@wildo-ai/platform-core-shared 1.1.1 → 1.1.3

package/dist/esm/wildo-applications/wildo-applications.custom.shared.resources-config.schemas.js

@@ -5,7 +5,7 @@
  * Handles creation, updates, and management of billable items across invoices.
  */
 import { z } from 'zod';
-import { CoreResourceOperation, CORE_APP_ROLES } from '@wildo-ai/saas-models';
+import { CoreResourceOperation, CORE_APP_ROLES, ResourceSystemAccessMode } from '@wildo-ai/saas-models';
 import { ResourceOperationVariantType, ResourceOperationRiskLevel } from '@wildo-ai/saas-models';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '@wildo-ai/saas-models';
 import { createResourceConfiguration_Initialization } from '@wildo-ai/saas-models';
@@ -16,6 +16,17 @@ const WildoApplications_Operations = undefined;
 export const wildoApplications_ResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
     mainSchema: Wildo_Application_Schema,
     resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION,
+    /**
+     * A subject export never includes this row: it is a managed application's platform record (slug, status, topology) — infrastructure identity, no person.
+     *
+     * Answered explicitly because the privacy gate at boot asks every resource whether its rows
+     * are about people. The unauthored default is already FORBIDDEN; writing it down is what turns
+     * "nobody asked" into "no". Not `retentionPolicy: RETAIN_ONLY`, although it is the same claim:
+     * that opt-in injects the `retentionStatus` / `impersonalizedAt` marker columns and demands the
+     * retention write door (UPDATE_MANY) on a resource no erasure walk can reach — there is no
+     * USERS edge — which is schema and surface for a path that never runs.
+     */
+    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },
     /**
      * BOOTSTRAP-STORE pin RETIRED 2026-08-22 (item C). This resource now follows the platform's
      * configured engine like every other platform resource, instead of declaring MONGODB.

package/dist/esm/wildo-applications/wildo-applications.custom.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"wildo-applications.custom.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/wildo-applications/wildo-applications.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAsC,qBAAqB,EAA0C,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1J,OAAO,EAAwB,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACvH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EACL,yBAAyB,EACzB,oCAAoC,EACrC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAGtF,MAAM,4BAA4B,GAAG,SAAS,CAAC;AAU/C,MAAM,CAAC,MAAM,6DAA6D,GAA6B,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAInM;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,yBAAyB,CAAC,iBAAiB;IAC/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBAAuB,EAAE,oCAAoC,CAAC,yBAAyB,CAAC,iBAAiB,CAAC;IAC1G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IAEvB,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,4BAA4B;IAE7C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC;oBAC/C,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE;wBACZ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;qBAC3B;oBACD,UAAU,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,CAAU;oBAC5E,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;KACF;IACD,iEAAiE;CAClE,CAAC,CAAC","sourcesContent":["/**\n * Billable Items Shared Resource Configuration\n * \n * Resource configuration for managing invoice line items and billable entries.\n * Handles creation, updates, and management of billable items across invoices.\n */\n\nimport { z } from 'zod';\n\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType, ResourceRelationship, CORE_APP_ROLES } from '@wildo-ai/saas-models';\nimport { ResourcePrimaryScope, ResourceOperationVariantType, ResourceOperationRiskLevel } from '@wildo-ai/saas-models';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '@wildo-ai/saas-models';\nimport { createResourceConfiguration_Initialization } from '@wildo-ai/saas-models';\nimport { CORE_ORG_ROLES } from '@wildo-ai/saas-models';\n\n\nimport {\n  CustomShared_ResourceType,\n  CustomShared_ResourceFieldIdentifier\n} from '../core/resources/resources-types.custom.shared.schemas';\nimport { Wildo_Application_Schema } from './wildo-applications.custom.shared.schemas';\n\n\nconst WildoApplications_Operations = undefined; \n\ntype WildoApplications_CoreOperations = \n  | CoreResourceOperation.READ \n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\nexport const wildoApplications_ResourceConfiguration_InitializationFactory: (...args: any[]) => any =  (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof WildoApplications_Operations,\n  WildoApplications_CoreOperations,\n  typeof Wildo_Application_Schema\n>({\n  mainSchema: Wildo_Application_Schema,\n  resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION,\n  /**\n   * BOOTSTRAP-STORE pin RETIRED 2026-08-22 (item C). This resource now follows the platform's\n   * configured engine like every other platform resource, instead of declaring MONGODB.\n   *\n   * The pin existed because this document was WRITTEN by a Mongo-wired plane an adapter override\n   * could never redirect, so a PG-engined platform would READ it from PostgreSQL while the\n   * bootstrap plane kept WRITING it to MongoDB. Its own contract named the two conditions that\n   * would free it, and BOTH are now met — verified rather than assumed:\n   *\n   *  1. **The infra-manager's raw writers are ported.** `pnpm check:platform-bootstrap-raw-store`\n   *     inspects 49 files and reports no undeclared raw-driver access; its `--self-test` passes 14\n   *     cases, so the clean result is the checker working rather than a checker matching nothing.\n   *     The 8 remaining DECLARED exemptions all sit in the bootstrap seed, and they write\n   *     `organizations` and `applications` — neither of which is one of these six — through arms\n   *     that are already adapter-aware.\n   *  2. **INIT's repository plane resolves the platform engine.** Phase 2.5\n   *     (`initializePlatformPostgresIfDeclared`, which calls\n   *     `setPlatformModeDefaultPersistenceAdapter`) runs BEFORE Phase 2.6 builds the registries —\n   *     an ordering the file marks as the one constraint that cannot be relaxed.\n   *\n   * Retired for all SIX declarations in one change, as the pin instructed (\"Never migrate one\n   * declaration on its own\"): a partial retirement is precisely the split-brain the pin prevented.\n   * `bootstrap-plane-persistence-adapter.test.ts` now asserts the inverse — that none of the six\n   * declares an adapter — so re-pinning any single one fails the suite.\n   *\n   * NOTE the data consequence, which the pin never covered: flipping the engine does not MOVE\n   * existing rows. A platform whose documents live in MongoDB must have them re-provisioned (or\n   * migrated) into PostgreSQL, or it reads empty tables. See item G.\n   */\n  resourceFieldIdentifier: CustomShared_ResourceFieldIdentifier[CustomShared_ResourceType.WILDO_APPLICATION],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: false,\n  \n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE\n  ],\n  \n  customOperation: WildoApplications_Operations,\n  \n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n    \n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n    \n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['appSlug', 'organizationId'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: {\n            organizationId: z.string(),\n          },\n          sortFields: ['appSlug', 'organizationId', 'createdAt', 'updatedAt'] as const,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n    \n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MANAGER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ]\n    },\n    \n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n  },\n  // responseSummaryDto auto-derived from isSummaryField decorators\n}); "]}
+{"version":3,"file":"wildo-applications.custom.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/wildo-applications/wildo-applications.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAsC,qBAAqB,EAA0C,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACpL,OAAO,EAAwB,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACvH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EACL,yBAAyB,EACzB,oCAAoC,EACrC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAGtF,MAAM,4BAA4B,GAAG,SAAS,CAAC;AAU/C,MAAM,CAAC,MAAM,6DAA6D,GAA6B,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAInM;IACA,UAAU,EAAE,wBAAwB;IACpC,kBAAkB,EAAE,yBAAyB,CAAC,iBAAiB;IAC/D;;;;;;;;;OASG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IACzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBAAuB,EAAE,oCAAoC,CAAC,yBAAyB,CAAC,iBAAiB,CAAC;IAC1G,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IAEvB,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,4BAA4B;IAE7C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC;oBAC/C,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE;wBACZ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;qBAC3B;oBACD,UAAU,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,CAAU;oBAC5E,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC;oBACnC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,0CAA0C;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;KACF;IACD,iEAAiE;CAClE,CAAC,CAAC","sourcesContent":["/**\n * Billable Items Shared Resource Configuration\n * \n * Resource configuration for managing invoice line items and billable entries.\n * Handles creation, updates, and management of billable items across invoices.\n */\n\nimport { z } from 'zod';\n\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType, ResourceRelationship, CORE_APP_ROLES, ResourceSystemAccessMode } from '@wildo-ai/saas-models';\nimport { ResourcePrimaryScope, ResourceOperationVariantType, ResourceOperationRiskLevel } from '@wildo-ai/saas-models';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '@wildo-ai/saas-models';\nimport { createResourceConfiguration_Initialization } from '@wildo-ai/saas-models';\nimport { CORE_ORG_ROLES } from '@wildo-ai/saas-models';\n\n\nimport {\n  CustomShared_ResourceType,\n  CustomShared_ResourceFieldIdentifier\n} from '../core/resources/resources-types.custom.shared.schemas';\nimport { Wildo_Application_Schema } from './wildo-applications.custom.shared.schemas';\n\n\nconst WildoApplications_Operations = undefined; \n\ntype WildoApplications_CoreOperations = \n  | CoreResourceOperation.READ \n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\nexport const wildoApplications_ResourceConfiguration_InitializationFactory: (...args: any[]) => any =  (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof WildoApplications_Operations,\n  WildoApplications_CoreOperations,\n  typeof Wildo_Application_Schema\n>({\n  mainSchema: Wildo_Application_Schema,\n  resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION,\n  /**\n   * A subject export never includes this row: it is a managed application's platform record (slug, status, topology) — infrastructure identity, no person.\n   *\n   * Answered explicitly because the privacy gate at boot asks every resource whether its rows\n   * are about people. The unauthored default is already FORBIDDEN; writing it down is what turns\n   * \"nobody asked\" into \"no\". Not `retentionPolicy: RETAIN_ONLY`, although it is the same claim:\n   * that opt-in injects the `retentionStatus` / `impersonalizedAt` marker columns and demands the\n   * retention write door (UPDATE_MANY) on a resource no erasure walk can reach — there is no\n   * USERS edge — which is schema and surface for a path that never runs.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n  /**\n   * BOOTSTRAP-STORE pin RETIRED 2026-08-22 (item C). This resource now follows the platform's\n   * configured engine like every other platform resource, instead of declaring MONGODB.\n   *\n   * The pin existed because this document was WRITTEN by a Mongo-wired plane an adapter override\n   * could never redirect, so a PG-engined platform would READ it from PostgreSQL while the\n   * bootstrap plane kept WRITING it to MongoDB. Its own contract named the two conditions that\n   * would free it, and BOTH are now met — verified rather than assumed:\n   *\n   *  1. **The infra-manager's raw writers are ported.** `pnpm check:platform-bootstrap-raw-store`\n   *     inspects 49 files and reports no undeclared raw-driver access; its `--self-test` passes 14\n   *     cases, so the clean result is the checker working rather than a checker matching nothing.\n   *     The 8 remaining DECLARED exemptions all sit in the bootstrap seed, and they write\n   *     `organizations` and `applications` — neither of which is one of these six — through arms\n   *     that are already adapter-aware.\n   *  2. **INIT's repository plane resolves the platform engine.** Phase 2.5\n   *     (`initializePlatformPostgresIfDeclared`, which calls\n   *     `setPlatformModeDefaultPersistenceAdapter`) runs BEFORE Phase 2.6 builds the registries —\n   *     an ordering the file marks as the one constraint that cannot be relaxed.\n   *\n   * Retired for all SIX declarations in one change, as the pin instructed (\"Never migrate one\n   * declaration on its own\"): a partial retirement is precisely the split-brain the pin prevented.\n   * `bootstrap-plane-persistence-adapter.test.ts` now asserts the inverse — that none of the six\n   * declares an adapter — so re-pinning any single one fails the suite.\n   *\n   * NOTE the data consequence, which the pin never covered: flipping the engine does not MOVE\n   * existing rows. A platform whose documents live in MongoDB must have them re-provisioned (or\n   * migrated) into PostgreSQL, or it reads empty tables. See item G.\n   */\n  resourceFieldIdentifier: CustomShared_ResourceFieldIdentifier[CustomShared_ResourceType.WILDO_APPLICATION],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: false,\n  \n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    CoreResourceOperation.DELETE\n  ],\n  \n  customOperation: WildoApplications_Operations,\n  \n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n    \n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n    \n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          isSearchable: true,\n          searchableFields: ['appSlug', 'organizationId'],\n          searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n          filterFields: {\n            organizationId: z.string(),\n          },\n          sortFields: ['appSlug', 'organizationId', 'createdAt', 'updatedAt'] as const,\n          maxPaginatedResultPerPageLimit: 100,\n        }\n      ],\n    },\n    \n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MANAGER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          // requestDto auto-derived from decorators\n        }\n      ]\n    },\n    \n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n  },\n  // responseSummaryDto auto-derived from isSummaryField decorators\n}); "]}

package/dist/esm/wildo-applications-versions/wildo-applications-versions.custom.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wildo-applications-versions.custom.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/wildo-applications-versions/wildo-applications-versions.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH,eAAO,MAAM,oEAAoE,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GA6DrG,CAAC"}
+{"version":3,"file":"wildo-applications-versions.custom.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/wildo-applications-versions/wildo-applications-versions.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH,eAAO,MAAM,oEAAoE,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAwErG,CAAC"}

package/dist/esm/wildo-applications-versions/wildo-applications-versions.custom.shared.resources-config.schemas.js

@@ -4,7 +4,7 @@
  * Resource configuration for managing invoice line items and billable entries.
  * Handles creation, updates, and management of billable items across invoices.
  */
-import { CoreResourceOperation, CORE_APP_ROLES } from '@wildo-ai/saas-models';
+import { CoreResourceOperation, CORE_APP_ROLES, ResourceSystemAccessMode } from '@wildo-ai/saas-models';
 import { ResourceOperationVariantType, ResourceOperationRiskLevel } from '@wildo-ai/saas-models';
 import { CoreUserNotificationTarget, CoreUserNotificationChannel } from '@wildo-ai/saas-models';
 import { createResourceConfiguration_Initialization } from '@wildo-ai/saas-models';
@@ -15,6 +15,17 @@ const WildoApplicationVersions_Operations = undefined;
 export const wildoApplicationVersions_ResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
     mainSchema: Wildo_Application_Version_Schema,
     resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION_VERSIONS,
+    /**
+     * A subject export never includes this row: it is a managed application's version record — a software artifact, no person.
+     *
+     * Answered explicitly because the privacy gate at boot asks every resource whether its rows
+     * are about people. The unauthored default is already FORBIDDEN; writing it down is what turns
+     * "nobody asked" into "no". Not `retentionPolicy: RETAIN_ONLY`, although it is the same claim:
+     * that opt-in injects the `retentionStatus` / `impersonalizedAt` marker columns and demands the
+     * retention write door (UPDATE_MANY) on a resource no erasure walk can reach — there is no
+     * USERS edge — which is schema and surface for a path that never runs.
+     */
+    systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },
     resourceFieldIdentifier: CustomShared_ResourceFieldIdentifier[CustomShared_ResourceType.WILDO_APPLICATION_VERSIONS],
     resourceRelationships: resourcesRelationships,
     isSystemResource: false,

package/dist/esm/wildo-applications-versions/wildo-applications-versions.custom.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"wildo-applications-versions.custom.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/wildo-applications-versions/wildo-applications-versions.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAsC,qBAAqB,EAA0C,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1J,OAAO,EAAwB,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACvH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EACL,yBAAyB,EACzB,oCAAoC,EACrC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AAGvG,MAAM,mCAAmC,GAAG,SAAS,CAAC;AAOtD,MAAM,CAAC,MAAM,oEAAoE,GAA6B,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI1M;IACA,UAAU,EAAE,gCAAgC;IAC5C,kBAAkB,EAAE,yBAAyB,CAAC,0BAA0B;IACxE,uBAAuB,EAAE,oCAAoC,CAAC,yBAAyB,CAAC,0BAA0B,CAAC;IACnH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IAEvB,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,mCAAmC;IAEpD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;KACF;IACD,iEAAiE;CAClE,CAAC,CAAC","sourcesContent":["/**\n * Billable Items Shared Resource Configuration\n * \n * Resource configuration for managing invoice line items and billable entries.\n * Handles creation, updates, and management of billable items across invoices.\n */\n\nimport { z } from 'zod';\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType, ResourceRelationship, CORE_APP_ROLES } from '@wildo-ai/saas-models';\nimport { ResourcePrimaryScope, ResourceOperationVariantType, ResourceOperationRiskLevel } from '@wildo-ai/saas-models';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '@wildo-ai/saas-models';\nimport { createResourceConfiguration_Initialization } from '@wildo-ai/saas-models';\nimport { CORE_ORG_ROLES } from '@wildo-ai/saas-models';\n\nimport {\n  CustomShared_ResourceType,\n  CustomShared_ResourceFieldIdentifier\n} from '../core/resources/resources-types.custom.shared.schemas';\nimport { Wildo_Application_Version_Schema } from './wildo-applications-versions.custom.shared.schemas';\n\n\nconst WildoApplicationVersions_Operations = undefined; \n\ntype WildoApplicationVersions_CoreOperations = \n  | CoreResourceOperation.READ \n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n\nexport const wildoApplicationVersions_ResourceConfiguration_InitializationFactory: (...args: any[]) => any =  (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof WildoApplicationVersions_Operations,\n  WildoApplicationVersions_CoreOperations,\n  typeof Wildo_Application_Version_Schema\n>({\n  mainSchema: Wildo_Application_Version_Schema,\n  resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION_VERSIONS,\n  resourceFieldIdentifier: CustomShared_ResourceFieldIdentifier[CustomShared_ResourceType.WILDO_APPLICATION_VERSIONS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: false,\n  \n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n  ],\n  \n  customOperation: WildoApplicationVersions_Operations,\n  \n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n    \n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n    \n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n  },\n  // responseSummaryDto auto-derived from isSummaryField decorators\n}); "]}
+{"version":3,"file":"wildo-applications-versions.custom.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/wildo-applications-versions/wildo-applications-versions.custom.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAsC,qBAAqB,EAA0C,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACpL,OAAO,EAAwB,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACvH,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,0CAA0C,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EACL,yBAAyB,EACzB,oCAAoC,EACrC,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AAGvG,MAAM,mCAAmC,GAAG,SAAS,CAAC;AAOtD,MAAM,CAAC,MAAM,oEAAoE,GAA6B,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI1M;IACA,UAAU,EAAE,gCAAgC;IAC5C,kBAAkB,EAAE,yBAAyB,CAAC,0BAA0B;IACxE;;;;;;;;;OASG;IACH,kBAAkB,EAAE,EAAE,aAAa,EAAE,wBAAwB,CAAC,SAAS,EAAE;IACzE,uBAAuB,EAAE,oCAAoC,CAAC,yBAAyB,CAAC,0BAA0B,CAAC;IACnH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,KAAK;IAEvB,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,mCAAmC;IAEpD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,0CAA0C;iBAC3C;aACF;YACD,iBAAiB,EAAE;gBACjB;oBACE,MAAM,EAAE,0BAA0B,CAAC,SAAS;oBAC5C,OAAO,EAAE,2BAA2B,CAAC,iBAAiB;iBACvD;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;oBAClC,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;KACF;IACD,iEAAiE;CAClE,CAAC,CAAC","sourcesContent":["/**\n * Billable Items Shared Resource Configuration\n * \n * Resource configuration for managing invoice line items and billable entries.\n * Handles creation, updates, and management of billable items across invoices.\n */\n\nimport { z } from 'zod';\n\nimport { coreResourceShared_FieldIdentifier, CoreResourceOperation, CoreResourceType, ResourceRelationship, CORE_APP_ROLES, ResourceSystemAccessMode } from '@wildo-ai/saas-models';\nimport { ResourcePrimaryScope, ResourceOperationVariantType, ResourceOperationRiskLevel } from '@wildo-ai/saas-models';\nimport { CoreUserNotificationTarget, CoreUserNotificationChannel } from '@wildo-ai/saas-models';\nimport { createResourceConfiguration_Initialization } from '@wildo-ai/saas-models';\nimport { CORE_ORG_ROLES } from '@wildo-ai/saas-models';\n\nimport {\n  CustomShared_ResourceType,\n  CustomShared_ResourceFieldIdentifier\n} from '../core/resources/resources-types.custom.shared.schemas';\nimport { Wildo_Application_Version_Schema } from './wildo-applications-versions.custom.shared.schemas';\n\n\nconst WildoApplicationVersions_Operations = undefined; \n\ntype WildoApplicationVersions_CoreOperations = \n  | CoreResourceOperation.READ \n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n\nexport const wildoApplicationVersions_ResourceConfiguration_InitializationFactory: (...args: any[]) => any =  (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof WildoApplicationVersions_Operations,\n  WildoApplicationVersions_CoreOperations,\n  typeof Wildo_Application_Version_Schema\n>({\n  mainSchema: Wildo_Application_Version_Schema,\n  resourceIdentifier: CustomShared_ResourceType.WILDO_APPLICATION_VERSIONS,\n  /**\n   * A subject export never includes this row: it is a managed application's version record — a software artifact, no person.\n   *\n   * Answered explicitly because the privacy gate at boot asks every resource whether its rows\n   * are about people. The unauthored default is already FORBIDDEN; writing it down is what turns\n   * \"nobody asked\" into \"no\". Not `retentionPolicy: RETAIN_ONLY`, although it is the same claim:\n   * that opt-in injects the `retentionStatus` / `impersonalizedAt` marker columns and demands the\n   * retention write door (UPDATE_MANY) on a resource no erasure walk can reach — there is no\n   * USERS edge — which is schema and surface for a path that never runs.\n   */\n  systemAccessPolicy: { exportSubject: ResourceSystemAccessMode.FORBIDDEN },\n  resourceFieldIdentifier: CustomShared_ResourceFieldIdentifier[CustomShared_ResourceType.WILDO_APPLICATION_VERSIONS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: false,\n  \n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n  ],\n  \n  customOperation: WildoApplicationVersions_Operations,\n  \n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // requestDto auto-derived from decorators\n        }\n      ],\n      userNotifications: [\n        {\n          target: CoreUserNotificationTarget.USER_SELF,\n          channel: CoreUserNotificationChannel.FRONT_END_SUCCESS,\n        }\n      ]\n    },\n    \n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n    \n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_MEMBER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }\n      ]\n    },\n  },\n  // responseSummaryDto auto-derived from isSummaryField decorators\n}); "]}

package/dist/esm/workbench/workbench-aspect-resources.custom.shared.schemas.d.ts

@@ -0,0 +1,100 @@
+import { CoreResourceOperation, ResourceRelationship } from '@wildo-ai/saas-models';
+import { z } from 'zod';
+import { WorkbenchShared_ResourceType } from './workbench-resources-types.custom.shared.schemas';
+/**
+ * FAMILY ASPECT RESOURCES — the spine's schema-agnostic transcription of
+ * `FAMILY_ASPECTS_REGISTRY` (`@wildo-ai/saas-specifications`, `_core/family-aspects.*`).
+ *
+ * ## The split, restated where it is enforced
+ *
+ * The registry is AUTHORITATIVE: item schemas, business keys, edges, all declared beside the
+ * `_core` family schemas (decided 2026-09-01). The spine cannot import it — platform-core-shared
+ * deliberately never depends on saas-specifications — so this module carries plain DATA: which
+ * aspects exist, which envelope fields carry references, and which resource each reference
+ * resolves to. A companion-side parity test holds this table to the registry; drift between the
+ * two is a failing test, never a silent divergence.
+ *
+ * ## The envelope
+ *
+ * Aspect rows share ONE envelope shape (identity, family backlink, headline, the full item as a
+ * raw record) plus the aspect's own FLATTENED reference fields. Flattening is the projection's
+ * job and is what makes every edge a PLAIN foreign key the engine already resolves:
+ *
+ * - weighted edge objects flatten to key arrays (`jobs[].jobRef` → `jobIds`),
+ * - multi-target fields split per target (`deliversRequirementRefs` →
+ *   `deliversFunctionalRequirementIds` + `deliversNonFunctionalRequirementIds`), because the
+ *   frontend resolves an FK field name to ONE resource — a mixed-kind array has no honest single
+ *   answer, and split fields read better anyway,
+ * - every field name below maps to exactly one target across ALL aspects (collision-audited at
+ *   generation; the parity test re-checks it).
+ *
+ * The `family` field is the artifact BACKLINK for free: it is the specification-artifacts
+ * resource's own field identifier, so the global field-identifier map already resolves it.
+ */
+/**
+ * How an aspect row gets its identity — mirrors the registry's `businessKey` contract.
+ *
+ * The three are not interchangeable and the fallback order between them is the point: a collection
+ * whose schema declares a single-field key is addressed by it, a singleton has one row per family so
+ * the aspect key IS the identity, and a keyless collection falls back to a positional address that is
+ * stable per landed snapshot and honest about carrying no business meaning.
+ */
+export declare enum WorkbenchAspectIdentityKind {
+    /** The item's own business key (`ref`, `taskRef`, …), unique within the aspect. */
+    BUSINESS_KEY = "business-key",
+    /** One row per family — identity is the aspect key itself. */
+    SINGLETON = "singleton",
+    /** Keyless collection (locale × jurisdictions): `<aspectKey>[<index>]`, stable per snapshot. */
+    INDEXED = "indexed"
+}
+export interface WorkbenchAspectEdgeDescriptor {
+    /** Envelope field carrying the reference key(s) — post-flatten, post-split. */
+    readonly field: string;
+    /** The registry aspect key the reference resolves to. */
+    readonly targetAspectKey: string;
+    /** `true` = key array; `false` = single key. */
+    readonly many: boolean;
+}
+export interface WorkbenchAspectDescriptor {
+    /** The registry aspect key (`market.icp`) — the parity test's join column. */
+    readonly aspectKey: string;
+    readonly resourceType: WorkbenchShared_ResourceType;
+    /** The introspection payload member this resource reads its rows from. */
+    readonly rowsPath: string;
+    readonly identity: WorkbenchAspectIdentityKind;
+    readonly edges: readonly WorkbenchAspectEdgeDescriptor[];
+}
+export declare const WORKBENCH_ASPECT_DESCRIPTORS: readonly WorkbenchAspectDescriptor[];
+export declare function getWorkbenchAspectDescriptor(aspectKey: string): WorkbenchAspectDescriptor | undefined;
+/**
+ * The shared envelope, instantiated per aspect with its identity field and reference fields.
+ *
+ * `content` stays a RAW record for the same reason the artifact resource's does: the spine never
+ * sees the item schemas; the workbench frontend renders `content` through the REAL `_core` schema
+ * from the registry, so typed rendering happens where the type authority is a dependency.
+ */
+export declare function buildWorkbenchAspectEnvelopeSchema(descriptor: WorkbenchAspectDescriptor): z.ZodObject<z.ZodRawShape>;
+type WorkbenchAspect_CoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST;
+/**
+ * One introspection resource-configuration factory per aspect, all from the same mold as their
+ * two siblings: READ/LIST only, `APPLICATION_STRUCTURE` tenancy, rows served by the companion's
+ * family-aspects behavior at this aspect's `rowsPath`. Identity is always the COMPOSED field the
+ * projection emits (see the identifier-map note in the types module).
+ */
+export declare function buildWorkbenchAspectConfigurationFactory(descriptor: WorkbenchAspectDescriptor): (resourcesRelationships: ResourceRelationship[]) => import("@wildo-ai/saas-models").ResourceConfiguration<undefined, WorkbenchAspect_CoreOperations, z.ZodObject<Readonly<{
+    [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+}>, z.core.$strip>>;
+/**
+ * Every aspect's relationships:
+ *
+ * - the STANDALONE application anchor each INTROSPECTION resource needs (primary scope derives
+ *   from it; STANDALONE keeps the route flat — the established pattern of its two siblings), and
+ * - one REFERENCE relationship per edge, carrying `foreignKeyField`: that is what teaches the
+ *   frontend's field-identifier map to resolve the envelope field to its target resource, which
+ *   is the entire navigation story (labels, popups, links) with no bespoke lookup anywhere.
+ */
+export declare function buildWorkbenchAspectRelationships(): ResourceRelationship[];
+/** The factory-map slice for all aspect resources — merged into the workbench map by its owner. */
+export declare const workbenchAspectResources_ConfigurationsFactoryMap: Record<string, ReturnType<typeof buildWorkbenchAspectConfigurationFactory>>;
+export {};
+//# sourceMappingURL=workbench-aspect-resources.custom.shared.schemas.d.ts.map

package/dist/esm/workbench/workbench-aspect-resources.custom.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workbench-aspect-resources.custom.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/workbench/workbench-aspect-resources.custom.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EAMrB,oBAAoB,EAKrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAEL,4BAA4B,EAC7B,MAAM,mDAAmD,CAAC;AAM3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;;GAOG;AACH,oBAAY,2BAA2B;IACrC,mFAAmF;IACnF,YAAY,iBAAiB;IAC7B,8DAA8D;IAC9D,SAAS,cAAc;IACvB,gGAAgG;IAChG,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAC;IACpD,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,6BAA6B,EAAE,CAAC;CAC1D;AAED,eAAO,MAAM,4BAA4B,EAAE,SAAS,yBAAyB,EAuX5E,CAAC;AAMF,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS,CAErG;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,yBAAyB,GACpC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAuC5B;AAED,KAAK,8BAA8B,GAAG,qBAAqB,CAAC,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC;AAE9F;;;;;GAKG;AACH,wBAAgB,wCAAwC,CAAC,UAAU,EAAE,yBAAyB,IAEpF,wBAAwB,oBAAoB,EAAE;;oBA6BvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,IAAI,oBAAoB,EAAE,CA8D1E;AAED,mGAAmG;AACnG,eAAO,MAAM,iDAAiD,EAAE,MAAM,CACpE,MAAM,EACN,UAAU,CAAC,OAAO,wCAAwC,CAAC,CAM5D,CAAC"}