npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.0 → 1.1.2 - Mend

@wildo-ai/saas-backend-lib 1.1.0 → 1.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (265) hide show

package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"infrastructure-tier-contract.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/infrastructure-tier-contract.backend.ts"],"names":[],"mappings":"AAAA~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG~~;AAEH;;;;;;;GAOG;AACH,oBAAY,kBAAkB;IAC5B,gGAAgG;IAChG,eAAe,oCAAoC;IACnD,gFAAgF;IAChF,SAAS,8BAA8B;IACvC,oFAAoF;IACpF,oBAAoB,sBAAsB;IAC1C,sEAAsE;IACtE,eAAe,oCAAoC;IACnD,qFAAqF;IACrF,WAAW,gCAAgC;IAC3C,yCAAyC;IACzC,uBAAuB,0BAA0B;IACjD,iEAAiE;IACjE,sBAAsB,yBAAyB;IAC/C,wCAAwC;IACxC,sBAAsB,yBAAyB;CAChD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,iCAAiC;IAC3C;;;OAGG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;OAWG;IACH,cAAc,kBAAkB;IAChC;;;;OAIG;IACH,iBAAiB,qBAAqB;IACtC;;;;;OAKG;IACH,cAAc,kBAAkB;IAChC;;;;OAIG;IACH,kBAAkB,qBAAqB;IACvC;;;OAGG;IACH,WAAW,eAAe;IAC1B;;;;;;;;;OASG;IACH,yBAAyB,6BAA6B;IACtD;;;;OAIG;IACH,kBAAkB,sBAAsB;CACzC;AAED,oBAAY,4BAA4B;IACtC,6CAA6C;IAC7C,SAAS,cAAc;IACvB,sFAAsF;IACtF,MAAM,WAAW;IACjB,mGAAmG;IACnG,cAAc,mBAAmB;CAClC;AAED;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GACxC;IAAE,OAAO,EAAE,4BAA4B,CAAC,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,OAAO,EAAE,4BAA4B,CAAC,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7F;IAAE,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;~~AAmI7E~~,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAC/C,kBAAkB,EAClB,MAAM,CAAC,iCAAiC,EAAE,gCAAgC,CAAC,~~CA0O5E~~,CAAC;AAIF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8CAA8C,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM3F,CAAC;AAEF;;;;;;;;GAQG;AACH,oBAAY,sCAAsC;IAChD,YAAY,gBAAgB;IAC5B,4BAA4B,+BAA+B;CAC5D;AAED,eAAO,MAAM,0CAA0C,EAAE,MAAM,CAC7D,sCAAsC,EACtC,MAAM,CAcP,CAAC"}
1	+ {"version":3,"file":"infrastructure-tier-contract.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/infrastructure-tier-contract.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH;;;;;;;GAOG;AACH,oBAAY,kBAAkB;IAC5B,gGAAgG;IAChG,eAAe,oCAAoC;IACnD,gFAAgF;IAChF,SAAS,8BAA8B;IACvC,oFAAoF;IACpF,oBAAoB,sBAAsB;IAC1C,sEAAsE;IACtE,eAAe,oCAAoC;IACnD,qFAAqF;IACrF,WAAW,gCAAgC;IAC3C,+DAA+D;IAC/D,WAAW,gCAAgC;IAC3C,yCAAyC;IACzC,uBAAuB,0BAA0B;IACjD,iEAAiE;IACjE,sBAAsB,yBAAyB;IAC/C,wCAAwC;IACxC,sBAAsB,yBAAyB;CAChD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,iCAAiC;IAC3C;;;OAGG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;OAWG;IACH,cAAc,kBAAkB;IAChC;;;;OAIG;IACH,iBAAiB,qBAAqB;IACtC;;;;;OAKG;IACH,cAAc,kBAAkB;IAChC;;;;OAIG;IACH,kBAAkB,qBAAqB;IACvC;;;OAGG;IACH,WAAW,eAAe;IAC1B;;;;;;;;;OASG;IACH,yBAAyB,6BAA6B;IACtD;;;;OAIG;IACH,kBAAkB,sBAAsB;CACzC;AAED,oBAAY,4BAA4B;IACtC,6CAA6C;IAC7C,SAAS,cAAc;IACvB,sFAAsF;IACtF,MAAM,WAAW;IACjB,mGAAmG;IACnG,cAAc,mBAAmB;CAClC;AAED;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GACxC;IAAE,OAAO,EAAE,4BAA4B,CAAC,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,OAAO,EAAE,4BAA4B,CAAC,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7F;IAAE,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAoI7E,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAC/C,kBAAkB,EAClB,MAAM,CAAC,iCAAiC,EAAE,gCAAgC,CAAC,CAyR5E,CAAC;AAIF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8CAA8C,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM3F,CAAC;AAEF;;;;;;;;GAQG;AACH,oBAAY,sCAAsC;IAChD,YAAY,gBAAgB;IAC5B,4BAA4B,+BAA+B;CAC5D;AAED,eAAO,MAAM,0CAA0C,EAAE,MAAM,CAC7D,sCAAsC,EACtC,MAAM,CAcP,CAAC"}

package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.js CHANGED Viewed

@@ -6,8 +6,13 @@
  *
  * The infrastructure tier is a deliberate bypass: its doors sit BELOW the service tier, take a
  * pre-built filter or an already-final document, and run no declared operation and no authorization.
- * Its clearest warrant is field-uniqueness validation, which runs INSIDE an in-flight operation's own
- * validation, where routing back through a declared operation would be circular.
+ * Its clearest warrant is the field-uniqueness check behind the `validate-field` route. A field
+ * declared unique with `scope: 'global'` must be counted across the ENTIRE collection — "no additional
+ * filter (intentional — check entire collection)" — including tenants the caller cannot see, and the
+ * answer returned as nothing but a number. A declared operation cannot serve that: `buildContextualFilter`
+ * would scope the count to the caller's tenant and the answer would simply be wrong. So the door
+ * deliberately waives tenant scoping and deliberately does NOT waive the retention hide, because
+ * counting a hidden row would turn the same number into an existence oracle.
  *
  * Its WEAKEST warrant is the one the tier has most often cited, and issue #100 asked for it to be
  * settled: "a consumable token is minted by a system action and consumed BEFORE authentication, so
@@ -17,7 +22,14 @@
  * fail-closes unless the resource opts in with `systemAccessPolicy.create = ALLOWED`, synthesises an
  * APPLICATION-scope super-admin context, and dispatches the resource's OWN declared CREATE —
  * which `CONSUMABLE_TOKENS` declares. So the framework does not owe a new "system principal"
- * vocabulary; one door is not using the one that exists. See `INSERT_DOCUMENT / authorization` below.
+ * vocabulary.
+ *
+ * That settles the FRAMEWORK question and deliberately does not settle the CALLER's: this door turns
+ * out to have a second, stronger reason to bypass the declared pipeline. `createsOneOffSession` is
+ * sealed `.excludeFromCreate()` so that no repository-create path can mint a session-establishing
+ * token, which is what makes `createToken` the sole minter and therefore the single funnel enforcing
+ * the impersonation-credential lifetime ceiling. A raw door is the shape that seal depends on. See
+ * `INSERT_DOCUMENT / authorization` below, and issue #102.
  *
  * What was missing is not correctness, it is a CONTRACT. Each door carried its own hand-written prose
  * about which cross-cutting invariant it upheld and which it skipped, so the tier's posture existed
@@ -31,10 +43,10 @@
  * EITHER enum fails to compile until every new cell is filled in. That is the property this file is
  * for: the missing case becomes a compiler error rather than something a reviewer has to notice.
  *
- * ## The tier is EIGHT doors, not the four that share a name
+ * ## The tier is NINE doors, not the four that share a name
  *
  * Issue #100 listed four, all suffixed `*ForInfrastructure`. That is the population the SUFFIX
- * describes, and it is half the tier. Four more handler members have the identical posture under a
+ * describes, and it was half the tier. Four more handler members have the identical posture under a
  * different name — `atomicIncrementField` and `atomicConditionalSet` carry, verbatim, the same
  * `@internal Framework-internal infrastructure primitive — NOT part of the operation lifecycle. The
  * caller owns authorization, scope-aware filter construction, and audit logging.` that the suffixed
@@ -81,6 +93,8 @@ export var InfrastructureDoor;
     InfrastructureDoor["INSERT_DOCUMENT"] = "insertDocumentForInfrastructure";
     /** Multi-row guarded write (token revocation by relatedId, usage-record marking). */
     InfrastructureDoor["BULK_UPDATE"] = "bulkUpdateForInfrastructure";
+    /** Multi-row DELETE (the consumable-token retention sweep). */
+    InfrastructureDoor["DELETE_MANY"] = "deleteManyForInfrastructure";
     /** Single-row compare-and-swap write. */
     InfrastructureDoor["ATOMIC_GUARDED_MUTATION"] = "atomicGuardedMutation";
     /** Single-row counter increment (metering, quota accounting). */
@@ -104,7 +118,7 @@ export var InfrastructureDoor;
  *    it, and the family has broken it in production (retention hide, transaction participation,
  *    adapter neutrality).
  *
- * This set is OPEN. Adding a member is the point: it immediately breaks compilation at all eight doors
+ * This set is OPEN. Adding a member is the point: it immediately breaks compilation at every door
  * until each declares a posture. Candidates DELIBERATELY excluded are recorded as data in
  * {@link INFRASTRUCTURE_CONCERN_CANDIDATES_EXCLUDED} rather than left absent — an absence is
  * indistinguishable from an oversight, which is the shape this whole file is about.
@@ -187,7 +201,7 @@ const { AUTHORIZATION, TENANT_SCOPING, SCHEMA_VALIDATION, RETENTION_HIDE, RAG_IN
 // written at the door — moved from that door's JSDoc rather than paraphrased, so the rationale exists
 // in exactly one place and cannot drift from the copy it was summarised into.
 /**
- * Identical at all eight doors. The placement note is the real mitigation: these members live on the
+ * Identical at every door. The placement note is the real mitigation: these members live on the
  * HANDLER and not on the `BackendResourceRepository` interface an application's custom code is handed.
  */
 const AUTHORIZATION_WAIVED = {
@@ -198,7 +212,7 @@ const AUTHORIZATION_WAIVED = {
     compensation: 'Declared on the handler rather than on the `BackendResourceRepository` interface, so custom '
         + 'application code cannot reach these doors through the repository it is given.',
 };
-/** Identical at all eight doors: the caller's filter or document is the whole confinement. */
+/** Identical at every door: the caller's filter or document is the whole confinement. */
 const TENANT_SCOPING_WAIVED = {
     posture: WAIVED,
     reason: 'The adapters\' `buildContextualFilter` — which injects the resource\'s scope FK — runs on the '
@@ -209,7 +223,7 @@ const TENANT_SCOPING_WAIVED = {
         + 'reached today only by field-uniqueness validation, consumable tokens and usage metering, each '
         + 'of which builds its own filter. Nothing mechanical enforces that on a future caller.',
 };
-/** Identical at all eight doors: the door emits nothing, and nothing downstream substitutes for it. */
+/** Identical at every door: the door emits nothing, and nothing downstream substitutes for it. */
 const AUDIT_TRAIL_WAIVED = {
     posture: WAIVED,
     reason: 'No operation lifecycle runs, so no auditable event is emitted by the door itself.',
@@ -226,8 +240,8 @@ const RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ = {
     reason: 'Read-only: writes nothing, so no `.ragSource()` field can change through it.',
 };
 /**
- * The five write doors, minus {@link InfrastructureDoor.INSERT_DOCUMENT}, which has its own partial
- * compensation (the cast).
+ * The pre-built WRITE doors, minus {@link InfrastructureDoor.INSERT_DOCUMENT}, which has its own partial
+ * compensation (the cast), and minus {@link InfrastructureDoor.DELETE_MANY}, which materializes no value.
  */
 const SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE = {
     posture: WAIVED,
@@ -237,7 +251,7 @@ const SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE = {
     compensation: 'Shape only, never values: `describeGuardedMutationInexpressibility` refuses a mutation that '
         + 'cannot be expressed on every adapter. Nothing checks what the mutation SAYS.',
 };
-/** Seven of the eight doors accept `RepositoryOptions` and forward them unchanged. */
+/** Every door but {@link InfrastructureDoor.COUNT_DOCUMENTS} accepts `RepositoryOptions` and forwards them unchanged. */
 const TRANSACTION_PARTICIPATION_PRESERVED = {
     posture: PRESERVED,
     how: 'Accepts `RepositoryOptions` and forwards them to the primitive, so a caller already inside a '
@@ -246,7 +260,8 @@ const TRANSACTION_PARTICIPATION_PRESERVED = {
 /**
  * The four doors whose only adapter-neutrality claim is that they dispatch a primitive declared on the
  * `BackendResourceRepository` interface — so an adapter omitting one fails to compile rather than
- * throwing on first use. All eight raw primitives are declared there and implemented on both arms.
+ * throwing on first use. Every raw primitive is declared there and implemented on both persisting arms
+ * (the read-only HTTP-API and introspection arms declare each one as an explicit refusal).
  */
 const ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT = (primitive) => ({
     posture: PRESERVED,
@@ -267,8 +282,8 @@ const RETENTION_HIDE_PRESERVED_AT_DISPATCH = (consequence) => ({
         + 'a future adapter inherits the predicate by construction.',
 });
 /**
- * The five write doors' RAG posture, identical in mechanism and differing only in what the sweep
- * reconciles for that door's shape. Moved from each door's own `rag-ingestion-gate: N/A —` comment,
+ * The materializing write doors' RAG posture, identical in mechanism and differing only in what the
+ * sweep reconciles for that door's shape. Moved from each door's own `rag-ingestion-gate: N/A —` comment,
  * which the sibling guard `rag-ingestion-write-door-coverage.guard.test.ts` still requires to be
  * present AT the door; that guard checks the waiver EXISTS, this table records what it says.
  */
@@ -294,16 +309,15 @@ export const INFRASTRUCTURE_TIER_CONTRACT = {
         [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,
         [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,
         [TRANSACTION_PARTICIPATION]: {
-            posture: WAIVED,
-            reason: 'THE ONE DOOR THAT CANNOT PARTICIPATE, and not by decision: it accepts no `RepositoryOptions` '
-                + 'parameter at all, so a caller inside a transaction counts OUTSIDE it and cannot see its own '
-                + 'uncommitted rows. `countByRawFilter` accepts and honours options on both arms; only this '
-                + 'door drops them — the identical shape its sibling `bulkUpdateForInfrastructure` records as '
-                + '"a silent correctness hole", at the one door nobody enumerated. Surfaced by filling this '
-                + 'table, deliberately recorded rather than repaired here: fixing a door inside the change that '
-                + 'declares the contract would hide the demonstration that the contract works. Filed as issue '
-                + '#104; flip this cell to PRESERVED when it lands.',
-            compensation: null,
+            posture: PRESERVED,
+            how: 'Accepts `RepositoryOptions` and forwards them to `countByRawFilter`, matching all seven '
+                + 'siblings. It was the ONE door in the tier that accepted none, so a caller inside a '
+                + 'transaction counted OUTSIDE it — the identical shape `bulkUpdateForInfrastructure` records '
+                + 'as a silent correctness hole, at the door nobody enumerated until this table gave every '
+                + 'door a row to fill in. Surfaced by filling the table (issue #104), fixed separately from '
+                + 'the change that declared the contract so the demonstration stayed visible. No caller passes '
+                + 'options today, so the forward is pinned rather than behaviour-verified: '
+                + '`__tests__/infrastructure-tier-transaction-forwarding.test.ts`.',
         },
         [ADAPTER_NEUTRALITY]: {
             posture: PRESERVED,
@@ -354,13 +368,18 @@ export const INFRASTRUCTURE_TIER_CONTRACT = {
                 + '(INTERNAL_CALL, ORG_ADMIN, with a requestDto). Routing through it would restore schema '
                 + 'validation, the RAG ingestion hook, the audit trail and the scope-context channel at this '
                 + 'door — five of the eight rows below stop being waivers.',
-            compensation: 'Handler-only placement, as for every door here. What stops the migration is narrow and '
-                + 'specific rather than principled — the declared requestDto omits the `_id`, `createdAt` and '
-                + '`updatedAt` this caller supplies deliberately; `CONSUMABLE_TOKENS` declares no '
-                + '`systemAccessPolicy`, so `createAsSystem` fail-closes today; the declared variant is gated '
-                + 'on ORG_ADMIN at organization scope, which a signup-time magic-link mint does not have; and '
-                + 'the caller reads the raw duplicate-key error to detect an `activeGenerationKey` conflict. '
-                + 'Tracked as issue #102 — the decision to migrate the caller — rather than answered here.',
+            compensation: 'Handler-only placement, as for every door here — AND, at this door only, a deliberate '
+                + 'security seal that makes the raw insert load-bearing rather than incidental. '
+                + '`createsOneOffSession` is `.excludeFromCreate().excludeFromUpdate()` so that no '
+                + 'repository-create path can mint a session-establishing token, which leaves `createToken` — '
+                + 'this door\'s caller — the SOLE minter and therefore the single funnel enforcing '
+                + '`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` fail-closed at issuance. That token is an '
+                + 'impersonation credential: exchanging it mints a JWT session for another user. Routing the '
+                + 'mint through `createAsSystem` would strip the field (measured: the preserve list resolves to '
+                + '`["organizationId","userId"]`, because a defaulted excluded field is deliberately withheld) '
+                + 'and silently mint every such token as non-session-establishing; relaxing the exclusion to '
+                + 'fix that would open a second mint path that never meets the ceiling. So the waiver here is '
+                + 'not an unpaid debt — it is the shape the credential ceiling depends on. See issue #102.',
         },
         [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,
         [SCHEMA_VALIDATION]: {
@@ -415,6 +434,43 @@ export const INFRASTRUCTURE_TIER_CONTRACT = {
                 + 'not be bulk-updated at all.',
         },
     },
+    [InfrastructureDoor.DELETE_MANY]: {
+        [AUTHORIZATION]: AUTHORIZATION_WAIVED,
+        [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,
+        [SCHEMA_VALIDATION]: {
+            posture: NOT_APPLICABLE,
+            reason: 'A DELETE writes no value, so there is nothing for a declared schema to validate. This is the '
+                + 'one WRITE door for which the concern is genuinely inapplicable rather than waived — its '
+                + 'siblings all carry a pre-built payload a schema could have checked and did not.',
+        },
+        [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH('a retained (erased-but-kept) row is immutable, and DESTROYING one is the sharpest form of '
+            + 'mutating it — the retention posture exists precisely to keep a row that must be kept, so a '
+            + 'framework sweep must not be the thing that reaps it.'),
+        [RAG_INGESTION_GATE]: {
+            posture: NOT_APPLICABLE,
+            reason: 'Materializes no value, so no `.ragSource()` field can change through it and there is nothing '
+                + 'to re-index. The mirror obligation — REMOVING a deleted row\'s chunks — is not this concern '
+                + 'and is not owned here either: the removal-seam guard '
+                + '(`rag-chunk-removal-seam-coverage.guard.test.ts`) excludes the raw repository doors BY '
+                + 'DECLARATION, bounding every one of them on the hourly reconciliation sweep\'s orphan pass, '
+                + 'and this door joins that family rather than opening a new question.',
+        },
+        [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,
+        [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,
+        [ADAPTER_NEUTRALITY]: {
+            posture: PRESERVED,
+            how: 'Dispatches the interface-declared `deleteManyByRawFilter`, so an adapter that omits it fails '
+                + 'to compile. THE DOOR EXISTS BECAUSE ITS ABSENCE WAS THE DEFECT: with a bulk UPDATE on the '
+                + 'tier and no bulk DELETE, the consumable-tokens cleanup batch had one route to reap rows — '
+                + 'reaching past the contract for `MongoDBService.getConnection()` — which made the framework\'s '
+                + 'only credential-retention sweep MongoDB-only. It was invisible while every application ran a '
+                + 'mongod beside PostgreSQL, and failed every six hours on the first one (`wonder-crm`) that '
+                + 'did not, with spent password-reset / invitation / magic-link rows accumulating with no '
+                + 'sweep. Note the neutrality this door CANNOT confer: an unexpressible predicate (`$expr`, a '
+                + 'column-to-column comparison) is still the caller\'s problem, and the batch resolves its one '
+                + 'such lane by reading candidates and comparing in memory.',
+        },
+    },
     [InfrastructureDoor.ATOMIC_GUARDED_MUTATION]: {
         [AUTHORIZATION]: AUTHORIZATION_WAIVED,
         [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,

package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"infrastructure-tier-contract.backend.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/infrastructure-tier-contract.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kBAiBX;AAjBD,WAAY,kBAAkB;IAC5B,gGAAgG;IAChG,yEAAmD,CAAA;IACnD,gFAAgF;IAChF,6DAAuC,CAAA;IACvC,oFAAoF;IACpF,gEAA0C,CAAA;IAC1C,sEAAsE;IACtE,yEAAmD,CAAA;IACnD,qFAAqF;IACrF,iEAA2C,CAAA;IAC3C,yCAAyC;IACzC,uEAAiD,CAAA;IACjD,iEAAiE;IACjE,qEAA+C,CAAA;IAC/C,wCAAwC;IACxC,qEAA+C,CAAA;AACjD,CAAC,EAjBW,kBAAkB,KAAlB,kBAAkB,QAiB7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,iCA4DX;AA5DD,WAAY,iCAAiC;IAC3C;;;OAGG;IACH,oEAA+B,CAAA;IAC/B;;;;;;;;;;;OAWG;IACH,qEAAgC,CAAA;IAChC;;;;OAIG;IACH,2EAAsC,CAAA;IACtC;;;;;OAKG;IACH,qEAAgC,CAAA;IAChC;;;;OAIG;IACH,4EAAuC,CAAA;IACvC;;;OAGG;IACH,+DAA0B,CAAA;IAC1B;;;;;;;;;OASG;IACH,2FAAsD,CAAA;IACtD;;;;OAIG;IACH,6EAAwC,CAAA;AAC1C,CAAC,EA5DW,iCAAiC,KAAjC,iCAAiC,QA4D5C;AAED,MAAM,CAAN,IAAY,4BAOX;AAPD,WAAY,4BAA4B;IACtC,6CAA6C;IAC7C,uDAAuB,CAAA;IACvB,sFAAsF;IACtF,iDAAiB,CAAA;IACjB,mGAAmG;IACnG,iEAAiC,CAAA;AACnC,CAAC,EAPW,4BAA4B,KAA5B,4BAA4B,QAOvC;AAYD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,4BAA4B,CAAC;AAC3E,MAAM,EACJ,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,yBAAyB,EACzB,kBAAkB,GACnB,GAAG,iCAAiC,CAAC;AAEtC,oGAAoG;AACpG,mGAAmG;AACnG,sGAAsG;AACtG,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,oBAAoB,GAAqC;IAC7D,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,+FAA+F;UAC7F,+FAA+F;UAC/F,yBAAyB;IAC7B,YAAY,EACV,8FAA8F;UAC5F,+EAA+E;CACpF,CAAC;AAEF,8FAA8F;AAC9F,MAAM,qBAAqB,GAAqC;IAC9D,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,gGAAgG;UAC9F,4FAA4F;UAC5F,8FAA8F;UAC9F,oCAAoC;IACxC,YAAY,EACV,iGAAiG;UAC/F,gGAAgG;UAChG,sFAAsF;CAC3F,CAAC;AAEF,uGAAuG;AACvG,MAAM,kBAAkB,GAAqC;IAC3D,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,mFAAmF;IAC3F,YAAY,EAAE,IAAI;CACnB,CAAC;AAEF,gGAAgG;AAChG,MAAM,wCAAwC,GAAqC;IACjF,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,oFAAoF;CAC7F,CAAC;AAEF,4BAA4B;AAC5B,MAAM,yCAAyC,GAAqC;IAClF,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,8EAA8E;CACvF,CAAC;AAEF;;;GAGG;AACH,MAAM,wCAAwC,GAAqC;IACjF,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,8FAA8F;UAC5F,iGAAiG;UACjG,+CAA+C;IACnD,YAAY,EACV,8FAA8F;UAC5F,8EAA8E;CACnF,CAAC;AAEF,sFAAsF;AACtF,MAAM,mCAAmC,GAAqC;IAC5E,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,+FAA+F;UAC7F,mEAAmE;CACxE,CAAC;AAEF;;;;GAIG;AACH,MAAM,wCAAwC,GAAG,CAAC,SAAiB,EAAoC,EAAE,CAAC,CAAC;IACzG,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,gBAAgB,SAAS,2EAA2E;UAClG,6FAA6F;UAC7F,uFAAuF;CAC5F,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,oCAAoC,GAAG,CAAC,WAAmB,EAAoC,EAAE,CAAC,CAAC;IACvG,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,oFAAoF,WAAW,GAAG;UAChG,mGAAmG;UACnG,0DAA0D;CAC/D,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,kCAAkC,GAAG,CAAC,KAAa,EAAoC,EAAE,CAAC,CAAC;IAC/F,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,8FAA8F;UAC5F,0EAA0E;IAC9E,YAAY,EAAE,wCAAwC,KAAK,EAAE;CAC9D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAGrC;IACF,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE;QACpC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,2FAA2F;kBACzF,4FAA4F;kBAC5F,8FAA8F;kBAC9F,6FAA6F;kBAC7F,0CAA0C;SAC/C;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE;YAC3B,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,+FAA+F;kBAC7F,8FAA8F;kBAC9F,2FAA2F;kBAC3F,6FAA6F;kBAC7F,2FAA2F;kBAC3F,+FAA+F;kBAC/F,6FAA6F;kBAC7F,kDAAkD;YACtD,YAAY,EAAE,IAAI;SACnB;QACD,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,4FAA4F;kBAC5F,6FAA6F;kBAC7F,uBAAuB;SAC5B;KACF;IAED,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC9B,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,mGAAmG;cACjG,gBAAgB,CACnB;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE,wCAAwC,CAAC,qBAAqB,CAAC;KACtF;IAED,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE;QACzC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,0FAA0F;kBACxF,oFAAoF;YACxF,YAAY,EACV,6FAA6F;kBAC3F,kFAAkF;kBAClF,6DAA6D;SAClE;QACD,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,gGAAgG;cAC9F,iBAAiB,CACpB;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE,wCAAwC,CAAC,mBAAmB,CAAC;KACpF;IAED,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE;QACpC,CAAC,aAAa,CAAC,EAAE;YACf,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,8FAA8F;kBAC5F,4FAA4F;kBAC5F,2FAA2F;kBAC3F,4FAA4F;kBAC5F,6FAA6F;kBAC7F,wFAAwF;kBACxF,yFAAyF;kBACzF,4FAA4F;kBAC5F,yDAAyD;YAC7D,YAAY,EACV,yFAAyF;kBACvF,6FAA6F;kBAC7F,iFAAiF;kBACjF,6FAA6F;kBAC7F,6FAA6F;kBAC7F,4FAA4F;kBAC5F,yFAAyF;SAC9F;QACD,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE;YACnB,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,+FAA+F;kBAC7F,wFAAwF;kBACxF,0FAA0F;kBAC1F,6CAA6C;YACjD,YAAY,EACV,sFAAsF;kBACpF,6FAA6F;kBAC7F,yFAAyF;kBACzF,0CAA0C;SAC/C;QACD,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,cAAc;YACvB,MAAM,EACJ,+FAA+F;kBAC7F,iEAAiE;SACtE;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,4CAA4C,CAC7C;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,iGAAiG;kBAC/F,gGAAgG;kBAChG,oFAAoF;kBACpF,8FAA8F;kBAC9F,yDAAyD;SAC9D;KACF;IAED,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE;QAChC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,oGAAoG;cAClG,mCAAmC,CACtC;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,gEAAgE,CACjE;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE;YAC3B,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,qFAAqF;kBACrF,gGAAgG;kBAChG,8FAA8F;kBAC9F,kDAAkD;SACvD;QACD,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,8FAA8F;kBAC9F,gGAAgG;kBAChG,6BAA6B;SAClC;KACF;IAED,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,EAAE;QAC5C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,4EAA4E,CAC7E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,+DAA+D,CAChE;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,6FAA6F;kBAC3F,8FAA8F;kBAC9F,kCAAkC;SACvC;KACF;IAED,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE;QAC3C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,8EAA8E,CAC/E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,8FAA8F;cAC5F,oBAAoB,CACvB;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,kGAAkG;kBAChG,8FAA8F;kBAC9F,+FAA+F;kBAC/F,6FAA6F;kBAC7F,sCAAsC;SAC3C;KACF;IAED,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE;QAC3C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,8EAA8E,CAC/E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,2FAA2F,CAC5F;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,yFAAyF;kBACvF,8FAA8F;kBAC9F,4FAA4F;kBAC5F,uFAAuF;kBACvF,0FAA0F;kBAC1F,kFAAkF;SACvF;KACF;CACF,CAAC;AAEF,oGAAoG;AAEpG;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAqC;IAC9F,oBAAoB,EAClB,kGAAkG;UAChG,6FAA6F;UAC7F,2FAA2F;UAC3F,0BAA0B;CAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,sCAGX;AAHD,WAAY,sCAAsC;IAChD,sEAA4B,CAAA;IAC5B,qGAA2D,CAAA;AAC7D,CAAC,EAHW,sCAAsC,KAAtC,sCAAsC,QAGjD;AAED,MAAM,CAAC,MAAM,0CAA0C,GAGnD;IACF,CAAC,sCAAsC,CAAC,YAAY,CAAC,EACnD,8FAA8F;UAC5F,mGAAmG;UACnG,kGAAkG;UAClG,kDAAkD;IACtD,CAAC,sCAAsC,CAAC,4BAA4B,CAAC,EACnE,qGAAqG;UACnG,+FAA+F;UAC/F,mGAAmG;UACnG,kGAAkG;UAClG,+FAA+F;UAC/F,6DAA6D;CAClE,CAAC","sourcesContent":["/*\n The contract every INFRASTRUCTURE-TIER door on {@link RepositoriesRegistryHandlerBackendService}\n * answers to.\n \n ## Why this file exists\n \n The infrastructure tier is a deliberate bypass: its doors sit BELOW the service tier, take a\n * pre-built filter or an already-final document, and run no declared operation and no authorization.\n * Its clearest warrant is field-uniqueness validation, which runs INSIDE an in-flight operation's own\n * validation, where routing back through a declared operation would be circular.\n \n Its WEAKEST warrant is the one the tier has most often cited, and issue #100 asked for it to be\n * settled: \"a consumable token is minted by a system action and consumed BEFORE authentication, so\n * there is genuinely no principal to authorize\". That conflates two moments. CONSUMPTION has no\n * principal — the token IS the credential. MINTING is a write the running system performs inside a\n * flow it controls, and the framework already has a vocabulary for exactly that: `createAsSystem`\n * fail-closes unless the resource opts in with `systemAccessPolicy.create = ALLOWED`, synthesises an\n * APPLICATION-scope super-admin context, and dispatches the resource's OWN declared CREATE —\n * which `CONSUMABLE_TOKENS` declares. So the framework does not owe a new \"system principal\"\n * vocabulary; one door is not using the one that exists. See `INSERT_DOCUMENT / authorization` below.\n \n What was missing is not correctness, it is a CONTRACT. Each door carried its own hand-written prose\n * about which cross-cutting invariant it upheld and which it skipped, so the tier's posture existed\n * only as a set of independent rationales. Adding a door, or a new invariant, meant re-deriving the\n * obligation by hand at every site with nothing mechanical to say whether it had been done — the exact\n * failure shape `.claude/rules/invariant-call-site-enumeration.md` records, where an invariant is\n * applied at one of its N sites and the miss is invisible.\n \n So the posture is DECLARED here instead, once, as data. Because the table is typed\n * `Record<InfrastructureDoor, Record<InfrastructureCrossCuttingConcern, …>>`, adding a member to\n * EITHER enum fails to compile until every new cell is filled in. That is the property this file is\n * for: the missing case becomes a compiler error rather than something a reviewer has to notice.\n \n ## The tier is EIGHT doors, not the four that share a name\n \n Issue #100 listed four, all suffixed `ForInfrastructure`. That is the population the SUFFIX\n describes, and it is half the tier. Four more handler members have the identical posture under a\n * different name — `atomicIncrementField` and `atomicConditionalSet` carry, verbatim, the same\n * `@internal Framework-internal infrastructure primitive — NOT part of the operation lifecycle. The\n * caller owns authorization, scope-aware filter construction, and audit logging.` that the suffixed\n * doors carry; `atomicGuardedMutation` and `readUnscopedByKey` likewise dispatch a caller-built filter\n * straight to an adapter with no operation above them.\n \n That is why {@link INFRASTRUCTURE_TIER_CONTRACT}'s pin discovers the tier by what a member DOES —\n * resolving a repository and dispatching to it — rather than by what it is called. Enumerating by name\n * finds every site that agrees with you about naming, which is `invariant-call-site-enumeration.md`\n * #12 and #20 in one. The sibling guard `rag-ingestion-write-door-coverage.guard.test.ts` had already\n * reached the same population from the write side: three of its five raw write doors carry no suffix.\n \n ## What this file is NOT\n \n It does not gate anything at runtime. A door's behaviour lives in the door; this is the record of\n * what that behaviour promises, kept adjacent and kept complete. Turning it into a runtime guard would\n * add a second authority that can disagree with the code, which is the failure this repository has\n * paid for repeatedly (see `.claude/rules/one-source-of-truth.md`).\n \n It is also not a place to fix a door. Filling the table surfaced one real asymmetry — see\n * {@link InfrastructureCrossCuttingConcern.TRANSACTION_PARTICIPATION} at\n * {@link InfrastructureDoor.COUNT_DOCUMENTS} — and it is RECORDED here rather than quietly repaired,\n * because a waiver nobody can see is the condition this contract exists to end.\n \n @see issue #100 — the decision this file implements.\n /\n\n/\n The doors.\n \n Each value is the METHOD NAME on the handler, deliberately, so\n * `__tests__/infrastructure-tier-contract.guard.test.ts` can discover the real tier from the handler's\n * source and assert this enum matches it exactly. A hand-maintained list that merely LOOKS complete is\n * what this file exists to prevent, so the list is checked against the class rather than trusted.\n /\nexport enum InfrastructureDoor {\n /* Backs field-uniqueness validation, which runs INSIDE an in-flight operation's validation. /\n COUNT_DOCUMENTS = 'countDocumentsForInfrastructure',\n /* Multi-row read for a framework-internal reader (consumable-token lookup). /\n FIND_MANY = 'findManyForInfrastructure',\n /* Single-row read below BOTH the operation tier and the execution-context tier. /\n READ_UNSCOPED_BY_KEY = 'readUnscopedByKey',\n /* INSERT of an already-final document (consumable-token minting). /\n INSERT_DOCUMENT = 'insertDocumentForInfrastructure',\n /* Multi-row guarded write (token revocation by relatedId, usage-record marking). /\n BULK_UPDATE = 'bulkUpdateForInfrastructure',\n /* Single-row compare-and-swap write. /\n ATOMIC_GUARDED_MUTATION = 'atomicGuardedMutation',\n /* Single-row counter increment (metering, quota accounting). /\n ATOMIC_INCREMENT_FIELD = 'atomicIncrementField',\n /* Single-row conditional set/clear. /\n ATOMIC_CONDITIONAL_SET = 'atomicConditionalSet',\n}\n\n/\n The cross-cutting invariants a door must answer for explicitly.\n \n ## The admission criterion, so the next member is not settled by taste\n \n A concern belongs here when it is an invariant that holds across the whole persistence boundary AND\n * a door can silently fail to uphold it. Members arrive on one of two bases, and each member's own\n * doc-comment names which:\n \n - conferred from above — an ordinary declared operation gets it for free at the controller or\n * service tier, and a door that runs no operation therefore does not (authorization, tenant\n * scoping, schema validation, the RAG ingestion gate, the audit trail);\n * - promised by the door itself — nothing above confers it; the door's own general name promises\n * it, and the family has broken it in production (retention hide, transaction participation,\n * adapter neutrality).\n \n This set is OPEN. Adding a member is the point: it immediately breaks compilation at all eight doors\n * until each declares a posture. Candidates DELIBERATELY excluded are recorded as data in\n * {@link INFRASTRUCTURE_CONCERN_CANDIDATES_EXCLUDED} rather than left absent — an absence is\n * indistinguishable from an oversight, which is the shape this whole file is about.\n /\nexport enum InfrastructureCrossCuttingConcern {\n /\n CONFERRED FROM ABOVE. Who may do this. The controller resolves it from the declared operation's\n * roles and variant; these doors run no operation, so nothing resolves a principal.\n /\n AUTHORIZATION = 'authorization',\n /\n CONFERRED FROM ABOVE. Which TENANT'S rows this statement may reach. The adapters' own\n * `buildContextualFilter` injects the scope FK (organizationId / userId) into every operation-tier\n * filter; the raw primitives these doors dispatch deliberately do not call it — \"the caller's filter\n * is the whole confinement, by design\".\n \n Distinct from {@link AUTHORIZATION} on purpose, and the distinction is the tier's own: the handler\n * states at `readUnscopedByKey` that \"a read that skips tenant scoping must NOT also skip erasure\n * retention: those are different questions\". Roles and rows are two gates, answered from two inputs,\n * and fusing them is what `.claude/rules/administrative-continuity-floors.md` records as producing\n * cross-tenant reach nobody declared.\n /\n TENANT_SCOPING = 'tenantScoping',\n /\n CONFERRED FROM ABOVE. That a written value was checked against a declared schema. The controller's\n * `validateRequestData` parses the payload through the operation's `requestDto` before any write;\n * these doors take an already-built document or mutation descriptor and no Zod schema sees it.\n /\n SCHEMA_VALIDATION = 'schemaValidation',\n /\n PROMISED BY THE DOOR. An erased-but-retained row must stay invisible to reads and unaffected by\n * writes — \"kept but frozen\". The tier applies it at its own single dispatch point\n * (`applyRetentionHideToRawFilter`) rather than in each adapter, so a future adapter inherits it by\n * construction.\n /\n RETENTION_HIDE = 'retentionHide',\n /\n CONFERRED FROM ABOVE. A `.ragSource()` field changing must re-derive the affected chunk set. The\n * hook lives at the service tier's single post-commit chokepoint, which is ABOVE these doors, so no\n * door can feed it.\n /\n RAG_INGESTION_GATE = 'ragIngestionGate',\n /\n CONFERRED FROM ABOVE. A security-relevant action must leave an auditable record. The operation\n * lifecycle emits it; no lifecycle runs here.\n /\n AUDIT_TRAIL = 'auditTrail',\n /\n PROMISED BY THE DOOR. A statement issued inside a caller's transaction must ENROL in it. Every\n * underlying primitive accepts `RepositoryOptions` and both adapters honour it, so whether a door\n * participates is decided entirely by whether the door accepts and forwards them.\n \n This is a member because the family has already lost it once, silently and expensively:\n * `bulkUpdateForInfrastructure` neither accepted nor forwarded options, so `revokeTokensByRelatedId`\n * committed immediately regardless of its caller's transaction and a driver retry observed a count\n * of 0 for work that had happened exactly once.\n /\n TRANSACTION_PARTICIPATION = 'transactionParticipation',\n /\n PROMISED BY THE DOOR. A generally-named capability must work on every persistence adapter, not\n * only the one it was written against. A member here is one the family has broken twice — both\n * breakages were a reach for `(repository as any).mongooseModel` behind a neutral-sounding name.\n /\n ADAPTER_NEUTRALITY = 'adapterNeutrality',\n}\n\nexport enum InfrastructureConcernPosture {\n /* The door itself upholds the invariant. /\n PRESERVED = 'preserved',\n /* The invariant could apply and deliberately is not upheld. A reason is required. /\n WAIVED = 'waived',\n /* The invariant cannot apply to this door's shape at all (e.g. a retention hide on an INSERT). /\n NOT_APPLICABLE = 'not-applicable',\n}\n\n/\n `compensation` is the field that makes a waiver reviewable: it names what ELSE catches the gap, or\n * is `null` to state plainly that nothing does. A waiver with no compensation is not forbidden — it is\n * simply visible, which is the whole ask of issue #100.\n /\nexport type InfrastructureConcernDeclaration =\n \| { posture: InfrastructureConcernPosture.PRESERVED; how: string }\n \| { posture: InfrastructureConcernPosture.WAIVED; reason: string; compensation: string \| null }\n \| { posture: InfrastructureConcernPosture.NOT_APPLICABLE; reason: string };\n\nconst { PRESERVED, WAIVED, NOT_APPLICABLE } = InfrastructureConcernPosture;\nconst {\n AUTHORIZATION,\n TENANT_SCOPING,\n SCHEMA_VALIDATION,\n RETENTION_HIDE,\n RAG_INGESTION_GATE,\n AUDIT_TRAIL,\n TRANSACTION_PARTICIPATION,\n ADAPTER_NEUTRALITY,\n} = InfrastructureCrossCuttingConcern;\n\n// ── Declarations shared verbatim across doors ────────────────────────────────────────────────────\n// Written once where the reason is genuinely the same one. Where a door's reason is its own, it is\n// written at the door — moved from that door's JSDoc rather than paraphrased, so the rationale exists\n// in exactly one place and cannot drift from the copy it was summarised into.\n\n/\n Identical at all eight doors. The placement note is the real mitigation: these members live on the\n * HANDLER and not on the `BackendResourceRepository` interface an application's custom code is handed.\n /\nconst AUTHORIZATION_WAIVED: InfrastructureConcernDeclaration = {\n posture: WAIVED,\n reason:\n 'Below the service tier: no declared operation runs, so there is no principal to resolve. The '\n + 'caller authorizes before calling; `executionContext` here is error context only and is never '\n + 'read for authorization.',\n compensation:\n 'Declared on the handler rather than on the `BackendResourceRepository` interface, so custom '\n + 'application code cannot reach these doors through the repository it is given.',\n};\n\n/* Identical at all eight doors: the caller's filter or document is the whole confinement. /\nconst TENANT_SCOPING_WAIVED: InfrastructureConcernDeclaration = {\n posture: WAIVED,\n reason:\n 'The adapters\\' `buildContextualFilter` — which injects the resource\\'s scope FK — runs on the '\n + 'operation-tier paths only. A raw primitive takes the caller\\'s filter as given, so a door '\n + 'reaching a scope-bearing resource without its scope predicate returns cross-tenant rows and '\n + 'nothing below the door re-adds it.',\n compensation:\n 'Handler-only placement (as for authorization), plus the narrowness of the callers: the tier is '\n + 'reached today only by field-uniqueness validation, consumable tokens and usage metering, each '\n + 'of which builds its own filter. Nothing mechanical enforces that on a future caller.',\n};\n\n/* Identical at all eight doors: the door emits nothing, and nothing downstream substitutes for it. /\nconst AUDIT_TRAIL_WAIVED: InfrastructureConcernDeclaration = {\n posture: WAIVED,\n reason: 'No operation lifecycle runs, so no auditable event is emitted by the door itself.',\n compensation: null,\n};\n\n/* The three read doors: a read materializes no value, so no schema could be applied to one. /\nconst SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ: InfrastructureConcernDeclaration = {\n posture: NOT_APPLICABLE,\n reason: 'Read-only: writes no value, so there is nothing for a declared schema to validate.',\n};\n\n/* The three read doors. /\nconst RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ: InfrastructureConcernDeclaration = {\n posture: NOT_APPLICABLE,\n reason: 'Read-only: writes nothing, so no `.ragSource()` field can change through it.',\n};\n\n/\n The five write doors, minus {@link InfrastructureDoor.INSERT_DOCUMENT}, which has its own partial\n * compensation (the cast).\n /\nconst SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE: InfrastructureConcernDeclaration = {\n posture: WAIVED,\n reason:\n 'The door takes an already-built mutation descriptor. The ordinary UPDATE path validates the '\n + 'after-image against the resource\\'s main schema; nothing on this path does, so a value outside '\n + 'a declared Zod constraint is stored as given.',\n compensation:\n 'Shape only, never values: `describeGuardedMutationInexpressibility` refuses a mutation that '\n + 'cannot be expressed on every adapter. Nothing checks what the mutation SAYS.',\n};\n\n/* Seven of the eight doors accept `RepositoryOptions` and forward them unchanged. /\nconst TRANSACTION_PARTICIPATION_PRESERVED: InfrastructureConcernDeclaration = {\n posture: PRESERVED,\n how:\n 'Accepts `RepositoryOptions` and forwards them to the primitive, so a caller already inside a '\n + 'transaction enrols this statement in it (Mongo session / PG trx).',\n};\n\n/\n The four doors whose only adapter-neutrality claim is that they dispatch a primitive declared on the\n * `BackendResourceRepository` interface — so an adapter omitting one fails to compile rather than\n * throwing on first use. All eight raw primitives are declared there and implemented on both arms.\n /\nconst ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT = (primitive: string): InfrastructureConcernDeclaration => ({\n posture: PRESERVED,\n how:\n `Dispatches \\`${primitive}\\`, which is declared on the \\`BackendResourceRepository\\` interface and `\n + 'implemented by both the MongoDB and PostgreSQL arms — so an adapter that omits it fails to '\n + 'compile rather than throwing on first use. No `as any` and no runtime `typeof` probe.',\n});\n\n/\n The retention hide as five of the six filter-bearing doors state it: applied at THIS dispatch point\n * and only here, so both adapter arms receive an already-hidden filter and the predicate lives in one\n * place. {@link InfrastructureDoor.COUNT_DOCUMENTS} states a stronger, caller-specific reason and\n * carries its own.\n /\nconst RETENTION_HIDE_PRESERVED_AT_DISPATCH = (consequence: string): InfrastructureConcernDeclaration => ({\n posture: PRESERVED,\n how:\n `The filter passes through \\`applyRetentionHideToRawFilter\\` HERE and only here — ${consequence} `\n + 'Enforcing it at the single dispatch point rather than in each adapter is what stops it drifting: '\n + 'a future adapter inherits the predicate by construction.',\n});\n\n/\n The five write doors' RAG posture, identical in mechanism and differing only in what the sweep\n * reconciles for that door's shape. Moved from each door's own `rag-ingestion-gate: N/A —` comment,\n * which the sibling guard `rag-ingestion-write-door-coverage.guard.test.ts` still requires to be\n * present AT the door; that guard checks the waiver EXISTS, this table records what it says.\n /\nconst RAG_INGESTION_GATE_WAIVED_TO_SWEEP = (bound: string): InfrastructureConcernDeclaration => ({\n posture: WAIVED,\n reason:\n 'Below the service tier, so the post-commit ingestion chokepoint cannot observe this door. A '\n + '`.ragSource()` field written through it is not re-indexed at write time.',\n compensation: `The hourly RAG reconciliation sweep: ${bound}`,\n});\n\nexport const INFRASTRUCTURE_TIER_CONTRACT: Record<\n InfrastructureDoor,\n Record<InfrastructureCrossCuttingConcern, InfrastructureConcernDeclaration>\n> = {\n [InfrastructureDoor.COUNT_DOCUMENTS]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n [RETENTION_HIDE]: {\n posture: PRESERVED,\n how:\n 'The filter passes through `applyRetentionHideToRawFilter` here and only here. Counting a '\n + 'hidden row would report a collision against a record the caller cannot see — an existence '\n + 'oracle for the field-uniqueness-validation caller. The consequence (a later INSERT can then '\n + 'collide on a plain unique business-key index) is the separate, tracked G-BKEY gate, and is '\n + 'NOT resolved by re-leaking the row here.',\n },\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: {\n posture: WAIVED,\n reason:\n 'THE ONE DOOR THAT CANNOT PARTICIPATE, and not by decision: it accepts no `RepositoryOptions` '\n + 'parameter at all, so a caller inside a transaction counts OUTSIDE it and cannot see its own '\n + 'uncommitted rows. `countByRawFilter` accepts and honours options on both arms; only this '\n + 'door drops them — the identical shape its sibling `bulkUpdateForInfrastructure` records as '\n + '\"a silent correctness hole\", at the one door nobody enumerated. Surfaced by filling this '\n + 'table, deliberately recorded rather than repaired here: fixing a door inside the change that '\n + 'declares the contract would hide the demonstration that the contract works. Filed as issue '\n + '#104; flip this cell to PRESERVED when it lands.',\n compensation: null,\n },\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Delegates to `countByRawFilter`. It previously reached `(repository as any).mongooseModel`, '\n + 'which made it MongoDB-only and left field-uniqueness validation unable to answer \"is this '\n + 'value already taken?\" on any PostgreSQL-backed resource — a generally-named capability one '\n + 'adapter did not have.',\n },\n },\n\n [InfrastructureDoor.FIND_MANY]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'a retained row must stay invisible to reads, and this is the single place the predicate is added '\n + 'for this path.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT('findManyByRawFilter'),\n },\n\n [InfrastructureDoor.READ_UNSCOPED_BY_KEY]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: {\n posture: WAIVED,\n reason:\n 'Unscoped BY NAME and by design — the only read on the repository contract that takes no '\n + 'execution context at all. Scope narrowing is the caller\\'s filter to express here.',\n compensation:\n 'Only the boundary this door does NOT relax: a read that skips tenant scoping must not also '\n + 'skip erasure retention — those are different questions — so the hide is applied '\n + 'unconditionally below. Nothing re-adds the scope predicate.',\n },\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'no caller may opt out of erasure retention by choosing this entry point, however unscoped the '\n + 'read itself is.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT('readUnscopedByKey'),\n },\n\n [InfrastructureDoor.INSERT_DOCUMENT]: {\n [AUTHORIZATION]: {\n posture: WAIVED,\n reason:\n 'Below the service tier, so no principal is resolved — but unlike its siblings this door has '\n + 'a DECLARED alternative it is not using, and the reason it gives for not using it does not '\n + 'hold. \"A consumable token is consumed before authentication, so there is no principal to '\n + 'authorize\" is true of CONSUMPTION and not of MINTING, which is a write the running system '\n + 'performs inside a flow it controls. `SystemAccessBackendService.createAsSystem` exists for '\n + 'precisely that principal, and `CONSUMABLE_TOKENS` already declares a CREATE operation '\n + '(INTERNAL_CALL, ORG_ADMIN, with a requestDto). Routing through it would restore schema '\n + 'validation, the RAG ingestion hook, the audit trail and the scope-context channel at this '\n + 'door — five of the eight rows below stop being waivers.',\n compensation:\n 'Handler-only placement, as for every door here. What stops the migration is narrow and '\n + 'specific rather than principled — the declared requestDto omits the `_id`, `createdAt` and '\n + '`updatedAt` this caller supplies deliberately; `CONSUMABLE_TOKENS` declares no '\n + '`systemAccessPolicy`, so `createAsSystem` fail-closes today; the declared variant is gated '\n + 'on ORG_ADMIN at organization scope, which a signup-time magic-link mint does not have; and '\n + 'the caller reads the raw duplicate-key error to detect an `activeGenerationKey` conflict. '\n + 'Tracked as issue #102 — the decision to migrate the caller — rather than answered here.',\n },\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: {\n posture: WAIVED,\n reason:\n 'The callers build a COMPLETE document — their own `_id`, their own `createdAt`/`updatedAt` — '\n + 'so the write deliberately skips the model create path: `Model.castObject` applies the '\n + 'schema\\'s type CASTS only, no defaults, no timestamps, NO VALIDATION. A value outside a '\n + 'declared Zod constraint is stored as given.',\n compensation:\n 'The cast THROWS on a value the schema cannot represent (a non-ObjectId string on an '\n + '`isForeignKey` path), so a structurally impossible write fails loudly at the write instead '\n + 'of storing a row no cast filter can ever match — issue #71\\'s silent form. Field-level '\n + 'constraints are not checked by anything.',\n },\n [RETENTION_HIDE]: {\n posture: NOT_APPLICABLE,\n reason:\n 'An INSERT creates a brand-new row, so there is no existing row to protect. A retained row is '\n + 'reached only through a filter, and this statement carries none.',\n },\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n 'its missing-set row scan picks the row up.',\n ),\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Delegates to `insertRawDocument`, which casts the document through the model before the driver '\n + 'sees it — the fix for issue #71. Uncast, this tier wrote a string where every sibling queries '\n + 'an ObjectId, so a row written by this tier was not reliably findable BY this tier '\n + '(`revokeTokensByRelatedId` matched 0 rows that existed). The PostgreSQL arm routes the same '\n + 'insert through `toSqlWriteRow` for exactly this reason.',\n },\n },\n\n [InfrastructureDoor.BULK_UPDATE]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'a bulk infrastructure update must never rewrite an erased-but-retained row, and retained rows are '\n + 'excluded from the modified count.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n 'its contentHash comparison reconciles the affected chunk sets.',\n ),\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: {\n posture: PRESERVED,\n how:\n 'Accepts `RepositoryOptions` and forwards them — and this door is WHY the concern is on this '\n + 'axis. It did neither until recently, so every bulk infrastructure update committed '\n + 'immediately regardless of the transaction its caller was inside: `revokeTokensByRelatedId`\\'s '\n + 'revocation could not be rolled back, and on a driver retry the caller observed a count of 0 '\n + 'for work that had in fact happened exactly once.',\n },\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Takes an ADAPTER-NEUTRAL mutation descriptor rather than a raw `{ $set: … }`, and refuses a '\n + 'mutation it cannot express on every adapter instead of silently degrading. The dialect used '\n + 'to sit in the SIGNATURE, so every caller wrote MongoDB and a PostgreSQL-backed resource could '\n + 'not be bulk-updated at all.',\n },\n },\n\n [InfrastructureDoor.ATOMIC_GUARDED_MUTATION]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'a retained row is immutable, so the compare-and-swap must never match one.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n 'its contentHash comparison reconciles the affected chunk set.',\n ),\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Refuses a mutation that is not adapter-neutral (`describeGuardedMutationInexpressibility`) '\n + 'BEFORE dispatching, rather than degrading on the arm that cannot express it, and dispatches '\n + 'an interface-declared primitive.',\n },\n },\n\n [InfrastructureDoor.ATOMIC_INCREMENT_FIELD]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'a retained (erased-but-kept) row is immutable and must never be incremented.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n 'its contentHash comparison re-derives the chunk set. In practice this door writes counters, '\n + 'never corpus text.',\n ),\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Dispatches the interface-declared `atomicIncrementField`. Its predecessor took a MongoDB update '\n + 'expression and reached for `mongooseModel`, so a counter built on it did not merely degrade '\n + 'on PostgreSQL — it failed every write, and where the caller swallowed the error (as metering '\n + 'paths do, so accounting never breaks a served request) the counter silently stayed at zero '\n + 'and any cap built on it never fired.',\n },\n },\n\n [InfrastructureDoor.ATOMIC_CONDITIONAL_SET]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'a retained row is immutable, so neither the set nor the clear may reach one.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n 'its contentHash comparison reconciles the chunk set of a field set or cleared through it.',\n ),\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Dispatches the interface-declared `atomicConditionalSet`. Until the neutral primitives '\n + 'existed, CLEARING a field had no adapter-neutral expression at all — the only route was the '\n + 'raw-MongoDB `atomicConditionalUpdate` (since retired), so every clear was silently also a '\n + 'MongoDB pin. The file-cleanup batch is the case that forced it: it clears stale link '\n + 'metadata from timed-out and malformed rows, so a PostgreSQL-backed FILES resource would '\n + 'have accepted writes and then stranded every row that batch exists to normalize.',\n },\n },\n};\n\n// ── The boundary of the enumeration, recorded rather than left implicit ──────────────────────────\n\n/\n Handler members that resolve a repository and dispatch to it, and are NOT infrastructure doors.\n \n The pin discovers the tier behaviourally — \"resolves a repository, then dispatches to it\" — which is\n * the only discovery that survives a rename. That query also finds the one member for which the answer\n * is legitimately different, and it is named here so the exclusion is a declaration a reader can\n * challenge rather than a silent filter inside a test.\n \n The pin asserts each of these is actually FOUND by the discovery, so an entry that stops matching\n * cannot quietly shrink the population it is excluded from.\n /\nexport const INFRASTRUCTURE_TIER_OPERATION_DISPATCH_MEMBERS: Readonly<Record<string, string>> = {\n doByExecutionContext:\n 'The DECLARED-operation dispatcher — the opposite of this tier. It carries an `ExecutionContext` '\n + 'whose operation the service and controller tiers have already authorized, and `doByPath` / '\n + '`doByKey` both funnel into it. It is found by the same query because it, too, resolves a '\n + 'repository and calls it.',\n};\n\n/\n Cross-cutting concerns CONSIDERED for {@link InfrastructureCrossCuttingConcern} and deliberately\n * left out, with the reason each collapses into an existing member.\n \n Recorded as data, not omitted, because `.claude/rules/invariant-call-site-enumeration.md` #14 is\n * exactly this: a site that DECLARES itself exempt is quieter than a missing one, so the declaration\n * has to be somewhere a reader can check it. Both entries below were checked against code rather than\n * reasoned about — the citations are the point.\n */\nexport enum InfrastructureExcludedConcernCandidate {\n SIEM_ROUTING = 'siemRouting',\n SUBJECT_ERASURE_REACHABILITY = 'subjectErasureReachability',\n}\n\nexport const INFRASTRUCTURE_CONCERN_CANDIDATES_EXCLUDED: Record<\n InfrastructureExcludedConcernCandidate,\n string\n> = {\n [InfrastructureExcludedConcernCandidate.SIEM_ROUTING]:\n 'Entailed by AUDIT_TRAIL, not independent of it. The routing service is declared as one that '\n + '\"dispatches AUDIT EVENTS to org SIEM endpoints\" (`inject/models/service-types.ts`), so its input '\n + 'is an emitted event. A door that emits none produces nothing to route, and a per-door SIEM cell '\n + 'could only ever restate that door\\'s audit cell.',\n [InfrastructureExcludedConcernCandidate.SUBJECT_ERASURE_REACHABILITY]:\n 'Splits cleanly into a half that is already a member and a half that is not a property of the door. '\n + 'The VISIBILITY-and-immutability half of erasure IS the retention hide — same predicate, same '\n + 'dispatch point — and is declared per door as RETENTION_HIDE. The DISCOVERY half (can the erasure '\n + 'orchestrator find the rows?) is answered by the resource graph: `eraseSubjectInPlace` walks the '\n + 'edges of the subject resource\\'s own configuration, so a row is reachable because of how its '\n + 'resource is declared, never because of which door wrote it.',\n};\n"]}
1	+ {"version":3,"file":"infrastructure-tier-contract.backend.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/infrastructure-tier-contract.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kBAmBX;AAnBD,WAAY,kBAAkB;IAC5B,gGAAgG;IAChG,yEAAmD,CAAA;IACnD,gFAAgF;IAChF,6DAAuC,CAAA;IACvC,oFAAoF;IACpF,gEAA0C,CAAA;IAC1C,sEAAsE;IACtE,yEAAmD,CAAA;IACnD,qFAAqF;IACrF,iEAA2C,CAAA;IAC3C,+DAA+D;IAC/D,iEAA2C,CAAA;IAC3C,yCAAyC;IACzC,uEAAiD,CAAA;IACjD,iEAAiE;IACjE,qEAA+C,CAAA;IAC/C,wCAAwC;IACxC,qEAA+C,CAAA;AACjD,CAAC,EAnBW,kBAAkB,KAAlB,kBAAkB,QAmB7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,iCA4DX;AA5DD,WAAY,iCAAiC;IAC3C;;;OAGG;IACH,oEAA+B,CAAA;IAC/B;;;;;;;;;;;OAWG;IACH,qEAAgC,CAAA;IAChC;;;;OAIG;IACH,2EAAsC,CAAA;IACtC;;;;;OAKG;IACH,qEAAgC,CAAA;IAChC;;;;OAIG;IACH,4EAAuC,CAAA;IACvC;;;OAGG;IACH,+DAA0B,CAAA;IAC1B;;;;;;;;;OASG;IACH,2FAAsD,CAAA;IACtD;;;;OAIG;IACH,6EAAwC,CAAA;AAC1C,CAAC,EA5DW,iCAAiC,KAAjC,iCAAiC,QA4D5C;AAED,MAAM,CAAN,IAAY,4BAOX;AAPD,WAAY,4BAA4B;IACtC,6CAA6C;IAC7C,uDAAuB,CAAA;IACvB,sFAAsF;IACtF,iDAAiB,CAAA;IACjB,mGAAmG;IACnG,iEAAiC,CAAA;AACnC,CAAC,EAPW,4BAA4B,KAA5B,4BAA4B,QAOvC;AAYD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,4BAA4B,CAAC;AAC3E,MAAM,EACJ,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,yBAAyB,EACzB,kBAAkB,GACnB,GAAG,iCAAiC,CAAC;AAEtC,oGAAoG;AACpG,mGAAmG;AACnG,sGAAsG;AACtG,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,oBAAoB,GAAqC;IAC7D,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,+FAA+F;UAC7F,+FAA+F;UAC/F,yBAAyB;IAC7B,YAAY,EACV,8FAA8F;UAC5F,+EAA+E;CACpF,CAAC;AAEF,yFAAyF;AACzF,MAAM,qBAAqB,GAAqC;IAC9D,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,gGAAgG;UAC9F,4FAA4F;UAC5F,8FAA8F;UAC9F,oCAAoC;IACxC,YAAY,EACV,iGAAiG;UAC/F,gGAAgG;UAChG,sFAAsF;CAC3F,CAAC;AAEF,kGAAkG;AAClG,MAAM,kBAAkB,GAAqC;IAC3D,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,mFAAmF;IAC3F,YAAY,EAAE,IAAI;CACnB,CAAC;AAEF,gGAAgG;AAChG,MAAM,wCAAwC,GAAqC;IACjF,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,oFAAoF;CAC7F,CAAC;AAEF,4BAA4B;AAC5B,MAAM,yCAAyC,GAAqC;IAClF,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,8EAA8E;CACvF,CAAC;AAEF;;;GAGG;AACH,MAAM,wCAAwC,GAAqC;IACjF,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,8FAA8F;UAC5F,iGAAiG;UACjG,+CAA+C;IACnD,YAAY,EACV,8FAA8F;UAC5F,8EAA8E;CACnF,CAAC;AAEF,yHAAyH;AACzH,MAAM,mCAAmC,GAAqC;IAC5E,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,+FAA+F;UAC7F,mEAAmE;CACxE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,wCAAwC,GAAG,CAAC,SAAiB,EAAoC,EAAE,CAAC,CAAC;IACzG,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,gBAAgB,SAAS,2EAA2E;UAClG,6FAA6F;UAC7F,uFAAuF;CAC5F,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,oCAAoC,GAAG,CAAC,WAAmB,EAAoC,EAAE,CAAC,CAAC;IACvG,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,oFAAoF,WAAW,GAAG;UAChG,mGAAmG;UACnG,0DAA0D;CAC/D,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,kCAAkC,GAAG,CAAC,KAAa,EAAoC,EAAE,CAAC,CAAC;IAC/F,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,8FAA8F;UAC5F,0EAA0E;IAC9E,YAAY,EAAE,wCAAwC,KAAK,EAAE;CAC9D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAGrC;IACF,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE;QACpC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,2FAA2F;kBACzF,4FAA4F;kBAC5F,8FAA8F;kBAC9F,6FAA6F;kBAC7F,0CAA0C;SAC/C;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE;YAC3B,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,0FAA0F;kBACxF,qFAAqF;kBACrF,6FAA6F;kBAC7F,0FAA0F;kBAC1F,2FAA2F;kBAC3F,8FAA8F;kBAC9F,0EAA0E;kBAC1E,iEAAiE;SACtE;QACD,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,4FAA4F;kBAC5F,6FAA6F;kBAC7F,uBAAuB;SAC5B;KACF;IAED,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC9B,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,mGAAmG;cACjG,gBAAgB,CACnB;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE,wCAAwC,CAAC,qBAAqB,CAAC;KACtF;IAED,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE;QACzC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,0FAA0F;kBACxF,oFAAoF;YACxF,YAAY,EACV,6FAA6F;kBAC3F,kFAAkF;kBAClF,6DAA6D;SAClE;QACD,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,gGAAgG;cAC9F,iBAAiB,CACpB;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE,wCAAwC,CAAC,mBAAmB,CAAC;KACpF;IAED,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE;QACpC,CAAC,aAAa,CAAC,EAAE;YACf,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,8FAA8F;kBAC5F,4FAA4F;kBAC5F,2FAA2F;kBAC3F,4FAA4F;kBAC5F,6FAA6F;kBAC7F,wFAAwF;kBACxF,yFAAyF;kBACzF,4FAA4F;kBAC5F,yDAAyD;YAC7D,YAAY,EACV,wFAAwF;kBACtF,+EAA+E;kBAC/E,kFAAkF;kBAClF,6FAA6F;kBAC7F,kFAAkF;kBAClF,mFAAmF;kBACnF,4FAA4F;kBAC5F,+FAA+F;kBAC/F,8FAA8F;kBAC9F,4FAA4F;kBAC5F,6FAA6F;kBAC7F,yFAAyF;SAC9F;QACD,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE;YACnB,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,+FAA+F;kBAC7F,wFAAwF;kBACxF,0FAA0F;kBAC1F,6CAA6C;YACjD,YAAY,EACV,sFAAsF;kBACpF,6FAA6F;kBAC7F,yFAAyF;kBACzF,0CAA0C;SAC/C;QACD,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,cAAc;YACvB,MAAM,EACJ,+FAA+F;kBAC7F,iEAAiE;SACtE;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,4CAA4C,CAC7C;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,iGAAiG;kBAC/F,gGAAgG;kBAChG,oFAAoF;kBACpF,8FAA8F;kBAC9F,yDAAyD;SAC9D;KACF;IAED,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE;QAChC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,oGAAoG;cAClG,mCAAmC,CACtC;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,gEAAgE,CACjE;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE;YAC3B,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,qFAAqF;kBACrF,gGAAgG;kBAChG,8FAA8F;kBAC9F,kDAAkD;SACvD;QACD,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,8FAA8F;kBAC9F,gGAAgG;kBAChG,6BAA6B;SAClC;KACF;IAED,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE;QAChC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE;YACnB,OAAO,EAAE,cAAc;YACvB,MAAM,EACJ,+FAA+F;kBAC7F,0FAA0F;kBAC1F,iFAAiF;SACtF;QACD,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,4FAA4F;cAC1F,6FAA6F;cAC7F,sDAAsD,CACzD;QACD,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,cAAc;YACvB,MAAM,EACJ,+FAA+F;kBAC7F,8FAA8F;kBAC9F,uDAAuD;kBACvD,yFAAyF;kBACzF,6FAA6F;kBAC7F,qEAAqE;SAC1E;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,+FAA+F;kBAC7F,4FAA4F;kBAC5F,4FAA4F;kBAC5F,gGAAgG;kBAChG,+FAA+F;kBAC/F,4FAA4F;kBAC5F,yFAAyF;kBACzF,6FAA6F;kBAC7F,8FAA8F;kBAC9F,0DAA0D;SAC/D;KACF;IAED,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,EAAE;QAC5C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,4EAA4E,CAC7E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,+DAA+D,CAChE;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,6FAA6F;kBAC3F,8FAA8F;kBAC9F,kCAAkC;SACvC;KACF;IAED,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE;QAC3C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,8EAA8E,CAC/E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,8FAA8F;cAC5F,oBAAoB,CACvB;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,kGAAkG;kBAChG,8FAA8F;kBAC9F,+FAA+F;kBAC/F,6FAA6F;kBAC7F,sCAAsC;SAC3C;KACF;IAED,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE;QAC3C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,8EAA8E,CAC/E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,2FAA2F,CAC5F;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,yFAAyF;kBACvF,8FAA8F;kBAC9F,4FAA4F;kBAC5F,uFAAuF;kBACvF,0FAA0F;kBAC1F,kFAAkF;SACvF;KACF;CACF,CAAC;AAEF,oGAAoG;AAEpG;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAqC;IAC9F,oBAAoB,EAClB,kGAAkG;UAChG,6FAA6F;UAC7F,2FAA2F;UAC3F,0BAA0B;CAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,sCAGX;AAHD,WAAY,sCAAsC;IAChD,sEAA4B,CAAA;IAC5B,qGAA2D,CAAA;AAC7D,CAAC,EAHW,sCAAsC,KAAtC,sCAAsC,QAGjD;AAED,MAAM,CAAC,MAAM,0CAA0C,GAGnD;IACF,CAAC,sCAAsC,CAAC,YAAY,CAAC,EACnD,8FAA8F;UAC5F,mGAAmG;UACnG,kGAAkG;UAClG,kDAAkD;IACtD,CAAC,sCAAsC,CAAC,4BAA4B,CAAC,EACnE,qGAAqG;UACnG,+FAA+F;UAC/F,mGAAmG;UACnG,kGAAkG;UAClG,+FAA+F;UAC/F,6DAA6D;CAClE,CAAC","sourcesContent":["/*\n The contract every INFRASTRUCTURE-TIER door on {@link RepositoriesRegistryHandlerBackendService}\n * answers to.\n \n ## Why this file exists\n \n The infrastructure tier is a deliberate bypass: its doors sit BELOW the service tier, take a\n * pre-built filter or an already-final document, and run no declared operation and no authorization.\n * Its clearest warrant is the field-uniqueness check behind the `validate-field` route. A field\n * declared unique with `scope: 'global'` must be counted across the ENTIRE collection — \"no additional\n * filter (intentional — check entire collection)\" — including tenants the caller cannot see, and the\n * answer returned as nothing but a number. A declared operation cannot serve that: `buildContextualFilter`\n * would scope the count to the caller's tenant and the answer would simply be wrong. So the door\n * deliberately waives tenant scoping and deliberately does NOT waive the retention hide, because\n * counting a hidden row would turn the same number into an existence oracle.\n \n Its WEAKEST warrant is the one the tier has most often cited, and issue #100 asked for it to be\n * settled: \"a consumable token is minted by a system action and consumed BEFORE authentication, so\n * there is genuinely no principal to authorize\". That conflates two moments. CONSUMPTION has no\n * principal — the token IS the credential. MINTING is a write the running system performs inside a\n * flow it controls, and the framework already has a vocabulary for exactly that: `createAsSystem`\n * fail-closes unless the resource opts in with `systemAccessPolicy.create = ALLOWED`, synthesises an\n * APPLICATION-scope super-admin context, and dispatches the resource's OWN declared CREATE —\n * which `CONSUMABLE_TOKENS` declares. So the framework does not owe a new \"system principal\"\n * vocabulary.\n \n That settles the FRAMEWORK question and deliberately does not settle the CALLER's: this door turns\n * out to have a second, stronger reason to bypass the declared pipeline. `createsOneOffSession` is\n * sealed `.excludeFromCreate()` so that no repository-create path can mint a session-establishing\n * token, which is what makes `createToken` the sole minter and therefore the single funnel enforcing\n * the impersonation-credential lifetime ceiling. A raw door is the shape that seal depends on. See\n * `INSERT_DOCUMENT / authorization` below, and issue #102.\n \n What was missing is not correctness, it is a CONTRACT. Each door carried its own hand-written prose\n * about which cross-cutting invariant it upheld and which it skipped, so the tier's posture existed\n * only as a set of independent rationales. Adding a door, or a new invariant, meant re-deriving the\n * obligation by hand at every site with nothing mechanical to say whether it had been done — the exact\n * failure shape `.claude/rules/invariant-call-site-enumeration.md` records, where an invariant is\n * applied at one of its N sites and the miss is invisible.\n \n So the posture is DECLARED here instead, once, as data. Because the table is typed\n * `Record<InfrastructureDoor, Record<InfrastructureCrossCuttingConcern, …>>`, adding a member to\n * EITHER enum fails to compile until every new cell is filled in. That is the property this file is\n * for: the missing case becomes a compiler error rather than something a reviewer has to notice.\n \n ## The tier is NINE doors, not the four that share a name\n \n Issue #100 listed four, all suffixed `ForInfrastructure`. That is the population the SUFFIX\n describes, and it was half the tier. Four more handler members have the identical posture under a\n * different name — `atomicIncrementField` and `atomicConditionalSet` carry, verbatim, the same\n * `@internal Framework-internal infrastructure primitive — NOT part of the operation lifecycle. The\n * caller owns authorization, scope-aware filter construction, and audit logging.` that the suffixed\n * doors carry; `atomicGuardedMutation` and `readUnscopedByKey` likewise dispatch a caller-built filter\n * straight to an adapter with no operation above them.\n \n That is why {@link INFRASTRUCTURE_TIER_CONTRACT}'s pin discovers the tier by what a member DOES —\n * resolving a repository and dispatching to it — rather than by what it is called. Enumerating by name\n * finds every site that agrees with you about naming, which is `invariant-call-site-enumeration.md`\n * #12 and #20 in one. The sibling guard `rag-ingestion-write-door-coverage.guard.test.ts` had already\n * reached the same population from the write side: three of its five raw write doors carry no suffix.\n \n ## What this file is NOT\n \n It does not gate anything at runtime. A door's behaviour lives in the door; this is the record of\n * what that behaviour promises, kept adjacent and kept complete. Turning it into a runtime guard would\n * add a second authority that can disagree with the code, which is the failure this repository has\n * paid for repeatedly (see `.claude/rules/one-source-of-truth.md`).\n \n It is also not a place to fix a door. Filling the table surfaced one real asymmetry — see\n * {@link InfrastructureCrossCuttingConcern.TRANSACTION_PARTICIPATION} at\n * {@link InfrastructureDoor.COUNT_DOCUMENTS} — and it is RECORDED here rather than quietly repaired,\n * because a waiver nobody can see is the condition this contract exists to end.\n \n @see issue #100 — the decision this file implements.\n /\n\n/\n The doors.\n \n Each value is the METHOD NAME on the handler, deliberately, so\n * `__tests__/infrastructure-tier-contract.guard.test.ts` can discover the real tier from the handler's\n * source and assert this enum matches it exactly. A hand-maintained list that merely LOOKS complete is\n * what this file exists to prevent, so the list is checked against the class rather than trusted.\n /\nexport enum InfrastructureDoor {\n /* Backs field-uniqueness validation, which runs INSIDE an in-flight operation's validation. /\n COUNT_DOCUMENTS = 'countDocumentsForInfrastructure',\n /* Multi-row read for a framework-internal reader (consumable-token lookup). /\n FIND_MANY = 'findManyForInfrastructure',\n /* Single-row read below BOTH the operation tier and the execution-context tier. /\n READ_UNSCOPED_BY_KEY = 'readUnscopedByKey',\n /* INSERT of an already-final document (consumable-token minting). /\n INSERT_DOCUMENT = 'insertDocumentForInfrastructure',\n /* Multi-row guarded write (token revocation by relatedId, usage-record marking). /\n BULK_UPDATE = 'bulkUpdateForInfrastructure',\n /* Multi-row DELETE (the consumable-token retention sweep). /\n DELETE_MANY = 'deleteManyForInfrastructure',\n /* Single-row compare-and-swap write. /\n ATOMIC_GUARDED_MUTATION = 'atomicGuardedMutation',\n /* Single-row counter increment (metering, quota accounting). /\n ATOMIC_INCREMENT_FIELD = 'atomicIncrementField',\n /* Single-row conditional set/clear. /\n ATOMIC_CONDITIONAL_SET = 'atomicConditionalSet',\n}\n\n/\n The cross-cutting invariants a door must answer for explicitly.\n \n ## The admission criterion, so the next member is not settled by taste\n \n A concern belongs here when it is an invariant that holds across the whole persistence boundary AND\n * a door can silently fail to uphold it. Members arrive on one of two bases, and each member's own\n * doc-comment names which:\n \n - conferred from above — an ordinary declared operation gets it for free at the controller or\n * service tier, and a door that runs no operation therefore does not (authorization, tenant\n * scoping, schema validation, the RAG ingestion gate, the audit trail);\n * - promised by the door itself — nothing above confers it; the door's own general name promises\n * it, and the family has broken it in production (retention hide, transaction participation,\n * adapter neutrality).\n \n This set is OPEN. Adding a member is the point: it immediately breaks compilation at every door\n * until each declares a posture. Candidates DELIBERATELY excluded are recorded as data in\n * {@link INFRASTRUCTURE_CONCERN_CANDIDATES_EXCLUDED} rather than left absent — an absence is\n * indistinguishable from an oversight, which is the shape this whole file is about.\n /\nexport enum InfrastructureCrossCuttingConcern {\n /\n CONFERRED FROM ABOVE. Who may do this. The controller resolves it from the declared operation's\n * roles and variant; these doors run no operation, so nothing resolves a principal.\n /\n AUTHORIZATION = 'authorization',\n /\n CONFERRED FROM ABOVE. Which TENANT'S rows this statement may reach. The adapters' own\n * `buildContextualFilter` injects the scope FK (organizationId / userId) into every operation-tier\n * filter; the raw primitives these doors dispatch deliberately do not call it — \"the caller's filter\n * is the whole confinement, by design\".\n \n Distinct from {@link AUTHORIZATION} on purpose, and the distinction is the tier's own: the handler\n * states at `readUnscopedByKey` that \"a read that skips tenant scoping must NOT also skip erasure\n * retention: those are different questions\". Roles and rows are two gates, answered from two inputs,\n * and fusing them is what `.claude/rules/administrative-continuity-floors.md` records as producing\n * cross-tenant reach nobody declared.\n /\n TENANT_SCOPING = 'tenantScoping',\n /\n CONFERRED FROM ABOVE. That a written value was checked against a declared schema. The controller's\n * `validateRequestData` parses the payload through the operation's `requestDto` before any write;\n * these doors take an already-built document or mutation descriptor and no Zod schema sees it.\n /\n SCHEMA_VALIDATION = 'schemaValidation',\n /\n PROMISED BY THE DOOR. An erased-but-retained row must stay invisible to reads and unaffected by\n * writes — \"kept but frozen\". The tier applies it at its own single dispatch point\n * (`applyRetentionHideToRawFilter`) rather than in each adapter, so a future adapter inherits it by\n * construction.\n /\n RETENTION_HIDE = 'retentionHide',\n /\n CONFERRED FROM ABOVE. A `.ragSource()` field changing must re-derive the affected chunk set. The\n * hook lives at the service tier's single post-commit chokepoint, which is ABOVE these doors, so no\n * door can feed it.\n /\n RAG_INGESTION_GATE = 'ragIngestionGate',\n /\n CONFERRED FROM ABOVE. A security-relevant action must leave an auditable record. The operation\n * lifecycle emits it; no lifecycle runs here.\n /\n AUDIT_TRAIL = 'auditTrail',\n /\n PROMISED BY THE DOOR. A statement issued inside a caller's transaction must ENROL in it. Every\n * underlying primitive accepts `RepositoryOptions` and both adapters honour it, so whether a door\n * participates is decided entirely by whether the door accepts and forwards them.\n \n This is a member because the family has already lost it once, silently and expensively:\n * `bulkUpdateForInfrastructure` neither accepted nor forwarded options, so `revokeTokensByRelatedId`\n * committed immediately regardless of its caller's transaction and a driver retry observed a count\n * of 0 for work that had happened exactly once.\n /\n TRANSACTION_PARTICIPATION = 'transactionParticipation',\n /\n PROMISED BY THE DOOR. A generally-named capability must work on every persistence adapter, not\n * only the one it was written against. A member here is one the family has broken twice — both\n * breakages were a reach for `(repository as any).mongooseModel` behind a neutral-sounding name.\n /\n ADAPTER_NEUTRALITY = 'adapterNeutrality',\n}\n\nexport enum InfrastructureConcernPosture {\n /* The door itself upholds the invariant. /\n PRESERVED = 'preserved',\n /* The invariant could apply and deliberately is not upheld. A reason is required. /\n WAIVED = 'waived',\n /* The invariant cannot apply to this door's shape at all (e.g. a retention hide on an INSERT). /\n NOT_APPLICABLE = 'not-applicable',\n}\n\n/\n `compensation` is the field that makes a waiver reviewable: it names what ELSE catches the gap, or\n * is `null` to state plainly that nothing does. A waiver with no compensation is not forbidden — it is\n * simply visible, which is the whole ask of issue #100.\n /\nexport type InfrastructureConcernDeclaration =\n \| { posture: InfrastructureConcernPosture.PRESERVED; how: string }\n \| { posture: InfrastructureConcernPosture.WAIVED; reason: string; compensation: string \| null }\n \| { posture: InfrastructureConcernPosture.NOT_APPLICABLE; reason: string };\n\nconst { PRESERVED, WAIVED, NOT_APPLICABLE } = InfrastructureConcernPosture;\nconst {\n AUTHORIZATION,\n TENANT_SCOPING,\n SCHEMA_VALIDATION,\n RETENTION_HIDE,\n RAG_INGESTION_GATE,\n AUDIT_TRAIL,\n TRANSACTION_PARTICIPATION,\n ADAPTER_NEUTRALITY,\n} = InfrastructureCrossCuttingConcern;\n\n// ── Declarations shared verbatim across doors ────────────────────────────────────────────────────\n// Written once where the reason is genuinely the same one. Where a door's reason is its own, it is\n// written at the door — moved from that door's JSDoc rather than paraphrased, so the rationale exists\n// in exactly one place and cannot drift from the copy it was summarised into.\n\n/\n Identical at every door. The placement note is the real mitigation: these members live on the\n * HANDLER and not on the `BackendResourceRepository` interface an application's custom code is handed.\n /\nconst AUTHORIZATION_WAIVED: InfrastructureConcernDeclaration = {\n posture: WAIVED,\n reason:\n 'Below the service tier: no declared operation runs, so there is no principal to resolve. The '\n + 'caller authorizes before calling; `executionContext` here is error context only and is never '\n + 'read for authorization.',\n compensation:\n 'Declared on the handler rather than on the `BackendResourceRepository` interface, so custom '\n + 'application code cannot reach these doors through the repository it is given.',\n};\n\n/* Identical at every door: the caller's filter or document is the whole confinement. /\nconst TENANT_SCOPING_WAIVED: InfrastructureConcernDeclaration = {\n posture: WAIVED,\n reason:\n 'The adapters\\' `buildContextualFilter` — which injects the resource\\'s scope FK — runs on the '\n + 'operation-tier paths only. A raw primitive takes the caller\\'s filter as given, so a door '\n + 'reaching a scope-bearing resource without its scope predicate returns cross-tenant rows and '\n + 'nothing below the door re-adds it.',\n compensation:\n 'Handler-only placement (as for authorization), plus the narrowness of the callers: the tier is '\n + 'reached today only by field-uniqueness validation, consumable tokens and usage metering, each '\n + 'of which builds its own filter. Nothing mechanical enforces that on a future caller.',\n};\n\n/* Identical at every door: the door emits nothing, and nothing downstream substitutes for it. /\nconst AUDIT_TRAIL_WAIVED: InfrastructureConcernDeclaration = {\n posture: WAIVED,\n reason: 'No operation lifecycle runs, so no auditable event is emitted by the door itself.',\n compensation: null,\n};\n\n/* The three read doors: a read materializes no value, so no schema could be applied to one. /\nconst SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ: InfrastructureConcernDeclaration = {\n posture: NOT_APPLICABLE,\n reason: 'Read-only: writes no value, so there is nothing for a declared schema to validate.',\n};\n\n/* The three read doors. /\nconst RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ: InfrastructureConcernDeclaration = {\n posture: NOT_APPLICABLE,\n reason: 'Read-only: writes nothing, so no `.ragSource()` field can change through it.',\n};\n\n/\n The pre-built WRITE doors, minus {@link InfrastructureDoor.INSERT_DOCUMENT}, which has its own partial\n * compensation (the cast), and minus {@link InfrastructureDoor.DELETE_MANY}, which materializes no value.\n /\nconst SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE: InfrastructureConcernDeclaration = {\n posture: WAIVED,\n reason:\n 'The door takes an already-built mutation descriptor. The ordinary UPDATE path validates the '\n + 'after-image against the resource\\'s main schema; nothing on this path does, so a value outside '\n + 'a declared Zod constraint is stored as given.',\n compensation:\n 'Shape only, never values: `describeGuardedMutationInexpressibility` refuses a mutation that '\n + 'cannot be expressed on every adapter. Nothing checks what the mutation SAYS.',\n};\n\n/* Every door but {@link InfrastructureDoor.COUNT_DOCUMENTS} accepts `RepositoryOptions` and forwards them unchanged. /\nconst TRANSACTION_PARTICIPATION_PRESERVED: InfrastructureConcernDeclaration = {\n posture: PRESERVED,\n how:\n 'Accepts `RepositoryOptions` and forwards them to the primitive, so a caller already inside a '\n + 'transaction enrols this statement in it (Mongo session / PG trx).',\n};\n\n/\n The four doors whose only adapter-neutrality claim is that they dispatch a primitive declared on the\n * `BackendResourceRepository` interface — so an adapter omitting one fails to compile rather than\n * throwing on first use. Every raw primitive is declared there and implemented on both persisting arms\n * (the read-only HTTP-API and introspection arms declare each one as an explicit refusal).\n /\nconst ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT = (primitive: string): InfrastructureConcernDeclaration => ({\n posture: PRESERVED,\n how:\n `Dispatches \\`${primitive}\\`, which is declared on the \\`BackendResourceRepository\\` interface and `\n + 'implemented by both the MongoDB and PostgreSQL arms — so an adapter that omits it fails to '\n + 'compile rather than throwing on first use. No `as any` and no runtime `typeof` probe.',\n});\n\n/\n The retention hide as five of the six filter-bearing doors state it: applied at THIS dispatch point\n * and only here, so both adapter arms receive an already-hidden filter and the predicate lives in one\n * place. {@link InfrastructureDoor.COUNT_DOCUMENTS} states a stronger, caller-specific reason and\n * carries its own.\n /\nconst RETENTION_HIDE_PRESERVED_AT_DISPATCH = (consequence: string): InfrastructureConcernDeclaration => ({\n posture: PRESERVED,\n how:\n `The filter passes through \\`applyRetentionHideToRawFilter\\` HERE and only here — ${consequence} `\n + 'Enforcing it at the single dispatch point rather than in each adapter is what stops it drifting: '\n + 'a future adapter inherits the predicate by construction.',\n});\n\n/\n The materializing write doors' RAG posture, identical in mechanism and differing only in what the\n * sweep reconciles for that door's shape. Moved from each door's own `rag-ingestion-gate: N/A —` comment,\n * which the sibling guard `rag-ingestion-write-door-coverage.guard.test.ts` still requires to be\n * present AT the door; that guard checks the waiver EXISTS, this table records what it says.\n /\nconst RAG_INGESTION_GATE_WAIVED_TO_SWEEP = (bound: string): InfrastructureConcernDeclaration => ({\n posture: WAIVED,\n reason:\n 'Below the service tier, so the post-commit ingestion chokepoint cannot observe this door. A '\n + '`.ragSource()` field written through it is not re-indexed at write time.',\n compensation: `The hourly RAG reconciliation sweep: ${bound}`,\n});\n\nexport const INFRASTRUCTURE_TIER_CONTRACT: Record<\n InfrastructureDoor,\n Record<InfrastructureCrossCuttingConcern, InfrastructureConcernDeclaration>\n> = {\n [InfrastructureDoor.COUNT_DOCUMENTS]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n [RETENTION_HIDE]: {\n posture: PRESERVED,\n how:\n 'The filter passes through `applyRetentionHideToRawFilter` here and only here. Counting a '\n + 'hidden row would report a collision against a record the caller cannot see — an existence '\n + 'oracle for the field-uniqueness-validation caller. The consequence (a later INSERT can then '\n + 'collide on a plain unique business-key index) is the separate, tracked G-BKEY gate, and is '\n + 'NOT resolved by re-leaking the row here.',\n },\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: {\n posture: PRESERVED,\n how:\n 'Accepts `RepositoryOptions` and forwards them to `countByRawFilter`, matching all seven '\n + 'siblings. It was the ONE door in the tier that accepted none, so a caller inside a '\n + 'transaction counted OUTSIDE it — the identical shape `bulkUpdateForInfrastructure` records '\n + 'as a silent correctness hole, at the door nobody enumerated until this table gave every '\n + 'door a row to fill in. Surfaced by filling the table (issue #104), fixed separately from '\n + 'the change that declared the contract so the demonstration stayed visible. No caller passes '\n + 'options today, so the forward is pinned rather than behaviour-verified: '\n + '`__tests__/infrastructure-tier-transaction-forwarding.test.ts`.',\n },\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Delegates to `countByRawFilter`. It previously reached `(repository as any).mongooseModel`, '\n + 'which made it MongoDB-only and left field-uniqueness validation unable to answer \"is this '\n + 'value already taken?\" on any PostgreSQL-backed resource — a generally-named capability one '\n + 'adapter did not have.',\n },\n },\n\n [InfrastructureDoor.FIND_MANY]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'a retained row must stay invisible to reads, and this is the single place the predicate is added '\n + 'for this path.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT('findManyByRawFilter'),\n },\n\n [InfrastructureDoor.READ_UNSCOPED_BY_KEY]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: {\n posture: WAIVED,\n reason:\n 'Unscoped BY NAME and by design — the only read on the repository contract that takes no '\n + 'execution context at all. Scope narrowing is the caller\\'s filter to express here.',\n compensation:\n 'Only the boundary this door does NOT relax: a read that skips tenant scoping must not also '\n + 'skip erasure retention — those are different questions — so the hide is applied '\n + 'unconditionally below. Nothing re-adds the scope predicate.',\n },\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'no caller may opt out of erasure retention by choosing this entry point, however unscoped the '\n + 'read itself is.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT('readUnscopedByKey'),\n },\n\n [InfrastructureDoor.INSERT_DOCUMENT]: {\n [AUTHORIZATION]: {\n posture: WAIVED,\n reason:\n 'Below the service tier, so no principal is resolved — but unlike its siblings this door has '\n + 'a DECLARED alternative it is not using, and the reason it gives for not using it does not '\n + 'hold. \"A consumable token is consumed before authentication, so there is no principal to '\n + 'authorize\" is true of CONSUMPTION and not of MINTING, which is a write the running system '\n + 'performs inside a flow it controls. `SystemAccessBackendService.createAsSystem` exists for '\n + 'precisely that principal, and `CONSUMABLE_TOKENS` already declares a CREATE operation '\n + '(INTERNAL_CALL, ORG_ADMIN, with a requestDto). Routing through it would restore schema '\n + 'validation, the RAG ingestion hook, the audit trail and the scope-context channel at this '\n + 'door — five of the eight rows below stop being waivers.',\n compensation:\n 'Handler-only placement, as for every door here — AND, at this door only, a deliberate '\n + 'security seal that makes the raw insert load-bearing rather than incidental. '\n + '`createsOneOffSession` is `.excludeFromCreate().excludeFromUpdate()` so that no '\n + 'repository-create path can mint a session-establishing token, which leaves `createToken` — '\n + 'this door\\'s caller — the SOLE minter and therefore the single funnel enforcing '\n + '`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` fail-closed at issuance. That token is an '\n + 'impersonation credential: exchanging it mints a JWT session for another user. Routing the '\n + 'mint through `createAsSystem` would strip the field (measured: the preserve list resolves to '\n + '`[\"organizationId\",\"userId\"]`, because a defaulted excluded field is deliberately withheld) '\n + 'and silently mint every such token as non-session-establishing; relaxing the exclusion to '\n + 'fix that would open a second mint path that never meets the ceiling. So the waiver here is '\n + 'not an unpaid debt — it is the shape the credential ceiling depends on. See issue #102.',\n },\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: {\n posture: WAIVED,\n reason:\n 'The callers build a COMPLETE document — their own `_id`, their own `createdAt`/`updatedAt` — '\n + 'so the write deliberately skips the model create path: `Model.castObject` applies the '\n + 'schema\\'s type CASTS only, no defaults, no timestamps, NO VALIDATION. A value outside a '\n + 'declared Zod constraint is stored as given.',\n compensation:\n 'The cast THROWS on a value the schema cannot represent (a non-ObjectId string on an '\n + '`isForeignKey` path), so a structurally impossible write fails loudly at the write instead '\n + 'of storing a row no cast filter can ever match — issue #71\\'s silent form. Field-level '\n + 'constraints are not checked by anything.',\n },\n [RETENTION_HIDE]: {\n posture: NOT_APPLICABLE,\n reason:\n 'An INSERT creates a brand-new row, so there is no existing row to protect. A retained row is '\n + 'reached only through a filter, and this statement carries none.',\n },\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n 'its missing-set row scan picks the row up.',\n ),\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Delegates to `insertRawDocument`, which casts the document through the model before the driver '\n + 'sees it — the fix for issue #71. Uncast, this tier wrote a string where every sibling queries '\n + 'an ObjectId, so a row written by this tier was not reliably findable BY this tier '\n + '(`revokeTokensByRelatedId` matched 0 rows that existed). The PostgreSQL arm routes the same '\n + 'insert through `toSqlWriteRow` for exactly this reason.',\n },\n },\n\n [InfrastructureDoor.BULK_UPDATE]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'a bulk infrastructure update must never rewrite an erased-but-retained row, and retained rows are '\n + 'excluded from the modified count.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n 'its contentHash comparison reconciles the affected chunk sets.',\n ),\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: {\n posture: PRESERVED,\n how:\n 'Accepts `RepositoryOptions` and forwards them — and this door is WHY the concern is on this '\n + 'axis. It did neither until recently, so every bulk infrastructure update committed '\n + 'immediately regardless of the transaction its caller was inside: `revokeTokensByRelatedId`\\'s '\n + 'revocation could not be rolled back, and on a driver retry the caller observed a count of 0 '\n + 'for work that had in fact happened exactly once.',\n },\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Takes an ADAPTER-NEUTRAL mutation descriptor rather than a raw `{ $set: … }`, and refuses a '\n + 'mutation it cannot express on every adapter instead of silently degrading. The dialect used '\n + 'to sit in the SIGNATURE, so every caller wrote MongoDB and a PostgreSQL-backed resource could '\n + 'not be bulk-updated at all.',\n },\n },\n\n [InfrastructureDoor.DELETE_MANY]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: {\n posture: NOT_APPLICABLE,\n reason:\n 'A DELETE writes no value, so there is nothing for a declared schema to validate. This is the '\n + 'one WRITE door for which the concern is genuinely inapplicable rather than waived — its '\n + 'siblings all carry a pre-built payload a schema could have checked and did not.',\n },\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'a retained (erased-but-kept) row is immutable, and DESTROYING one is the sharpest form of '\n + 'mutating it — the retention posture exists precisely to keep a row that must be kept, so a '\n + 'framework sweep must not be the thing that reaps it.',\n ),\n [RAG_INGESTION_GATE]: {\n posture: NOT_APPLICABLE,\n reason:\n 'Materializes no value, so no `.ragSource()` field can change through it and there is nothing '\n + 'to re-index. The mirror obligation — REMOVING a deleted row\\'s chunks — is not this concern '\n + 'and is not owned here either: the removal-seam guard '\n + '(`rag-chunk-removal-seam-coverage.guard.test.ts`) excludes the raw repository doors BY '\n + 'DECLARATION, bounding every one of them on the hourly reconciliation sweep\\'s orphan pass, '\n + 'and this door joins that family rather than opening a new question.',\n },\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Dispatches the interface-declared `deleteManyByRawFilter`, so an adapter that omits it fails '\n + 'to compile. THE DOOR EXISTS BECAUSE ITS ABSENCE WAS THE DEFECT: with a bulk UPDATE on the '\n + 'tier and no bulk DELETE, the consumable-tokens cleanup batch had one route to reap rows — '\n + 'reaching past the contract for `MongoDBService.getConnection()` — which made the framework\\'s '\n + 'only credential-retention sweep MongoDB-only. It was invisible while every application ran a '\n + 'mongod beside PostgreSQL, and failed every six hours on the first one (`wonder-crm`) that '\n + 'did not, with spent password-reset / invitation / magic-link rows accumulating with no '\n + 'sweep. Note the neutrality this door CANNOT confer: an unexpressible predicate (`$expr`, a '\n + 'column-to-column comparison) is still the caller\\'s problem, and the batch resolves its one '\n + 'such lane by reading candidates and comparing in memory.',\n },\n },\n\n [InfrastructureDoor.ATOMIC_GUARDED_MUTATION]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'a retained row is immutable, so the compare-and-swap must never match one.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n 'its contentHash comparison reconciles the affected chunk set.',\n ),\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Refuses a mutation that is not adapter-neutral (`describeGuardedMutationInexpressibility`) '\n + 'BEFORE dispatching, rather than degrading on the arm that cannot express it, and dispatches '\n + 'an interface-declared primitive.',\n },\n },\n\n [InfrastructureDoor.ATOMIC_INCREMENT_FIELD]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'a retained (erased-but-kept) row is immutable and must never be incremented.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n 'its contentHash comparison re-derives the chunk set. In practice this door writes counters, '\n + 'never corpus text.',\n ),\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Dispatches the interface-declared `atomicIncrementField`. Its predecessor took a MongoDB update '\n + 'expression and reached for `mongooseModel`, so a counter built on it did not merely degrade '\n + 'on PostgreSQL — it failed every write, and where the caller swallowed the error (as metering '\n + 'paths do, so accounting never breaks a served request) the counter silently stayed at zero '\n + 'and any cap built on it never fired.',\n },\n },\n\n [InfrastructureDoor.ATOMIC_CONDITIONAL_SET]: {\n [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n 'a retained row is immutable, so neither the set nor the clear may reach one.',\n ),\n [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n 'its contentHash comparison reconciles the chunk set of a field set or cleared through it.',\n ),\n [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n [ADAPTER_NEUTRALITY]: {\n posture: PRESERVED,\n how:\n 'Dispatches the interface-declared `atomicConditionalSet`. Until the neutral primitives '\n + 'existed, CLEARING a field had no adapter-neutral expression at all — the only route was the '\n + 'raw-MongoDB `atomicConditionalUpdate` (since retired), so every clear was silently also a '\n + 'MongoDB pin. The file-cleanup batch is the case that forced it: it clears stale link '\n + 'metadata from timed-out and malformed rows, so a PostgreSQL-backed FILES resource would '\n + 'have accepted writes and then stranded every row that batch exists to normalize.',\n },\n },\n};\n\n// ── The boundary of the enumeration, recorded rather than left implicit ──────────────────────────\n\n/\n Handler members that resolve a repository and dispatch to it, and are NOT infrastructure doors.\n \n The pin discovers the tier behaviourally — \"resolves a repository, then dispatches to it\" — which is\n * the only discovery that survives a rename. That query also finds the one member for which the answer\n * is legitimately different, and it is named here so the exclusion is a declaration a reader can\n * challenge rather than a silent filter inside a test.\n \n The pin asserts each of these is actually FOUND by the discovery, so an entry that stops matching\n * cannot quietly shrink the population it is excluded from.\n /\nexport const INFRASTRUCTURE_TIER_OPERATION_DISPATCH_MEMBERS: Readonly<Record<string, string>> = {\n doByExecutionContext:\n 'The DECLARED-operation dispatcher — the opposite of this tier. It carries an `ExecutionContext` '\n + 'whose operation the service and controller tiers have already authorized, and `doByPath` / '\n + '`doByKey` both funnel into it. It is found by the same query because it, too, resolves a '\n + 'repository and calls it.',\n};\n\n/\n Cross-cutting concerns CONSIDERED for {@link InfrastructureCrossCuttingConcern} and deliberately\n * left out, with the reason each collapses into an existing member.\n \n Recorded as data, not omitted, because `.claude/rules/invariant-call-site-enumeration.md` #14 is\n * exactly this: a site that DECLARES itself exempt is quieter than a missing one, so the declaration\n * has to be somewhere a reader can check it. Both entries below were checked against code rather than\n * reasoned about — the citations are the point.\n */\nexport enum InfrastructureExcludedConcernCandidate {\n SIEM_ROUTING = 'siemRouting',\n SUBJECT_ERASURE_REACHABILITY = 'subjectErasureReachability',\n}\n\nexport const INFRASTRUCTURE_CONCERN_CANDIDATES_EXCLUDED: Record<\n InfrastructureExcludedConcernCandidate,\n string\n> = {\n [InfrastructureExcludedConcernCandidate.SIEM_ROUTING]:\n 'Entailed by AUDIT_TRAIL, not independent of it. The routing service is declared as one that '\n + '\"dispatches AUDIT EVENTS to org SIEM endpoints\" (`inject/models/service-types.ts`), so its input '\n + 'is an emitted event. A door that emits none produces nothing to route, and a per-door SIEM cell '\n + 'could only ever restate that door\\'s audit cell.',\n [InfrastructureExcludedConcernCandidate.SUBJECT_ERASURE_REACHABILITY]:\n 'Splits cleanly into a half that is already a member and a half that is not a property of the door. '\n + 'The VISIBILITY-and-immutability half of erasure IS the retention hide — same predicate, same '\n + 'dispatch point — and is declared per door as RETENTION_HIDE. The DISCOVERY half (can the erasure '\n + 'orchestrator find the rows?) is answered by the resource graph: `eraseSubjectInPlace` walks the '\n + 'edges of the subject resource\\'s own configuration, so a row is reachable because of how its '\n + 'resource is declared, never because of which door wrote it.',\n};\n"]}

package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.d.ts CHANGED Viewed

@@ -34,9 +34,10 @@ export declare class IntrospectionResourceRepositoryBackendService {
     private readonly resolveSource;
     constructor(resourceType: string, logger: LoggerService, errorBuilder: ErrorBuilderBackendService, resolveSource: () => IntrospectionResourceSourceBackendPort | undefined);
     doByPath<T = any, U = any>(operationRepositoryPath: Parameters<typeof ResourcesConfig_OperationPathUtils.createOperationRepositoryPathKey>[0], executionContext: ExecutionContext<any>, id_or_ids_or_filter?: any, data?: U, options?: unknown): Promise<T>;
-    doByKey<T = any, U = any>(_operationRepositoryPathKey: string, executionContext: ExecutionContext<any>, id_or_ids_or_filter?: any, data?: U, options?: unknown): Promise<T>;
+    doByKey<T = any, U = any>(operationRepositoryPathKey: string, executionContext: ExecutionContext<any>, id_or_ids_or_filter?: any, data?: U, options?: unknown): Promise<T>;
     doByExecutionContext<T = any>(executionContext: ExecutionContext<any>, data?: any): Promise<T>;
     private doOperation;
+    private doOperationByIdentifier;
     read<T = undefined>(executionContext: ExecutionContext<any>, id_or_filter: any): Promise<any>;
     readForInternalScan<T = undefined>(executionContext: ExecutionContext<any>, id_or_filter: any): Promise<any>;
     /**
@@ -74,6 +75,7 @@ export declare class IntrospectionResourceRepositoryBackendService {
     atomicConditionalSet(): Promise<never>;
     atomicGuardedMutation(): Promise<never>;
     updateManyByRawFilter(): Promise<never>;
+    deleteManyByRawFilter(): Promise<never>;
     insertRawDocument(): Promise<never>;
     findManyByRawFilter(): Promise<never>;
     private readOnlyRefusal;

package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"introspection-resource-repository.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,kCAAkC,EAClC,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AAE3G;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,6CAA6C;IAEtD,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,aAAa,EAAE,MAAM,sCAAsC,GAAG,SAAS;~~IAe7E~~,QAAQ,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACpC,uBAAuB,EAAE,UAAU,CAAC,OAAO,kCAAkC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAClH,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,CAAC,CAAC;~~IAIA~~,OAAO,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,~~2BAA2B~~,EAAE,MAAM,~~EACnC~~,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,CAAC,CAAC;~~IAIA~~,oBAAoB,CAAC,CAAC,GAAG,GAAG,EACvC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,IAAI,CAAC,EAAE,GAAG,GACT,OAAO,CAAC,CAAC,CAAC;YAIC,WAAW;~~IAwBZ~~,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAK7F,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAIzH;;;;;;;;;;;;OAYG;IACU,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;~~IAQ3G~~;;;OAGG;IACU,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAI7G,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,GAAG,GACX,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;~~IAK3B~~,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;YAKvF,MAAM;IAiCpB,OAAO,CAAC,cAAc;IAoBT,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;IACnC,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;IAElD,OAAO,CAAC,eAAe;CAYxB"}
1	+ {"version":3,"file":"introspection-resource-repository.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,kCAAkC,EAClC,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AAE3G;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,6CAA6C;IAEtD,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,aAAa,EAAE,MAAM,sCAAsC,GAAG,SAAS;IA2B7E,QAAQ,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACpC,uBAAuB,EAAE,UAAU,CAAC,OAAO,kCAAkC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAClH,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,CAAC,CAAC;IASA,OAAO,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,0BAA0B,EAAE,MAAM,EAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,CAAC,CAAC;IAUA,oBAAoB,CAAC,CAAC,GAAG,GAAG,EACvC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,IAAI,CAAC,EAAE,GAAG,GACT,OAAO,CAAC,CAAC,CAAC;YAIC,WAAW;YAUX,uBAAuB;IAsBxB,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAK7F,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAIzH;;;;;;;;;;;;OAYG;IACU,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAe3G;;;OAGG;IACU,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAI7G,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,GAAG,GACX,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAM3B,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;YAKvF,MAAM;IAiCpB,OAAO,CAAC,cAAc;IAoBT,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;IACnC,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;IAElD,OAAO,CAAC,eAAe;CAYxB"}

package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { CoreResourceOperation, ErrorCustomMessageReference, ErrorType, ResourceOperationsUtils, } from '@wildo-ai/saas-models';
+import { CoreResourceOperation, ErrorCustomMessageReference, ErrorType, ResourceOperationsUtils, ResourcesConfig_OperationPathUtils, } from '@wildo-ai/saas-models';
 /**
  * Repository for `PersistenceAdapter.INTROSPECTION` — rows DERIVED per read, never stored.
  *
@@ -45,17 +45,33 @@ export class IntrospectionResourceRepositoryBackendService {
      * family — the adapter's writes are refused in `doOperation` as well as on their named members,
      * because the service dispatches by operation and never touches those members.
      */
+    /*
+     * The SUPPLIED path is the dispatch authority, never `executionContext.operation` — corrected
+     * 2026-09-01, and the distinction only becomes visible on the adapter's first non-read
+     * operation. The authorizer's pre-fetch reads the target of a WRITE-SHAPED operation by calling
+     * `doByPath({resourceIdentifier, operationIdentifier: READ}, …)` while the execution context
+     * still carries the operation being authorized; the Mongo and PostgreSQL repositories dispatch
+     * on the supplied key, so their pre-fetch reads. This repository dispatched on the CONTEXT's
+     * operation, so the same pre-fetch fell into the read-only refusal and every custom dispatch
+     * operation on an introspected resource died as 404 `authorizations_validation_failed` before
+     * its OVERRIDE_ALL implementation could run. Same rule as the twins: the caller names the
+     * repository intent; the context names what is being authorized.
+     */
     async doByPath(operationRepositoryPath, executionContext, id_or_ids_or_filter, data, options) {
-        return this.doOperation(executionContext.operation, executionContext, id_or_ids_or_filter, data);
+        return this.doOperationByIdentifier(String(operationRepositoryPath.operationIdentifier), executionContext, id_or_ids_or_filter, data);
     }
-    async doByKey(_operationRepositoryPathKey, executionContext, id_or_ids_or_filter, data, options) {
-        return this.doOperation(executionContext.operation, executionContext, id_or_ids_or_filter, data);
+    async doByKey(operationRepositoryPathKey, executionContext, id_or_ids_or_filter, data, options) {
+        const parsed = ResourcesConfig_OperationPathUtils.parseOperationRepositoryPathKey(operationRepositoryPathKey);
+        return this.doOperationByIdentifier(String(parsed.operationIdentifier), executionContext, id_or_ids_or_filter, data);
     }
     async doByExecutionContext(executionContext, data) {
         return this.doOperation(executionContext.operation, executionContext, undefined, data);
     }
     async doOperation(operation, executionContext, id_or_ids_or_filter, data) {
         const operationIdentifier = ResourceOperationsUtils.getCoreResourceOperationFromOperation(operation);
+        return this.doOperationByIdentifier(String(operationIdentifier ?? ''), executionContext, id_or_ids_or_filter, data);
+    }
+    async doOperationByIdentifier(operationIdentifier, executionContext, id_or_ids_or_filter, data) {
         switch (operationIdentifier) {
             case CoreResourceOperation.READ:
                 return this.read(executionContext, id_or_ids_or_filter);
@@ -66,7 +82,7 @@ export class IntrospectionResourceRepositoryBackendService {
             case CoreResourceOperation.SEARCH:
                 return this.search(executionContext, data?.query ?? '', data?.filter);
             default:
-                throw this.readOnlyRefusal(String(operationIdentifier ?? 'unknown operation'));
+                throw this.readOnlyRefusal(operationIdentifier || 'unknown operation');
         }
     }
     // ───────────────────────────── reads ─────────────────────────────
@@ -94,7 +110,14 @@ export class IntrospectionResourceRepositoryBackendService {
         const rows = await this.derive(executionContext, { filter: ids_or_filter });
         return {
             data: rows,
-            pagination: { page: 1, limit: rows.length, total: rows.length, totalPages: 1 },
+            /*
+             * `limit` is the page SIZE the answer was computed with, and the envelope schema holds it to
+             * >= 1 — `rows.length` alone turned every EMPTY derivation into a 500 at transformOutput
+             * ("pagination.limit: too_small"), measured 2026-09-01 the first time an introspection
+             * resource could legitimately be empty (a family-aspect collection of a not-landed family).
+             * An empty page of size 1 is honest; a page of size 0 is not a page.
+             */
+            pagination: { page: 1, limit: Math.max(rows.length, 1), total: rows.length, totalPages: 1 },
         };
     }
     /**
@@ -106,7 +129,8 @@ export class IntrospectionResourceRepositoryBackendService {
     }
     async search(executionContext, searchQuery, filter) {
         const rows = await this.derive(executionContext, { filter, searchQuery });
-        return { data: rows, total: rows.length, page: 1, limit: rows.length };
+        // Same >=1 floor as list() above — an empty search result is a page of size 1 with no rows.
+        return { data: rows, total: rows.length, page: 1, limit: Math.max(rows.length, 1) };
     }
     async count(executionContext, filter) {
         const rows = await this.derive(executionContext, { filter });
@@ -168,6 +192,7 @@ export class IntrospectionResourceRepositoryBackendService {
     async atomicConditionalSet() { throw this.readOnlyRefusal('atomicConditionalSet'); }
     async atomicGuardedMutation() { throw this.readOnlyRefusal('atomicGuardedMutation'); }
     async updateManyByRawFilter() { throw this.readOnlyRefusal('updateManyByRawFilter'); }
+    async deleteManyByRawFilter() { throw this.readOnlyRefusal('deleteManyByRawFilter'); }
     async insertRawDocument() { throw this.readOnlyRefusal('insertRawDocument'); }
     async findManyByRawFilter() { throw this.readOnlyRefusal('findManyByRawFilter'); }
     readOnlyRefusal(member) {