@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.d.ts

@@ -6,8 +6,13 @@
  *
  * The infrastructure tier is a deliberate bypass: its doors sit BELOW the service tier, take a
  * pre-built filter or an already-final document, and run no declared operation and no authorization.
- * Its clearest warrant is field-uniqueness validation, which runs INSIDE an in-flight operation's own
- * validation, where routing back through a declared operation would be circular.
+ * Its clearest warrant is the field-uniqueness check behind the `validate-field` route. A field
+ * declared unique with `scope: 'global'` must be counted across the ENTIRE collection — "no additional
+ * filter (intentional — check entire collection)" — including tenants the caller cannot see, and the
+ * answer returned as nothing but a number. A declared operation cannot serve that: `buildContextualFilter`
+ * would scope the count to the caller's tenant and the answer would simply be wrong. So the door
+ * deliberately waives tenant scoping and deliberately does NOT waive the retention hide, because
+ * counting a hidden row would turn the same number into an existence oracle.
  *
  * Its WEAKEST warrant is the one the tier has most often cited, and issue #100 asked for it to be
  * settled: "a consumable token is minted by a system action and consumed BEFORE authentication, so
@@ -17,7 +22,14 @@
  * fail-closes unless the resource opts in with `systemAccessPolicy.create = ALLOWED`, synthesises an
  * APPLICATION-scope super-admin context, and dispatches the resource's OWN declared CREATE —
  * which `CONSUMABLE_TOKENS` declares. So the framework does not owe a new "system principal"
- * vocabulary; one door is not using the one that exists. See `INSERT_DOCUMENT / authorization` below.
+ * vocabulary.
+ *
+ * That settles the FRAMEWORK question and deliberately does not settle the CALLER's: this door turns
+ * out to have a second, stronger reason to bypass the declared pipeline. `createsOneOffSession` is
+ * sealed `.excludeFromCreate()` so that no repository-create path can mint a session-establishing
+ * token, which is what makes `createToken` the sole minter and therefore the single funnel enforcing
+ * the impersonation-credential lifetime ceiling. A raw door is the shape that seal depends on. See
+ * `INSERT_DOCUMENT / authorization` below, and issue #102.
  *
  * What was missing is not correctness, it is a CONTRACT. Each door carried its own hand-written prose
  * about which cross-cutting invariant it upheld and which it skipped, so the tier's posture existed
@@ -31,10 +43,10 @@
  * EITHER enum fails to compile until every new cell is filled in. That is the property this file is
  * for: the missing case becomes a compiler error rather than something a reviewer has to notice.
  *
- * ## The tier is EIGHT doors, not the four that share a name
+ * ## The tier is NINE doors, not the four that share a name
  *
  * Issue #100 listed four, all suffixed `*ForInfrastructure`. That is the population the SUFFIX
- * describes, and it is half the tier. Four more handler members have the identical posture under a
+ * describes, and it was half the tier. Four more handler members have the identical posture under a
  * different name — `atomicIncrementField` and `atomicConditionalSet` carry, verbatim, the same
  * `@internal Framework-internal infrastructure primitive — NOT part of the operation lifecycle. The
  * caller owns authorization, scope-aware filter construction, and audit logging.` that the suffixed
@@ -80,6 +92,8 @@ export declare enum InfrastructureDoor {
     INSERT_DOCUMENT = "insertDocumentForInfrastructure",
     /** Multi-row guarded write (token revocation by relatedId, usage-record marking). */
     BULK_UPDATE = "bulkUpdateForInfrastructure",
+    /** Multi-row DELETE (the consumable-token retention sweep). */
+    DELETE_MANY = "deleteManyForInfrastructure",
     /** Single-row compare-and-swap write. */
     ATOMIC_GUARDED_MUTATION = "atomicGuardedMutation",
     /** Single-row counter increment (metering, quota accounting). */
@@ -103,7 +117,7 @@ export declare enum InfrastructureDoor {
  *    it, and the family has broken it in production (retention hide, transaction participation,
  *    adapter neutrality).
  *
- * This set is OPEN. Adding a member is the point: it immediately breaks compilation at all eight doors
+ * This set is OPEN. Adding a member is the point: it immediately breaks compilation at every door
  * until each declares a posture. Candidates DELIBERATELY excluded are recorded as data in
  * {@link INFRASTRUCTURE_CONCERN_CANDIDATES_EXCLUDED} rather than left absent — an absence is
  * indistinguishable from an oversight, which is the shape this whole file is about.

package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infrastructure-tier-contract.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/infrastructure-tier-contract.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH;;;;;;;GAOG;AACH,oBAAY,kBAAkB;IAC5B,gGAAgG;IAChG,eAAe,oCAAoC;IACnD,gFAAgF;IAChF,SAAS,8BAA8B;IACvC,oFAAoF;IACpF,oBAAoB,sBAAsB;IAC1C,sEAAsE;IACtE,eAAe,oCAAoC;IACnD,qFAAqF;IACrF,WAAW,gCAAgC;IAC3C,yCAAyC;IACzC,uBAAuB,0BAA0B;IACjD,iEAAiE;IACjE,sBAAsB,yBAAyB;IAC/C,wCAAwC;IACxC,sBAAsB,yBAAyB;CAChD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,iCAAiC;IAC3C;;;OAGG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;OAWG;IACH,cAAc,kBAAkB;IAChC;;;;OAIG;IACH,iBAAiB,qBAAqB;IACtC;;;;;OAKG;IACH,cAAc,kBAAkB;IAChC;;;;OAIG;IACH,kBAAkB,qBAAqB;IACvC;;;OAGG;IACH,WAAW,eAAe;IAC1B;;;;;;;;;OASG;IACH,yBAAyB,6BAA6B;IACtD;;;;OAIG;IACH,kBAAkB,sBAAsB;CACzC;AAED,oBAAY,4BAA4B;IACtC,6CAA6C;IAC7C,SAAS,cAAc;IACvB,sFAAsF;IACtF,MAAM,WAAW;IACjB,mGAAmG;IACnG,cAAc,mBAAmB;CAClC;AAED;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GACxC;IAAE,OAAO,EAAE,4BAA4B,CAAC,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,OAAO,EAAE,4BAA4B,CAAC,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7F;IAAE,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAmI7E,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAC/C,kBAAkB,EAClB,MAAM,CAAC,iCAAiC,EAAE,gCAAgC,CAAC,CA0O5E,CAAC;AAIF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8CAA8C,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM3F,CAAC;AAEF;;;;;;;;GAQG;AACH,oBAAY,sCAAsC;IAChD,YAAY,gBAAgB;IAC5B,4BAA4B,+BAA+B;CAC5D;AAED,eAAO,MAAM,0CAA0C,EAAE,MAAM,CAC7D,sCAAsC,EACtC,MAAM,CAcP,CAAC"}
+{"version":3,"file":"infrastructure-tier-contract.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/infrastructure-tier-contract.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH;;;;;;;GAOG;AACH,oBAAY,kBAAkB;IAC5B,gGAAgG;IAChG,eAAe,oCAAoC;IACnD,gFAAgF;IAChF,SAAS,8BAA8B;IACvC,oFAAoF;IACpF,oBAAoB,sBAAsB;IAC1C,sEAAsE;IACtE,eAAe,oCAAoC;IACnD,qFAAqF;IACrF,WAAW,gCAAgC;IAC3C,+DAA+D;IAC/D,WAAW,gCAAgC;IAC3C,yCAAyC;IACzC,uBAAuB,0BAA0B;IACjD,iEAAiE;IACjE,sBAAsB,yBAAyB;IAC/C,wCAAwC;IACxC,sBAAsB,yBAAyB;CAChD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,iCAAiC;IAC3C;;;OAGG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;OAWG;IACH,cAAc,kBAAkB;IAChC;;;;OAIG;IACH,iBAAiB,qBAAqB;IACtC;;;;;OAKG;IACH,cAAc,kBAAkB;IAChC;;;;OAIG;IACH,kBAAkB,qBAAqB;IACvC;;;OAGG;IACH,WAAW,eAAe;IAC1B;;;;;;;;;OASG;IACH,yBAAyB,6BAA6B;IACtD;;;;OAIG;IACH,kBAAkB,sBAAsB;CACzC;AAED,oBAAY,4BAA4B;IACtC,6CAA6C;IAC7C,SAAS,cAAc;IACvB,sFAAsF;IACtF,MAAM,WAAW;IACjB,mGAAmG;IACnG,cAAc,mBAAmB;CAClC;AAED;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GACxC;IAAE,OAAO,EAAE,4BAA4B,CAAC,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,OAAO,EAAE,4BAA4B,CAAC,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7F;IAAE,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AA4I7E,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAC/C,kBAAkB,EAClB,MAAM,CAAC,iCAAiC,EAAE,gCAAgC,CAAC,CAyR5E,CAAC;AAIF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8CAA8C,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM3F,CAAC;AAEF;;;;;;;;GAQG;AACH,oBAAY,sCAAsC;IAChD,YAAY,gBAAgB;IAC5B,4BAA4B,+BAA+B;CAC5D;AAED,eAAO,MAAM,0CAA0C,EAAE,MAAM,CAC7D,sCAAsC,EACtC,MAAM,CAcP,CAAC"}

package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.js

@@ -6,8 +6,13 @@
  *
  * The infrastructure tier is a deliberate bypass: its doors sit BELOW the service tier, take a
  * pre-built filter or an already-final document, and run no declared operation and no authorization.
- * Its clearest warrant is field-uniqueness validation, which runs INSIDE an in-flight operation's own
- * validation, where routing back through a declared operation would be circular.
+ * Its clearest warrant is the field-uniqueness check behind the `validate-field` route. A field
+ * declared unique with `scope: 'global'` must be counted across the ENTIRE collection — "no additional
+ * filter (intentional — check entire collection)" — including tenants the caller cannot see, and the
+ * answer returned as nothing but a number. A declared operation cannot serve that: `buildContextualFilter`
+ * would scope the count to the caller's tenant and the answer would simply be wrong. So the door
+ * deliberately waives tenant scoping and deliberately does NOT waive the retention hide, because
+ * counting a hidden row would turn the same number into an existence oracle.
  *
  * Its WEAKEST warrant is the one the tier has most often cited, and issue #100 asked for it to be
  * settled: "a consumable token is minted by a system action and consumed BEFORE authentication, so
@@ -17,7 +22,14 @@
  * fail-closes unless the resource opts in with `systemAccessPolicy.create = ALLOWED`, synthesises an
  * APPLICATION-scope super-admin context, and dispatches the resource's OWN declared CREATE —
  * which `CONSUMABLE_TOKENS` declares. So the framework does not owe a new "system principal"
- * vocabulary; one door is not using the one that exists. See `INSERT_DOCUMENT / authorization` below.
+ * vocabulary.
+ *
+ * That settles the FRAMEWORK question and deliberately does not settle the CALLER's: this door turns
+ * out to have a second, stronger reason to bypass the declared pipeline. `createsOneOffSession` is
+ * sealed `.excludeFromCreate()` so that no repository-create path can mint a session-establishing
+ * token, which is what makes `createToken` the sole minter and therefore the single funnel enforcing
+ * the impersonation-credential lifetime ceiling. A raw door is the shape that seal depends on. See
+ * `INSERT_DOCUMENT / authorization` below, and issue #102.
  *
  * What was missing is not correctness, it is a CONTRACT. Each door carried its own hand-written prose
  * about which cross-cutting invariant it upheld and which it skipped, so the tier's posture existed
@@ -31,10 +43,10 @@
  * EITHER enum fails to compile until every new cell is filled in. That is the property this file is
  * for: the missing case becomes a compiler error rather than something a reviewer has to notice.
  *
- * ## The tier is EIGHT doors, not the four that share a name
+ * ## The tier is NINE doors, not the four that share a name
  *
  * Issue #100 listed four, all suffixed `*ForInfrastructure`. That is the population the SUFFIX
- * describes, and it is half the tier. Four more handler members have the identical posture under a
+ * describes, and it was half the tier. Four more handler members have the identical posture under a
  * different name — `atomicIncrementField` and `atomicConditionalSet` carry, verbatim, the same
  * `@internal Framework-internal infrastructure primitive — NOT part of the operation lifecycle. The
  * caller owns authorization, scope-aware filter construction, and audit logging.` that the suffixed
@@ -81,6 +93,8 @@ export var InfrastructureDoor;
     InfrastructureDoor["INSERT_DOCUMENT"] = "insertDocumentForInfrastructure";
     /** Multi-row guarded write (token revocation by relatedId, usage-record marking). */
     InfrastructureDoor["BULK_UPDATE"] = "bulkUpdateForInfrastructure";
+    /** Multi-row DELETE (the consumable-token retention sweep). */
+    InfrastructureDoor["DELETE_MANY"] = "deleteManyForInfrastructure";
     /** Single-row compare-and-swap write. */
     InfrastructureDoor["ATOMIC_GUARDED_MUTATION"] = "atomicGuardedMutation";
     /** Single-row counter increment (metering, quota accounting). */
@@ -104,7 +118,7 @@ export var InfrastructureDoor;
  *    it, and the family has broken it in production (retention hide, transaction participation,
  *    adapter neutrality).
  *
- * This set is OPEN. Adding a member is the point: it immediately breaks compilation at all eight doors
+ * This set is OPEN. Adding a member is the point: it immediately breaks compilation at every door
  * until each declares a posture. Candidates DELIBERATELY excluded are recorded as data in
  * {@link INFRASTRUCTURE_CONCERN_CANDIDATES_EXCLUDED} rather than left absent — an absence is
  * indistinguishable from an oversight, which is the shape this whole file is about.
@@ -187,7 +201,7 @@ const { AUTHORIZATION, TENANT_SCOPING, SCHEMA_VALIDATION, RETENTION_HIDE, RAG_IN
 // written at the door — moved from that door's JSDoc rather than paraphrased, so the rationale exists
 // in exactly one place and cannot drift from the copy it was summarised into.
 /**
- * Identical at all eight doors. The placement note is the real mitigation: these members live on the
+ * Identical at every door. The placement note is the real mitigation: these members live on the
  * HANDLER and not on the `BackendResourceRepository` interface an application's custom code is handed.
  */
 const AUTHORIZATION_WAIVED = {
@@ -198,7 +212,7 @@ const AUTHORIZATION_WAIVED = {
     compensation: 'Declared on the handler rather than on the `BackendResourceRepository` interface, so custom '
         + 'application code cannot reach these doors through the repository it is given.',
 };
-/** Identical at all eight doors: the caller's filter or document is the whole confinement. */
+/** Identical at every door: the caller's filter or document is the whole confinement. */
 const TENANT_SCOPING_WAIVED = {
     posture: WAIVED,
     reason: 'The adapters\' `buildContextualFilter` — which injects the resource\'s scope FK — runs on the '
@@ -209,7 +223,7 @@ const TENANT_SCOPING_WAIVED = {
         + 'reached today only by field-uniqueness validation, consumable tokens and usage metering, each '
         + 'of which builds its own filter. Nothing mechanical enforces that on a future caller.',
 };
-/** Identical at all eight doors: the door emits nothing, and nothing downstream substitutes for it. */
+/** Identical at every door: the door emits nothing, and nothing downstream substitutes for it. */
 const AUDIT_TRAIL_WAIVED = {
     posture: WAIVED,
     reason: 'No operation lifecycle runs, so no auditable event is emitted by the door itself.',
@@ -226,8 +240,8 @@ const RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ = {
     reason: 'Read-only: writes nothing, so no `.ragSource()` field can change through it.',
 };
 /**
- * The five write doors, minus {@link InfrastructureDoor.INSERT_DOCUMENT}, which has its own partial
- * compensation (the cast).
+ * The pre-built WRITE doors, minus {@link InfrastructureDoor.INSERT_DOCUMENT}, which has its own partial
+ * compensation (the cast), and minus {@link InfrastructureDoor.DELETE_MANY}, which materializes no value.
  */
 const SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE = {
     posture: WAIVED,
@@ -237,7 +251,15 @@ const SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE = {
     compensation: 'Shape only, never values: `describeGuardedMutationInexpressibility` refuses a mutation that '
         + 'cannot be expressed on every adapter. Nothing checks what the mutation SAYS.',
 };
-/** Seven of the eight doors accept `RepositoryOptions` and forward them unchanged. */
+/**
+ * The plain reason SEVEN doors give: they accept `RepositoryOptions` and forward them unchanged.
+ *
+ * ALL EIGHT doors do that now. {@link InfrastructureDoor.COUNT_DOCUMENTS} states its own cell rather
+ * than reusing this one because it has a longer story to tell — it was the one door that accepted no
+ * options at all (issue #104), and its cell records that rather than letting the repair erase it.
+ * This comment previously read "every door BUT COUNT_DOCUMENTS accepts them", which was true when it
+ * was written and became a false description of the tier the moment the door was fixed.
+ */
 const TRANSACTION_PARTICIPATION_PRESERVED = {
     posture: PRESERVED,
     how: 'Accepts `RepositoryOptions` and forwards them to the primitive, so a caller already inside a '
@@ -246,7 +268,8 @@ const TRANSACTION_PARTICIPATION_PRESERVED = {
 /**
  * The four doors whose only adapter-neutrality claim is that they dispatch a primitive declared on the
  * `BackendResourceRepository` interface — so an adapter omitting one fails to compile rather than
- * throwing on first use. All eight raw primitives are declared there and implemented on both arms.
+ * throwing on first use. Every raw primitive is declared there and implemented on both persisting arms
+ * (the read-only HTTP-API and introspection arms declare each one as an explicit refusal).
  */
 const ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT = (primitive) => ({
     posture: PRESERVED,
@@ -267,8 +290,8 @@ const RETENTION_HIDE_PRESERVED_AT_DISPATCH = (consequence) => ({
         + 'a future adapter inherits the predicate by construction.',
 });
 /**
- * The five write doors' RAG posture, identical in mechanism and differing only in what the sweep
- * reconciles for that door's shape. Moved from each door's own `rag-ingestion-gate: N/A —` comment,
+ * The materializing write doors' RAG posture, identical in mechanism and differing only in what the
+ * sweep reconciles for that door's shape. Moved from each door's own `rag-ingestion-gate: N/A —` comment,
  * which the sibling guard `rag-ingestion-write-door-coverage.guard.test.ts` still requires to be
  * present AT the door; that guard checks the waiver EXISTS, this table records what it says.
  */
@@ -294,16 +317,15 @@ export const INFRASTRUCTURE_TIER_CONTRACT = {
         [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,
         [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,
         [TRANSACTION_PARTICIPATION]: {
-            posture: WAIVED,
-            reason: 'THE ONE DOOR THAT CANNOT PARTICIPATE, and not by decision: it accepts no `RepositoryOptions` '
-                + 'parameter at all, so a caller inside a transaction counts OUTSIDE it and cannot see its own '
-                + 'uncommitted rows. `countByRawFilter` accepts and honours options on both arms; only this '
-                + 'door drops them — the identical shape its sibling `bulkUpdateForInfrastructure` records as '
-                + '"a silent correctness hole", at the one door nobody enumerated. Surfaced by filling this '
-                + 'table, deliberately recorded rather than repaired here: fixing a door inside the change that '
-                + 'declares the contract would hide the demonstration that the contract works. Filed as issue '
-                + '#104; flip this cell to PRESERVED when it lands.',
-            compensation: null,
+            posture: PRESERVED,
+            how: 'Accepts `RepositoryOptions` and forwards them to `countByRawFilter`, matching all seven '
+                + 'siblings. It was the ONE door in the tier that accepted none, so a caller inside a '
+                + 'transaction counted OUTSIDE it — the identical shape `bulkUpdateForInfrastructure` records '
+                + 'as a silent correctness hole, at the door nobody enumerated until this table gave every '
+                + 'door a row to fill in. Surfaced by filling the table (issue #104), fixed separately from '
+                + 'the change that declared the contract so the demonstration stayed visible. No caller passes '
+                + 'options today, so the forward is pinned rather than behaviour-verified: '
+                + '`__tests__/infrastructure-tier-transaction-forwarding.test.ts`.',
         },
         [ADAPTER_NEUTRALITY]: {
             posture: PRESERVED,
@@ -354,13 +376,18 @@ export const INFRASTRUCTURE_TIER_CONTRACT = {
                 + '(INTERNAL_CALL, ORG_ADMIN, with a requestDto). Routing through it would restore schema '
                 + 'validation, the RAG ingestion hook, the audit trail and the scope-context channel at this '
                 + 'door — five of the eight rows below stop being waivers.',
-            compensation: 'Handler-only placement, as for every door here. What stops the migration is narrow and '
-                + 'specific rather than principled — the declared requestDto omits the `_id`, `createdAt` and '
-                + '`updatedAt` this caller supplies deliberately; `CONSUMABLE_TOKENS` declares no '
-                + '`systemAccessPolicy`, so `createAsSystem` fail-closes today; the declared variant is gated '
-                + 'on ORG_ADMIN at organization scope, which a signup-time magic-link mint does not have; and '
-                + 'the caller reads the raw duplicate-key error to detect an `activeGenerationKey` conflict. '
-                + 'Tracked as issue #102 — the decision to migrate the caller — rather than answered here.',
+            compensation: 'Handler-only placement, as for every door here — AND, at this door only, a deliberate '
+                + 'security seal that makes the raw insert load-bearing rather than incidental. '
+                + '`createsOneOffSession` is `.excludeFromCreate().excludeFromUpdate()` so that no '
+                + 'repository-create path can mint a session-establishing token, which leaves `createToken` — '
+                + 'this door\'s caller — the SOLE minter and therefore the single funnel enforcing '
+                + '`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` fail-closed at issuance. That token is an '
+                + 'impersonation credential: exchanging it mints a JWT session for another user. Routing the '
+                + 'mint through `createAsSystem` would strip the field (measured: the preserve list resolves to '
+                + '`["organizationId","userId"]`, because a defaulted excluded field is deliberately withheld) '
+                + 'and silently mint every such token as non-session-establishing; relaxing the exclusion to '
+                + 'fix that would open a second mint path that never meets the ceiling. So the waiver here is '
+                + 'not an unpaid debt — it is the shape the credential ceiling depends on. See issue #102.',
         },
         [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,
         [SCHEMA_VALIDATION]: {
@@ -415,6 +442,43 @@ export const INFRASTRUCTURE_TIER_CONTRACT = {
                 + 'not be bulk-updated at all.',
         },
     },
+    [InfrastructureDoor.DELETE_MANY]: {
+        [AUTHORIZATION]: AUTHORIZATION_WAIVED,
+        [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,
+        [SCHEMA_VALIDATION]: {
+            posture: NOT_APPLICABLE,
+            reason: 'A DELETE writes no value, so there is nothing for a declared schema to validate. This is the '
+                + 'one WRITE door for which the concern is genuinely inapplicable rather than waived — its '
+                + 'siblings all carry a pre-built payload a schema could have checked and did not.',
+        },
+        [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH('a retained (erased-but-kept) row is immutable, and DESTROYING one is the sharpest form of '
+            + 'mutating it — the retention posture exists precisely to keep a row that must be kept, so a '
+            + 'framework sweep must not be the thing that reaps it.'),
+        [RAG_INGESTION_GATE]: {
+            posture: NOT_APPLICABLE,
+            reason: 'Materializes no value, so no `.ragSource()` field can change through it and there is nothing '
+                + 'to re-index. The mirror obligation — REMOVING a deleted row\'s chunks — is not this concern '
+                + 'and is not owned here either: the removal-seam guard '
+                + '(`rag-chunk-removal-seam-coverage.guard.test.ts`) excludes the raw repository doors BY '
+                + 'DECLARATION, bounding every one of them on the hourly reconciliation sweep\'s orphan pass, '
+                + 'and this door joins that family rather than opening a new question.',
+        },
+        [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,
+        [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,
+        [ADAPTER_NEUTRALITY]: {
+            posture: PRESERVED,
+            how: 'Dispatches the interface-declared `deleteManyByRawFilter`, so an adapter that omits it fails '
+                + 'to compile. THE DOOR EXISTS BECAUSE ITS ABSENCE WAS THE DEFECT: with a bulk UPDATE on the '
+                + 'tier and no bulk DELETE, the consumable-tokens cleanup batch had one route to reap rows — '
+                + 'reaching past the contract for `MongoDBService.getConnection()` — which made the framework\'s '
+                + 'only credential-retention sweep MongoDB-only. It was invisible while every application ran a '
+                + 'mongod beside PostgreSQL, and failed every six hours on the first one (`wonder-crm`) that '
+                + 'did not, with spent password-reset / invitation / magic-link rows accumulating with no '
+                + 'sweep. Note the neutrality this door CANNOT confer: an unexpressible predicate (`$expr`, a '
+                + 'column-to-column comparison) is still the caller\'s problem, and the batch resolves its one '
+                + 'such lane by reading candidates and comparing in memory.',
+        },
+    },
     [InfrastructureDoor.ATOMIC_GUARDED_MUTATION]: {
         [AUTHORIZATION]: AUTHORIZATION_WAIVED,
         [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,

package/dist/esm/base-classes/services/repositories/infrastructure-tier-contract.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"infrastructure-tier-contract.backend.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/infrastructure-tier-contract.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kBAiBX;AAjBD,WAAY,kBAAkB;IAC5B,gGAAgG;IAChG,yEAAmD,CAAA;IACnD,gFAAgF;IAChF,6DAAuC,CAAA;IACvC,oFAAoF;IACpF,gEAA0C,CAAA;IAC1C,sEAAsE;IACtE,yEAAmD,CAAA;IACnD,qFAAqF;IACrF,iEAA2C,CAAA;IAC3C,yCAAyC;IACzC,uEAAiD,CAAA;IACjD,iEAAiE;IACjE,qEAA+C,CAAA;IAC/C,wCAAwC;IACxC,qEAA+C,CAAA;AACjD,CAAC,EAjBW,kBAAkB,KAAlB,kBAAkB,QAiB7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,iCA4DX;AA5DD,WAAY,iCAAiC;IAC3C;;;OAGG;IACH,oEAA+B,CAAA;IAC/B;;;;;;;;;;;OAWG;IACH,qEAAgC,CAAA;IAChC;;;;OAIG;IACH,2EAAsC,CAAA;IACtC;;;;;OAKG;IACH,qEAAgC,CAAA;IAChC;;;;OAIG;IACH,4EAAuC,CAAA;IACvC;;;OAGG;IACH,+DAA0B,CAAA;IAC1B;;;;;;;;;OASG;IACH,2FAAsD,CAAA;IACtD;;;;OAIG;IACH,6EAAwC,CAAA;AAC1C,CAAC,EA5DW,iCAAiC,KAAjC,iCAAiC,QA4D5C;AAED,MAAM,CAAN,IAAY,4BAOX;AAPD,WAAY,4BAA4B;IACtC,6CAA6C;IAC7C,uDAAuB,CAAA;IACvB,sFAAsF;IACtF,iDAAiB,CAAA;IACjB,mGAAmG;IACnG,iEAAiC,CAAA;AACnC,CAAC,EAPW,4BAA4B,KAA5B,4BAA4B,QAOvC;AAYD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,4BAA4B,CAAC;AAC3E,MAAM,EACJ,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,yBAAyB,EACzB,kBAAkB,GACnB,GAAG,iCAAiC,CAAC;AAEtC,oGAAoG;AACpG,mGAAmG;AACnG,sGAAsG;AACtG,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,oBAAoB,GAAqC;IAC7D,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,+FAA+F;UAC7F,+FAA+F;UAC/F,yBAAyB;IAC7B,YAAY,EACV,8FAA8F;UAC5F,+EAA+E;CACpF,CAAC;AAEF,8FAA8F;AAC9F,MAAM,qBAAqB,GAAqC;IAC9D,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,gGAAgG;UAC9F,4FAA4F;UAC5F,8FAA8F;UAC9F,oCAAoC;IACxC,YAAY,EACV,iGAAiG;UAC/F,gGAAgG;UAChG,sFAAsF;CAC3F,CAAC;AAEF,uGAAuG;AACvG,MAAM,kBAAkB,GAAqC;IAC3D,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,mFAAmF;IAC3F,YAAY,EAAE,IAAI;CACnB,CAAC;AAEF,gGAAgG;AAChG,MAAM,wCAAwC,GAAqC;IACjF,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,oFAAoF;CAC7F,CAAC;AAEF,4BAA4B;AAC5B,MAAM,yCAAyC,GAAqC;IAClF,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,8EAA8E;CACvF,CAAC;AAEF;;;GAGG;AACH,MAAM,wCAAwC,GAAqC;IACjF,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,8FAA8F;UAC5F,iGAAiG;UACjG,+CAA+C;IACnD,YAAY,EACV,8FAA8F;UAC5F,8EAA8E;CACnF,CAAC;AAEF,sFAAsF;AACtF,MAAM,mCAAmC,GAAqC;IAC5E,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,+FAA+F;UAC7F,mEAAmE;CACxE,CAAC;AAEF;;;;GAIG;AACH,MAAM,wCAAwC,GAAG,CAAC,SAAiB,EAAoC,EAAE,CAAC,CAAC;IACzG,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,gBAAgB,SAAS,2EAA2E;UAClG,6FAA6F;UAC7F,uFAAuF;CAC5F,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,oCAAoC,GAAG,CAAC,WAAmB,EAAoC,EAAE,CAAC,CAAC;IACvG,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,oFAAoF,WAAW,GAAG;UAChG,mGAAmG;UACnG,0DAA0D;CAC/D,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,kCAAkC,GAAG,CAAC,KAAa,EAAoC,EAAE,CAAC,CAAC;IAC/F,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,8FAA8F;UAC5F,0EAA0E;IAC9E,YAAY,EAAE,wCAAwC,KAAK,EAAE;CAC9D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAGrC;IACF,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE;QACpC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,2FAA2F;kBACzF,4FAA4F;kBAC5F,8FAA8F;kBAC9F,6FAA6F;kBAC7F,0CAA0C;SAC/C;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE;YAC3B,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,+FAA+F;kBAC7F,8FAA8F;kBAC9F,2FAA2F;kBAC3F,6FAA6F;kBAC7F,2FAA2F;kBAC3F,+FAA+F;kBAC/F,6FAA6F;kBAC7F,kDAAkD;YACtD,YAAY,EAAE,IAAI;SACnB;QACD,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,4FAA4F;kBAC5F,6FAA6F;kBAC7F,uBAAuB;SAC5B;KACF;IAED,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC9B,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,mGAAmG;cACjG,gBAAgB,CACnB;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE,wCAAwC,CAAC,qBAAqB,CAAC;KACtF;IAED,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE;QACzC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,0FAA0F;kBACxF,oFAAoF;YACxF,YAAY,EACV,6FAA6F;kBAC3F,kFAAkF;kBAClF,6DAA6D;SAClE;QACD,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,gGAAgG;cAC9F,iBAAiB,CACpB;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE,wCAAwC,CAAC,mBAAmB,CAAC;KACpF;IAED,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE;QACpC,CAAC,aAAa,CAAC,EAAE;YACf,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,8FAA8F;kBAC5F,4FAA4F;kBAC5F,2FAA2F;kBAC3F,4FAA4F;kBAC5F,6FAA6F;kBAC7F,wFAAwF;kBACxF,yFAAyF;kBACzF,4FAA4F;kBAC5F,yDAAyD;YAC7D,YAAY,EACV,yFAAyF;kBACvF,6FAA6F;kBAC7F,iFAAiF;kBACjF,6FAA6F;kBAC7F,6FAA6F;kBAC7F,4FAA4F;kBAC5F,yFAAyF;SAC9F;QACD,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE;YACnB,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,+FAA+F;kBAC7F,wFAAwF;kBACxF,0FAA0F;kBAC1F,6CAA6C;YACjD,YAAY,EACV,sFAAsF;kBACpF,6FAA6F;kBAC7F,yFAAyF;kBACzF,0CAA0C;SAC/C;QACD,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,cAAc;YACvB,MAAM,EACJ,+FAA+F;kBAC7F,iEAAiE;SACtE;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,4CAA4C,CAC7C;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,iGAAiG;kBAC/F,gGAAgG;kBAChG,oFAAoF;kBACpF,8FAA8F;kBAC9F,yDAAyD;SAC9D;KACF;IAED,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE;QAChC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,oGAAoG;cAClG,mCAAmC,CACtC;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,gEAAgE,CACjE;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE;YAC3B,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,qFAAqF;kBACrF,gGAAgG;kBAChG,8FAA8F;kBAC9F,kDAAkD;SACvD;QACD,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,8FAA8F;kBAC9F,gGAAgG;kBAChG,6BAA6B;SAClC;KACF;IAED,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,EAAE;QAC5C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,4EAA4E,CAC7E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,+DAA+D,CAChE;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,6FAA6F;kBAC3F,8FAA8F;kBAC9F,kCAAkC;SACvC;KACF;IAED,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE;QAC3C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,8EAA8E,CAC/E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,8FAA8F;cAC5F,oBAAoB,CACvB;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,kGAAkG;kBAChG,8FAA8F;kBAC9F,+FAA+F;kBAC/F,6FAA6F;kBAC7F,sCAAsC;SAC3C;KACF;IAED,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE;QAC3C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,8EAA8E,CAC/E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,2FAA2F,CAC5F;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,yFAAyF;kBACvF,8FAA8F;kBAC9F,4FAA4F;kBAC5F,uFAAuF;kBACvF,0FAA0F;kBAC1F,kFAAkF;SACvF;KACF;CACF,CAAC;AAEF,oGAAoG;AAEpG;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAqC;IAC9F,oBAAoB,EAClB,kGAAkG;UAChG,6FAA6F;UAC7F,2FAA2F;UAC3F,0BAA0B;CAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,sCAGX;AAHD,WAAY,sCAAsC;IAChD,sEAA4B,CAAA;IAC5B,qGAA2D,CAAA;AAC7D,CAAC,EAHW,sCAAsC,KAAtC,sCAAsC,QAGjD;AAED,MAAM,CAAC,MAAM,0CAA0C,GAGnD;IACF,CAAC,sCAAsC,CAAC,YAAY,CAAC,EACnD,8FAA8F;UAC5F,mGAAmG;UACnG,kGAAkG;UAClG,kDAAkD;IACtD,CAAC,sCAAsC,CAAC,4BAA4B,CAAC,EACnE,qGAAqG;UACnG,+FAA+F;UAC/F,mGAAmG;UACnG,kGAAkG;UAClG,+FAA+F;UAC/F,6DAA6D;CAClE,CAAC","sourcesContent":["/**\n * The contract every INFRASTRUCTURE-TIER door on {@link RepositoriesRegistryHandlerBackendService}\n * answers to.\n *\n * ## Why this file exists\n *\n * The infrastructure tier is a deliberate bypass: its doors sit BELOW the service tier, take a\n * pre-built filter or an already-final document, and run no declared operation and no authorization.\n * Its clearest warrant is field-uniqueness validation, which runs INSIDE an in-flight operation's own\n * validation, where routing back through a declared operation would be circular.\n *\n * Its WEAKEST warrant is the one the tier has most often cited, and issue #100 asked for it to be\n * settled: \"a consumable token is minted by a system action and consumed BEFORE authentication, so\n * there is genuinely no principal to authorize\". That conflates two moments. CONSUMPTION has no\n * principal — the token IS the credential. MINTING is a write the running system performs inside a\n * flow it controls, and the framework already has a vocabulary for exactly that: `createAsSystem`\n * fail-closes unless the resource opts in with `systemAccessPolicy.create = ALLOWED`, synthesises an\n * APPLICATION-scope super-admin context, and dispatches the resource's OWN declared CREATE —\n * which `CONSUMABLE_TOKENS` declares. So the framework does not owe a new \"system principal\"\n * vocabulary; one door is not using the one that exists. See `INSERT_DOCUMENT / authorization` below.\n *\n * What was missing is not correctness, it is a CONTRACT. Each door carried its own hand-written prose\n * about which cross-cutting invariant it upheld and which it skipped, so the tier's posture existed\n * only as a set of independent rationales. Adding a door, or a new invariant, meant re-deriving the\n * obligation by hand at every site with nothing mechanical to say whether it had been done — the exact\n * failure shape `.claude/rules/invariant-call-site-enumeration.md` records, where an invariant is\n * applied at one of its N sites and the miss is invisible.\n *\n * So the posture is DECLARED here instead, once, as data. Because the table is typed\n * `Record<InfrastructureDoor, Record<InfrastructureCrossCuttingConcern, …>>`, adding a member to\n * EITHER enum fails to compile until every new cell is filled in. That is the property this file is\n * for: the missing case becomes a compiler error rather than something a reviewer has to notice.\n *\n * ## The tier is EIGHT doors, not the four that share a name\n *\n * Issue #100 listed four, all suffixed `*ForInfrastructure`. That is the population the SUFFIX\n * describes, and it is half the tier. Four more handler members have the identical posture under a\n * different name — `atomicIncrementField` and `atomicConditionalSet` carry, verbatim, the same\n * `@internal Framework-internal infrastructure primitive — NOT part of the operation lifecycle. The\n * caller owns authorization, scope-aware filter construction, and audit logging.` that the suffixed\n * doors carry; `atomicGuardedMutation` and `readUnscopedByKey` likewise dispatch a caller-built filter\n * straight to an adapter with no operation above them.\n *\n * That is why {@link INFRASTRUCTURE_TIER_CONTRACT}'s pin discovers the tier by what a member DOES —\n * resolving a repository and dispatching to it — rather than by what it is called. Enumerating by name\n * finds every site that agrees with you about naming, which is `invariant-call-site-enumeration.md`\n * #12 and #20 in one. The sibling guard `rag-ingestion-write-door-coverage.guard.test.ts` had already\n * reached the same population from the write side: three of its five raw write doors carry no suffix.\n *\n * ## What this file is NOT\n *\n * It does not gate anything at runtime. A door's behaviour lives in the door; this is the record of\n * what that behaviour promises, kept adjacent and kept complete. Turning it into a runtime guard would\n * add a second authority that can disagree with the code, which is the failure this repository has\n * paid for repeatedly (see `.claude/rules/one-source-of-truth.md`).\n *\n * It is also not a place to fix a door. Filling the table surfaced one real asymmetry — see\n * {@link InfrastructureCrossCuttingConcern.TRANSACTION_PARTICIPATION} at\n * {@link InfrastructureDoor.COUNT_DOCUMENTS} — and it is RECORDED here rather than quietly repaired,\n * because a waiver nobody can see is the condition this contract exists to end.\n *\n * @see issue #100 — the decision this file implements.\n */\n\n/**\n * The doors.\n *\n * Each value is the METHOD NAME on the handler, deliberately, so\n * `__tests__/infrastructure-tier-contract.guard.test.ts` can discover the real tier from the handler's\n * source and assert this enum matches it exactly. A hand-maintained list that merely LOOKS complete is\n * what this file exists to prevent, so the list is checked against the class rather than trusted.\n */\nexport enum InfrastructureDoor {\n  /** Backs field-uniqueness validation, which runs INSIDE an in-flight operation's validation. */\n  COUNT_DOCUMENTS = 'countDocumentsForInfrastructure',\n  /** Multi-row read for a framework-internal reader (consumable-token lookup). */\n  FIND_MANY = 'findManyForInfrastructure',\n  /** Single-row read below BOTH the operation tier and the execution-context tier. */\n  READ_UNSCOPED_BY_KEY = 'readUnscopedByKey',\n  /** INSERT of an already-final document (consumable-token minting). */\n  INSERT_DOCUMENT = 'insertDocumentForInfrastructure',\n  /** Multi-row guarded write (token revocation by relatedId, usage-record marking). */\n  BULK_UPDATE = 'bulkUpdateForInfrastructure',\n  /** Single-row compare-and-swap write. */\n  ATOMIC_GUARDED_MUTATION = 'atomicGuardedMutation',\n  /** Single-row counter increment (metering, quota accounting). */\n  ATOMIC_INCREMENT_FIELD = 'atomicIncrementField',\n  /** Single-row conditional set/clear. */\n  ATOMIC_CONDITIONAL_SET = 'atomicConditionalSet',\n}\n\n/**\n * The cross-cutting invariants a door must answer for explicitly.\n *\n * ## The admission criterion, so the next member is not settled by taste\n *\n * A concern belongs here when it is an invariant that holds across the whole persistence boundary AND\n * a door can silently fail to uphold it. Members arrive on one of two bases, and each member's own\n * doc-comment names which:\n *\n *  - **conferred from above** — an ordinary declared operation gets it for free at the controller or\n *    service tier, and a door that runs no operation therefore does not (authorization, tenant\n *    scoping, schema validation, the RAG ingestion gate, the audit trail);\n *  - **promised by the door itself** — nothing above confers it; the door's own general name promises\n *    it, and the family has broken it in production (retention hide, transaction participation,\n *    adapter neutrality).\n *\n * This set is OPEN. Adding a member is the point: it immediately breaks compilation at all eight doors\n * until each declares a posture. Candidates DELIBERATELY excluded are recorded as data in\n * {@link INFRASTRUCTURE_CONCERN_CANDIDATES_EXCLUDED} rather than left absent — an absence is\n * indistinguishable from an oversight, which is the shape this whole file is about.\n */\nexport enum InfrastructureCrossCuttingConcern {\n  /**\n   * CONFERRED FROM ABOVE. Who may do this. The controller resolves it from the declared operation's\n   * roles and variant; these doors run no operation, so nothing resolves a principal.\n   */\n  AUTHORIZATION = 'authorization',\n  /**\n   * CONFERRED FROM ABOVE. Which TENANT'S rows this statement may reach. The adapters' own\n   * `buildContextualFilter` injects the scope FK (organizationId / userId) into every operation-tier\n   * filter; the raw primitives these doors dispatch deliberately do not call it — \"the caller's filter\n   * is the whole confinement, by design\".\n   *\n   * Distinct from {@link AUTHORIZATION} on purpose, and the distinction is the tier's own: the handler\n   * states at `readUnscopedByKey` that \"a read that skips tenant scoping must NOT also skip erasure\n   * retention: those are different questions\". Roles and rows are two gates, answered from two inputs,\n   * and fusing them is what `.claude/rules/administrative-continuity-floors.md` records as producing\n   * cross-tenant reach nobody declared.\n   */\n  TENANT_SCOPING = 'tenantScoping',\n  /**\n   * CONFERRED FROM ABOVE. That a written value was checked against a declared schema. The controller's\n   * `validateRequestData` parses the payload through the operation's `requestDto` before any write;\n   * these doors take an already-built document or mutation descriptor and no Zod schema sees it.\n   */\n  SCHEMA_VALIDATION = 'schemaValidation',\n  /**\n   * PROMISED BY THE DOOR. An erased-but-retained row must stay invisible to reads and unaffected by\n   * writes — \"kept but frozen\". The tier applies it at its own single dispatch point\n   * (`applyRetentionHideToRawFilter`) rather than in each adapter, so a future adapter inherits it by\n   * construction.\n   */\n  RETENTION_HIDE = 'retentionHide',\n  /**\n   * CONFERRED FROM ABOVE. A `.ragSource()` field changing must re-derive the affected chunk set. The\n   * hook lives at the service tier's single post-commit chokepoint, which is ABOVE these doors, so no\n   * door can feed it.\n   */\n  RAG_INGESTION_GATE = 'ragIngestionGate',\n  /**\n   * CONFERRED FROM ABOVE. A security-relevant action must leave an auditable record. The operation\n   * lifecycle emits it; no lifecycle runs here.\n   */\n  AUDIT_TRAIL = 'auditTrail',\n  /**\n   * PROMISED BY THE DOOR. A statement issued inside a caller's transaction must ENROL in it. Every\n   * underlying primitive accepts `RepositoryOptions` and both adapters honour it, so whether a door\n   * participates is decided entirely by whether the door accepts and forwards them.\n   *\n   * This is a member because the family has already lost it once, silently and expensively:\n   * `bulkUpdateForInfrastructure` neither accepted nor forwarded options, so `revokeTokensByRelatedId`\n   * committed immediately regardless of its caller's transaction and a driver retry observed a count\n   * of 0 for work that had happened exactly once.\n   */\n  TRANSACTION_PARTICIPATION = 'transactionParticipation',\n  /**\n   * PROMISED BY THE DOOR. A generally-named capability must work on every persistence adapter, not\n   * only the one it was written against. A member here is one the family has broken twice — both\n   * breakages were a reach for `(repository as any).mongooseModel` behind a neutral-sounding name.\n   */\n  ADAPTER_NEUTRALITY = 'adapterNeutrality',\n}\n\nexport enum InfrastructureConcernPosture {\n  /** The door itself upholds the invariant. */\n  PRESERVED = 'preserved',\n  /** The invariant could apply and deliberately is not upheld. A reason is required. */\n  WAIVED = 'waived',\n  /** The invariant cannot apply to this door's shape at all (e.g. a retention hide on an INSERT). */\n  NOT_APPLICABLE = 'not-applicable',\n}\n\n/**\n * `compensation` is the field that makes a waiver reviewable: it names what ELSE catches the gap, or\n * is `null` to state plainly that nothing does. A waiver with no compensation is not forbidden — it is\n * simply visible, which is the whole ask of issue #100.\n */\nexport type InfrastructureConcernDeclaration =\n  | { posture: InfrastructureConcernPosture.PRESERVED; how: string }\n  | { posture: InfrastructureConcernPosture.WAIVED; reason: string; compensation: string | null }\n  | { posture: InfrastructureConcernPosture.NOT_APPLICABLE; reason: string };\n\nconst { PRESERVED, WAIVED, NOT_APPLICABLE } = InfrastructureConcernPosture;\nconst {\n  AUTHORIZATION,\n  TENANT_SCOPING,\n  SCHEMA_VALIDATION,\n  RETENTION_HIDE,\n  RAG_INGESTION_GATE,\n  AUDIT_TRAIL,\n  TRANSACTION_PARTICIPATION,\n  ADAPTER_NEUTRALITY,\n} = InfrastructureCrossCuttingConcern;\n\n// ── Declarations shared verbatim across doors ────────────────────────────────────────────────────\n// Written once where the reason is genuinely the same one. Where a door's reason is its own, it is\n// written at the door — moved from that door's JSDoc rather than paraphrased, so the rationale exists\n// in exactly one place and cannot drift from the copy it was summarised into.\n\n/**\n * Identical at all eight doors. The placement note is the real mitigation: these members live on the\n * HANDLER and not on the `BackendResourceRepository` interface an application's custom code is handed.\n */\nconst AUTHORIZATION_WAIVED: InfrastructureConcernDeclaration = {\n  posture: WAIVED,\n  reason:\n    'Below the service tier: no declared operation runs, so there is no principal to resolve. The '\n    + 'caller authorizes before calling; `executionContext` here is error context only and is never '\n    + 'read for authorization.',\n  compensation:\n    'Declared on the handler rather than on the `BackendResourceRepository` interface, so custom '\n    + 'application code cannot reach these doors through the repository it is given.',\n};\n\n/** Identical at all eight doors: the caller's filter or document is the whole confinement. */\nconst TENANT_SCOPING_WAIVED: InfrastructureConcernDeclaration = {\n  posture: WAIVED,\n  reason:\n    'The adapters\\' `buildContextualFilter` — which injects the resource\\'s scope FK — runs on the '\n    + 'operation-tier paths only. A raw primitive takes the caller\\'s filter as given, so a door '\n    + 'reaching a scope-bearing resource without its scope predicate returns cross-tenant rows and '\n    + 'nothing below the door re-adds it.',\n  compensation:\n    'Handler-only placement (as for authorization), plus the narrowness of the callers: the tier is '\n    + 'reached today only by field-uniqueness validation, consumable tokens and usage metering, each '\n    + 'of which builds its own filter. Nothing mechanical enforces that on a future caller.',\n};\n\n/** Identical at all eight doors: the door emits nothing, and nothing downstream substitutes for it. */\nconst AUDIT_TRAIL_WAIVED: InfrastructureConcernDeclaration = {\n  posture: WAIVED,\n  reason: 'No operation lifecycle runs, so no auditable event is emitted by the door itself.',\n  compensation: null,\n};\n\n/** The three read doors: a read materializes no value, so no schema could be applied to one. */\nconst SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ: InfrastructureConcernDeclaration = {\n  posture: NOT_APPLICABLE,\n  reason: 'Read-only: writes no value, so there is nothing for a declared schema to validate.',\n};\n\n/** The three read doors. */\nconst RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ: InfrastructureConcernDeclaration = {\n  posture: NOT_APPLICABLE,\n  reason: 'Read-only: writes nothing, so no `.ragSource()` field can change through it.',\n};\n\n/**\n * The five write doors, minus {@link InfrastructureDoor.INSERT_DOCUMENT}, which has its own partial\n * compensation (the cast).\n */\nconst SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE: InfrastructureConcernDeclaration = {\n  posture: WAIVED,\n  reason:\n    'The door takes an already-built mutation descriptor. The ordinary UPDATE path validates the '\n    + 'after-image against the resource\\'s main schema; nothing on this path does, so a value outside '\n    + 'a declared Zod constraint is stored as given.',\n  compensation:\n    'Shape only, never values: `describeGuardedMutationInexpressibility` refuses a mutation that '\n    + 'cannot be expressed on every adapter. Nothing checks what the mutation SAYS.',\n};\n\n/** Seven of the eight doors accept `RepositoryOptions` and forward them unchanged. */\nconst TRANSACTION_PARTICIPATION_PRESERVED: InfrastructureConcernDeclaration = {\n  posture: PRESERVED,\n  how:\n    'Accepts `RepositoryOptions` and forwards them to the primitive, so a caller already inside a '\n    + 'transaction enrols this statement in it (Mongo session / PG trx).',\n};\n\n/**\n * The four doors whose only adapter-neutrality claim is that they dispatch a primitive declared on the\n * `BackendResourceRepository` interface — so an adapter omitting one fails to compile rather than\n * throwing on first use. All eight raw primitives are declared there and implemented on both arms.\n */\nconst ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT = (primitive: string): InfrastructureConcernDeclaration => ({\n  posture: PRESERVED,\n  how:\n    `Dispatches \\`${primitive}\\`, which is declared on the \\`BackendResourceRepository\\` interface and `\n    + 'implemented by both the MongoDB and PostgreSQL arms — so an adapter that omits it fails to '\n    + 'compile rather than throwing on first use. No `as any` and no runtime `typeof` probe.',\n});\n\n/**\n * The retention hide as five of the six filter-bearing doors state it: applied at THIS dispatch point\n * and only here, so both adapter arms receive an already-hidden filter and the predicate lives in one\n * place. {@link InfrastructureDoor.COUNT_DOCUMENTS} states a stronger, caller-specific reason and\n * carries its own.\n */\nconst RETENTION_HIDE_PRESERVED_AT_DISPATCH = (consequence: string): InfrastructureConcernDeclaration => ({\n  posture: PRESERVED,\n  how:\n    `The filter passes through \\`applyRetentionHideToRawFilter\\` HERE and only here — ${consequence} `\n    + 'Enforcing it at the single dispatch point rather than in each adapter is what stops it drifting: '\n    + 'a future adapter inherits the predicate by construction.',\n});\n\n/**\n * The five write doors' RAG posture, identical in mechanism and differing only in what the sweep\n * reconciles for that door's shape. Moved from each door's own `rag-ingestion-gate: N/A —` comment,\n * which the sibling guard `rag-ingestion-write-door-coverage.guard.test.ts` still requires to be\n * present AT the door; that guard checks the waiver EXISTS, this table records what it says.\n */\nconst RAG_INGESTION_GATE_WAIVED_TO_SWEEP = (bound: string): InfrastructureConcernDeclaration => ({\n  posture: WAIVED,\n  reason:\n    'Below the service tier, so the post-commit ingestion chokepoint cannot observe this door. A '\n    + '`.ragSource()` field written through it is not re-indexed at write time.',\n  compensation: `The hourly RAG reconciliation sweep: ${bound}`,\n});\n\nexport const INFRASTRUCTURE_TIER_CONTRACT: Record<\n  InfrastructureDoor,\n  Record<InfrastructureCrossCuttingConcern, InfrastructureConcernDeclaration>\n> = {\n  [InfrastructureDoor.COUNT_DOCUMENTS]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n    [RETENTION_HIDE]: {\n      posture: PRESERVED,\n      how:\n        'The filter passes through `applyRetentionHideToRawFilter` here and only here. Counting a '\n        + 'hidden row would report a collision against a record the caller cannot see — an existence '\n        + 'oracle for the field-uniqueness-validation caller. The consequence (a later INSERT can then '\n        + 'collide on a plain unique business-key index) is the separate, tracked G-BKEY gate, and is '\n        + 'NOT resolved by re-leaking the row here.',\n    },\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: {\n      posture: WAIVED,\n      reason:\n        'THE ONE DOOR THAT CANNOT PARTICIPATE, and not by decision: it accepts no `RepositoryOptions` '\n        + 'parameter at all, so a caller inside a transaction counts OUTSIDE it and cannot see its own '\n        + 'uncommitted rows. `countByRawFilter` accepts and honours options on both arms; only this '\n        + 'door drops them — the identical shape its sibling `bulkUpdateForInfrastructure` records as '\n        + '\"a silent correctness hole\", at the one door nobody enumerated. Surfaced by filling this '\n        + 'table, deliberately recorded rather than repaired here: fixing a door inside the change that '\n        + 'declares the contract would hide the demonstration that the contract works. Filed as issue '\n        + '#104; flip this cell to PRESERVED when it lands.',\n      compensation: null,\n    },\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Delegates to `countByRawFilter`. It previously reached `(repository as any).mongooseModel`, '\n        + 'which made it MongoDB-only and left field-uniqueness validation unable to answer \"is this '\n        + 'value already taken?\" on any PostgreSQL-backed resource — a generally-named capability one '\n        + 'adapter did not have.',\n    },\n  },\n\n  [InfrastructureDoor.FIND_MANY]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'a retained row must stay invisible to reads, and this is the single place the predicate is added '\n      + 'for this path.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT('findManyByRawFilter'),\n  },\n\n  [InfrastructureDoor.READ_UNSCOPED_BY_KEY]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: {\n      posture: WAIVED,\n      reason:\n        'Unscoped BY NAME and by design — the only read on the repository contract that takes no '\n        + 'execution context at all. Scope narrowing is the caller\\'s filter to express here.',\n      compensation:\n        'Only the boundary this door does NOT relax: a read that skips tenant scoping must not also '\n        + 'skip erasure retention — those are different questions — so the hide is applied '\n        + 'unconditionally below. Nothing re-adds the scope predicate.',\n    },\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'no caller may opt out of erasure retention by choosing this entry point, however unscoped the '\n      + 'read itself is.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT('readUnscopedByKey'),\n  },\n\n  [InfrastructureDoor.INSERT_DOCUMENT]: {\n    [AUTHORIZATION]: {\n      posture: WAIVED,\n      reason:\n        'Below the service tier, so no principal is resolved — but unlike its siblings this door has '\n        + 'a DECLARED alternative it is not using, and the reason it gives for not using it does not '\n        + 'hold. \"A consumable token is consumed before authentication, so there is no principal to '\n        + 'authorize\" is true of CONSUMPTION and not of MINTING, which is a write the running system '\n        + 'performs inside a flow it controls. `SystemAccessBackendService.createAsSystem` exists for '\n        + 'precisely that principal, and `CONSUMABLE_TOKENS` already declares a CREATE operation '\n        + '(INTERNAL_CALL, ORG_ADMIN, with a requestDto). Routing through it would restore schema '\n        + 'validation, the RAG ingestion hook, the audit trail and the scope-context channel at this '\n        + 'door — five of the eight rows below stop being waivers.',\n      compensation:\n        'Handler-only placement, as for every door here. What stops the migration is narrow and '\n        + 'specific rather than principled — the declared requestDto omits the `_id`, `createdAt` and '\n        + '`updatedAt` this caller supplies deliberately; `CONSUMABLE_TOKENS` declares no '\n        + '`systemAccessPolicy`, so `createAsSystem` fail-closes today; the declared variant is gated '\n        + 'on ORG_ADMIN at organization scope, which a signup-time magic-link mint does not have; and '\n        + 'the caller reads the raw duplicate-key error to detect an `activeGenerationKey` conflict. '\n        + 'Tracked as issue #102 — the decision to migrate the caller — rather than answered here.',\n    },\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: {\n      posture: WAIVED,\n      reason:\n        'The callers build a COMPLETE document — their own `_id`, their own `createdAt`/`updatedAt` — '\n        + 'so the write deliberately skips the model create path: `Model.castObject` applies the '\n        + 'schema\\'s type CASTS only, no defaults, no timestamps, NO VALIDATION. A value outside a '\n        + 'declared Zod constraint is stored as given.',\n      compensation:\n        'The cast THROWS on a value the schema cannot represent (a non-ObjectId string on an '\n        + '`isForeignKey` path), so a structurally impossible write fails loudly at the write instead '\n        + 'of storing a row no cast filter can ever match — issue #71\\'s silent form. Field-level '\n        + 'constraints are not checked by anything.',\n    },\n    [RETENTION_HIDE]: {\n      posture: NOT_APPLICABLE,\n      reason:\n        'An INSERT creates a brand-new row, so there is no existing row to protect. A retained row is '\n        + 'reached only through a filter, and this statement carries none.',\n    },\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n      'its missing-set row scan picks the row up.',\n    ),\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Delegates to `insertRawDocument`, which casts the document through the model before the driver '\n        + 'sees it — the fix for issue #71. Uncast, this tier wrote a string where every sibling queries '\n        + 'an ObjectId, so a row written by this tier was not reliably findable BY this tier '\n        + '(`revokeTokensByRelatedId` matched 0 rows that existed). The PostgreSQL arm routes the same '\n        + 'insert through `toSqlWriteRow` for exactly this reason.',\n    },\n  },\n\n  [InfrastructureDoor.BULK_UPDATE]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'a bulk infrastructure update must never rewrite an erased-but-retained row, and retained rows are '\n      + 'excluded from the modified count.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n      'its contentHash comparison reconciles the affected chunk sets.',\n    ),\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: {\n      posture: PRESERVED,\n      how:\n        'Accepts `RepositoryOptions` and forwards them — and this door is WHY the concern is on this '\n        + 'axis. It did neither until recently, so every bulk infrastructure update committed '\n        + 'immediately regardless of the transaction its caller was inside: `revokeTokensByRelatedId`\\'s '\n        + 'revocation could not be rolled back, and on a driver retry the caller observed a count of 0 '\n        + 'for work that had in fact happened exactly once.',\n    },\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Takes an ADAPTER-NEUTRAL mutation descriptor rather than a raw `{ $set: … }`, and refuses a '\n        + 'mutation it cannot express on every adapter instead of silently degrading. The dialect used '\n        + 'to sit in the SIGNATURE, so every caller wrote MongoDB and a PostgreSQL-backed resource could '\n        + 'not be bulk-updated at all.',\n    },\n  },\n\n  [InfrastructureDoor.ATOMIC_GUARDED_MUTATION]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'a retained row is immutable, so the compare-and-swap must never match one.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n      'its contentHash comparison reconciles the affected chunk set.',\n    ),\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Refuses a mutation that is not adapter-neutral (`describeGuardedMutationInexpressibility`) '\n        + 'BEFORE dispatching, rather than degrading on the arm that cannot express it, and dispatches '\n        + 'an interface-declared primitive.',\n    },\n  },\n\n  [InfrastructureDoor.ATOMIC_INCREMENT_FIELD]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'a retained (erased-but-kept) row is immutable and must never be incremented.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n      'its contentHash comparison re-derives the chunk set. In practice this door writes counters, '\n      + 'never corpus text.',\n    ),\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Dispatches the interface-declared `atomicIncrementField`. Its predecessor took a MongoDB update '\n        + 'expression and reached for `mongooseModel`, so a counter built on it did not merely degrade '\n        + 'on PostgreSQL — it failed every write, and where the caller swallowed the error (as metering '\n        + 'paths do, so accounting never breaks a served request) the counter silently stayed at zero '\n        + 'and any cap built on it never fired.',\n    },\n  },\n\n  [InfrastructureDoor.ATOMIC_CONDITIONAL_SET]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'a retained row is immutable, so neither the set nor the clear may reach one.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n      'its contentHash comparison reconciles the chunk set of a field set or cleared through it.',\n    ),\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Dispatches the interface-declared `atomicConditionalSet`. Until the neutral primitives '\n        + 'existed, CLEARING a field had no adapter-neutral expression at all — the only route was the '\n        + 'raw-MongoDB `atomicConditionalUpdate` (since retired), so every clear was silently also a '\n        + 'MongoDB pin. The file-cleanup batch is the case that forced it: it clears stale link '\n        + 'metadata from timed-out and malformed rows, so a PostgreSQL-backed FILES resource would '\n        + 'have accepted writes and then stranded every row that batch exists to normalize.',\n    },\n  },\n};\n\n// ── The boundary of the enumeration, recorded rather than left implicit ──────────────────────────\n\n/**\n * Handler members that resolve a repository and dispatch to it, and are NOT infrastructure doors.\n *\n * The pin discovers the tier behaviourally — \"resolves a repository, then dispatches to it\" — which is\n * the only discovery that survives a rename. That query also finds the one member for which the answer\n * is legitimately different, and it is named here so the exclusion is a declaration a reader can\n * challenge rather than a silent filter inside a test.\n *\n * The pin asserts each of these is actually FOUND by the discovery, so an entry that stops matching\n * cannot quietly shrink the population it is excluded from.\n */\nexport const INFRASTRUCTURE_TIER_OPERATION_DISPATCH_MEMBERS: Readonly<Record<string, string>> = {\n  doByExecutionContext:\n    'The DECLARED-operation dispatcher — the opposite of this tier. It carries an `ExecutionContext` '\n    + 'whose operation the service and controller tiers have already authorized, and `doByPath` / '\n    + '`doByKey` both funnel into it. It is found by the same query because it, too, resolves a '\n    + 'repository and calls it.',\n};\n\n/**\n * Cross-cutting concerns CONSIDERED for {@link InfrastructureCrossCuttingConcern} and deliberately\n * left out, with the reason each collapses into an existing member.\n *\n * Recorded as data, not omitted, because `.claude/rules/invariant-call-site-enumeration.md` #14 is\n * exactly this: a site that DECLARES itself exempt is quieter than a missing one, so the declaration\n * has to be somewhere a reader can check it. Both entries below were checked against code rather than\n * reasoned about — the citations are the point.\n */\nexport enum InfrastructureExcludedConcernCandidate {\n  SIEM_ROUTING = 'siemRouting',\n  SUBJECT_ERASURE_REACHABILITY = 'subjectErasureReachability',\n}\n\nexport const INFRASTRUCTURE_CONCERN_CANDIDATES_EXCLUDED: Record<\n  InfrastructureExcludedConcernCandidate,\n  string\n> = {\n  [InfrastructureExcludedConcernCandidate.SIEM_ROUTING]:\n    'Entailed by AUDIT_TRAIL, not independent of it. The routing service is declared as one that '\n    + '\"dispatches AUDIT EVENTS to org SIEM endpoints\" (`inject/models/service-types.ts`), so its input '\n    + 'is an emitted event. A door that emits none produces nothing to route, and a per-door SIEM cell '\n    + 'could only ever restate that door\\'s audit cell.',\n  [InfrastructureExcludedConcernCandidate.SUBJECT_ERASURE_REACHABILITY]:\n    'Splits cleanly into a half that is already a member and a half that is not a property of the door. '\n    + 'The VISIBILITY-and-immutability half of erasure IS the retention hide — same predicate, same '\n    + 'dispatch point — and is declared per door as RETENTION_HIDE. The DISCOVERY half (can the erasure '\n    + 'orchestrator find the rows?) is answered by the resource graph: `eraseSubjectInPlace` walks the '\n    + 'edges of the subject resource\\'s own configuration, so a row is reachable because of how its '\n    + 'resource is declared, never because of which door wrote it.',\n};\n"]}
+{"version":3,"file":"infrastructure-tier-contract.backend.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/repositories/infrastructure-tier-contract.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kBAmBX;AAnBD,WAAY,kBAAkB;IAC5B,gGAAgG;IAChG,yEAAmD,CAAA;IACnD,gFAAgF;IAChF,6DAAuC,CAAA;IACvC,oFAAoF;IACpF,gEAA0C,CAAA;IAC1C,sEAAsE;IACtE,yEAAmD,CAAA;IACnD,qFAAqF;IACrF,iEAA2C,CAAA;IAC3C,+DAA+D;IAC/D,iEAA2C,CAAA;IAC3C,yCAAyC;IACzC,uEAAiD,CAAA;IACjD,iEAAiE;IACjE,qEAA+C,CAAA;IAC/C,wCAAwC;IACxC,qEAA+C,CAAA;AACjD,CAAC,EAnBW,kBAAkB,KAAlB,kBAAkB,QAmB7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,iCA4DX;AA5DD,WAAY,iCAAiC;IAC3C;;;OAGG;IACH,oEAA+B,CAAA;IAC/B;;;;;;;;;;;OAWG;IACH,qEAAgC,CAAA;IAChC;;;;OAIG;IACH,2EAAsC,CAAA;IACtC;;;;;OAKG;IACH,qEAAgC,CAAA;IAChC;;;;OAIG;IACH,4EAAuC,CAAA;IACvC;;;OAGG;IACH,+DAA0B,CAAA;IAC1B;;;;;;;;;OASG;IACH,2FAAsD,CAAA;IACtD;;;;OAIG;IACH,6EAAwC,CAAA;AAC1C,CAAC,EA5DW,iCAAiC,KAAjC,iCAAiC,QA4D5C;AAED,MAAM,CAAN,IAAY,4BAOX;AAPD,WAAY,4BAA4B;IACtC,6CAA6C;IAC7C,uDAAuB,CAAA;IACvB,sFAAsF;IACtF,iDAAiB,CAAA;IACjB,mGAAmG;IACnG,iEAAiC,CAAA;AACnC,CAAC,EAPW,4BAA4B,KAA5B,4BAA4B,QAOvC;AAYD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,4BAA4B,CAAC;AAC3E,MAAM,EACJ,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,yBAAyB,EACzB,kBAAkB,GACnB,GAAG,iCAAiC,CAAC;AAEtC,oGAAoG;AACpG,mGAAmG;AACnG,sGAAsG;AACtG,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,oBAAoB,GAAqC;IAC7D,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,+FAA+F;UAC7F,+FAA+F;UAC/F,yBAAyB;IAC7B,YAAY,EACV,8FAA8F;UAC5F,+EAA+E;CACpF,CAAC;AAEF,yFAAyF;AACzF,MAAM,qBAAqB,GAAqC;IAC9D,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,gGAAgG;UAC9F,4FAA4F;UAC5F,8FAA8F;UAC9F,oCAAoC;IACxC,YAAY,EACV,iGAAiG;UAC/F,gGAAgG;UAChG,sFAAsF;CAC3F,CAAC;AAEF,kGAAkG;AAClG,MAAM,kBAAkB,GAAqC;IAC3D,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,mFAAmF;IAC3F,YAAY,EAAE,IAAI;CACnB,CAAC;AAEF,gGAAgG;AAChG,MAAM,wCAAwC,GAAqC;IACjF,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,oFAAoF;CAC7F,CAAC;AAEF,4BAA4B;AAC5B,MAAM,yCAAyC,GAAqC;IAClF,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,8EAA8E;CACvF,CAAC;AAEF;;;GAGG;AACH,MAAM,wCAAwC,GAAqC;IACjF,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,8FAA8F;UAC5F,iGAAiG;UACjG,+CAA+C;IACnD,YAAY,EACV,8FAA8F;UAC5F,8EAA8E;CACnF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,mCAAmC,GAAqC;IAC5E,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,+FAA+F;UAC7F,mEAAmE;CACxE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,wCAAwC,GAAG,CAAC,SAAiB,EAAoC,EAAE,CAAC,CAAC;IACzG,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,gBAAgB,SAAS,2EAA2E;UAClG,6FAA6F;UAC7F,uFAAuF;CAC5F,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,oCAAoC,GAAG,CAAC,WAAmB,EAAoC,EAAE,CAAC,CAAC;IACvG,OAAO,EAAE,SAAS;IAClB,GAAG,EACD,oFAAoF,WAAW,GAAG;UAChG,mGAAmG;UACnG,0DAA0D;CAC/D,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,kCAAkC,GAAG,CAAC,KAAa,EAAoC,EAAE,CAAC,CAAC;IAC/F,OAAO,EAAE,MAAM;IACf,MAAM,EACJ,8FAA8F;UAC5F,0EAA0E;IAC9E,YAAY,EAAE,wCAAwC,KAAK,EAAE;CAC9D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAGrC;IACF,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE;QACpC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,2FAA2F;kBACzF,4FAA4F;kBAC5F,8FAA8F;kBAC9F,6FAA6F;kBAC7F,0CAA0C;SAC/C;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE;YAC3B,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,0FAA0F;kBACxF,qFAAqF;kBACrF,6FAA6F;kBAC7F,0FAA0F;kBAC1F,2FAA2F;kBAC3F,8FAA8F;kBAC9F,0EAA0E;kBAC1E,iEAAiE;SACtE;QACD,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,4FAA4F;kBAC5F,6FAA6F;kBAC7F,uBAAuB;SAC5B;KACF;IAED,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC9B,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,mGAAmG;cACjG,gBAAgB,CACnB;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE,wCAAwC,CAAC,qBAAqB,CAAC;KACtF;IAED,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE;QACzC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,0FAA0F;kBACxF,oFAAoF;YACxF,YAAY,EACV,6FAA6F;kBAC3F,kFAAkF;kBAClF,6DAA6D;SAClE;QACD,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,gGAAgG;cAC9F,iBAAiB,CACpB;QACD,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;QAC/D,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE,wCAAwC,CAAC,mBAAmB,CAAC;KACpF;IAED,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE;QACpC,CAAC,aAAa,CAAC,EAAE;YACf,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,8FAA8F;kBAC5F,4FAA4F;kBAC5F,2FAA2F;kBAC3F,4FAA4F;kBAC5F,6FAA6F;kBAC7F,wFAAwF;kBACxF,yFAAyF;kBACzF,4FAA4F;kBAC5F,yDAAyD;YAC7D,YAAY,EACV,wFAAwF;kBACtF,+EAA+E;kBAC/E,kFAAkF;kBAClF,6FAA6F;kBAC7F,kFAAkF;kBAClF,mFAAmF;kBACnF,4FAA4F;kBAC5F,+FAA+F;kBAC/F,8FAA8F;kBAC9F,4FAA4F;kBAC5F,6FAA6F;kBAC7F,yFAAyF;SAC9F;QACD,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE;YACnB,OAAO,EAAE,MAAM;YACf,MAAM,EACJ,+FAA+F;kBAC7F,wFAAwF;kBACxF,0FAA0F;kBAC1F,6CAA6C;YACjD,YAAY,EACV,sFAAsF;kBACpF,6FAA6F;kBAC7F,yFAAyF;kBACzF,0CAA0C;SAC/C;QACD,CAAC,cAAc,CAAC,EAAE;YAChB,OAAO,EAAE,cAAc;YACvB,MAAM,EACJ,+FAA+F;kBAC7F,iEAAiE;SACtE;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,4CAA4C,CAC7C;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,iGAAiG;kBAC/F,gGAAgG;kBAChG,oFAAoF;kBACpF,8FAA8F;kBAC9F,yDAAyD;SAC9D;KACF;IAED,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE;QAChC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,oGAAoG;cAClG,mCAAmC,CACtC;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,gEAAgE,CACjE;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE;YAC3B,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,qFAAqF;kBACrF,gGAAgG;kBAChG,8FAA8F;kBAC9F,kDAAkD;SACvD;QACD,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,8FAA8F;kBAC5F,8FAA8F;kBAC9F,gGAAgG;kBAChG,6BAA6B;SAClC;KACF;IAED,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE;QAChC,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE;YACnB,OAAO,EAAE,cAAc;YACvB,MAAM,EACJ,+FAA+F;kBAC7F,0FAA0F;kBAC1F,iFAAiF;SACtF;QACD,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,4FAA4F;cAC1F,6FAA6F;cAC7F,sDAAsD,CACzD;QACD,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,cAAc;YACvB,MAAM,EACJ,+FAA+F;kBAC7F,8FAA8F;kBAC9F,uDAAuD;kBACvD,yFAAyF;kBACzF,6FAA6F;kBAC7F,qEAAqE;SAC1E;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,+FAA+F;kBAC7F,4FAA4F;kBAC5F,4FAA4F;kBAC5F,gGAAgG;kBAChG,+FAA+F;kBAC/F,4FAA4F;kBAC5F,yFAAyF;kBACzF,6FAA6F;kBAC7F,8FAA8F;kBAC9F,0DAA0D;SAC/D;KACF;IAED,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,EAAE;QAC5C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,4EAA4E,CAC7E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,+DAA+D,CAChE;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,6FAA6F;kBAC3F,8FAA8F;kBAC9F,kCAAkC;SACvC;KACF;IAED,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE;QAC3C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,8EAA8E,CAC/E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,8FAA8F;cAC5F,oBAAoB,CACvB;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,kGAAkG;kBAChG,8FAA8F;kBAC9F,+FAA+F;kBAC/F,6FAA6F;kBAC7F,sCAAsC;SAC3C;KACF;IAED,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE;QAC3C,CAAC,aAAa,CAAC,EAAE,oBAAoB;QACrC,CAAC,cAAc,CAAC,EAAE,qBAAqB;QACvC,CAAC,iBAAiB,CAAC,EAAE,wCAAwC;QAC7D,CAAC,cAAc,CAAC,EAAE,oCAAoC,CACpD,8EAA8E,CAC/E;QACD,CAAC,kBAAkB,CAAC,EAAE,kCAAkC,CACtD,2FAA2F,CAC5F;QACD,CAAC,WAAW,CAAC,EAAE,kBAAkB;QACjC,CAAC,yBAAyB,CAAC,EAAE,mCAAmC;QAChE,CAAC,kBAAkB,CAAC,EAAE;YACpB,OAAO,EAAE,SAAS;YAClB,GAAG,EACD,yFAAyF;kBACvF,8FAA8F;kBAC9F,4FAA4F;kBAC5F,uFAAuF;kBACvF,0FAA0F;kBAC1F,kFAAkF;SACvF;KACF;CACF,CAAC;AAEF,oGAAoG;AAEpG;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAqC;IAC9F,oBAAoB,EAClB,kGAAkG;UAChG,6FAA6F;UAC7F,2FAA2F;UAC3F,0BAA0B;CAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,sCAGX;AAHD,WAAY,sCAAsC;IAChD,sEAA4B,CAAA;IAC5B,qGAA2D,CAAA;AAC7D,CAAC,EAHW,sCAAsC,KAAtC,sCAAsC,QAGjD;AAED,MAAM,CAAC,MAAM,0CAA0C,GAGnD;IACF,CAAC,sCAAsC,CAAC,YAAY,CAAC,EACnD,8FAA8F;UAC5F,mGAAmG;UACnG,kGAAkG;UAClG,kDAAkD;IACtD,CAAC,sCAAsC,CAAC,4BAA4B,CAAC,EACnE,qGAAqG;UACnG,+FAA+F;UAC/F,mGAAmG;UACnG,kGAAkG;UAClG,+FAA+F;UAC/F,6DAA6D;CAClE,CAAC","sourcesContent":["/**\n * The contract every INFRASTRUCTURE-TIER door on {@link RepositoriesRegistryHandlerBackendService}\n * answers to.\n *\n * ## Why this file exists\n *\n * The infrastructure tier is a deliberate bypass: its doors sit BELOW the service tier, take a\n * pre-built filter or an already-final document, and run no declared operation and no authorization.\n * Its clearest warrant is the field-uniqueness check behind the `validate-field` route. A field\n * declared unique with `scope: 'global'` must be counted across the ENTIRE collection — \"no additional\n * filter (intentional — check entire collection)\" — including tenants the caller cannot see, and the\n * answer returned as nothing but a number. A declared operation cannot serve that: `buildContextualFilter`\n * would scope the count to the caller's tenant and the answer would simply be wrong. So the door\n * deliberately waives tenant scoping and deliberately does NOT waive the retention hide, because\n * counting a hidden row would turn the same number into an existence oracle.\n *\n * Its WEAKEST warrant is the one the tier has most often cited, and issue #100 asked for it to be\n * settled: \"a consumable token is minted by a system action and consumed BEFORE authentication, so\n * there is genuinely no principal to authorize\". That conflates two moments. CONSUMPTION has no\n * principal — the token IS the credential. MINTING is a write the running system performs inside a\n * flow it controls, and the framework already has a vocabulary for exactly that: `createAsSystem`\n * fail-closes unless the resource opts in with `systemAccessPolicy.create = ALLOWED`, synthesises an\n * APPLICATION-scope super-admin context, and dispatches the resource's OWN declared CREATE —\n * which `CONSUMABLE_TOKENS` declares. So the framework does not owe a new \"system principal\"\n * vocabulary.\n *\n * That settles the FRAMEWORK question and deliberately does not settle the CALLER's: this door turns\n * out to have a second, stronger reason to bypass the declared pipeline. `createsOneOffSession` is\n * sealed `.excludeFromCreate()` so that no repository-create path can mint a session-establishing\n * token, which is what makes `createToken` the sole minter and therefore the single funnel enforcing\n * the impersonation-credential lifetime ceiling. A raw door is the shape that seal depends on. See\n * `INSERT_DOCUMENT / authorization` below, and issue #102.\n *\n * What was missing is not correctness, it is a CONTRACT. Each door carried its own hand-written prose\n * about which cross-cutting invariant it upheld and which it skipped, so the tier's posture existed\n * only as a set of independent rationales. Adding a door, or a new invariant, meant re-deriving the\n * obligation by hand at every site with nothing mechanical to say whether it had been done — the exact\n * failure shape `.claude/rules/invariant-call-site-enumeration.md` records, where an invariant is\n * applied at one of its N sites and the miss is invisible.\n *\n * So the posture is DECLARED here instead, once, as data. Because the table is typed\n * `Record<InfrastructureDoor, Record<InfrastructureCrossCuttingConcern, …>>`, adding a member to\n * EITHER enum fails to compile until every new cell is filled in. That is the property this file is\n * for: the missing case becomes a compiler error rather than something a reviewer has to notice.\n *\n * ## The tier is NINE doors, not the four that share a name\n *\n * Issue #100 listed four, all suffixed `*ForInfrastructure`. That is the population the SUFFIX\n * describes, and it was half the tier. Four more handler members have the identical posture under a\n * different name — `atomicIncrementField` and `atomicConditionalSet` carry, verbatim, the same\n * `@internal Framework-internal infrastructure primitive — NOT part of the operation lifecycle. The\n * caller owns authorization, scope-aware filter construction, and audit logging.` that the suffixed\n * doors carry; `atomicGuardedMutation` and `readUnscopedByKey` likewise dispatch a caller-built filter\n * straight to an adapter with no operation above them.\n *\n * That is why {@link INFRASTRUCTURE_TIER_CONTRACT}'s pin discovers the tier by what a member DOES —\n * resolving a repository and dispatching to it — rather than by what it is called. Enumerating by name\n * finds every site that agrees with you about naming, which is `invariant-call-site-enumeration.md`\n * #12 and #20 in one. The sibling guard `rag-ingestion-write-door-coverage.guard.test.ts` had already\n * reached the same population from the write side: three of its five raw write doors carry no suffix.\n *\n * ## What this file is NOT\n *\n * It does not gate anything at runtime. A door's behaviour lives in the door; this is the record of\n * what that behaviour promises, kept adjacent and kept complete. Turning it into a runtime guard would\n * add a second authority that can disagree with the code, which is the failure this repository has\n * paid for repeatedly (see `.claude/rules/one-source-of-truth.md`).\n *\n * It is also not a place to fix a door. Filling the table surfaced one real asymmetry — see\n * {@link InfrastructureCrossCuttingConcern.TRANSACTION_PARTICIPATION} at\n * {@link InfrastructureDoor.COUNT_DOCUMENTS} — and it is RECORDED here rather than quietly repaired,\n * because a waiver nobody can see is the condition this contract exists to end.\n *\n * @see issue #100 — the decision this file implements.\n */\n\n/**\n * The doors.\n *\n * Each value is the METHOD NAME on the handler, deliberately, so\n * `__tests__/infrastructure-tier-contract.guard.test.ts` can discover the real tier from the handler's\n * source and assert this enum matches it exactly. A hand-maintained list that merely LOOKS complete is\n * what this file exists to prevent, so the list is checked against the class rather than trusted.\n */\nexport enum InfrastructureDoor {\n  /** Backs field-uniqueness validation, which runs INSIDE an in-flight operation's validation. */\n  COUNT_DOCUMENTS = 'countDocumentsForInfrastructure',\n  /** Multi-row read for a framework-internal reader (consumable-token lookup). */\n  FIND_MANY = 'findManyForInfrastructure',\n  /** Single-row read below BOTH the operation tier and the execution-context tier. */\n  READ_UNSCOPED_BY_KEY = 'readUnscopedByKey',\n  /** INSERT of an already-final document (consumable-token minting). */\n  INSERT_DOCUMENT = 'insertDocumentForInfrastructure',\n  /** Multi-row guarded write (token revocation by relatedId, usage-record marking). */\n  BULK_UPDATE = 'bulkUpdateForInfrastructure',\n  /** Multi-row DELETE (the consumable-token retention sweep). */\n  DELETE_MANY = 'deleteManyForInfrastructure',\n  /** Single-row compare-and-swap write. */\n  ATOMIC_GUARDED_MUTATION = 'atomicGuardedMutation',\n  /** Single-row counter increment (metering, quota accounting). */\n  ATOMIC_INCREMENT_FIELD = 'atomicIncrementField',\n  /** Single-row conditional set/clear. */\n  ATOMIC_CONDITIONAL_SET = 'atomicConditionalSet',\n}\n\n/**\n * The cross-cutting invariants a door must answer for explicitly.\n *\n * ## The admission criterion, so the next member is not settled by taste\n *\n * A concern belongs here when it is an invariant that holds across the whole persistence boundary AND\n * a door can silently fail to uphold it. Members arrive on one of two bases, and each member's own\n * doc-comment names which:\n *\n *  - **conferred from above** — an ordinary declared operation gets it for free at the controller or\n *    service tier, and a door that runs no operation therefore does not (authorization, tenant\n *    scoping, schema validation, the RAG ingestion gate, the audit trail);\n *  - **promised by the door itself** — nothing above confers it; the door's own general name promises\n *    it, and the family has broken it in production (retention hide, transaction participation,\n *    adapter neutrality).\n *\n * This set is OPEN. Adding a member is the point: it immediately breaks compilation at every door\n * until each declares a posture. Candidates DELIBERATELY excluded are recorded as data in\n * {@link INFRASTRUCTURE_CONCERN_CANDIDATES_EXCLUDED} rather than left absent — an absence is\n * indistinguishable from an oversight, which is the shape this whole file is about.\n */\nexport enum InfrastructureCrossCuttingConcern {\n  /**\n   * CONFERRED FROM ABOVE. Who may do this. The controller resolves it from the declared operation's\n   * roles and variant; these doors run no operation, so nothing resolves a principal.\n   */\n  AUTHORIZATION = 'authorization',\n  /**\n   * CONFERRED FROM ABOVE. Which TENANT'S rows this statement may reach. The adapters' own\n   * `buildContextualFilter` injects the scope FK (organizationId / userId) into every operation-tier\n   * filter; the raw primitives these doors dispatch deliberately do not call it — \"the caller's filter\n   * is the whole confinement, by design\".\n   *\n   * Distinct from {@link AUTHORIZATION} on purpose, and the distinction is the tier's own: the handler\n   * states at `readUnscopedByKey` that \"a read that skips tenant scoping must NOT also skip erasure\n   * retention: those are different questions\". Roles and rows are two gates, answered from two inputs,\n   * and fusing them is what `.claude/rules/administrative-continuity-floors.md` records as producing\n   * cross-tenant reach nobody declared.\n   */\n  TENANT_SCOPING = 'tenantScoping',\n  /**\n   * CONFERRED FROM ABOVE. That a written value was checked against a declared schema. The controller's\n   * `validateRequestData` parses the payload through the operation's `requestDto` before any write;\n   * these doors take an already-built document or mutation descriptor and no Zod schema sees it.\n   */\n  SCHEMA_VALIDATION = 'schemaValidation',\n  /**\n   * PROMISED BY THE DOOR. An erased-but-retained row must stay invisible to reads and unaffected by\n   * writes — \"kept but frozen\". The tier applies it at its own single dispatch point\n   * (`applyRetentionHideToRawFilter`) rather than in each adapter, so a future adapter inherits it by\n   * construction.\n   */\n  RETENTION_HIDE = 'retentionHide',\n  /**\n   * CONFERRED FROM ABOVE. A `.ragSource()` field changing must re-derive the affected chunk set. The\n   * hook lives at the service tier's single post-commit chokepoint, which is ABOVE these doors, so no\n   * door can feed it.\n   */\n  RAG_INGESTION_GATE = 'ragIngestionGate',\n  /**\n   * CONFERRED FROM ABOVE. A security-relevant action must leave an auditable record. The operation\n   * lifecycle emits it; no lifecycle runs here.\n   */\n  AUDIT_TRAIL = 'auditTrail',\n  /**\n   * PROMISED BY THE DOOR. A statement issued inside a caller's transaction must ENROL in it. Every\n   * underlying primitive accepts `RepositoryOptions` and both adapters honour it, so whether a door\n   * participates is decided entirely by whether the door accepts and forwards them.\n   *\n   * This is a member because the family has already lost it once, silently and expensively:\n   * `bulkUpdateForInfrastructure` neither accepted nor forwarded options, so `revokeTokensByRelatedId`\n   * committed immediately regardless of its caller's transaction and a driver retry observed a count\n   * of 0 for work that had happened exactly once.\n   */\n  TRANSACTION_PARTICIPATION = 'transactionParticipation',\n  /**\n   * PROMISED BY THE DOOR. A generally-named capability must work on every persistence adapter, not\n   * only the one it was written against. A member here is one the family has broken twice — both\n   * breakages were a reach for `(repository as any).mongooseModel` behind a neutral-sounding name.\n   */\n  ADAPTER_NEUTRALITY = 'adapterNeutrality',\n}\n\nexport enum InfrastructureConcernPosture {\n  /** The door itself upholds the invariant. */\n  PRESERVED = 'preserved',\n  /** The invariant could apply and deliberately is not upheld. A reason is required. */\n  WAIVED = 'waived',\n  /** The invariant cannot apply to this door's shape at all (e.g. a retention hide on an INSERT). */\n  NOT_APPLICABLE = 'not-applicable',\n}\n\n/**\n * `compensation` is the field that makes a waiver reviewable: it names what ELSE catches the gap, or\n * is `null` to state plainly that nothing does. A waiver with no compensation is not forbidden — it is\n * simply visible, which is the whole ask of issue #100.\n */\nexport type InfrastructureConcernDeclaration =\n  | { posture: InfrastructureConcernPosture.PRESERVED; how: string }\n  | { posture: InfrastructureConcernPosture.WAIVED; reason: string; compensation: string | null }\n  | { posture: InfrastructureConcernPosture.NOT_APPLICABLE; reason: string };\n\nconst { PRESERVED, WAIVED, NOT_APPLICABLE } = InfrastructureConcernPosture;\nconst {\n  AUTHORIZATION,\n  TENANT_SCOPING,\n  SCHEMA_VALIDATION,\n  RETENTION_HIDE,\n  RAG_INGESTION_GATE,\n  AUDIT_TRAIL,\n  TRANSACTION_PARTICIPATION,\n  ADAPTER_NEUTRALITY,\n} = InfrastructureCrossCuttingConcern;\n\n// ── Declarations shared verbatim across doors ────────────────────────────────────────────────────\n// Written once where the reason is genuinely the same one. Where a door's reason is its own, it is\n// written at the door — moved from that door's JSDoc rather than paraphrased, so the rationale exists\n// in exactly one place and cannot drift from the copy it was summarised into.\n\n/**\n * Identical at every door. The placement note is the real mitigation: these members live on the\n * HANDLER and not on the `BackendResourceRepository` interface an application's custom code is handed.\n */\nconst AUTHORIZATION_WAIVED: InfrastructureConcernDeclaration = {\n  posture: WAIVED,\n  reason:\n    'Below the service tier: no declared operation runs, so there is no principal to resolve. The '\n    + 'caller authorizes before calling; `executionContext` here is error context only and is never '\n    + 'read for authorization.',\n  compensation:\n    'Declared on the handler rather than on the `BackendResourceRepository` interface, so custom '\n    + 'application code cannot reach these doors through the repository it is given.',\n};\n\n/** Identical at every door: the caller's filter or document is the whole confinement. */\nconst TENANT_SCOPING_WAIVED: InfrastructureConcernDeclaration = {\n  posture: WAIVED,\n  reason:\n    'The adapters\\' `buildContextualFilter` — which injects the resource\\'s scope FK — runs on the '\n    + 'operation-tier paths only. A raw primitive takes the caller\\'s filter as given, so a door '\n    + 'reaching a scope-bearing resource without its scope predicate returns cross-tenant rows and '\n    + 'nothing below the door re-adds it.',\n  compensation:\n    'Handler-only placement (as for authorization), plus the narrowness of the callers: the tier is '\n    + 'reached today only by field-uniqueness validation, consumable tokens and usage metering, each '\n    + 'of which builds its own filter. Nothing mechanical enforces that on a future caller.',\n};\n\n/** Identical at every door: the door emits nothing, and nothing downstream substitutes for it. */\nconst AUDIT_TRAIL_WAIVED: InfrastructureConcernDeclaration = {\n  posture: WAIVED,\n  reason: 'No operation lifecycle runs, so no auditable event is emitted by the door itself.',\n  compensation: null,\n};\n\n/** The three read doors: a read materializes no value, so no schema could be applied to one. */\nconst SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ: InfrastructureConcernDeclaration = {\n  posture: NOT_APPLICABLE,\n  reason: 'Read-only: writes no value, so there is nothing for a declared schema to validate.',\n};\n\n/** The three read doors. */\nconst RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ: InfrastructureConcernDeclaration = {\n  posture: NOT_APPLICABLE,\n  reason: 'Read-only: writes nothing, so no `.ragSource()` field can change through it.',\n};\n\n/**\n * The pre-built WRITE doors, minus {@link InfrastructureDoor.INSERT_DOCUMENT}, which has its own partial\n * compensation (the cast), and minus {@link InfrastructureDoor.DELETE_MANY}, which materializes no value.\n */\nconst SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE: InfrastructureConcernDeclaration = {\n  posture: WAIVED,\n  reason:\n    'The door takes an already-built mutation descriptor. The ordinary UPDATE path validates the '\n    + 'after-image against the resource\\'s main schema; nothing on this path does, so a value outside '\n    + 'a declared Zod constraint is stored as given.',\n  compensation:\n    'Shape only, never values: `describeGuardedMutationInexpressibility` refuses a mutation that '\n    + 'cannot be expressed on every adapter. Nothing checks what the mutation SAYS.',\n};\n\n/**\n * The plain reason SEVEN doors give: they accept `RepositoryOptions` and forward them unchanged.\n *\n * ALL EIGHT doors do that now. {@link InfrastructureDoor.COUNT_DOCUMENTS} states its own cell rather\n * than reusing this one because it has a longer story to tell — it was the one door that accepted no\n * options at all (issue #104), and its cell records that rather than letting the repair erase it.\n * This comment previously read \"every door BUT COUNT_DOCUMENTS accepts them\", which was true when it\n * was written and became a false description of the tier the moment the door was fixed.\n */\nconst TRANSACTION_PARTICIPATION_PRESERVED: InfrastructureConcernDeclaration = {\n  posture: PRESERVED,\n  how:\n    'Accepts `RepositoryOptions` and forwards them to the primitive, so a caller already inside a '\n    + 'transaction enrols this statement in it (Mongo session / PG trx).',\n};\n\n/**\n * The four doors whose only adapter-neutrality claim is that they dispatch a primitive declared on the\n * `BackendResourceRepository` interface — so an adapter omitting one fails to compile rather than\n * throwing on first use. Every raw primitive is declared there and implemented on both persisting arms\n * (the read-only HTTP-API and introspection arms declare each one as an explicit refusal).\n */\nconst ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT = (primitive: string): InfrastructureConcernDeclaration => ({\n  posture: PRESERVED,\n  how:\n    `Dispatches \\`${primitive}\\`, which is declared on the \\`BackendResourceRepository\\` interface and `\n    + 'implemented by both the MongoDB and PostgreSQL arms — so an adapter that omits it fails to '\n    + 'compile rather than throwing on first use. No `as any` and no runtime `typeof` probe.',\n});\n\n/**\n * The retention hide as five of the six filter-bearing doors state it: applied at THIS dispatch point\n * and only here, so both adapter arms receive an already-hidden filter and the predicate lives in one\n * place. {@link InfrastructureDoor.COUNT_DOCUMENTS} states a stronger, caller-specific reason and\n * carries its own.\n */\nconst RETENTION_HIDE_PRESERVED_AT_DISPATCH = (consequence: string): InfrastructureConcernDeclaration => ({\n  posture: PRESERVED,\n  how:\n    `The filter passes through \\`applyRetentionHideToRawFilter\\` HERE and only here — ${consequence} `\n    + 'Enforcing it at the single dispatch point rather than in each adapter is what stops it drifting: '\n    + 'a future adapter inherits the predicate by construction.',\n});\n\n/**\n * The materializing write doors' RAG posture, identical in mechanism and differing only in what the\n * sweep reconciles for that door's shape. Moved from each door's own `rag-ingestion-gate: N/A —` comment,\n * which the sibling guard `rag-ingestion-write-door-coverage.guard.test.ts` still requires to be\n * present AT the door; that guard checks the waiver EXISTS, this table records what it says.\n */\nconst RAG_INGESTION_GATE_WAIVED_TO_SWEEP = (bound: string): InfrastructureConcernDeclaration => ({\n  posture: WAIVED,\n  reason:\n    'Below the service tier, so the post-commit ingestion chokepoint cannot observe this door. A '\n    + '`.ragSource()` field written through it is not re-indexed at write time.',\n  compensation: `The hourly RAG reconciliation sweep: ${bound}`,\n});\n\nexport const INFRASTRUCTURE_TIER_CONTRACT: Record<\n  InfrastructureDoor,\n  Record<InfrastructureCrossCuttingConcern, InfrastructureConcernDeclaration>\n> = {\n  [InfrastructureDoor.COUNT_DOCUMENTS]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n    [RETENTION_HIDE]: {\n      posture: PRESERVED,\n      how:\n        'The filter passes through `applyRetentionHideToRawFilter` here and only here. Counting a '\n        + 'hidden row would report a collision against a record the caller cannot see — an existence '\n        + 'oracle for the field-uniqueness-validation caller. The consequence (a later INSERT can then '\n        + 'collide on a plain unique business-key index) is the separate, tracked G-BKEY gate, and is '\n        + 'NOT resolved by re-leaking the row here.',\n    },\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: {\n      posture: PRESERVED,\n      how:\n        'Accepts `RepositoryOptions` and forwards them to `countByRawFilter`, matching all seven '\n        + 'siblings. It was the ONE door in the tier that accepted none, so a caller inside a '\n        + 'transaction counted OUTSIDE it — the identical shape `bulkUpdateForInfrastructure` records '\n        + 'as a silent correctness hole, at the door nobody enumerated until this table gave every '\n        + 'door a row to fill in. Surfaced by filling the table (issue #104), fixed separately from '\n        + 'the change that declared the contract so the demonstration stayed visible. No caller passes '\n        + 'options today, so the forward is pinned rather than behaviour-verified: '\n        + '`__tests__/infrastructure-tier-transaction-forwarding.test.ts`.',\n    },\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Delegates to `countByRawFilter`. It previously reached `(repository as any).mongooseModel`, '\n        + 'which made it MongoDB-only and left field-uniqueness validation unable to answer \"is this '\n        + 'value already taken?\" on any PostgreSQL-backed resource — a generally-named capability one '\n        + 'adapter did not have.',\n    },\n  },\n\n  [InfrastructureDoor.FIND_MANY]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'a retained row must stay invisible to reads, and this is the single place the predicate is added '\n      + 'for this path.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT('findManyByRawFilter'),\n  },\n\n  [InfrastructureDoor.READ_UNSCOPED_BY_KEY]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: {\n      posture: WAIVED,\n      reason:\n        'Unscoped BY NAME and by design — the only read on the repository contract that takes no '\n        + 'execution context at all. Scope narrowing is the caller\\'s filter to express here.',\n      compensation:\n        'Only the boundary this door does NOT relax: a read that skips tenant scoping must not also '\n        + 'skip erasure retention — those are different questions — so the hide is applied '\n        + 'unconditionally below. Nothing re-adds the scope predicate.',\n    },\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_NOT_APPLICABLE_ON_READ,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'no caller may opt out of erasure retention by choosing this entry point, however unscoped the '\n      + 'read itself is.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_NOT_APPLICABLE_ON_READ,\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: ADAPTER_NEUTRALITY_PRESERVED_BY_CONTRACT('readUnscopedByKey'),\n  },\n\n  [InfrastructureDoor.INSERT_DOCUMENT]: {\n    [AUTHORIZATION]: {\n      posture: WAIVED,\n      reason:\n        'Below the service tier, so no principal is resolved — but unlike its siblings this door has '\n        + 'a DECLARED alternative it is not using, and the reason it gives for not using it does not '\n        + 'hold. \"A consumable token is consumed before authentication, so there is no principal to '\n        + 'authorize\" is true of CONSUMPTION and not of MINTING, which is a write the running system '\n        + 'performs inside a flow it controls. `SystemAccessBackendService.createAsSystem` exists for '\n        + 'precisely that principal, and `CONSUMABLE_TOKENS` already declares a CREATE operation '\n        + '(INTERNAL_CALL, ORG_ADMIN, with a requestDto). Routing through it would restore schema '\n        + 'validation, the RAG ingestion hook, the audit trail and the scope-context channel at this '\n        + 'door — five of the eight rows below stop being waivers.',\n      compensation:\n        'Handler-only placement, as for every door here — AND, at this door only, a deliberate '\n        + 'security seal that makes the raw insert load-bearing rather than incidental. '\n        + '`createsOneOffSession` is `.excludeFromCreate().excludeFromUpdate()` so that no '\n        + 'repository-create path can mint a session-establishing token, which leaves `createToken` — '\n        + 'this door\\'s caller — the SOLE minter and therefore the single funnel enforcing '\n        + '`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` fail-closed at issuance. That token is an '\n        + 'impersonation credential: exchanging it mints a JWT session for another user. Routing the '\n        + 'mint through `createAsSystem` would strip the field (measured: the preserve list resolves to '\n        + '`[\"organizationId\",\"userId\"]`, because a defaulted excluded field is deliberately withheld) '\n        + 'and silently mint every such token as non-session-establishing; relaxing the exclusion to '\n        + 'fix that would open a second mint path that never meets the ceiling. So the waiver here is '\n        + 'not an unpaid debt — it is the shape the credential ceiling depends on. See issue #102.',\n    },\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: {\n      posture: WAIVED,\n      reason:\n        'The callers build a COMPLETE document — their own `_id`, their own `createdAt`/`updatedAt` — '\n        + 'so the write deliberately skips the model create path: `Model.castObject` applies the '\n        + 'schema\\'s type CASTS only, no defaults, no timestamps, NO VALIDATION. A value outside a '\n        + 'declared Zod constraint is stored as given.',\n      compensation:\n        'The cast THROWS on a value the schema cannot represent (a non-ObjectId string on an '\n        + '`isForeignKey` path), so a structurally impossible write fails loudly at the write instead '\n        + 'of storing a row no cast filter can ever match — issue #71\\'s silent form. Field-level '\n        + 'constraints are not checked by anything.',\n    },\n    [RETENTION_HIDE]: {\n      posture: NOT_APPLICABLE,\n      reason:\n        'An INSERT creates a brand-new row, so there is no existing row to protect. A retained row is '\n        + 'reached only through a filter, and this statement carries none.',\n    },\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n      'its missing-set row scan picks the row up.',\n    ),\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Delegates to `insertRawDocument`, which casts the document through the model before the driver '\n        + 'sees it — the fix for issue #71. Uncast, this tier wrote a string where every sibling queries '\n        + 'an ObjectId, so a row written by this tier was not reliably findable BY this tier '\n        + '(`revokeTokensByRelatedId` matched 0 rows that existed). The PostgreSQL arm routes the same '\n        + 'insert through `toSqlWriteRow` for exactly this reason.',\n    },\n  },\n\n  [InfrastructureDoor.BULK_UPDATE]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'a bulk infrastructure update must never rewrite an erased-but-retained row, and retained rows are '\n      + 'excluded from the modified count.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n      'its contentHash comparison reconciles the affected chunk sets.',\n    ),\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: {\n      posture: PRESERVED,\n      how:\n        'Accepts `RepositoryOptions` and forwards them — and this door is WHY the concern is on this '\n        + 'axis. It did neither until recently, so every bulk infrastructure update committed '\n        + 'immediately regardless of the transaction its caller was inside: `revokeTokensByRelatedId`\\'s '\n        + 'revocation could not be rolled back, and on a driver retry the caller observed a count of 0 '\n        + 'for work that had in fact happened exactly once.',\n    },\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Takes an ADAPTER-NEUTRAL mutation descriptor rather than a raw `{ $set: … }`, and refuses a '\n        + 'mutation it cannot express on every adapter instead of silently degrading. The dialect used '\n        + 'to sit in the SIGNATURE, so every caller wrote MongoDB and a PostgreSQL-backed resource could '\n        + 'not be bulk-updated at all.',\n    },\n  },\n\n  [InfrastructureDoor.DELETE_MANY]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: {\n      posture: NOT_APPLICABLE,\n      reason:\n        'A DELETE writes no value, so there is nothing for a declared schema to validate. This is the '\n        + 'one WRITE door for which the concern is genuinely inapplicable rather than waived — its '\n        + 'siblings all carry a pre-built payload a schema could have checked and did not.',\n    },\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'a retained (erased-but-kept) row is immutable, and DESTROYING one is the sharpest form of '\n      + 'mutating it — the retention posture exists precisely to keep a row that must be kept, so a '\n      + 'framework sweep must not be the thing that reaps it.',\n    ),\n    [RAG_INGESTION_GATE]: {\n      posture: NOT_APPLICABLE,\n      reason:\n        'Materializes no value, so no `.ragSource()` field can change through it and there is nothing '\n        + 'to re-index. The mirror obligation — REMOVING a deleted row\\'s chunks — is not this concern '\n        + 'and is not owned here either: the removal-seam guard '\n        + '(`rag-chunk-removal-seam-coverage.guard.test.ts`) excludes the raw repository doors BY '\n        + 'DECLARATION, bounding every one of them on the hourly reconciliation sweep\\'s orphan pass, '\n        + 'and this door joins that family rather than opening a new question.',\n    },\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Dispatches the interface-declared `deleteManyByRawFilter`, so an adapter that omits it fails '\n        + 'to compile. THE DOOR EXISTS BECAUSE ITS ABSENCE WAS THE DEFECT: with a bulk UPDATE on the '\n        + 'tier and no bulk DELETE, the consumable-tokens cleanup batch had one route to reap rows — '\n        + 'reaching past the contract for `MongoDBService.getConnection()` — which made the framework\\'s '\n        + 'only credential-retention sweep MongoDB-only. It was invisible while every application ran a '\n        + 'mongod beside PostgreSQL, and failed every six hours on the first one (`wonder-crm`) that '\n        + 'did not, with spent password-reset / invitation / magic-link rows accumulating with no '\n        + 'sweep. Note the neutrality this door CANNOT confer: an unexpressible predicate (`$expr`, a '\n        + 'column-to-column comparison) is still the caller\\'s problem, and the batch resolves its one '\n        + 'such lane by reading candidates and comparing in memory.',\n    },\n  },\n\n  [InfrastructureDoor.ATOMIC_GUARDED_MUTATION]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'a retained row is immutable, so the compare-and-swap must never match one.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n      'its contentHash comparison reconciles the affected chunk set.',\n    ),\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Refuses a mutation that is not adapter-neutral (`describeGuardedMutationInexpressibility`) '\n        + 'BEFORE dispatching, rather than degrading on the arm that cannot express it, and dispatches '\n        + 'an interface-declared primitive.',\n    },\n  },\n\n  [InfrastructureDoor.ATOMIC_INCREMENT_FIELD]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'a retained (erased-but-kept) row is immutable and must never be incremented.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n      'its contentHash comparison re-derives the chunk set. In practice this door writes counters, '\n      + 'never corpus text.',\n    ),\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Dispatches the interface-declared `atomicIncrementField`. Its predecessor took a MongoDB update '\n        + 'expression and reached for `mongooseModel`, so a counter built on it did not merely degrade '\n        + 'on PostgreSQL — it failed every write, and where the caller swallowed the error (as metering '\n        + 'paths do, so accounting never breaks a served request) the counter silently stayed at zero '\n        + 'and any cap built on it never fired.',\n    },\n  },\n\n  [InfrastructureDoor.ATOMIC_CONDITIONAL_SET]: {\n    [AUTHORIZATION]: AUTHORIZATION_WAIVED,\n    [TENANT_SCOPING]: TENANT_SCOPING_WAIVED,\n    [SCHEMA_VALIDATION]: SCHEMA_VALIDATION_WAIVED_PRE_BUILT_WRITE,\n    [RETENTION_HIDE]: RETENTION_HIDE_PRESERVED_AT_DISPATCH(\n      'a retained row is immutable, so neither the set nor the clear may reach one.',\n    ),\n    [RAG_INGESTION_GATE]: RAG_INGESTION_GATE_WAIVED_TO_SWEEP(\n      'its contentHash comparison reconciles the chunk set of a field set or cleared through it.',\n    ),\n    [AUDIT_TRAIL]: AUDIT_TRAIL_WAIVED,\n    [TRANSACTION_PARTICIPATION]: TRANSACTION_PARTICIPATION_PRESERVED,\n    [ADAPTER_NEUTRALITY]: {\n      posture: PRESERVED,\n      how:\n        'Dispatches the interface-declared `atomicConditionalSet`. Until the neutral primitives '\n        + 'existed, CLEARING a field had no adapter-neutral expression at all — the only route was the '\n        + 'raw-MongoDB `atomicConditionalUpdate` (since retired), so every clear was silently also a '\n        + 'MongoDB pin. The file-cleanup batch is the case that forced it: it clears stale link '\n        + 'metadata from timed-out and malformed rows, so a PostgreSQL-backed FILES resource would '\n        + 'have accepted writes and then stranded every row that batch exists to normalize.',\n    },\n  },\n};\n\n// ── The boundary of the enumeration, recorded rather than left implicit ──────────────────────────\n\n/**\n * Handler members that resolve a repository and dispatch to it, and are NOT infrastructure doors.\n *\n * The pin discovers the tier behaviourally — \"resolves a repository, then dispatches to it\" — which is\n * the only discovery that survives a rename. That query also finds the one member for which the answer\n * is legitimately different, and it is named here so the exclusion is a declaration a reader can\n * challenge rather than a silent filter inside a test.\n *\n * The pin asserts each of these is actually FOUND by the discovery, so an entry that stops matching\n * cannot quietly shrink the population it is excluded from.\n */\nexport const INFRASTRUCTURE_TIER_OPERATION_DISPATCH_MEMBERS: Readonly<Record<string, string>> = {\n  doByExecutionContext:\n    'The DECLARED-operation dispatcher — the opposite of this tier. It carries an `ExecutionContext` '\n    + 'whose operation the service and controller tiers have already authorized, and `doByPath` / '\n    + '`doByKey` both funnel into it. It is found by the same query because it, too, resolves a '\n    + 'repository and calls it.',\n};\n\n/**\n * Cross-cutting concerns CONSIDERED for {@link InfrastructureCrossCuttingConcern} and deliberately\n * left out, with the reason each collapses into an existing member.\n *\n * Recorded as data, not omitted, because `.claude/rules/invariant-call-site-enumeration.md` #14 is\n * exactly this: a site that DECLARES itself exempt is quieter than a missing one, so the declaration\n * has to be somewhere a reader can check it. Both entries below were checked against code rather than\n * reasoned about — the citations are the point.\n */\nexport enum InfrastructureExcludedConcernCandidate {\n  SIEM_ROUTING = 'siemRouting',\n  SUBJECT_ERASURE_REACHABILITY = 'subjectErasureReachability',\n}\n\nexport const INFRASTRUCTURE_CONCERN_CANDIDATES_EXCLUDED: Record<\n  InfrastructureExcludedConcernCandidate,\n  string\n> = {\n  [InfrastructureExcludedConcernCandidate.SIEM_ROUTING]:\n    'Entailed by AUDIT_TRAIL, not independent of it. The routing service is declared as one that '\n    + '\"dispatches AUDIT EVENTS to org SIEM endpoints\" (`inject/models/service-types.ts`), so its input '\n    + 'is an emitted event. A door that emits none produces nothing to route, and a per-door SIEM cell '\n    + 'could only ever restate that door\\'s audit cell.',\n  [InfrastructureExcludedConcernCandidate.SUBJECT_ERASURE_REACHABILITY]:\n    'Splits cleanly into a half that is already a member and a half that is not a property of the door. '\n    + 'The VISIBILITY-and-immutability half of erasure IS the retention hide — same predicate, same '\n    + 'dispatch point — and is declared per door as RETENTION_HIDE. The DISCOVERY half (can the erasure '\n    + 'orchestrator find the rows?) is answered by the resource graph: `eraseSubjectInPlace` walks the '\n    + 'edges of the subject resource\\'s own configuration, so a row is reachable because of how its '\n    + 'resource is declared, never because of which door wrote it.',\n};\n"]}

package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.d.ts

@@ -34,9 +34,10 @@ export declare class IntrospectionResourceRepositoryBackendService {
     private readonly resolveSource;
     constructor(resourceType: string, logger: LoggerService, errorBuilder: ErrorBuilderBackendService, resolveSource: () => IntrospectionResourceSourceBackendPort | undefined);
     doByPath<T = any, U = any>(operationRepositoryPath: Parameters<typeof ResourcesConfig_OperationPathUtils.createOperationRepositoryPathKey>[0], executionContext: ExecutionContext<any>, id_or_ids_or_filter?: any, data?: U, options?: unknown): Promise<T>;
-    doByKey<T = any, U = any>(_operationRepositoryPathKey: string, executionContext: ExecutionContext<any>, id_or_ids_or_filter?: any, data?: U, options?: unknown): Promise<T>;
+    doByKey<T = any, U = any>(operationRepositoryPathKey: string, executionContext: ExecutionContext<any>, id_or_ids_or_filter?: any, data?: U, options?: unknown): Promise<T>;
     doByExecutionContext<T = any>(executionContext: ExecutionContext<any>, data?: any): Promise<T>;
     private doOperation;
+    private doOperationByIdentifier;
     read<T = undefined>(executionContext: ExecutionContext<any>, id_or_filter: any): Promise<any>;
     readForInternalScan<T = undefined>(executionContext: ExecutionContext<any>, id_or_filter: any): Promise<any>;
     /**
@@ -74,6 +75,7 @@ export declare class IntrospectionResourceRepositoryBackendService {
     atomicConditionalSet(): Promise<never>;
     atomicGuardedMutation(): Promise<never>;
     updateManyByRawFilter(): Promise<never>;
+    deleteManyByRawFilter(): Promise<never>;
     insertRawDocument(): Promise<never>;
     findManyByRawFilter(): Promise<never>;
     private readOnlyRefusal;

package/dist/esm/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"introspection-resource-repository.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,kCAAkC,EAClC,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AAE3G;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,6CAA6C;IAEtD,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,aAAa,EAAE,MAAM,sCAAsC,GAAG,SAAS;IAe7E,QAAQ,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACpC,uBAAuB,EAAE,UAAU,CAAC,OAAO,kCAAkC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAClH,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,CAAC,CAAC;IAIA,OAAO,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,2BAA2B,EAAE,MAAM,EACnC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,CAAC,CAAC;IAIA,oBAAoB,CAAC,CAAC,GAAG,GAAG,EACvC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,IAAI,CAAC,EAAE,GAAG,GACT,OAAO,CAAC,CAAC,CAAC;YAIC,WAAW;IAwBZ,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAK7F,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAIzH;;;;;;;;;;;;OAYG;IACU,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAQ3G;;;OAGG;IACU,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAI7G,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,GAAG,GACX,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAK3B,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;YAKvF,MAAM;IAiCpB,OAAO,CAAC,cAAc;IAoBT,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;IACnC,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;IAElD,OAAO,CAAC,eAAe;CAYxB"}
+{"version":3,"file":"introspection-resource-repository.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/base-classes/services/repositories/introspection/introspection-resource-repository.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,kCAAkC,EAClC,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AAE3G;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,6CAA6C;IAEtD,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,aAAa,EACrB,YAAY,EAAE,0BAA0B,EACxC,aAAa,EAAE,MAAM,sCAAsC,GAAG,SAAS;IA2B7E,QAAQ,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACpC,uBAAuB,EAAE,UAAU,CAAC,OAAO,kCAAkC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAClH,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,CAAC,CAAC;IASA,OAAO,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,0BAA0B,EAAE,MAAM,EAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,mBAAmB,CAAC,EAAE,GAAG,EACzB,IAAI,CAAC,EAAE,CAAC,EACR,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,CAAC,CAAC;IAUA,oBAAoB,CAAC,CAAC,GAAG,GAAG,EACvC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,IAAI,CAAC,EAAE,GAAG,GACT,OAAO,CAAC,CAAC,CAAC;YAIC,WAAW;YAUX,uBAAuB;IAsBxB,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAK7F,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAIzH;;;;;;;;;;;;OAYG;IACU,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAe3G;;;OAGG;IACU,mBAAmB,CAAC,CAAC,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAI7G,MAAM,CAAC,CAAC,GAAG,GAAG,EACzB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,GAAG,GACX,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAM3B,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;YAKvF,MAAM;IAiCpB,OAAO,CAAC,cAAc;IAoBT,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;IACxB,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAC5B,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,oBAAoB,IAAI,OAAO,CAAC,KAAK,CAAC;IACtC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;IACvC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;IACnC,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;IAElD,OAAO,CAAC,eAAe;CAYxB"}