@wildo-ai/saas-models 1.1.8 → 1.1.10

package/dist/esm/security/authentications/service-provider-client-authentication.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-provider-client-authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/service-provider-client-authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,kCAAkC,EAAE,MAAM,kDAAkD,CAAC;AAEtG,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAE9G,uIAAuI;AACvI,4FAA4F;AAC5F,MAAM,CAAN,IAAY,wBAQX;AARD,WAAY,wBAAwB;IAClC,uGAAuG;IACvG,iEAAqC,CAAA;IACrC;;;OAGG;IACH,yEAA6C,CAAA;AAC/C,CAAC,EARW,wBAAwB,KAAxB,wBAAwB,QAQnC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,2EAA2E;IAC3E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,+GAA+G;IAC/G,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,iFAAiF;IACjF,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,wFAAwF;IACxF,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;CACjC,CAAC,CAAC;AAGH,iEAAiE;AACjE,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5E,oBAAoB,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAyC;IAC9E,GAAG,EAAE,UAAU,CAAC,OAAO;IACvB,GAAG,EAAE,UAAU,CAAC,IAAI;IACpB,GAAG,EAAE,UAAU,CAAC,OAAO;CACxB,CAAC;AAeF;;;;;;GAMG;AACH,MAAM,UAAU,2CAA2C,CAAC,YAAgC;IAC1F,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC;IACvC,OAAO;QACL,oBAAoB,EAAE,YAAY,CAAC,SAAS,EAAE,UAAU,KAAK,IAAI;QACjE,eAAe,EAAE,kCAAkC,CAAC,YAAY,CAAC;QACjE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,WAAiD,EAAE,EAAQ,EAAE,GAAS;IAC1F,IAAI,WAAW,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,WAAW,CAAC,aAAa,GAAG,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAOzC;IACC,MAAM,eAAe,GAAG,CAAC,QAAgC,EAAW,EAAE,CACpE,QAAQ,CAAC,MAAM,KAAK,wBAAwB,CAAC,oBAAoB;WAC9D,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,KAAK,uBAAuB,CAAC,sBAAsB;eACrF,QAAQ,CAAC,8BAA8B,KAAK,KAAK,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC9C,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;WAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;WAC3D,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC;WAChE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC3D,IAAI,YAAY,CAAC,gBAAgB,KAAK,uBAAuB,CAAC,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACvG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,8BAA8B,KAAK,YAAY,CAAC,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACnH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChF,+GAA+G;IAC/G,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;SAC7D,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5F,CAAC;AACD,qFAAqF","sourcesContent":["/**\n * A client organization's authentication policy, evaluated when a service firm's expert ACTS in it (#1633).\n *\n * ## The shape of the problem\n *\n * The firm and the client are two tenants of ONE application. An organization type's `authOverrides` are resolved at\n * LOGIN, as a user-global most-restrictive intersection over every active membership — so a provider membership\n * (#1597) left in that intersection would feed every client's policy into the expert's sign-in: an expert serving 200\n * clients would be held to the strictest of 200 policies for firm-only work, and one client disabling a method the\n * firm relies on would lock them out entirely. And no client's policy would ever be evaluated when the expert actually\n * acts in that client.\n *\n * So provider memberships leave the login-time intersection, and the CLIENT's policy is evaluated per request, for the\n * organization the request targets, against what the session has satisfied FOR THAT ORGANIZATION. The pure half of\n * that evaluation is here; the store and the request wiring are backend.\n *\n * ## What counts as satisfying a client\n *\n * - A factor proven to THIS application FOR THIS CLIENT (a step-up answered while the request targeted it) —\n *   {@link FactorSatisfactionSource.THIS_APPLICATION}. A factor completed at sign-in satisfied the EXPERT's own\n *   policy, not the client's, and does not count; neither does one satisfied for another client. This is the\n *   resource-tenant posture Microsoft Entra B2B takes when inbound MFA trust is off.\n * - When the client trusts the firm's MFA on this relationship, a factor the FIRM's enterprise identity provider\n *   reported in the expert's sign-in — {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED} — provided it maps to a\n *   method the client's policy accepts. The client's minimum strength therefore still applies under trust.\n *\n * Every satisfied factor is recorded with the organization it counts for and where it came from, so the client can\n * answer \"was this expert's action MFA-protected, and by whom?\".\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.\n */\n\nimport { z } from 'zod';\nimport { AuthMethod } from './authentication.shared.schemas';\nimport { resolveAcceptedSecondFactorMethods } from '../../config/auth-config-resolution.shared.utils';\nimport type { UserTypeAuthPolicy } from '../../config/entity-identity-config.shared.schemas';\nimport { ServiceProviderMfaTrust } from '../../organizations/service-provider-client-controls.shared.schemas';\n\n/** @wildo_source:part:start saas.models.auth.service-provider-client-authentication facet:layer:shared facet:audience:app-developer */\n/** Where a factor recorded on a session, for one client organization, came from (#1633). */\nexport enum FactorSatisfactionSource {\n  /** The expert proved the factor to this application while acting for that organization (a step-up). */\n  THIS_APPLICATION = 'THIS_APPLICATION',\n  /**\n   * The firm's own enterprise identity provider reported the factor in the expert's sign-in, and the client trusts\n   * that provider's MFA on this relationship. The claim is the upstream's; this application only accepted it.\n   */\n  PROVIDER_IDP_TRUSTED = 'PROVIDER_IDP_TRUSTED',\n}\n\n/** One factor a session has satisfied for one organization. */\nexport const SessionSatisfiedFactorSchema = z.strictObject({\n  /** The organization the factor counts for — a client, never \"everyone\". */\n  organizationId: z.string().min(1),\n  factor: z.enum(AuthMethod),\n  satisfiedAt: z.coerce.date(),\n  source: z.enum(FactorSatisfactionSource),\n  /** For {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}: the firm whose identity provider reported it. */\n  identityProviderOrganizationId: z.string().min(1).optional(),\n});\nexport type SessionSatisfiedFactor = z.infer<typeof SessionSatisfiedFactorSchema>;\n\n/**\n * What an enterprise identity provider reported about how it authenticated the person, captured at the federated\n * sign-in that opened the session. Evidence only: nothing reads it except the trust evaluation below, and it is\n * never re-emitted as this application's own `amr`.\n */\nexport const SessionFederatedAmrEvidenceSchema = z.strictObject({\n  /** The organization whose enterprise connection the person signed in through. */\n  identityProviderOrganizationId: z.string().min(1),\n  /** The RFC 8176 values the provider's verified ID token carried, as it carried them. */\n  amr: z.array(z.string().min(1).max(64)).max(32),\n  authenticatedAt: z.coerce.date(),\n});\nexport type SessionFederatedAmrEvidence = z.infer<typeof SessionFederatedAmrEvidenceSchema>;\n\n/** Everything a session records for client-policy evaluation. */\nexport const SessionClientAuthenticationRecordSchema = z.strictObject({\n  satisfiedFactors: z.array(SessionSatisfiedFactorSchema).max(256).default([]),\n  federatedAmrEvidence: SessionFederatedAmrEvidenceSchema.optional(),\n});\nexport type SessionClientAuthenticationRecord = z.infer<typeof SessionClientAuthenticationRecordSchema>;\n\n/**\n * Which RFC 8176 `amr` values an upstream may report that name a factor this application can hold to a minimum\n * strength — and nothing else.\n *\n * spec-cite: RFC 8176 \"Authentication Method Reference Values\", §2 (https://www.rfc-editor.org/rfc/rfc8176.html) —\n * `otp` is defined there as a one-time password per RFC 4226 / RFC 6238 (HOTP/TOTP), `sms` as confirmation using SMS,\n * `hwk` as proof-of-possession of a hardware-secured key.\n *\n * Deliberately absent, and the absence is the decision:\n * - `mfa` names no factor. It asserts that several were used without saying which, so it cannot be held to a\n *   minimum strength, and the session could not record which factor it accepted. It never counts on its own.\n * - `swk` (a software-secured key) is not mapped to PASSKEY: whether a synced passkey is phishing-resistant hardware\n *   is exactly what a client requiring hardware is asking, and an upstream's `swk` does not answer it.\n * - `pwd` maps to nothing a second factor can be: a password is what the first factor already proved.\n */\nexport const UPSTREAM_AMR_SECOND_FACTOR: Readonly<Record<string, AuthMethod>> = {\n  hwk: AuthMethod.PASSKEY,\n  otp: AuthMethod.TOTP,\n  sms: AuthMethod.SMS_OTP,\n};\n\n/** What a client organization's effective policy asks of an expert acting in it. */\nexport interface ServiceProviderClientAuthRequirement {\n  /** Whether a second factor, satisfied for this organization, is required at all. */\n  readonly requiresSecondFactor: boolean;\n  /** The factors that may satisfy it — the policy's accepted second factors, so its minimum strength included. */\n  readonly acceptedFactors: readonly AuthMethod[];\n  /**\n   * How long a satisfied factor stays valid, when the client's policy declares a step-up window. Absent: for the\n   * session, as a factor completed at sign-in holds for the session.\n   */\n  readonly windowSeconds?: number;\n}\n\n/**\n * The requirement a client organization type's EFFECTIVE policy (the expert's user type resolved against the client\n * type, `resolveAuthPolicyForOrganizationType`) places on an expert acting in it.\n *\n * A missing policy is not \"no requirement\": it is an unresolvable one, and the caller must refuse. That is why this\n * takes the resolved policy rather than resolving it.\n */\nexport function resolveServiceProviderClientAuthRequirement(clientPolicy: UserTypeAuthPolicy): ServiceProviderClientAuthRequirement {\n  const stepUp = clientPolicy.stepUpAuth;\n  return {\n    requiresSecondFactor: clientPolicy.mfaPolicy?.requireMFA === true,\n    acceptedFactors: resolveAcceptedSecondFactorMethods(clientPolicy),\n    ...(stepUp?.enabled ? { windowSeconds: stepUp.maxAgeSeconds } : {}),\n  };\n}\n\n/** Is a moment still inside the requirement's window? */\nfunction withinWindow(requirement: ServiceProviderClientAuthRequirement, at: Date, now: Date): boolean {\n  if (requirement.windowSeconds === undefined) return true;\n  return now.getTime() - at.getTime() <= requirement.windowSeconds * 1000;\n}\n\n/**\n * The factor this session already satisfied FOR THIS ORGANIZATION that meets the requirement, if any.\n *\n * Keyed on the organization, so a factor satisfied for client A never satisfies client B.\n *\n * A factor the firm's identity provider reported ({@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}) counts only\n * while the trust that admitted it still holds: the relationship the expert is admitted through TODAY trusts the\n * firm's MFA, and it is THAT firm's IdP that reported the factor. The record is a memo of an earlier evaluation, not\n * a grant. Without this check, a client withdrawing its trust would still accept the recorded factor until the\n * session record expired (a refresh chain's lifetime), and a different firm's relationship into the same client\n * would ride on the first firm's IdP. A factor this application verified itself needs no such condition: the client\n * accepted it from this application directly.\n */\nexport function findSatisfiedClientFactor(input: {\n  readonly requirement: ServiceProviderClientAuthRequirement;\n  readonly organizationId: string;\n  readonly satisfiedFactors: readonly SessionSatisfiedFactor[];\n  /** The relationship admitting the expert on THIS request: its firm, and whether the client trusts that firm's MFA. */\n  readonly relationship: { readonly providerOrganizationId: string; readonly providerMfaTrust?: ServiceProviderMfaTrust };\n  readonly now: Date;\n}): SessionSatisfiedFactor | undefined {\n  const trustStillHolds = (recorded: SessionSatisfiedFactor): boolean =>\n    recorded.source !== FactorSatisfactionSource.PROVIDER_IDP_TRUSTED\n    || (input.relationship.providerMfaTrust === ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA\n      && recorded.identityProviderOrganizationId === input.relationship.providerOrganizationId);\n  return input.satisfiedFactors.find((recorded) =>\n    recorded.organizationId === input.organizationId\n    && input.requirement.acceptedFactors.includes(recorded.factor)\n    && withinWindow(input.requirement, recorded.satisfiedAt, input.now)\n    && trustStillHolds(recorded));\n}\n\n/**\n * The factor a trusted upstream `amr` satisfies for this client, if any (#1633, item 3).\n *\n * All must hold: the client trusts the firm's MFA on this relationship; the expert signed in through the FIRM's own\n * enterprise identity provider (not another organization's); the reported value names a factor in the client's\n * accepted set; and, when the client declares a window, the sign-in is inside it. The strongest qualifying factor is\n * chosen, so the record names the best proof the upstream reported.\n */\nexport function evaluateTrustedProviderAmr(input: {\n  readonly requirement: ServiceProviderClientAuthRequirement;\n  readonly relationship: { readonly providerOrganizationId: string; readonly providerMfaTrust?: ServiceProviderMfaTrust };\n  readonly evidence: SessionFederatedAmrEvidence | undefined;\n  readonly now: Date;\n}): AuthMethod | undefined {\n  const { requirement, relationship, evidence, now } = input;\n  if (relationship.providerMfaTrust !== ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA) return undefined;\n  if (!evidence || evidence.identityProviderOrganizationId !== relationship.providerOrganizationId) return undefined;\n  if (!withinWindow(requirement, evidence.authenticatedAt, now)) return undefined;\n  // `hasOwn`: the values are an upstream's strings, and `__proto__` must name nothing rather than the prototype.\n  const reported = new Set(evidence.amr\n    .filter((value) => Object.hasOwn(UPSTREAM_AMR_SECOND_FACTOR, value))\n    .map((value) => UPSTREAM_AMR_SECOND_FACTOR[value]!));\n  return [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.SMS_OTP]\n    .find((method) => reported.has(method) && requirement.acceptedFactors.includes(method));\n}\n/** @wildo_source:part:end saas.models.auth.service-provider-client-authentication */\n"]}
+{"version":3,"file":"service-provider-client-authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/service-provider-client-authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,kCAAkC,EAAE,MAAM,kDAAkD,CAAC;AAEtG,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAE9G,uIAAuI;AACvI,4FAA4F;AAC5F,MAAM,CAAN,IAAY,wBAQX;AARD,WAAY,wBAAwB;IAClC,uGAAuG;IACvG,iEAAqC,CAAA;IACrC;;;OAGG;IACH,yEAA6C,CAAA;AAC/C,CAAC,EARW,wBAAwB,KAAxB,wBAAwB,QAQnC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,2EAA2E;IAC3E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,+GAA+G;IAC/G,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,iFAAiF;IACjF,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,wFAAwF;IACxF,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;CACjC,CAAC,CAAC;AAGH,iEAAiE;AACjE,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5E,oBAAoB,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAyC;IAC9E,GAAG,EAAE,UAAU,CAAC,OAAO;IACvB,GAAG,EAAE,UAAU,CAAC,IAAI;IACpB,GAAG,EAAE,UAAU,CAAC,OAAO;CACxB,CAAC;AAeF;;;;;;GAMG;AACH,MAAM,UAAU,2CAA2C,CAAC,YAAgC;IAC1F,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC;IACvC,OAAO;QACL,oBAAoB,EAAE,YAAY,CAAC,SAAS,EAAE,UAAU,KAAK,IAAI;QACjE,eAAe,EAAE,kCAAkC,CAAC,YAAY,CAAC;QACjE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,WAAiD,EAAE,EAAQ,EAAE,GAAS;IAC1F,IAAI,WAAW,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,WAAW,CAAC,aAAa,GAAG,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAOzC;IACC,MAAM,eAAe,GAAG,CAAC,QAAgC,EAAW,EAAE,CACpE,QAAQ,CAAC,MAAM,KAAK,wBAAwB,CAAC,oBAAoB;WAC9D,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,KAAK,uBAAuB,CAAC,sBAAsB;eACrF,QAAQ,CAAC,8BAA8B,KAAK,KAAK,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC9C,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;WAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;WAC3D,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC;WAChE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC3D,IAAI,YAAY,CAAC,gBAAgB,KAAK,uBAAuB,CAAC,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACvG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,8BAA8B,KAAK,YAAY,CAAC,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACnH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChF,+GAA+G;IAC/G,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;SAC7D,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5F,CAAC;AACD,qFAAqF","sourcesContent":["/**\n * A client organization's authentication policy, evaluated when a service firm's expert ACTS in it (#1633).\n *\n * ## The shape of the problem\n *\n * The firm and the client are two tenants of ONE application. An organization type's `authOverrides` are resolved at\n * LOGIN, as a user-global most-restrictive intersection over every active membership — so a provider membership\n * (#1597) left in that intersection would feed every client's policy into the expert's sign-in: an expert serving 200\n * clients would be held to the strictest of 200 policies for firm-only work, and one client disabling a method the\n * firm relies on would lock them out entirely. And no client's policy would ever be evaluated when the expert actually\n * acts in that client.\n *\n * So provider memberships leave the login-time intersection, and the CLIENT's policy is evaluated per request, for the\n * organization the request targets, against what the session has satisfied FOR THAT ORGANIZATION. The pure half of\n * that evaluation is here; the store and the request wiring are backend.\n *\n * ## What counts as satisfying a client\n *\n * - A factor proven to THIS application FOR THIS CLIENT (a step-up answered while the request targeted it) —\n *   {@link FactorSatisfactionSource.THIS_APPLICATION}. A factor completed at sign-in satisfied the EXPERT's own\n *   policy, not the client's, and does not count; neither does one satisfied for another client. This is the\n *   resource-tenant posture Microsoft Entra B2B takes when inbound MFA trust is off.\n * - When the client trusts the firm's MFA on this relationship, a factor the FIRM's enterprise identity provider\n *   reported in the expert's sign-in — {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED} — provided it maps to a\n *   method the client's policy accepts. The client's minimum strength therefore still applies under trust.\n *\n * Every satisfied factor is recorded with the organization it counts for and where it came from, so the client can\n * answer \"was this expert's action MFA-protected, and by whom?\".\n *\n * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the resource tenant's authentication policy is enforced on external experts, per request.\n */\n\nimport { z } from 'zod';\nimport { AuthMethod } from './authentication.shared.schemas';\nimport { resolveAcceptedSecondFactorMethods } from '../../config/auth-config-resolution.shared.utils';\nimport type { UserTypeAuthPolicy } from '../../config/entity-identity-config.shared.schemas';\nimport { ServiceProviderMfaTrust } from '../../organizations/service-provider-client-controls.shared.schemas';\n\n/** @wildo_source:part:start saas.models.auth.service-provider-client-authentication facet:layer:shared facet:audience:app-developer */\n/** Where a factor recorded on a session, for one client organization, came from (#1633). */\nexport enum FactorSatisfactionSource {\n  /** The expert proved the factor to this application while acting for that organization (a step-up). */\n  THIS_APPLICATION = 'THIS_APPLICATION',\n  /**\n   * The firm's own enterprise identity provider reported the factor in the expert's sign-in, and the client trusts\n   * that provider's MFA on this relationship. The claim is the upstream's; this application only accepted it.\n   */\n  PROVIDER_IDP_TRUSTED = 'PROVIDER_IDP_TRUSTED',\n}\n\n/** One factor a session has satisfied for one organization. */\nexport const SessionSatisfiedFactorSchema = z.strictObject({\n  /** The organization the factor counts for — a client, never \"everyone\". */\n  organizationId: z.string().min(1),\n  factor: z.enum(AuthMethod),\n  satisfiedAt: z.coerce.date(),\n  source: z.enum(FactorSatisfactionSource),\n  /** For {@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}: the firm whose identity provider reported it. */\n  identityProviderOrganizationId: z.string().min(1).optional(),\n});\nexport type SessionSatisfiedFactor = z.infer<typeof SessionSatisfiedFactorSchema>;\n\n/**\n * What an enterprise identity provider reported about how it authenticated the person, captured at the federated\n * sign-in that opened the session. Evidence only: nothing reads it except the trust evaluation below, and it is\n * never re-emitted as this application's own `amr`.\n */\nexport const SessionFederatedAmrEvidenceSchema = z.strictObject({\n  /** The organization whose enterprise connection the person signed in through. */\n  identityProviderOrganizationId: z.string().min(1),\n  /** The RFC 8176 values the provider's verified ID token carried, as it carried them. */\n  amr: z.array(z.string().min(1).max(64)).max(32),\n  authenticatedAt: z.coerce.date(),\n});\nexport type SessionFederatedAmrEvidence = z.infer<typeof SessionFederatedAmrEvidenceSchema>;\n\n/** Everything a session records for client-policy evaluation. */\nexport const SessionClientAuthenticationRecordSchema = z.strictObject({\n  satisfiedFactors: z.array(SessionSatisfiedFactorSchema).max(256).default([]),\n  federatedAmrEvidence: SessionFederatedAmrEvidenceSchema.optional(),\n});\nexport type SessionClientAuthenticationRecord = z.infer<typeof SessionClientAuthenticationRecordSchema>;\n\n/**\n * Which RFC 8176 `amr` values an upstream may report that name a factor this application can hold to a minimum\n * strength — and nothing else.\n *\n * spec-cite: RFC 8176 \"Authentication Method Reference Values\", §2 (https://www.rfc-editor.org/rfc/rfc8176.html) —\n * `otp` is defined there as a one-time password per RFC 4226 / RFC 6238 (HOTP/TOTP), `sms` as confirmation using SMS,\n * `hwk` as proof-of-possession of a hardware-secured key.\n *\n * Deliberately absent, and the absence is the decision:\n * - `mfa` names no factor. It asserts that several were used without saying which, so it cannot be held to a\n *   minimum strength, and the session could not record which factor it accepted. It never counts on its own.\n * - `swk` (a software-secured key) is not mapped to PASSKEY: whether a synced passkey is phishing-resistant hardware\n *   is exactly what a client requiring hardware is asking, and an upstream's `swk` does not answer it.\n * - `pwd` maps to nothing a second factor can be: a password is what the first factor already proved.\n */\nexport const UPSTREAM_AMR_SECOND_FACTOR: Readonly<Record<string, AuthMethod>> = {\n  hwk: AuthMethod.PASSKEY,\n  otp: AuthMethod.TOTP,\n  sms: AuthMethod.SMS_OTP,\n};\n\n/** What a client organization's effective policy asks of an expert acting in it. */\nexport interface ServiceProviderClientAuthRequirement {\n  /** Whether a second factor, satisfied for this organization, is required at all. */\n  readonly requiresSecondFactor: boolean;\n  /** The factors that may satisfy it — the policy's accepted second factors, so its minimum strength included. */\n  readonly acceptedFactors: readonly AuthMethod[];\n  /**\n   * How long a satisfied factor stays valid, when the client's policy declares a step-up window. Absent: for the\n   * session, as a factor completed at sign-in holds for the session.\n   */\n  readonly windowSeconds?: number;\n}\n\n/**\n * The requirement a client organization type's EFFECTIVE policy (the expert's user type resolved against the client\n * type, `resolveAuthPolicyForOrganizationType`) places on an expert acting in it.\n *\n * A missing policy is not \"no requirement\": it is an unresolvable one, and the caller must refuse. That is why this\n * takes the resolved policy rather than resolving it.\n */\nexport function resolveServiceProviderClientAuthRequirement(clientPolicy: UserTypeAuthPolicy): ServiceProviderClientAuthRequirement {\n  const stepUp = clientPolicy.stepUpAuth;\n  return {\n    requiresSecondFactor: clientPolicy.mfaPolicy?.requireMFA === true,\n    acceptedFactors: resolveAcceptedSecondFactorMethods(clientPolicy),\n    ...(stepUp?.enabled ? { windowSeconds: stepUp.maxAgeSeconds } : {}),\n  };\n}\n\n/** Is a moment still inside the requirement's window? */\nfunction withinWindow(requirement: ServiceProviderClientAuthRequirement, at: Date, now: Date): boolean {\n  if (requirement.windowSeconds === undefined) return true;\n  return now.getTime() - at.getTime() <= requirement.windowSeconds * 1000;\n}\n\n/**\n * The factor this session already satisfied FOR THIS ORGANIZATION that meets the requirement, if any.\n *\n * Keyed on the organization, so a factor satisfied for client A never satisfies client B.\n *\n * A factor the firm's identity provider reported ({@link FactorSatisfactionSource.PROVIDER_IDP_TRUSTED}) counts only\n * while the trust that admitted it still holds: the relationship the expert is admitted through TODAY trusts the\n * firm's MFA, and it is THAT firm's IdP that reported the factor. The record is a memo of an earlier evaluation, not\n * a grant. Without this check, a client withdrawing its trust would still accept the recorded factor until the\n * session record expired (a refresh chain's lifetime), and a different firm's relationship into the same client\n * would ride on the first firm's IdP. A factor this application verified itself needs no such condition: the client\n * accepted it from this application directly.\n */\nexport function findSatisfiedClientFactor(input: {\n  readonly requirement: ServiceProviderClientAuthRequirement;\n  readonly organizationId: string;\n  readonly satisfiedFactors: readonly SessionSatisfiedFactor[];\n  /** The relationship admitting the expert on THIS request: its firm, and whether the client trusts that firm's MFA. */\n  readonly relationship: { readonly providerOrganizationId: string; readonly providerMfaTrust?: ServiceProviderMfaTrust };\n  readonly now: Date;\n}): SessionSatisfiedFactor | undefined {\n  const trustStillHolds = (recorded: SessionSatisfiedFactor): boolean =>\n    recorded.source !== FactorSatisfactionSource.PROVIDER_IDP_TRUSTED\n    || (input.relationship.providerMfaTrust === ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA\n      && recorded.identityProviderOrganizationId === input.relationship.providerOrganizationId);\n  return input.satisfiedFactors.find((recorded) =>\n    recorded.organizationId === input.organizationId\n    && input.requirement.acceptedFactors.includes(recorded.factor)\n    && withinWindow(input.requirement, recorded.satisfiedAt, input.now)\n    && trustStillHolds(recorded));\n}\n\n/**\n * The factor a trusted upstream `amr` satisfies for this client, if any (#1633, item 3).\n *\n * All must hold: the client trusts the firm's MFA on this relationship; the expert signed in through the FIRM's own\n * enterprise identity provider (not another organization's); the reported value names a factor in the client's\n * accepted set; and, when the client declares a window, the sign-in is inside it. The strongest qualifying factor is\n * chosen, so the record names the best proof the upstream reported.\n */\nexport function evaluateTrustedProviderAmr(input: {\n  readonly requirement: ServiceProviderClientAuthRequirement;\n  readonly relationship: { readonly providerOrganizationId: string; readonly providerMfaTrust?: ServiceProviderMfaTrust };\n  readonly evidence: SessionFederatedAmrEvidence | undefined;\n  readonly now: Date;\n}): AuthMethod | undefined {\n  const { requirement, relationship, evidence, now } = input;\n  if (relationship.providerMfaTrust !== ServiceProviderMfaTrust.TRUST_PROVIDER_IDP_MFA) return undefined;\n  if (!evidence || evidence.identityProviderOrganizationId !== relationship.providerOrganizationId) return undefined;\n  if (!withinWindow(requirement, evidence.authenticatedAt, now)) return undefined;\n  // `hasOwn`: the values are an upstream's strings, and `__proto__` must name nothing rather than the prototype.\n  const reported = new Set(evidence.amr\n    .filter((value) => Object.hasOwn(UPSTREAM_AMR_SECOND_FACTOR, value))\n    .map((value) => UPSTREAM_AMR_SECOND_FACTOR[value]!));\n  return [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.SMS_OTP]\n    .find((method) => reported.has(method) && requirement.acceptedFactors.includes(method));\n}\n/** @wildo_source:part:end saas.models.auth.service-provider-client-authentication */\n"]}

package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,oBAAY,0BAA0B;IACpC,YAAY,gBAAgB;IAC5B,SAAS,aAAa;IACtB,SAAS,aAAa;CACvB;AAID,eAAO,MAAM,qCAAqC;;iBAEhD,CAAC;AAEH,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAE/D,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAI/D,eAAO,MAAM,mCAAmC,mRA2K/C,CAAC"}
+{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,oBAAY,0BAA0B;IACpC,YAAY,gBAAgB;IAC5B,SAAS,aAAa;IACtB,SAAS,aAAa;CACvB;AAID,eAAO,MAAM,qCAAqC;;iBAEhD,CAAC;AAEH,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAE/D,eAAO,MAAM,kCAAkC,gCAAe,CAAC;AAI/D,eAAO,MAAM,mCAAmC,mRA2K/C,CAAC"}

package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,qCAAqC,EAAE,MAAM,oCAAoC,CAAC;AAElH,wEAAwE;AAExE,MAAM,CAAN,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,0DAA4B,CAAA;IAC5B,oDAAsB,CAAA;IACtB,oDAAsB,CAAA;AACxB,CAAC,EAJW,0BAA0B,KAA1B,0BAA0B,QAIrC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;CACtI,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE/D,wEAAwE;AAExE,MAAM,CAAC,MAAM,mCAAmC,GAAG,uCAAuC,CACxF,qCAAqC,EACrC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,0BAA0B;IAC3C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,4EAA4E;QAC5E,gFAAgF;QAChF,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,yEAAyE;QACzE,wEAAwE;QACxE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,oEAAoE;oBACpE,sEAAsE;oBACtE,mEAAmE;oBACnE,oEAAoE;oBACpE,4BAA4B;oBAC5B,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;wBACrC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAU;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,+DAA+D;QAC/D,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,YAAY,CAAC,EAAE;YACzC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,+DAA+D;oBAC/D,mDAAmD;oBACnD,oEAAoE;oBACpE,kEAAkE;oBAClE,gEAAgE;oBAChE,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,qCAAqC;oBACjD,8EAA8E;oBAC9E,kEAAkE;oBAClE,6EAA6E;oBAC7E,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;wBAC3F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;qBAC3E,CAAC;iBACH,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iEAAiE;oBACjE,qEAAqE;oBACrE,mEAAmE;oBACnE,qEAAqE;oBACrE,kEAAkE;oBAClE,uEAAuE;oBACvE,mEAAmE;oBACnE,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,kCAAkC;oBAC9C,qEAAqE;oBACrE,6CAA6C;oBAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8FAA8F,CAAC;wBACjI,YAAY,EAAE,CAAC;6BACZ,MAAM,EAAE;6BACR,QAAQ,CAAC,wKAAwK,CAAC;wBACrL,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;qBACvE,CAAC;iBACH,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,gGAAgG;oBAChG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,iEAAiE;oBACjE,iEAAiE;oBACjE,mEAAmE;oBACnE,uEAAuE;oBACvE,0EAA0E;oBAC1E,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,kCAAkC;oBAC9C,gEAAgE;oBAChE,mEAAmE;oBACnE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6GAA6G,CAAC;wBAC/I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;qBACvE,CAAC;iBACH,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SIEM Delivery DLQ Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...siemDeliveryDlqPolymorphicFactories\n *\n * The ORG + APP operation surfaces below (READ/LIST/RETRY/PURGE, all with\n * `polymorphicRole` for both scopes) are fully wired, but only the ORGANIZATION\n * variant is ever exercised in production: no producer emits app-scoped SIEM\n * deliveries, so `APPLICATION_SIEM_DELIVERY_DLQ` is never populated. The APP variant\n * is RESERVED / DORMANT — see the note on `siem-delivery-dlq.shared.schemas.ts` and\n * `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`.\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationReversibility,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SiemDeliveryDlqStatus, siemDeliveryDlqPolymorphicDeclaration } from './siem-delivery-dlq.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SiemDeliveryDlq_Operations {\n  RETRY_SINGLE = 'retrySingle',\n  RETRY_ALL = 'retryAll',\n  PURGE_ALL = 'purgeAll',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const SiemDeliveryDlq_RetrySingleRequestDto = z.object({\n  entryId: z.string().describe('The id of the dead-letter entry to re-deliver. An entry that was already delivered cannot be retried.'),\n});\n\nexport const SiemDeliveryDlq_RetryAllRequestDto = z.object({});\n\nexport const SiemDeliveryDlq_PurgeAllRequestDto = z.object({});\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const siemDeliveryDlqPolymorphicFactories = createPolymorphicResourceConfigurations(\n  siemDeliveryDlqPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: SiemDeliveryDlq_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.DELETE,\n      // Bulk twin of DELETE — the write path for both `PURGE_ALL` (drop every row\n      // in the scope) and the delete-on-requeue tail of `RETRY_SINGLE` / `RETRY_ALL`.\n      // The custom impls route through `repository.deleteMany`, which resolves a\n      // DEFAULT DELETE_MANY operation. REPOSITORY_ONLY (like CREATE/DELETE): never a\n      // public HTTP surface — operators purge/retry via the custom operations, which\n      // own request validation + the summary response. Mirrors the M2M webhook\n      // delivery-log sibling, whose PURGE_OLD uses the same DELETE_MANY seam.\n      CoreResourceOperation.DELETE_MANY,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Failed-deliveries triage surface: status is the quick-filter axis\n          // (the UI promotes it to an All/Pending-retry/Exhausted/Delivered tab\n          // strip via `collectionDisplayConfig.quickFilterField`), createdAt\n          // bounds an incident window. Backend-validated: the controller only\n          // extracts declared fields.\n          filterFields: {\n            status: z.enum(SiemDeliveryDlqStatus),\n            createdAt: z.date(),\n          },\n          sortFields: ['createdAt', 'status'] as const,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Bulk delete used by PURGE_ALL (whole-scope clear) and the delete-on-requeue\n      // tail of RETRY_SINGLE/RETRY_ALL. REPOSITORY_ONLY — driven only by the custom\n      // impls' `repository.deleteMany`, never a public HTTP surface.\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [SiemDeliveryDlq_Operations.RETRY_SINGLE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // The request body owns the one target (`entryId`). Borrow the\n          // COLLECTION update verb so the generated route is\n          // `…/siem-delivery-dlq/retry-single`, with no second, independently\n          // supplied DLQ id in the URL. This is a single-row command, not a\n          // selection bulk operation, so `isBulkOperation` remains unset.\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: SiemDeliveryDlq_RetrySingleRequestDto,\n          // Borrows UPDATE_MANY for its route/verb but returns a retry acknowledgement,\n          // NOT the DLQ resource row. Without this the service output fails\n          // `transformOutput`'s `internalDto.parse` against the resource schema → 500.\n          customResponseDto: z.object({\n            message: z.string().describe('A human-readable confirmation that the entry was re-queued.'),\n            entryId: z.string().describe('The entry that was re-queued for delivery.'),\n          }),\n        }],\n      },\n      [SiemDeliveryDlq_Operations.RETRY_ALL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Borrows the COLLECTION verb UPDATE_MANY (not entity UPDATE): a\n          // whole-scope retry is a collection operation, so the framework must\n          // generate a collection route (`…/siem-delivery-dlq/retry-all`, no\n          // `:id` path segment) — an operator scope-level action has no single\n          // row to address. Entity UPDATE would generate `…/:id/retry-all`,\n          // which the collection surface can never fill. `isBulkOperation` stays\n          // unset: this is collection-level, not a selection-of-ids bulk op.\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: SiemDeliveryDlq_RetryAllRequestDto,\n          // Returns a bulk-retry summary, NOT the borrowed bulk-update default\n          // response — customResponseDto overrides it.\n          customResponseDto: z.object({\n            retriedCount: z.number().describe('How many entries were re-queued for delivery. Re-queued entries leave the dead-letter queue.'),\n            skippedCount: z\n              .number()\n              .describe('How many entries were not re-queued: already delivered, without a stored event, or failing to re-queue. Every entry is skipped when no SIEM destination is configured.'),\n            message: z.string().describe('A human-readable summary of the retry.'),\n          }),\n        }],\n      },\n      [SiemDeliveryDlq_Operations.PURGE_ALL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // IRREVERSIBLE: Empties the dead-letter queue. Those deliveries are not retained anywhere else.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          // Borrows the COLLECTION verb DELETE_MANY (not entity DELETE): a\n          // whole-scope purge is a collection operation → collection route\n          // (`…/siem-delivery-dlq/purge-all`, no `:id`). Entity DELETE would\n          // generate `…/:id/purge-all`, unfillable from the scope-level surface.\n          // `isBulkOperation` stays unset (collection-level, not a selection bulk).\n          resourceOperationLike: CoreResourceOperation.DELETE_MANY,\n          requestDto: SiemDeliveryDlq_PurgeAllRequestDto,\n          // Returns a purge summary, NOT the borrowed bulk-delete default\n          // `{ deletedIds, deletedCount }` — customResponseDto overrides it.\n          customResponseDto: z.object({\n            purgedCount: z.number().describe('How many dead-letter entries were deleted. The purge covers every entry in this scope, whatever its status.'),\n            message: z.string().describe('A human-readable summary of the purge.'),\n          }),\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"siem-delivery-dlq.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,qCAAqC,EAAE,MAAM,oCAAoC,CAAC;AAElH,wEAAwE;AAExE,MAAM,CAAN,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,0DAA4B,CAAA;IAC5B,oDAAsB,CAAA;IACtB,oDAAsB,CAAA;AACxB,CAAC,EAJW,0BAA0B,KAA1B,0BAA0B,QAIrC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;CACtI,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE/D,wEAAwE;AAExE,MAAM,CAAC,MAAM,mCAAmC,GAAG,uCAAuC,CACxF,qCAAqC,EACrC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,0BAA0B;IAC3C,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,4EAA4E;QAC5E,gFAAgF;QAChF,2EAA2E;QAC3E,+EAA+E;QAC/E,+EAA+E;QAC/E,yEAAyE;QACzE,wEAAwE;QACxE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,oEAAoE;oBACpE,sEAAsE;oBACtE,mEAAmE;oBACnE,oEAAoE;oBACpE,4BAA4B;oBAC5B,YAAY,EAAE;wBACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;wBACrC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;qBACpB;oBACD,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAU;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,+DAA+D;QAC/D,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,YAAY,CAAC,EAAE;YACzC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,+DAA+D;oBAC/D,mDAAmD;oBACnD,oEAAoE;oBACpE,kEAAkE;oBAClE,gEAAgE;oBAChE,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,qCAAqC;oBACjD,8EAA8E;oBAC9E,kEAAkE;oBAClE,6EAA6E;oBAC7E,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;wBAC3F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;qBAC3E,CAAC;iBACH,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,iEAAiE;oBACjE,qEAAqE;oBACrE,mEAAmE;oBACnE,qEAAqE;oBACrE,kEAAkE;oBAClE,uEAAuE;oBACvE,mEAAmE;oBACnE,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,kCAAkC;oBAC9C,qEAAqE;oBACrE,6CAA6C;oBAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8FAA8F,CAAC;wBACjI,YAAY,EAAE,CAAC;6BACZ,MAAM,EAAE;6BACR,QAAQ,CAAC,wKAAwK,CAAC;wBACrL,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;qBACvE,CAAC;iBACH,CAAC;SACH;QACD,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,gGAAgG;oBAChG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,iEAAiE;oBACjE,iEAAiE;oBACjE,mEAAmE;oBACnE,uEAAuE;oBACvE,0EAA0E;oBAC1E,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,kCAAkC;oBAC9C,gEAAgE;oBAChE,mEAAmE;oBACnE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;wBAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6GAA6G,CAAC;wBAC/I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;qBACvE,CAAC;iBACH,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SIEM Delivery DLQ Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...siemDeliveryDlqPolymorphicFactories\n *\n * The ORG + APP operation surfaces below (READ/LIST/RETRY/PURGE, all with\n * `polymorphicRole` for both scopes) are fully wired, but only the ORGANIZATION\n * variant is ever exercised in production: no producer emits app-scoped SIEM\n * deliveries, so `APPLICATION_SIEM_DELIVERY_DLQ` is never populated. The APP variant\n * is RESERVED / DORMANT — see the note on `siem-delivery-dlq.shared.schemas.ts` and\n * `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`.\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationReversibility,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SiemDeliveryDlqStatus, siemDeliveryDlqPolymorphicDeclaration } from './siem-delivery-dlq.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SiemDeliveryDlq_Operations {\n  RETRY_SINGLE = 'retrySingle',\n  RETRY_ALL = 'retryAll',\n  PURGE_ALL = 'purgeAll',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const SiemDeliveryDlq_RetrySingleRequestDto = z.object({\n  entryId: z.string().describe('The id of the dead-letter entry to re-deliver. An entry that was already delivered cannot be retried.'),\n});\n\nexport const SiemDeliveryDlq_RetryAllRequestDto = z.object({});\n\nexport const SiemDeliveryDlq_PurgeAllRequestDto = z.object({});\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const siemDeliveryDlqPolymorphicFactories = createPolymorphicResourceConfigurations(\n  siemDeliveryDlqPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: SiemDeliveryDlq_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.DELETE,\n      // Bulk twin of DELETE — the write path for both `PURGE_ALL` (drop every row\n      // in the scope) and the delete-on-requeue tail of `RETRY_SINGLE` / `RETRY_ALL`.\n      // The custom impls route through `repository.deleteMany`, which resolves a\n      // DEFAULT DELETE_MANY operation. REPOSITORY_ONLY (like CREATE/DELETE): never a\n      // public HTTP surface — operators purge/retry via the custom operations, which\n      // own request validation + the summary response. Mirrors the M2M webhook\n      // delivery-log sibling, whose PURGE_OLD uses the same DELETE_MANY seam.\n      CoreResourceOperation.DELETE_MANY,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // Failed-deliveries triage surface: status is the quick-filter axis\n          // (the UI promotes it to an All/Pending-retry/Exhausted/Delivered tab\n          // strip via `collectionDisplayConfig.quickFilterField`), createdAt\n          // bounds an incident window. Backend-validated: the controller only\n          // extracts declared fields.\n          filterFields: {\n            status: z.enum(SiemDeliveryDlqStatus),\n            createdAt: z.date(),\n          },\n          sortFields: ['createdAt', 'status'] as const,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Bulk delete used by PURGE_ALL (whole-scope clear) and the delete-on-requeue\n      // tail of RETRY_SINGLE/RETRY_ALL. REPOSITORY_ONLY — driven only by the custom\n      // impls' `repository.deleteMany`, never a public HTTP surface.\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [SiemDeliveryDlq_Operations.RETRY_SINGLE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          // The request body owns the one target (`entryId`). Borrow the\n          // COLLECTION update verb so the generated route is\n          // `…/siem-delivery-dlq/retry-single`, with no second, independently\n          // supplied DLQ id in the URL. This is a single-row command, not a\n          // selection bulk operation, so `isBulkOperation` remains unset.\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: SiemDeliveryDlq_RetrySingleRequestDto,\n          // Borrows UPDATE_MANY for its route/verb but returns a retry acknowledgement,\n          // NOT the DLQ resource row. Without this the service output fails\n          // `transformOutput`'s `internalDto.parse` against the resource schema → 500.\n          customResponseDto: z.object({\n            message: z.string().describe('A human-readable confirmation that the entry was re-queued.'),\n            entryId: z.string().describe('The entry that was re-queued for delivery.'),\n          }),\n        }],\n      },\n      [SiemDeliveryDlq_Operations.RETRY_ALL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // Borrows the COLLECTION verb UPDATE_MANY (not entity UPDATE): a\n          // whole-scope retry is a collection operation, so the framework must\n          // generate a collection route (`…/siem-delivery-dlq/retry-all`, no\n          // `:id` path segment) — an operator scope-level action has no single\n          // row to address. Entity UPDATE would generate `…/:id/retry-all`,\n          // which the collection surface can never fill. `isBulkOperation` stays\n          // unset: this is collection-level, not a selection-of-ids bulk op.\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: SiemDeliveryDlq_RetryAllRequestDto,\n          // Returns a bulk-retry summary, NOT the borrowed bulk-update default\n          // response — customResponseDto overrides it.\n          customResponseDto: z.object({\n            retriedCount: z.number().describe('How many entries were re-queued for delivery. Re-queued entries leave the dead-letter queue.'),\n            skippedCount: z\n              .number()\n              .describe('How many entries were not re-queued: already delivered, without a stored event, or failing to re-queue. Every entry is skipped when no SIEM destination is configured.'),\n            message: z.string().describe('A human-readable summary of the retry.'),\n          }),\n        }],\n      },\n      [SiemDeliveryDlq_Operations.PURGE_ALL]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // IRREVERSIBLE: Empties the dead-letter queue. Those deliveries are not retained anywhere else.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          // Borrows the COLLECTION verb DELETE_MANY (not entity DELETE): a\n          // whole-scope purge is a collection operation → collection route\n          // (`…/siem-delivery-dlq/purge-all`, no `:id`). Entity DELETE would\n          // generate `…/:id/purge-all`, unfillable from the scope-level surface.\n          // `isBulkOperation` stays unset (collection-level, not a selection bulk).\n          resourceOperationLike: CoreResourceOperation.DELETE_MANY,\n          requestDto: SiemDeliveryDlq_PurgeAllRequestDto,\n          // Returns a purge summary, NOT the borrowed bulk-delete default\n          // `{ deletedIds, deletedCount }` — customResponseDto overrides it.\n          customResponseDto: z.object({\n            purgedCount: z.number().describe('How many dead-letter entries were deleted. The purge covers every entry in this scope, whatever its status.'),\n            message: z.string().describe('A human-readable summary of the purge.'),\n          }),\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-dlq.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAC;AAEX,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;iBAqBpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;kBAQhD,CAAC"}
+{"version":3,"file":"siem-delivery-dlq.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAC;AAEX,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;iBAqBpC,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;kBAQhD,CAAC"}

package/dist/esm/security/authentications/siem/siem-delivery-dlq.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-dlq.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mEAAmE,CAAC;AACzG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,gGAAgG;IAChG,kGAAkG;IAClG,oFAAoF;IACpF,EAAE;IACF,uFAAuF;IACvF,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,KAAK,CAAC;IACxE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,cAAc,EAAE;IAEnG,+EAA+E;IAC/E,6EAA6E;IAC7E,yEAAyE;IACzE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,qCAAqC,GAAG,yBAAyB,CAAC;IAC7E,gBAAgB,EAAE,iBAAiB;IACnC,mBAAmB,EAAE,mBAAmB;IACxC,WAAW,EAAE,mBAAmB;IAChC,UAAU,EAAE,yBAAyB;IACrC,2EAA2E;IAC3E,qEAAqE;IACrE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SIEM Delivery DLQ Schema (Shared) — Polymorphic\n *\n * Dead-letter queue entries for failed SIEM webhook deliveries.\n * Naturally flat — no structural nesting needed.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * ── ORG variant is live; the APPLICATION variant is RESERVED / DORMANT ─────────────\n * The polymorphism below emits both an ORG and an APPLICATION variant (uniform with the\n * sibling SIEM export-config + the SSO/SCIM configs, all declared over\n * `AUTH_SCOPE_VARIANTS`). Only the ORGANIZATION variant is populated in practice: rows\n * are written by `SIEMWebhookDeliveryBackendService._enqueueToDLQ` when a delivery fails,\n * and the sole delivery producer (`AuditEventDispatcherBackendService`) is ORG-scoped.\n * There is no app-scoped producer, so `APPLICATION_SIEM_DELIVERY_DLQ` is never filled in\n * production — its RETRY/PURGE custom-impls and the app-scope delivery seams exist as\n * reserved plumbing, not a wired path. See `AuditEventDispatcherBackendService.\n * dispatchToOrganizationAuditSinks` for the full rationale + how a future app producer\n * would attach.\n *\n * @see auth-data-model-audit.md §2E\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories } from '@wildo-ai/zod-decorators';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const SiemDeliveryDlqStatus = {\n  PENDING_RETRY: 'pending_retry',\n  EXHAUSTED: 'exhausted',\n  DELIVERED: 'delivered',\n} as const;\n\nexport const SiemDeliveryDlqBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  eventId: z.string().min(1),\n  // USAGE — this is a FAILED AUDIT EVENT held for retry, so it carries the same personal data the\n  // audit row does. A dead-letter queue is where personal data sits longest and is looked at least;\n  // that it is transit state rather than a record does not remove it from the notice.\n  //\n  // `addDataCategories` because `z.unknown()` carries no prototype-installed decorators.\n  eventPayload: addDataCategories(z.unknown(), PersonalDataCategory.USAGE),\n  failureReason: z.string().min(1).isSummaryField(),\n  failureCount: z.number().min(0).default(1),\n  lastAttemptAt: z.date(),\n  nextRetryAt: z.date().optional(),\n  status: z.enum(SiemDeliveryDlqStatus).default(SiemDeliveryDlqStatus.PENDING_RETRY).isSummaryField(),\n\n  // Summary field: DLQ entry time is core row identity for the failed-deliveries\n  // dashboard (per-row time + the LIST's `temporalGroupField: 'createdAt'` day\n  // grouping read it from the SUMMARY DTO — mirrors the m2m delivery log).\n  createdAt: z.date().default(() => new Date()).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type SiemDeliveryDlqBase = z.infer<typeof SiemDeliveryDlqBaseSchema>;\n\nexport const siemDeliveryDlqPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'siemDeliveryDlq',\n  baseFieldIdentifier: 'siemDeliveryDlqId',\n  baseEnumKey: 'SIEM_DELIVERY_DLQ',\n  baseSchema: SiemDeliveryDlqBaseSchema,\n  // Many DLQ rows per scope (each failed delivery is its own document) — opt\n  // out of the polymorphism engine's singleton-per-scope auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"siem-delivery-dlq.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-dlq.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mEAAmE,CAAC;AACzG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,gGAAgG;IAChG,kGAAkG;IAClG,oFAAoF;IACpF,EAAE;IACF,uFAAuF;IACvF,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,KAAK,CAAC;IACxE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,cAAc,EAAE;IAEnG,+EAA+E;IAC/E,6EAA6E;IAC7E,yEAAyE;IACzE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,qCAAqC,GAAG,yBAAyB,CAAC;IAC7E,gBAAgB,EAAE,iBAAiB;IACnC,mBAAmB,EAAE,mBAAmB;IACxC,WAAW,EAAE,mBAAmB;IAChC,UAAU,EAAE,yBAAyB;IACrC,2EAA2E;IAC3E,qEAAqE;IACrE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SIEM Delivery DLQ Schema (Shared) — Polymorphic\n *\n * Dead-letter queue entries for failed SIEM webhook deliveries.\n * Naturally flat — no structural nesting needed.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * ── ORG variant is live; the APPLICATION variant is RESERVED / DORMANT ─────────────\n * The polymorphism below emits both an ORG and an APPLICATION variant (uniform with the\n * sibling SIEM export-config + the SSO/SCIM configs, all declared over\n * `AUTH_SCOPE_VARIANTS`). Only the ORGANIZATION variant is populated in practice: rows\n * are written by `SIEMWebhookDeliveryBackendService._enqueueToDLQ` when a delivery fails,\n * and the sole delivery producer (`AuditEventDispatcherBackendService`) is ORG-scoped.\n * There is no app-scoped producer, so `APPLICATION_SIEM_DELIVERY_DLQ` is never filled in\n * production — its RETRY/PURGE custom-impls and the app-scope delivery seams exist as\n * reserved plumbing, not a wired path. See `AuditEventDispatcherBackendService.\n * dispatchToOrganizationAuditSinks` for the full rationale + how a future app producer\n * would attach.\n *\n * @see auth-data-model-audit.md §2E\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories } from '@wildo-ai/zod-decorators';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const SiemDeliveryDlqStatus = {\n  PENDING_RETRY: 'pending_retry',\n  EXHAUSTED: 'exhausted',\n  DELIVERED: 'delivered',\n} as const;\n\nexport const SiemDeliveryDlqBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  eventId: z.string().min(1),\n  // USAGE — this is a FAILED AUDIT EVENT held for retry, so it carries the same personal data the\n  // audit row does. A dead-letter queue is where personal data sits longest and is looked at least;\n  // that it is transit state rather than a record does not remove it from the notice.\n  //\n  // `addDataCategories` because `z.unknown()` carries no prototype-installed decorators.\n  eventPayload: addDataCategories(z.unknown(), PersonalDataCategory.USAGE),\n  failureReason: z.string().min(1).isSummaryField(),\n  failureCount: z.number().min(0).default(1),\n  lastAttemptAt: z.date(),\n  nextRetryAt: z.date().optional(),\n  status: z.enum(SiemDeliveryDlqStatus).default(SiemDeliveryDlqStatus.PENDING_RETRY).isSummaryField(),\n\n  // Summary field: DLQ entry time is core row identity for the failed-deliveries\n  // dashboard (per-row time + the LIST's `temporalGroupField: 'createdAt'` day\n  // grouping read it from the SUMMARY DTO — mirrors the m2m delivery log).\n  createdAt: z.date().default(() => new Date()).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\n\nexport type SiemDeliveryDlqBase = z.infer<typeof SiemDeliveryDlqBaseSchema>;\n\nexport const siemDeliveryDlqPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'siemDeliveryDlq',\n  baseFieldIdentifier: 'siemDeliveryDlqId',\n  baseEnumKey: 'SIEM_DELIVERY_DLQ',\n  baseSchema: SiemDeliveryDlqBaseSchema,\n  // Many DLQ rows per scope (each failed delivery is its own document) — opt\n  // out of the polymorphism engine's singleton-per-scope auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/security/authentications/siem/siem-delivery-outbox.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-outbox.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-outbox.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAqB/G,eAAO,MAAM,sCAAsC,0RAsElD,CAAC"}
+{"version":3,"file":"siem-delivery-outbox.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-outbox.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAqB/G,eAAO,MAAM,sCAAsC,0RAsElD,CAAC"}

package/dist/esm/security/authentications/siem/siem-delivery-outbox.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-outbox.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-outbox.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wCAAwC,EAAE,MAAM,uCAAuC,CAAC;AAEjG;;;;;;GAMG;AACH,MAAM,0BAA0B,GAA6B;IAC3D,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,uCAAuC,CAC3F,wCAAwC,EACxC;IACE,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE;QACd,iCAAiC;QACjC,qBAAqB,CAAC,MAAM;QAC5B,wDAAwD;QACxD,qBAAqB,CAAC,IAAI;QAC1B,gGAAgG;QAChG,qBAAqB,CAAC,IAAI;QAC1B,iFAAiF;QACjF,qBAAqB,CAAC,MAAM;QAC5B,yFAAyF;QACzF,0EAA0E;QAC1E,qBAAqB,CAAC,MAAM;QAC5B,sFAAsF;QACtF,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SIEM Delivery Outbox Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...siemDeliveryOutboxPolymorphicFactories\n *\n * ## Every operation is REPOSITORY_ONLY, and that is the whole configuration\n *\n * This resource has no HTTP surface at all — no `API_CALL` variant, no custom operation, nothing an\n * operator can address. It differs from its DLQ sibling in exactly that way, and deliberately: the\n * DLQ is a triage surface a human works (retry this, purge those), while the outbox is machinery\n * mid-flight. A row here is owned by the collector between the moment an event is accepted and the\n * moment a collector takes it, which is ordinarily under a minute.\n *\n * Exposing it would create an operator affordance over rows that a concurrent flush may be claiming\n * — a delete racing a claim, a \"retry\" on something already in flight — for no question a human\n * actually has. The question an operator DOES have (\"what failed to reach my SIEM?\") is the DLQ's,\n * and it is already answered there.\n *\n * So the roles below gate repository-tier resolution only; they are not a permission an HTTP request\n * can ever exercise. They mirror the DLQ's rather than inventing a second answer, because a scope\n * that may read its dead letters is the same scope that would own its pending ones.\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { siemDeliveryOutboxPolymorphicDeclaration } from './siem-delivery-outbox.shared.schemas';\n\n/**\n * The polymorphic role map every operation here carries — one object rather than six copies.\n *\n * The DLQ declares its identical map inline at each of its six operations, which is how a role set\n * comes to disagree with itself one operation at a time. There is nothing per-operation to vary:\n * the answer is \"the scope's administrator\", for all of them.\n */\nconst SIEM_DELIVERY_OUTBOX_ROLES: Record<string, string[]> = {\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\nexport const siemDeliveryOutboxPolymorphicFactories = createPolymorphicResourceConfigurations(\n  siemDeliveryOutboxPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    coreOperations: [\n      // The append, on the audit path.\n      CoreResourceOperation.CREATE,\n      // The claim reads a row back after its compare-and-set.\n      CoreResourceOperation.READ,\n      // Pending-set queries: by destination, oldest first, and the count that fires the size trigger.\n      CoreResourceOperation.LIST,\n      // The claim itself — `atomicConditionalSet` resolves a DEFAULT UPDATE operation.\n      CoreResourceOperation.UPDATE,\n      // A delivered row is gone; there is no terminal state to keep. The DLQ is where a FAILED\n      // delivery is retained, and a row that succeeded has nothing left to say.\n      CoreResourceOperation.DELETE,\n      // Bulk twin of DELETE: one flush retires its whole claimed set in a single statement.\n      CoreResourceOperation.DELETE_MANY,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"siem-delivery-outbox.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-outbox.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,wCAAwC,EAAE,MAAM,uCAAuC,CAAC;AAEjG;;;;;;GAMG;AACH,MAAM,0BAA0B,GAA6B;IAC3D,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;IAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;CACvE,CAAC;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,uCAAuC,CAC3F,wCAAwC,EACxC;IACE,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE;QACd,iCAAiC;QACjC,qBAAqB,CAAC,MAAM;QAC5B,wDAAwD;QACxD,qBAAqB,CAAC,IAAI;QAC1B,gGAAgG;QAChG,qBAAqB,CAAC,IAAI;QAC1B,iFAAiF;QACjF,qBAAqB,CAAC,MAAM;QAC5B,yFAAyF;QACzF,0EAA0E;QAC1E,qBAAqB,CAAC,MAAM;QAC5B,sFAAsF;QACtF,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,0BAA0B;oBAC3C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SIEM Delivery Outbox Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...siemDeliveryOutboxPolymorphicFactories\n *\n * ## Every operation is REPOSITORY_ONLY, and that is the whole configuration\n *\n * This resource has no HTTP surface at all — no `API_CALL` variant, no custom operation, nothing an\n * operator can address. It differs from its DLQ sibling in exactly that way, and deliberately: the\n * DLQ is a triage surface a human works (retry this, purge those), while the outbox is machinery\n * mid-flight. A row here is owned by the collector between the moment an event is accepted and the\n * moment a collector takes it, which is ordinarily under a minute.\n *\n * Exposing it would create an operator affordance over rows that a concurrent flush may be claiming\n * — a delete racing a claim, a \"retry\" on something already in flight — for no question a human\n * actually has. The question an operator DOES have (\"what failed to reach my SIEM?\") is the DLQ's,\n * and it is already answered there.\n *\n * So the roles below gate repository-tier resolution only; they are not a permission an HTTP request\n * can ever exercise. They mirror the DLQ's rather than inventing a second answer, because a scope\n * that may read its dead letters is the same scope that would own its pending ones.\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { siemDeliveryOutboxPolymorphicDeclaration } from './siem-delivery-outbox.shared.schemas';\n\n/**\n * The polymorphic role map every operation here carries — one object rather than six copies.\n *\n * The DLQ declares its identical map inline at each of its six operations, which is how a role set\n * comes to disagree with itself one operation at a time. There is nothing per-operation to vary:\n * the answer is \"the scope's administrator\", for all of them.\n */\nconst SIEM_DELIVERY_OUTBOX_ROLES: Record<string, string[]> = {\n  [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n  [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n};\n\nexport const siemDeliveryOutboxPolymorphicFactories = createPolymorphicResourceConfigurations(\n  siemDeliveryOutboxPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    coreOperations: [\n      // The append, on the audit path.\n      CoreResourceOperation.CREATE,\n      // The claim reads a row back after its compare-and-set.\n      CoreResourceOperation.READ,\n      // Pending-set queries: by destination, oldest first, and the count that fires the size trigger.\n      CoreResourceOperation.LIST,\n      // The claim itself — `atomicConditionalSet` resolves a DEFAULT UPDATE operation.\n      CoreResourceOperation.UPDATE,\n      // A delivered row is gone; there is no terminal state to keep. The DLQ is where a FAILED\n      // delivery is retained, and a row that succeeded has nothing left to say.\n      CoreResourceOperation.DELETE,\n      // Bulk twin of DELETE: one flush retires its whole claimed set in a single statement.\n      CoreResourceOperation.DELETE_MANY,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      [CoreResourceOperation.DELETE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: SIEM_DELIVERY_OUTBOX_ROLES,\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/siem/siem-delivery-outbox.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-outbox.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-outbox.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBA2DvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,wCAAwC;;;;;;;;;;;kBAQnD,CAAC"}
+{"version":3,"file":"siem-delivery-outbox.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-outbox.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBA2DvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,wCAAwC;;;;;;;;;;;kBAQnD,CAAC"}

package/dist/esm/security/authentications/siem/siem-delivery-outbox.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-outbox.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-outbox.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mEAAmE,CAAC;AACzG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEzD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEhE;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,KAAK,CAAC;IAE3E;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE9B;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAElC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wCAAwC,GAAG,yBAAyB,CAAC;IAChF,gBAAgB,EAAE,oBAAoB;IACtC,mBAAmB,EAAE,sBAAsB;IAC3C,WAAW,EAAE,sBAAsB;IACnC,UAAU,EAAE,4BAA4B;IACxC,yFAAyF;IACzF,sDAAsD;IACtD,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SIEM Delivery Outbox Schema (Shared) — Polymorphic\n *\n * One row per security audit event that is WAITING to be delivered, so that several events can leave\n * as ONE HTTP request. The sibling of `siem-delivery-dlq.shared.schemas.ts` one step earlier in the\n * lane: the DLQ holds what FAILED, this holds what has not been sent yet.\n *\n * ## Why a durable row rather than an in-memory buffer (#1379)\n *\n * The delivery worker posts one event per request because the job is created PER EVENT at enqueue —\n * `processDelivery` is handed one payload and no parameter it receives could ever batch. Grouping\n * therefore has to happen before the queue, and the group has to survive a restart: an event that is\n * already durable on the broker today must not become an event held in a process's heap. So the\n * pending set is a resource, written before the event's job is acknowledged and deleted only once the\n * collector has taken it.\n *\n * An in-memory accumulator was rejected for exactly that reason, and a second candidate — holding the\n * events as UNACKED broker deliveries — was rejected on a measurement: `consume()` runs on the single\n * primary channel and `channel.prefetch(1)` is set on it, so at most ONE delivery is ever in flight\n * per process and no accumulation is possible without a second channel. Keeping the durable half of\n * this lane in one place (the broker for transport, this table for grouping) is the simpler story.\n *\n * ## The two columns that carry the design\n *\n * `destinationKey` is what makes a batch legitimate: a request carries one URL, one auth method and\n * one credential, so rows may only travel together when those agree. It is a FINGERPRINT of the\n * transport configuration rather than the configuration itself, so a config change mid-window simply\n * starts a new key — the rows enqueued under the old one flush under the configuration they were\n * authored against, which is the only honest reading of \"this event was exported to that destination\".\n *\n * `claimId` is what makes concurrent collectors safe. Two replicas may flush the same destination at\n * the same instant; each stamps the rows it intends to send with its own id under a compare-and-set,\n * so a row belongs to exactly one request and the two batches are disjoint rather than duplicated.\n *\n * ── ORG variant is live; the APPLICATION variant is RESERVED / DORMANT ─────────────\n * Declared over `AUTH_SCOPE_VARIANTS` like every other SIEM resource, and populated only for the\n * ORGANIZATION scope for the same reason: the sole delivery producer is org-scoped. See\n * `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories } from '@wildo-ai/zod-decorators';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const SiemDeliveryOutboxBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The envelope's own event id. Also the idempotency key for the append: the event's job may be\n   * redelivered by the broker after a crash between the append and the acknowledgement, and appending\n   * twice would put the same event in the batch twice.\n   */\n  eventId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * Fingerprint of the transport configuration this event is bound for — see the header. Indexed\n   * because every collector query filters on it: it is the unit a batch is assembled over.\n   */\n  destinationKey: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * The delivery job payload as the dispatcher built it: the envelope, its F6 HMAC, the attempt\n   * number and the projected transport config.\n   *\n   * Stored WHOLE rather than decomposed so the collector sends exactly what the one-event path would\n   * have sent. The alternative — rebuilding a payload at flush time from parts — is the shape that\n   * lets a batched delivery drift from an unbatched one, and the enqueue seam exists precisely to\n   * stop two producers building different payloads for the same event.\n   *\n   * USAGE — this is a security audit event awaiting export, so it carries the same personal data the\n   * audit row does, for as long as it waits. `addDataCategories` because `z.unknown()` carries no\n   * prototype-installed decorators.\n   */\n  deliveryPayload: addDataCategories(z.unknown(), PersonalDataCategory.USAGE),\n\n  /**\n   * Which delivery attempt this event is on, carried across flushes.\n   *\n   * The per-event retry ceiling is unchanged by batching: a rejected event advances its own counter\n   * and dead-letters at `retryAttempts` exactly as it does today, whether it was rejected alone or as\n   * one of fifty. Holding the counter per ROW is what keeps that true — a counter held per BATCH\n   * would make one event's failure spend another's budget.\n   */\n  deliveryAttempt: z.number().int().min(0).default(0),\n\n  /**\n   * The collector run that owns this row, or absent while it is unclaimed.\n   *\n   * A compare-and-set on this field is the whole concurrency story: a flush claims only rows where it\n   * is absent, so two simultaneous flushes of one destination partition the pending set instead of\n   * both sending it.\n   */\n  claimId: z.string().optional(),\n  claimedAt: z.date().optional(),\n\n  /**\n   * When this event may next be attempted — set when a flush defers it under backpressure or after a\n   * failed attempt's backoff. Absent means \"eligible now\".\n   */\n  nextAttemptAt: z.date().optional(),\n\n  createdAt: z.date().default(() => new Date()).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SiemDeliveryOutboxBase = z.infer<typeof SiemDeliveryOutboxBaseSchema>;\n\nexport const siemDeliveryOutboxPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'siemDeliveryOutbox',\n  baseFieldIdentifier: 'siemDeliveryOutboxId',\n  baseEnumKey: 'SIEM_DELIVERY_OUTBOX',\n  baseSchema: SiemDeliveryOutboxBaseSchema,\n  // Many pending rows per scope — opt out of the polymorphism engine's singleton-per-scope\n  // auto-business-key, exactly as the DLQ sibling does.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"siem-delivery-outbox.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-outbox.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mEAAmE,CAAC;AACzG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEzD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAEhE;;;;;;;;;;;;OAYG;IACH,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,KAAK,CAAC;IAE3E;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAE9B;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAElC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACtG,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wCAAwC,GAAG,yBAAyB,CAAC;IAChF,gBAAgB,EAAE,oBAAoB;IACtC,mBAAmB,EAAE,sBAAsB;IAC3C,WAAW,EAAE,sBAAsB;IACnC,UAAU,EAAE,4BAA4B;IACxC,yFAAyF;IACzF,sDAAsD;IACtD,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SIEM Delivery Outbox Schema (Shared) — Polymorphic\n *\n * One row per security audit event that is WAITING to be delivered, so that several events can leave\n * as ONE HTTP request. The sibling of `siem-delivery-dlq.shared.schemas.ts` one step earlier in the\n * lane: the DLQ holds what FAILED, this holds what has not been sent yet.\n *\n * ## Why a durable row rather than an in-memory buffer (#1379)\n *\n * The delivery worker posts one event per request because the job is created PER EVENT at enqueue —\n * `processDelivery` is handed one payload and no parameter it receives could ever batch. Grouping\n * therefore has to happen before the queue, and the group has to survive a restart: an event that is\n * already durable on the broker today must not become an event held in a process's heap. So the\n * pending set is a resource, written before the event's job is acknowledged and deleted only once the\n * collector has taken it.\n *\n * An in-memory accumulator was rejected for exactly that reason, and a second candidate — holding the\n * events as UNACKED broker deliveries — was rejected on a measurement: `consume()` runs on the single\n * primary channel and `channel.prefetch(1)` is set on it, so at most ONE delivery is ever in flight\n * per process and no accumulation is possible without a second channel. Keeping the durable half of\n * this lane in one place (the broker for transport, this table for grouping) is the simpler story.\n *\n * ## The two columns that carry the design\n *\n * `destinationKey` is what makes a batch legitimate: a request carries one URL, one auth method and\n * one credential, so rows may only travel together when those agree. It is a FINGERPRINT of the\n * transport configuration rather than the configuration itself, so a config change mid-window simply\n * starts a new key — the rows enqueued under the old one flush under the configuration they were\n * authored against, which is the only honest reading of \"this event was exported to that destination\".\n *\n * `claimId` is what makes concurrent collectors safe. Two replicas may flush the same destination at\n * the same instant; each stamps the rows it intends to send with its own id under a compare-and-set,\n * so a row belongs to exactly one request and the two batches are disjoint rather than duplicated.\n *\n * ── ORG variant is live; the APPLICATION variant is RESERVED / DORMANT ─────────────\n * Declared over `AUTH_SCOPE_VARIANTS` like every other SIEM resource, and populated only for the\n * ORGANIZATION scope for the same reason: the sole delivery producer is org-scoped. See\n * `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../../compliance/privacy/personal-data-category.shared.schemas';\nimport { addDataCategories } from '@wildo-ai/zod-decorators';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const SiemDeliveryOutboxBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /**\n   * The envelope's own event id. Also the idempotency key for the append: the event's job may be\n   * redelivered by the broker after a crash between the append and the acknowledgement, and appending\n   * twice would put the same event in the batch twice.\n   */\n  eventId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * Fingerprint of the transport configuration this event is bound for — see the header. Indexed\n   * because every collector query filters on it: it is the unit a batch is assembled over.\n   */\n  destinationKey: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * The delivery job payload as the dispatcher built it: the envelope, its F6 HMAC, the attempt\n   * number and the projected transport config.\n   *\n   * Stored WHOLE rather than decomposed so the collector sends exactly what the one-event path would\n   * have sent. The alternative — rebuilding a payload at flush time from parts — is the shape that\n   * lets a batched delivery drift from an unbatched one, and the enqueue seam exists precisely to\n   * stop two producers building different payloads for the same event.\n   *\n   * USAGE — this is a security audit event awaiting export, so it carries the same personal data the\n   * audit row does, for as long as it waits. `addDataCategories` because `z.unknown()` carries no\n   * prototype-installed decorators.\n   */\n  deliveryPayload: addDataCategories(z.unknown(), PersonalDataCategory.USAGE),\n\n  /**\n   * Which delivery attempt this event is on, carried across flushes.\n   *\n   * The per-event retry ceiling is unchanged by batching: a rejected event advances its own counter\n   * and dead-letters at `retryAttempts` exactly as it does today, whether it was rejected alone or as\n   * one of fifty. Holding the counter per ROW is what keeps that true — a counter held per BATCH\n   * would make one event's failure spend another's budget.\n   */\n  deliveryAttempt: z.number().int().min(0).default(0),\n\n  /**\n   * The collector run that owns this row, or absent while it is unclaimed.\n   *\n   * A compare-and-set on this field is the whole concurrency story: a flush claims only rows where it\n   * is absent, so two simultaneous flushes of one destination partition the pending set instead of\n   * both sending it.\n   */\n  claimId: z.string().optional(),\n  claimedAt: z.date().optional(),\n\n  /**\n   * When this event may next be attempted — set when a flush defers it under backpressure or after a\n   * failed attempt's backoff. Absent means \"eligible now\".\n   */\n  nextAttemptAt: z.date().optional(),\n\n  createdAt: z.date().default(() => new Date()).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SiemDeliveryOutboxBase = z.infer<typeof SiemDeliveryOutboxBaseSchema>;\n\nexport const siemDeliveryOutboxPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'siemDeliveryOutbox',\n  baseFieldIdentifier: 'siemDeliveryOutboxId',\n  baseEnumKey: 'SIEM_DELIVERY_OUTBOX',\n  baseSchema: SiemDeliveryOutboxBaseSchema,\n  // Many pending rows per scope — opt out of the polymorphism engine's singleton-per-scope\n  // auto-business-key, exactly as the DLQ sibling does.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/security/authentications/siem/siem-delivery-reliability-contract.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-reliability-contract.shared.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-reliability-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;IAC7C,2FAA2F;;IAE3F,mEAAmE;;CAE3D,CAAC;AAEX,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,EAAE,MAAqF,CAAC"}
+{"version":3,"file":"siem-delivery-reliability-contract.shared.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-reliability-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC;IAC7C,2FAA2F;;IAE3F,mEAAmE;;CAE3D,CAAC;AAEX,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,EAAE,MAAqF,CAAC"}

package/dist/esm/security/authentications/siem/siem-delivery-reliability-contract.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-delivery-reliability-contract.shared.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-delivery-reliability-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,2FAA2F;IAC3F,8BAA8B,EAAE,CAAC;IACjC,mEAAmE;IACnE,6BAA6B,EAAE,CAAC;CACxB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAAW,kCAAkC,CAAC,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC","sourcesContent":["/**\n * What an operator can rely on when a SIEM receiver starts failing.\n *\n * The retry count, backoff and timeout are configurable per organization and already live on\n * `SiemExportConfigBaseSchema`. The circuit breaker is not configurable: it is a fixed protection\n * against a failing receiver absorbing the delivery worker, and it was two module-private constants\n * inside the delivery service. That is why the operations page could describe the breaker's\n * existence but never say when it opens or how long it stays open — the numbers had no name the\n * documentation could cite.\n *\n * The delivery service derives from this object and the customer documentation projects it.\n */\nexport const SIEM_DELIVERY_RELIABILITY_CONTRACT = {\n  /** Consecutive delivery failures to one destination before deliveries to it are paused. */\n  circuitBreakerFailureThreshold: 5,\n  /** How long the pause lasts before one delivery is tried again. */\n  circuitBreakerCooldownMinutes: 5,\n} as const;\n\n/** The cooldown in milliseconds, for the delivery worker's own timers. */\nexport const SIEM_CIRCUIT_BREAKER_COOLDOWN_MS: number = SIEM_DELIVERY_RELIABILITY_CONTRACT.circuitBreakerCooldownMinutes * 60 * 1000;\n"]}
+{"version":3,"file":"siem-delivery-reliability-contract.shared.js","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-delivery-reliability-contract.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,2FAA2F;IAC3F,8BAA8B,EAAE,CAAC;IACjC,mEAAmE;IACnE,6BAA6B,EAAE,CAAC;CACxB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAAW,kCAAkC,CAAC,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC","sourcesContent":["/**\n * What an operator can rely on when a SIEM receiver starts failing.\n *\n * The retry count, backoff and timeout are configurable per organization and already live on\n * `SiemExportConfigBaseSchema`. The circuit breaker is not configurable: it is a fixed protection\n * against a failing receiver absorbing the delivery worker, and it was two module-private constants\n * inside the delivery service. That is why the operations page could describe the breaker's\n * existence but never say when it opens or how long it stays open — the numbers had no name the\n * documentation could cite.\n *\n * The delivery service derives from this object and the customer documentation projects it.\n */\nexport const SIEM_DELIVERY_RELIABILITY_CONTRACT = {\n  /** Consecutive delivery failures to one destination before deliveries to it are paused. */\n  circuitBreakerFailureThreshold: 5,\n  /** How long the pause lasts before one delivery is tried again. */\n  circuitBreakerCooldownMinutes: 5,\n} as const;\n\n/** The cooldown in milliseconds, for the delivery worker's own timers. */\nexport const SIEM_CIRCUIT_BREAKER_COOLDOWN_MS: number = SIEM_DELIVERY_RELIABILITY_CONTRACT.circuitBreakerCooldownMinutes * 60 * 1000;\n"]}

package/dist/esm/security/authentications/siem/siem-export-config.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EAEL,4BAA4B,EAC7B,MAAM,6CAA6C,CAAC;AAQrD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC,EAAE,QAAQ,CAAC;IAG3D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,aAAa,CAAC;IAC3E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,QAAQ,CAAC;CACvE,CAGA,CAAC;AAIF,eAAO,MAAM,oCAAoC,yNA4GhD,CAAC"}
+{"version":3,"file":"siem-export-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EAEL,4BAA4B,EAC7B,MAAM,6CAA6C,CAAC;AAQrD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC,EAAE,QAAQ,CAAC;IAG3D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,aAAa,CAAC;IAC3E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,QAAQ,CAAC;CACvE,CAGA,CAAC;AAIF,eAAO,MAAM,oCAAoC,yNA4GhD,CAAC"}

package/dist/esm/security/authentications/siem/siem-export-config.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,sCAAsC,EAAE,MAAM,qCAAqC,CAAC;AAE7F,wEAAwE;AAExE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAK7C;IACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,aAAa;IAC1E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,QAAQ;CACtE,CAAC;AAEF,wEAAwE;AAExE,MAAM,CAAC,MAAM,oCAAoC,GAAG,uCAAuC,CACzF,sCAAsC,EACtC;IACE,gBAAgB,EAAE,IAAI;IACtB,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,oEAAoE;IACpE,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,mCAAmC;IACnC,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACtI,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,qCAAqC,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBAChF,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,kGAAkG;QAClG,iGAAiG;QACjG,6FAA6F;QAC7F,6FAA6F;QAC7F,oFAAoF;QACpF,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,sFAAsF;QACtF,+FAA+F;QAC/F,EAAE;QACF,iGAAiG;QACjG,sFAAsF;QACtF,wGAAwG;QACxG,wEAAwE;QACxE,EAAE;QACF,sGAAsG;QACtG,8FAA8F;QAC9F,gGAAgG;QAChG,iGAAiG;QACjG,6FAA6F;QAC7F,qDAAqD;QACrD,EAAE;QACF,uGAAuG;QACvG,0FAA0F;QAC1F,yEAAyE;QACzE,wGAAwG;QACxG,8EAA8E;QAC9E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,qCAAqC,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBAChF,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,oFAAoF;QACpF,8EAA8E;QAC9E,+EAA+E;QAC/E,+DAA+D;QAC/D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SIEM Export Config Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...siemExportConfigPolymorphicFactories\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { siemExportConfigPolymorphicDeclaration } from './siem-export-config.shared.schemas';\n\n// ── Write variants ───────────────────────────────────────────────────\n\n/**\n * The variant type each SIEM-export-config WRITE runs on — the one named source both this configuration\n * and the backend hooks registered on these writes read (credential sealing, cache invalidation, change\n * audit).\n *\n * A custom implementation is keyed by `(resource, operation, variantType)`. Until #953 each hook\n * restated `INTERNAL_CALL` by hand, so moving UPDATE onto its API_CALL door meant editing four files\n * in lockstep, and the first one missed would silently stop sealing credentials. Startup validation\n * would refuse the mismatch, but only once the process was already starting.\n *\n * - `CREATE` stays `INTERNAL_CALL`: the row is seeded, or lazily materialised on the userless login\n *   path, and never created self-serve.\n * - `UPDATE` is `API_CALL`: the admin's edit door.\n */\nexport const SIEM_EXPORT_CONFIG_WRITE_VARIANT_TYPE: Readonly<{\n  // Exact members, not the enum: a variant is a union DISCRIMINATED by `variantType`, so a value typed\n  // as the whole enum matches no member of it.\n  [CoreResourceOperation.CREATE]: ResourceOperationVariantType.INTERNAL_CALL;\n  [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL;\n}> = {\n  [CoreResourceOperation.CREATE]: ResourceOperationVariantType.INTERNAL_CALL,\n  [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL,\n};\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const siemExportConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n  siemExportConfigPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // Audit/SIEM dispatch loads the export config via `readAsSystem` to decide\n    // where to deliver events, independent of any user (READ). When the row is\n    // absent — a provisioned / migrated / pre-seed org that bypassed the\n    // `afterCreate` default-seed — that same userless login path lazily\n    // materialises the disabled-default row via `createAsSystem` (CREATE); see\n    // `AuthOrganizationConfigurationService.loadSiemExportConfig`. Both are\n    // system-context (the logging-in user is not the config's admin owner), so\n    // the resource opts BOTH verbs in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n      // materialised by the framework default-seed (repository tier) OR — when that\n      // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n      // userless login path via `createAsSystem` (`systemAccessPolicy.create` opts\n      // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n      // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n      // self-alerting on mere construction) on every login for a config-less org.\n      // No public HTTP create surface (config is seeded/bootstrapped, never\n      // self-serve). Same fix as the SCIM-tokens READ/UPDATE. Admin tier / MEDIUM.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: SIEM_EXPORT_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.CREATE],\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      // THE WRITE DOOR (API_CALL, #953). Until 2026-09-13 this was INTERNAL_CALL with the comment \"SIEM\n      // config edits reach this through `AuthOrganizationConfigurationService.saveSiemExportConfig`\" —\n      // and nothing in production called that method. The engine preset rendered an edit form, the\n      // customer documentation told an operator which values to enter, and the only rows that ever\n      // carried a destination were written straight into the database by the e2e harness.\n      //\n      // A plain UPDATE, not a named domain operation: this is an edit of the scope's one config row\n      // over the fields the form already renders, with no step-specific transition to model (the SSO\n      // domain claim/verify/revoke operations are named because each IS such a transition).\n      // `saveSiemExportConfig` still resolves this same default variant, so there is one write path.\n      //\n      // Both scope variants get the door, because a polymorphic declaration cannot give them different\n      // variant types. The APPLICATION variant is settable and INERT — no producer delivers\n      // application-scoped events (see `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`)\n      // — decided deliberately on 2026-09-13 rather than refused at the door.\n      //\n      // HIGH, not MEDIUM: HIGH is inside `AUTOMATIC_AUDIT_RISK_FLOOR`, so EVERY edit on EITHER scope leaves\n      // a `RESOURCE_OPERATION_PERFORMED` row. The organization variant additionally emits the typed\n      // `ORGANIZATION_SIEM_EXPORT_CONFIGURED`; the application variant has no typed event (its schema\n      // names an organization), so at MEDIUM an application-scope destination change recorded nothing.\n      // The change is high-consequence either way: it decides where a tenant's security events go,\n      // whether they go at all, and with which credential.\n      //\n      // ⚠️ `authCredential` IS SEALED BY A CUSTOM IMPLEMENTATION ON THIS PATH (#951). `.isWriteOnlySecret()`\n      // governs how a value is PRESENTED, never how it is STORED. This variant and the sealing,\n      // cache-invalidation and change-audit hooks in saas-backend-lib all read\n      // `SIEM_EXPORT_CONFIG_WRITE_VARIANT_TYPE`, so they move together. Hard-code a variant type here instead\n      // and all three hooks are orphaned, which startup validation refuses by name.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: SIEM_EXPORT_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.UPDATE],\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n      // onParentDelete cascade so this one-per-scope SIEM-export-config row is physically\n      // removed when its owning org/app is deleted. Without a DELETE op the cascade\n      // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a\n      // config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"siem-export-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-export-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,sCAAsC,EAAE,MAAM,qCAAqC,CAAC;AAE7F,wEAAwE;AAExE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAK7C;IACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,aAAa;IAC1E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,QAAQ;CACtE,CAAC;AAEF,wEAAwE;AAExE,MAAM,CAAC,MAAM,oCAAoC,GAAG,uCAAuC,CACzF,sCAAsC,EACtC;IACE,gBAAgB,EAAE,IAAI;IACtB,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,oEAAoE;IACpE,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,mCAAmC;IACnC,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACtI,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,6EAA6E;QAC7E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,qCAAqC,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBAChF,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C,CAAC;SACH;QACD,kGAAkG;QAClG,iGAAiG;QACjG,6FAA6F;QAC7F,6FAA6F;QAC7F,oFAAoF;QACpF,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,sFAAsF;QACtF,+FAA+F;QAC/F,EAAE;QACF,iGAAiG;QACjG,sFAAsF;QACtF,wGAAwG;QACxG,wEAAwE;QACxE,EAAE;QACF,sGAAsG;QACtG,8FAA8F;QAC9F,gGAAgG;QAChG,iGAAiG;QACjG,6FAA6F;QAC7F,qDAAqD;QACrD,EAAE;QACF,uGAAuG;QACvG,0FAA0F;QAC1F,yEAAyE;QACzE,wGAAwG;QACxG,8EAA8E;QAC9E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,qCAAqC,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBAChF,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,oFAAoF;QACpF,8EAA8E;QAC9E,+EAA+E;QAC/E,+DAA+D;QAC/D,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SIEM Export Config Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...siemExportConfigPolymorphicFactories\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { siemExportConfigPolymorphicDeclaration } from './siem-export-config.shared.schemas';\n\n// ── Write variants ───────────────────────────────────────────────────\n\n/**\n * The variant type each SIEM-export-config WRITE runs on — the one named source both this configuration\n * and the backend hooks registered on these writes read (credential sealing, cache invalidation, change\n * audit).\n *\n * A custom implementation is keyed by `(resource, operation, variantType)`. Until #953 each hook\n * restated `INTERNAL_CALL` by hand, so moving UPDATE onto its API_CALL door meant editing four files\n * in lockstep, and the first one missed would silently stop sealing credentials. Startup validation\n * would refuse the mismatch, but only once the process was already starting.\n *\n * - `CREATE` stays `INTERNAL_CALL`: the row is seeded, or lazily materialised on the userless login\n *   path, and never created self-serve.\n * - `UPDATE` is `API_CALL`: the admin's edit door.\n */\nexport const SIEM_EXPORT_CONFIG_WRITE_VARIANT_TYPE: Readonly<{\n  // Exact members, not the enum: a variant is a union DISCRIMINATED by `variantType`, so a value typed\n  // as the whole enum matches no member of it.\n  [CoreResourceOperation.CREATE]: ResourceOperationVariantType.INTERNAL_CALL;\n  [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL;\n}> = {\n  [CoreResourceOperation.CREATE]: ResourceOperationVariantType.INTERNAL_CALL,\n  [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL,\n};\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const siemExportConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n  siemExportConfigPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // Audit/SIEM dispatch loads the export config via `readAsSystem` to decide\n    // where to deliver events, independent of any user (READ). When the row is\n    // absent — a provisioned / migrated / pre-seed org that bypassed the\n    // `afterCreate` default-seed — that same userless login path lazily\n    // materialises the disabled-default row via `createAsSystem` (CREATE); see\n    // `AuthOrganizationConfigurationService.loadSiemExportConfig`. Both are\n    // system-context (the logging-in user is not the config's admin owner), so\n    // the resource opts BOTH verbs in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n      // materialised by the framework default-seed (repository tier) OR — when that\n      // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n      // userless login path via `createAsSystem` (`systemAccessPolicy.create` opts\n      // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n      // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n      // self-alerting on mere construction) on every login for a config-less org.\n      // No public HTTP create surface (config is seeded/bootstrapped, never\n      // self-serve). Same fix as the SCIM-tokens READ/UPDATE. Admin tier / MEDIUM.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: SIEM_EXPORT_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.CREATE],\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        }],\n      },\n      // THE WRITE DOOR (API_CALL, #953). Until 2026-09-13 this was INTERNAL_CALL with the comment \"SIEM\n      // config edits reach this through `AuthOrganizationConfigurationService.saveSiemExportConfig`\" —\n      // and nothing in production called that method. The engine preset rendered an edit form, the\n      // customer documentation told an operator which values to enter, and the only rows that ever\n      // carried a destination were written straight into the database by the e2e harness.\n      //\n      // A plain UPDATE, not a named domain operation: this is an edit of the scope's one config row\n      // over the fields the form already renders, with no step-specific transition to model (the SSO\n      // domain claim/verify/revoke operations are named because each IS such a transition).\n      // `saveSiemExportConfig` still resolves this same default variant, so there is one write path.\n      //\n      // Both scope variants get the door, because a polymorphic declaration cannot give them different\n      // variant types. The APPLICATION variant is settable and INERT — no producer delivers\n      // application-scoped events (see `AuditEventDispatcherBackendService.dispatchToOrganizationAuditSinks`)\n      // — decided deliberately on 2026-09-13 rather than refused at the door.\n      //\n      // HIGH, not MEDIUM: HIGH is inside `AUTOMATIC_AUDIT_RISK_FLOOR`, so EVERY edit on EITHER scope leaves\n      // a `RESOURCE_OPERATION_PERFORMED` row. The organization variant additionally emits the typed\n      // `ORGANIZATION_SIEM_EXPORT_CONFIGURED`; the application variant has no typed event (its schema\n      // names an organization), so at MEDIUM an application-scope destination change recorded nothing.\n      // The change is high-consequence either way: it decides where a tenant's security events go,\n      // whether they go at all, and with which credential.\n      //\n      // ⚠️ `authCredential` IS SEALED BY A CUSTOM IMPLEMENTATION ON THIS PATH (#951). `.isWriteOnlySecret()`\n      // governs how a value is PRESENTED, never how it is STORED. This variant and the sealing,\n      // cache-invalidation and change-audit hooks in saas-backend-lib all read\n      // `SIEM_EXPORT_CONFIG_WRITE_VARIANT_TYPE`, so they move together. Hard-code a variant type here instead\n      // and all three hooks are orphaned, which startup validation refuses by name.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: SIEM_EXPORT_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.UPDATE],\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n      // onParentDelete cascade so this one-per-scope SIEM-export-config row is physically\n      // removed when its owning org/app is deleted. Without a DELETE op the cascade\n      // (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope with a\n      // config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/siem/siem-export-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;CAMpB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgMrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAMjD,CAAC"}
+{"version":3,"file":"siem-export-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;CAMpB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgMrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAMjD,CAAC"}

package/dist/esm/security/authentications/siem/siem-export-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"siem-export-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qCAAqC,EAAE,MAAM,yEAAyE,CAAC;AAChI,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,eAAe,EAAE,iBAAiB;IAClC,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAE,eAAe;IAC9B,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;CAClB,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IAEpD,4EAA4E;IAC5E,6EAA6E;IAC7E,qEAAqE;IACrE,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC;IAC/D;;;;;;;;;;;;;;OAcG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IACzD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC;IAE3D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC;IAE7E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;YACrD,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,WAAW;SAC9B,CAAC,CAAC,QAAQ,CAAC,oDAAoD,CAAC;QACjE,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mEAAmE,CAAC;QAC1J,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4FAA4F,CAAC;KAC1J,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB;;;;;;;;;;;;;;WAcG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kGAAkG,CAAC;QACnK;;;;;;;;;;WAUG;QACH,kBAAkB,EAAE,CAAC,CAAC,UAAU;QAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAoCG;QACH,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAC5C,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAC3C,CAAC,QAAQ,CAAC,oHAAoH,CAAC;QAChI,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QAC3G,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,oFAAoF,CAAC;QAC1J,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC;KACtH,CAAC;IAEF,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE1D;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IAElE;;;;;;;;;;;;;;;;;;;;;OAqBG;IAEH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sCAAsC,GAAG,yBAAyB,CAAC;IAC9E,gBAAgB,EAAE,kBAAkB;IACpC,mBAAmB,EAAE,oBAAoB;IACzC,WAAW,EAAE,oBAAoB;IACjC,UAAU,EAAE,0BAA0B;IACtC,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SIEM Export Config Schema (Shared) — Polymorphic\n *\n * Webhook configuration for exporting security audit events to external SIEM.\n * Nested sub-objects: eventFilter{}, delivery{}.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * ── ORG variant is live; the APPLICATION variant is settable but INERT ─────────────\n * The polymorphism below emits both an ORGANIZATION and an APPLICATION variant. Only the\n * ORGANIZATION variant drives delivery today: the sole SIEM producer\n * (`AuditEventDispatcherBackendService`) fans out per authenticated tenant (org) and reads\n * this config via `loadSiemExportConfig(ec, ORGANIZATION, orgId)`. An app super-admin CAN\n * create/enable `APPLICATION_SIEM_EXPORT_CONFIG` (it has its own custom-impl +\n * APP_ADMIN_SUPER_ADMIN roles), but NO producer emits app-scoped deliveries, so an enabled\n * app config silently delivers nothing. The APP variant is RESERVED / DORMANT until an\n * app-scoped producer is built — see `AuditEventDispatcherBackendService.\n * dispatchToOrganizationAuditSinks` for the rationale + the wiring it would need. (When\n * that producer lands, or if this trap is hardened sooner, the app config surface should\n * be gated/hidden until delivery actually works.)\n *\n * @see auth-data-model-audit.md §2D\n */\n\nimport { z } from 'zod';\nimport { SiemExportProjectionDeclarationSchema } from '../../../compliance/audit-trails/audit-export-projection.shared.schemas';\nimport { WildoHeaderKeys } from '../../../requests/header-keys.shared';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const SIEMAuthMethod = {\n  BEARER_TOKEN: 'bearer_token',\n  API_KEY_HEADER: 'api_key_header',\n  HMAC_SHA256: 'hmac_sha256',\n  NONE: 'none',\n} as const;\n\n/**\n * The wire formats a tenant's SIEM export can request.\n *\n * `OCSF` is the JSON-native security schema the category has standardised on (ITU ratification track\n * to June 2026), and it is a PEER of the two text formats rather than a replacement: CEF and LEEF stay\n * for tenants whose SIEM wants them. The difference that matters is representational — a\n * security-audit envelope maps onto an OCSF CLASS natively, where CEF can only force it into a\n * `csN` custom-string slot.\n */\nexport const SIEMEventFormat = {\n  JSON_STRUCTURED: 'json_structured',\n  CEF: 'cef',\n  LEEF: 'leef',\n  OCSF: 'ocsf',\n} as const;\n\nexport const SIEMEventCategory = {\n  AUTHENTICATION: 'authentication',\n  AUTHORIZATION: 'authorization',\n  USER_LIFECYCLE: 'user_lifecycle',\n  ORG_MANAGEMENT: 'org_management',\n  DATA_ACCESS: 'data_access',\n} as const;\n\nexport const SIEMFilterSeverity = {\n  INFO: 'info',\n  WARNING: 'warning',\n  CRITICAL: 'critical',\n} as const;\n\nexport const SiemExportConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  enabled: z.boolean().default(false).isSummaryField(),\n\n  // Destination for exported audit events. The empty string is the DISABLED /\n  // not-yet-configured state (paired with `enabled: false`) and is the default\n  // for a freshly-seeded config — so the union MUST admit `''`. A bare\n  // `z.url().default('')` is self-contradictory: `z.url()` rejects `''`, so the\n  // default value fails output re-validation and every unconfigured row 500s on\n  // READ (`transformOutput`). Accept a real URL OR the empty sentinel.\n  webhookUrl: z.url().or(z.literal('')).default(''),\n\n  authMethod: z.enum(SIEMAuthMethod).default(SIEMAuthMethod.NONE),\n  /**\n   * User-provided secret used to authenticate outbound webhook deliveries to the\n   * customer's SIEM endpoint (bearer token, API-key value, etc.).\n   *\n   * `.isWriteOnlySecret()` gives this the framework's write-then-masked-secret\n   * contract: it stays in the CREATE/UPDATE request DTO (the operator supplies\n   * and rotates it) and in the response DTO (so the UI renders a masked\n   * placeholder), but the framework redacts it to `••••••••` at the client\n   * boundary and treats a round-tripped `••••••••` on write as \"keep the existing\n   * secret\". The real value is retained for backend internal reads only — the\n   * webhook dispatcher reads it via `readAsSystem` to sign deliveries. Do NOT use\n   * `.isBackendOnly()` here: that strips the field from every client DTO, dropping\n   * the operator's typed value before it is stored and leaving the presets a field\n   * they cannot resolve.\n   */\n  authCredential: z.string().optional().isWriteOnlySecret(),\n  authHeaderName: z.string().default(WildoHeaderKeys.API_KEY),\n\n  eventFormat: z.enum(SIEMEventFormat).default(SIEMEventFormat.JSON_STRUCTURED),\n\n  eventFilter: z.object({\n    categories: z.array(z.enum(SIEMEventCategory)).default([\n      SIEMEventCategory.AUTHENTICATION,\n      SIEMEventCategory.AUTHORIZATION,\n      SIEMEventCategory.USER_LIFECYCLE,\n      SIEMEventCategory.ORG_MANAGEMENT,\n      SIEMEventCategory.DATA_ACCESS,\n    ]).describe(\"The event categories exported to this destination.\"),\n    severityMinimum: z.enum(SIEMFilterSeverity).default(SIEMFilterSeverity.INFO).describe(\"The least severe event exported. Less severe events are not sent.\"),\n    specificEventTypes: z.array(z.string()).optional().describe(\"An optional allow-list of event types, matched exactly: no substring or wildcard matching.\"),\n  }),\n\n  /*\n   * Three knobs, and the two that were removed are the reason to read this.\n   *\n   * `retryAttempts`, `retryBackoffSeconds` and `timeoutSeconds` are honoured — the delivery worker\n   * reads all three (`siem-webhook-delivery.backend.service`, at the retry ceiling, the exponential\n   * backoff and the request deadline).\n   *\n   * `batchSize` and `batchWindowSeconds` are honoured TOO, as of #1379 — but they were not always,\n   * and the history is the reason to read this rather than trivia. They spent months appearing in\n   * the delivery service only as fields of its parameter TYPE: declared, passed, never consulted.\n   * That is the shape which makes an inert knob hardest to see, because it has a \"reader\" that\n   * decides nothing. The worker posted ONE event per HTTP request whatever they said, and the\n   * customer documentation warned an operator not to size a receiver or a billing estimate on\n   * either — a warning being what you write when the control is missing.\n   *\n   * They were deleted in `be001548` rather than kept as a disclosed \"reserved\" knob, on the\n   * principle that a receiver sized on `batchSize: 100` is sized wrong and a documented warning is\n   * not a control. They are back now because the control exists: a durable collector groups pending\n   * events per destination and sends them as one request, so the two numbers decide how many events\n   * a request may carry and how long a partly-filled one waits.\n   *\n   * The pairing that matters: `batchSize: 1` — the DEFAULT — means no batching at all, the window is\n   * never consulted, and the wire is byte-for-byte what it was before any of this existed.\n   */\n  delivery: z.object({\n    /**\n     * The MOST events one HTTP request may carry. `1` — the default — is one request per event,\n     * which is what this destination gets until its operator asks for anything else.\n     *\n     * The number means what it says: the collector claims at most this many pending events for one\n     * request and sends no more, so a receiver sized on `batchSize: 50` receives at most fifty. A\n     * burst larger than this becomes several requests of this size rather than one oversized body.\n     *\n     * Capped at 100 because the body is the sum of its events and collector endpoints commonly\n     * refuse a payload around a megabyte: a hundred CEF lines sits comfortably under that, where a\n     * thousand would not. Raising the cap is a decision about the receiver, not about this engine.\n     *\n     * At `1` the delivery path is byte-for-byte what it was before batching existed — the event is\n     * sent alone, framed as itself, and {@link batchWindowSeconds} is never consulted.\n     */\n    batchSize: z.number().int().min(1).max(100).default(1).describe(\"The most events one request may carry, up to 100. `1`, the default, sends one request per event.\"),\n    /**\n     * How long a partly-filled batch waits for company before it is sent anyway.\n     *\n     * ONLY consulted when {@link batchSize} is greater than 1 — at the default of 1 there is no\n     * batch to fill, so a lone event is never held. That is the pairing to know: this field cannot\n     * delay anything on a destination that has not opted into batching.\n     *\n     * It bounds how stale an exported security event may be, which is why the ceiling is a minute\n     * rather than the five that the retry backoff allows. A SOC's detection latency is the thing\n     * being spent here.\n     */\n    batchWindowSeconds: z.preprocess(\n      /*\n       * A stored value BELOW the floor is LEGACY, and is normalised to the default rather than\n       * refused. Measured 2026-09-21 on the dogfood application: 17 of 17 rows carry\n       * `batchWindowSeconds: 0`, and so do wonder-crm's and the platform's.\n       *\n       * They were written by the seed's `delivery: {}` under the PRE-`be001548` schema, whose\n       * default for this field was 0 — back when nothing read it. Re-adding the field in #1379 with\n       * a floor of 1 made every one of those rows unreadable: `transformOutput` re-validates stored\n       * data against the CURRENT schema, so every read of every organization's SIEM export config\n       * threw, which is `loadSiemExportConfig` — the per-organization audit routing lookup.\n       *\n       * **The floor cannot simply be widened to 0, and the reason is in the collector**: \"A window\n       * of 0 would make the flush job race the append's own transaction; the window is floored at 1\n       * second by the schema\". `.min(1)` is load-bearing, so 0 is not a value this contract may\n       * hold — which is exactly why coercing it is honest rather than lax. It cannot be WRITTEN\n       * either: a create or update carrying 0 still fails the inner schema, because preprocess only\n       * substitutes the value that reaches it and the floor below still judges everything else.\n       *\n       * Neither of the framework's two repair mechanisms can reach these rows, which is why the\n       * normalisation lives here. A seed version bump does not: `AFTER_CREATE` \"fires once and\n       * cannot reach backwards\", and the lazy backfill is \"first access creates the row, never\n       * re-applied\". A SQL data migration would cover the three PostgreSQL surfaces and leave every\n       * Mongo-backed application broken.\n       *\n       * Matched on EXACTLY 0, never `< 1`. The first version of this coercion took anything below\n       * the floor, and a probe immediately showed it accepting `-3` as 5 — a coercion that had\n       * quietly become permission, which is the shape this repository forbids under \"never present\n       * suppression as repair\". A negative, a fraction and anything above the ceiling are still\n       * refused outright; 0 alone is the value the old schema actually wrote.\n       *\n       * The residual, stated rather than hidden: read and write share this schema, so an operator\n       * who TYPES 0 gets 5 instead of a validation error. That is the cost of the trade, and it is\n       * the right way round against every read of every organization's export config throwing.\n       *\n       * Mapped to `undefined` rather than to a literal so `.default(5)` stays the single source of\n       * the value. Removable once no deployment can hold a pre-#1379 row.\n       */\n      (value) => (value === 0 ? undefined : value),\n      z.number().int().min(1).max(60).default(5),\n    ).describe(\"How long, in seconds, a partly filled batch waits before it is sent anyway. Used only when `batchSize` is above 1.\"),\n    retryAttempts: z.number().min(0).max(5).default(3).describe(\"How many times a failed delivery is retried.\"),\n    retryBackoffSeconds: z.number().min(1).max(300).default(30).describe(\"The base delay before a retry, in seconds. Retries back off exponentially from it.\"),\n    timeoutSeconds: z.number().min(1).max(60).default(10).describe(\"How long one delivery request may take, in seconds.\"),\n  }),\n\n  customHeaders: z.record(z.string(), z.string()).optional(),\n\n  /**\n   * What this destination may RECEIVE — the per-destination half of the audit-export projection\n   * (#1380). The vocabulary, the floor and the resolution live in\n   * `compliance/audit-trails/audit-export-projection.shared.schemas`; this field is only where a\n   * tenant declares its own narrowing.\n   *\n   * **`.optional()` on purpose, and the absent case is FULL disclosure.** Two destinations on one\n   * tenant can hold different agreements, so the declaration belongs here rather than on the\n   * application — but every row that exists today has none, and reading an absent declaration as\n   * \"disclose nothing\" would silently strip live feeds down to the floor. An operator narrows\n   * deliberately; the framework does not narrow on their behalf. See `FULL_AUDIT_EXPORT_PROJECTION`\n   * for why that fail-OPEN is right in this one place.\n   *\n   * This is NOT the revival of `includeRawEventData` / `includeDeviceContext` below. Those were two\n   * booleans beside the retry policy that nothing read; this resolves against a contract that is\n   * total over the envelope AND total over the event vocabulary, is applied once at the ENQUEUE\n   * SEAM — before the event is signed and queued, so all four wire formats carry it identically and\n   * no producer can reach the queue around it — and cannot trim the floor.\n   */\n  exportProjection: SiemExportProjectionDeclarationSchema.optional(),\n\n  /*\n   * `includeRawEventData` and `includeDeviceContext` were REMOVED here, and neither was ever read.\n   *\n   * Both defaulted `true`, both rendered as switches on the SIEM pane with a description underneath,\n   * and the complete set of mentions was: this declaration, the display and edit templates, the\n   * specification, the customer documentation, the i18n labels — and FOUR test files, where each\n   * appears as a field of a config FIXTURE rather than as a behaviour under assertion. The envelope\n   * builders in `compliance/audit-trails` contain no `includeRaw`, no `rawEvent` and no\n   * `deviceContext` at all: what an exported event carries is decided by the projection contract,\n   * the same shape for every sink.\n   *\n   * They are worth naming apart from the other dead switches on these panes, because these two had\n   * `booleanUI({ showDescription: true })` — so an operator got a switch, a label AND a sentence\n   * explaining what it did, for a flag that did nothing. Being the best-presented control on the\n   * page is not evidence of being one.\n   *\n   * Removing them is not a loss of the capability they named. Choosing what an export carries is a\n   * real feature with a design — a projection the application declares — and it would be built on\n   * the envelope contract, not on two booleans beside the retry policy.\n   *\n   * Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n   */\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SiemExportConfigBase = z.infer<typeof SiemExportConfigBaseSchema>;\n\nexport const siemExportConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'siemExportConfig',\n  baseFieldIdentifier: 'siemExportConfigId',\n  baseEnumKey: 'SIEM_EXPORT_CONFIG',\n  baseSchema: SiemExportConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}
+{"version":3,"file":"siem-export-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/siem/siem-export-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qCAAqC,EAAE,MAAM,yEAAyE,CAAC;AAChI,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,eAAe,EAAE,iBAAiB;IAClC,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAE,eAAe;IAC9B,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;CAClB,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IAEpD,4EAA4E;IAC5E,6EAA6E;IAC7E,qEAAqE;IACrE,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC;IAC/D;;;;;;;;;;;;;;OAcG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE;IACzD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC;IAE3D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC;IAE7E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;YACrD,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,aAAa;YAC/B,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,cAAc;YAChC,iBAAiB,CAAC,WAAW;SAC9B,CAAC,CAAC,QAAQ,CAAC,oDAAoD,CAAC;QACjE,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mEAAmE,CAAC;QAC1J,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4FAA4F,CAAC;KAC1J,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB;;;;;;;;;;;;;;WAcG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kGAAkG,CAAC;QACnK;;;;;;;;;;WAUG;QACH,kBAAkB,EAAE,CAAC,CAAC,UAAU;QAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAoCG;QACH,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAC5C,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAC3C,CAAC,QAAQ,CAAC,oHAAoH,CAAC;QAChI,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QAC3G,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,oFAAoF,CAAC;QAC1J,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC;KACtH,CAAC;IAEF,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE1D;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IAElE;;;;;;;;;;;;;;;;;;;;;OAqBG;IAEH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sCAAsC,GAAG,yBAAyB,CAAC;IAC9E,gBAAgB,EAAE,kBAAkB;IACpC,mBAAmB,EAAE,oBAAoB;IACzC,WAAW,EAAE,oBAAoB;IACjC,UAAU,EAAE,0BAA0B;IACtC,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SIEM Export Config Schema (Shared) — Polymorphic\n *\n * Webhook configuration for exporting security audit events to external SIEM.\n * Nested sub-objects: eventFilter{}, delivery{}.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * ── ORG variant is live; the APPLICATION variant is settable but INERT ─────────────\n * The polymorphism below emits both an ORGANIZATION and an APPLICATION variant. Only the\n * ORGANIZATION variant drives delivery today: the sole SIEM producer\n * (`AuditEventDispatcherBackendService`) fans out per authenticated tenant (org) and reads\n * this config via `loadSiemExportConfig(ec, ORGANIZATION, orgId)`. An app super-admin CAN\n * create/enable `APPLICATION_SIEM_EXPORT_CONFIG` (it has its own custom-impl +\n * APP_ADMIN_SUPER_ADMIN roles), but NO producer emits app-scoped deliveries, so an enabled\n * app config silently delivers nothing. The APP variant is RESERVED / DORMANT until an\n * app-scoped producer is built — see `AuditEventDispatcherBackendService.\n * dispatchToOrganizationAuditSinks` for the rationale + the wiring it would need. (When\n * that producer lands, or if this trap is hardened sooner, the app config surface should\n * be gated/hidden until delivery actually works.)\n *\n * @see auth-data-model-audit.md §2D\n */\n\nimport { z } from 'zod';\nimport { SiemExportProjectionDeclarationSchema } from '../../../compliance/audit-trails/audit-export-projection.shared.schemas';\nimport { WildoHeaderKeys } from '../../../requests/header-keys.shared';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const SIEMAuthMethod = {\n  BEARER_TOKEN: 'bearer_token',\n  API_KEY_HEADER: 'api_key_header',\n  HMAC_SHA256: 'hmac_sha256',\n  NONE: 'none',\n} as const;\n\n/**\n * The wire formats a tenant's SIEM export can request.\n *\n * `OCSF` is the JSON-native security schema the category has standardised on (ITU ratification track\n * to June 2026), and it is a PEER of the two text formats rather than a replacement: CEF and LEEF stay\n * for tenants whose SIEM wants them. The difference that matters is representational — a\n * security-audit envelope maps onto an OCSF CLASS natively, where CEF can only force it into a\n * `csN` custom-string slot.\n */\nexport const SIEMEventFormat = {\n  JSON_STRUCTURED: 'json_structured',\n  CEF: 'cef',\n  LEEF: 'leef',\n  OCSF: 'ocsf',\n} as const;\n\nexport const SIEMEventCategory = {\n  AUTHENTICATION: 'authentication',\n  AUTHORIZATION: 'authorization',\n  USER_LIFECYCLE: 'user_lifecycle',\n  ORG_MANAGEMENT: 'org_management',\n  DATA_ACCESS: 'data_access',\n} as const;\n\nexport const SIEMFilterSeverity = {\n  INFO: 'info',\n  WARNING: 'warning',\n  CRITICAL: 'critical',\n} as const;\n\nexport const SiemExportConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  enabled: z.boolean().default(false).isSummaryField(),\n\n  // Destination for exported audit events. The empty string is the DISABLED /\n  // not-yet-configured state (paired with `enabled: false`) and is the default\n  // for a freshly-seeded config — so the union MUST admit `''`. A bare\n  // `z.url().default('')` is self-contradictory: `z.url()` rejects `''`, so the\n  // default value fails output re-validation and every unconfigured row 500s on\n  // READ (`transformOutput`). Accept a real URL OR the empty sentinel.\n  webhookUrl: z.url().or(z.literal('')).default(''),\n\n  authMethod: z.enum(SIEMAuthMethod).default(SIEMAuthMethod.NONE),\n  /**\n   * User-provided secret used to authenticate outbound webhook deliveries to the\n   * customer's SIEM endpoint (bearer token, API-key value, etc.).\n   *\n   * `.isWriteOnlySecret()` gives this the framework's write-then-masked-secret\n   * contract: it stays in the CREATE/UPDATE request DTO (the operator supplies\n   * and rotates it) and in the response DTO (so the UI renders a masked\n   * placeholder), but the framework redacts it to `••••••••` at the client\n   * boundary and treats a round-tripped `••••••••` on write as \"keep the existing\n   * secret\". The real value is retained for backend internal reads only — the\n   * webhook dispatcher reads it via `readAsSystem` to sign deliveries. Do NOT use\n   * `.isBackendOnly()` here: that strips the field from every client DTO, dropping\n   * the operator's typed value before it is stored and leaving the presets a field\n   * they cannot resolve.\n   */\n  authCredential: z.string().optional().isWriteOnlySecret(),\n  authHeaderName: z.string().default(WildoHeaderKeys.API_KEY),\n\n  eventFormat: z.enum(SIEMEventFormat).default(SIEMEventFormat.JSON_STRUCTURED),\n\n  eventFilter: z.object({\n    categories: z.array(z.enum(SIEMEventCategory)).default([\n      SIEMEventCategory.AUTHENTICATION,\n      SIEMEventCategory.AUTHORIZATION,\n      SIEMEventCategory.USER_LIFECYCLE,\n      SIEMEventCategory.ORG_MANAGEMENT,\n      SIEMEventCategory.DATA_ACCESS,\n    ]).describe(\"The event categories exported to this destination.\"),\n    severityMinimum: z.enum(SIEMFilterSeverity).default(SIEMFilterSeverity.INFO).describe(\"The least severe event exported. Less severe events are not sent.\"),\n    specificEventTypes: z.array(z.string()).optional().describe(\"An optional allow-list of event types, matched exactly: no substring or wildcard matching.\"),\n  }),\n\n  /*\n   * Three knobs, and the two that were removed are the reason to read this.\n   *\n   * `retryAttempts`, `retryBackoffSeconds` and `timeoutSeconds` are honoured — the delivery worker\n   * reads all three (`siem-webhook-delivery.backend.service`, at the retry ceiling, the exponential\n   * backoff and the request deadline).\n   *\n   * `batchSize` and `batchWindowSeconds` are honoured TOO, as of #1379 — but they were not always,\n   * and the history is the reason to read this rather than trivia. They spent months appearing in\n   * the delivery service only as fields of its parameter TYPE: declared, passed, never consulted.\n   * That is the shape which makes an inert knob hardest to see, because it has a \"reader\" that\n   * decides nothing. The worker posted ONE event per HTTP request whatever they said, and the\n   * customer documentation warned an operator not to size a receiver or a billing estimate on\n   * either — a warning being what you write when the control is missing.\n   *\n   * They were deleted in `be001548` rather than kept as a disclosed \"reserved\" knob, on the\n   * principle that a receiver sized on `batchSize: 100` is sized wrong and a documented warning is\n   * not a control. They are back now because the control exists: a durable collector groups pending\n   * events per destination and sends them as one request, so the two numbers decide how many events\n   * a request may carry and how long a partly-filled one waits.\n   *\n   * The pairing that matters: `batchSize: 1` — the DEFAULT — means no batching at all, the window is\n   * never consulted, and the wire is byte-for-byte what it was before any of this existed.\n   */\n  delivery: z.object({\n    /**\n     * The MOST events one HTTP request may carry. `1` — the default — is one request per event,\n     * which is what this destination gets until its operator asks for anything else.\n     *\n     * The number means what it says: the collector claims at most this many pending events for one\n     * request and sends no more, so a receiver sized on `batchSize: 50` receives at most fifty. A\n     * burst larger than this becomes several requests of this size rather than one oversized body.\n     *\n     * Capped at 100 because the body is the sum of its events and collector endpoints commonly\n     * refuse a payload around a megabyte: a hundred CEF lines sits comfortably under that, where a\n     * thousand would not. Raising the cap is a decision about the receiver, not about this engine.\n     *\n     * At `1` the delivery path is byte-for-byte what it was before batching existed — the event is\n     * sent alone, framed as itself, and {@link batchWindowSeconds} is never consulted.\n     */\n    batchSize: z.number().int().min(1).max(100).default(1).describe(\"The most events one request may carry, up to 100. `1`, the default, sends one request per event.\"),\n    /**\n     * How long a partly-filled batch waits for company before it is sent anyway.\n     *\n     * ONLY consulted when {@link batchSize} is greater than 1 — at the default of 1 there is no\n     * batch to fill, so a lone event is never held. That is the pairing to know: this field cannot\n     * delay anything on a destination that has not opted into batching.\n     *\n     * It bounds how stale an exported security event may be, which is why the ceiling is a minute\n     * rather than the five that the retry backoff allows. A SOC's detection latency is the thing\n     * being spent here.\n     */\n    batchWindowSeconds: z.preprocess(\n      /*\n       * A stored value BELOW the floor is LEGACY, and is normalised to the default rather than\n       * refused. Measured 2026-09-21 on the dogfood application: 17 of 17 rows carry\n       * `batchWindowSeconds: 0`, and so do wonder-crm's and the platform's.\n       *\n       * They were written by the seed's `delivery: {}` under the PRE-`be001548` schema, whose\n       * default for this field was 0 — back when nothing read it. Re-adding the field in #1379 with\n       * a floor of 1 made every one of those rows unreadable: `transformOutput` re-validates stored\n       * data against the CURRENT schema, so every read of every organization's SIEM export config\n       * threw, which is `loadSiemExportConfig` — the per-organization audit routing lookup.\n       *\n       * **The floor cannot simply be widened to 0, and the reason is in the collector**: \"A window\n       * of 0 would make the flush job race the append's own transaction; the window is floored at 1\n       * second by the schema\". `.min(1)` is load-bearing, so 0 is not a value this contract may\n       * hold — which is exactly why coercing it is honest rather than lax. It cannot be WRITTEN\n       * either: a create or update carrying 0 still fails the inner schema, because preprocess only\n       * substitutes the value that reaches it and the floor below still judges everything else.\n       *\n       * Neither of the framework's two repair mechanisms can reach these rows, which is why the\n       * normalisation lives here. A seed version bump does not: `AFTER_CREATE` \"fires once and\n       * cannot reach backwards\", and the lazy backfill is \"first access creates the row, never\n       * re-applied\". A SQL data migration would cover the three PostgreSQL surfaces and leave every\n       * Mongo-backed application broken.\n       *\n       * Matched on EXACTLY 0, never `< 1`. The first version of this coercion took anything below\n       * the floor, and a probe immediately showed it accepting `-3` as 5 — a coercion that had\n       * quietly become permission, which is the shape this repository forbids under \"never present\n       * suppression as repair\". A negative, a fraction and anything above the ceiling are still\n       * refused outright; 0 alone is the value the old schema actually wrote.\n       *\n       * The residual, stated rather than hidden: read and write share this schema, so an operator\n       * who TYPES 0 gets 5 instead of a validation error. That is the cost of the trade, and it is\n       * the right way round against every read of every organization's export config throwing.\n       *\n       * Mapped to `undefined` rather than to a literal so `.default(5)` stays the single source of\n       * the value. Removable once no deployment can hold a pre-#1379 row.\n       */\n      (value) => (value === 0 ? undefined : value),\n      z.number().int().min(1).max(60).default(5),\n    ).describe(\"How long, in seconds, a partly filled batch waits before it is sent anyway. Used only when `batchSize` is above 1.\"),\n    retryAttempts: z.number().min(0).max(5).default(3).describe(\"How many times a failed delivery is retried.\"),\n    retryBackoffSeconds: z.number().min(1).max(300).default(30).describe(\"The base delay before a retry, in seconds. Retries back off exponentially from it.\"),\n    timeoutSeconds: z.number().min(1).max(60).default(10).describe(\"How long one delivery request may take, in seconds.\"),\n  }),\n\n  customHeaders: z.record(z.string(), z.string()).optional(),\n\n  /**\n   * What this destination may RECEIVE — the per-destination half of the audit-export projection\n   * (#1380). The vocabulary, the floor and the resolution live in\n   * `compliance/audit-trails/audit-export-projection.shared.schemas`; this field is only where a\n   * tenant declares its own narrowing.\n   *\n   * **`.optional()` on purpose, and the absent case is FULL disclosure.** Two destinations on one\n   * tenant can hold different agreements, so the declaration belongs here rather than on the\n   * application — but every row that exists today has none, and reading an absent declaration as\n   * \"disclose nothing\" would silently strip live feeds down to the floor. An operator narrows\n   * deliberately; the framework does not narrow on their behalf. See `FULL_AUDIT_EXPORT_PROJECTION`\n   * for why that fail-OPEN is right in this one place.\n   *\n   * This is NOT the revival of `includeRawEventData` / `includeDeviceContext` below. Those were two\n   * booleans beside the retry policy that nothing read; this resolves against a contract that is\n   * total over the envelope AND total over the event vocabulary, is applied once at the ENQUEUE\n   * SEAM — before the event is signed and queued, so all four wire formats carry it identically and\n   * no producer can reach the queue around it — and cannot trim the floor.\n   */\n  exportProjection: SiemExportProjectionDeclarationSchema.optional(),\n\n  /*\n   * `includeRawEventData` and `includeDeviceContext` were REMOVED here, and neither was ever read.\n   *\n   * Both defaulted `true`, both rendered as switches on the SIEM pane with a description underneath,\n   * and the complete set of mentions was: this declaration, the display and edit templates, the\n   * specification, the customer documentation, the i18n labels — and FOUR test files, where each\n   * appears as a field of a config FIXTURE rather than as a behaviour under assertion. The envelope\n   * builders in `compliance/audit-trails` contain no `includeRaw`, no `rawEvent` and no\n   * `deviceContext` at all: what an exported event carries is decided by the projection contract,\n   * the same shape for every sink.\n   *\n   * They are worth naming apart from the other dead switches on these panes, because these two had\n   * `booleanUI({ showDescription: true })` — so an operator got a switch, a label AND a sentence\n   * explaining what it did, for a flag that did nothing. Being the best-presented control on the\n   * page is not evidence of being one.\n   *\n   * Removing them is not a loss of the capability they named. Choosing what an export carries is a\n   * real feature with a design — a projection the application declares — and it would be built on\n   * the envelope contract, not on two booleans beside the retry policy.\n   *\n   * Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n   */\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SiemExportConfigBase = z.infer<typeof SiemExportConfigBaseSchema>;\n\nexport const siemExportConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'siemExportConfig',\n  baseFieldIdentifier: 'siemExportConfigId',\n  baseEnumKey: 'SIEM_EXPORT_CONFIG',\n  baseSchema: SiemExportConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/sso/sso-config.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EAEL,4BAA4B,EAC7B,MAAM,6CAA6C,CAAC;AAkBrD,oBAAY,oBAAoB;IAC9B,YAAY,gBAAgB;IAC5B,aAAa,iBAAiB;IAC9B,aAAa,iBAAiB;CAC/B;AAmCD,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;IAG3C,2EAA2E;;IAE3E,qDAAqD;;kBAErD,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;IAI5C;;;;OAIG;;kBAEH,CAAC;AAEH,eAAO,MAAM,iCAAiC;;IAE5C,iFAAiF;;kBAEjF,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC7F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC/F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,6BAA6B,EAAE,QAAQ,CAAC;IAGnD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,QAAQ,CAAC;CACvE,CAEA,CAAC;AAIF,eAAO,MAAM,6BAA6B,wQA0PzC,CAAC"}
+{"version":3,"file":"sso-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EAEL,4BAA4B,EAC7B,MAAM,6CAA6C,CAAC;AAkBrD,oBAAY,oBAAoB;IAC9B,YAAY,gBAAgB;IAC5B,aAAa,iBAAiB;IAC9B,aAAa,iBAAiB;CAC/B;AAmCD,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;IAG3C,2EAA2E;;IAE3E,qDAAqD;;kBAErD,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;IAI5C;;;;OAIG;;kBAEH,CAAC;AAEH,eAAO,MAAM,iCAAiC;;IAE5C,iFAAiF;;kBAEjF,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC7F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC/F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,6BAA6B,EAAE,QAAQ,CAAC;IAGnD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,QAAQ,CAAC;CACvE,CAEA,CAAC;AAIF,eAAO,MAAM,6BAA6B,wQA0PzC,CAAC"}