: 'plain',\n} as const;\n\nexport const SamlNameIdFormat = {\n  UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',\n  EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',\n  PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n  TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',\n} as const;\n\nexport const SsoConnectionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  protocol: z.enum(SsoProtocol).isSummaryField(),\n  externalProviderId: z.string().min(1).optional(),\n  displayName: z.string().min(1).isSummaryField(),\n  // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides\n  // which IdP silently receives logins. Marked individually rather than on any parent: this\n  // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records\n  // the WHOLE object into rows that replicate to an unerasable ledger.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP\n  // decide which identity provider is trusted to authenticate this tenant.\n  enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  // Read by `selectSsoConnectionForRouting` (#1800): among the eligible connections equally specific to\n  // the signing-in user's domain, the default receives the sign-in. A write that makes one connection\n  // the default demotes the scope's others in the same transaction.\n  isDefault: z\n    .boolean()\n    .default(false)\n    .isAuditEvidence()\n    .describe(\"Whether sign-ins go to this connection when several of this organization's connections could take them. A connection that names the user's email domain in `allowedDomains` still wins over a default that accepts any domain. Making a connection the default removes the flag from the others.\"),\n\n  // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates\n  // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,\n  // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,\n  // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed\n  // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a\n  // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the\n  // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the\n  // container would copy key material into an unerasable ledger. The two-level `attributeMapping`\n  // leaves are deliberately NOT marked — the evidence resolver reaches one level of nesting only, so a\n  // marker there would be inert.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay\n  // validation posture decide which provider is trusted to authenticate this tenant and whether its\n  // assertions are actually verified.\n  saml: z.object({\n    entityId: z.string().min(1).isAuditEvidence().describe(\"The identity provider's SAML entity ID: the issuer its assertions name, and how a sign-in the provider starts is matched to this connection.\"),\n    ssoUrl: z.url().isAuditEvidence().describe(\"The identity provider's single sign-on endpoint, where the application sends a sign-in request.\"),\n    sloUrl: z.url().optional().isAuditEvidence().describe(\"The identity provider's single logout endpoint. Absent when the provider offers none.\"),\n    /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */\n    x509CertificatePem: z.string().min(1).optional().describe(\"The identity provider's signing certificate or certificates, PEM-encoded, used to verify its signatures. Accepted on create and update, and stored parsed as `x509Certificates`, which no response includes.\"),\n    x509Certificates: z.array(z.string()).min(1).isBackendOnly(),\n    attributeMapping: z.object({\n      email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress').describe(\"The name of the SAML attribute carrying the user's email address.\"),\n      firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname').describe(\"The name of the SAML attribute carrying the user's first name.\"),\n      lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname').describe(\"The name of the SAML attribute carrying the user's last name.\"),\n      roles: z.string().optional().describe(\"The name of the SAML attribute carrying the user's roles, which `roleMapping` translates into application roles.\"),\n      department: z.string().optional().describe(\"The name of the SAML attribute carrying the user's department.\"),\n      employeeId: z.string().optional().describe(\"The name of the SAML attribute carrying the user's employee ID.\"),\n      groups: z.string().optional().describe(\"The name of the SAML attribute carrying the user's group memberships.\"),\n    }).describe('Which SAML attribute carries each user detail. A detail with no attribute named is not read.'),\n    signRequests: z.boolean().default(true).isAuditEvidence().describe('Whether the application signs the sign-in requests it sends to the identity provider.'),\n    wantAssertionsSigned: z.boolean().default(true).isAuditEvidence().describe('Whether an assertion must be signed to be accepted.'),\n    allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence().describe(\"How far, in seconds, the identity provider's clock may differ from the application's when an assertion's validity times and authentication instant are checked.\"),\n    forceAuthn: z.boolean().default(false).isAuditEvidence().describe('Whether every sign-in asks the identity provider to authenticate the person afresh rather than reuse its own session (`ForceAuthn`).'),\n    maxAuthAge: z.number().min(0).optional().isAuditEvidence().describe(\"The oldest, in seconds, the identity provider's own authentication may be: an assertion whose `AuthnInstant` is older is refused. Absent means no limit.\"),\n    /**\n     * Whether a person linked through this connection may confirm it is them by signing in again here\n     * (#1441), when adding or removing a way to sign in. Off by default, like the OIDC flag.\n     *\n     * The request is sent with `ForceAuthn=\"true\"` whatever `forceAuthn` says, and the assertion's\n     * `AuthnStatement/@AuthnInstant` must be no older than the request: SAML 2.0 Core §3.4.1 says an IdP\n     * receiving `ForceAuthn=\"true\"` MUST authenticate the presenter directly rather than rely on a previous\n     * security context, and the schema makes `AuthnInstant` required on every authentication statement.\n     * Turn it on only for an IdP that honours `ForceAuthn`: one that silently reuses its session answers\n     * with an old `AuthnInstant` and every re-authentication through it is refused.\n     *\n     * spec-cite: OASIS SAML 2.0 Core (saml-core-2.0-os) §3.4.1 `ForceAuthn` (\"the identity provider MUST\n     * authenticate the presenter directly rather than rely on a previous security context\") and §2.7.2\n     * `AuthnInstant [Required]`, fetched 2026-09-21 from\n     * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\n     */\n    reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence().describe('Whether a person linked through this connection may confirm it is them by signing in here again, when adding or removing a way to sign in. Turn it on only for a provider that honours `ForceAuthn`.'),\n    nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence().describe(\"The NameID format the application asks the identity provider to use for the person's identifier.\"),\n    allowIdpInitiated: z.boolean().default(false).isAuditEvidence().describe('Whether a sign-in the identity provider starts, with no request from the application, is accepted. Single logout the provider starts is accepted either way.'),\n    /*\n     * NO `auditSettings` (`logAuthAttempts` / `logAttributeMapping` / `retentionDays`), here or on the\n     * OIDC block. They were stored, shown on the settings screen, and read by nothing, so an\n     * administrator could switch authentication logging off or shorten its retention and nothing\n     * happened (#1768). Removed rather than wired, like #419 and #1236: every sign-in is recorded on the\n     * application's audit trail whatever a connection says, which is intended — a tenant switch that\n     * turns off its own authentication logging would weaken the evidence the audit trail exists for —\n     * and how long rows are kept is the application's retention schedule, not a per-connection number.\n     */\n  }).optional(),\n\n  // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection\n  // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /\n  // `clientId`) and HOW strictly it validates tokens (`pkceEnabled`, `pkceMethod`), plus what it\n  // requests (`scopes` / `customScopes` / `responseType` / `responseMode` / template + auth-request\n  // shaping, including the `acrValues` step-up demand). Turning `pkceEnabled` off, or repointing\n  // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the\n  // before/after — and so does a change to `acrValues`, which is an authentication-strength\n  // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is\n  // a write-only secret); `claimsMapping` is two-level and out of the resolver's one-level reach.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-\n  // validation posture decide which provider is trusted and whether its tokens are actually verified.\n  oidc: z.object({\n    templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence().describe(\"How the provider's endpoints are found: `template` reads them from a known provider's definition, `discovery` reads them from the provider's OpenID discovery document, and `manual` uses the endpoints entered here.\"),\n    templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence().describe(\"In `template` mode, values substituted into the provider definition's endpoint URLs, such as a tenant id.\"),\n    customScopes: z.array(z.string()).optional().isAuditEvidence().describe('Scopes requested in addition to `scopes`.'),\n    discoveryUrl: z.url().optional().isAuditEvidence().describe(\"The provider's OpenID discovery document URL. In `discovery` mode the endpoints are read from it when `issuer` is not given.\"),\n    issuer: z.url().optional().isAuditEvidence().describe(\"The provider's issuer identifier. An ID token is accepted only when its `iss` claim matches it.\"),\n    authorizationEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's authorization endpoint, where the browser is sent to sign in.\"),\n    tokenEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's token endpoint, where the application exchanges the authorization code for tokens.\"),\n    userInfoEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's userinfo endpoint, read for profile claims the ID token does not carry.\"),\n    jwksUri: z.url().optional().isAuditEvidence().describe('Where the provider publishes the keys its ID tokens are verified against.'),\n    endSessionEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's logout endpoint, used when `federatedLogoutEnabled` is on.\"),\n    /**\n     * Redirect the browser to the identity provider's `endSessionEndpoint` when this connection's\n     * user logs out of Wildo — RP-initiated logout (issue #445).\n     *\n     * OPT-IN, and `false` by default, mirroring SAML's `singleLogoutEnabled` rather than inventing a\n     * second shape for the same question. Defaulting it on would change the logout behaviour of\n     * every existing connection that merely happens to have discovered an `end_session_endpoint`,\n     * which for the DISCOVERY template mode is most of them: the endpoint is read out of the\n     * provider's own document, so its presence records what the provider CAN do, never what the\n     * operator wants.\n     *\n     * The endpoint is the CAPABILITY and this is the DECISION. Both are needed — a connection with\n     * this on and no endpoint federates nothing, and says so in the log rather than failing a logout.\n     */\n    federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence().describe(\"Whether logging out of the application also sends the browser to the provider's `endSessionEndpoint`. Off by default.\"),\n    clientId: z.string().min(1).isAuditEvidence().describe('The client ID the provider issued for this application.'),\n    /**\n     * OIDC/OAuth2 client secret issued by the IdP, used by the backend token\n     * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to\n     * authenticate this connection at the provider's token endpoint.\n     *\n     * `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:\n     * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it\n     * stays in the response DTO so the UI renders a masked placeholder, but the\n     * framework redacts it to `••••••••` at the client-serialization boundary only\n     * — internal reads (`servicesRegistryHandler.read` during token exchange) keep\n     * the real value. Do NOT use `.isBackendOnly()`: that strips the field from\n     * every client DTO, so the operator could never supply it.\n     *\n     * Preservation on UPDATE is NOT automatic here: this is a nested field, and the\n     * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a\n     * round-tripped mask must be re-injected from the stored record by the SSO\n     * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The\n     * central sentinel-strip only preserves TOP-LEVEL write-only secrets.\n     */\n    clientSecret: z.string().min(1).isWriteOnlySecret().describe('The client secret the provider issued, used at its token endpoint. Write-only: responses return it masked.'),\n    scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence().describe('The scopes requested at sign-in.'),\n    responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence().describe('The OAuth response type requested (`response_type`).'),\n    responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence().describe('How the provider returns the result to the application (`response_mode`). Absent means `query`.'),\n    claimsMapping: z.object({\n      email: z.string().default('email').describe(\"The name of the claim carrying the user's email address.\"),\n      firstName: z.string().default('given_name').describe(\"The name of the claim carrying the user's first name.\"),\n      lastName: z.string().default('family_name').describe(\"The name of the claim carrying the user's last name.\"),\n      roles: z.string().optional().describe(\"The name of the claim carrying the user's roles, which `roleMapping` translates into application roles.\"),\n      department: z.string().optional().describe(\"The name of the claim carrying the user's department.\"),\n      employeeId: z.string().optional().describe(\"The name of the claim carrying the user's employee ID.\"),\n      groups: z.string().optional().describe(\"The name of the claim carrying the user's group memberships.\"),\n    }).describe('Which ID-token or userinfo claim carries each user detail. A detail with no claim named is not read.'),\n    /*\n     * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,\n     * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,\n     * which is why they were removed rather than honoured (#419, decided 2026-09-08).\n     *\n     * `verifyIdToken` ALWAYS verifies the issuer and the audience and hardcodes a five-minute\n     * maximum token age. Honouring the three toggles could therefore only ever LOOSEN a guard that\n     * is currently unconditional — an operator could switch off issuer or audience validation and\n     * break the token trust chain from a settings screen. A configuration field whose only\n     * achievable effect is to weaken a security control should not exist.\n     */\n    acrValues: z.array(z.string()).optional().isAuditEvidence().describe('Authentication context classes requested from the provider (`acr_values`), for example a stronger sign-in method.'),\n    maxAge: z.number().min(0).optional().isAuditEvidence().describe(\"The oldest, in seconds, the provider's authentication may be (`max_age`).\"),\n    prompt: z.enum(SSOPrompt).optional().isAuditEvidence().describe('The `prompt` value sent with the authorization request.'),\n    /**\n     * May an account re-prove who it is through this identity provider (#1441)?\n     *\n     * When on, an account whose link to this provider is an OIDC link can answer a re-authentication\n     * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in\n     * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`\n     * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the\n     * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is\n     * refused, never trusted.\n     *\n     * OFF by default, and it should be switched on only for a provider that honours those parameters.\n     * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`\n     * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value\n     * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security\n     * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.\n     * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from\n     * https://openid.net/specs/openid-connect-core-1_0.html\n     * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched\n     * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect\n     */\n    reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence().describe('Whether a person linked through this connection may confirm it is them by signing in here again, when adding or removing a way to sign in. Turn it on only for a provider that honours `prompt=login` and returns `auth_time`.'),\n    pkceEnabled: z.boolean().default(true).isAuditEvidence().describe('Whether the sign-in uses PKCE to bind the authorization code to this request.'),\n    pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence().describe('The PKCE code challenge method.'),\n    // NO `auditSettings` — removed with the SAML block's, for the same reason (#1768).\n  }).optional(),\n\n  autoCreateUsers: z.boolean().default(true),\n  /*\n   * NO `autoVerifyEmail` (#1769). The only reader honours it for SCIM provisioning alone — an\n   * interactive sign-in cannot stop to send the person off to verify an address — and SCIM reads the\n   * SCIM provisioning config's own `autoVerifyEmail`, never this one. So the connection's copy was a\n   * setting nothing could ever act on. The directory's assertion of an address is trusted on an\n   * enterprise connection because the tenant configured the connection for its own domain.\n   */\n  /*\n   * `bypassAppMFA` was REMOVED (#1236), rather than wired.\n   *\n   * It was authorable, `.isAuditEvidence()`, and read by no production code — so a change to it was\n   * recorded in the trail as a change to a security setting that had no runtime effect. That is the\n   * sharp edge: the ledger asserted a posture change that did not happen, and a reviewer reading the\n   * trail would conclude a control had been relaxed.\n   *\n   * Removed rather than implemented because implementing it would re-open what #1223 had just closed.\n   * An application's declared `requireMFA` is now enforced on the federated lane too — the external\n   * assurance default derives from that declaration — and the organization policy merge is\n   * most-restrictive, so a tenant may tighten the application's posture and never loosen it. A\n   * connection-level escape hatch is the one shape that contradicts both.\n   *\n   * The framework's own shipped documentation already told operators \"keep it off and do not use it as\n   * evidence that MFA was bypassed or enforced\". A field whose documentation says not to use it is a\n   * field to delete.\n   *\n   * If an application ever needs a tenant to lower the application's requirement, that belongs where\n   * the requirement is DECLARED — in the user-type MFA policy — not on a connection, so that the\n   * relaxation is visible beside the thing it relaxes.\n   */\n  // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`\n  // and the two mappings decide what authority an externally-authenticated identity lands with,\n  // and `allowedDomains` decides whose identities the connection will accept at all. A change\n  // here is an authorization change; the field NAME alone cannot evidence it.\n  // The values are role names and domains — configuration, not personal data.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an\n  // externally-authenticated identity lands with, and whose identities are accepted.\n  defaultRole: z.string().optional().isAuditEvidence(),\n  allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * The provider DIRECTORIES this connection admits — for Microsoft, the Entra tenant ids (#1230).\n   *\n   * A separate list from `allowedDomains` because the values are a different KIND. An email domain says\n   * where an address is; a directory id says which organization's directory asserted it, and only the\n   * second is a membership proof — a directory can assert an address in a domain it does not own,\n   * which is the case the whole mechanism exists to separate.\n   *\n   * Empty means no directory restriction, matching `allowedDomains` rather than inventing a second\n   * convention. The two are INDEPENDENT: a connection may restrict the directory and not the domain,\n   * and the directory check does not stop when the domain list is empty.\n   *\n   * `.isAuditEvidence()` for the same reason as its neighbours below — widening the set of directories\n   * a connection accepts is an authorization change, and the field name alone cannot evidence it.\n   */\n  allowedDirectoryIds: z.array(z.string()).default([]).isAuditEvidence(),\n  roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n  groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n// NOTE: Protocol-config discriminant enforcement (protocol=saml → saml defined, protocol=oidc → oidc defined)\n// is validated at the backend service layer, not via .refine() here.\n// Zod 4 doesn't allow .extend() on refined objects, which breaks the polymorphism engine.\n\n\nexport type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;\n\nexport const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConnections',\n  baseFieldIdentifier: 'ssoConnectionId',\n  baseEnumKey: 'SSO_CONNECTIONS',\n  baseSchema: SsoConnectionBaseSchema,\n  // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"administrative-continuity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAE7D;;;;;;;;;OASG;IACH,uBAAuB,4BAA4B;IAEnD;;;;;OAKG;IACH,sCAAsC,2CAA2C;CAClF;AACD,uFAAuF"}
+{"version":3,"file":"administrative-continuity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAE7D;;;;;;;;;OASG;IACH,uBAAuB,4BAA4B;IAEnD;;;;;OAKG;IACH,sCAAsC,2CAA2C;CAClF;AACD,uFAAuF"}

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"administrative-continuity.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAN,IAAY,iCA8BX;AA9BD,WAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,kGAA6D,CAAA;IAE7D;;;;;;;;;OASG;IACH,wFAAmD,CAAA;IAEnD;;;;;OAKG;IACH,sHAAiF,CAAA;AACnF,CAAC,EA9BW,iCAAiC,KAAjC,iCAAiC,QA8B5C;AACD,uFAAuF","sourcesContent":["/**\n * Administrative-continuity refusal codes — the stable, client-branchable identity of a\n * \"you would remove the last accountable administrator\" refusal.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application, and each of its\n * tenants, must retain an accountable administrative principal.\n *\n * ## Why this exists as a shared enum rather than prose\n *\n * Both authority floors refuse with `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an\n * ALLOWLIST of context keys on a CONFLICT. The human remedy travels under `message`, which is on that\n * list — but prose is not a contract: a client wanting to tell \"you would strip the last\n * administrator\" apart from any other 409 would have to regex-parse it, and that breaks the moment\n * the wording is improved.\n *\n * The allowlist's own documented rule is that a client-branchable value rides under the stable `code`\n * key, sourced from an enum declared HERE in `@wildo-ai/saas-models` so backend and frontend share one\n * definition — and explicitly NOT under an invented `reason` / `errorKind` field (which the sanitizer\n * strips precisely so that this rule is the only way through). The backend-side `reason` codes remain,\n * unchanged and unshipped: they are the LOG/audit identity, richer than the wire and free to stay so.\n *\n * ## Why one enum for two floors\n *\n * The application floor and the organization-owner floor are distinct authorities over distinct\n * populations, but from a CLIENT's perspective they are one situation with one remedy shape: appoint\n * another administrator at the named scope, then retry. A single enum lets a caller branch on \"this is\n * an administrative-continuity refusal\" with one check and still distinguish the scope when it wants\n * to — which two unrelated enums would not.\n */\n\n/** @wildo_source:part:start saas.models.authorization.administrative-continuity-codes facet:layer:shared facet:audience:app-developer */\n/**\n * Which administrative population a refusal was protecting.\n *\n * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: schemas,\n * comparisons and client branches all derive from this enum rather than re-typing the literals.\n *\n * ## Where you meet it\n *\n * A write that would strip the last accountable administrator is refused with HTTP **409 CONFLICT**,\n * and this value rides under the response's stable `code` key. Branch on `code`, never on the\n * message: the message is a human remedy and is free to be reworded, and every other field a backend\n * might have used to carry the reason is stripped from a CONFLICT before it reaches a client.\n *\n * `409` and not `403`/`400` is deliberate and worth handling separately: the caller IS authorised and\n * the payload IS valid. What forbids the write is the current state, so a generic \"conflict, retry\"\n * branch loops forever — the remedy is to appoint another administrator at the named scope first.\n *\n * ## What counts as an administrator, when you are deciding whether the remedy will work\n *\n * Three conditions, all of which must hold, and each resolved toward the SMALLER count so an\n * ambiguity produces an over-refusal (recoverable) rather than a lockout (not):\n *\n * 1. the roles must CONFER the anchor role — `APP_ADMIN_SUPER_ADMIN` at application scope,\n *    `ORG_OWNER` at organization scope — directly OR through an `inheritFrom` chain. The conferring\n *    set is resolved from your application's LIVE role table at the moment of the call, so a role you\n *    registered yourself that inherits from the anchor counts, and its holders are equally protected;\n * 2. the membership must be `ACTIVE`. An `INVITED` row does not count even though accepting it would\n *    flip the same row — a recoverable administrator is not a usable one, and the invitee may never\n *    accept;\n * 3. the linked user account must be `ACTIVE`. A suspended user cannot present the membership at all.\n *\n * ## Two traps\n *\n * **A UNIT-scoped grant does not satisfy the organization floor.** Granting the owner role inside one\n * organization unit reaches that unit and nothing across the tenant, so the floor — which reads\n * organization-wide membership roles and nothing else — refuses the retry exactly as before. Promote\n * an organization-wide member instead.\n *\n * **Deactivating a user REPORTS rather than refuses.** Suspending an account is overwhelmingly\n * incident response, and refusing it would mean an operator cannot lock out a hostile owner without\n * first transferring ownership using the tenant the attacker controls. So the containment proceeds\n * and every tenant it strands is recorded at critical severity — do not read this refusal as a\n * guarantee that no suspension can leave a tenant ownerless.\n *\n * A tenant that is finished is exempt: a `CANCELLED` or `DELETED` organization, or one that has\n * already requested deletion, may lose its last owner, so ordinary offboarding is never blocked.\n */\nexport enum AdministrativeContinuityErrorCode {\n  /**\n   * The write would leave the APPLICATION with no administratively usable super-administrator —\n   * a principal that confers `APP_ADMIN_SUPER_ADMIN` (directly or through an `inheritFrom` chain)\n   * and whose account status can still authenticate.\n   *\n   * Unrecoverable in-product once breached: every recovery door is itself gated on that role.\n   * Remedy: grant a super-administrator role to another active user, then retry.\n   */\n  LAST_APPLICATION_SUPER_ADMIN = 'LAST_APPLICATION_SUPER_ADMIN',\n\n  /**\n   * The write would leave ONE organization with no administratively usable owner — an ACTIVE\n   * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.\n   *\n   * Remedy before removing the last owner: grant an owner role to another active member, then retry.\n   * If external mutation or restored data already stranded the organization, the dedicated\n   * GRANT_OWNERSHIP operation provides a repair path to an eligible ACTIVE member with an ACTIVE\n   * linked user. A crossing platform administrator still needs its declared variant and a usable\n   * tenant-access grant; ownerless request auto-approval does not bypass the repair's checks.\n   */\n  LAST_ORGANIZATION_OWNER = 'LAST_ORGANIZATION_OWNER',\n\n  /**\n   * `grantOwnership` was asked to make a PROVIDER membership (#1597 — a service firm's expert, present\n   * through the client's service-provider relationship) an owner. Refused: an organization whose owner\n   * is a firm's expert still cannot administer itself, and the floor never counts such a row. Remedy:\n   * grant ownership to one of the organization's OWN members.\n   */\n  SERVICE_PROVIDER_MEMBERSHIP_CANNOT_OWN = 'SERVICE_PROVIDER_MEMBERSHIP_CANNOT_OWN',\n}\n/** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */\n"]}
+{"version":3,"file":"administrative-continuity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAN,IAAY,iCA8BX;AA9BD,WAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,kGAA6D,CAAA;IAE7D;;;;;;;;;OASG;IACH,wFAAmD,CAAA;IAEnD;;;;;OAKG;IACH,sHAAiF,CAAA;AACnF,CAAC,EA9BW,iCAAiC,KAAjC,iCAAiC,QA8B5C;AACD,uFAAuF","sourcesContent":["/**\n * Administrative-continuity refusal codes — the stable, client-branchable identity of a\n * \"you would remove the last accountable administrator\" refusal.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application, and each of its\n * tenants, must retain an accountable administrative principal.\n *\n * ## Why this exists as a shared enum rather than prose\n *\n * Both authority floors refuse with `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an\n * ALLOWLIST of context keys on a CONFLICT. The human remedy travels under `message`, which is on that\n * list — but prose is not a contract: a client wanting to tell \"you would strip the last\n * administrator\" apart from any other 409 would have to regex-parse it, and that breaks the moment\n * the wording is improved.\n *\n * The allowlist's own documented rule is that a client-branchable value rides under the stable `code`\n * key, sourced from an enum declared HERE in `@wildo-ai/saas-models` so backend and frontend share one\n * definition — and explicitly NOT under an invented `reason` / `errorKind` field (which the sanitizer\n * strips precisely so that this rule is the only way through). The backend-side `reason` codes remain,\n * unchanged and unshipped: they are the LOG/audit identity, richer than the wire and free to stay so.\n *\n * ## Why one enum for two floors\n *\n * The application floor and the organization-owner floor are distinct authorities over distinct\n * populations, but from a CLIENT's perspective they are one situation with one remedy shape: appoint\n * another administrator at the named scope, then retry. A single enum lets a caller branch on \"this is\n * an administrative-continuity refusal\" with one check and still distinguish the scope when it wants\n * to — which two unrelated enums would not.\n */\n\n/** @wildo_source:part:start saas.models.authorization.administrative-continuity-codes facet:layer:shared facet:audience:app-developer */\n/**\n * Which administrative population a refusal was protecting.\n *\n * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: schemas,\n * comparisons and client branches all derive from this enum rather than re-typing the literals.\n *\n * ## Where you meet it\n *\n * A write that would strip the last accountable administrator is refused with HTTP **409 CONFLICT**,\n * and this value rides under the response's stable `code` key. Branch on `code`, never on the\n * message: the message is a human remedy and is free to be reworded, and every other field a backend\n * might have used to carry the reason is stripped from a CONFLICT before it reaches a client.\n *\n * `409` and not `403`/`400` is deliberate and worth handling separately: the caller IS authorised and\n * the payload IS valid. What forbids the write is the current state, so a generic \"conflict, retry\"\n * branch loops forever — the remedy is to appoint another administrator at the named scope first.\n *\n * ## What counts as an administrator, when you are deciding whether the remedy will work\n *\n * Three conditions, all of which must hold, and each resolved toward the SMALLER count so an\n * ambiguity produces an over-refusal (recoverable) rather than a lockout (not):\n *\n * 1. the roles must CONFER the anchor role — `APP_ADMIN_SUPER_ADMIN` at application scope,\n *    `ORG_OWNER` at organization scope — directly OR through an `inheritFrom` chain. The conferring\n *    set is resolved from your application's LIVE role table at the moment of the call, so a role you\n *    registered yourself that inherits from the anchor counts, and its holders are equally protected;\n * 2. the membership must be `ACTIVE`. An `INVITED` row does not count even though accepting it would\n *    flip the same row — a recoverable administrator is not a usable one, and the invitee may never\n *    accept;\n * 3. the linked user account must be `ACTIVE`. A suspended user cannot present the membership at all.\n *\n * ## Two traps\n *\n * **A UNIT-scoped grant does not satisfy the organization floor.** Granting the owner role inside one\n * organization unit reaches that unit and nothing across the tenant, so the floor — which reads\n * organization-wide membership roles and nothing else — refuses the retry exactly as before. Promote\n * an organization-wide member instead.\n *\n * **Deactivating a user REPORTS rather than refuses.** Suspending an account is overwhelmingly\n * incident response, and refusing it would mean an operator cannot lock out a hostile owner without\n * first transferring ownership using the tenant the attacker controls. So the containment proceeds\n * and every tenant it strands is recorded at critical severity — do not read this refusal as a\n * guarantee that no suspension can leave a tenant ownerless.\n *\n * A tenant that is finished is exempt: a `CANCELLED` or `DELETED` organization, or one that has\n * already requested deletion, may lose its last owner, so ordinary offboarding is never blocked.\n */\nexport enum AdministrativeContinuityErrorCode {\n  /**\n   * The write would leave the APPLICATION with no administratively usable super-administrator —\n   * a principal that confers `APP_ADMIN_SUPER_ADMIN` (directly or through an `inheritFrom` chain)\n   * and whose account status can still authenticate.\n   *\n   * Unrecoverable in-product once breached: every recovery door is itself gated on that role.\n   * Remedy: grant a super-administrator role to another active user, then retry.\n   */\n  LAST_APPLICATION_SUPER_ADMIN = 'LAST_APPLICATION_SUPER_ADMIN',\n\n  /**\n   * The write would leave ONE organization with no administratively usable owner — an ACTIVE\n   * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.\n   *\n   * Remedy before removing the last owner: grant an owner role to another active member, then retry.\n   * If external mutation or restored data already stranded the organization, the dedicated\n   * GRANT_OWNERSHIP operation provides a repair path to an eligible ACTIVE member with an ACTIVE\n   * linked user. A crossing platform administrator still needs its declared variant and a usable\n   * tenant-access grant; ownerless request auto-approval does not bypass the repair's checks.\n   */\n  LAST_ORGANIZATION_OWNER = 'LAST_ORGANIZATION_OWNER',\n\n  /**\n   * `grantOwnership` was asked to make a PROVIDER membership (#1597 — a service firm's expert, present\n   * through the client's service-provider relationship) an owner. Refused: an organization whose owner\n   * is a firm's expert still cannot administer itself, and the floor never counts such a row. Remedy:\n   * grant ownership to one of the organization's OWN members.\n   */\n  SERVICE_PROVIDER_MEMBERSHIP_CANNOT_OWN = 'SERVICE_PROVIDER_MEMBERSHIP_CANNOT_OWN',\n}\n/** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */\n"]}

package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,kCAAkC,EAEnC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAE3B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,kEAAkE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAoQ7H,CAAC"}
+{"version":3,"file":"application-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/application-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,kCAAkC,EAEnC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAE3B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,kEAAkE,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;kBAoQ7H,CAAC"}

package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC1G,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,wCAAwC,GACzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAS1H,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACnI,0CAA0C,CAIxC;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;OAKG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,kCAAkC,CAAC,cAAc,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6KAA6K,CAAC;wBACxP;;;;;2BAKG;wBACH,wBAAwB,EAAE,wCAAwC,CAAC,QAAQ,EAAE;qBAC9E,CAAC;iBACH;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,kCAAkC,CAAC,OAAO,CAAC,EAAE;YAC5C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,CACpD,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,wCAAwC,CAAC;4BAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;4BAC5C,cAAc,EAAE,YAAY,EAAE,MAAM;yBACrC,CAAC;iBACL;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,kCAAkC,CAAC,IAAI,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,mIAAmI;QACnI,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;KACF;IACD,4FAA4F;IAC5F,0FAA0F;CAC3F,CAAC,CAAC","sourcesContent":["/**\n * Application Access Grants — resource configuration.\n *\n * The operation set mirrors `platformAccessGrants` verb for verb, and the ONE difference is the whole\n * feature: `approve` is gated on the PLATFORM's own administrators rather than a tenant's, and refuses\n * the requester. On the tenant resource the ABSENCE of `admitsCrossTenantPlatformAdministration` on\n * `approve` is what stops an operator approving their own request; here every verb is platform-tier by\n * construction, so that absence buys nothing and the refusal has to be a MEASUREMENT the\n * implementation makes — `applicationAccessGrantApproverIsDistinct`.\n *\n * See `application-access-grants.shared.schemas.ts` for why the resource exists and why it is a\n * sibling type rather than a field, and `.claude/rules/administrative-continuity-floors.md` for the\n * ladder it sits on.\n */\n\nimport { z } from 'zod';\nimport { ExecutionContext_MachineCredentialSchema } from '../../runtime/execution-context.shared.schemas';\nimport {\n  ApplicationAccessGrantSchema,\n  ApplicationAccessGrants_Operations,\n  applicationAccessGrantApproverIsDistinct,\n} from './application-access-grants.shared.schemas';\nimport { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\ntype ApplicationAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const applicationAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ApplicationAccessGrants_Operations,\n    ApplicationAccessGrantsCoreOperations,\n    typeof ApplicationAccessGrantSchema\n  >({\n    mainSchema: ApplicationAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.APPLICATION_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` ALLOWED for the trusted path, and for exactly the reason the tenant resource\n     * allows them: the authorization layer itself resolves a caller's usable grant on a system\n     * context, before the caller's own authority has been established for the read it is gating.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the two-person measurement. A system door around those would be a second way to mint an\n     * application-wide elevation, which is the one thing this resource exists to prevent.\n     *\n     * `exportSubject: FORBIDDEN`, mirrored from the tenant resource. `operatorUserId` and\n     * `approvedByUserId` are foreign keys back to USERS, so these rows sit on a user's Art. 15 graph\n     * as `INCLUDED_REFERENCES_SUBJECT`; an included resource carrying NO declaration REFUSES the whole\n     * export, so omitting this would trade a boot failure for a broken disclosure right. FORBIDDEN\n     * because this is a security-monitoring record and handing the monitoring trail to the person it\n     * monitors is self-defeating — and because it names ANOTHER data subject's decision (the second\n     * administrator), which Art. 15(4) protects.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text — mirrored from the tenant resource\n     * because it is the same kind of record. What survives is WHO reached application-wide, WHEN, and\n     * who signed for it; what does not is `justification` and `decisionReason`, the operator- and\n     * approver-written prose most likely to name a third party in passing.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these revokes NO session: the grant is a record ABOUT an operator's access, not\n     * the operator. Their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be\n       * REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize\n       * writer uses to stamp markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      /**\n       * The pending queue a second administrator works from, and the record of what was granted.\n       *\n       * `APP_ADMIN_SUPER_ADMIN` on every read: the rows name operator reach across every tenant, and\n       * there is no tenant-side reader here as there is on the platform resource — an application-wide\n       * grant has no customer to show it to. That absence is precisely why the approval had to become\n       * a second signature.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb.\n       *\n       * Note what it deliberately does NOT declare: `admitsCrossTenantPlatformAdministration`. On the\n       * tenant resource that flag is what lets a non-member operator write a row inside someone else's\n       * tenant, and `requestAccess` there is exempted from the grant requirement it bootstraps. Here\n       * the resource is APPLICATION-scoped — there is no tenant boundary to cross — so the flag would\n       * be meaningless and the exemption has a different shape: the ADMISSION gate exempts this\n       * resource entirely, because an operator would otherwise need an application-wide grant in order\n       * to ask for one.\n       *\n       * What keeps that safe is the same argument the tenant resource makes: requesting is not\n       * accessing. This writes one PENDING row and reads nothing. The blast radius of an abused\n       * request is an entry in a queue that another administrator must sign.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — application-wide reach is\n       * requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [ApplicationAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 1h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional().describe(\"How long the elevation lasts, in whole minutes, counted from this request rather than from approval. Defaults to 30; a longer request is reduced to 60 rather than refused.\"),\n              /**\n               * Ask for the elevation ON BEHALF OF one machine credential of this application — an API key or an\n               * OAuth client, e.g. an assurance collector's (#297). The credential must exist, belong to this\n               * application, be active and unexpired, or the request is refused. Once signed, the grant admits that\n               * credential and NOT the requester.\n               */\n              grantedMachineCredential: ExecutionContext_MachineCredentialSchema.optional(),\n            }),\n          },\n        ],\n      },\n\n      /**\n       * The SECOND SIGNATURE.\n       *\n       * `enabledCondition` refuses a self-approval here as well as in the implementation, and the\n       * duplication is deliberate rather than redundant — they are two different guarantees. This one\n       * makes the affordance DISAPPEAR for the requester, so a platform console never renders an\n       * Approve button on one's own request; the implementation's `assert…` is the fail-closed half,\n       * because `enabledCondition` is evaluated against the row the framework fetched and a future\n       * variant authored without one would otherwise transition silently.\n       *\n       * Neutering either alone must not admit a self-approval. That is what the two pins assert.\n       *\n       * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation requires\n       * a second, distinct platform administrator's signature.\n       */\n      [ApplicationAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject, initiatorIds }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              && applicationAccessGrantApproverIsDistinct({\n                operatorUserId: currentObject.operatorUserId,\n                approverUserId: initiatorIds?.userId,\n              }),\n          },\n        ],\n      },\n\n      /**\n       * Refusing a request. NOT gated on being a different person: an operator who thinks better of\n       * their own request should be able to withdraw it, and a denial only ever removes authority.\n       * The two-person rule constrains what an operator can GRANT themselves, never what they can\n       * refuse themselves.\n       */\n      [ApplicationAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /** Ending an elevation early. Monotonic — it only ever removes authority — so it is unrestricted among platform administrators. */\n      [ApplicationAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n\n      /**\n       * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and by\n       * nothing else. INTERNAL_CALL: no route, no affordance.\n       *\n       * `requestDto: z.object({})` is EMPTY BY CONTRACT, not by omission — an operation without a\n       * `requestDto` inherits the resource's entire update contract, which would let a verb that\n       * accepts nothing advertise every field, `status` included.\n       */\n      [ApplicationAccessGrants_Operations.EXPIRE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({}),\n          },\n        ],\n      },\n    },\n    // NOTE: the APPLICATION primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (APPLICATION → APPLICATION_ACCESS_GRANTS).\n  });\n"]}
+{"version":3,"file":"application-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/application-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC1G,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,wCAAwC,GACzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAS1H,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACnI,0CAA0C,CAIxC;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;OAKG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,kCAAkC,CAAC,cAAc,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6KAA6K,CAAC;wBACxP;;;;;2BAKG;wBACH,wBAAwB,EAAE,wCAAwC,CAAC,QAAQ,EAAE;qBAC9E,CAAC;iBACH;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,kCAAkC,CAAC,OAAO,CAAC,EAAE;YAC5C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,CACpD,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,wCAAwC,CAAC;4BAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;4BAC5C,cAAc,EAAE,YAAY,EAAE,MAAM;yBACrC,CAAC;iBACL;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,kCAAkC,CAAC,IAAI,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,mIAAmI;QACnI,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;KACF;IACD,4FAA4F;IAC5F,0FAA0F;CAC3F,CAAC,CAAC","sourcesContent":["/**\n * Application Access Grants — resource configuration.\n *\n * The operation set mirrors `platformAccessGrants` verb for verb, and the ONE difference is the whole\n * feature: `approve` is gated on the PLATFORM's own administrators rather than a tenant's, and refuses\n * the requester. On the tenant resource the ABSENCE of `admitsCrossTenantPlatformAdministration` on\n * `approve` is what stops an operator approving their own request; here every verb is platform-tier by\n * construction, so that absence buys nothing and the refusal has to be a MEASUREMENT the\n * implementation makes — `applicationAccessGrantApproverIsDistinct`.\n *\n * See `application-access-grants.shared.schemas.ts` for why the resource exists and why it is a\n * sibling type rather than a field, and `.claude/rules/administrative-continuity-floors.md` for the\n * ladder it sits on.\n */\n\nimport { z } from 'zod';\nimport { ExecutionContext_MachineCredentialSchema } from '../../runtime/execution-context.shared.schemas';\nimport {\n  ApplicationAccessGrantSchema,\n  ApplicationAccessGrants_Operations,\n  applicationAccessGrantApproverIsDistinct,\n} from './application-access-grants.shared.schemas';\nimport { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\ntype ApplicationAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const applicationAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ApplicationAccessGrants_Operations,\n    ApplicationAccessGrantsCoreOperations,\n    typeof ApplicationAccessGrantSchema\n  >({\n    mainSchema: ApplicationAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.APPLICATION_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` ALLOWED for the trusted path, and for exactly the reason the tenant resource\n     * allows them: the authorization layer itself resolves a caller's usable grant on a system\n     * context, before the caller's own authority has been established for the read it is gating.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the two-person measurement. A system door around those would be a second way to mint an\n     * application-wide elevation, which is the one thing this resource exists to prevent.\n     *\n     * `exportSubject: FORBIDDEN`, mirrored from the tenant resource. `operatorUserId` and\n     * `approvedByUserId` are foreign keys back to USERS, so these rows sit on a user's Art. 15 graph\n     * as `INCLUDED_REFERENCES_SUBJECT`; an included resource carrying NO declaration REFUSES the whole\n     * export, so omitting this would trade a boot failure for a broken disclosure right. FORBIDDEN\n     * because this is a security-monitoring record and handing the monitoring trail to the person it\n     * monitors is self-defeating — and because it names ANOTHER data subject's decision (the second\n     * administrator), which Art. 15(4) protects.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text — mirrored from the tenant resource\n     * because it is the same kind of record. What survives is WHO reached application-wide, WHEN, and\n     * who signed for it; what does not is `justification` and `decisionReason`, the operator- and\n     * approver-written prose most likely to name a third party in passing.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these revokes NO session: the grant is a record ABOUT an operator's access, not\n     * the operator. Their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be\n       * REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize\n       * writer uses to stamp markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      /**\n       * The pending queue a second administrator works from, and the record of what was granted.\n       *\n       * `APP_ADMIN_SUPER_ADMIN` on every read: the rows name operator reach across every tenant, and\n       * there is no tenant-side reader here as there is on the platform resource — an application-wide\n       * grant has no customer to show it to. That absence is precisely why the approval had to become\n       * a second signature.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb.\n       *\n       * Note what it deliberately does NOT declare: `admitsCrossTenantPlatformAdministration`. On the\n       * tenant resource that flag is what lets a non-member operator write a row inside someone else's\n       * tenant, and `requestAccess` there is exempted from the grant requirement it bootstraps. Here\n       * the resource is APPLICATION-scoped — there is no tenant boundary to cross — so the flag would\n       * be meaningless and the exemption has a different shape: the ADMISSION gate exempts this\n       * resource entirely, because an operator would otherwise need an application-wide grant in order\n       * to ask for one.\n       *\n       * What keeps that safe is the same argument the tenant resource makes: requesting is not\n       * accessing. This writes one PENDING row and reads nothing. The blast radius of an abused\n       * request is an entry in a queue that another administrator must sign.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — application-wide reach is\n       * requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [ApplicationAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 1h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional().describe(\"How long the elevation lasts, in whole minutes, counted from this request rather than from approval. Defaults to 30; a longer request is reduced to 60 rather than refused.\"),\n              /**\n               * Ask for the elevation ON BEHALF OF one machine credential of this application — an API key or an\n               * OAuth client, e.g. an assurance collector's (#297). The credential must exist, belong to this\n               * application, be active and unexpired, or the request is refused. Once signed, the grant admits that\n               * credential and NOT the requester.\n               */\n              grantedMachineCredential: ExecutionContext_MachineCredentialSchema.optional(),\n            }),\n          },\n        ],\n      },\n\n      /**\n       * The SECOND SIGNATURE.\n       *\n       * `enabledCondition` refuses a self-approval here as well as in the implementation, and the\n       * duplication is deliberate rather than redundant — they are two different guarantees. This one\n       * makes the affordance DISAPPEAR for the requester, so a platform console never renders an\n       * Approve button on one's own request; the implementation's `assert…` is the fail-closed half,\n       * because `enabledCondition` is evaluated against the row the framework fetched and a future\n       * variant authored without one would otherwise transition silently.\n       *\n       * Neutering either alone must not admit a self-approval. That is what the two pins assert.\n       *\n       * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation requires\n       * a second, distinct platform administrator's signature.\n       */\n      [ApplicationAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject, initiatorIds }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              && applicationAccessGrantApproverIsDistinct({\n                operatorUserId: currentObject.operatorUserId,\n                approverUserId: initiatorIds?.userId,\n              }),\n          },\n        ],\n      },\n\n      /**\n       * Refusing a request. NOT gated on being a different person: an operator who thinks better of\n       * their own request should be able to withdraw it, and a denial only ever removes authority.\n       * The two-person rule constrains what an operator can GRANT themselves, never what they can\n       * refuse themselves.\n       */\n      [ApplicationAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /** Ending an elevation early. Monotonic — it only ever removes authority — so it is unrestricted among platform administrators. */\n      [ApplicationAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n\n      /**\n       * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and by\n       * nothing else. INTERNAL_CALL: no route, no affordance.\n       *\n       * `requestDto: z.object({})` is EMPTY BY CONTRACT, not by omission — an operation without a\n       * `requestDto` inherits the resource's entire update contract, which would let a verb that\n       * accepts nothing advertise every field, `status` included.\n       */\n      [ApplicationAccessGrants_Operations.EXPIRE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({}),\n          },\n        ],\n      },\n    },\n    // NOTE: the APPLICATION primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (APPLICATION → APPLICATION_ACCESS_GRANTS).\n  });\n"]}

package/dist/esm/security/authorizations/application-access-grants.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-access-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAKpF;;;;;;;GAOG;AACH,eAAO,MAAM,iDAAiD,KAAK,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,iDAAiD,KAAK,CAAC;AAEpE;;;;;;GAMG;AACH,oBAAY,kCAAkC;IAC5C;;;OAGG;IACH,cAAc,kBAAkB;IAChC,sHAAsH;IACtH,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,uFAAuF;IACvF,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;iBA0GvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAMjH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE;IACnD,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC,QAAQ,CAAC,wBAAwB,CAAC,EAAE;YAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KAC3G,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE;YAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KACpG,CAAC;CACH,GAAG,OAAO,CASV;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE;IAC/D,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;CACpD,GAAG,OAAO,CAKV"}
+{"version":3,"file":"application-access-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/application-access-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAKpF;;;;;;;GAOG;AACH,eAAO,MAAM,iDAAiD,KAAK,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,iDAAiD,KAAK,CAAC;AAEpE;;;;;;GAMG;AACH,oBAAY,kCAAkC;IAC5C;;;OAGG;IACH,cAAc,kBAAkB;IAChC,sHAAsH;IACtH,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,uFAAuF;IACvF,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;iBA0GvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAMjH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE;IACnD,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC,QAAQ,CAAC,wBAAwB,CAAC,EAAE;YAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KAC3G,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE;YAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KACpG,CAAC;CACH,GAAG,OAAO,CASV;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE;IAC/D,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;CACpD,GAAG,OAAO,CAKV"}

package/dist/esm/security/authorizations/application-access-grants.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-access-grants.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authorizations/application-access-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,EAAE,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,EAAE,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,kCAYX;AAZD,WAAY,kCAAkC;IAC5C;;;OAGG;IACH,sEAAgC,CAAA;IAChC,sHAAsH;IACtH,yDAAmB,CAAA;IACnB,mDAAa,CAAA;IACb,uDAAiB,CAAA;IACjB,uFAAuF;IACvF,uDAAiB,CAAA;AACnB,CAAC,EAZW,kCAAkC,KAAlC,kCAAkC,QAY7C;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE9G,yGAAyG;IACzG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzI;;;;;OAKG;IACH,mGAAmG;IACnG,iGAAiG;IACjG,yDAAyD;IACzD,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;SAC3C,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;SACtC,UAAU,CAAC,2BAA2B,CAAC;SACvC,OAAO,CAAC,yBAAyB,CAAC,gBAAgB,CAAC;SACnD,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE5G;;;;;;;;;OASG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACxI,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEvE;;;;;;;;;;;;;;OAcG;IACH,wBAAwB,EAAE,wCAAwC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEnH,mFAAmF;IACnF,2DAA2D;IAC3D,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACtE,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,MAAM,CACrB;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,wBAA4C,EAAE,GAAS;IACzG,MAAM,SAAS,GAAG,wBAAwB,IAAI,wBAAwB,GAAG,CAAC;QACxE,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,iDAAiD,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,iDAAiD,CAAC,CAAC;IACvF,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAS5C;IACC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC;IACrD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;IACpJ,CAAC;IACD,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wCAAwC,CAAC,MAGxD;IACC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,QAAQ,KAAK,QAAQ,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * Application Access Grants — time-bound, justified, TWO-PERSON-APPROVED elevation for an operator\n * act that names no single tenant.\n *\n * ## Which reads use this grant\n *\n * Actual application-wide grants always require a different administrator's approval. The general\n * directory and other application-wide read gates retain that requirement. The application audit\n * viewer instead defaults to its administrator-role gate, in production and development alike;\n * `auditTrail.applicationReadAccess = AuditApplicationReadAccess.INDEPENDENT_APPROVAL` explicitly\n * enrolls that viewer in this grant requirement. Role-based audit reads remain observed and do not\n * invent a grant id. The historical diagnosis below explains the general elevation mechanism, not\n * an assertion that every cross-tenant audit read must use it.\n *\n * ## The asymmetry this closes\n *\n * `platformAccessGrants` governs the NARROW act: one operator, one named tenant, one window. It is\n * the door `.claude/rules/administrative-continuity-floors.md` calls rungs 4–5 of the ladder, and it\n * works.\n *\n * The WIDE act was ungoverned. Measured 2026-09-09 and recorded on\n * `ScopeRootConfinementDisposition.UNCONFINED_APPLICATION_TIER_DIRECTORY`:\n *\n * | | per-row crossing | application-wide read |\n * |---|---|---|\n * | elevation required | a usable `platformAccessGrants` row | **none** |\n * | role tier | `APP_ADMIN_SUPER_ADMIN` | `APP_ADMIN_VIEWER` / `ORG_MEMBER` |\n * | evidence | `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, naming the grant | an observation naming no elevation |\n *\n * So the narrow act carried elevation and expiry and the widest read did not — and the wide one sat\n * at a strictly LOWER role tier. That is worse than \"not symmetric\"; it is the control inverted.\n *\n * ## Why a SEPARATE resource and not a `scope` field on the tenant grant\n *\n * Structural, not stylistic. A `platformAccessGrants` row is ORGANIZATIONS-scoped: its primary-scope\n * relationship carries `isPrimaryScope: true` on `organizationId`, every route is\n * `/organizations/{organizationId}/platform-access-grants/…`, and the tenant's ability to SEE and\n * REVOKE the row is exactly what that scope buys. An application-wide elevation names no tenant, so\n * the route has nothing to carry and the scope has nobody to serve. Adding a nullable\n * `organizationId` to make one row shape serve both would weaken the field whose presence IS the\n * tenant grant's control — which the finding explicitly refuses (\"do not weaken the per-row model to\n * make the two symmetric\").\n *\n * The engine's own precedent for a second scope over one lifecycle is `applicationAuditLogs` beside\n * `auditLogs`: a sibling resource type carrying ONE application parent, taking the route it needs and\n * leaving the existing door byte-identical.\n *\n * ## Why TWO-PERSON, and what was rejected\n *\n * Tenant approval is the industry ceiling (Microsoft Customer Lockbox, Google Access Approval) and it\n * is structurally unavailable here: there is no single customer to ask. `administrative-continuity-floors.md`\n * names the next-strongest control in as many words — *\"a second factor authenticates a session; only\n * a second signature constrains an authenticated operator\"* — and asks for a two-person rule on the\n * widest acts.\n *\n * Auto-approval was rejected: it is the tenant grant's default posture precisely BECAUSE a tenant can\n * opt in above it, and there is no such party here, so an auto-approved application-wide grant would\n * be a standing privilege with a request form in front of it.\n *\n * Confining the read to tenants the caller holds a grant for was rejected on MEASUREMENT rather than\n * cost: `users` rows carry no tenant column at all, so there is nothing for a tenant predicate to\n * bind to, and any junction-based confinement would also remove the tenant-less user — the person who\n * has just signed up and belongs to nobody — from the only surface that can find them.\n */\n\nimport { z } from 'zod';\nimport { ExecutionContext_MachineCredentialSchema } from '../../runtime/execution-context.shared.schemas';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';\n\n/** Fixed replacement for grant free-text that cannot be cleared (a `.min(1)` field). */\nconst ERASED_GRANT_TEXT = '[erased]';\n\n/**\n * The default life of an application-wide grant whose request names no duration.\n *\n * THIRTY minutes — half the tenant grant's default, and the halving is the point rather than a round\n * number. A tenant grant reaches ONE customer and the customer can see and revoke it; this one\n * reaches every customer at once and no customer can see it. The window is the only thing that ends\n * it early, so the unconsidered case gets the narrowest window a support interaction can still use.\n */\nexport const APPLICATION_ACCESS_GRANT_DEFAULT_DURATION_MINUTES = 30;\n\n/**\n * The maximum life of an application-wide grant, whatever a request asks for.\n *\n * ONE HOUR against the tenant grant's four. A four-hour window is defended there as \"a working\n * session, not a working week\" for an elevation into one tenant; the same reasoning gives a shorter\n * answer for an elevation into all of them. An operator who genuinely needs longer re-requests, and\n * a second administrator signs again — which is the record we want, and the reason a shorter ceiling\n * here costs no security and buys a second signature per hour of the widest access the system grants.\n */\nexport const APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES = 60;\n\n/**\n * Custom verbs. Mirrors `PlatformAccessGrants_Operations` deliberately — the same lifecycle,\n * so the same verbs, so a reader who knows one knows the other.\n *\n * There is no ordinary CREATE/UPDATE for the same reason: they would be a second, ungated path to the\n * server-authored fields whose server authorship IS the control.\n */\nexport enum ApplicationAccessGrants_Operations {\n  /**\n   * The bootstrap verb. Writes one row in `PENDING_APPROVAL` and NEVER in `ACTIVE` — see\n   * the `status` field below for why auto-approval has no member here.\n   */\n  REQUEST_ACCESS = 'requestAccess',\n  /** The SECOND administrator's signature. Refuses the requester — {@link applicationAccessGrantApproverIsDistinct}. */\n  APPROVE = 'approve',\n  DENY = 'deny',\n  REVOKE = 'revoke',\n  /** ACTIVE → EXPIRED, dispatched by the credential-expiry sweep and by nothing else. */\n  EXPIRE = 'expire',\n}\n\nexport const ApplicationAccessGrantSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The primary-scope parent — the deployment this elevation is inside.\n   *\n   * OPTIONAL, and that is a load-bearing copy of `applicationAuditLogs`' own shape rather than a\n   * looseness: declared MANDATORY the resource does not load at all on a Mongo-persisted deployment\n   * (the ZodToMongoose convertor refuses it and INIT dies on `zod_converter_schema_conversion_failed`).\n   * Addressing is carried by `isPrimaryScope` + `REQUIRES_CONTEXT` on the relationship, which is what\n   * the URL builder reads, so the route is identical either way.\n   */\n  applicationId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),\n\n  /** The operator who requested the elevation. Server-authored from the session, never client-supplied. */\n  operatorUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * Why the operator needs application-wide reach. REQUIRED, like its tenant sibling, and here it\n   * carries more weight: it is the ONLY thing the approving administrator has to decide on. A tenant\n   * grant's approver knows their own tenant and their own support case; this approver knows nothing\n   * but this sentence.\n   */\n  // USER_CONTENT — free prose an OPERATOR typed. MASK rather than REMOVE on erasure: `.min(1)` makes\n  // it non-clearable, so a null would be rejected by the strict update-DTO parse the impersonalize\n  // writer runs, and a fixed non-empty string is accepted.\n  justification: addImpersonalizeWith(\n    z.string().min(1).max(1000).isSummaryField()\n    .dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.MASK,\n    { maskValue: ERASED_GRANT_TEXT },\n  ),\n\n  /**\n   * Lifecycle position, sharing {@link PlatformAccessGrantStatus} rather than declaring a parallel\n   * vocabulary — the states really are the same states, and two enums holding the same five members\n   * is how a sweep, a predicate and a UI come to disagree about what `active` means.\n   *\n   * ## The member that is UNREACHABLE here, and why that is the control\n   *\n   * Every application-wide grant starts `PENDING_APPROVAL`. There is no auto-approval path and\n   * therefore no `autoApprovalReason` field: the tenant grant auto-approves when the tenant has not\n   * opted into approval, or cannot approve — both are statements about a NAMED tenant, and this row\n   * names none. A grant that could approve itself would make the two-person rule ceremonial, which is\n   * exactly the criticism `approve` on the tenant resource carries against platform self-approval.\n   */\n  status: z.enum(PlatformAccessGrantStatus)\n    .systemEnum('PlatformAccessGrantStatus')\n    .default(PlatformAccessGrantStatus.PENDING_APPROVAL)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /**\n   * When the elevation stops working.\n   *\n   * Server-authored from the requested duration, clamped to\n   * {@link APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES}. The admission predicate reads THIS\n   * field and not `status`, so expiry needs no sweeper to take effect — the same separation the\n   * tenant grant keeps, and for the same reason: if admission ever starts reading the label, a\n   * lagging sweep becomes an authorization hole rather than a stale display.\n   */\n  expiresAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * The SECOND administrator. Present on every `ACTIVE` row, by construction.\n   *\n   * Optional in the SCHEMA because it is unset while the request is pending and stays unset on a\n   * denied or revoked one. It is not optional in the LIFECYCLE: the only writer of\n   * `status = ACTIVE` is `approve`, and `approve` refuses when this would equal `operatorUserId`.\n   * That refusal is the two-person rule, and it lives in one predicate\n   * ({@link applicationAccessGrantApproverIsDistinct}) so no second call site can re-derive it\n   * more leniently.\n   */\n  approvedByUserId: z.string().min(1).optional().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  approvedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n\n  /**\n   * The ONE machine credential this elevation is for, when it is for a machine rather than the requester (#297).\n   *\n   * An application's audit read policy can require independent approval (`INDEPENDENT_APPROVAL`), and until\n   * 2026-09-13 that refused every machine outright: a grant was keyed on `operatorUserId` and a machine has no\n   * user. So the assurance collector — the reader such a policy most wants governed — could never read.\n   *\n   * When set, a HUMAN administrator requests the elevation ON BEHALF OF this credential, a second administrator\n   * signs exactly as for any other grant, and the admission admits that credential and NOBODY ELSE — in\n   * particular never the requester, who would otherwise have minted themselves a window by naming a machine.\n   * {@link applicationAccessGrantAdmits} is the one place that decision lives.\n   *\n   * Set at request time only, validated against a live application API key or OAuth client, and never updated:\n   * re-pointing a signed elevation at a different credential would be a grant nobody signed.\n   */\n  grantedMachineCredential: ExecutionContext_MachineCredentialSchema.optional().excludeFromUpdate().isAuditEvidence(),\n\n  /** The approver's reason for refusing, or the revoker's reason for withdrawing. */\n  // REMOVE — free text again, and clearable (`.optional()`).\n  decisionReason: addImpersonalizeWith(\n    z.string().max(1000).optional().excludeFromCreate().excludeFromUpdate()\n    .dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\n\nexport type ApplicationAccessGrant = z.infer<typeof ApplicationAccessGrantSchema>;\n\n/**\n * Clamp a requested duration to the application-wide ceiling.\n *\n * A deliberate near-copy of `resolvePlatformAccessGrantExpiry` rather than a shared function taking\n * two constants: the two ceilings are two DECISIONS about two different acts, and a shared helper\n * invites the next author to pass whichever constant is in scope. The behaviour that matters is\n * identical and stated in both places — a longer ask is CLAMPED, never refused, because being told\n * \"ask again with a smaller number\" during an incident is friction with no security benefit.\n */\nexport function resolveApplicationAccessGrantExpiry(requestedDurationMinutes: number | undefined, now: Date): Date {\n  const requested = requestedDurationMinutes && requestedDurationMinutes > 0\n    ? requestedDurationMinutes\n    : APPLICATION_ACCESS_GRANT_DEFAULT_DURATION_MINUTES;\n  const minutes = Math.min(requested, APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES);\n  return new Date(now.getTime() + minutes * 60_000);\n}\n\n/**\n * Does this grant admit this principal?\n *\n * **The one decision about WHO a grant is for**, because two principals now hold grants and each reading of the\n * row must agree:\n *\n *  - a grant bound to a machine credential admits exactly that credential (same method, same id) and nobody else —\n *    not its requester, not another credential, not a human carrying no credential;\n *  - an unbound grant admits exactly its requester, as a HUMAN: a machine principal carrying the requester's user\n *    id is not a thing the request pipeline builds, and admitting one would be a second way for a person to lend\n *    their elevation to a credential without a second signature naming it.\n *\n * Fails closed on every missing input. Usability of the WINDOW is a separate question (`isPlatformAccessGrantUsable`).\n */\nexport function applicationAccessGrantAdmits(params: {\n  readonly grant: {\n    readonly operatorUserId?: string | null;\n    readonly grantedMachineCredential?: { readonly authMethod: string; readonly credentialId: string } | null;\n  };\n  readonly principal: {\n    readonly userId?: string | null;\n    readonly machineCredential?: { readonly authMethod: string; readonly credentialId: string } | null;\n  };\n}): boolean {\n  const bound = params.grant.grantedMachineCredential;\n  const presented = params.principal.machineCredential;\n  if (bound) {\n    return Boolean(presented && presented.credentialId && presented.credentialId === bound.credentialId && presented.authMethod === bound.authMethod);\n  }\n  if (presented) return false;\n  const userId = String(params.principal.userId ?? '');\n  return Boolean(userId) && String(params.grant.operatorUserId ?? '') === userId;\n}\n\n/**\n * Is this approver a DIFFERENT person from the operator who asked?\n *\n * **This predicate is the two-person rule.** Everything else about an application-wide grant — the\n * request, the window, the justification, the audit row — exists in the tenant grant too. What is new\n * here is exactly this comparison, so it is named, exported, and asked in ONE place.\n *\n * ## Why it is a predicate and not an inline `!==`\n *\n * Three call sites would otherwise each write their own comparison, and two of the three ways to\n * write it are wrong in the same direction:\n *\n *  - an approver id that is ABSENT must NOT pass. An unauthenticated or system-context approval has\n *    no second person behind it, and `undefined !== 'operator'` is `true` — the inline form fails\n *    OPEN on precisely the input a broken context supplies;\n *  - an operator id that is absent must not pass either, for the mirror reason.\n *\n * So the predicate requires BOTH ids to be present and different. Fails closed on everything else.\n */\nexport function applicationAccessGrantApproverIsDistinct(params: {\n  readonly operatorUserId: string | undefined | null;\n  readonly approverUserId: string | undefined | null;\n}): boolean {\n  const operator = String(params.operatorUserId ?? '');\n  const approver = String(params.approverUserId ?? '');\n  if (!operator || !approver) return false;\n  return operator !== approver;\n}\n"]}
+{"version":3,"file":"application-access-grants.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/application-access-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,EAAE,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,EAAE,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,kCAYX;AAZD,WAAY,kCAAkC;IAC5C;;;OAGG;IACH,sEAAgC,CAAA;IAChC,sHAAsH;IACtH,yDAAmB,CAAA;IACnB,mDAAa,CAAA;IACb,uDAAiB,CAAA;IACjB,uFAAuF;IACvF,uDAAiB,CAAA;AACnB,CAAC,EAZW,kCAAkC,KAAlC,kCAAkC,QAY7C;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE9G,yGAAyG;IACzG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEzI;;;;;OAKG;IACH,mGAAmG;IACnG,iGAAiG;IACjG,yDAAyD;IACzD,aAAa,EAAE,oBAAoB,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;SAC3C,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,IAAI,EAClB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;SACtC,UAAU,CAAC,2BAA2B,CAAC;SACvC,OAAO,CAAC,yBAAyB,CAAC,gBAAgB,CAAC;SACnD,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;IAEpB;;;;;;;;OAQG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAE5G;;;;;;;;;OASG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IACxI,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEvE;;;;;;;;;;;;;;OAcG;IACH,wBAAwB,EAAE,wCAAwC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;IAEnH,mFAAmF;IACnF,2DAA2D;IAC3D,cAAc,EAAE,oBAAoB,CAClC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SACtE,cAAc,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAClD,aAAa,CAAC,MAAM,CACrB;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,wBAA4C,EAAE,GAAS;IACzG,MAAM,SAAS,GAAG,wBAAwB,IAAI,wBAAwB,GAAG,CAAC;QACxE,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,iDAAiD,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,iDAAiD,CAAC,CAAC;IACvF,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAS5C;IACC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC;IACrD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;IACpJ,CAAC;IACD,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wCAAwC,CAAC,MAGxD;IACC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,QAAQ,KAAK,QAAQ,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * Application Access Grants — time-bound, justified, TWO-PERSON-APPROVED elevation for an operator\n * act that names no single tenant.\n *\n * ## Which reads use this grant\n *\n * Actual application-wide grants always require a different administrator's approval. The general\n * directory and other application-wide read gates retain that requirement. The application audit\n * viewer instead defaults to its administrator-role gate, in production and development alike;\n * `auditTrail.applicationReadAccess = AuditApplicationReadAccess.INDEPENDENT_APPROVAL` explicitly\n * enrolls that viewer in this grant requirement. Role-based audit reads remain observed and do not\n * invent a grant id. The historical diagnosis below explains the general elevation mechanism, not\n * an assertion that every cross-tenant audit read must use it.\n *\n * ## The asymmetry this closes\n *\n * `platformAccessGrants` governs the NARROW act: one operator, one named tenant, one window. It is\n * the door `.claude/rules/administrative-continuity-floors.md` calls rungs 4–5 of the ladder, and it\n * works.\n *\n * The WIDE act was ungoverned. Measured 2026-09-09 and recorded on\n * `ScopeRootConfinementDisposition.UNCONFINED_APPLICATION_TIER_DIRECTORY`:\n *\n * | | per-row crossing | application-wide read |\n * |---|---|---|\n * | elevation required | a usable `platformAccessGrants` row | **none** |\n * | role tier | `APP_ADMIN_SUPER_ADMIN` | `APP_ADMIN_VIEWER` / `ORG_MEMBER` |\n * | evidence | `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, naming the grant | an observation naming no elevation |\n *\n * So the narrow act carried elevation and expiry and the widest read did not — and the wide one sat\n * at a strictly LOWER role tier. That is worse than \"not symmetric\"; it is the control inverted.\n *\n * ## Why a SEPARATE resource and not a `scope` field on the tenant grant\n *\n * Structural, not stylistic. A `platformAccessGrants` row is ORGANIZATIONS-scoped: its primary-scope\n * relationship carries `isPrimaryScope: true` on `organizationId`, every route is\n * `/organizations/{organizationId}/platform-access-grants/…`, and the tenant's ability to SEE and\n * REVOKE the row is exactly what that scope buys. An application-wide elevation names no tenant, so\n * the route has nothing to carry and the scope has nobody to serve. Adding a nullable\n * `organizationId` to make one row shape serve both would weaken the field whose presence IS the\n * tenant grant's control — which the finding explicitly refuses (\"do not weaken the per-row model to\n * make the two symmetric\").\n *\n * The engine's own precedent for a second scope over one lifecycle is `applicationAuditLogs` beside\n * `auditLogs`: a sibling resource type carrying ONE application parent, taking the route it needs and\n * leaving the existing door byte-identical.\n *\n * ## Why TWO-PERSON, and what was rejected\n *\n * Tenant approval is the industry ceiling (Microsoft Customer Lockbox, Google Access Approval) and it\n * is structurally unavailable here: there is no single customer to ask. `administrative-continuity-floors.md`\n * names the next-strongest control in as many words — *\"a second factor authenticates a session; only\n * a second signature constrains an authenticated operator\"* — and asks for a two-person rule on the\n * widest acts.\n *\n * Auto-approval was rejected: it is the tenant grant's default posture precisely BECAUSE a tenant can\n * opt in above it, and there is no such party here, so an auto-approved application-wide grant would\n * be a standing privilege with a request form in front of it.\n *\n * Confining the read to tenants the caller holds a grant for was rejected on MEASUREMENT rather than\n * cost: `users` rows carry no tenant column at all, so there is nothing for a tenant predicate to\n * bind to, and any junction-based confinement would also remove the tenant-less user — the person who\n * has just signed up and belongs to nobody — from the only surface that can find them.\n */\n\nimport { z } from 'zod';\nimport { ExecutionContext_MachineCredentialSchema } from '../../runtime/execution-context.shared.schemas';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\nimport { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';\n\n/** Fixed replacement for grant free-text that cannot be cleared (a `.min(1)` field). */\nconst ERASED_GRANT_TEXT = '[erased]';\n\n/**\n * The default life of an application-wide grant whose request names no duration.\n *\n * THIRTY minutes — half the tenant grant's default, and the halving is the point rather than a round\n * number. A tenant grant reaches ONE customer and the customer can see and revoke it; this one\n * reaches every customer at once and no customer can see it. The window is the only thing that ends\n * it early, so the unconsidered case gets the narrowest window a support interaction can still use.\n */\nexport const APPLICATION_ACCESS_GRANT_DEFAULT_DURATION_MINUTES = 30;\n\n/**\n * The maximum life of an application-wide grant, whatever a request asks for.\n *\n * ONE HOUR against the tenant grant's four. A four-hour window is defended there as \"a working\n * session, not a working week\" for an elevation into one tenant; the same reasoning gives a shorter\n * answer for an elevation into all of them. An operator who genuinely needs longer re-requests, and\n * a second administrator signs again — which is the record we want, and the reason a shorter ceiling\n * here costs no security and buys a second signature per hour of the widest access the system grants.\n */\nexport const APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES = 60;\n\n/**\n * Custom verbs. Mirrors `PlatformAccessGrants_Operations` deliberately — the same lifecycle,\n * so the same verbs, so a reader who knows one knows the other.\n *\n * There is no ordinary CREATE/UPDATE for the same reason: they would be a second, ungated path to the\n * server-authored fields whose server authorship IS the control.\n */\nexport enum ApplicationAccessGrants_Operations {\n  /**\n   * The bootstrap verb. Writes one row in `PENDING_APPROVAL` and NEVER in `ACTIVE` — see\n   * the `status` field below for why auto-approval has no member here.\n   */\n  REQUEST_ACCESS = 'requestAccess',\n  /** The SECOND administrator's signature. Refuses the requester — {@link applicationAccessGrantApproverIsDistinct}. */\n  APPROVE = 'approve',\n  DENY = 'deny',\n  REVOKE = 'revoke',\n  /** ACTIVE → EXPIRED, dispatched by the credential-expiry sweep and by nothing else. */\n  EXPIRE = 'expire',\n}\n\nexport const ApplicationAccessGrantSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The primary-scope parent — the deployment this elevation is inside.\n   *\n   * OPTIONAL, and that is a load-bearing copy of `applicationAuditLogs`' own shape rather than a\n   * looseness: declared MANDATORY the resource does not load at all on a Mongo-persisted deployment\n   * (the ZodToMongoose convertor refuses it and INIT dies on `zod_converter_schema_conversion_failed`).\n   * Addressing is carried by `isPrimaryScope` + `REQUIRES_CONTEXT` on the relationship, which is what\n   * the URL builder reads, so the route is identical either way.\n   */\n  applicationId: z.string().min(1).optional().isDBIndexed().isForeignKey().excludeFromUpdate().isAuditEvidence(),\n\n  /** The operator who requested the elevation. Server-authored from the session, never client-supplied. */\n  operatorUserId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * Why the operator needs application-wide reach. REQUIRED, like its tenant sibling, and here it\n   * carries more weight: it is the ONLY thing the approving administrator has to decide on. A tenant\n   * grant's approver knows their own tenant and their own support case; this approver knows nothing\n   * but this sentence.\n   */\n  // USER_CONTENT — free prose an OPERATOR typed. MASK rather than REMOVE on erasure: `.min(1)` makes\n  // it non-clearable, so a null would be rejected by the strict update-DTO parse the impersonalize\n  // writer runs, and a fixed non-empty string is accepted.\n  justification: addImpersonalizeWith(\n    z.string().min(1).max(1000).isSummaryField()\n    .dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.MASK,\n    { maskValue: ERASED_GRANT_TEXT },\n  ),\n\n  /**\n   * Lifecycle position, sharing {@link PlatformAccessGrantStatus} rather than declaring a parallel\n   * vocabulary — the states really are the same states, and two enums holding the same five members\n   * is how a sweep, a predicate and a UI come to disagree about what `active` means.\n   *\n   * ## The member that is UNREACHABLE here, and why that is the control\n   *\n   * Every application-wide grant starts `PENDING_APPROVAL`. There is no auto-approval path and\n   * therefore no `autoApprovalReason` field: the tenant grant auto-approves when the tenant has not\n   * opted into approval, or cannot approve — both are statements about a NAMED tenant, and this row\n   * names none. A grant that could approve itself would make the two-person rule ceremonial, which is\n   * exactly the criticism `approve` on the tenant resource carries against platform self-approval.\n   */\n  status: z.enum(PlatformAccessGrantStatus)\n    .systemEnum('PlatformAccessGrantStatus')\n    .default(PlatformAccessGrantStatus.PENDING_APPROVAL)\n    .isDBIndexed()\n    .isSummaryField()\n    .excludeFromCreate()\n    .excludeFromUpdate()\n    .isAuditEvidence(),\n\n  /**\n   * When the elevation stops working.\n   *\n   * Server-authored from the requested duration, clamped to\n   * {@link APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES}. The admission predicate reads THIS\n   * field and not `status`, so expiry needs no sweeper to take effect — the same separation the\n   * tenant grant keeps, and for the same reason: if admission ever starts reading the label, a\n   * lagging sweep becomes an authorization hole rather than a stale display.\n   */\n  expiresAt: z.date().isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n\n  /**\n   * The SECOND administrator. Present on every `ACTIVE` row, by construction.\n   *\n   * Optional in the SCHEMA because it is unset while the request is pending and stays unset on a\n   * denied or revoked one. It is not optional in the LIFECYCLE: the only writer of\n   * `status = ACTIVE` is `approve`, and `approve` refuses when this would equal `operatorUserId`.\n   * That refusal is the two-person rule, and it lives in one predicate\n   * ({@link applicationAccessGrantApproverIsDistinct}) so no second call site can re-derive it\n   * more leniently.\n   */\n  approvedByUserId: z.string().min(1).optional().isForeignKey().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n  approvedAt: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n\n  /**\n   * The ONE machine credential this elevation is for, when it is for a machine rather than the requester (#297).\n   *\n   * An application's audit read policy can require independent approval (`INDEPENDENT_APPROVAL`), and until\n   * 2026-09-13 that refused every machine outright: a grant was keyed on `operatorUserId` and a machine has no\n   * user. So the assurance collector — the reader such a policy most wants governed — could never read.\n   *\n   * When set, a HUMAN administrator requests the elevation ON BEHALF OF this credential, a second administrator\n   * signs exactly as for any other grant, and the admission admits that credential and NOBODY ELSE — in\n   * particular never the requester, who would otherwise have minted themselves a window by naming a machine.\n   * {@link applicationAccessGrantAdmits} is the one place that decision lives.\n   *\n   * Set at request time only, validated against a live application API key or OAuth client, and never updated:\n   * re-pointing a signed elevation at a different credential would be a grant nobody signed.\n   */\n  grantedMachineCredential: ExecutionContext_MachineCredentialSchema.optional().excludeFromUpdate().isAuditEvidence(),\n\n  /** The approver's reason for refusing, or the revoker's reason for withdrawing. */\n  // REMOVE — free text again, and clearable (`.optional()`).\n  decisionReason: addImpersonalizeWith(\n    z.string().max(1000).optional().excludeFromCreate().excludeFromUpdate()\n    .dataCategories(PersonalDataCategory.USER_CONTENT),\n    RedactionType.REMOVE,\n  ),\n\n  createdAt: z.date().optional(),\n  updatedAt: z.date().optional(),\n});\n\nexport type ApplicationAccessGrant = z.infer<typeof ApplicationAccessGrantSchema>;\n\n/**\n * Clamp a requested duration to the application-wide ceiling.\n *\n * A deliberate near-copy of `resolvePlatformAccessGrantExpiry` rather than a shared function taking\n * two constants: the two ceilings are two DECISIONS about two different acts, and a shared helper\n * invites the next author to pass whichever constant is in scope. The behaviour that matters is\n * identical and stated in both places — a longer ask is CLAMPED, never refused, because being told\n * \"ask again with a smaller number\" during an incident is friction with no security benefit.\n */\nexport function resolveApplicationAccessGrantExpiry(requestedDurationMinutes: number | undefined, now: Date): Date {\n  const requested = requestedDurationMinutes && requestedDurationMinutes > 0\n    ? requestedDurationMinutes\n    : APPLICATION_ACCESS_GRANT_DEFAULT_DURATION_MINUTES;\n  const minutes = Math.min(requested, APPLICATION_ACCESS_GRANT_MAXIMUM_DURATION_MINUTES);\n  return new Date(now.getTime() + minutes * 60_000);\n}\n\n/**\n * Does this grant admit this principal?\n *\n * **The one decision about WHO a grant is for**, because two principals now hold grants and each reading of the\n * row must agree:\n *\n *  - a grant bound to a machine credential admits exactly that credential (same method, same id) and nobody else —\n *    not its requester, not another credential, not a human carrying no credential;\n *  - an unbound grant admits exactly its requester, as a HUMAN: a machine principal carrying the requester's user\n *    id is not a thing the request pipeline builds, and admitting one would be a second way for a person to lend\n *    their elevation to a credential without a second signature naming it.\n *\n * Fails closed on every missing input. Usability of the WINDOW is a separate question (`isPlatformAccessGrantUsable`).\n */\nexport function applicationAccessGrantAdmits(params: {\n  readonly grant: {\n    readonly operatorUserId?: string | null;\n    readonly grantedMachineCredential?: { readonly authMethod: string; readonly credentialId: string } | null;\n  };\n  readonly principal: {\n    readonly userId?: string | null;\n    readonly machineCredential?: { readonly authMethod: string; readonly credentialId: string } | null;\n  };\n}): boolean {\n  const bound = params.grant.grantedMachineCredential;\n  const presented = params.principal.machineCredential;\n  if (bound) {\n    return Boolean(presented && presented.credentialId && presented.credentialId === bound.credentialId && presented.authMethod === bound.authMethod);\n  }\n  if (presented) return false;\n  const userId = String(params.principal.userId ?? '');\n  return Boolean(userId) && String(params.grant.operatorUserId ?? '') === userId;\n}\n\n/**\n * Is this approver a DIFFERENT person from the operator who asked?\n *\n * **This predicate is the two-person rule.** Everything else about an application-wide grant — the\n * request, the window, the justification, the audit row — exists in the tenant grant too. What is new\n * here is exactly this comparison, so it is named, exported, and asked in ONE place.\n *\n * ## Why it is a predicate and not an inline `!==`\n *\n * Three call sites would otherwise each write their own comparison, and two of the three ways to\n * write it are wrong in the same direction:\n *\n *  - an approver id that is ABSENT must NOT pass. An unauthenticated or system-context approval has\n *    no second person behind it, and `undefined !== 'operator'` is `true` — the inline form fails\n *    OPEN on precisely the input a broken context supplies;\n *  - an operator id that is absent must not pass either, for the mirror reason.\n *\n * So the predicate requires BOTH ids to be present and different. Fails closed on everything else.\n */\nexport function applicationAccessGrantApproverIsDistinct(params: {\n  readonly operatorUserId: string | undefined | null;\n  readonly approverUserId: string | undefined | null;\n}): boolean {\n  const operator = String(params.operatorUserId ?? '');\n  const approver = String(params.approverUserId ?? '');\n  if (!operator || !approver) return false;\n  return operator !== approver;\n}\n"]}

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAQlD,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAE5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,+DAA+D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;kBAuU1H,CAAC"}
+{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAQlD,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAE5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,+DAA+D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;kBAuU1H,CAAC"}

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAW1H,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAChI,0CAA0C,CAIxC;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;OAQG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QAEtC;;;;;;;;;;;;;;;WAeG;QACH,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;QACjC,uFAAuF;QACvF,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB;;;;;;;;WAQG;QAEH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,mBAAmB;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;WAaG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,+BAA+B,CAAC,cAAc,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C;;;;;;;;;;;;;;;uBAeG;oBACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBACvP,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,uFAAuF;oBACvF,sFAAsF;oBACtF,iEAAiE;oBACjE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,0FAA0F;oBAC1F,sEAAsE;oBACtE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE;YACtC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED;;;;;;;WAOG;QACH;;;;;;;;;WASG;QACH,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;KACF;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,+FAA+F;IAC/F,wEAAwE;CACzE,CAAC,CAAC","sourcesContent":["/**\n * Platform Access Grants — resource configuration.\n *\n * The operation set is unusual and the asymmetry is the point: the PLATFORM requests, the TENANT\n * decides. No verb lets one side do the other's job.\n *\n *   requestAccess  — platform-tier, crosses the tenant boundary\n *   approve / deny — the TARGET tenant's own administrators, never platform-tier\n *   revoke         — either side, because either may end an elevation early\n *\n * See `platform-access-grants.shared.schemas.ts` for why the resource exists at all (rungs 4–5 of\n * the operator-access ladder in `.claude/rules/administrative-continuity-floors.md`) and\n * `.claude/plans/platform-access-grants-jit-elevation.md` for the remaining steps.\n */\n\nimport { z } from 'zod';\nimport { PlatformAccessGrantSchema, PlatformAccessGrantStatus, PlatformAccessGrants_Operations } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n\ntype PlatformAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const platformAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof PlatformAccessGrants_Operations,\n    PlatformAccessGrantsCoreOperations,\n    typeof PlatformAccessGrantSchema\n  >({\n    mainSchema: PlatformAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.PLATFORM_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.PLATFORM_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` are ALLOWED for the trusted path because the authorization layer itself has to\n     * resolve a caller's usable grant before admitting a crossing, and it does so on a system context\n     * — the caller is by definition not a member of the tenant whose grants are being read.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the tenant policy and the continuity-floor measurement. A system door around those would be a\n     * second way to mint an elevation, which is the one thing this resource exists to prevent.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n\n      /**\n       * Subject-export disclosure — FORBIDDEN, and the declaration is REQUIRED rather than optional.\n       *\n       * `operatorUserId` and `approvedByUserId` are foreign keys back to USERS, so\n       * `classifySubjectExportDisposition` puts these rows on a user's Art. 15 graph as\n       * `INCLUDED_REFERENCES_SUBJECT` — personal data CONCERNING the subject even though the subject\n       * does not own it. An included resource carrying NO declaration REFUSES the entire export, so\n       * omitting this would trade a frontend boot failure for a broken disclosure right.\n       *\n       * FORBIDDEN for the reason AUDIT_LOGS is: this is a security/operational monitoring record, and\n       * handing the monitoring trail to the person it monitors is self-defeating. It is also not only\n       * about them — a grant names the TENANT's approver and carries the tenant's decision reason, so\n       * disclosing it to the operator would expose another data subject's decision (Art. 15(4)).\n       * FORBIDDEN rows are left OUT of the bundle and RECORDED with that reason, never silently\n       * dropped, so the report still answers \"why is this missing?\".\n       */\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text.\n     *\n     * Note this is a DIFFERENT question from the `exportSubject: FORBIDDEN` above, and the two answers\n     * differ deliberately. That one asks whether the monitored operator may READ the monitoring trail —\n     * no. This one asks what erasure DOES to the row, and nothing here says erasure must not reach it.\n     *\n     * The grant survives because its security value is WHO reached WHICH tenant, WHEN, and under whose\n     * approval — none of which is scrubbed. What does not survive is `justification` and `decisionReason`:\n     * operator- and approver-written prose, and the surface most likely to name a third party in passing.\n     * That makes the erasure narrow rather than destructive of the record.\n     *\n     * Contrast `auditLogs`, which is exempt outright: it is the immutable ledger of what happened,\n     * including this erasure, so scrubbing it would destroy the evidence the erasure was performed.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The grant is a record ABOUT an operator's access, not\n     * the operator; their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n      // Present for the tenant-purge cascade ONLY — see the operation's configuration below.\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be REPOSITORY_ONLY: the\n\n       * retention primitives resolve through `getServiceOperationPathDefault`, which matches only\n\n       * INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize writer uses to stamp markers.\n\n       */\n\n      [CoreResourceOperation.UPDATE_MANY]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n        }],\n\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            // Both sides read the same row through the same door: a tenant admin sees elevations\n            // raised against their tenant (the consent record is worthless if the consenting party\n            // cannot see it), and the platform sees the ones it raised. The ORGANIZATIONS scope does\n            // the tenant separation; the platform reaches it through the cross-tenant admission on\n            // the verbs below.\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * PURGE ONLY — there is deliberately no `API_CALL` variant, so no client can delete a grant.\n       *\n       * The verb exists because grants are a COMPOSITION child of ORGANIZATIONS with\n       * `onParentDelete` enabled, and a cascade can only call an operation the child actually\n       * declares. Without it the registry's composition-cascade-deletability guard fails — correctly:\n       * the cascade would have been declared and then silently unable to run, leaving grant rows\n       * behind after their tenant was purged.\n       *\n       * Route-less is the whole point of the shape. `INTERNAL_CALL` mirrors `organizations.delete`'s\n       * own default: the tenant purge may remove these rows, and nobody else may. Erasing a consent\n       * record through an API would let either party rewrite the history of an access decision, which\n       * is exactly what this resource exists to make impossible.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb, and the ONE operation here that must stay reachable without an existing\n       * grant — otherwise the mechanism cannot start: an operator would need an elevation to request\n       * an elevation. It therefore declares `admitsCrossTenantPlatformAdministration` and must be\n       * explicitly exempted when the admission predicate later starts requiring a usable grant\n       * (Step 4 of the plan). That exemption is load-bearing and gets its own pin.\n       *\n       * What keeps the exemption safe is that requesting is not accessing: this verb writes a row in\n       * `PENDING_APPROVAL` (or `ACTIVE` when the tenant has not opted into approval) and touches\n       * nothing else in the tenant. The blast radius of an abused request is a notification and an\n       * audit row naming the operator.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — elevation is requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [PlatformAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            admitsCrossTenantPlatformAdministration: true,\n            /**\n             * `organizationId` deliberately does NOT appear in this body DTO. The organization is\n             * already the mandatory primary-scope path segment and the execution-context creator\n             * validates that URL value before dispatch. Requiring it again in JSON made clients\n             * author the same security-critical target twice and created an avoidable mismatch case.\n             *\n             * WHERE AN OPERATOR GETS the path id is still a deliberate product decision. There is\n             * no in-product surface that lists organizations the operator does not belong to:\n             * `organizations | LIST` is confined to the caller's own memberships. The id therefore\n             * arrives with the customer support case, where it is also present in support URLs,\n             * organization notifications and the audit trail.\n             *\n             * Do not widen `organizations | LIST` to make discovery convenient: a browsable\n             * directory is the customer list and would restore the standing cross-tenant\n             * visibility this workflow exists to avoid.\n             */\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 4h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional().describe(\"How long the access lasts, in whole minutes, counted from this request rather than from approval. Defaults to 60; a longer request is reduced to 240 rather than refused.\"),\n            }),\n          },\n        ],\n        userNotifications: [\n          {\n            // The tenant learns immediately that an operator asked for access — before it happens,\n            // not after. Under the approval posture this notification IS the request; without it,\n            // opting in would give a tenant a decision it never hears about.\n            target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n            channel: CoreUserNotificationChannel.EMAIL,\n          },\n        ],\n      },\n\n      /**\n       * The tenant's decision. Gated on the TENANT's own roles and deliberately NOT reachable by the\n       * platform: an operator who could approve their own request would make the whole Lockbox\n       * posture ceremonial. Note the absence of `admitsCrossTenantPlatformAdministration` here — that\n       * absence is the control, so do not add it \"for symmetry\".\n       */\n      [PlatformAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            // Only a request still awaiting a decision can be decided. Fails closed server-side, so a\n            // replayed approval cannot revive a denied, revoked or expired grant.\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      [PlatformAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /**\n       * Ending an elevation early. Reachable by BOTH sides, which is why it carries the cross-tenant\n       * admission while `approve`/`deny` do not: a tenant revokes access it granted, and an operator\n       * closes out their own session rather than leaving a live window open until it lapses.\n       *\n       * Revoking is monotonic — it only ever removes authority — so admitting the platform side costs\n       * nothing the reversibility test would object to.\n       */\n      /**\n       * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and\n       * by nothing else (#413). INTERNAL_CALL: no route, no frontend affordance, and therefore no\n       * `admitsCrossTenantPlatformAdministration` — the tenant-boundary question does not arise for\n       * an operation no request can reach.\n       *\n       * The transition precondition lives in the paired implementation, which permits it only from\n       * ACTIVE: a grant the tenant DENIED or REVOKED must keep saying so, and relabelling a\n       * terminal grant would rewrite the decision history a customer audit reads.\n       */\n      [PlatformAccessGrants_Operations.EXPIRE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n            // and the paired prefix implementation forces the status transition itself, so there is no field\n            // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n            // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n            // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n            requestDto: z.object({}),\n          },\n        ],\n      },\n\n      [PlatformAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            admitsCrossTenantPlatformAdministration: true,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n    },\n    // NOTE: the ORGANIZATIONS primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (ORGANIZATIONS → PLATFORM_ACCESS_GRANTS), which is\n    // the single place scope is expressed for every resource. Declaring it twice would let the two\n    // drift, and the relationship is the one the authorizer actually reads.\n  });\n"]}
+{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAW1H,MAAM,CAAC,MAAM,+DAA+D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAChI,0CAA0C,CAIxC;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,sBAAsB;IAC3D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IACpG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;OAQG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QAEtC;;;;;;;;;;;;;;;WAeG;QACH,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;;;;;;;;OAcG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;QACjC,uFAAuF;QACvF,qBAAqB,CAAC,MAAM;KAC7B;IAED,uBAAuB,EAAE;QAEvB;;;;;;;;WAQG;QAEH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YAEnC,QAAQ,EAAE,CAAC;oBAET,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBAEvD,SAAS,EAAE,IAAI;oBAEf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAE7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAE/C,CAAC;SAEH;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,uFAAuF;oBACvF,mBAAmB;oBACnB,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;WAaG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,+BAA+B,CAAC,cAAc,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C;;;;;;;;;;;;;;;uBAeG;oBACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2KAA2K,CAAC;qBACvP,CAAC;iBACH;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,uFAAuF;oBACvF,sFAAsF;oBACtF,iEAAiE;oBACjE,MAAM,EAAE,0BAA0B,CAAC,kBAAkB;oBACrD,OAAO,EAAE,2BAA2B,CAAC,KAAK;iBAC3C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,0FAA0F;oBAC1F,sEAAsE;oBACtE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE;YACtC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED;;;;;;;WAOG;QACH;;;;;;;;;WASG;QACH,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,iGAAiG;oBACjG,iGAAiG;oBACjG,iGAAiG;oBACjG,kGAAkG;oBAClG,gGAAgG;oBAChG,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;QAED,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE;YACxC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,mCAAmC,CAAC;oBACrF,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,uCAAuC,EAAE,IAAI;oBAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;KACF;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,+FAA+F;IAC/F,wEAAwE;CACzE,CAAC,CAAC","sourcesContent":["/**\n * Platform Access Grants — resource configuration.\n *\n * The operation set is unusual and the asymmetry is the point: the PLATFORM requests, the TENANT\n * decides. No verb lets one side do the other's job.\n *\n *   requestAccess  — platform-tier, crosses the tenant boundary\n *   approve / deny — the TARGET tenant's own administrators, never platform-tier\n *   revoke         — either side, because either may end an elevation early\n *\n * See `platform-access-grants.shared.schemas.ts` for why the resource exists at all (rungs 4–5 of\n * the operator-access ladder in `.claude/rules/administrative-continuity-floors.md`) and\n * `.claude/plans/platform-access-grants-jit-elevation.md` for the remaining steps.\n */\n\nimport { z } from 'zod';\nimport { PlatformAccessGrantSchema, PlatformAccessGrantStatus, PlatformAccessGrants_Operations } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '../../notifications/notifications.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\n\ntype PlatformAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const platformAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof PlatformAccessGrants_Operations,\n    PlatformAccessGrantsCoreOperations,\n    typeof PlatformAccessGrantSchema\n  >({\n    mainSchema: PlatformAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.PLATFORM_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.PLATFORM_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` are ALLOWED for the trusted path because the authorization layer itself has to\n     * resolve a caller's usable grant before admitting a crossing, and it does so on a system context\n     * — the caller is by definition not a member of the tenant whose grants are being read.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the tenant policy and the continuity-floor measurement. A system door around those would be a\n     * second way to mint an elevation, which is the one thing this resource exists to prevent.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n\n      /**\n       * Subject-export disclosure — FORBIDDEN, and the declaration is REQUIRED rather than optional.\n       *\n       * `operatorUserId` and `approvedByUserId` are foreign keys back to USERS, so\n       * `classifySubjectExportDisposition` puts these rows on a user's Art. 15 graph as\n       * `INCLUDED_REFERENCES_SUBJECT` — personal data CONCERNING the subject even though the subject\n       * does not own it. An included resource carrying NO declaration REFUSES the entire export, so\n       * omitting this would trade a frontend boot failure for a broken disclosure right.\n       *\n       * FORBIDDEN for the reason AUDIT_LOGS is: this is a security/operational monitoring record, and\n       * handing the monitoring trail to the person it monitors is self-defeating. It is also not only\n       * about them — a grant names the TENANT's approver and carries the tenant's decision reason, so\n       * disclosing it to the operator would expose another data subject's decision (Art. 15(4)).\n       * FORBIDDEN rows are left OUT of the bundle and RECORDED with that reason, never silently\n       * dropped, so the report still answers \"why is this missing?\".\n       */\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text.\n     *\n     * Note this is a DIFFERENT question from the `exportSubject: FORBIDDEN` above, and the two answers\n     * differ deliberately. That one asks whether the monitored operator may READ the monitoring trail —\n     * no. This one asks what erasure DOES to the row, and nothing here says erasure must not reach it.\n     *\n     * The grant survives because its security value is WHO reached WHICH tenant, WHEN, and under whose\n     * approval — none of which is scrubbed. What does not survive is `justification` and `decisionReason`:\n     * operator- and approver-written prose, and the surface most likely to name a third party in passing.\n     * That makes the erasure narrow rather than destructive of the record.\n     *\n     * Contrast `auditLogs`, which is exempt outright: it is the immutable ledger of what happened,\n     * including this erasure, so scrubbing it would destroy the evidence the erasure was performed.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these rows revokes NO session. The grant is a record ABOUT an operator's access, not\n     * the operator; their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n      // Present for the tenant-purge cascade ONLY — see the operation's configuration below.\n      CoreResourceOperation.DELETE,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be REPOSITORY_ONLY: the\n\n       * retention primitives resolve through `getServiceOperationPathDefault`, which matches only\n\n       * INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize writer uses to stamp markers.\n\n       */\n\n      [CoreResourceOperation.UPDATE_MANY]: {\n\n        variants: [{\n\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n\n          isDefault: true,\n\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n\n        }],\n\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            // Both sides read the same row through the same door: a tenant admin sees elevations\n            // raised against their tenant (the consent record is worthless if the consenting party\n            // cannot see it), and the platform sees the ones it raised. The ORGANIZATIONS scope does\n            // the tenant separation; the platform reaches it through the cross-tenant admission on\n            // the verbs below.\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * PURGE ONLY — there is deliberately no `API_CALL` variant, so no client can delete a grant.\n       *\n       * The verb exists because grants are a COMPOSITION child of ORGANIZATIONS with\n       * `onParentDelete` enabled, and a cascade can only call an operation the child actually\n       * declares. Without it the registry's composition-cascade-deletability guard fails — correctly:\n       * the cascade would have been declared and then silently unable to run, leaving grant rows\n       * behind after their tenant was purged.\n       *\n       * Route-less is the whole point of the shape. `INTERNAL_CALL` mirrors `organizations.delete`'s\n       * own default: the tenant purge may remove these rows, and nobody else may. Erasing a consent\n       * record through an API would let either party rewrite the history of an access decision, which\n       * is exactly what this resource exists to make impossible.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb, and the ONE operation here that must stay reachable without an existing\n       * grant — otherwise the mechanism cannot start: an operator would need an elevation to request\n       * an elevation. It therefore declares `admitsCrossTenantPlatformAdministration` and must be\n       * explicitly exempted when the admission predicate later starts requiring a usable grant\n       * (Step 4 of the plan). That exemption is load-bearing and gets its own pin.\n       *\n       * What keeps the exemption safe is that requesting is not accessing: this verb writes a row in\n       * `PENDING_APPROVAL` (or `ACTIVE` when the tenant has not opted into approval) and touches\n       * nothing else in the tenant. The blast radius of an abused request is a notification and an\n       * audit row naming the operator.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — elevation is requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [PlatformAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            admitsCrossTenantPlatformAdministration: true,\n            /**\n             * `organizationId` deliberately does NOT appear in this body DTO. The organization is\n             * already the mandatory primary-scope path segment and the execution-context creator\n             * validates that URL value before dispatch. Requiring it again in JSON made clients\n             * author the same security-critical target twice and created an avoidable mismatch case.\n             *\n             * WHERE AN OPERATOR GETS the path id is still a deliberate product decision. There is\n             * no in-product surface that lists organizations the operator does not belong to:\n             * `organizations | LIST` is confined to the caller's own memberships. The id therefore\n             * arrives with the customer support case, where it is also present in support URLs,\n             * organization notifications and the audit trail.\n             *\n             * Do not widen `organizations | LIST` to make discovery convenient: a browsable\n             * directory is the customer list and would restore the standing cross-tenant\n             * visibility this workflow exists to avoid.\n             */\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 4h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional().describe(\"How long the access lasts, in whole minutes, counted from this request rather than from approval. Defaults to 60; a longer request is reduced to 240 rather than refused.\"),\n            }),\n          },\n        ],\n        userNotifications: [\n          {\n            // The tenant learns immediately that an operator asked for access — before it happens,\n            // not after. Under the approval posture this notification IS the request; without it,\n            // opting in would give a tenant a decision it never hears about.\n            target: CoreUserNotificationTarget.ORGANIZATION_USERS,\n            channel: CoreUserNotificationChannel.EMAIL,\n          },\n        ],\n      },\n\n      /**\n       * The tenant's decision. Gated on the TENANT's own roles and deliberately NOT reachable by the\n       * platform: an operator who could approve their own request would make the whole Lockbox\n       * posture ceremonial. Note the absence of `admitsCrossTenantPlatformAdministration` here — that\n       * absence is the control, so do not add it \"for symmetry\".\n       */\n      [PlatformAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            // Only a request still awaiting a decision can be decided. Fails closed server-side, so a\n            // replayed approval cannot revive a denied, revoked or expired grant.\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      [PlatformAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /**\n       * Ending an elevation early. Reachable by BOTH sides, which is why it carries the cross-tenant\n       * admission while `approve`/`deny` do not: a tenant revokes access it granted, and an operator\n       * closes out their own session rather than leaving a live window open until it lapses.\n       *\n       * Revoking is monotonic — it only ever removes authority — so admitting the platform side costs\n       * nothing the reversibility test would object to.\n       */\n      /**\n       * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and\n       * by nothing else (#413). INTERNAL_CALL: no route, no frontend affordance, and therefore no\n       * `admitsCrossTenantPlatformAdministration` — the tenant-boundary question does not arise for\n       * an operation no request can reach.\n       *\n       * The transition precondition lives in the paired implementation, which permits it only from\n       * ACTIVE: a grant the tenant DENIED or REVOKED must keep saying so, and relabelling a\n       * terminal grant would rewrite the decision history a customer audit reads.\n       */\n      [PlatformAccessGrants_Operations.EXPIRE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            // EMPTY BY CONTRACT, not by omission. The credential-expiry sweep dispatches this verb with `{}`\n            // and the paired prefix implementation forces the status transition itself, so there is no field\n            // a caller may supply. Declaring nothing is NOT the same as declaring this: an operation without\n            // a `requestDto` inherits the resource's ENTIRE update contract, which would let an INTERNAL_CALL\n            // that accepts nothing advertise every field — `status` included, the one field this verb owns.\n            requestDto: z.object({}),\n          },\n        ],\n      },\n\n      [PlatformAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            admitsCrossTenantPlatformAdministration: true,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n    },\n    // NOTE: the ORGANIZATIONS primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (ORGANIZATIONS → PLATFORM_ACCESS_GRANTS), which is\n    // the single place scope is expressed for every resource. Declaring it twice would let the two\n    // drift, and the relationship is the one the authorizer actually reads.\n  });\n"]}

package/dist/esm/security/authorizations/platform-access-grants.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-access-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/authorizations/platform-access-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;GAaG;AACH,oBAAY,wBAAwB;IAClC,yGAAyG;IACzG,MAAM,WAAW;IACjB;;;OAGG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;GAKG;AACH,oBAAY,yBAAyB;IACnC,wFAAwF;IACxF,gBAAgB,qBAAqB;IACrC,yFAAyF;IACzF,MAAM,WAAW;IACjB,gGAAgG;IAChG,MAAM,WAAW;IACjB;;;;;;;;;OASG;IACH,OAAO,YAAY;IACnB,2EAA2E;IAC3E,OAAO,YAAY;CACpB;AAED;;;;;;;GAOG;AACH,oBAAY,sCAAsC;IAChD,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB;;;;;;;;;OASG;IACH,OAAO,YAAY;CACpB;AAED,yGAAyG;AACzG,oBAAY,qCAAqC;IAC/C,kGAAkG;IAClG,4BAA4B,iCAAiC;IAC7D;;;;;OAKG;IACH,qBAAqB,0BAA0B;CAChD;AAKD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,8CAA8C,KAAK,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,8CAA8C,MAAM,CAAC;AAElE,0DAA0D;AAC1D,eAAO,MAAM,wCAAwC,EAAE,SAAS,yBAAyB,EAGxF,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;iBAiFpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,SAAS,EACpE,GAAG,EAAE,IAAI,GACR,OAAO,CAMT;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAM9G;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,oBAAY,+BAA+B;IACzC,cAAc,kBAAkB;IAChC,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB;;;;OAIG;IACH,MAAM,WAAW;CAClB"}
+{"version":3,"file":"platform-access-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;GAaG;AACH,oBAAY,wBAAwB;IAClC,yGAAyG;IACzG,MAAM,WAAW;IACjB;;;OAGG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;GAKG;AACH,oBAAY,yBAAyB;IACnC,wFAAwF;IACxF,gBAAgB,qBAAqB;IACrC,yFAAyF;IACzF,MAAM,WAAW;IACjB,gGAAgG;IAChG,MAAM,WAAW;IACjB;;;;;;;;;OASG;IACH,OAAO,YAAY;IACnB,2EAA2E;IAC3E,OAAO,YAAY;CACpB;AAED;;;;;;;GAOG;AACH,oBAAY,sCAAsC;IAChD,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB;;;;;;;;;OASG;IACH,OAAO,YAAY;CACpB;AAED,yGAAyG;AACzG,oBAAY,qCAAqC;IAC/C,kGAAkG;IAClG,4BAA4B,iCAAiC;IAC7D;;;;;OAKG;IACH,qBAAqB,0BAA0B;CAChD;AAKD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,8CAA8C,KAAK,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,8CAA8C,MAAM,CAAC;AAElE,0DAA0D;AAC1D,eAAO,MAAM,wCAAwC,EAAE,SAAS,yBAAyB,EAGxF,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;iBAiFpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,SAAS,EACpE,GAAG,EAAE,IAAI,GACR,OAAO,CAMT;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAM9G;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,oBAAY,+BAA+B;IACzC,cAAc,kBAAkB;IAChC,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB;;;;OAIG;IACH,MAAM,WAAW;CAClB"}