@wildo-ai/saas-models 1.1.9 → 1.1.10

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-consent-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAE1H,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAC3E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAK7C;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,kGAAkG;IAClG,oGAAoG;IACpG,qGAAqG;IACrG,kGAAkG;IAClG,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF;;;;;;;;OAQG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,iGAAiG;QACjG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACrJ;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACrJ;SACF;QACD,mGAAmG;QACnG,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aAC1K;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aAC1K;SACF;QACD,gGAAgG;QAChG,qGAAqG;QACrG,yBAAyB;QACzB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aACxJ;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * OIDC Persistent Consent Grants — Resource Configuration\n *\n * USER_SELF-scoped (the scope is derived from the `USERS → OAUTH_CONSENT_GRANTS` composition\n * relationship). READ / LIST / DELETE are OWNER-facing (`API_CALL` + `APP_USER`): the framework's\n * USER_SELF primary-scope filter restricts every result to the authenticated caller's own grants, so a\n * user can list their \"authorized apps\" and revoke one, and nobody can see or delete another user's\n * grants. CREATE / UPDATE are SYSTEM-only (`INTERNAL_CALL`): the OIDC consent-decision endpoint is the\n * sole writer, via the `createAsSystem` / `updateAsSystem` primitives.\n *\n * `systemAccessPolicy` opts the write + read verbs into the `*AsSystem` door (default is fail-closed\n * FORBIDDEN): the decision endpoint create/updates a grant with no request-context FK to attach\n * (`userId` is re-attached from the schema allowlist on the system path), and the authorize endpoint\n * read/lists a user's grants to decide whether to skip the prompt. There is no `delete` system-access\n * verb (none exists); owner revoke goes through the `API_CALL` DELETE route, and the USERS\n * `onParentDelete` composition cascade deletes grants directly at the repository layer (variant-agnostic).\n */\n\nimport { OAuthConsentGrantSchema } from './oauth-consent-grants.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\nexport const oauthConsentGrantsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n  // UPDATE_MANY is route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE\n  | CoreResourceOperation.UPDATE_MANY,\n  typeof OAuthConsentGrantSchema\n>({\n  mainSchema: OAuthConsentGrantSchema,\n  resourceIdentifier: CoreResourceType.OAUTH_CONSENT_GRANTS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.OAUTH_CONSENT_GRANTS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // The OIDC consent-decision endpoint stores/updates grants via createAsSystem/updateAsSystem (the\n  // client-shaped CREATE DTO strips the context FK `userId`, re-attached from the schema allowlist on\n  // the system path); the authorize endpoint reads/lists a user's grants via readAsSystem/listAsSystem\n  // to decide whether to skip the consent prompt. Default is fail-closed FORBIDDEN, so opt each in.\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n  },\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  /**\n   * Subject erasure RETAINS this row and RESETS the authorized scopes.\n *\n * The grant is kept deliberately: a consent decision is the evidence that access was authorized, which is\n * exactly what an operator must be able to show afterwards. But `scopes` records WHAT this person let a\n * third party reach, which its USAGE category correctly declares — so `RETAIN_ONLY` would be false. The\n * field is a defaulted array, which only `RedactionType.RESET` can scrub; it returns to the empty default,\n * so the grant remains as evidence and what it granted no longer describes the person.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * Erasing one of these rows revokes NO session. A grant is a record ABOUT a decision, not the person, and\n *  revoking a third-party client's OAuth access is a separate act from ending a login session.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n     * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n     * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n     * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n     * verb the impersonalize writer uses to stamp the retention markers.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.CRITICAL,\n      }],\n    },\n\n    // Owner-facing: the USER_SELF primary-scope filter restricts results to the caller's own grants.\n    [CoreResourceOperation.READ]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.LOW },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.LOW },\n      ],\n    },\n    // System-only: the consent-decision endpoint is the sole writer (createAsSystem / updateAsSystem).\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n      ],\n    },\n    // Owner-facing revoke (USER_SELF filter → own grant only). The USERS onParentDelete composition\n    // cascade also deletes grants, directly at the repository layer (variant-agnostic — it only requires\n    // a DELETE op to exist).\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"oauth-consent-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAE1H,MAAM,CAAC,MAAM,6DAA6D,GAAG,CAC3E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAK7C;IACA,UAAU,EAAE,uBAAuB;IACnC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,kGAAkG;IAClG,oGAAoG;IACpG,qGAAqG;IACrG,kGAAkG;IAClG,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,OAAO;QAC/C,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE;IAEpF;;;;;;;;OAQG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IACD,uBAAuB,EAAE;QACvB;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED,iGAAiG;QACjG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACrJ;SACF;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,GAAG,EAAE;aACrJ;SACF;QACD,mGAAmG;QACnG,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aAC1K;SACF;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aAC1K;SACF;QACD,gGAAgG;QAChG,qGAAqG;QACrG,yBAAyB;QACzB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR,EAAE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,CAAC,MAAM,EAAE;aACxJ;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * OIDC Persistent Consent Grants — Resource Configuration\n *\n * USER_SELF-scoped (the scope is derived from the `USERS → OAUTH_CONSENT_GRANTS` composition\n * relationship). READ / LIST / DELETE are OWNER-facing (`API_CALL` + `APP_USER`): the framework's\n * USER_SELF primary-scope filter restricts every result to the authenticated caller's own grants, so a\n * user can list their \"authorized apps\" and revoke one, and nobody can see or delete another user's\n * grants. CREATE / UPDATE are SYSTEM-only (`INTERNAL_CALL`): the OIDC consent-decision endpoint is the\n * sole writer, via the `createAsSystem` / `updateAsSystem` primitives.\n *\n * `systemAccessPolicy` opts the write + read verbs into the `*AsSystem` door (default is fail-closed\n * FORBIDDEN): the decision endpoint create/updates a grant with no request-context FK to attach\n * (`userId` is re-attached from the schema allowlist on the system path), and the authorize endpoint\n * read/lists a user's grants to decide whether to skip the prompt. There is no `delete` system-access\n * verb (none exists); owner revoke goes through the `API_CALL` DELETE route, and the USERS\n * `onParentDelete` composition cascade deletes grants directly at the repository layer (variant-agnostic).\n */\n\nimport { OAuthConsentGrantSchema } from './oauth-consent-grants.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\nimport { DataPortabilityProvenance } from '../../compliance/privacy/subject-export.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\nexport const oauthConsentGrantsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[]\n) => createResourceConfiguration_Initialization<undefined,\n  // UPDATE_MANY is route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE\n  | CoreResourceOperation.UPDATE_MANY,\n  typeof OAuthConsentGrantSchema\n>({\n  mainSchema: OAuthConsentGrantSchema,\n  resourceIdentifier: CoreResourceType.OAUTH_CONSENT_GRANTS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.OAUTH_CONSENT_GRANTS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  // The OIDC consent-decision endpoint stores/updates grants via createAsSystem/updateAsSystem (the\n  // client-shaped CREATE DTO strips the context FK `userId`, re-attached from the schema allowlist on\n  // the system path); the authorize endpoint reads/lists a user's grants via readAsSystem/listAsSystem\n  // to decide whether to skip the consent prompt. Default is fail-closed FORBIDDEN, so opt each in.\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n  },\n  portabilityPolicy: { defaultProvenance: DataPortabilityProvenance.SUBJECT_PROVIDED },\n\n  /**\n   * Subject erasure RETAINS this row and RESETS the authorized scopes.\n *\n * The grant is kept deliberately: a consent decision is the evidence that access was authorized, which is\n * exactly what an operator must be able to show afterwards. But `scopes` records WHAT this person let a\n * third party reach, which its USAGE category correctly declares — so `RETAIN_ONLY` would be false. The\n * field is a defaulted array, which only `RedactionType.RESET` can scrub; it returns to the empty default,\n * so the grant remains as evidence and what it granted no longer describes the person.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n  },\n\n  /**\n   * Erasing one of these rows revokes NO session. A grant is a record ABOUT a decision, not the person, and\n *  revoking a third-party client's OAuth access is a separate act from ending a login session.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n  operationsConfiguration: {\n    /*\n     * Route-less retention plumbing — INTERNAL_CALL registers no route, so no API surface is added, and it\n     * must not be REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n     * which matches only INTERNAL_CALL / API_CALL. LIST is LOW (a read-shaped op may not claim the\n     * HIGH/CRITICAL band, which carries an audit-emission obligation); UPDATE_MANY is CRITICAL — it is the\n     * verb the impersonalize writer uses to stamp the retention markers.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.INTERNAL_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.CRITICAL,\n      }],\n    },\n\n    // Owner-facing: the USER_SELF primary-scope filter restricts results to the caller's own grants.\n    [CoreResourceOperation.READ]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.LOW },\n      ],\n    },\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.LOW },\n      ],\n    },\n    // System-only: the consent-decision endpoint is the sole writer (createAsSystem / updateAsSystem).\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n      ],\n    },\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.INTERNAL_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n      ],\n    },\n    // Owner-facing revoke (USER_SELF filter → own grant only). The USERS onParentDelete composition\n    // cascade also deletes grants, directly at the repository layer (variant-agnostic — it only requires\n    // a DELETE op to exist).\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        { variantType: ResourceOperationVariantType.API_CALL, isDefault: true, roles: [CORE_APP_ROLES.APP_USER], riskLevel: ResourceOperationRiskLevel.MEDIUM },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-consent-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,uBAAuB;;;;;;;;;kBAsDlC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC,MAAM,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"oauth-consent-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,uBAAuB;;;;;;;;;kBAsDlC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC,MAAM,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-consent-grants.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,6EAA6E;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,iGAAiG;IACjG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE1D;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE9D;;;;;OAKG;IACH,+FAA+F;IAC/F,wFAAwF;IACxF,2IAA2I;IAC3I,iGAAiG;IACjG,iGAAiG;IACjG,wFAAwF;IACxF,MAAM,EAAE,oBAAoB,CAC5B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EACxE,aAAa,CAAC,KAAK,CACpB;IAED;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,GAAG,CAAC","sourcesContent":["/**\n * OIDC Persistent Consent Grants (\"remember this app\")\n *\n * A durable \"user X authorized OAuth client Y for identity scopes Z (at resource R)\" record. It is\n * CREATED (via the system write primitive) when a user APPROVES an interactive-consent request AND\n * opts to remember the app, and READ at `/oauth/authorize` to SKIP re-prompting when an existing grant\n * already covers the requested scopes. The user can list their grants (\"authorized apps\") and revoke\n * one.\n *\n * USER-scoped: owned by `userId` (USER_SELF primary scope, derived from the `USERS → OAUTH_CONSENT_GRANTS`\n * composition relationship). One grant per `(userId, clientId, resource)` — a re-consent UPDATES the\n * granted scopes rather than creating a duplicate. `resource` participates in the grain because two\n * authorize requests from the same client for different RFC 8707 resources (distinct A2A / MCP agent\n * endpoints) are genuinely distinct delegations; an OIDC-only login carries no `resource` and yields a\n * single resource-less grant.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\nexport const OAuthConsentGrantSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** FK → USERS — the user who granted consent (the USER_SELF scope owner). */\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  /** The registered OAuth client (`_id`, `oc_*`) the user authorized. Part of the business key. */\n  clientId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * The RFC 8707 `resource` (the target A2A / MCP agent endpoint) this grant covers. Absent for an\n   * OIDC-only login with no delegation. Part of the business key — a grant authorizes one client for\n   * one resource, so different agent endpoints require separate, explicit consent.\n   */\n  resource: z.string().optional().isDBIndexed().isSummaryField(),\n\n  /**\n   * The IDENTITY scopes the user granted (e.g. `openid`, `profile`, `email`). A later authorize whose\n   * requested scopes are a SUBSET of these skips the prompt; a request for a scope NOT in the grant\n   * re-prompts (silent scope expansion is forbidden). Identity only — scopes carry no authorization\n   * weight (authorization is roles-only).\n   */\n  // USAGE — what this person authorized a third-party client to reach on their behalf, and when.\n  // A consent record is an observation of a decision they made, not an attribute of them.\n  // RESET on erasure — returns this field to its schema default. It holds which scopes this person authorized a third-party client to reach,\n  // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK\n  // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK\n  // needs a string. The value comes from the schema, so there is no second copy to drift.\n  scopes: addImpersonalizeWith(\n  z.array(z.string()).default([]).dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n\n  /**\n   * Expiry. The authorize lookup ignores a grant past this instant, fail-closed to a fresh consent\n   * prompt.\n   *\n   * SET ON EVERY AFFIRMATIVE CONSENT since 2026-09-08 (#465) — on creation and again on every widen,\n   * because a widen is the user approving again and a re-affirmation should restart the clock. It\n   * was declared here with a reader and NO WRITER before that, so a remembered approval lived until\n   * the person revoked it while the field read to an operator as a policy knob that existed.\n   *\n   * Still optional on the SCHEMA, for two reasons that are not the same: grants created before that\n   * date carry none and must keep working (an absent expiry means \"never\", which is what they were\n   * granted under), and a resource may be written by a path that has no operator policy in hand.\n   */\n  expiresAt: z.date().optional().isDBIndexed(),\n\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'userId',\n  'clientId',\n  'resource',\n]);\n\n/**\n * How long a remembered consent lasts when the application authors no policy of its own.\n *\n * **180 days**, and the reasoning matters more than the number. A remembered consent is a standing\n * delegation of authority to a third party, so it should lapse on its own if nobody re-affirms it —\n * but a prompt the user meets every few weeks trains them to click through, which makes the consent\n * screen worth less rather than more. Half a year is long enough not to nag and short enough that an\n * authorization the user has forgotten about does not outlive their interest in the client by years.\n *\n * An application overrides it with `auth.consentGrantLifetimeDays`. There is deliberately no way to\n * express \"never expires\": that was the state this default replaced, and it was not chosen.\n */\nexport const OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS = 180;\n\nexport type OAuthConsentGrant = z.infer<typeof OAuthConsentGrantSchema>;\n"]}
+{"version":3,"file":"oauth-consent-grants.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,6EAA6E;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,iGAAiG;IACjG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE1D;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE9D;;;;;OAKG;IACH,+FAA+F;IAC/F,wFAAwF;IACxF,2IAA2I;IAC3I,iGAAiG;IACjG,iGAAiG;IACjG,wFAAwF;IACxF,MAAM,EAAE,oBAAoB,CAC5B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EACxE,aAAa,CAAC,KAAK,CACpB;IAED;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,GAAG,CAAC","sourcesContent":["/**\n * OIDC Persistent Consent Grants (\"remember this app\")\n *\n * A durable \"user X authorized OAuth client Y for identity scopes Z (at resource R)\" record. It is\n * CREATED (via the system write primitive) when a user APPROVES an interactive-consent request AND\n * opts to remember the app, and READ at `/oauth/authorize` to SKIP re-prompting when an existing grant\n * already covers the requested scopes. The user can list their grants (\"authorized apps\") and revoke\n * one.\n *\n * USER-scoped: owned by `userId` (USER_SELF primary scope, derived from the `USERS → OAUTH_CONSENT_GRANTS`\n * composition relationship). One grant per `(userId, clientId, resource)` — a re-consent UPDATES the\n * granted scopes rather than creating a duplicate. `resource` participates in the grain because two\n * authorize requests from the same client for different RFC 8707 resources (distinct A2A / MCP agent\n * endpoints) are genuinely distinct delegations; an OIDC-only login carries no `resource` and yields a\n * single resource-less grant.\n */\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\nexport const OAuthConsentGrantSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  /** FK → USERS — the user who granted consent (the USER_SELF scope owner). */\n  userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n  /** The registered OAuth client (`_id`, `oc_*`) the user authorized. Part of the business key. */\n  clientId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n  /**\n   * The RFC 8707 `resource` (the target A2A / MCP agent endpoint) this grant covers. Absent for an\n   * OIDC-only login with no delegation. Part of the business key — a grant authorizes one client for\n   * one resource, so different agent endpoints require separate, explicit consent.\n   */\n  resource: z.string().optional().isDBIndexed().isSummaryField(),\n\n  /**\n   * The IDENTITY scopes the user granted (e.g. `openid`, `profile`, `email`). A later authorize whose\n   * requested scopes are a SUBSET of these skips the prompt; a request for a scope NOT in the grant\n   * re-prompts (silent scope expansion is forbidden). Identity only — scopes carry no authorization\n   * weight (authorization is roles-only).\n   */\n  // USAGE — what this person authorized a third-party client to reach on their behalf, and when.\n  // A consent record is an observation of a decision they made, not an attribute of them.\n  // RESET on erasure — returns this field to its schema default. It holds which scopes this person authorized a third-party client to reach,\n  // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK\n  // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK\n  // needs a string. The value comes from the schema, so there is no second copy to drift.\n  scopes: addImpersonalizeWith(\n  z.array(z.string()).default([]).dataCategories(PersonalDataCategory.USAGE),\n    RedactionType.RESET,\n  ),\n\n  /**\n   * Expiry. The authorize lookup ignores a grant past this instant, fail-closed to a fresh consent\n   * prompt.\n   *\n   * SET ON EVERY AFFIRMATIVE CONSENT since 2026-09-08 (#465) — on creation and again on every widen,\n   * because a widen is the user approving again and a re-affirmation should restart the clock. It\n   * was declared here with a reader and NO WRITER before that, so a remembered approval lived until\n   * the person revoked it while the field read to an operator as a policy knob that existed.\n   *\n   * Still optional on the SCHEMA, for two reasons that are not the same: grants created before that\n   * date carry none and must keep working (an absent expiry means \"never\", which is what they were\n   * granted under), and a resource may be written by a path that has no operator policy in hand.\n   */\n  expiresAt: z.date().optional().isDBIndexed(),\n\n  createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n  'userId',\n  'clientId',\n  'resource',\n]);\n\n/**\n * How long a remembered consent lasts when the application authors no policy of its own.\n *\n * **180 days**, and the reasoning matters more than the number. A remembered consent is a standing\n * delegation of authority to a third party, so it should lapse on its own if nobody re-affirms it —\n * but a prompt the user meets every few weeks trains them to click through, which makes the consent\n * screen worth less rather than more. Half a year is long enough not to nag and short enough that an\n * authorization the user has forgotten about does not outlive their interest in the client by years.\n *\n * An application overrides it with `auth.consentGrantLifetimeDays`. There is deliberately no way to\n * express \"never expires\": that was the state this default replaced, and it was not chosen.\n */\nexport const OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS = 180;\n\nexport type OAuthConsentGrant = z.infer<typeof OAuthConsentGrantSchema>;\n"]}

package/dist/esm/security/oauth-clients/oauth-resource-server.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-resource-server.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,oBAAY,kBAAkB;IAC5B,uFAAuF;IACvF,GAAG,QAAQ;IACX,gGAAgG;IAChG,GAAG,QAAQ;IACX,uGAAuG;IACvG,GAAG,QAAQ;CACZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAC9C,OAAO,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,EACnD,wBAAwB,CAIzB,CAAC;AAEF;yGACyG;AACzG,eAAO,MAAM,gCAAgC,EAAE,SAAS,kBAAkB,EAGzE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,kBAAkB,EAIvE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAGtE,CAAC;AAoEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;iBAGlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBASjC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;2BAAkF,CAAC;AAE5H,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,kEAAkE"}
+{"version":3,"file":"oauth-resource-server.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,oBAAY,kBAAkB;IAC5B,uFAAuF;IACvF,GAAG,QAAQ;IACX,gGAAgG;IAChG,GAAG,QAAQ;IACX,uGAAuG;IACvG,GAAG,QAAQ;CACZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAC9C,OAAO,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,EACnD,wBAAwB,CAIzB,CAAC;AAEF;yGACyG;AACzG,eAAO,MAAM,gCAAgC,EAAE,SAAS,kBAAkB,EAGzE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,kBAAkB,EAIvE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAGtE,CAAC;AAoEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;iBAGlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBASjC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;2BAAkF,CAAC;AAE5H,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,kEAAkE"}

package/dist/esm/security/oauth-clients/oauth-resource-server.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-resource-server.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAN,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,uFAAuF;IACvF,iCAAW,CAAA;IACX,gGAAgG;IAChG,iCAAW,CAAA;IACX,uGAAuG;IACvG,iCAAW,CAAA;AACb,CAAC,EAPW,kBAAkB,KAAlB,kBAAkB,QAO7B;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAGpC;IACF,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,SAAS;IAC5D,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,YAAY;CAChE,CAAC;AAEF;yGACyG;AACzG,MAAM,CAAC,MAAM,gCAAgC,GAAkC;IAC7E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAkC;IAC3E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAkC;IAC1E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,iCAAiC,GAAG;IACxC,oGAAoG;IACpG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,gDAAgD,CAAC;IACtG,kGAAkG;IAClG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,+FAA+F;IAC/F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,iCAAiC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,iCAAiC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;IACvC;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,6GAA6G,CAAC,CAAC,QAAQ,EAAE;CACtK,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAQ5H,kEAAkE","sourcesContent":["import { z } from 'zod';\nimport { ManualControllerRouteKey } from '../../requests/manual-controllers-routes-urls';\n\n/**\n * OAuth 2.0 **Resource Servers** exposed by a Wildo app — the token-CONSUMING surfaces, each\n * with its OWN canonical audience URI (RFC 8707 §2, \"Resource Indicators for OAuth 2.0\").\n *\n * ## What this is (and is NOT)\n *\n * A `ResourceServerKind` identifies WHICH endpoint may consume a token — it is an\n * **audience / transport** concept, a confused-deputy + token-replay defense\n * (RFC 8707: \"an audience-restricted access token … cannot then be taken by that resource\n * and presented elsewhere\"). It is **NOT** an authorization axis: it never decides WHAT a\n * token may do at a surface. Authorization at every resource server is **roles-only** — the\n * framework's RBAC (scope-based authorization was removed 2026-07-21). So:\n *\n * - **Audience** (this enum) answers *\"at which door may this token be presented?\"*\n * - **Roles** answer *\"what may it do once through that door?\"*\n *\n * The two compose; they are not competing vocabularies.\n *\n * ## The three resource servers\n *\n * | Kind  | Surface                                   | Canonical audience (`aud`)          |\n * |-------|-------------------------------------------|-------------------------------------|\n * | `API` | generic HTTP resource API (CRUD)          | `<appPublicBase>/api/v1`            |\n * | `A2A` | Agent2Agent endpoint (external agents)    | `<API audience>/a2a`               |\n * | `MCP` | Model Context Protocol tool endpoint      | `<API audience>/mcp`               |\n *\n * ## Standards\n *\n * - **RFC 8707** — a token is minted `aud`-bound to the resource server it targets; the AS is\n *   told the target via the `resource` request parameter.\n * - **RFC 9728** (Protected Resource Metadata) — each server publishes\n *   `/.well-known/oauth-protected-resource` advertising its trusted authorization server.\n * - **MCP / A2A authorization specs** — the MCP server (and A2A agent) MUST verify a received\n *   token is `aud`-restricted to ITSELF and MUST reject tokens not issued for it.\n *\n * Resolve a kind's canonical audience via\n * `AppConfigurationService.resolveResourceServerAudience(kind)` (backend) — the SINGLE SOURCE\n * OF TRUTH so minting and validation cannot drift.\n */\nexport enum ResourceServerKind {\n  /** The generic HTTP resource API (CRUD on resources), mounted at the API base path. */\n  API = 'api',\n  /** The Agent2Agent (A2A) endpoint — external agents acting on behalf of a user or a machine. */\n  A2A = 'a2a',\n  /** The Model Context Protocol (MCP) endpoint — a curated subset of operations exposed as MCP tools. */\n  MCP = 'mcp',\n}\n\n/**\n * The mount-path route each NON-`API` resource server appends to the API audience to form its\n * canonical audience URI (see {@link ResourceServerKind}). `API` is the API base itself, so it\n * is intentionally absent here. Keeping the mapping in `_core` next to the enum guarantees the\n * audience derivation is identical everywhere it is computed.\n */\nexport const RESOURCE_SERVER_MOUNT_ROUTE: Record<\n  Exclude<ResourceServerKind, ResourceServerKind.API>,\n  ManualControllerRouteKey\n> = {\n  [ResourceServerKind.A2A]: ManualControllerRouteKey.A2A_TASKS,\n  [ResourceServerKind.MCP]: ManualControllerRouteKey.MCP_ENDPOINT,\n};\n\n/** The resource servers that a USER-DELEGATED token may legitimately target (never the main API —\n *  a delegated token must be confined to an agent surface, per B-S2 / the audience-confinement rule). */\nexport const DELEGATED_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n  ResourceServerKind.A2A,\n  ResourceServerKind.MCP,\n];\n\n/**\n * The resource servers a MACHINE (client-credentials) token may be audience-bound to — ALL of them.\n * Unlike a user-delegated token (confined to agent surfaces), a machine principal legitimately calls\n * the generic API directly AND the A2A / MCP endpoints. The `client_credentials` token endpoint\n * validates the requested RFC 8707 `resource` against this set and mints an `aud`-bound token for the\n * named surface (an absent `resource` deliberately selects the generic API audience). Each resource server then accepts\n * a token bound to its OWN audience (per-endpoint, tight) — the confused-deputy / token-passthrough\n * defense — while the main API accepts only the API audience, so a per-endpoint token cannot be\n * replayed there.\n */\nexport const MACHINE_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n  ResourceServerKind.API,\n  ResourceServerKind.A2A,\n  ResourceServerKind.MCP,\n];\n\n/**\n * The resource-server kinds that support MULTIPLE NAMED INSTANCES (R-2). `API` is excluded: there is\n * exactly one generic resource API per app, so an instance ref never applies to it.\n */\nexport const INSTANCEABLE_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n  ResourceServerKind.A2A,\n  ResourceServerKind.MCP,\n];\n\n/**\n * @wildo_source:part:start saas.models.resource-server-instance facet:layer:shared facet:family:external-access\n *\n * A NAMED resource-server instance — one addressable external surface of a given\n * {@link ResourceServerKind}, with its OWN URL segment, RFC 8707 audience, discovery document, and\n * curated content. Declare instances on `ApplicationInitializationConfig.resourceServerInstances`\n * (your backend's initialization config). Import path: `@wildo-ai/saas-models`.\n *\n * This is a DISCRIMINATED UNION on `kind`, so the two surfaces cannot be confused at authoring time:\n * an MCP server has no `actorSystemRefs` (its membership is declared per-operation), and `kind: API`\n * is unrepresentable (there is exactly one generic resource API per app — see\n * {@link INSTANCEABLE_RESOURCE_SERVERS}). Both were previously only caught at startup, if at all.\n *\n * ## Why instances exist\n *\n * - **MCP** has no grouping primitive: a server exposes ONE flat `tools/list` and a client is\n *   configured with ONE URL. Multiple named servers are therefore the only way to offer curated tool\n *   subsets per consumer (e.g. a read-only `support` server vs a write-capable `ops` server) — which\n *   also keeps tool counts small enough for reliable agent tool-choice.\n * - **A2A** groups SKILLS inside one agent card (a request targets one via `metadata.skillId`).\n *   Multiple named agents therefore express distinct agent IDENTITIES (own card, own audience, own\n *   skill subset) — skills remain the routing mechanism WITHIN an agent.\n *\n * ## What a named instance IS, and what it is NOT\n *\n * Each instance's canonical audience is `resolveResourceServerAudience(kind, ref)` → `…/<mount>/<ref>`.\n * An access token is RFC 8707 bound to exactly ONE instance, so **a token minted for one instance is\n * REJECTED at another** (the 2026-07-29 strict-audience flip makes this real, not advisory). That is a\n * TOKEN-REPLAY boundary: a leaked or misdirected token cannot be used on a sibling surface.\n *\n * It is **NOT a per-client capability grant**. Any client the app authorizes for a grant may request any\n * audience the app declares, exactly as at the generic API. What a caller may DO once through the door is\n * decided by **roles**, uniformly:\n *\n * > **MCP/A2A exposure can only ever be a SUBSET of what roles already permit — it never widens.**\n * > `mcp.exposed` and `mcp.servers` are CURATION applied BEFORE authorization, never instead of it: they\n * > decide which operations are shaped as agent tools and which surface advertises them. Every\n * > `tools/call` still re-runs the same role authorization the REST API runs, and primary scope resolves\n * > identically (a USER_SELF operation reaches the delegating user's own row; an ORG/APPLICATION-scoped\n * > operation runs in the machine token's or delegating user's scope).\n *\n * So curate a surface to make an agent's tool-choice reliable and to confine a token — and use ROLES when\n * a caller must be unable to perform an operation at all.\n *\n * ## Membership (deliberately asymmetric — the units differ)\n *\n * - **MCP**: the OPERATION opts in (`operation.mcp.servers`), beside its existing `mcp.exposed`.\n * - **A2A**: the AGENT lists its skills ({@link A2aAgentInstance.actorSystemRefs}), because the card is\n *   itself the grouping primitive and actor systems carry no a2a config.\n *\n * Both membership lists follow the same rule: OMITTED means \"the default\", PRESENT means \"exactly these,\n * and there must be at least one\". An empty array is rejected rather than silently meaning \"all\" on one\n * side and \"the default\" on the other.\n *\n * `ref` is the URL/audience segment: keep it short, stable and URL-safe — renaming it changes the\n * instance's audience and invalidates tokens minted for the old name.\n */\nconst resourceServerInstanceCommonShape = {\n  /** URL + audience segment (`…/mcp/<ref>`). Short, stable, URL-safe; renaming invalidates tokens. */\n  ref: z.string().min(1).regex(/^[a-z0-9][a-z0-9-]*$/, 'ref must be lowercase alphanumeric with dashes'),\n  /** Human/agent-facing name — surfaced in the instance's discovery document (PRM / agent card). */\n  displayName: z.string().min(1),\n  /** What this surface is for; surfaced in discovery so a client can pick the right instance. */\n  description: z.string(),\n};\n\n/**\n * A named **MCP server**: its own `/mcp/<ref>` URL, RFC 8707 audience, protected-resource metadata and\n * curated tool catalog. Membership is declared on the OPERATION (`operation.mcp.servers`), never here —\n * which is why this branch carries no membership list of its own.\n */\nexport const McpServerInstanceSchema = z.object({\n  ...resourceServerInstanceCommonShape,\n  kind: z.literal(ResourceServerKind.MCP),\n});\n\n/**\n * A named **A2A agent**: its own `/a2a/<ref>` URL, RFC 8707 audience, agent card and skill subset. A\n * distinct agent IDENTITY, not a view onto the default card.\n */\nexport const A2aAgentInstanceSchema = z.object({\n  ...resourceServerInstanceCommonShape,\n  kind: z.literal(ResourceServerKind.A2A),\n  /**\n   * The actor systems exposed as THIS agent's skills. OMITTED ⇒ every exposable system (the default\n   * single-card behavior). PRESENT ⇒ exactly these, and at least one — an empty list is rejected at\n   * startup rather than being read as \"all\", which would turn a typo into a silently WIDER agent.\n   */\n  actorSystemRefs: z.array(z.string()).min(1, 'actorSystemRefs must name at least one actor system when present — omit it to expose every exposable system').optional(),\n});\n\nexport const ResourceServerInstanceSchema = z.discriminatedUnion('kind', [McpServerInstanceSchema, A2aAgentInstanceSchema]);\n\n/** A named MCP server instance (see {@link McpServerInstanceSchema}). */\nexport type McpServerInstance = z.infer<typeof McpServerInstanceSchema>;\n/** A named A2A agent instance (see {@link A2aAgentInstanceSchema}). */\nexport type A2aAgentInstance = z.infer<typeof A2aAgentInstanceSchema>;\n/** Any named resource-server instance — narrow on `kind` to reach the kind-specific fields. */\nexport type ResourceServerInstance = z.infer<typeof ResourceServerInstanceSchema>;\n/** @wildo_source:part:end saas.models.resource-server-instance */\n"]}
+{"version":3,"file":"oauth-resource-server.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAN,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,uFAAuF;IACvF,iCAAW,CAAA;IACX,gGAAgG;IAChG,iCAAW,CAAA;IACX,uGAAuG;IACvG,iCAAW,CAAA;AACb,CAAC,EAPW,kBAAkB,KAAlB,kBAAkB,QAO7B;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAGpC;IACF,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,SAAS;IAC5D,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,wBAAwB,CAAC,YAAY;CAChE,CAAC;AAEF;yGACyG;AACzG,MAAM,CAAC,MAAM,gCAAgC,GAAkC;IAC7E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAkC;IAC3E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAkC;IAC1E,kBAAkB,CAAC,GAAG;IACtB,kBAAkB,CAAC,GAAG;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,iCAAiC,GAAG;IACxC,oGAAoG;IACpG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,gDAAgD,CAAC;IACtG,kGAAkG;IAClG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,+FAA+F;IAC/F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,iCAAiC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,iCAAiC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;IACvC;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,6GAA6G,CAAC,CAAC,QAAQ,EAAE;CACtK,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAQ5H,kEAAkE","sourcesContent":["import { z } from 'zod';\nimport { ManualControllerRouteKey } from '../../requests/manual-controllers-routes-urls';\n\n/**\n * OAuth 2.0 **Resource Servers** exposed by a Wildo app — the token-CONSUMING surfaces, each\n * with its OWN canonical audience URI (RFC 8707 §2, \"Resource Indicators for OAuth 2.0\").\n *\n * ## What this is (and is NOT)\n *\n * A `ResourceServerKind` identifies WHICH endpoint may consume a token — it is an\n * **audience / transport** concept, a confused-deputy + token-replay defense\n * (RFC 8707: \"an audience-restricted access token … cannot then be taken by that resource\n * and presented elsewhere\"). It is **NOT** an authorization axis: it never decides WHAT a\n * token may do at a surface. Authorization at every resource server is **roles-only** — the\n * framework's RBAC (scope-based authorization was removed 2026-07-21). So:\n *\n * - **Audience** (this enum) answers *\"at which door may this token be presented?\"*\n * - **Roles** answer *\"what may it do once through that door?\"*\n *\n * The two compose; they are not competing vocabularies.\n *\n * ## The three resource servers\n *\n * | Kind  | Surface                                   | Canonical audience (`aud`)          |\n * |-------|-------------------------------------------|-------------------------------------|\n * | `API` | generic HTTP resource API (CRUD)          | `<appPublicBase>/api/v1`            |\n * | `A2A` | Agent2Agent endpoint (external agents)    | `<API audience>/a2a`               |\n * | `MCP` | Model Context Protocol tool endpoint      | `<API audience>/mcp`               |\n *\n * ## Standards\n *\n * - **RFC 8707** — a token is minted `aud`-bound to the resource server it targets; the AS is\n *   told the target via the `resource` request parameter.\n * - **RFC 9728** (Protected Resource Metadata) — each server publishes\n *   `/.well-known/oauth-protected-resource` advertising its trusted authorization server.\n * - **MCP / A2A authorization specs** — the MCP server (and A2A agent) MUST verify a received\n *   token is `aud`-restricted to ITSELF and MUST reject tokens not issued for it.\n *\n * Resolve a kind's canonical audience via\n * `AppConfigurationService.resolveResourceServerAudience(kind)` (backend) — the SINGLE SOURCE\n * OF TRUTH so minting and validation cannot drift.\n */\nexport enum ResourceServerKind {\n  /** The generic HTTP resource API (CRUD on resources), mounted at the API base path. */\n  API = 'api',\n  /** The Agent2Agent (A2A) endpoint — external agents acting on behalf of a user or a machine. */\n  A2A = 'a2a',\n  /** The Model Context Protocol (MCP) endpoint — a curated subset of operations exposed as MCP tools. */\n  MCP = 'mcp',\n}\n\n/**\n * The mount-path route each NON-`API` resource server appends to the API audience to form its\n * canonical audience URI (see {@link ResourceServerKind}). `API` is the API base itself, so it\n * is intentionally absent here. Keeping the mapping in `_core` next to the enum guarantees the\n * audience derivation is identical everywhere it is computed.\n */\nexport const RESOURCE_SERVER_MOUNT_ROUTE: Record<\n  Exclude<ResourceServerKind, ResourceServerKind.API>,\n  ManualControllerRouteKey\n> = {\n  [ResourceServerKind.A2A]: ManualControllerRouteKey.A2A_TASKS,\n  [ResourceServerKind.MCP]: ManualControllerRouteKey.MCP_ENDPOINT,\n};\n\n/** The resource servers that a USER-DELEGATED token may legitimately target (never the main API —\n *  a delegated token must be confined to an agent surface, per B-S2 / the audience-confinement rule). */\nexport const DELEGATED_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n  ResourceServerKind.A2A,\n  ResourceServerKind.MCP,\n];\n\n/**\n * The resource servers a MACHINE (client-credentials) token may be audience-bound to — ALL of them.\n * Unlike a user-delegated token (confined to agent surfaces), a machine principal legitimately calls\n * the generic API directly AND the A2A / MCP endpoints. The `client_credentials` token endpoint\n * validates the requested RFC 8707 `resource` against this set and mints an `aud`-bound token for the\n * named surface (an absent `resource` deliberately selects the generic API audience). Each resource server then accepts\n * a token bound to its OWN audience (per-endpoint, tight) — the confused-deputy / token-passthrough\n * defense — while the main API accepts only the API audience, so a per-endpoint token cannot be\n * replayed there.\n */\nexport const MACHINE_TOKEN_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n  ResourceServerKind.API,\n  ResourceServerKind.A2A,\n  ResourceServerKind.MCP,\n];\n\n/**\n * The resource-server kinds that support MULTIPLE NAMED INSTANCES (R-2). `API` is excluded: there is\n * exactly one generic resource API per app, so an instance ref never applies to it.\n */\nexport const INSTANCEABLE_RESOURCE_SERVERS: readonly ResourceServerKind[] = [\n  ResourceServerKind.A2A,\n  ResourceServerKind.MCP,\n];\n\n/**\n * @wildo_source:part:start saas.models.resource-server-instance facet:layer:shared facet:family:external-access\n *\n * A NAMED resource-server instance — one addressable external surface of a given\n * {@link ResourceServerKind}, with its OWN URL segment, RFC 8707 audience, discovery document, and\n * curated content. Declare instances on `ApplicationInitializationConfig.resourceServerInstances`\n * (your backend's initialization config). Import path: `@wildo-ai/saas-models`.\n *\n * This is a DISCRIMINATED UNION on `kind`, so the two surfaces cannot be confused at authoring time:\n * an MCP server has no `actorSystemRefs` (its membership is declared per-operation), and `kind: API`\n * is unrepresentable (there is exactly one generic resource API per app — see\n * {@link INSTANCEABLE_RESOURCE_SERVERS}). Both were previously only caught at startup, if at all.\n *\n * ## Why instances exist\n *\n * - **MCP** has no grouping primitive: a server exposes ONE flat `tools/list` and a client is\n *   configured with ONE URL. Multiple named servers are therefore the only way to offer curated tool\n *   subsets per consumer (e.g. a read-only `support` server vs a write-capable `ops` server) — which\n *   also keeps tool counts small enough for reliable agent tool-choice.\n * - **A2A** groups SKILLS inside one agent card (a request targets one via `metadata.skillId`).\n *   Multiple named agents therefore express distinct agent IDENTITIES (own card, own audience, own\n *   skill subset) — skills remain the routing mechanism WITHIN an agent.\n *\n * ## What a named instance IS, and what it is NOT\n *\n * Each instance's canonical audience is `resolveResourceServerAudience(kind, ref)` → `…/<mount>/<ref>`.\n * An access token is RFC 8707 bound to exactly ONE instance, so **a token minted for one instance is\n * REJECTED at another** (the 2026-07-29 strict-audience flip makes this real, not advisory). That is a\n * TOKEN-REPLAY boundary: a leaked or misdirected token cannot be used on a sibling surface.\n *\n * It is **NOT a per-client capability grant**. Any client the app authorizes for a grant may request any\n * audience the app declares, exactly as at the generic API. What a caller may DO once through the door is\n * decided by **roles**, uniformly:\n *\n * > **MCP/A2A exposure can only ever be a SUBSET of what roles already permit — it never widens.**\n * > `mcp.exposed` and `mcp.servers` are CURATION applied BEFORE authorization, never instead of it: they\n * > decide which operations are shaped as agent tools and which surface advertises them. Every\n * > `tools/call` still re-runs the same role authorization the REST API runs, and primary scope resolves\n * > identically (a USER_SELF operation reaches the delegating user's own row; an ORG/APPLICATION-scoped\n * > operation runs in the machine token's or delegating user's scope).\n *\n * So curate a surface to make an agent's tool-choice reliable and to confine a token — and use ROLES when\n * a caller must be unable to perform an operation at all.\n *\n * ## Membership (deliberately asymmetric — the units differ)\n *\n * - **MCP**: the OPERATION opts in (`operation.mcp.servers`), beside its existing `mcp.exposed`.\n * - **A2A**: the AGENT lists its skills ({@link A2aAgentInstance.actorSystemRefs}), because the card is\n *   itself the grouping primitive and actor systems carry no a2a config.\n *\n * Both membership lists follow the same rule: OMITTED means \"the default\", PRESENT means \"exactly these,\n * and there must be at least one\". An empty array is rejected rather than silently meaning \"all\" on one\n * side and \"the default\" on the other.\n *\n * `ref` is the URL/audience segment: keep it short, stable and URL-safe — renaming it changes the\n * instance's audience and invalidates tokens minted for the old name.\n */\nconst resourceServerInstanceCommonShape = {\n  /** URL + audience segment (`…/mcp/<ref>`). Short, stable, URL-safe; renaming invalidates tokens. */\n  ref: z.string().min(1).regex(/^[a-z0-9][a-z0-9-]*$/, 'ref must be lowercase alphanumeric with dashes'),\n  /** Human/agent-facing name — surfaced in the instance's discovery document (PRM / agent card). */\n  displayName: z.string().min(1),\n  /** What this surface is for; surfaced in discovery so a client can pick the right instance. */\n  description: z.string(),\n};\n\n/**\n * A named **MCP server**: its own `/mcp/<ref>` URL, RFC 8707 audience, protected-resource metadata and\n * curated tool catalog. Membership is declared on the OPERATION (`operation.mcp.servers`), never here —\n * which is why this branch carries no membership list of its own.\n */\nexport const McpServerInstanceSchema = z.object({\n  ...resourceServerInstanceCommonShape,\n  kind: z.literal(ResourceServerKind.MCP),\n});\n\n/**\n * A named **A2A agent**: its own `/a2a/<ref>` URL, RFC 8707 audience, agent card and skill subset. A\n * distinct agent IDENTITY, not a view onto the default card.\n */\nexport const A2aAgentInstanceSchema = z.object({\n  ...resourceServerInstanceCommonShape,\n  kind: z.literal(ResourceServerKind.A2A),\n  /**\n   * The actor systems exposed as THIS agent's skills. OMITTED ⇒ every exposable system (the default\n   * single-card behavior). PRESENT ⇒ exactly these, and at least one — an empty list is rejected at\n   * startup rather than being read as \"all\", which would turn a typo into a silently WIDER agent.\n   */\n  actorSystemRefs: z.array(z.string()).min(1, 'actorSystemRefs must name at least one actor system when present — omit it to expose every exposable system').optional(),\n});\n\nexport const ResourceServerInstanceSchema = z.discriminatedUnion('kind', [McpServerInstanceSchema, A2aAgentInstanceSchema]);\n\n/** A named MCP server instance (see {@link McpServerInstanceSchema}). */\nexport type McpServerInstance = z.infer<typeof McpServerInstanceSchema>;\n/** A named A2A agent instance (see {@link A2aAgentInstanceSchema}). */\nexport type A2aAgentInstance = z.infer<typeof A2aAgentInstanceSchema>;\n/** Any named resource-server instance — narrow on `kind` to reach the kind-specific fields. */\nexport type ResourceServerInstance = z.infer<typeof ResourceServerInstanceSchema>;\n/** @wildo_source:part:end saas.models.resource-server-instance */\n"]}

package/dist/esm/security/outbound-target-control.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"outbound-target-control.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oBAAoB,yBAAyB;IAC7C,+FAA+F;IAC/F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,cAAc,mBAAmB;IACjC,8FAA8F;IAC9F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,UAAU,eAAe;IACzB;;;;OAIG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,0GAA0G;IAC1G,IAAI,SAAS;IACb,4GAA4G;IAC5G,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,eAAe,oBAAoB;CACpC"}
+{"version":3,"file":"outbound-target-control.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oBAAoB,yBAAyB;IAC7C,+FAA+F;IAC/F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,cAAc,mBAAmB;IACjC,8FAA8F;IAC9F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,UAAU,eAAe;IACzB;;;;OAIG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,0GAA0G;IAC1G,IAAI,SAAS;IACb,4GAA4G;IAC5G,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,eAAe,oBAAoB;CACpC"}

package/dist/esm/security/outbound-target-control.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"outbound-target-control.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,mBA8BX;AA9BD,WAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oEAA6C,CAAA;IAC7C,+FAA+F;IAC/F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,wDAAiC,CAAA;IACjC,8FAA8F;IAC9F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,kFAA2D,CAAA;IAC3D;;;OAGG;IACH,gDAAyB,CAAA;IACzB;;;;OAIG;IACH,gFAAyD,CAAA;AAC3D,CAAC,EA9BW,mBAAmB,KAAnB,mBAAmB,QA8B9B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,0GAA0G;IAC1G,gDAAa,CAAA;IACb,4GAA4G;IAC5G,kEAA+B,CAAA;IAC/B,0GAA0G;IAC1G,sEAAmC,CAAA;AACrC,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C","sourcesContent":["/**\n * The classes of server-side request whose DESTINATION is chosen by somebody other than the\n * deployment that makes the request — and how much of the private network each may reach.\n *\n * ## Why the class, and not the call site, is the unit\n *\n * The request-forgery question is never \"is this URL safe?\" in the abstract. It is \"who picked this\n * destination, and are they allowed to point this server at its own network?\". An organization\n * administrator who authors a webhook endpoint, an A2A client registering a push target, and an\n * unauthenticated stranger presenting an OAuth `client_id` URL all answer it differently — and the\n * application developer who writes a provider endpoint into the backend's own configuration is not a\n * request-forgery threat at all, because they already own the server.\n *\n * So the vocabulary names the CLASS of destination, by who authors it. Every engine site that issues\n * such a request declares which class it is serving, and the admission follows from the class plus\n * the operator-declared runtime environment — never from anything the destination's author can set.\n *\n * ## What is deliberately NOT a class\n *\n * Destinations the application's own code declares — a provider API endpoint, an `httpApiBinding`\n * base URL — are trusted as authored. What those sites must still refuse is a REMOTE server\n * re-pointing the request (a redirect), which is a property of the transport, not an admission.\n * Platform topology (the apps-manager, the module registry, infrastructure sidecars) is operator\n * configuration and private by design.\n */\nexport enum OutboundTargetClass {\n  /** An M2M webhook endpoint. Authored by an organization administrator. */\n  M2M_WEBHOOK_ENDPOINT = 'm2m_webhook_endpoint',\n  /** An A2A push-notification target. Supplied by the external A2A client that registered it. */\n  A2A_PUSH_NOTIFICATION_ENDPOINT = 'a2a_push_notification_endpoint',\n  /**\n   * A SIEM collector. Authored by an organization administrator; the one class the operator may\n   * admit onto a private network, because a self-hosted collector on the same network is a supported\n   * deployment shape.\n   */\n  SIEM_COLLECTOR = 'siem_collector',\n  /** An OAuth client metadata document. Its URL is presented by an UNAUTHENTICATED stranger. */\n  OAUTH_CLIENT_METADATA_DOCUMENT = 'oauth_client_metadata_document',\n  /**\n   * A federated identity provider's endpoints — OIDC discovery, token, userinfo, profile extension,\n   * JWKS, SAML metadata and the SAML SSO/SLO reachability checks. Authored by an organization\n   * administrator on an SSO connection, or discovered from a document that administrator's IdP serves.\n   */\n  FEDERATED_IDENTITY_PROVIDER = 'federated_identity_provider',\n  /**\n   * A remote MCP server an agent calls. Declared by the application, but it is a THIRD PARTY's\n   * service, reached with the agent's delegated credentials, and its answers can re-point a request.\n   */\n  MCP_SERVER = 'mcp_server',\n  /**\n   * A download link an EMAIL provider hands back at runtime — the original bytes of a received message, an\n   * attachment (#1600). The application declared the provider, but the VENDOR chose this URL, so it is admitted\n   * only against the hosts the provider's contract declares, and never re-pointed by a redirect.\n   */\n  EMAIL_PROVIDER_CONTENT_URL = 'email_provider_content_url',\n}\n\n/**\n * How much of the network an outbound request may reach beyond the public internet.\n *\n * Three members rather than a boolean, because the useful middle is not \"private\" and not \"public\":\n * local development and automated test runs legitimately reach doubles on LOOPBACK, and nothing about\n * that justifies reaching the cloud instance-metadata address (link-local) or a cluster-internal\n * service (RFC 1918), which are the addresses a request-forgery attack actually wants.\n */\nexport enum OutboundPrivateAddressAdmission {\n  /** Public addresses only. The default, and the only posture a stranger-supplied destination ever gets. */\n  NONE = 'none',\n  /** Public addresses plus loopback (`127.0.0.0/8`, `::1`, `localhost`). Never link-local, never RFC 1918. */\n  LOOPBACK_ONLY = 'loopback_only',\n  /** Any address. Only by an explicit operator declaration, and only for a class the operator may admit. */\n  PRIVATE_NETWORK = 'private_network',\n}\n"]}
+{"version":3,"file":"outbound-target-control.shared.schemas.js","sourceRoot":"","sources":["../../../src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,mBA8BX;AA9BD,WAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oEAA6C,CAAA;IAC7C,+FAA+F;IAC/F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,wDAAiC,CAAA;IACjC,8FAA8F;IAC9F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,kFAA2D,CAAA;IAC3D;;;OAGG;IACH,gDAAyB,CAAA;IACzB;;;;OAIG;IACH,gFAAyD,CAAA;AAC3D,CAAC,EA9BW,mBAAmB,KAAnB,mBAAmB,QA8B9B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,0GAA0G;IAC1G,gDAAa,CAAA;IACb,4GAA4G;IAC5G,kEAA+B,CAAA;IAC/B,0GAA0G;IAC1G,sEAAmC,CAAA;AACrC,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C","sourcesContent":["/**\n * The classes of server-side request whose DESTINATION is chosen by somebody other than the\n * deployment that makes the request — and how much of the private network each may reach.\n *\n * ## Why the class, and not the call site, is the unit\n *\n * The request-forgery question is never \"is this URL safe?\" in the abstract. It is \"who picked this\n * destination, and are they allowed to point this server at its own network?\". An organization\n * administrator who authors a webhook endpoint, an A2A client registering a push target, and an\n * unauthenticated stranger presenting an OAuth `client_id` URL all answer it differently — and the\n * application developer who writes a provider endpoint into the backend's own configuration is not a\n * request-forgery threat at all, because they already own the server.\n *\n * So the vocabulary names the CLASS of destination, by who authors it. Every engine site that issues\n * such a request declares which class it is serving, and the admission follows from the class plus\n * the operator-declared runtime environment — never from anything the destination's author can set.\n *\n * ## What is deliberately NOT a class\n *\n * Destinations the application's own code declares — a provider API endpoint, an `httpApiBinding`\n * base URL — are trusted as authored. What those sites must still refuse is a REMOTE server\n * re-pointing the request (a redirect), which is a property of the transport, not an admission.\n * Platform topology (the apps-manager, the module registry, infrastructure sidecars) is operator\n * configuration and private by design.\n */\nexport enum OutboundTargetClass {\n  /** An M2M webhook endpoint. Authored by an organization administrator. */\n  M2M_WEBHOOK_ENDPOINT = 'm2m_webhook_endpoint',\n  /** An A2A push-notification target. Supplied by the external A2A client that registered it. */\n  A2A_PUSH_NOTIFICATION_ENDPOINT = 'a2a_push_notification_endpoint',\n  /**\n   * A SIEM collector. Authored by an organization administrator; the one class the operator may\n   * admit onto a private network, because a self-hosted collector on the same network is a supported\n   * deployment shape.\n   */\n  SIEM_COLLECTOR = 'siem_collector',\n  /** An OAuth client metadata document. Its URL is presented by an UNAUTHENTICATED stranger. */\n  OAUTH_CLIENT_METADATA_DOCUMENT = 'oauth_client_metadata_document',\n  /**\n   * A federated identity provider's endpoints — OIDC discovery, token, userinfo, profile extension,\n   * JWKS, SAML metadata and the SAML SSO/SLO reachability checks. Authored by an organization\n   * administrator on an SSO connection, or discovered from a document that administrator's IdP serves.\n   */\n  FEDERATED_IDENTITY_PROVIDER = 'federated_identity_provider',\n  /**\n   * A remote MCP server an agent calls. Declared by the application, but it is a THIRD PARTY's\n   * service, reached with the agent's delegated credentials, and its answers can re-point a request.\n   */\n  MCP_SERVER = 'mcp_server',\n  /**\n   * A download link an EMAIL provider hands back at runtime — the original bytes of a received message, an\n   * attachment (#1600). The application declared the provider, but the VENDOR chose this URL, so it is admitted\n   * only against the hosts the provider's contract declares, and never re-pointed by a redirect.\n   */\n  EMAIL_PROVIDER_CONTENT_URL = 'email_provider_content_url',\n}\n\n/**\n * How much of the network an outbound request may reach beyond the public internet.\n *\n * Three members rather than a boolean, because the useful middle is not \"private\" and not \"public\":\n * local development and automated test runs legitimately reach doubles on LOOPBACK, and nothing about\n * that justifies reaching the cloud instance-metadata address (link-local) or a cluster-internal\n * service (RFC 1918), which are the addresses a request-forgery attack actually wants.\n */\nexport enum OutboundPrivateAddressAdmission {\n  /** Public addresses only. The default, and the only posture a stranger-supplied destination ever gets. */\n  NONE = 'none',\n  /** Public addresses plus loopback (`127.0.0.0/8`, `::1`, `localhost`). Never link-local, never RFC 1918. */\n  LOOPBACK_ONLY = 'loopback_only',\n  /** Any address. Only by an explicit operator declaration, and only for a class the operator may admit. */\n  PRIVATE_NETWORK = 'private_network',\n}\n"]}

package/dist/esm/security/submission-challenge/submission-challenge.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"submission-challenge.shared.d.ts","sourceRoot":"","sources":["../../../../../src/security/submission-challenge/submission-challenge.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,iDAAiD;AACjD,oBAAY,+BAA+B;IACzC,0GAA0G;IAC1G,cAAc,mBAAmB;IACjC,qDAAqD;IACrD,aAAa,kBAAkB;CAChC;AAED;;;;;;;;GAQG;AACH,oBAAY,yBAAyB;IACnC,0DAA0D;IAC1D,eAAe,oBAAoB;CACpC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,QAA4B,CAAC;AAE7E,gIAAgI;AAChI,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oCAAoC;IACnD,yHAAyH;IACzH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,4FAA4F;AAC5F,oBAAY,oBAAoB;IAC9B,OAAO,YAAY;CACpB;AAED,8GAA8G;AAC9G,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kJAAkJ;IAClJ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,4GAA4G;AAC5G,MAAM,MAAM,2BAA2B,GACnC;IACA,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,cAAc,CAAC;IAC9D,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,aAAa,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,yCAAyC,CAAC;AAE9F;;;;GAIG;AACH,oBAAY,8BAA8B;IACxC,kEAAkE;IAClE,QAAQ,kCAAkC;IAC1C,2CAA2C;IAC3C,OAAO,iCAAiC;CACzC;AAED,oGAAoG;AACpG,eAAO,MAAM,wCAAwC,OAAO,CAAC;AAE7D,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,2BAA2B,GAAG,MAAM,CAE/F;AAMD,6FAA6F;AAC7F,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,oBAAoB,EAC/B,OAAO,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAC5E,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAUlD"}
+{"version":3,"file":"submission-challenge.shared.d.ts","sourceRoot":"","sources":["../../../../src/security/submission-challenge/submission-challenge.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,iDAAiD;AACjD,oBAAY,+BAA+B;IACzC,0GAA0G;IAC1G,cAAc,mBAAmB;IACjC,qDAAqD;IACrD,aAAa,kBAAkB;CAChC;AAED;;;;;;;;GAQG;AACH,oBAAY,yBAAyB;IACnC,0DAA0D;IAC1D,eAAe,oBAAoB;CACpC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,QAA4B,CAAC;AAE7E,gIAAgI;AAChI,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oCAAoC;IACnD,yHAAyH;IACzH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,4FAA4F;AAC5F,oBAAY,oBAAoB;IAC9B,OAAO,YAAY;CACpB;AAED,8GAA8G;AAC9G,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kJAAkJ;IAClJ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,4GAA4G;AAC5G,MAAM,MAAM,2BAA2B,GACnC;IACA,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,cAAc,CAAC;IAC9D,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,aAAa,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,yCAAyC,CAAC;AAE9F;;;;GAIG;AACH,oBAAY,8BAA8B;IACxC,kEAAkE;IAClE,QAAQ,kCAAkC;IAC1C,2CAA2C;IAC3C,OAAO,iCAAiC;CACzC;AAED,oGAAoG;AACpG,eAAO,MAAM,wCAAwC,OAAO,CAAC;AAE7D,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,2BAA2B,GAAG,MAAM,CAE/F;AAMD,6FAA6F;AAC7F,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,oBAAoB,EAC/B,OAAO,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAC5E,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAUlD"}

package/dist/esm/security/submission-challenge/submission-challenge.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"submission-challenge.shared.js","sourceRoot":"","sources":["../../../../../src/security/submission-challenge/submission-challenge.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,iDAAiD;AACjD,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,0GAA0G;IAC1G,oEAAiC,CAAA;IACjC,qDAAqD;IACrD,kEAA+B,CAAA;AACjC,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACnC,0DAA0D;IAC1D,gEAAmC,CAAA;AACrC,CAAC,EAHW,yBAAyB,KAAzB,yBAAyB,QAGpC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;AAE7E,gIAAgI;AAChI,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAsBD,4FAA4F;AAC5F,MAAM,CAAN,IAAY,oBAEX;AAFD,WAAY,oBAAoB;IAC9B,2CAAmB,CAAA;AACrB,CAAC,EAFW,oBAAoB,KAApB,oBAAoB,QAE/B;AA8BD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC;AAE9F;;;;GAIG;AACH,MAAM,CAAN,IAAY,8BAKX;AALD,WAAY,8BAA8B;IACxC,kEAAkE;IAClE,4EAA0C,CAAA;IAC1C,2CAA2C;IAC3C,0EAAwC,CAAA;AAC1C,CAAC,EALW,8BAA8B,KAA9B,8BAA8B,QAKzC;AAED,oGAAoG;AACpG,MAAM,CAAC,MAAM,wCAAwC,GAAG,IAAI,CAAC;AAE7D,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,QAAqC;IACrF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,KAAK,CAAC,MAAmB;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY,EAAE,MAAc;IACzE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9G,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAA+B,EAC/B,UAA2E,EAAE;IAE7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,SAAS,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,MAAM,wBAAwB,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,+BAA+B,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,GAAG,UAAU,KAAK,UAAU,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * The challenge a public submission answers before the backend accepts it (#1735).\n *\n * ## Why two kinds, and why the second one is not optional\n *\n * A captcha vendor that analyses visitors for its own purposes needs their consent (Google reCAPTCHA:\n * CNIL Délibération SAN-2023-003, recorded on the frontend consent classification), so a visitor who\n * declines must still be able to submit. If declining meant \"no challenge\", a bot would decline too and\n * the captcha would protect nothing. So an application that protects a form accepts EITHER:\n *\n * - a vendor token (`PROVIDER_TOKEN`) — obtained by the consented vendor's browser part and verified by its\n *   backend part (reCAPTCHA `siteverify`);\n * - a proof of work (`PROOF_OF_WORK`) — the engine's own challenge, consent-exempt because nothing leaves\n *   the application and nothing is stored in the visitor's browser: the backend issues a salted SHA-256\n *   puzzle signed with an application key, the browser searches for the number, the backend re-derives it.\n *   It makes each submission cost the sender CPU time instead of identifying anyone.\n *\n * A submission with neither, or with one that fails, is refused: the challenge fails CLOSED.\n *\n * The proof-of-work scheme is ALTCHA's: challenge = SHA-256(salt + number), the client iterates numbers until the hash\n * matches. The signature here covers the salt as well as the hash (HMAC(salt + \"\\n\" + challenge)): the hash input has\n * no separator and the salt ends in its expiry digits, so a signature over the hash alone would let digits move from\n * the number onto the salt and forge a later expiry.\n * spec-cite: https://altcha.org/docs/proof-of-work/ (read through its search summary 2026-09-29) — the scheme\n * is described, not quoted; the field names below are this framework's own.\n *\n * ## Browser-safe on purpose\n *\n * The website's contact form encodes and solves challenges in the visitor's browser, so this file imports\n * nothing and uses only `globalThis.crypto.subtle`, which both browsers and Node provide.\n */\n\n/** Which kind of answer a submission carries. */\nexport enum SubmissionChallengeResponseKind {\n  /** A token from a consented captcha vendor's browser part, verified by the same vendor's backend part. */\n  PROVIDER_TOKEN = 'provider_token',\n  /** The engine's own consent-exempt proof of work. */\n  PROOF_OF_WORK = 'proof_of_work',\n}\n\n/**\n * The actions the ENGINE's own protected operations are bound to. A vendor token is minted for an action and the\n * backend refuses one minted for another, so a token solved on one form cannot be replayed on another.\n *\n * This enum names the engine's actions only. An application protects its OWN anonymous operation by declaring\n * `submissionChallenge: { action: '<its action>' }` on the operation variant (#1985), with an action it names in its\n * own vocabulary; see {@link ResourceOperationSubmissionChallenge} for why the declaration takes a name rather than a\n * member of this enum.\n */\nexport enum SubmissionChallengeAction {\n  /** The public contact form (`POST /inbound-contacts`). */\n  INBOUND_CONTACT = 'inbound_contact',\n}\n\n/**\n * The names a submission-challenge action may take: letters, digits, underscores and slashes, 1 to 100 characters.\n *\n * The character set is the captcha vendor's. The action is sent to Google reCAPTCHA as the `action` a token is minted\n * for and checked against on `siteverify`, and reCAPTCHA v3 states \"Actions might contain only alphanumeric\n * characters, slashes, and underscores.\" A name outside it would be minted by no vendor, so every token for it would\n * be refused. The 100-character bound is this framework's own: nothing longer is a name a person reads in a console.\n * spec-cite: https://developers.google.com/recaptcha/docs/v3 §\"Actions\" (fetched 2026-09-29)\n */\nexport const SUBMISSION_CHALLENGE_ACTION_PATTERN = /^[A-Za-z0-9_/]{1,100}$/u;\n\n/** Whether `value` is an action name a captcha vendor can mint a token for. See {@link SUBMISSION_CHALLENGE_ACTION_PATTERN}. */\nexport function isSubmissionChallengeActionName(value: unknown): value is string {\n  return typeof value === 'string' && SUBMISSION_CHALLENGE_ACTION_PATTERN.test(value);\n}\n\n/**\n * An operation variant's declaration that an UNAUTHENTICATED caller answers a submission challenge (#1985).\n *\n * `action` is a NAME (an open identifier), not a member of {@link SubmissionChallengeAction}, so an application can\n * protect its own anonymous create (a waitlist, a quote request) without the engine growing a member for it. The\n * engine's own operations pass their enum member; an application passes a member of its own enum. What keeps the name\n * honest is the grammar ({@link SUBMISSION_CHALLENGE_ACTION_PATTERN}), which the resource factory enforces.\n *\n * Rejected alternatives, recorded because each was on the table:\n * - A closed engine enum grown one member per protected operation. The engine cannot know an application's forms, so\n *   an application's own create could never be protected: exactly the gap this declaration closes.\n * - Deriving the action from the operation (`<resource>/<operation>`). It needs no authoring, but a resource or variant\n *   identifier may carry characters the vendor refuses (a hyphen), so the derivation would have to rewrite them, and two\n *   operations could then collide on one action with nothing saying so. A declared name is visible, reviewable and fixed.\n */\nexport interface ResourceOperationSubmissionChallenge {\n  /** The action a vendor token must have been minted for. Name one per form: sharing it lets a token move between them. */\n  readonly action: string;\n}\n\n/** The only hash the proof of work uses. Named so the wire value has one runtime source. */\nexport enum ProofOfWorkAlgorithm {\n  SHA_256 = 'SHA-256',\n}\n\n/** A proof-of-work challenge as the backend issues it. Every field is echoed back unchanged in the answer. */\nexport interface ProofOfWorkChallenge {\n  readonly algorithm: ProofOfWorkAlgorithm;\n  /** Random, and carries the expiry (`<hex>?expires=<unix seconds>`) so the signature covers it. */\n  readonly salt: string;\n  /** Hex SHA-256 of `salt + number` for the secret number. */\n  readonly challenge: string;\n  /** The largest number the search has to try. */\n  readonly maxNumber: number;\n  /** Hex HMAC-SHA-256 of `salt`, a newline and `challenge`, under the application's challenge key — so the salt and its expiry cannot be edited. */\n  readonly signature: string;\n}\n\n/** What a submission sends, in the `WildoHeaderKeys.SUBMISSION_CHALLENGE_RESPONSE` header, JSON-encoded. */\nexport type SubmissionChallengeResponse =\n  | {\n    readonly kind: SubmissionChallengeResponseKind.PROVIDER_TOKEN;\n    /** The captcha provider whose browser part minted the token (`recaptcha`). */\n    readonly providerRef: string;\n    readonly token: string;\n  }\n  | {\n    readonly kind: SubmissionChallengeResponseKind.PROOF_OF_WORK;\n    readonly challenge: ProofOfWorkChallenge;\n    /** The number the browser found. */\n    readonly number: number;\n  };\n\n/**\n * Where a browser asks for a proof-of-work challenge, under the API base path. The ONE source of this path: the\n * backend's route table (`MANUAL_CONTROLLER_ROUTES_URLS`) reads it from here, so a browser form can reach it without\n * pulling that whole table into its bundle.\n */\nexport const SUBMISSION_CHALLENGE_PROOF_OF_WORK_PATH = '/submission-challenges/proof-of-work';\n\n/**\n * The stable `error.code` of a refused public submission — what a client branches on (the engine hoists an error's\n * `context.code` to the top-level `error.code` of its response). A form answers either one again, with the proof of\n * work.\n */\nexport enum SubmissionChallengeRefusalCode {\n  /** No answer was sent, and the application protects this form. */\n  REQUIRED = 'SUBMISSION_CHALLENGE_REQUIRED',\n  /** An answer was sent and not accepted. */\n  REFUSED = 'SUBMISSION_CHALLENGE_REFUSED',\n}\n\n/** The largest encoded answer the backend reads; anything longer is refused before it is parsed. */\nexport const SUBMISSION_CHALLENGE_RESPONSE_MAX_LENGTH = 8192;\n\n/** Encode an answer for the request header. */\nexport function encodeSubmissionChallengeResponse(response: SubmissionChallengeResponse): string {\n  return JSON.stringify(response);\n}\n\nfunction toHex(buffer: ArrayBuffer): string {\n  return Array.from(new Uint8Array(buffer), (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/** Hex SHA-256 of `salt + number` — the one hash both the solver and the backend compute. */\nexport async function hashProofOfWorkCandidate(salt: string, number: number): Promise<string> {\n  const digest = await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(`${salt}${number}`));\n  return toHex(digest);\n}\n\n/**\n * Find the number a challenge was built from, or `undefined` when none up to `maxNumber` matches (a\n * challenge not issued by this scheme). Yields to the event loop every `yieldEvery` tries so a page stays\n * responsive while it searches.\n */\nexport async function solveProofOfWorkChallenge(\n  challenge: ProofOfWorkChallenge,\n  options: { readonly yieldEvery?: number; readonly signal?: AbortSignal } = {},\n): Promise<SubmissionChallengeResponse | undefined> {\n  const yieldEvery = options.yieldEvery ?? 1000;\n  for (let number = 0; number <= challenge.maxNumber; number += 1) {\n    if (options.signal?.aborted) return undefined;\n    if (await hashProofOfWorkCandidate(challenge.salt, number) === challenge.challenge) {\n      return { kind: SubmissionChallengeResponseKind.PROOF_OF_WORK, challenge, number };\n    }\n    if (number % yieldEvery === yieldEvery - 1) await new Promise((resolve) => setTimeout(resolve, 0));\n  }\n  return undefined;\n}\n"]}
+{"version":3,"file":"submission-challenge.shared.js","sourceRoot":"","sources":["../../../../src/security/submission-challenge/submission-challenge.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,iDAAiD;AACjD,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,0GAA0G;IAC1G,oEAAiC,CAAA;IACjC,qDAAqD;IACrD,kEAA+B,CAAA;AACjC,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACnC,0DAA0D;IAC1D,gEAAmC,CAAA;AACrC,CAAC,EAHW,yBAAyB,KAAzB,yBAAyB,QAGpC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;AAE7E,gIAAgI;AAChI,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAsBD,4FAA4F;AAC5F,MAAM,CAAN,IAAY,oBAEX;AAFD,WAAY,oBAAoB;IAC9B,2CAAmB,CAAA;AACrB,CAAC,EAFW,oBAAoB,KAApB,oBAAoB,QAE/B;AA8BD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC;AAE9F;;;;GAIG;AACH,MAAM,CAAN,IAAY,8BAKX;AALD,WAAY,8BAA8B;IACxC,kEAAkE;IAClE,4EAA0C,CAAA;IAC1C,2CAA2C;IAC3C,0EAAwC,CAAA;AAC1C,CAAC,EALW,8BAA8B,KAA9B,8BAA8B,QAKzC;AAED,oGAAoG;AACpG,MAAM,CAAC,MAAM,wCAAwC,GAAG,IAAI,CAAC;AAE7D,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,QAAqC;IACrF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,KAAK,CAAC,MAAmB;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY,EAAE,MAAc;IACzE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9G,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAA+B,EAC/B,UAA2E,EAAE;IAE7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,SAAS,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,MAAM,wBAAwB,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,+BAA+B,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,GAAG,UAAU,KAAK,UAAU,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * The challenge a public submission answers before the backend accepts it (#1735).\n *\n * ## Why two kinds, and why the second one is not optional\n *\n * A captcha vendor that analyses visitors for its own purposes needs their consent (Google reCAPTCHA:\n * CNIL Délibération SAN-2023-003, recorded on the frontend consent classification), so a visitor who\n * declines must still be able to submit. If declining meant \"no challenge\", a bot would decline too and\n * the captcha would protect nothing. So an application that protects a form accepts EITHER:\n *\n * - a vendor token (`PROVIDER_TOKEN`) — obtained by the consented vendor's browser part and verified by its\n *   backend part (reCAPTCHA `siteverify`);\n * - a proof of work (`PROOF_OF_WORK`) — the engine's own challenge, consent-exempt because nothing leaves\n *   the application and nothing is stored in the visitor's browser: the backend issues a salted SHA-256\n *   puzzle signed with an application key, the browser searches for the number, the backend re-derives it.\n *   It makes each submission cost the sender CPU time instead of identifying anyone.\n *\n * A submission with neither, or with one that fails, is refused: the challenge fails CLOSED.\n *\n * The proof-of-work scheme is ALTCHA's: challenge = SHA-256(salt + number), the client iterates numbers until the hash\n * matches. The signature here covers the salt as well as the hash (HMAC(salt + \"\\n\" + challenge)): the hash input has\n * no separator and the salt ends in its expiry digits, so a signature over the hash alone would let digits move from\n * the number onto the salt and forge a later expiry.\n * spec-cite: https://altcha.org/docs/proof-of-work/ (read through its search summary 2026-09-29) — the scheme\n * is described, not quoted; the field names below are this framework's own.\n *\n * ## Browser-safe on purpose\n *\n * The website's contact form encodes and solves challenges in the visitor's browser, so this file imports\n * nothing and uses only `globalThis.crypto.subtle`, which both browsers and Node provide.\n */\n\n/** Which kind of answer a submission carries. */\nexport enum SubmissionChallengeResponseKind {\n  /** A token from a consented captcha vendor's browser part, verified by the same vendor's backend part. */\n  PROVIDER_TOKEN = 'provider_token',\n  /** The engine's own consent-exempt proof of work. */\n  PROOF_OF_WORK = 'proof_of_work',\n}\n\n/**\n * The actions the ENGINE's own protected operations are bound to. A vendor token is minted for an action and the\n * backend refuses one minted for another, so a token solved on one form cannot be replayed on another.\n *\n * This enum names the engine's actions only. An application protects its OWN anonymous operation by declaring\n * `submissionChallenge: { action: '<its action>' }` on the operation variant (#1985), with an action it names in its\n * own vocabulary; see {@link ResourceOperationSubmissionChallenge} for why the declaration takes a name rather than a\n * member of this enum.\n */\nexport enum SubmissionChallengeAction {\n  /** The public contact form (`POST /inbound-contacts`). */\n  INBOUND_CONTACT = 'inbound_contact',\n}\n\n/**\n * The names a submission-challenge action may take: letters, digits, underscores and slashes, 1 to 100 characters.\n *\n * The character set is the captcha vendor's. The action is sent to Google reCAPTCHA as the `action` a token is minted\n * for and checked against on `siteverify`, and reCAPTCHA v3 states \"Actions might contain only alphanumeric\n * characters, slashes, and underscores.\" A name outside it would be minted by no vendor, so every token for it would\n * be refused. The 100-character bound is this framework's own: nothing longer is a name a person reads in a console.\n * spec-cite: https://developers.google.com/recaptcha/docs/v3 §\"Actions\" (fetched 2026-09-29)\n */\nexport const SUBMISSION_CHALLENGE_ACTION_PATTERN = /^[A-Za-z0-9_/]{1,100}$/u;\n\n/** Whether `value` is an action name a captcha vendor can mint a token for. See {@link SUBMISSION_CHALLENGE_ACTION_PATTERN}. */\nexport function isSubmissionChallengeActionName(value: unknown): value is string {\n  return typeof value === 'string' && SUBMISSION_CHALLENGE_ACTION_PATTERN.test(value);\n}\n\n/**\n * An operation variant's declaration that an UNAUTHENTICATED caller answers a submission challenge (#1985).\n *\n * `action` is a NAME (an open identifier), not a member of {@link SubmissionChallengeAction}, so an application can\n * protect its own anonymous create (a waitlist, a quote request) without the engine growing a member for it. The\n * engine's own operations pass their enum member; an application passes a member of its own enum. What keeps the name\n * honest is the grammar ({@link SUBMISSION_CHALLENGE_ACTION_PATTERN}), which the resource factory enforces.\n *\n * Rejected alternatives, recorded because each was on the table:\n * - A closed engine enum grown one member per protected operation. The engine cannot know an application's forms, so\n *   an application's own create could never be protected: exactly the gap this declaration closes.\n * - Deriving the action from the operation (`<resource>/<operation>`). It needs no authoring, but a resource or variant\n *   identifier may carry characters the vendor refuses (a hyphen), so the derivation would have to rewrite them, and two\n *   operations could then collide on one action with nothing saying so. A declared name is visible, reviewable and fixed.\n */\nexport interface ResourceOperationSubmissionChallenge {\n  /** The action a vendor token must have been minted for. Name one per form: sharing it lets a token move between them. */\n  readonly action: string;\n}\n\n/** The only hash the proof of work uses. Named so the wire value has one runtime source. */\nexport enum ProofOfWorkAlgorithm {\n  SHA_256 = 'SHA-256',\n}\n\n/** A proof-of-work challenge as the backend issues it. Every field is echoed back unchanged in the answer. */\nexport interface ProofOfWorkChallenge {\n  readonly algorithm: ProofOfWorkAlgorithm;\n  /** Random, and carries the expiry (`<hex>?expires=<unix seconds>`) so the signature covers it. */\n  readonly salt: string;\n  /** Hex SHA-256 of `salt + number` for the secret number. */\n  readonly challenge: string;\n  /** The largest number the search has to try. */\n  readonly maxNumber: number;\n  /** Hex HMAC-SHA-256 of `salt`, a newline and `challenge`, under the application's challenge key — so the salt and its expiry cannot be edited. */\n  readonly signature: string;\n}\n\n/** What a submission sends, in the `WildoHeaderKeys.SUBMISSION_CHALLENGE_RESPONSE` header, JSON-encoded. */\nexport type SubmissionChallengeResponse =\n  | {\n    readonly kind: SubmissionChallengeResponseKind.PROVIDER_TOKEN;\n    /** The captcha provider whose browser part minted the token (`recaptcha`). */\n    readonly providerRef: string;\n    readonly token: string;\n  }\n  | {\n    readonly kind: SubmissionChallengeResponseKind.PROOF_OF_WORK;\n    readonly challenge: ProofOfWorkChallenge;\n    /** The number the browser found. */\n    readonly number: number;\n  };\n\n/**\n * Where a browser asks for a proof-of-work challenge, under the API base path. The ONE source of this path: the\n * backend's route table (`MANUAL_CONTROLLER_ROUTES_URLS`) reads it from here, so a browser form can reach it without\n * pulling that whole table into its bundle.\n */\nexport const SUBMISSION_CHALLENGE_PROOF_OF_WORK_PATH = '/submission-challenges/proof-of-work';\n\n/**\n * The stable `error.code` of a refused public submission — what a client branches on (the engine hoists an error's\n * `context.code` to the top-level `error.code` of its response). A form answers either one again, with the proof of\n * work.\n */\nexport enum SubmissionChallengeRefusalCode {\n  /** No answer was sent, and the application protects this form. */\n  REQUIRED = 'SUBMISSION_CHALLENGE_REQUIRED',\n  /** An answer was sent and not accepted. */\n  REFUSED = 'SUBMISSION_CHALLENGE_REFUSED',\n}\n\n/** The largest encoded answer the backend reads; anything longer is refused before it is parsed. */\nexport const SUBMISSION_CHALLENGE_RESPONSE_MAX_LENGTH = 8192;\n\n/** Encode an answer for the request header. */\nexport function encodeSubmissionChallengeResponse(response: SubmissionChallengeResponse): string {\n  return JSON.stringify(response);\n}\n\nfunction toHex(buffer: ArrayBuffer): string {\n  return Array.from(new Uint8Array(buffer), (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/** Hex SHA-256 of `salt + number` — the one hash both the solver and the backend compute. */\nexport async function hashProofOfWorkCandidate(salt: string, number: number): Promise<string> {\n  const digest = await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(`${salt}${number}`));\n  return toHex(digest);\n}\n\n/**\n * Find the number a challenge was built from, or `undefined` when none up to `maxNumber` matches (a\n * challenge not issued by this scheme). Yields to the event loop every `yieldEvery` tries so a page stays\n * responsive while it searches.\n */\nexport async function solveProofOfWorkChallenge(\n  challenge: ProofOfWorkChallenge,\n  options: { readonly yieldEvery?: number; readonly signal?: AbortSignal } = {},\n): Promise<SubmissionChallengeResponse | undefined> {\n  const yieldEvery = options.yieldEvery ?? 1000;\n  for (let number = 0; number <= challenge.maxNumber; number += 1) {\n    if (options.signal?.aborted) return undefined;\n    if (await hashProofOfWorkCandidate(challenge.salt, number) === challenge.challenge) {\n      return { kind: SubmissionChallengeResponseKind.PROOF_OF_WORK, challenge, number };\n    }\n    if (number % yieldEvery === yieldEvery - 1) await new Promise((resolve) => setTimeout(resolve, 0));\n  }\n  return undefined;\n}\n"]}

package/dist/esm/systems-of-record/system-of-record-actions.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-actions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-actions.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAEhG,oHAAoH;AAEpH;;;;;;;;GAQG;AACH,oBAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;GAGG;AACH,eAAO,MAAM,0CAA0C,EAAE,QAAQ,CAAC,MAAM,CAAC,6BAA6B,EAAE,uBAAuB,CAAC,CAI9H,CAAC;AAEH,8BAA8B;AAC9B,oBAAY,0BAA0B;IACpC;;;;OAIG;IACH,MAAM,WAAW;IACjB,kFAAkF;IAClF,IAAI,SAAS;CACd;AAED,4EAA4E;AAC5E,oBAAY,sCAAsC;IAChD,kHAAkH;IAClH,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,UAAU,eAAe;IACzB,0GAA0G;IAC1G,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,uCAAuC;IACjD;;;OAGG;IACH,iBAAiB,sBAAsB;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;CAChD;AAED,eAAO,MAAM,yCAAyC;;IAGlD,2GAA2G;;;;IAK3G;;;OAGG;;4BAGL,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G,eAAO,MAAM,8BAA8B;;IAGvC,0EAA0E;;IAE1E;;;;OAIG;;;;;IAMH,qFAAqF;;;;IAKrF,gEAAgE;;6BAGlE,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,QAAwB,CAAC;AAC1E,eAAO,MAAM,8BAA8B,aAAsG,CAAC;AAalJ,2BAA2B;AAC3B,eAAO,MAAM,qCAAqC;;;;QA5C9C,0EAA0E;;QAE1E;;;;WAIG;;;;;QAMH,qFAAqF;;;;QAKrF,gEAAgE;;;IA8BlE;;;OAGG;;;;;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;OAGG;;IAEH;;;;OAIG;;IAEH,yHAAyH;;;QAlGvH,2GAA2G;;;;QAK3G;;;WAGG;;;IA4FL;;;;;;;;;;;;;;;;OAgBG;;kBAEH,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,yDAAyD;AACzD,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAE5G,+EAA+E;AAC/E,eAAO,MAAM,sCAAsC;;;;QA3G/C,0EAA0E;;QAE1E;;;;WAIG;;;;;QAMH,qFAAqF;;;;QAKrF,gEAAgE;;;IA8BlE;;;OAGG;;;;;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;OAGG;;IAEH;;;;OAIG;;IAEH,yHAAyH;;;QAlGvH,2GAA2G;;;;QAK3G;;;WAGG;;;IA4FL;;;;;;;;;;;;;;;;OAgBG;;mBAQgI,CAAC;AACtI,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,kEAAkE;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,EAAE,WAAW,CAAC,MAAM,CAGnE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gDAAgD,EAAE,WAAW,CAAC,MAAM,CAAgC,CAAC;AAElH;;;;;;;GAOG;AACH,wBAAgB,+CAA+C,CAAC,MAAM,EAAE;IACtE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,gCAAgC,GAAG,SAAS,CAAC;CAChE,GAAG,IAAI,CAkEP"}
+{"version":3,"file":"system-of-record-actions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-actions.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAEhG,oHAAoH;AAEpH;;;;;;;;GAQG;AACH,oBAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;GAGG;AACH,eAAO,MAAM,0CAA0C,EAAE,QAAQ,CAAC,MAAM,CAAC,6BAA6B,EAAE,uBAAuB,CAAC,CAI9H,CAAC;AAEH,8BAA8B;AAC9B,oBAAY,0BAA0B;IACpC;;;;OAIG;IACH,MAAM,WAAW;IACjB,kFAAkF;IAClF,IAAI,SAAS;CACd;AAED,4EAA4E;AAC5E,oBAAY,sCAAsC;IAChD,kHAAkH;IAClH,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,UAAU,eAAe;IACzB,0GAA0G;IAC1G,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,uCAAuC;IACjD;;;OAGG;IACH,iBAAiB,sBAAsB;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;CAChD;AAED,eAAO,MAAM,yCAAyC;;IAGlD,2GAA2G;;;;IAK3G;;;OAGG;;4BAGL,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G,eAAO,MAAM,8BAA8B;;IAGvC,0EAA0E;;IAE1E;;;;OAIG;;;;;IAMH,qFAAqF;;;;IAKrF,gEAAgE;;6BAGlE,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,QAAwB,CAAC;AAC1E,eAAO,MAAM,8BAA8B,aAAsG,CAAC;AAalJ,2BAA2B;AAC3B,eAAO,MAAM,qCAAqC;;;;QA5C9C,0EAA0E;;QAE1E;;;;WAIG;;;;;QAMH,qFAAqF;;;;QAKrF,gEAAgE;;;IA8BlE;;;OAGG;;;;;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;OAGG;;IAEH;;;;OAIG;;IAEH,yHAAyH;;;QAlGvH,2GAA2G;;;;QAK3G;;;WAGG;;;IA4FL;;;;;;;;;;;;;;;;OAgBG;;kBAEH,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,yDAAyD;AACzD,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAE5G,+EAA+E;AAC/E,eAAO,MAAM,sCAAsC;;;;QA3G/C,0EAA0E;;QAE1E;;;;WAIG;;;;;QAMH,qFAAqF;;;;QAKrF,gEAAgE;;;IA8BlE;;;OAGG;;;;;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;OAGG;;IAEH;;;;OAIG;;IAEH,yHAAyH;;;QAlGvH,2GAA2G;;;;QAK3G;;;WAGG;;;IA4FL;;;;;;;;;;;;;;;;OAgBG;;mBAQgI,CAAC;AACtI,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,kEAAkE;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,EAAE,WAAW,CAAC,MAAM,CAGnE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gDAAgD,EAAE,WAAW,CAAC,MAAM,CAAgC,CAAC;AAElH;;;;;;;GAOG;AACH,wBAAgB,+CAA+C,CAAC,MAAM,EAAE;IACtE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,gCAAgC,GAAG,SAAS,CAAC;CAChE,GAAG,IAAI,CAkEP"}

package/dist/esm/systems-of-record/system-of-record-actions.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-actions.shared.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-actions.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAEhG,oHAAoH;AAEpH;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BAqBX;AArBD,WAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,oEAAmC,CAAA;IACnC;;;;OAIG;IACH,0EAAyC,CAAA;IACzC;;;;OAIG;IACH,8EAA6C,CAAA;AAC/C,CAAC,EArBW,6BAA6B,KAA7B,6BAA6B,QAqBxC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAA6E,MAAM,CAAC,MAAM,CAAC;IAChJ,CAAC,6BAA6B,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC,YAAY;IACrF,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC,KAAK;IACjF,CAAC,6BAA6B,CAAC,oBAAoB,CAAC,EAAE,uBAAuB,CAAC,KAAK;CACpF,CAAC,CAAC;AAEH,8BAA8B;AAC9B,MAAM,CAAN,IAAY,0BASX;AATD,WAAY,0BAA0B;IACpC;;;;OAIG;IACH,+CAAiB,CAAA;IACjB,kFAAkF;IAClF,2CAAa,CAAA;AACf,CAAC,EATW,0BAA0B,KAA1B,0BAA0B,QASrC;AAED,4EAA4E;AAC5E,MAAM,CAAN,IAAY,sCAUX;AAVD,WAAY,sCAAsC;IAChD,kHAAkH;IAClH,iFAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAyB,CAAA;IACzB,0GAA0G;IAC1G,uDAAa,CAAA;AACf,CAAC,EAVW,sCAAsC,KAAtC,sCAAsC,QAUjD;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,uCAYX;AAZD,WAAY,uCAAuC;IACjD;;;OAGG;IACH,kFAAuC,CAAA;IACvC;;;;OAIG;IACH,0FAA+C,CAAA;AACjD,CAAC,EAZW,uCAAuC,KAAvC,uCAAuC,QAYlD;AAED,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,iBAAiB,CAAC;QAC1E,2GAA2G;QAC3G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,0EAA0E,CAAC;KAC9G,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,qBAAqB,CAAC;QAC9E;;;WAGG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACtC,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE;IAC1E,CAAC,CAAC,YAAY,CAAC;QACb,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,eAAe,CAAC;QAC/D,0EAA0E;QAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,oCAAoC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC7F;;;;WAIG;QACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC9G,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,iBAAiB,CAAC;KACjI,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,kBAAkB,CAAC;QAClE,qFAAqF;QACrF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qDAAqD,EAAE,2CAA2C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KAC7I,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,oBAAoB,CAAC;QACpE,gEAAgE;QAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,EAAE,0CAA0C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KAChH,CAAC;CACH,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,qBAAqB,CAAC;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oCAAoC,EAAE,mCAAmC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAElJ,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAqB,CAAC,EAC5F,EAAE,OAAO,EAAE,2DAA2D,EAAE,CACzE,CAAC;AACF,uEAAuE;AACvE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,EAC5H,EAAE,OAAO,EAAE,mCAAmC,EAAE,CACjD,CAAC;AAEF,2BAA2B;AAC3B,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAC1C,IAAI,EAAE,8BAA8B;IACpC;;;OAGG;IACH,KAAK,EAAE,oBAAoB;IAC3B;;;;OAIG;IACH,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE;IACjC;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClD,yHAAyH;IACzH,eAAe,EAAE,yCAAyC,CAAC,QAAQ,EAAE;IACrE;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAKH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC,8BAA8B,EAAE,qCAAqC,CAAC,CAAC;AAGtI,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAwB,IAAI,GAAG,CAAC;IAC/E,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY;IACtG,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa;CACzG,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElH;;;;;;;GAOG;AACH,MAAM,UAAU,+CAA+C,CAAC,MAG/D;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACpC,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;YACpC,MAAM,IAAI,KAAK,CAAC,WAAW,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC;QACF,IAAI,OAAO,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;YAClD,MAAM,CACJ,mHAAmH;kBACjH,iHAAiH;kBACjH,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,0CAA0C,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,mBAAmB,MAAM,CAAC,IAAI,CAAC,KAAK,oBAAoB,YAAY,6BAA6B,OAAO,GAAG,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,6BAA6B,CAAC,oBAAoB,EAAE,CAAC;YACpI,MAAM,CAAC,yFAAyF,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,6BAA6B,CAAC,kBAAkB,EAAE,CAAC;YAChI,MAAM,CAAC,wGAAwG,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAChG,MAAM,CACJ,wHAAwH;kBACtH,gEAAgE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,6BAA6B,CAAC,eAAe,EAAE,CAAC;YACxE,IAAI,oCAAoC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjE,MAAM,CACJ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,4FAA4F;sBAChH,iDAAiD,CACpD,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC3F,MAAM,CACJ,gHAAgH;sBAC9G,oFAAoF,CACvF,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,CAAC,MAAM,IAAI,gDAAgD,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpI,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,2FAA2F,CAAC,CAAC;YAC5H,CAAC;YACD,IACE,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,sCAAsC,CAAC,IAAI;mBACvE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAC7C,CAAC;gBACD,MAAM,CAAC,uGAAuG,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,IAAI,KAAK,uCAAuC,CAAC,qBAAqB,EAAE,CAAC;YACnG,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC;YACnD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;gBACxE,MAAM,CACJ,4BAA4B,SAAS,8EAA8E;sBACjH,iGAAiG,CACpG,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,6BAA6B,CAAC,eAAe;mBAClE,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;gBAChF,MAAM,CAAC,gGAAgG,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * Declared ACTIONS of a system of record (#1678) — the named vendor operations an application may run against the\n * ERP it reads, beside the row reads and row writes its read-through bindings already open.\n *\n * Posting an invoice (Odoo `account.move` `action_post`), confirming a sales order, an OData bound or unbound action:\n * none of them is a row write, and before this nothing declared one and nothing executed one. The only thing that\n * could run one was the systems-of-record registry's raw access hand-out, which returns an instance's credentials and\n * records nothing (#1738 withdrew it from every application-facing door).\n *\n * ## The decision these declarations implement (Paul, 2026-09-25, on #1677/#1678)\n *\n * One vendor may serve two roles through two SEPARATE lanes. The system-of-record lane declares named actions and runs\n * them under the INSTANCE's service identity, confined to the owner organization and to the member's partition, with\n * its own audit event. The same vendor may also be a classical provider with its own user or organization connections.\n * The two share a vendor identity for display and compliance, and never a credential or a runtime object (#1049 D10).\n * There is no Odoo provider package, and a provider operation can never name a system-of-record instance.\n *\n * ## WHERE an action is declared, and the placement that was rejected\n *\n * On a read-through BINDING (`httpApiBinding.actions`), both kinds:\n *\n * - a RECORD-targeted action on the binding of the entity it acts on, which supplies the key codec that decodes the\n *   target id and the resource whose read gates decide whether the caller may reach that record;\n * - a RECORD-FREE action on the binding of the entity whose model (Odoo) or service (OData) the call is made against.\n *\n * Rejected: record-free actions on the INSTANCE (`systemsOfRecord.<name>.actions` in `wildo.saas.config.ts`). Three\n * reasons, any one sufficient. An action declares a Zod INPUT schema, and the saas configuration is parsed by the CLI\n * and the companion as data, where a schema object is not representable. An action declares the ROLES admitted to it,\n * which are the same role keys the resource's operations declare in `shared-lib`, and a second home for them would\n * drift. And the HTTP exposure of an action is a custom operation on a read-through resource, which lives in the\n * resource configuration anyway; the instance declaration is not in scope there (it lives in the application root, not\n * in `shared-lib`). What the instance keeps is what only the instance knows: whether its data is partitioned, which is\n * why a record-free action's partition stance is checked at boot, where both are visible.\n *\n * ## What is checked where\n *\n * - HERE, at authoring (the resource factory, through `assertHttpApiBindingDialectCoherence`): the call shape against\n *   the binding's dialect, the target against the call shape, the refused vendor methods, the stance's placement.\n * - At BOOT (the resources registry, where the instance and the vendor facet are visible): the facet declares the call\n *   shape, a record-free action on a PARTITIONED instance states its partition stance, and action names are unique per\n *   instance.\n * - Per REQUEST (the system-of-record action executor): who may run it, on which record, and what it sends.\n */\nimport { z } from 'zod';\nimport { isZodObject } from '@wildo-ai/zod-decorators';\n\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\n\n/** @wildo_source:part:start saas.models.system-of-record-actions facet:layer:shared facet:audience:app-developer */\n\n/**\n * The wire SHAPE of a vendor action — how the engine calls it. Declared by the VENDOR FACET (which shapes its product\n * supports, `actionCallShapes`) and chosen per action by its declaration.\n *\n * REST_JSON has no member: an arbitrary REST surface has no action convention to compile against, and a declared method\n * plus path template is a design of its own. A REST_JSON binding declaring an action is refused by name. (REST_JSON\n * ROW writes are declared per verb since #1728 — `operations.create` / `update` / `delete` — because a row write has a\n * fixed meaning a method and a path can carry; an action's meaning is the vendor's, and has no such shape.)\n */\nexport enum SystemOfRecordActionCallShape {\n  /**\n   * Odoo's `object.execute_kw(db, uid, key, model, method, positional, keyword)` — any public model method, the\n   * credential inside the RPC arguments. A record-targeted call passes the record ids as its first positional\n   * argument, which is how Odoo addresses a recordset method such as `action_post`.\n   *\n   * spec-cite: Odoo 18.0 developer documentation, External API — \"Calling methods\" (the execute_kw argument layout).\n   */\n  ODOO_EXECUTE_KW = 'odoo-execute-kw',\n  /**\n   * An OData v4 BOUND action: `POST <EntitySet>(<key>)/<Namespace>.<Action>`, parameters in the JSON body.\n   *\n   * spec-cite: OData Version 4.01 Part 1: Protocol §11.5.5 (Actions) and §11.5.5.1 (Invoking an Action).\n   */\n  ODATA_BOUND_ACTION = 'odata-bound-action',\n  /**\n   * An OData v4 UNBOUND action reached through its action import: `POST /<ActionImport>`, parameters in the JSON body.\n   *\n   * spec-cite: OData Version 4.01 Part 1: Protocol §11.5.5.1 (Invoking an Action).\n   */\n  ODATA_UNBOUND_ACTION = 'odata-unbound-action',\n}\n\n/**\n * The dialect each call shape is spoken over. Total over {@link SystemOfRecordActionCallShape}, so a new shape is a\n * compile error here until somebody says which dialect it belongs to.\n */\nexport const SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT: Readonly<Record<SystemOfRecordActionCallShape, HttpApiTransportDialect>> = Object.freeze({\n  [SystemOfRecordActionCallShape.ODOO_EXECUTE_KW]: HttpApiTransportDialect.ODOO_JSONRPC,\n  [SystemOfRecordActionCallShape.ODATA_BOUND_ACTION]: HttpApiTransportDialect.ODATA,\n  [SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION]: HttpApiTransportDialect.ODATA,\n});\n\n/** What an action acts ON. */\nexport enum SystemOfRecordActionTarget {\n  /**\n   * ONE record of the binding's entity, addressed by its synthesized id. The record is READ FIRST through the binding's\n   * read gates (owner organization, partition), so a caller can act only on a record it could see — and a record\n   * outside its partition answers as absent, exactly as a read answers.\n   */\n  RECORD = 'record',\n  /** No record: a model-level Odoo method (`create`) or an OData unbound action. */\n  NONE = 'none',\n}\n\n/** Where an Odoo action's validated input goes in the `execute_kw` call. */\nexport enum SystemOfRecordOdooActionInputPlacement {\n  /** The input object is the keyword-argument dict. The default: most recordset methods take options by keyword. */\n  KEYWORD_ARGUMENTS = 'keyword-arguments',\n  /**\n   * The input object is the (next) POSITIONAL argument — after the id list on a record-targeted action, first on a\n   * record-free one. `create(vals)` is the canonical case.\n   */\n  POSITIONAL = 'positional',\n  /** The method takes nothing beyond its records (`action_post`). The declared input must then be empty. */\n  NONE = 'none',\n}\n\n/**\n * How a RECORD-FREE action relates to the instance's partitions (#1058), required at boot when the instance is\n * partitioned. A record-targeted action needs none: the record it reads first carries its partition.\n */\nexport enum SystemOfRecordActionPartitionStanceKind {\n  /**\n   * The action touches no partitioned data — a lookup of a vendor setting, an action whose effect no partition owns.\n   * The declaration must say WHY in `reason`, because a claim nothing checks has to be one a reviewer can read.\n   */\n  PARTITION_NEUTRAL = 'partition-neutral',\n  /**\n   * The action CARRIES the partition as one of its inputs, and the engine derives it from the caller's organization\n   * unit exactly as a read-through create is placed (#1679): a member of one unit lands in its partition, a member of\n   * several names the unit, and a caller may never supply the partition value itself.\n   */\n  MEMBER_UNIT_PARTITION = 'member-unit-partition',\n}\n\nexport const SystemOfRecordActionPartitionStanceSchema = z.discriminatedUnion('kind', [\n  z.strictObject({\n    kind: z.literal(SystemOfRecordActionPartitionStanceKind.PARTITION_NEUTRAL),\n    /** Why no partition is reached. Read by a reviewer; nothing can verify it, which is why it is required. */\n    reason: z.string().trim().min(20, 'Say why this action reaches no partitioned data — a reviewer reads this.'),\n  }),\n  z.strictObject({\n    kind: z.literal(SystemOfRecordActionPartitionStanceKind.MEMBER_UNIT_PARTITION),\n    /**\n     * The REMOTE parameter the placed partition value is written into (`company_id`): a key of the Odoo keyword\n     * arguments or of the positional input object, or a member of the OData body. The caller's input may not carry it.\n     */\n    parameter: z.string().min(1).max(120),\n  }),\n]);\nexport type SystemOfRecordActionPartitionStance = z.infer<typeof SystemOfRecordActionPartitionStanceSchema>;\n\nexport const SystemOfRecordActionCallSchema = z.discriminatedUnion('shape', [\n  z.strictObject({\n    shape: z.literal(SystemOfRecordActionCallShape.ODOO_EXECUTE_KW),\n    /** The model method, in Odoo's own spelling (`action_post`, `create`). */\n    method: z.string().regex(/^[a-z_][a-z0-9_]*$/, 'An Odoo method name is snake_case.').max(120),\n    /**\n     * The model the call is made on, for a RECORD-FREE action only. A record-targeted action acts on the binding's own\n     * model — the one its key codec and read gates describe — so naming another would decode the id against the wrong\n     * entity. Absent means the binding's `entityRef`.\n     */\n    model: z.string().regex(/^[a-z_][a-z0-9_.]*$/, 'An Odoo model name is dotted snake_case.').max(120).optional(),\n    inputPlacement: z.enum(SystemOfRecordOdooActionInputPlacement).default(SystemOfRecordOdooActionInputPlacement.KEYWORD_ARGUMENTS),\n  }),\n  z.strictObject({\n    shape: z.literal(SystemOfRecordActionCallShape.ODATA_BOUND_ACTION),\n    /** The namespace-qualified action name (`Microsoft.Dynamics.CRM.WinOpportunity`). */\n    qualifiedName: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*(\\.[A-Za-z_][A-Za-z0-9_]*)+$/, 'A bound action is named Namespace.Action.').max(200),\n  }),\n  z.strictObject({\n    shape: z.literal(SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION),\n    /** The action import's name, as the service root exposes it. */\n    actionImport: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'An action import is a simple identifier.').max(200),\n  }),\n]);\nexport type SystemOfRecordActionCall = z.infer<typeof SystemOfRecordActionCallSchema>;\n\n/**\n * The application's NAME for an action — lowerCamelCase, and distinct from the vendor's method name on purpose: the\n * name is what code, roles and audit rows speak (`postInvoice`), the call is what the vendor understands\n * (`account.move` `action_post`). Unique per INSTANCE across every binding, checked at boot, because callers address an\n * action by `(system, action)`.\n */\nexport const SYSTEM_OF_RECORD_ACTION_NAME_PATTERN = /^[a-z][a-zA-Z0-9]*$/;\nexport const SystemOfRecordActionNameSchema = z.string().regex(SYSTEM_OF_RECORD_ACTION_NAME_PATTERN, 'An action name is lowerCamelCase.').max(64);\n\n/** A Zod OBJECT schema carried as a value — an action's input contract. */\nconst zodObjectSchemaValue = z.custom<z.ZodObject<z.ZodRawShape>>(\n  (value) => value !== null && typeof value === 'object' && isZodObject(value as z.ZodTypeAny),\n  { message: 'An action input is a Zod object schema (z.object({...})).' },\n);\n/** Any Zod schema carried as a value — an action's output contract. */\nconst zodSchemaValue = z.custom<z.ZodTypeAny>(\n  (value) => value !== null && typeof value === 'object' && typeof (value as { safeParse?: unknown }).safeParse === 'function',\n  { message: 'An action output is a Zod schema.' },\n);\n\n/** ONE declared action. */\nexport const SystemOfRecordActionDeclarationSchema = z.strictObject({\n  target: z.enum(SystemOfRecordActionTarget),\n  call: SystemOfRecordActionCallSchema,\n  /**\n   * The input contract, validated BEFORE anything is sent. Strict parsing is the caller's contract: a key the schema\n   * does not declare is refused rather than forwarded, so nothing reaches the vendor that the author did not name.\n   */\n  input: zodObjectSchemaValue,\n  /**\n   * The result contract. When declared, the vendor's answer is parsed through it and only the parsed value is returned;\n   * an answer it rejects after the vendor APPLIED the action is reported as an unknown outcome, never as \"not done\".\n   * Absent means the result is returned as the vendor sent it.\n   */\n  output: zodSchemaValue.optional(),\n  /**\n   * Whether the action CHANGES remote state. A writing action must carry an Idempotency-Key from EVERY caller, because a\n   * remote change cannot be rolled back, and its interrupted attempts are reported as an unknown outcome rather than as\n   * a failure. A non-writing action (a vendor computation that changes nothing) needs neither.\n   */\n  writes: z.boolean(),\n  /**\n   * Whether the VENDOR makes a repeated call harmless, so the transport may re-send it after a timeout or a 5xx. False\n   * unless the vendor offers an idempotency mechanism for this call; Odoo offers none, so no Odoo action is retry-safe.\n   * A writing action is never re-sent without an Idempotency-Key, whatever this says.\n   */\n  retrySafe: z.boolean().default(false),\n  /**\n   * The role keys admitted to run it, held in the OWNER organization (an organization role) or at application scope. A\n   * role held only inside an organization UNIT admits the action on that unit's partition alone.\n   */\n  roles: z.array(z.string().min(1)).min(1),\n  /**\n   * Whether a context with NO user and no machine principal — the engine's own batch, cron and queue work, a webhook, an\n   * autonomous agent with nobody behind it — may run it. Such a context then acts ORGANIZATION-WIDE on the owner\n   * organization's behalf, which is exactly why it is off unless declared.\n   */\n  admitsSystemInitiation: z.boolean().default(false),\n  /** A record-free action's relation to the instance's partitions; see {@link SystemOfRecordActionPartitionStanceKind}. */\n  partitionStance: SystemOfRecordActionPartitionStanceSchema.optional(),\n  /**\n   * The resource operation that is this action's HTTP door, when it has one: a custom operation of the SAME resource\n   * whose implementation hands the request to the system-of-record action executor. Absent means the action is reached\n   * from code only.\n   *\n   * Naming the door HERE is what lets the resource factory tell an action from a row write. Without it, the only thing the\n   * factory can see is the verb the operation borrows, and both available borrows were wrong (#1678 review, F1):\n   *\n   * - borrowing READ made a state-changing route a GET, and its required Idempotency-Key was refused at boot, because a\n   *   read-shaped operation claims its repeat changes nothing — Wonder Todos' backend could not start;\n   * - borrowing UPDATE read as a ROW write, so the factory demanded `writableVerbs: [update]` — a door onto the bound\n   *   entity's rows that nobody asked for.\n   *\n   * A named door is exempt from the row-write rules and held to the action's own instead: a WRITING action's door borrows\n   * a single-row mutation verb (so its route is not a GET and a retry is keyed), requires the key on every variant, and\n   * runs INLINE. See `assertHttpApiWriteDeclarationCoherence`.\n   */\n  operation: z.string().min(1).optional(),\n});\nexport type SystemOfRecordActionDeclaration = z.infer<typeof SystemOfRecordActionDeclarationSchema>;\n/** What an author writes — defaulted fields optional. */\nexport type SystemOfRecordActionDeclarationAuthored = z.input<typeof SystemOfRecordActionDeclarationSchema>;\n\n/** Every action a binding declares, keyed by the application's action name. */\nexport const SystemOfRecordActionDeclarationsSchema = z.record(SystemOfRecordActionNameSchema, SystemOfRecordActionDeclarationSchema);\nexport type SystemOfRecordActionDeclarations = z.infer<typeof SystemOfRecordActionDeclarationsSchema>;\n\n/** @wildo_source:part:end saas.models.system-of-record-actions */\n\n/**\n * Odoo methods that READ, refused as actions.\n *\n * An action's answer is returned to its caller, and it is not confined the way the read lane confines rows: a\n * `search_read` declared as an action would hand a unit-confined member every company's rows. Reads go through the\n * read-through resource, whose pushdown and key-addressed admission are the confinement. A deny-list cannot be\n * complete — Odoo lets any public method be called — so an author reviews what a declared method returns; these are the\n * methods whose whole purpose is to return rows.\n */\nexport const ODOO_READ_METHODS_REFUSED_AS_ACTIONS: ReadonlySet<string> = new Set([\n  'read', 'search', 'search_read', 'search_count', 'read_group', 'name_search', 'name_get', 'fields_get',\n  'web_read', 'web_search_read', 'web_read_group', 'export_data', 'get_views', 'load_views', 'default_get',\n]);\n\n/**\n * Odoo methods that are ROW WRITES of the binding's own entity, refused as record-targeted actions: `write` and\n * `unlink` on the bound model are exactly what `writableVerbs` opens (#1679), with its payload rules and its field-level\n * trail. Declaring them as actions would open a second door onto the same change, one that skips both.\n */\nexport const ODOO_ROW_WRITE_METHODS_REFUSED_AS_RECORD_ACTIONS: ReadonlySet<string> = new Set(['write', 'unlink']);\n\n/**\n * Refuse every action declaration the engine could not honour, at AUTHORING (#1678). Throws a plain `Error` naming the\n * action and the fix; the resource factory wraps it with the resource identifier.\n *\n * What is NOT decidable here, and why: whether the vendor's facet supports the call shape and whether the instance is\n * partitioned both need the saas configuration and the facet map, which `shared-lib` does not see. Those are the boot\n * checks (`collectSystemOfRecordActionDeclarationViolations` in the backend).\n */\nexport function assertSystemOfRecordActionDeclarationsCoherence(params: {\n  readonly dialect: HttpApiTransportDialect;\n  readonly actions: SystemOfRecordActionDeclarations | undefined;\n}): void {\n  const { dialect, actions } = params;\n  for (const [actionName, action] of Object.entries(actions ?? {})) {\n    const refuse = (why: string): never => {\n      throw new Error(`actions.${actionName}: ${why}`);\n    };\n    if (dialect === HttpApiTransportDialect.REST_JSON) {\n      refuse(\n        'a REST_JSON binding cannot declare actions: an arbitrary REST surface has no action convention for the engine to '\n        + 'compile (its row writes are declared per verb in `operations`; an action has no such fixed shape). Declare the '\n        + 'action on an Odoo or OData binding, or remove it.',\n      );\n    }\n    const shapeDialect = SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT[action.call.shape];\n    if (shapeDialect !== dialect) {\n      refuse(`the call shape '${action.call.shape}' is spoken over ${shapeDialect}, and this binding speaks ${dialect}.`);\n    }\n    if (action.target === SystemOfRecordActionTarget.RECORD && action.call.shape === SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION) {\n      refuse('an UNBOUND OData action acts on no record; declare target: none, or use a bound action.');\n    }\n    if (action.target === SystemOfRecordActionTarget.NONE && action.call.shape === SystemOfRecordActionCallShape.ODATA_BOUND_ACTION) {\n      refuse('a BOUND OData action is invoked on a record; declare target: record, or use the unbound action import.');\n    }\n    if (action.target === SystemOfRecordActionTarget.RECORD && action.partitionStance !== undefined) {\n      refuse(\n        'a record-targeted action takes its partition from the record it reads first, so a partition stance would be a second, '\n        + 'unchecked answer to the same question. Remove partitionStance.',\n      );\n    }\n    if (action.call.shape === SystemOfRecordActionCallShape.ODOO_EXECUTE_KW) {\n      if (ODOO_READ_METHODS_REFUSED_AS_ACTIONS.has(action.call.method)) {\n        refuse(\n          `'${action.call.method}' reads rows, and an action's answer is not confined the way the read lane confines rows. `\n          + 'Read through the read-through resource instead.',\n        );\n      }\n      if (action.target === SystemOfRecordActionTarget.RECORD && action.call.model !== undefined) {\n        refuse(\n          'a record-targeted action acts on the binding\\'s own model, whose key codec and read gates address the record; '\n          + 'declare the action on the binding of the model it acts on, or make it record-free.',\n        );\n      }\n      if (action.target === SystemOfRecordActionTarget.RECORD && ODOO_ROW_WRITE_METHODS_REFUSED_AS_RECORD_ACTIONS.has(action.call.method)) {\n        refuse(`'${action.call.method}' is a row write of this binding's entity; open it through writableVerbs instead (#1679).`);\n      }\n      if (\n        action.call.inputPlacement === SystemOfRecordOdooActionInputPlacement.NONE\n        && Object.keys(action.input.shape).length > 0\n      ) {\n        refuse('inputPlacement \\'none\\' sends no input, so the declared input must be an empty object (z.object({})).');\n      }\n    }\n    if (action.partitionStance?.kind === SystemOfRecordActionPartitionStanceKind.MEMBER_UNIT_PARTITION) {\n      const parameter = action.partitionStance.parameter;\n      if (Object.prototype.hasOwnProperty.call(action.input.shape, parameter)) {\n        refuse(\n          `the partition parameter '${parameter}' is placed by the engine from the caller's organization unit, so the input `\n          + 'may not declare it — a caller who could send it would choose which company the action lands in.',\n        );\n      }\n      if (action.call.shape === SystemOfRecordActionCallShape.ODOO_EXECUTE_KW\n        && action.call.inputPlacement === SystemOfRecordOdooActionInputPlacement.NONE) {\n        refuse('a member-unit partition is written into the input, and inputPlacement \\'none\\' sends no input.');\n      }\n    }\n  }\n}\n"]}
+{"version":3,"file":"system-of-record-actions.shared.schemas.js","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-actions.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAEhG,oHAAoH;AAEpH;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,6BAqBX;AArBD,WAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,oEAAmC,CAAA;IACnC;;;;OAIG;IACH,0EAAyC,CAAA;IACzC;;;;OAIG;IACH,8EAA6C,CAAA;AAC/C,CAAC,EArBW,6BAA6B,KAA7B,6BAA6B,QAqBxC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAA6E,MAAM,CAAC,MAAM,CAAC;IAChJ,CAAC,6BAA6B,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC,YAAY;IACrF,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC,KAAK;IACjF,CAAC,6BAA6B,CAAC,oBAAoB,CAAC,EAAE,uBAAuB,CAAC,KAAK;CACpF,CAAC,CAAC;AAEH,8BAA8B;AAC9B,MAAM,CAAN,IAAY,0BASX;AATD,WAAY,0BAA0B;IACpC;;;;OAIG;IACH,+CAAiB,CAAA;IACjB,kFAAkF;IAClF,2CAAa,CAAA;AACf,CAAC,EATW,0BAA0B,KAA1B,0BAA0B,QASrC;AAED,4EAA4E;AAC5E,MAAM,CAAN,IAAY,sCAUX;AAVD,WAAY,sCAAsC;IAChD,kHAAkH;IAClH,iFAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAyB,CAAA;IACzB,0GAA0G;IAC1G,uDAAa,CAAA;AACf,CAAC,EAVW,sCAAsC,KAAtC,sCAAsC,QAUjD;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,uCAYX;AAZD,WAAY,uCAAuC;IACjD;;;OAGG;IACH,kFAAuC,CAAA;IACvC;;;;OAIG;IACH,0FAA+C,CAAA;AACjD,CAAC,EAZW,uCAAuC,KAAvC,uCAAuC,QAYlD;AAED,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,iBAAiB,CAAC;QAC1E,2GAA2G;QAC3G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,0EAA0E,CAAC;KAC9G,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,qBAAqB,CAAC;QAC9E;;;WAGG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACtC,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE;IAC1E,CAAC,CAAC,YAAY,CAAC;QACb,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,eAAe,CAAC;QAC/D,0EAA0E;QAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,oCAAoC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC7F;;;;WAIG;QACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC9G,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,iBAAiB,CAAC;KACjI,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,kBAAkB,CAAC;QAClE,qFAAqF;QACrF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qDAAqD,EAAE,2CAA2C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KAC7I,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,oBAAoB,CAAC;QACpE,gEAAgE;QAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,EAAE,0CAA0C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KAChH,CAAC;CACH,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,qBAAqB,CAAC;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oCAAoC,EAAE,mCAAmC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAElJ,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAqB,CAAC,EAC5F,EAAE,OAAO,EAAE,2DAA2D,EAAE,CACzE,CAAC;AACF,uEAAuE;AACvE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,EAC5H,EAAE,OAAO,EAAE,mCAAmC,EAAE,CACjD,CAAC;AAEF,2BAA2B;AAC3B,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAC1C,IAAI,EAAE,8BAA8B;IACpC;;;OAGG;IACH,KAAK,EAAE,oBAAoB;IAC3B;;;;OAIG;IACH,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE;IACjC;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClD,yHAAyH;IACzH,eAAe,EAAE,yCAAyC,CAAC,QAAQ,EAAE;IACrE;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAKH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC,8BAA8B,EAAE,qCAAqC,CAAC,CAAC;AAGtI,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAwB,IAAI,GAAG,CAAC;IAC/E,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY;IACtG,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa;CACzG,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElH;;;;;;;GAOG;AACH,MAAM,UAAU,+CAA+C,CAAC,MAG/D;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACpC,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;YACpC,MAAM,IAAI,KAAK,CAAC,WAAW,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC;QACF,IAAI,OAAO,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;YAClD,MAAM,CACJ,mHAAmH;kBACjH,iHAAiH;kBACjH,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,0CAA0C,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,mBAAmB,MAAM,CAAC,IAAI,CAAC,KAAK,oBAAoB,YAAY,6BAA6B,OAAO,GAAG,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,6BAA6B,CAAC,oBAAoB,EAAE,CAAC;YACpI,MAAM,CAAC,yFAAyF,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,6BAA6B,CAAC,kBAAkB,EAAE,CAAC;YAChI,MAAM,CAAC,wGAAwG,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAChG,MAAM,CACJ,wHAAwH;kBACtH,gEAAgE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,6BAA6B,CAAC,eAAe,EAAE,CAAC;YACxE,IAAI,oCAAoC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjE,MAAM,CACJ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,4FAA4F;sBAChH,iDAAiD,CACpD,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC3F,MAAM,CACJ,gHAAgH;sBAC9G,oFAAoF,CACvF,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,CAAC,MAAM,IAAI,gDAAgD,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpI,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,2FAA2F,CAAC,CAAC;YAC5H,CAAC;YACD,IACE,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,sCAAsC,CAAC,IAAI;mBACvE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAC7C,CAAC;gBACD,MAAM,CAAC,uGAAuG,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,IAAI,KAAK,uCAAuC,CAAC,qBAAqB,EAAE,CAAC;YACnG,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC;YACnD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;gBACxE,MAAM,CACJ,4BAA4B,SAAS,8EAA8E;sBACjH,iGAAiG,CACpG,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,6BAA6B,CAAC,eAAe;mBAClE,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,sCAAsC,CAAC,IAAI,EAAE,CAAC;gBAChF,MAAM,CAAC,gGAAgG,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * Declared ACTIONS of a system of record (#1678) — the named vendor operations an application may run against the\n * ERP it reads, beside the row reads and row writes its read-through bindings already open.\n *\n * Posting an invoice (Odoo `account.move` `action_post`), confirming a sales order, an OData bound or unbound action:\n * none of them is a row write, and before this nothing declared one and nothing executed one. The only thing that\n * could run one was the systems-of-record registry's raw access hand-out, which returns an instance's credentials and\n * records nothing (#1738 withdrew it from every application-facing door).\n *\n * ## The decision these declarations implement (Paul, 2026-09-25, on #1677/#1678)\n *\n * One vendor may serve two roles through two SEPARATE lanes. The system-of-record lane declares named actions and runs\n * them under the INSTANCE's service identity, confined to the owner organization and to the member's partition, with\n * its own audit event. The same vendor may also be a classical provider with its own user or organization connections.\n * The two share a vendor identity for display and compliance, and never a credential or a runtime object (#1049 D10).\n * There is no Odoo provider package, and a provider operation can never name a system-of-record instance.\n *\n * ## WHERE an action is declared, and the placement that was rejected\n *\n * On a read-through BINDING (`httpApiBinding.actions`), both kinds:\n *\n * - a RECORD-targeted action on the binding of the entity it acts on, which supplies the key codec that decodes the\n *   target id and the resource whose read gates decide whether the caller may reach that record;\n * - a RECORD-FREE action on the binding of the entity whose model (Odoo) or service (OData) the call is made against.\n *\n * Rejected: record-free actions on the INSTANCE (`systemsOfRecord.<name>.actions` in `wildo.saas.config.ts`). Three\n * reasons, any one sufficient. An action declares a Zod INPUT schema, and the saas configuration is parsed by the CLI\n * and the companion as data, where a schema object is not representable. An action declares the ROLES admitted to it,\n * which are the same role keys the resource's operations declare in `shared-lib`, and a second home for them would\n * drift. And the HTTP exposure of an action is a custom operation on a read-through resource, which lives in the\n * resource configuration anyway; the instance declaration is not in scope there (it lives in the application root, not\n * in `shared-lib`). What the instance keeps is what only the instance knows: whether its data is partitioned, which is\n * why a record-free action's partition stance is checked at boot, where both are visible.\n *\n * ## What is checked where\n *\n * - HERE, at authoring (the resource factory, through `assertHttpApiBindingDialectCoherence`): the call shape against\n *   the binding's dialect, the target against the call shape, the refused vendor methods, the stance's placement.\n * - At BOOT (the resources registry, where the instance and the vendor facet are visible): the facet declares the call\n *   shape, a record-free action on a PARTITIONED instance states its partition stance, and action names are unique per\n *   instance.\n * - Per REQUEST (the system-of-record action executor): who may run it, on which record, and what it sends.\n */\nimport { z } from 'zod';\nimport { isZodObject } from '@wildo-ai/zod-decorators';\n\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\n\n/** @wildo_source:part:start saas.models.system-of-record-actions facet:layer:shared facet:audience:app-developer */\n\n/**\n * The wire SHAPE of a vendor action — how the engine calls it. Declared by the VENDOR FACET (which shapes its product\n * supports, `actionCallShapes`) and chosen per action by its declaration.\n *\n * REST_JSON has no member: an arbitrary REST surface has no action convention to compile against, and a declared method\n * plus path template is a design of its own. A REST_JSON binding declaring an action is refused by name. (REST_JSON\n * ROW writes are declared per verb since #1728 — `operations.create` / `update` / `delete` — because a row write has a\n * fixed meaning a method and a path can carry; an action's meaning is the vendor's, and has no such shape.)\n */\nexport enum SystemOfRecordActionCallShape {\n  /**\n   * Odoo's `object.execute_kw(db, uid, key, model, method, positional, keyword)` — any public model method, the\n   * credential inside the RPC arguments. A record-targeted call passes the record ids as its first positional\n   * argument, which is how Odoo addresses a recordset method such as `action_post`.\n   *\n   * spec-cite: Odoo 18.0 developer documentation, External API — \"Calling methods\" (the execute_kw argument layout).\n   */\n  ODOO_EXECUTE_KW = 'odoo-execute-kw',\n  /**\n   * An OData v4 BOUND action: `POST <EntitySet>(<key>)/<Namespace>.<Action>`, parameters in the JSON body.\n   *\n   * spec-cite: OData Version 4.01 Part 1: Protocol §11.5.5 (Actions) and §11.5.5.1 (Invoking an Action).\n   */\n  ODATA_BOUND_ACTION = 'odata-bound-action',\n  /**\n   * An OData v4 UNBOUND action reached through its action import: `POST /<ActionImport>`, parameters in the JSON body.\n   *\n   * spec-cite: OData Version 4.01 Part 1: Protocol §11.5.5.1 (Invoking an Action).\n   */\n  ODATA_UNBOUND_ACTION = 'odata-unbound-action',\n}\n\n/**\n * The dialect each call shape is spoken over. Total over {@link SystemOfRecordActionCallShape}, so a new shape is a\n * compile error here until somebody says which dialect it belongs to.\n */\nexport const SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT: Readonly<Record<SystemOfRecordActionCallShape, HttpApiTransportDialect>> = Object.freeze({\n  [SystemOfRecordActionCallShape.ODOO_EXECUTE_KW]: HttpApiTransportDialect.ODOO_JSONRPC,\n  [SystemOfRecordActionCallShape.ODATA_BOUND_ACTION]: HttpApiTransportDialect.ODATA,\n  [SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION]: HttpApiTransportDialect.ODATA,\n});\n\n/** What an action acts ON. */\nexport enum SystemOfRecordActionTarget {\n  /**\n   * ONE record of the binding's entity, addressed by its synthesized id. The record is READ FIRST through the binding's\n   * read gates (owner organization, partition), so a caller can act only on a record it could see — and a record\n   * outside its partition answers as absent, exactly as a read answers.\n   */\n  RECORD = 'record',\n  /** No record: a model-level Odoo method (`create`) or an OData unbound action. */\n  NONE = 'none',\n}\n\n/** Where an Odoo action's validated input goes in the `execute_kw` call. */\nexport enum SystemOfRecordOdooActionInputPlacement {\n  /** The input object is the keyword-argument dict. The default: most recordset methods take options by keyword. */\n  KEYWORD_ARGUMENTS = 'keyword-arguments',\n  /**\n   * The input object is the (next) POSITIONAL argument — after the id list on a record-targeted action, first on a\n   * record-free one. `create(vals)` is the canonical case.\n   */\n  POSITIONAL = 'positional',\n  /** The method takes nothing beyond its records (`action_post`). The declared input must then be empty. */\n  NONE = 'none',\n}\n\n/**\n * How a RECORD-FREE action relates to the instance's partitions (#1058), required at boot when the instance is\n * partitioned. A record-targeted action needs none: the record it reads first carries its partition.\n */\nexport enum SystemOfRecordActionPartitionStanceKind {\n  /**\n   * The action touches no partitioned data — a lookup of a vendor setting, an action whose effect no partition owns.\n   * The declaration must say WHY in `reason`, because a claim nothing checks has to be one a reviewer can read.\n   */\n  PARTITION_NEUTRAL = 'partition-neutral',\n  /**\n   * The action CARRIES the partition as one of its inputs, and the engine derives it from the caller's organization\n   * unit exactly as a read-through create is placed (#1679): a member of one unit lands in its partition, a member of\n   * several names the unit, and a caller may never supply the partition value itself.\n   */\n  MEMBER_UNIT_PARTITION = 'member-unit-partition',\n}\n\nexport const SystemOfRecordActionPartitionStanceSchema = z.discriminatedUnion('kind', [\n  z.strictObject({\n    kind: z.literal(SystemOfRecordActionPartitionStanceKind.PARTITION_NEUTRAL),\n    /** Why no partition is reached. Read by a reviewer; nothing can verify it, which is why it is required. */\n    reason: z.string().trim().min(20, 'Say why this action reaches no partitioned data — a reviewer reads this.'),\n  }),\n  z.strictObject({\n    kind: z.literal(SystemOfRecordActionPartitionStanceKind.MEMBER_UNIT_PARTITION),\n    /**\n     * The REMOTE parameter the placed partition value is written into (`company_id`): a key of the Odoo keyword\n     * arguments or of the positional input object, or a member of the OData body. The caller's input may not carry it.\n     */\n    parameter: z.string().min(1).max(120),\n  }),\n]);\nexport type SystemOfRecordActionPartitionStance = z.infer<typeof SystemOfRecordActionPartitionStanceSchema>;\n\nexport const SystemOfRecordActionCallSchema = z.discriminatedUnion('shape', [\n  z.strictObject({\n    shape: z.literal(SystemOfRecordActionCallShape.ODOO_EXECUTE_KW),\n    /** The model method, in Odoo's own spelling (`action_post`, `create`). */\n    method: z.string().regex(/^[a-z_][a-z0-9_]*$/, 'An Odoo method name is snake_case.').max(120),\n    /**\n     * The model the call is made on, for a RECORD-FREE action only. A record-targeted action acts on the binding's own\n     * model — the one its key codec and read gates describe — so naming another would decode the id against the wrong\n     * entity. Absent means the binding's `entityRef`.\n     */\n    model: z.string().regex(/^[a-z_][a-z0-9_.]*$/, 'An Odoo model name is dotted snake_case.').max(120).optional(),\n    inputPlacement: z.enum(SystemOfRecordOdooActionInputPlacement).default(SystemOfRecordOdooActionInputPlacement.KEYWORD_ARGUMENTS),\n  }),\n  z.strictObject({\n    shape: z.literal(SystemOfRecordActionCallShape.ODATA_BOUND_ACTION),\n    /** The namespace-qualified action name (`Microsoft.Dynamics.CRM.WinOpportunity`). */\n    qualifiedName: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*(\\.[A-Za-z_][A-Za-z0-9_]*)+$/, 'A bound action is named Namespace.Action.').max(200),\n  }),\n  z.strictObject({\n    shape: z.literal(SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION),\n    /** The action import's name, as the service root exposes it. */\n    actionImport: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'An action import is a simple identifier.').max(200),\n  }),\n]);\nexport type SystemOfRecordActionCall = z.infer<typeof SystemOfRecordActionCallSchema>;\n\n/**\n * The application's NAME for an action — lowerCamelCase, and distinct from the vendor's method name on purpose: the\n * name is what code, roles and audit rows speak (`postInvoice`), the call is what the vendor understands\n * (`account.move` `action_post`). Unique per INSTANCE across every binding, checked at boot, because callers address an\n * action by `(system, action)`.\n */\nexport const SYSTEM_OF_RECORD_ACTION_NAME_PATTERN = /^[a-z][a-zA-Z0-9]*$/;\nexport const SystemOfRecordActionNameSchema = z.string().regex(SYSTEM_OF_RECORD_ACTION_NAME_PATTERN, 'An action name is lowerCamelCase.').max(64);\n\n/** A Zod OBJECT schema carried as a value — an action's input contract. */\nconst zodObjectSchemaValue = z.custom<z.ZodObject<z.ZodRawShape>>(\n  (value) => value !== null && typeof value === 'object' && isZodObject(value as z.ZodTypeAny),\n  { message: 'An action input is a Zod object schema (z.object({...})).' },\n);\n/** Any Zod schema carried as a value — an action's output contract. */\nconst zodSchemaValue = z.custom<z.ZodTypeAny>(\n  (value) => value !== null && typeof value === 'object' && typeof (value as { safeParse?: unknown }).safeParse === 'function',\n  { message: 'An action output is a Zod schema.' },\n);\n\n/** ONE declared action. */\nexport const SystemOfRecordActionDeclarationSchema = z.strictObject({\n  target: z.enum(SystemOfRecordActionTarget),\n  call: SystemOfRecordActionCallSchema,\n  /**\n   * The input contract, validated BEFORE anything is sent. Strict parsing is the caller's contract: a key the schema\n   * does not declare is refused rather than forwarded, so nothing reaches the vendor that the author did not name.\n   */\n  input: zodObjectSchemaValue,\n  /**\n   * The result contract. When declared, the vendor's answer is parsed through it and only the parsed value is returned;\n   * an answer it rejects after the vendor APPLIED the action is reported as an unknown outcome, never as \"not done\".\n   * Absent means the result is returned as the vendor sent it.\n   */\n  output: zodSchemaValue.optional(),\n  /**\n   * Whether the action CHANGES remote state. A writing action must carry an Idempotency-Key from EVERY caller, because a\n   * remote change cannot be rolled back, and its interrupted attempts are reported as an unknown outcome rather than as\n   * a failure. A non-writing action (a vendor computation that changes nothing) needs neither.\n   */\n  writes: z.boolean(),\n  /**\n   * Whether the VENDOR makes a repeated call harmless, so the transport may re-send it after a timeout or a 5xx. False\n   * unless the vendor offers an idempotency mechanism for this call; Odoo offers none, so no Odoo action is retry-safe.\n   * A writing action is never re-sent without an Idempotency-Key, whatever this says.\n   */\n  retrySafe: z.boolean().default(false),\n  /**\n   * The role keys admitted to run it, held in the OWNER organization (an organization role) or at application scope. A\n   * role held only inside an organization UNIT admits the action on that unit's partition alone.\n   */\n  roles: z.array(z.string().min(1)).min(1),\n  /**\n   * Whether a context with NO user and no machine principal — the engine's own batch, cron and queue work, a webhook, an\n   * autonomous agent with nobody behind it — may run it. Such a context then acts ORGANIZATION-WIDE on the owner\n   * organization's behalf, which is exactly why it is off unless declared.\n   */\n  admitsSystemInitiation: z.boolean().default(false),\n  /** A record-free action's relation to the instance's partitions; see {@link SystemOfRecordActionPartitionStanceKind}. */\n  partitionStance: SystemOfRecordActionPartitionStanceSchema.optional(),\n  /**\n   * The resource operation that is this action's HTTP door, when it has one: a custom operation of the SAME resource\n   * whose implementation hands the request to the system-of-record action executor. Absent means the action is reached\n   * from code only.\n   *\n   * Naming the door HERE is what lets the resource factory tell an action from a row write. Without it, the only thing the\n   * factory can see is the verb the operation borrows, and both available borrows were wrong (#1678 review, F1):\n   *\n   * - borrowing READ made a state-changing route a GET, and its required Idempotency-Key was refused at boot, because a\n   *   read-shaped operation claims its repeat changes nothing — Wonder Todos' backend could not start;\n   * - borrowing UPDATE read as a ROW write, so the factory demanded `writableVerbs: [update]` — a door onto the bound\n   *   entity's rows that nobody asked for.\n   *\n   * A named door is exempt from the row-write rules and held to the action's own instead: a WRITING action's door borrows\n   * a single-row mutation verb (so its route is not a GET and a retry is keyed), requires the key on every variant, and\n   * runs INLINE. See `assertHttpApiWriteDeclarationCoherence`.\n   */\n  operation: z.string().min(1).optional(),\n});\nexport type SystemOfRecordActionDeclaration = z.infer<typeof SystemOfRecordActionDeclarationSchema>;\n/** What an author writes — defaulted fields optional. */\nexport type SystemOfRecordActionDeclarationAuthored = z.input<typeof SystemOfRecordActionDeclarationSchema>;\n\n/** Every action a binding declares, keyed by the application's action name. */\nexport const SystemOfRecordActionDeclarationsSchema = z.record(SystemOfRecordActionNameSchema, SystemOfRecordActionDeclarationSchema);\nexport type SystemOfRecordActionDeclarations = z.infer<typeof SystemOfRecordActionDeclarationsSchema>;\n\n/** @wildo_source:part:end saas.models.system-of-record-actions */\n\n/**\n * Odoo methods that READ, refused as actions.\n *\n * An action's answer is returned to its caller, and it is not confined the way the read lane confines rows: a\n * `search_read` declared as an action would hand a unit-confined member every company's rows. Reads go through the\n * read-through resource, whose pushdown and key-addressed admission are the confinement. A deny-list cannot be\n * complete — Odoo lets any public method be called — so an author reviews what a declared method returns; these are the\n * methods whose whole purpose is to return rows.\n */\nexport const ODOO_READ_METHODS_REFUSED_AS_ACTIONS: ReadonlySet<string> = new Set([\n  'read', 'search', 'search_read', 'search_count', 'read_group', 'name_search', 'name_get', 'fields_get',\n  'web_read', 'web_search_read', 'web_read_group', 'export_data', 'get_views', 'load_views', 'default_get',\n]);\n\n/**\n * Odoo methods that are ROW WRITES of the binding's own entity, refused as record-targeted actions: `write` and\n * `unlink` on the bound model are exactly what `writableVerbs` opens (#1679), with its payload rules and its field-level\n * trail. Declaring them as actions would open a second door onto the same change, one that skips both.\n */\nexport const ODOO_ROW_WRITE_METHODS_REFUSED_AS_RECORD_ACTIONS: ReadonlySet<string> = new Set(['write', 'unlink']);\n\n/**\n * Refuse every action declaration the engine could not honour, at AUTHORING (#1678). Throws a plain `Error` naming the\n * action and the fix; the resource factory wraps it with the resource identifier.\n *\n * What is NOT decidable here, and why: whether the vendor's facet supports the call shape and whether the instance is\n * partitioned both need the saas configuration and the facet map, which `shared-lib` does not see. Those are the boot\n * checks (`collectSystemOfRecordActionDeclarationViolations` in the backend).\n */\nexport function assertSystemOfRecordActionDeclarationsCoherence(params: {\n  readonly dialect: HttpApiTransportDialect;\n  readonly actions: SystemOfRecordActionDeclarations | undefined;\n}): void {\n  const { dialect, actions } = params;\n  for (const [actionName, action] of Object.entries(actions ?? {})) {\n    const refuse = (why: string): never => {\n      throw new Error(`actions.${actionName}: ${why}`);\n    };\n    if (dialect === HttpApiTransportDialect.REST_JSON) {\n      refuse(\n        'a REST_JSON binding cannot declare actions: an arbitrary REST surface has no action convention for the engine to '\n        + 'compile (its row writes are declared per verb in `operations`; an action has no such fixed shape). Declare the '\n        + 'action on an Odoo or OData binding, or remove it.',\n      );\n    }\n    const shapeDialect = SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT[action.call.shape];\n    if (shapeDialect !== dialect) {\n      refuse(`the call shape '${action.call.shape}' is spoken over ${shapeDialect}, and this binding speaks ${dialect}.`);\n    }\n    if (action.target === SystemOfRecordActionTarget.RECORD && action.call.shape === SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION) {\n      refuse('an UNBOUND OData action acts on no record; declare target: none, or use a bound action.');\n    }\n    if (action.target === SystemOfRecordActionTarget.NONE && action.call.shape === SystemOfRecordActionCallShape.ODATA_BOUND_ACTION) {\n      refuse('a BOUND OData action is invoked on a record; declare target: record, or use the unbound action import.');\n    }\n    if (action.target === SystemOfRecordActionTarget.RECORD && action.partitionStance !== undefined) {\n      refuse(\n        'a record-targeted action takes its partition from the record it reads first, so a partition stance would be a second, '\n        + 'unchecked answer to the same question. Remove partitionStance.',\n      );\n    }\n    if (action.call.shape === SystemOfRecordActionCallShape.ODOO_EXECUTE_KW) {\n      if (ODOO_READ_METHODS_REFUSED_AS_ACTIONS.has(action.call.method)) {\n        refuse(\n          `'${action.call.method}' reads rows, and an action's answer is not confined the way the read lane confines rows. `\n          + 'Read through the read-through resource instead.',\n        );\n      }\n      if (action.target === SystemOfRecordActionTarget.RECORD && action.call.model !== undefined) {\n        refuse(\n          'a record-targeted action acts on the binding\\'s own model, whose key codec and read gates address the record; '\n          + 'declare the action on the binding of the model it acts on, or make it record-free.',\n        );\n      }\n      if (action.target === SystemOfRecordActionTarget.RECORD && ODOO_ROW_WRITE_METHODS_REFUSED_AS_RECORD_ACTIONS.has(action.call.method)) {\n        refuse(`'${action.call.method}' is a row write of this binding's entity; open it through writableVerbs instead (#1679).`);\n      }\n      if (\n        action.call.inputPlacement === SystemOfRecordOdooActionInputPlacement.NONE\n        && Object.keys(action.input.shape).length > 0\n      ) {\n        refuse('inputPlacement \\'none\\' sends no input, so the declared input must be an empty object (z.object({})).');\n      }\n    }\n    if (action.partitionStance?.kind === SystemOfRecordActionPartitionStanceKind.MEMBER_UNIT_PARTITION) {\n      const parameter = action.partitionStance.parameter;\n      if (Object.prototype.hasOwnProperty.call(action.input.shape, parameter)) {\n        refuse(\n          `the partition parameter '${parameter}' is placed by the engine from the caller's organization unit, so the input `\n          + 'may not declare it — a caller who could send it would choose which company the action lands in.',\n        );\n      }\n      if (action.call.shape === SystemOfRecordActionCallShape.ODOO_EXECUTE_KW\n        && action.call.inputPlacement === SystemOfRecordOdooActionInputPlacement.NONE) {\n        refuse('a member-unit partition is written into the input, and inputPlacement \\'none\\' sends no input.');\n      }\n    }\n  }\n}\n"]}

package/dist/esm/systems-of-record/system-of-record-credential-kind.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-credential-kind.shared.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-credential-kind.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH;;;;;GAKG;AACH,oBAAY,4BAA4B;IACtC;;;;;;;;OAQG;IACH,oBAAoB,yBAAyB;IAE7C;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;;;OASG;IACH,aAAa,kBAAkB;IAE/B;;;;;;;;;;;OAWG;IACH,KAAK,UAAU;IAEf;;;;;;;;OAQG;IACH,gCAAgC,qCAAqC;IAErE;;;;;;;;;;;;;;;;OAgBG;IACH,qCAAqC,0CAA0C;IAE/E;;;;;;;;;OASG;IACH,iBAAiB,sBAAsB;CACxC;AAED,uGAAuG;AACvG,wBAAgB,sCAAsC,CAAC,IAAI,EAAE,4BAA4B,GAAG,OAAO,CAIlG"}
+{"version":3,"file":"system-of-record-credential-kind.shared.d.ts","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-credential-kind.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH;;;;;GAKG;AACH,oBAAY,4BAA4B;IACtC;;;;;;;;OAQG;IACH,oBAAoB,yBAAyB;IAE7C;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IAEjC;;;;;;;;;OASG;IACH,aAAa,kBAAkB;IAE/B;;;;;;;;;;;OAWG;IACH,KAAK,UAAU;IAEf;;;;;;;;OAQG;IACH,gCAAgC,qCAAqC;IAErE;;;;;;;;;;;;;;;;OAgBG;IACH,qCAAqC,0CAA0C;IAE/E;;;;;;;;;OASG;IACH,iBAAiB,sBAAsB;CACxC;AAED,uGAAuG;AACvG,wBAAgB,sCAAsC,CAAC,IAAI,EAAE,4BAA4B,GAAG,OAAO,CAIlG"}

package/dist/esm/systems-of-record/system-of-record-credential-kind.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-credential-kind.shared.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-credential-kind.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH;;;;;GAKG;AACH,MAAM,CAAN,IAAY,4BA0FX;AA1FD,WAAY,4BAA4B;IACtC;;;;;;;;OAQG;IACH,6EAA6C,CAAA;IAE7C;;;;;;;;OAQG;IACH,iEAAiC,CAAA;IAEjC;;;;;;;;;OASG;IACH,+DAA+B,CAAA;IAE/B;;;;;;;;;;;OAWG;IACH,+CAAe,CAAA;IAEf;;;;;;;;OAQG;IACH,qGAAqE,CAAA;IAErE;;;;;;;;;;;;;;;;OAgBG;IACH,+GAA+E,CAAA;IAE/E;;;;;;;;;OASG;IACH,uEAAuC,CAAA;AACzC,CAAC,EA1FW,4BAA4B,KAA5B,4BAA4B,QA0FvC;AAED,uGAAuG;AACvG,MAAM,UAAU,sCAAsC,CAAC,IAAkC;IACvF,OAAO,IAAI,KAAK,4BAA4B,CAAC,gCAAgC;WACxE,IAAI,KAAK,4BAA4B,CAAC,qCAAqC;WAC3E,IAAI,KAAK,4BAA4B,CAAC,iBAAiB,CAAC;AAC/D,CAAC","sourcesContent":["/**\n * `SystemOfRecordCredentialKind` — HOW the engine authenticates to a system of record.\n *\n * A root-exported boundary module, for the same package-contract reason as its sibling\n * `HttpApiTransportDialect` (#1055 R3): the ROOT-exported application-configuration contract\n * (`systemsOfRecord.<name>.credential.kind`) names this vocabulary, and a TypeScript `enum` is\n * NOMINAL — a root-only consumer that cannot reach the declaring module through a public specifier\n * gets `TS2742`/`TS2883`. `.claude/rules/package-public-entrypoints.md` prescribes moving the\n * boundary rather than re-exporting across it, so the `external-data` subpath does NOT re-export\n * this module.\n *\n * ## Why it is a separate vocabulary from the dialect\n *\n * A dialect says how to SPEAK (query protocol, envelope, filter language); a credential kind says\n * how to PROVE WHO YOU ARE. Odoo happens to pair one with the other today, and that coincidence is\n * exactly what `CLAUDE.md` forbids merging on: an OData v4 service reached with a bearer token and\n * the same service reached with client-credentials OAuth2 differ in the second axis and not the\n * first. Keeping them apart costs one enum and stops the pairing from being baked into the model.\n *\n * ## What a kind OWNS (#1055 R15, the slot-ownership decision)\n *\n * The kind owns the inputs IT needs — its secret slots, and any address slot that exists only\n * because of the kind. `OAUTH2_CLIENT_CREDENTIALS_SECRET` owns `tokenUrl`, which no vendor would\n * declare if it were reached with a static key. The FACET owns the vendor's own address slots and\n * the OFFERS it makes (a kind plus that vendor's policy for it); the INSTANCE chooses one offer.\n *\n * A third owner arrived with #1056 and is worth naming, because two of the three are easy to\n * confuse: the FACET also owns everything about a kind that varies BY VENDOR but not by deployment —\n * which header carries a static key, whether a token answer omits `expires_in`, whether an assertion\n * header needs a supplied `kid` or a derived `x5t`. Those are not slots: nobody types them per\n * environment, and asking an operator for them would be asking a question the facet already holds\n * the answer to (`derive-before-you-ask.md`).\n * The contracts themselves live beside the facet schema, on the `external-data` subpath, because\n * nothing root-exported needs to name a slot SHAPE — only the kind's NAME.\n *\n * ## How the catalogue grew, and what is still missing from it\n *\n * #1055 shipped ONE member, the one kind its one facet offered. #1056 added the six a service\n * identity actually needs across the vendors epic #1049 §4.6 surveyed — two static-key placements,\n * HTTP Basic, and three OAuth2 shapes. A member here with no entry in\n * `SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS` is a compile error, so the two cannot drift.\n *\n * `MTLS_CLIENT_CERTIFICATE` is deliberately ABSENT and is #1263. It is not a seventh variation on\n * composing a request: every kind here decides what to put IN a request, and mTLS decides how the\n * CONNECTION is made, which `HttpApiFetchLike` has no channel for (its `init` carries no\n * dispatcher). Adding it means widening the one outbound seam both this lane and the connector lane\n * run on — a different blast radius, and the reason SAP is declared unsupported-by-kind in #1057\n * rather than every other vendor waiting behind it.\n *\n * ## The root-only probe, measured 2026-09-15\n *\n * `package-public-entrypoints.md` asks for a measurement rather than a category judgement. A\n * consumer importing ONLY the package root, deriving values from this enum and emitting with\n * `declaration: true`:\n *\n * ```\n * export declare const declaredKind = SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS;\n * export declare function pickInstance(): { kind: SystemOfRecordCredentialKind; dialect: HttpApiTransportDialect };\n * ```\n *\n * Zero errors, and the emitted declaration NAMES the enum through the root specifier rather than a\n * `node_modules/.../dist/esm/...` path. The probe's negative control — importing\n * `SystemOfRecordVendorFacetSchema`, which is deliberately subpath-only — fails with `TS2305`, so\n * the probe discriminates rather than passing everything.\n */\n\n/**\n * How the engine proves its identity to a system of record. Closed vocabulary — a system of record\n * spends the APPLICATION's own service identity (D12), so nothing here is ever a person's lent\n * credential; those live on the connected-accounts lane and are deliberately not reachable from\n * this one (`pnpm check:systems-of-record-separation`).\n */\nexport enum SystemOfRecordCredentialKind {\n  /**\n   * Odoo's classic external API: the credential travels INSIDE the RPC arguments rather than in an\n   * HTTP header. The adapter performs `common.authenticate(db, login, apiKey, {})` for a uid and\n   * then passes `(db, uid, apiKey, …)` as the leading positional arguments of every `execute_kw`.\n   *\n   * Its inputs are the API key (a secret slot, owned here) plus the database and login (vendor\n   * address slots, owned by the Odoo facet — they identify WHICH Odoo and WHICH user, and would\n   * still be needed by a hypothetical second Odoo credential kind).\n   */\n  ODOO_API_KEY_IN_ARGS = 'odoo-api-key-in-args',\n\n  /**\n   * A static key presented in an HTTP request header.\n   *\n   * The SECRET is the key; WHICH header carries it and what prefixes it (`Bearer `, `ApiKey `, or\n   * nothing at all) are the VENDOR's facts, so they are declared on the facet's offer rather than\n   * asked of the operator who authors an instance. An operator who has to be told their vendor's\n   * header name is being asked a question the facet already holds the answer to\n   * (`derive-before-you-ask.md`).\n   */\n  API_KEY_HEADER = 'api-key-header',\n\n  /**\n   * A static key presented as a query-string parameter.\n   *\n   * Weaker than a header by construction — a URL reaches access logs, proxy logs and `Referer`\n   * headers — and offered only because some vendors accept nothing else. The parameter NAME is the\n   * vendor's fact, like the header name above.\n   *\n   * The key is appended by the transport at dispatch, never baked into a stored `baseUrl`: a base\n   * URL is printed in diagnostics and a credential must not ride in it.\n   */\n  API_KEY_QUERY = 'api-key-query',\n\n  /**\n   * HTTP Basic (RFC 7617): `Authorization: Basic base64(username \":\" password)`.\n   *\n   * SAP's communication user is the case this exists for. The username is a SECRET slot rather than\n   * an address slot even though it is not confidential on its own — it is half of one credential,\n   * it is rotated with the other half, and splitting a credential across the address channel and\n   * the secret channel makes rotation two operations that can disagree.\n   *\n   * A username containing `:` is unrepresentable in this scheme (the colon is the delimiter and the\n   * RFC forbids it), so it is refused where it is authored rather than producing a credential that\n   * decodes to a different pair than the one typed.\n   */\n  BASIC = 'basic',\n\n  /**\n   * OAuth 2.0 client credentials (RFC 6749 §4.4) with a shared secret: `grant_type=client_credentials`\n   * plus `client_id` and `client_secret`.\n   *\n   * An APP-ONLY identity — no person, no consent screen, no refresh token. That is the whole of D12:\n   * a system of record is the operator's own deployment, reached as the application, so a\n   * user-delegated flow would be authenticating the wrong party. The connector lane owns the\n   * authorization-code exchange and is not reachable from here.\n   */\n  OAUTH2_CLIENT_CREDENTIALS_SECRET = 'oauth2-client-credentials-secret',\n\n  /**\n   * OAuth 2.0 client credentials with a CLIENT ASSERTION signed by a private key (RFC 7523 §2.2):\n   * `grant_type=client_credentials` with\n   * `client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.\n   *\n   * NetSuite and Microsoft Entra's certificate credential are both this, and NetSuite is the reason\n   * it is separate from {@link OAUTH2_JWT_BEARER}: its documentation states the grant type is\n   * *always* `client_credentials`, so it is client AUTHENTICATION by assertion rather than the\n   * assertion GRANT (#1056 R1 corrected an earlier reading that had NetSuite under the grant).\n   *\n   * spec-cite: RFC 7523 §2.2 (Using JWTs for Client Authentication); NetSuite OAuth 2.0\n   * client-credentials help, https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162755359851.html\n   *\n   * The assertion's protected HEADER differs by vendor — NetSuite carries a vendor-assigned `kid`,\n   * Entra wants an `x5t` thumbprint — so the header policy is declared on the facet's offer (R2). A\n   * generic \"sign it with the private key\" is rejected by both.\n   */\n  OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE = 'oauth2-client-credentials-certificate',\n\n  /**\n   * The OAuth 2.0 JWT BEARER GRANT (RFC 7523 §2.1):\n   * `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer` with a signed `assertion`.\n   *\n   * Salesforce only, among the vendors surveyed. Distinct from the kind above in the one field that\n   * decides how the token endpoint reads the request — the grant type — which is exactly the kind of\n   * distinction `CLAUDE.md` forbids collapsing because two shapes look similar.\n   *\n   * spec-cite: RFC 7523 §2.1 (Using JWTs as Authorization Grants).\n   */\n  OAUTH2_JWT_BEARER = 'oauth2-jwt-bearer',\n}\n\n/** Whether a kind obtains a token from a token endpoint — the three that need a minter and a cache. */\nexport function systemOfRecordCredentialKindMintsToken(kind: SystemOfRecordCredentialKind): boolean {\n  return kind === SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET\n    || kind === SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE\n    || kind === SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER;\n}\n"]}
+{"version":3,"file":"system-of-record-credential-kind.shared.js","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-credential-kind.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH;;;;;GAKG;AACH,MAAM,CAAN,IAAY,4BA0FX;AA1FD,WAAY,4BAA4B;IACtC;;;;;;;;OAQG;IACH,6EAA6C,CAAA;IAE7C;;;;;;;;OAQG;IACH,iEAAiC,CAAA;IAEjC;;;;;;;;;OASG;IACH,+DAA+B,CAAA;IAE/B;;;;;;;;;;;OAWG;IACH,+CAAe,CAAA;IAEf;;;;;;;;OAQG;IACH,qGAAqE,CAAA;IAErE;;;;;;;;;;;;;;;;OAgBG;IACH,+GAA+E,CAAA;IAE/E;;;;;;;;;OASG;IACH,uEAAuC,CAAA;AACzC,CAAC,EA1FW,4BAA4B,KAA5B,4BAA4B,QA0FvC;AAED,uGAAuG;AACvG,MAAM,UAAU,sCAAsC,CAAC,IAAkC;IACvF,OAAO,IAAI,KAAK,4BAA4B,CAAC,gCAAgC;WACxE,IAAI,KAAK,4BAA4B,CAAC,qCAAqC;WAC3E,IAAI,KAAK,4BAA4B,CAAC,iBAAiB,CAAC;AAC/D,CAAC","sourcesContent":["/**\n * `SystemOfRecordCredentialKind` — HOW the engine authenticates to a system of record.\n *\n * A root-exported boundary module, for the same package-contract reason as its sibling\n * `HttpApiTransportDialect` (#1055 R3): the ROOT-exported application-configuration contract\n * (`systemsOfRecord.<name>.credential.kind`) names this vocabulary, and a TypeScript `enum` is\n * NOMINAL — a root-only consumer that cannot reach the declaring module through a public specifier\n * gets `TS2742`/`TS2883`. `.claude/rules/package-public-entrypoints.md` prescribes moving the\n * boundary rather than re-exporting across it, so the `external-data` subpath does NOT re-export\n * this module.\n *\n * ## Why it is a separate vocabulary from the dialect\n *\n * A dialect says how to SPEAK (query protocol, envelope, filter language); a credential kind says\n * how to PROVE WHO YOU ARE. Odoo happens to pair one with the other today, and that coincidence is\n * exactly what `CLAUDE.md` forbids merging on: an OData v4 service reached with a bearer token and\n * the same service reached with client-credentials OAuth2 differ in the second axis and not the\n * first. Keeping them apart costs one enum and stops the pairing from being baked into the model.\n *\n * ## What a kind OWNS (#1055 R15, the slot-ownership decision)\n *\n * The kind owns the inputs IT needs — its secret slots, and any address slot that exists only\n * because of the kind. `OAUTH2_CLIENT_CREDENTIALS_SECRET` owns `tokenUrl`, which no vendor would\n * declare if it were reached with a static key. The FACET owns the vendor's own address slots and\n * the OFFERS it makes (a kind plus that vendor's policy for it); the INSTANCE chooses one offer.\n *\n * A third owner arrived with #1056 and is worth naming, because two of the three are easy to\n * confuse: the FACET also owns everything about a kind that varies BY VENDOR but not by deployment —\n * which header carries a static key, whether a token answer omits `expires_in`, whether an assertion\n * header needs a supplied `kid` or a derived `x5t`. Those are not slots: nobody types them per\n * environment, and asking an operator for them would be asking a question the facet already holds\n * the answer to (`derive-before-you-ask.md`).\n * The contracts themselves live beside the facet schema, on the `external-data` subpath, because\n * nothing root-exported needs to name a slot SHAPE — only the kind's NAME.\n *\n * ## How the catalogue grew, and what is still missing from it\n *\n * #1055 shipped ONE member, the one kind its one facet offered. #1056 added the six a service\n * identity actually needs across the vendors epic #1049 §4.6 surveyed — two static-key placements,\n * HTTP Basic, and three OAuth2 shapes. A member here with no entry in\n * `SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS` is a compile error, so the two cannot drift.\n *\n * `MTLS_CLIENT_CERTIFICATE` is deliberately ABSENT and is #1263. It is not a seventh variation on\n * composing a request: every kind here decides what to put IN a request, and mTLS decides how the\n * CONNECTION is made, which `HttpApiFetchLike` has no channel for (its `init` carries no\n * dispatcher). Adding it means widening the one outbound seam both this lane and the connector lane\n * run on — a different blast radius, and the reason SAP is declared unsupported-by-kind in #1057\n * rather than every other vendor waiting behind it.\n *\n * ## The root-only probe, measured 2026-09-15\n *\n * `package-public-entrypoints.md` asks for a measurement rather than a category judgement. A\n * consumer importing ONLY the package root, deriving values from this enum and emitting with\n * `declaration: true`:\n *\n * ```\n * export declare const declaredKind = SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS;\n * export declare function pickInstance(): { kind: SystemOfRecordCredentialKind; dialect: HttpApiTransportDialect };\n * ```\n *\n * Zero errors, and the emitted declaration NAMES the enum through the root specifier rather than a\n * `node_modules/.../dist/esm/...` path. The probe's negative control — importing\n * `SystemOfRecordVendorFacetSchema`, which is deliberately subpath-only — fails with `TS2305`, so\n * the probe discriminates rather than passing everything.\n */\n\n/**\n * How the engine proves its identity to a system of record. Closed vocabulary — a system of record\n * spends the APPLICATION's own service identity (D12), so nothing here is ever a person's lent\n * credential; those live on the connected-accounts lane and are deliberately not reachable from\n * this one (`pnpm check:systems-of-record-separation`).\n */\nexport enum SystemOfRecordCredentialKind {\n  /**\n   * Odoo's classic external API: the credential travels INSIDE the RPC arguments rather than in an\n   * HTTP header. The adapter performs `common.authenticate(db, login, apiKey, {})` for a uid and\n   * then passes `(db, uid, apiKey, …)` as the leading positional arguments of every `execute_kw`.\n   *\n   * Its inputs are the API key (a secret slot, owned here) plus the database and login (vendor\n   * address slots, owned by the Odoo facet — they identify WHICH Odoo and WHICH user, and would\n   * still be needed by a hypothetical second Odoo credential kind).\n   */\n  ODOO_API_KEY_IN_ARGS = 'odoo-api-key-in-args',\n\n  /**\n   * A static key presented in an HTTP request header.\n   *\n   * The SECRET is the key; WHICH header carries it and what prefixes it (`Bearer `, `ApiKey `, or\n   * nothing at all) are the VENDOR's facts, so they are declared on the facet's offer rather than\n   * asked of the operator who authors an instance. An operator who has to be told their vendor's\n   * header name is being asked a question the facet already holds the answer to\n   * (`derive-before-you-ask.md`).\n   */\n  API_KEY_HEADER = 'api-key-header',\n\n  /**\n   * A static key presented as a query-string parameter.\n   *\n   * Weaker than a header by construction — a URL reaches access logs, proxy logs and `Referer`\n   * headers — and offered only because some vendors accept nothing else. The parameter NAME is the\n   * vendor's fact, like the header name above.\n   *\n   * The key is appended by the transport at dispatch, never baked into a stored `baseUrl`: a base\n   * URL is printed in diagnostics and a credential must not ride in it.\n   */\n  API_KEY_QUERY = 'api-key-query',\n\n  /**\n   * HTTP Basic (RFC 7617): `Authorization: Basic base64(username \":\" password)`.\n   *\n   * SAP's communication user is the case this exists for. The username is a SECRET slot rather than\n   * an address slot even though it is not confidential on its own — it is half of one credential,\n   * it is rotated with the other half, and splitting a credential across the address channel and\n   * the secret channel makes rotation two operations that can disagree.\n   *\n   * A username containing `:` is unrepresentable in this scheme (the colon is the delimiter and the\n   * RFC forbids it), so it is refused where it is authored rather than producing a credential that\n   * decodes to a different pair than the one typed.\n   */\n  BASIC = 'basic',\n\n  /**\n   * OAuth 2.0 client credentials (RFC 6749 §4.4) with a shared secret: `grant_type=client_credentials`\n   * plus `client_id` and `client_secret`.\n   *\n   * An APP-ONLY identity — no person, no consent screen, no refresh token. That is the whole of D12:\n   * a system of record is the operator's own deployment, reached as the application, so a\n   * user-delegated flow would be authenticating the wrong party. The connector lane owns the\n   * authorization-code exchange and is not reachable from here.\n   */\n  OAUTH2_CLIENT_CREDENTIALS_SECRET = 'oauth2-client-credentials-secret',\n\n  /**\n   * OAuth 2.0 client credentials with a CLIENT ASSERTION signed by a private key (RFC 7523 §2.2):\n   * `grant_type=client_credentials` with\n   * `client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.\n   *\n   * NetSuite and Microsoft Entra's certificate credential are both this, and NetSuite is the reason\n   * it is separate from {@link OAUTH2_JWT_BEARER}: its documentation states the grant type is\n   * *always* `client_credentials`, so it is client AUTHENTICATION by assertion rather than the\n   * assertion GRANT (#1056 R1 corrected an earlier reading that had NetSuite under the grant).\n   *\n   * spec-cite: RFC 7523 §2.2 (Using JWTs for Client Authentication); NetSuite OAuth 2.0\n   * client-credentials help, https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_162755359851.html\n   *\n   * The assertion's protected HEADER differs by vendor — NetSuite carries a vendor-assigned `kid`,\n   * Entra wants an `x5t` thumbprint — so the header policy is declared on the facet's offer (R2). A\n   * generic \"sign it with the private key\" is rejected by both.\n   */\n  OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE = 'oauth2-client-credentials-certificate',\n\n  /**\n   * The OAuth 2.0 JWT BEARER GRANT (RFC 7523 §2.1):\n   * `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer` with a signed `assertion`.\n   *\n   * Salesforce only, among the vendors surveyed. Distinct from the kind above in the one field that\n   * decides how the token endpoint reads the request — the grant type — which is exactly the kind of\n   * distinction `CLAUDE.md` forbids collapsing because two shapes look similar.\n   *\n   * spec-cite: RFC 7523 §2.1 (Using JWTs as Authorization Grants).\n   */\n  OAUTH2_JWT_BEARER = 'oauth2-jwt-bearer',\n}\n\n/** Whether a kind obtains a token from a token endpoint — the three that need a minter and a cache. */\nexport function systemOfRecordCredentialKindMintsToken(kind: SystemOfRecordCredentialKind): boolean {\n  return kind === SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET\n    || kind === SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE\n    || kind === SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER;\n}\n"]}

package/dist/esm/systems-of-record/system-of-record-declaration.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-declaration.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-declaration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,6GAA6G;AAE7G;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,QAAsB,CAAC;AAEjE,qGAAqG;AACrG,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,gCAAgC;IAC1C,sMAAsM;IACtM,8BAA8B,mCAAmC;IACjE,mJAAmJ;IACnJ,oCAAoC,yCAAyC;CAC9E;AAED,eAAO,MAAM,wBAAwB,aAGG,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,6BAA6B,sBAAsB,CAAC;AAEjE;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,6BAA6B;AAC7B,eAAO,MAAM,+BAA+B;IAC1C;;;;;OAKG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;;;IAGH;;;;;;;;;;;;;;;OAeG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;IAMH;;;;;OAKG;;kBAEH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;IA1HtC;;;;;OAKG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;;;IAGH;;;;;;;;;;;;;;;OAeG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;IAMH;;;;;OAKG;;mBAwBD,CAAC;AACL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,2DAA2D"}
+{"version":3,"file":"system-of-record-declaration.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-declaration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,6GAA6G;AAE7G;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,QAAsB,CAAC;AAEjE,qGAAqG;AACrG,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,gCAAgC;IAC1C,sMAAsM;IACtM,8BAA8B,mCAAmC;IACjE,mJAAmJ;IACnJ,oCAAoC,yCAAyC;CAC9E;AAED,eAAO,MAAM,wBAAwB,aAGG,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,6BAA6B,sBAAsB,CAAC;AAEjE;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,6BAA6B;AAC7B,eAAO,MAAM,+BAA+B;IAC1C;;;;;OAKG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;;;IAGH;;;;;;;;;;;;;;;OAeG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;IAMH;;;;;OAKG;;kBAEH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;IA1HtC;;;;;OAKG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;;;IAGH;;;;;;;;;;;;;;;OAeG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;IAMH;;;;;OAKG;;mBAwBD,CAAC;AACL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,2DAA2D"}