@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.d.ts

@@ -11,6 +11,7 @@ import type { PlatformMutualizedHandlerBackendService } from '../../../requests/
 import type { ServerlessServicesHandlerBackendService } from '../../../requests/service/serverless-services-handler.backend.service';
 import type { ExecutionContextCreatorBackendService } from '../../../runtime/services/execution-context-creator.backend.service';
 import type { SystemAccessBackendService } from '../../../base-classes/services/services/system-access.backend.service';
+import type { WorkerRemoteClientFactoryBackendService } from '../../../applications/services/worker-remote-client-factory.backend.service';
 import type { ServiceOptions } from '../../../base-classes/models/repositories.backend.schemas';
 type Augment<TAugment extends object | undefined = undefined> = TAugment extends undefined ? {} : TAugment;
 export type ResourceOperationCustomImplementation_InputTypeOf<TMode extends ResourceOperation_CustomServiceImplementationMode = ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL, TInput extends (z.ZodSchema | undefined) = z.ZodAny | undefined, TOutput extends z.ZodSchema = z.ZodAny, TAugment extends object | undefined = undefined> = (TMode extends ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL | ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS ? TInput extends z.ZodSchema ? z.infer<TInput> : never : TMode extends ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS ? TInput extends z.ZodSchema ? z.infer<TInput> & Augment<TAugment> : never : z.infer<TOutput>);
@@ -82,6 +83,27 @@ export type ResourceOperation_CustomImplementation_Utils = {
      * not bind the system-access service still construct.
      */
     systemAccessService?: SystemAccessBackendService;
+    /**
+     * Dispatch to one of the application's declared WORKERS — the sanctioned way to move work off the
+     * request path from application backend code.
+     *
+     * `workerClientFactory.client('<workerName>').post('/route', body)` mints the
+     * `APPLICATION_WORKER_REQUEST` JWT the worker's verifier pins and reaches the worker at the URL
+     * the deploy injected. The factory fails CLOSED on an undeclared worker rather than dispatching to
+     * a guessed address.
+     *
+     * ## Why it had to be added here (#426)
+     *
+     * The factory shipped, was bound in DI, and had NO caller anywhere — and this is why: a custom
+     * implementation is the one place an application writes backend logic, and this bag was the only
+     * thing it receives. There was no handle, so no application COULD call a worker, which is the
+     * deeper half of why the backend-to-worker chain had never run for anyone. Adding the handle is
+     * what turns a shipped mechanism into a reachable one.
+     *
+     * Optional for the same reason `systemAccessService` is: a minimal test container that does not
+     * bind the factory must still construct.
+     */
+    workerClientFactory?: WorkerRemoteClientFactoryBackendService;
     /** SAML metadata service — for DISCOVER_ENDPOINTS (emits SAML_METADATA_PARSED) */
     samlMetadataService?: {
         parseIdPMetadata(metadataXml: string): unknown;

package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-operation-custom-implementation-base.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iDAAiD,EAGlD,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACzG,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qFAAqF,CAAC;AAC5I,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAC/I,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAC/I,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qEAAqE,CAAC;AAE1G,KAAK,OAAO,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAAI,QAAQ,SAAS,SAAS,GAAG,EAAE,GAAG,QAAQ,CAAC;AAEzG,MAAM,MAAM,iDAAiD,CAC3D,KAAK,SAAS,iDAAiD,GAAG,iDAAiD,CAAC,YAAY,EAChI,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,EAC/D,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACtC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAC5C,CACD,KAAK,SAAS,iDAAiD,CAAC,YAAY,GAAG,iDAAiD,CAAC,uBAAuB,GACpJ,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GACf,KAAK,GACT,KAAK,SAAS,iDAAiD,CAAC,wBAAwB,GACtF,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,GACnC,KAAK,GACT,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CACnB,CAAA;AAED,MAAM,MAAM,kDAAkD,CAC1D,KAAK,SAAS,iDAAiD,GAAG,iDAAiD,CAAC,YAAY,EAChI,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,EAC/D,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACtC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAC7C,CACF,KAAK,SAAS,iDAAiD,CAAC,uBAAuB,GACnF,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,GACnC,OAAO,CAAC,QAAQ,CAAC,GACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CACrB,CAAA;AAID,eAAO,MAAM,wDAAwD,GAAI,OAAO,SAAS,CAAC,CAAC,UAAU,GAAG,SAAS,EAAE,OAAO,GAAG,OAAO,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,EACpL,MAAM,iDAAiD,EACvD,eAAe,OAAO,GAAG,QAAQ,EACjC,QAAQ,OAAO,EACf,eAAe,OAAO,EACtB,eAAe,0BAA0B,KACxC,OAuDF,CAAA;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,EAAE,0BAA0B,CAAC;IACzC,iBAAiB,EAAE,+BAA+B,CAAC;IACnD,gBAAgB,EAAE,qCAAqC,CAAC;IACxD;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,kBAAkB,EAAE,gCAAgC,CAAC;IACrD,yBAAyB,EAAE,uCAAuC,CAAC;IACnE,yBAAyB,EAAE,uCAAuC,CAAC;IACnE;;;;OAIG;IACH,uBAAuB,EAAE,qCAAqC,CAAC;IAC/D;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD,kFAAkF;IAClF,mBAAmB,CAAC,EAAE;QAAE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACzE;;;;OAIG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,CAAC;IAChF;;;OAGG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC;CACrB,CAAC;AAEF,8BAAsB,yCAAyC,CAC7D,MAAM,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACrC,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM;aAGtB,eAAe,IAAI,iDAAiD,EAAE;IAEtF;;;;;;;OAOG;aACa,WAAW,CACzB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CAAC,iDAAiD,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EACzI,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACxD,iDAAiD,CAAC,YAAY,EAC9D,MAAM,EAAE,OAAO,CACjB,CAAC;IAEJ;;;;;;;;;;;;OAYG;aACa,oBAAoB,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,EAChF,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,uBAAuB,EACzE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAC5B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,uBAAuB,EACzE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,CAAC;IAEJ;;;OAGG;aACa,qBAAqB,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,EACjF,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,CAAC;IAEJ;;;;;;;;OAQG;aACa,qBAAqB,CACnC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,CAAC;IAEJ;;;;;;;;;;;;;;;;;;OAkBG;aACa,sBAAsB,CACpC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,CAAC;IAEJ;;;;;;;;;;;;;;;;;;OAkBG;aACa,QAAQ,CACtB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,UAAU,EAC5D,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,UAAU,EAC5D,MAAM,EAAE,OAAO,CAChB,CAAC;CACL"}
+{"version":3,"file":"resource-operation-custom-implementation-base.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iDAAiD,EAGlD,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACzG,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qFAAqF,CAAC;AAC5I,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAC/I,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,iFAAiF,CAAC;AAC/I,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,uFAAuF,CAAC;AACrJ,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qEAAqE,CAAC;AAE1G,KAAK,OAAO,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAAI,QAAQ,SAAS,SAAS,GAAG,EAAE,GAAG,QAAQ,CAAC;AAEzG,MAAM,MAAM,iDAAiD,CAC3D,KAAK,SAAS,iDAAiD,GAAG,iDAAiD,CAAC,YAAY,EAChI,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,EAC/D,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACtC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAC5C,CACD,KAAK,SAAS,iDAAiD,CAAC,YAAY,GAAG,iDAAiD,CAAC,uBAAuB,GACpJ,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GACf,KAAK,GACT,KAAK,SAAS,iDAAiD,CAAC,wBAAwB,GACtF,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,GACnC,KAAK,GACT,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CACnB,CAAA;AAED,MAAM,MAAM,kDAAkD,CAC1D,KAAK,SAAS,iDAAiD,GAAG,iDAAiD,CAAC,YAAY,EAChI,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,EAC/D,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACtC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,IAC7C,CACF,KAAK,SAAS,iDAAiD,CAAC,uBAAuB,GACnF,MAAM,SAAS,CAAC,CAAC,SAAS,GACxB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,GACnC,OAAO,CAAC,QAAQ,CAAC,GACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CACrB,CAAA;AAID,eAAO,MAAM,wDAAwD,GAAI,OAAO,SAAS,CAAC,CAAC,UAAU,GAAG,SAAS,EAAE,OAAO,GAAG,OAAO,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,EACpL,MAAM,iDAAiD,EACvD,eAAe,OAAO,GAAG,QAAQ,EACjC,QAAQ,OAAO,EACf,eAAe,OAAO,EACtB,eAAe,0BAA0B,KACxC,OAuDF,CAAA;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,EAAE,0BAA0B,CAAC;IACzC,iBAAiB,EAAE,+BAA+B,CAAC;IACnD,gBAAgB,EAAE,qCAAqC,CAAC;IACxD;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,kBAAkB,EAAE,gCAAgC,CAAC;IACrD,yBAAyB,EAAE,uCAAuC,CAAC;IACnE,yBAAyB,EAAE,uCAAuC,CAAC;IACnE;;;;OAIG;IACH,uBAAuB,EAAE,qCAAqC,CAAC;IAC/D;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mBAAmB,CAAC,EAAE,uCAAuC,CAAC;IAC9D,kFAAkF;IAClF,mBAAmB,CAAC,EAAE;QAAE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACzE;;;;OAIG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,CAAC;IAChF;;;OAGG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC;CACrB,CAAC;AAEF,8BAAsB,yCAAyC,CAC7D,MAAM,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,EACrC,OAAO,SAAS,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM;aAGtB,eAAe,IAAI,iDAAiD,EAAE;IAEtF;;;;;;;OAOG;aACa,WAAW,CACzB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CAAC,iDAAiD,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EACzI,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACxD,iDAAiD,CAAC,YAAY,EAC9D,MAAM,EAAE,OAAO,CACjB,CAAC;IAEJ;;;;;;;;;;;;OAYG;aACa,oBAAoB,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,EAChF,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,uBAAuB,EACzE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAC5B,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,uBAAuB,EACzE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,CAAC;IAEJ;;;OAGG;aACa,qBAAqB,CAAC,QAAQ,SAAS,MAAM,GAAC,SAAS,GAAG,SAAS,EACjF,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,EAAE,QAAQ,CAC1B,CAAC;IAEJ;;;;;;;;OAQG;aACa,qBAAqB,CACnC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,CAAC;IAEJ;;;;;;;;;;;;;;;;;;OAkBG;aACa,sBAAsB,CACpC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,wBAAwB,EAC1E,MAAM,EAAE,OAAO,CAChB,CAAC;IAEJ;;;;;;;;;;;;;;;;;;OAkBG;aACa,QAAQ,CACtB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,iDAAiD,CACtD,iDAAiD,CAAC,UAAU,EAC5D,MAAM,EAAE,OAAO,CAChB,EACD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACvC,KAAK,EAAE,4CAA4C,GAClD,OAAO,CAAC,kDAAkD,CACzD,iDAAiD,CAAC,UAAU,EAC5D,MAAM,EAAE,OAAO,CAChB,CAAC;CACL"}

package/dist/esm/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-operation-custom-implementation-base.backend.service.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iDAAiD,EACjD,SAAS,EACT,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAgD/B,MAAM,CAAC,MAAM,wDAAwD,GAAG,CACtE,IAAuD,EACvD,aAAiC,EACjC,MAAe,EACf,aAAsB,EACtB,YAAyC,EAChC,EAAE;IAEX,MAAM,KAAK,GAAG,CAAC,MAAgC,EAAE,MAAe,EAAE,QAAiB,KAAK,EAAW,EAAE;QACnG,IAAI,CAAC,MAAM;YACT,OAAO,MAAM,CAAC;QAEhB,IAAG,MAAM,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,KAAK;gBACP,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,IAAG,MAAM,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,YAAY,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,YAAY,EAAE,CAAC;oBACjB,2HAA2H;oBAC3H,2EAA2E;oBAC3E,6DAA6D;oBAC7D,mEAAmE;oBACnE,0EAA0E;oBAC1E,2EAA2E;oBAC3E,yEAAyE;oBACzE,sEAAsE;oBACtE,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAC7D,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;qBACvF,CAAC,CAAC;oBACH,mEAAmE;gBACrE,CAAC;gBACD,4EAA4E;gBAC5E,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,UAAU,GAAI,MAAmC,CAAC,OAAO,CAAC;YAChE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACvE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAA;IAED,IAAG,aAAa,KAAK,OAAO,EAAE,CAAC;QAC7B,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,IAAI,KAAK,iDAAiD,CAAC,wBAAwB;eAClF,IAAI,KAAK,iDAAiD,CAAC,uBAAuB,EAAE,CAAC;YACxF,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAY,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,CAAY,CAAC;IAEjD,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,IAAI,KAAK,iDAAiD,CAAC,uBAAuB,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAY,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,CAAY,CAAC;IACjD,CAAC;AACH,CAAC,CAAA;AA2FD,MAAM,OAAgB,yCAAyC;CAwJ9D","sourcesContent":["import { z } from 'zod';\nimport {\n  ResourceConfiguration_Operation,\n  ResourceConfiguration_OperationPath,\n  ResourceOperation_CustomServiceImplementationMode,\n  ErrorType,\n  ErrorCustomMessageReference,\n} from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from './services-registry-handler.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ExternalApiHandlerBackendService } from '~wildo-backend-lib/external-providers/services/external-api-handler.backend.service';\nimport type { PlatformMutualizedHandlerBackendService } from '~wildo-backend-lib/requests/service/platform-mutualized-handler.backend.service';\nimport type { ServerlessServicesHandlerBackendService } from '~wildo-backend-lib/requests/service/serverless-services-handler.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\n\ntype Augment<TAugment extends object|undefined = undefined> = TAugment extends undefined ? {} : TAugment;\n\nexport type ResourceOperationCustomImplementation_InputTypeOf<\n  TMode extends ResourceOperation_CustomServiceImplementationMode = ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n  TInput extends (z.ZodSchema | undefined) = z.ZodAny | undefined,\n  TOutput extends z.ZodSchema = z.ZodAny,\n  TAugment extends object|undefined = undefined\n> =(\n  TMode extends ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL | ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput>\n      : never\n  : TMode extends ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput> & Augment<TAugment>\n      : never\n  : z.infer<TOutput>\n)\n\nexport type ResourceOperationCustomImplementation_OutputTypeOf<\n    TMode extends ResourceOperation_CustomServiceImplementationMode = ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n    TInput extends (z.ZodSchema | undefined) = z.ZodAny | undefined,\n    TOutput extends z.ZodSchema = z.ZodAny,\n    TAugment extends object|undefined = undefined\n> = (\n  TMode extends ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput> & Augment<TAugment>\n      : Augment<TAugment>\n    : z.infer<TOutput>\n)\n\n\n\nexport const parseResourceOperation_CustomServiceImplementationSchema = <TSchema extends z.ZodTypeAny | undefined, TReturn = TSchema extends z.ZodTypeAny ? z.infer<TSchema> : unknown>(\n  mode: ResourceOperation_CustomServiceImplementationMode,\n  inputOrOutput: 'input' | 'output',\n  schema: TSchema,\n  objectToParse: unknown,\n  errorBuilder?: ErrorBuilderBackendService,\n): TReturn => {\n\n  const parse = (schema: z.ZodTypeAny | undefined, object: unknown, loose: boolean = false): unknown => {\n    if (!schema)\n      return object;\n\n    if(schema instanceof z.ZodObject) {\n      if (loose)\n        return z.looseObject(schema.shape).parse(object);\n      return schema.parse(object);\n    }\n    if(schema instanceof z.ZodArray) {\n      if (!(object instanceof Array)) {\n        if (errorBuilder) {\n          /** @wildo_source:part:start example.backend.operation.error-throw facet:kind:usage-example facet:audience:app-developer */\n          // Inside a backend custom-operation hook you receive `utils.errorBuilder`.\n          // Throw a WildoError with it — NEVER `throw new Error(...)`:\n          //  • the ErrorType drives the HTTP status (VALIDATION → 400 here);\n          //  • customMessageReference names the localized user message (resolved by\n          //    tErrorMessage → errors_messages.<ref>.msg) — do NOT hardcode English;\n          //  • any dynamic values go in `context` as structured keys (log-only for\n          //    most types), never interpolated into a `context.message` string.\n          throw errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,\n          });\n          /** @wildo_source:part:end example.backend.operation.error-throw */\n        }\n        // Bootstrap/leaf fallback ONLY — errorBuilder is unavailable here (pre-DI).\n        throw new Error('Input is not an array');\n      }\n      const itemSchema = (schema as z.ZodArray<z.ZodTypeAny>).element;\n      object = object.map((item: unknown) => parse(itemSchema, item, loose));\n      return object;\n    }\n    return schema.parse(object);\n  }\n\n  if(inputOrOutput === 'input') {\n    // PREFIX and REPLACE both receive data that may contain augmented fields\n    // from basicPrefixOperation or prior PREFIX handlers — use loose parse\n    // to preserve those fields while still validating declared schema fields.\n    if (mode === ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS\n      || mode === ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS) {\n      return parse(schema, objectToParse, true) as TReturn;\n    }\n    return parse(schema, objectToParse) as TReturn;\n\n  } else {\n    // PREFIX output may contain augmented fields (TAugment) that the declared\n    // output schema doesn't know about — use loose parse to preserve them.\n    if (mode === ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS) {\n      return parse(schema, objectToParse, true) as TReturn;\n    }\n    return parse(schema, objectToParse) as TReturn;\n  }\n}\n\n\n\n/**\n * Utilities object provided to custom implementation methods.\n *\n * Contains:\n * - Service instances (logger, errorBuilder, registries, handlers)\n * - `executionContextCreator`: Creates child execution contexts for cross-resource sub-calls\n * - Contextual data for the operation:\n *   - `objectContext`: Parent and child resource data (fetched based on resource configuration)\n *   - `initiatorUserContext`: User context of the user/organization/application initiating the operation\n *   - `currentObject`: The current resource object (for UPDATE/DELETE operations) or input data (for CREATE operations)\n *\n * Context fields are populated automatically by the service registry handler based on:\n * - Resource configuration context needs analysis\n * - Operation type (CREATE uses input data, UPDATE/DELETE fetches current object)\n *\n * ### Cross-resource operations\n *\n * For cross-resource calls from custom impls, use `utils.executionContextCreator.createForSubCall()`\n * to create a child context with proper depth tracking and cycle detection, then pass it\n * to `utils.servicesRegistry`. Example:\n *\n * ```ts\n * const subCtx = await utils.executionContextCreator.createForSubCall(\n *   executionContext, targetResourceType, CoreResourceOperation.CREATE\n * );\n * await utils.servicesRegistry.create(targetResourceType, subCtx, data);\n * ```\n *\n * Calling `servicesRegistry` directly with the parent context is functionally safe\n * (doOperation corrects the operation), but skips depth/cycle tracking.\n */\nexport type ResourceOperation_CustomImplementation_Utils = {\n  logger: LoggerService;\n  errorBuilder: ErrorBuilderBackendService;\n  resourcesRegistry: ResourcesRegistryBackendService;\n  servicesRegistry: ServicesRegistryHandlerBackendService;\n  /**\n   * Options of the operation currently executing, including its database\n   * transaction. Cross-resource mutations from a hook must forward these\n   * options when they belong to the same semantic unit of work.\n   */\n  serviceOptions?: ServiceOptions;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  externalApiHandler: ExternalApiHandlerBackendService;\n  platformMutualizedHandler: PlatformMutualizedHandlerBackendService;\n  serverlessServicesHandler: ServerlessServicesHandlerBackendService;\n  /**\n   * Creates child execution contexts for cross-resource sub-calls with proper\n   * depth tracking and cycle detection. Use `createForSubCall()` when calling\n   * `servicesRegistry` methods from a custom implementation.\n   */\n  executionContextCreator: ExecutionContextCreatorBackendService;\n  /**\n   * The SANCTIONED privileged-access path for custom implementations. A custom\n   * impl is a request-triggered elevation site: it runs inside the caller's\n   * (often anonymous / low-privilege) execution context but sometimes must read\n   * or write a resource that context cannot reach (e.g. an anonymous lead-capture\n   * CREATE that needs a users-by-email lookup). Route those through\n   * `systemAccessService.readAsSystem` / `listAsSystem` / `createAsSystem` /\n   * `updateAsSystem` — each is fail-closed on the target's `systemAccessPolicy`\n   * opt-in AND emits a `SYSTEM_CONTEXT_*` audit event. Do NOT hand-build a\n   * super-admin context via `executionContextCreator` for an ACL bypass; that\n   * path is ungated and unaudited. Optional so minimal test containers that do\n   * not bind the system-access service still construct.\n   */\n  systemAccessService?: SystemAccessBackendService;\n  /** SAML metadata service — for DISCOVER_ENDPOINTS (emits SAML_METADATA_PARSED) */\n  samlMetadataService?: { parseIdPMetadata(metadataXml: string): unknown };\n  /**\n   * Contextual data about parent and child resources.\n   * Structure: { parents: Record<string, any>, children: Record<string, any> }\n   * Populated based on resource configuration context needs.\n   */\n  objectContext?: { parents: Record<string, any>; children: Record<string, any> };\n  /**\n   * User context of the initiator (user/organization/application) performing the operation.\n   * Populated from execution context.\n   */\n  initiatorUserContext?: any;\n  /**\n   * Current resource object (for UPDATE/DELETE) or input data (for CREATE).\n   * For UPDATE/DELETE: Fetched from repository before custom implementation execution.\n   * For CREATE: Uses the input data provided to the operation.\n   */\n  currentObject?: any;\n};\n\nexport abstract class ResourceOperationCustomImplementationBase<\n  TInput extends z.ZodSchema = z.ZodAny,\n  TOutput extends z.ZodSchema = z.ZodAny,\n> {\n\n  public abstract getPlaceholders(): ResourceOperation_CustomServiceImplementationMode[];\n\n  /**\n   * Replaces the ENTIRE operation pipeline — no core CRUD, no notifications, no other hooks.\n   * Single-owner mode: if multiple registrations declare this, highest priority wins.\n   *\n   * A registration exposing this mode cannot enable `transactionalCore`: the\n   * override returns before the framework-owned core transaction is entered,\n   * so advertising that atomicity boundary would be false.\n   */\n  public abstract overrideAll(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL, TInput, TOutput>,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n       ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n       TInput, TOutput\n    >>;\n\n  /**\n   * Runs before core CRUD. Augments `data` via spread-merge (`data = { ...data, ...result }`).\n   *\n   * **Multi-registration execution:** handlers run sequentially by ascending priority number\n   * (lower number = higher priority = runs first). Each handler receives the accumulated `data`\n   * from all prior handlers. For field conflicts, **last-writer-wins**: the handler with the\n   * HIGHEST priority number (lowest priority) overwrites fields set by earlier handlers.\n   *\n   * **Array inputs (CREATE_MANY):** handler must return the full transformed array, not a\n   * spread-merged object. Non-array returns are silently dropped with a debug log.\n   *\n   * `utils.currentObject` reflects pre-PREFIX state (original DB record or CREATE input).\n   */\n  public abstract prefixCoreOperations<TAugment extends object|undefined = undefined>(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment>,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >>;\n\n  /**\n   * Replaces the core CRUD **result** — the core DB operation still runs, this overwrites `currentState`.\n   * Receives PREFIX-augmented `data` as input. Single-owner mode: highest priority wins.\n   */\n  public abstract replaceCoreOperations<TAugment extends object|undefined = undefined>(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >>;\n\n  /**\n   * Runs after core CRUD and REPLACE. Input is the core operation result.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   * Handlers must guard against non-object input when destructuring.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   */\n  public abstract postfixCoreOperations(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.POSTFIX_CORE_OPERARTIONS,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.POSTFIX_CORE_OPERARTIONS,\n      TInput, TOutput\n    >>;\n\n  /**\n   * Runs after notification dispatch. Input is the current operation result.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   *\n   * On a framework-owned transactional operation, this hook runs only after\n   * the root commit and framework post-commit effects finish. It receives the\n   * committed callback attempt's context and no completed transaction in\n   * `utils.serviceOptions`. A thrown error therefore rejects the response after\n   * an irreversible commit; this phase is for request-scoped result transforms,\n   * not mutation-owned external work.\n   *\n   * Because the phase transforms the returned value, it is not accepted when\n   * the operation reuses an explicit or ambient caller-owned transaction:\n   * that nested call must return before its caller can commit.\n   */\n  public abstract afterUserNotifications(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AFTER_USER_NOTIFICATIONS,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AFTER_USER_NOTIFICATIONS,\n      TInput, TOutput\n    >>;\n\n  /**\n   * Final hook — runs at the very end of the pipeline, after notifications and lifecycle evaluations.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   *\n   * On a framework-owned transactional operation, this hook runs only after\n   * the root commit and framework post-commit effects finish. It receives the\n   * committed callback attempt's context and no completed transaction in\n   * `utils.serviceOptions`. A thrown error therefore rejects the response after\n   * an irreversible commit; this phase is for request-scoped result transforms,\n   * not mutation-owned external work.\n   *\n   * Because the phase transforms the returned value, it is not accepted when\n   * the operation reuses an explicit or ambient caller-owned transaction:\n   * that nested call must return before its caller can commit.\n   */\n  public abstract atTheEnd(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AT_THE_END,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AT_THE_END,\n      TInput, TOutput\n    >>;\n}\n"]}
+{"version":3,"file":"resource-operation-custom-implementation-base.backend.service.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-custom-implementation-base.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,iDAAiD,EACjD,SAAS,EACT,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAiD/B,MAAM,CAAC,MAAM,wDAAwD,GAAG,CACtE,IAAuD,EACvD,aAAiC,EACjC,MAAe,EACf,aAAsB,EACtB,YAAyC,EAChC,EAAE;IAEX,MAAM,KAAK,GAAG,CAAC,MAAgC,EAAE,MAAe,EAAE,QAAiB,KAAK,EAAW,EAAE;QACnG,IAAI,CAAC,MAAM;YACT,OAAO,MAAM,CAAC;QAEhB,IAAG,MAAM,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,KAAK;gBACP,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,IAAG,MAAM,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,YAAY,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,YAAY,EAAE,CAAC;oBACjB,2HAA2H;oBAC3H,2EAA2E;oBAC3E,6DAA6D;oBAC7D,mEAAmE;oBACnE,0EAA0E;oBAC1E,2EAA2E;oBAC3E,yEAAyE;oBACzE,sEAAsE;oBACtE,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAC7D,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;qBACvF,CAAC,CAAC;oBACH,mEAAmE;gBACrE,CAAC;gBACD,4EAA4E;gBAC5E,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,UAAU,GAAI,MAAmC,CAAC,OAAO,CAAC;YAChE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACvE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAA;IAED,IAAG,aAAa,KAAK,OAAO,EAAE,CAAC;QAC7B,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,IAAI,KAAK,iDAAiD,CAAC,wBAAwB;eAClF,IAAI,KAAK,iDAAiD,CAAC,uBAAuB,EAAE,CAAC;YACxF,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAY,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,CAAY,CAAC;IAEjD,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,IAAI,KAAK,iDAAiD,CAAC,uBAAuB,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAY,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,EAAE,aAAa,CAAY,CAAC;IACjD,CAAC;AACH,CAAC,CAAA;AAgHD,MAAM,OAAgB,yCAAyC;CAwJ9D","sourcesContent":["import { z } from 'zod';\nimport {\n  ResourceConfiguration_Operation,\n  ResourceConfiguration_OperationPath,\n  ResourceOperation_CustomServiceImplementationMode,\n  ErrorType,\n  ErrorCustomMessageReference,\n} from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from './services-registry-handler.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { ExternalApiHandlerBackendService } from '~wildo-backend-lib/external-providers/services/external-api-handler.backend.service';\nimport type { PlatformMutualizedHandlerBackendService } from '~wildo-backend-lib/requests/service/platform-mutualized-handler.backend.service';\nimport type { ServerlessServicesHandlerBackendService } from '~wildo-backend-lib/requests/service/serverless-services-handler.backend.service';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { WorkerRemoteClientFactoryBackendService } from '~wildo-backend-lib/applications/services/worker-remote-client-factory.backend.service';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\n\ntype Augment<TAugment extends object|undefined = undefined> = TAugment extends undefined ? {} : TAugment;\n\nexport type ResourceOperationCustomImplementation_InputTypeOf<\n  TMode extends ResourceOperation_CustomServiceImplementationMode = ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n  TInput extends (z.ZodSchema | undefined) = z.ZodAny | undefined,\n  TOutput extends z.ZodSchema = z.ZodAny,\n  TAugment extends object|undefined = undefined\n> =(\n  TMode extends ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL | ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput>\n      : never\n  : TMode extends ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput> & Augment<TAugment>\n      : never\n  : z.infer<TOutput>\n)\n\nexport type ResourceOperationCustomImplementation_OutputTypeOf<\n    TMode extends ResourceOperation_CustomServiceImplementationMode = ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n    TInput extends (z.ZodSchema | undefined) = z.ZodAny | undefined,\n    TOutput extends z.ZodSchema = z.ZodAny,\n    TAugment extends object|undefined = undefined\n> = (\n  TMode extends ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS\n    ? TInput extends z.ZodSchema\n      ? z.infer<TInput> & Augment<TAugment>\n      : Augment<TAugment>\n    : z.infer<TOutput>\n)\n\n\n\nexport const parseResourceOperation_CustomServiceImplementationSchema = <TSchema extends z.ZodTypeAny | undefined, TReturn = TSchema extends z.ZodTypeAny ? z.infer<TSchema> : unknown>(\n  mode: ResourceOperation_CustomServiceImplementationMode,\n  inputOrOutput: 'input' | 'output',\n  schema: TSchema,\n  objectToParse: unknown,\n  errorBuilder?: ErrorBuilderBackendService,\n): TReturn => {\n\n  const parse = (schema: z.ZodTypeAny | undefined, object: unknown, loose: boolean = false): unknown => {\n    if (!schema)\n      return object;\n\n    if(schema instanceof z.ZodObject) {\n      if (loose)\n        return z.looseObject(schema.shape).parse(object);\n      return schema.parse(object);\n    }\n    if(schema instanceof z.ZodArray) {\n      if (!(object instanceof Array)) {\n        if (errorBuilder) {\n          /** @wildo_source:part:start example.backend.operation.error-throw facet:kind:usage-example facet:audience:app-developer */\n          // Inside a backend custom-operation hook you receive `utils.errorBuilder`.\n          // Throw a WildoError with it — NEVER `throw new Error(...)`:\n          //  • the ErrorType drives the HTTP status (VALIDATION → 400 here);\n          //  • customMessageReference names the localized user message (resolved by\n          //    tErrorMessage → errors_messages.<ref>.msg) — do NOT hardcode English;\n          //  • any dynamic values go in `context` as structured keys (log-only for\n          //    most types), never interpolated into a `context.message` string.\n          throw errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,\n          });\n          /** @wildo_source:part:end example.backend.operation.error-throw */\n        }\n        // Bootstrap/leaf fallback ONLY — errorBuilder is unavailable here (pre-DI).\n        throw new Error('Input is not an array');\n      }\n      const itemSchema = (schema as z.ZodArray<z.ZodTypeAny>).element;\n      object = object.map((item: unknown) => parse(itemSchema, item, loose));\n      return object;\n    }\n    return schema.parse(object);\n  }\n\n  if(inputOrOutput === 'input') {\n    // PREFIX and REPLACE both receive data that may contain augmented fields\n    // from basicPrefixOperation or prior PREFIX handlers — use loose parse\n    // to preserve those fields while still validating declared schema fields.\n    if (mode === ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS\n      || mode === ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS) {\n      return parse(schema, objectToParse, true) as TReturn;\n    }\n    return parse(schema, objectToParse) as TReturn;\n\n  } else {\n    // PREFIX output may contain augmented fields (TAugment) that the declared\n    // output schema doesn't know about — use loose parse to preserve them.\n    if (mode === ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS) {\n      return parse(schema, objectToParse, true) as TReturn;\n    }\n    return parse(schema, objectToParse) as TReturn;\n  }\n}\n\n\n\n/**\n * Utilities object provided to custom implementation methods.\n *\n * Contains:\n * - Service instances (logger, errorBuilder, registries, handlers)\n * - `executionContextCreator`: Creates child execution contexts for cross-resource sub-calls\n * - Contextual data for the operation:\n *   - `objectContext`: Parent and child resource data (fetched based on resource configuration)\n *   - `initiatorUserContext`: User context of the user/organization/application initiating the operation\n *   - `currentObject`: The current resource object (for UPDATE/DELETE operations) or input data (for CREATE operations)\n *\n * Context fields are populated automatically by the service registry handler based on:\n * - Resource configuration context needs analysis\n * - Operation type (CREATE uses input data, UPDATE/DELETE fetches current object)\n *\n * ### Cross-resource operations\n *\n * For cross-resource calls from custom impls, use `utils.executionContextCreator.createForSubCall()`\n * to create a child context with proper depth tracking and cycle detection, then pass it\n * to `utils.servicesRegistry`. Example:\n *\n * ```ts\n * const subCtx = await utils.executionContextCreator.createForSubCall(\n *   executionContext, targetResourceType, CoreResourceOperation.CREATE\n * );\n * await utils.servicesRegistry.create(targetResourceType, subCtx, data);\n * ```\n *\n * Calling `servicesRegistry` directly with the parent context is functionally safe\n * (doOperation corrects the operation), but skips depth/cycle tracking.\n */\nexport type ResourceOperation_CustomImplementation_Utils = {\n  logger: LoggerService;\n  errorBuilder: ErrorBuilderBackendService;\n  resourcesRegistry: ResourcesRegistryBackendService;\n  servicesRegistry: ServicesRegistryHandlerBackendService;\n  /**\n   * Options of the operation currently executing, including its database\n   * transaction. Cross-resource mutations from a hook must forward these\n   * options when they belong to the same semantic unit of work.\n   */\n  serviceOptions?: ServiceOptions;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  externalApiHandler: ExternalApiHandlerBackendService;\n  platformMutualizedHandler: PlatformMutualizedHandlerBackendService;\n  serverlessServicesHandler: ServerlessServicesHandlerBackendService;\n  /**\n   * Creates child execution contexts for cross-resource sub-calls with proper\n   * depth tracking and cycle detection. Use `createForSubCall()` when calling\n   * `servicesRegistry` methods from a custom implementation.\n   */\n  executionContextCreator: ExecutionContextCreatorBackendService;\n  /**\n   * The SANCTIONED privileged-access path for custom implementations. A custom\n   * impl is a request-triggered elevation site: it runs inside the caller's\n   * (often anonymous / low-privilege) execution context but sometimes must read\n   * or write a resource that context cannot reach (e.g. an anonymous lead-capture\n   * CREATE that needs a users-by-email lookup). Route those through\n   * `systemAccessService.readAsSystem` / `listAsSystem` / `createAsSystem` /\n   * `updateAsSystem` — each is fail-closed on the target's `systemAccessPolicy`\n   * opt-in AND emits a `SYSTEM_CONTEXT_*` audit event. Do NOT hand-build a\n   * super-admin context via `executionContextCreator` for an ACL bypass; that\n   * path is ungated and unaudited. Optional so minimal test containers that do\n   * not bind the system-access service still construct.\n   */\n  systemAccessService?: SystemAccessBackendService;\n  /**\n   * Dispatch to one of the application's declared WORKERS — the sanctioned way to move work off the\n   * request path from application backend code.\n   *\n   * `workerClientFactory.client('<workerName>').post('/route', body)` mints the\n   * `APPLICATION_WORKER_REQUEST` JWT the worker's verifier pins and reaches the worker at the URL\n   * the deploy injected. The factory fails CLOSED on an undeclared worker rather than dispatching to\n   * a guessed address.\n   *\n   * ## Why it had to be added here (#426)\n   *\n   * The factory shipped, was bound in DI, and had NO caller anywhere — and this is why: a custom\n   * implementation is the one place an application writes backend logic, and this bag was the only\n   * thing it receives. There was no handle, so no application COULD call a worker, which is the\n   * deeper half of why the backend-to-worker chain had never run for anyone. Adding the handle is\n   * what turns a shipped mechanism into a reachable one.\n   *\n   * Optional for the same reason `systemAccessService` is: a minimal test container that does not\n   * bind the factory must still construct.\n   */\n  workerClientFactory?: WorkerRemoteClientFactoryBackendService;\n  /** SAML metadata service — for DISCOVER_ENDPOINTS (emits SAML_METADATA_PARSED) */\n  samlMetadataService?: { parseIdPMetadata(metadataXml: string): unknown };\n  /**\n   * Contextual data about parent and child resources.\n   * Structure: { parents: Record<string, any>, children: Record<string, any> }\n   * Populated based on resource configuration context needs.\n   */\n  objectContext?: { parents: Record<string, any>; children: Record<string, any> };\n  /**\n   * User context of the initiator (user/organization/application) performing the operation.\n   * Populated from execution context.\n   */\n  initiatorUserContext?: any;\n  /**\n   * Current resource object (for UPDATE/DELETE) or input data (for CREATE).\n   * For UPDATE/DELETE: Fetched from repository before custom implementation execution.\n   * For CREATE: Uses the input data provided to the operation.\n   */\n  currentObject?: any;\n};\n\nexport abstract class ResourceOperationCustomImplementationBase<\n  TInput extends z.ZodSchema = z.ZodAny,\n  TOutput extends z.ZodSchema = z.ZodAny,\n> {\n\n  public abstract getPlaceholders(): ResourceOperation_CustomServiceImplementationMode[];\n\n  /**\n   * Replaces the ENTIRE operation pipeline — no core CRUD, no notifications, no other hooks.\n   * Single-owner mode: if multiple registrations declare this, highest priority wins.\n   *\n   * A registration exposing this mode cannot enable `transactionalCore`: the\n   * override returns before the framework-owned core transaction is entered,\n   * so advertising that atomicity boundary would be false.\n   */\n  public abstract overrideAll(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL, TInput, TOutput>,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n       ResourceOperation_CustomServiceImplementationMode.OVERRIDE_ALL,\n       TInput, TOutput\n    >>;\n\n  /**\n   * Runs before core CRUD. Augments `data` via spread-merge (`data = { ...data, ...result }`).\n   *\n   * **Multi-registration execution:** handlers run sequentially by ascending priority number\n   * (lower number = higher priority = runs first). Each handler receives the accumulated `data`\n   * from all prior handlers. For field conflicts, **last-writer-wins**: the handler with the\n   * HIGHEST priority number (lowest priority) overwrites fields set by earlier handlers.\n   *\n   * **Array inputs (CREATE_MANY):** handler must return the full transformed array, not a\n   * spread-merged object. Non-array returns are silently dropped with a debug log.\n   *\n   * `utils.currentObject` reflects pre-PREFIX state (original DB record or CREATE input).\n   */\n  public abstract prefixCoreOperations<TAugment extends object|undefined = undefined>(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment>,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.PREFIX_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >>;\n\n  /**\n   * Replaces the core CRUD **result** — the core DB operation still runs, this overwrites `currentState`.\n   * Receives PREFIX-augmented `data` as input. Single-owner mode: highest priority wins.\n   */\n  public abstract replaceCoreOperations<TAugment extends object|undefined = undefined>(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.REPLACE_CORE_OPERARTIONS,\n      TInput, TOutput, TAugment\n    >>;\n\n  /**\n   * Runs after core CRUD and REPLACE. Input is the core operation result.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   * Handlers must guard against non-object input when destructuring.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   */\n  public abstract postfixCoreOperations(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.POSTFIX_CORE_OPERARTIONS,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.POSTFIX_CORE_OPERARTIONS,\n      TInput, TOutput\n    >>;\n\n  /**\n   * Runs after notification dispatch. Input is the current operation result.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   *\n   * On a framework-owned transactional operation, this hook runs only after\n   * the root commit and framework post-commit effects finish. It receives the\n   * committed callback attempt's context and no completed transaction in\n   * `utils.serviceOptions`. A thrown error therefore rejects the response after\n   * an irreversible commit; this phase is for request-scoped result transforms,\n   * not mutation-owned external work.\n   *\n   * Because the phase transforms the returned value, it is not accepted when\n   * the operation reuses an explicit or ambient caller-owned transaction:\n   * that nested call must return before its caller can commit.\n   */\n  public abstract afterUserNotifications(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AFTER_USER_NOTIFICATIONS,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AFTER_USER_NOTIFICATIONS,\n      TInput, TOutput\n    >>;\n\n  /**\n   * Final hook — runs at the very end of the pipeline, after notifications and lifecycle evaluations.\n   *\n   * **DELETE operations:** `input` is a `string` (the deleted `_id`) or `string[]` (bulk),\n   * NOT the deleted document. Use `utils.currentObject` to access the pre-deletion document.\n   *\n   * With multi-registration, handlers run sequentially by priority — each receives the previous handler's output.\n   *\n   * On a framework-owned transactional operation, this hook runs only after\n   * the root commit and framework post-commit effects finish. It receives the\n   * committed callback attempt's context and no completed transaction in\n   * `utils.serviceOptions`. A thrown error therefore rejects the response after\n   * an irreversible commit; this phase is for request-scoped result transforms,\n   * not mutation-owned external work.\n   *\n   * Because the phase transforms the returned value, it is not accepted when\n   * the operation reuses an explicit or ambient caller-owned transaction:\n   * that nested call must return before its caller can commit.\n   */\n  public abstract atTheEnd(\n    _id: string | undefined,\n    input: ResourceOperationCustomImplementation_InputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AT_THE_END,\n      TInput, TOutput\n    >,\n    executionContext: ExecutionContext<any>,\n    utils: ResourceOperation_CustomImplementation_Utils\n  ): Promise<ResourceOperationCustomImplementation_OutputTypeOf<\n      ResourceOperation_CustomServiceImplementationMode.AT_THE_END,\n      TInput, TOutput\n    >>;\n}\n"]}

package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.d.ts

@@ -1,4 +1,5 @@
 import { type ResourceConfiguration_Operation, type ResourceOperation_UnimplementedAcknowledgement } from '@wildo-ai/saas-models';
+import { ResourceOperationImplementationCoverage, ResourceOperationRequestContractBreadth, ResourceOperationUnserviceableReason } from '@wildo-ai/saas-models';
 import type { ResourceOperationCustomImplementationRegistration } from './resource-operation-custom-implementation-registry.backend.service';
 /**
  * Whether a configured resource operation can fulfil the contract it declares.
@@ -28,26 +29,8 @@ import type { ResourceOperationCustomImplementationRegistration } from './resour
  * assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — an interface must not report success for an action
  * it did not perform; monitoring and incident response depend on truthful responses.
  */
-export declare enum ResourceOperationImplementationCoverage {
-    /** Something consumes the declared contract: a custom implementation, a declarative side effect, or the core path itself. */
-    SERVICEABLE = "serviceable",
-    /** Nothing does. Left alone, the operation answers 2xx having performed nothing. */
-    UNSERVICEABLE = "unserviceable",
-    /** Outside this guard's remit — a core operation, or a variant the service tier never enters. */
-    NOT_APPLICABLE = "not_applicable"
-}
-/**
- * Why an operation was judged {@link ResourceOperationImplementationCoverage.UNSERVICEABLE}.
- * Surfaced verbatim in the startup error so the fix is obvious without re-deriving the analysis.
- */
-export declare enum ResourceOperationUnserviceableReason {
-    /** Write-like: no declared request field is a persisted resource-schema field, so the write is empty. */
-    NO_REQUEST_FIELD_IS_PERSISTED = "no_request_field_is_persisted",
-    /** READ-like: the core read addresses the row by id and consumes no request field, so the declared verb never happens. */
-    READ_CONSUMES_NO_REQUEST_FIELD = "read_consumes_no_request_field",
-    /** Collection-like: no declared request field is a collection parameter the core path reads. */
-    NO_REQUEST_FIELD_IS_COLLECTION_PARAMETER = "no_request_field_is_collection_parameter"
-}
+/** Re-exported so consumers of this module keep one import site; the vocabularies themselves live in `saas-models`. */
+export { ResourceOperationImplementationCoverage, ResourceOperationRequestContractBreadth, ResourceOperationUnserviceableReason };
 export interface ResourceOperationImplementationCoverageVerdict {
     readonly coverage: ResourceOperationImplementationCoverage;
     readonly unserviceableReason?: ResourceOperationUnserviceableReason;
@@ -95,12 +78,6 @@ export interface ResourceOperationImplementationCoverageVerdict {
  * assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — a named verb must not silently widen into an
  * unconstrained write over fields its resource never exposed for update.
  */
-export declare enum ResourceOperationRequestContractBreadth {
-    /** The operation authored its own request contract, or its family cannot inherit one. */
-    AUTHORED = "authored",
-    /** A write-like custom verb inherited the resource's whole create/update contract. */
-    OVERBROAD_INHERITED_FULL_CONTRACT = "overbroad_inherited_full_contract"
-}
 export interface ResourceOperationRequestContractVerdict {
     readonly breadth: ResourceOperationRequestContractBreadth;
     /** Every field the caller may send — the inherited contract when overbroad. Empty otherwise. */

package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-operation-implementation-coverage.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,+BAA+B,EACpC,KAAK,8CAA8C,EACpD,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EACV,iDAAiD,EAClD,MAAM,qEAAqE,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,oBAAY,uCAAuC;IACjD,6HAA6H;IAC7H,WAAW,gBAAgB;IAC3B,oFAAoF;IACpF,aAAa,kBAAkB;IAC/B,iGAAiG;IACjG,cAAc,mBAAmB;CAClC;AAED;;;GAGG;AACH,oBAAY,oCAAoC;IAC9C,yGAAyG;IACzG,6BAA6B,kCAAkC;IAC/D,0HAA0H;IAC1H,8BAA8B,mCAAmC;IACjE,gGAAgG;IAChG,wCAAwC,6CAA6C;CACtF;AAED,MAAM,WAAW,8CAA8C;IAC7D,QAAQ,CAAC,QAAQ,EAAE,uCAAuC,CAAC;IAC3D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,oCAAoC,CAAC;IACpE,6GAA6G;IAC7G,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,8CAA8C,CAAC;CAC3E;AA2DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,oBAAY,uCAAuC;IACjD,yFAAyF;IACzF,QAAQ,aAAa;IACrB,sFAAsF;IACtF,iCAAiC,sCAAsC;CACxE;AAED,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,OAAO,EAAE,uCAAuC,CAAC;IAC1D,gGAAgG;IAChG,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GACxD,uCAAuC,CAkBzC;AASD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GACxD,WAAW,CAAC,MAAM,CAAC,CAIrB;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,8CAA8C,CAC5D,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,aAAa,EAAE,SAAS,iDAAiD,EAAE,GAC1E,8CAA8C,CAgEhD"}
+{"version":3,"file":"resource-operation-implementation-coverage.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,+BAA+B,EACpC,KAAK,8CAA8C,EACpD,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uCAAuC,EACvC,uCAAuC,EACvC,oCAAoC,EACrC,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EACV,iDAAiD,EAClD,MAAM,qEAAqE,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,uHAAuH;AACvH,OAAO,EAAE,uCAAuC,EAAE,uCAAuC,EAAE,oCAAoC,EAAE,CAAC;AAElI,MAAM,WAAW,8CAA8C;IAC7D,QAAQ,CAAC,QAAQ,EAAE,uCAAuC,CAAC;IAC3D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,oCAAoC,CAAC;IACpE,6GAA6G;IAC7G,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,8CAA8C,CAAC;CAC3E;AA2DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,OAAO,EAAE,uCAAuC,CAAC;IAC1D,gGAAgG;IAChG,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GACxD,uCAAuC,CAkBzC;AASD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GACxD,WAAW,CAAC,MAAM,CAAC,CAIrB;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,8CAA8C,CAC5D,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,aAAa,EAAE,SAAS,iDAAiD,EAAE,GAC1E,8CAA8C,CAgEhD"}

package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.js

@@ -1,4 +1,5 @@
 import { CoreResourceOperation, ResourceOperationVariantType, createOrUpdateMandatoryDiscardFields, isApiCallOperation, isApiCallWithCallbackOperation, } from '@wildo-ai/saas-models';
+import { ResourceOperationImplementationCoverage, ResourceOperationRequestContractBreadth, ResourceOperationUnserviceableReason, } from '@wildo-ai/saas-models';
 import { getMergedObjectOrUnionShape } from '@wildo-ai/zod-decorators';
 /**
  * Whether a configured resource operation can fulfil the contract it declares.
@@ -28,28 +29,8 @@ import { getMergedObjectOrUnionShape } from '@wildo-ai/zod-decorators';
  * assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — an interface must not report success for an action
  * it did not perform; monitoring and incident response depend on truthful responses.
  */
-export var ResourceOperationImplementationCoverage;
-(function (ResourceOperationImplementationCoverage) {
-    /** Something consumes the declared contract: a custom implementation, a declarative side effect, or the core path itself. */
-    ResourceOperationImplementationCoverage["SERVICEABLE"] = "serviceable";
-    /** Nothing does. Left alone, the operation answers 2xx having performed nothing. */
-    ResourceOperationImplementationCoverage["UNSERVICEABLE"] = "unserviceable";
-    /** Outside this guard's remit — a core operation, or a variant the service tier never enters. */
-    ResourceOperationImplementationCoverage["NOT_APPLICABLE"] = "not_applicable";
-})(ResourceOperationImplementationCoverage || (ResourceOperationImplementationCoverage = {}));
-/**
- * Why an operation was judged {@link ResourceOperationImplementationCoverage.UNSERVICEABLE}.
- * Surfaced verbatim in the startup error so the fix is obvious without re-deriving the analysis.
- */
-export var ResourceOperationUnserviceableReason;
-(function (ResourceOperationUnserviceableReason) {
-    /** Write-like: no declared request field is a persisted resource-schema field, so the write is empty. */
-    ResourceOperationUnserviceableReason["NO_REQUEST_FIELD_IS_PERSISTED"] = "no_request_field_is_persisted";
-    /** READ-like: the core read addresses the row by id and consumes no request field, so the declared verb never happens. */
-    ResourceOperationUnserviceableReason["READ_CONSUMES_NO_REQUEST_FIELD"] = "read_consumes_no_request_field";
-    /** Collection-like: no declared request field is a collection parameter the core path reads. */
-    ResourceOperationUnserviceableReason["NO_REQUEST_FIELD_IS_COLLECTION_PARAMETER"] = "no_request_field_is_collection_parameter";
-})(ResourceOperationUnserviceableReason || (ResourceOperationUnserviceableReason = {}));
+/** Re-exported so consumers of this module keep one import site; the vocabularies themselves live in `saas-models`. */
+export { ResourceOperationImplementationCoverage, ResourceOperationRequestContractBreadth, ResourceOperationUnserviceableReason };
 /**
  * Collection parameters the generic core path reads off `inputData`.
  *
@@ -100,52 +81,6 @@ const COLLECTION_CORE_OPERATIONS = new Set([
     CoreResourceOperation.SEARCH,
     CoreResourceOperation.COUNT,
 ]);
-/**
- * Whether a custom operation's declared request contract is WIDER than the verb it names.
- *
- * # The defect this exists to make impossible
- *
- * `buildEnhancedRequestDto` synthesizes a request contract when an operation does not author one:
- * for a write-like `resourceOperationLike` that synthesis is the resource's ENTIRE create/update
- * contract. `resourceOperationLike` is therefore doing double duty — it selects the core path that
- * PERSISTS, and it also picks the contract the caller may SEND. The first is what an author wants
- * from a custom verb; the second almost never is.
- *
- * The result is an operation whose name promises one transition while its contract accepts every
- * field on the resource. `applicationApiKeys | deactivate` inherited
- * `{name, description, roles, status, expiresAt}` — so `PUT .../deactivate` could carry
- * `status: active` and do the exact opposite of its name, and could rewrite `roles` on a machine
- * credential even though that resource exposes no core UPDATE and gates roles only when minting.
- * `organizationOAuthClients | regenerate` inherited `redirectUris`.
- *
- * This is NOT the {@link ResourceOperationImplementationCoverage} question. Those operations DO
- * write; several have full custom implementations. They write too much. Conflating the two would
- * force the wrong remedy (an `unimplementedAcknowledgement` on an operation that is implemented)
- * and would corrupt the bidirectional stale-acknowledgement check, so this is a SEPARATE verdict
- * with its own resolver — sharing this module because both answer "does this operation mean what
- * it says", and a split would let the two drift.
- *
- * # Why "authored a contract" is the whole predicate
- *
- * A narrower rule ("the contract equals the full update contract") would be a heuristic, and it
- * would miss an author who pasted the full contract deliberately. Requiring the contract to be
- * AUTHORED makes intent explicit at the declaration site with no new model field and no second
- * acknowledgement list: an author who genuinely wants the whole contract writes it out, and the
- * reviewer sees them do it. Silence is the bug.
- *
- * `hasCustomRequestDto` is set by the factory as `!!variantParams.requestDto` and is already the
- * signal the DTO builder itself uses to tell an authored contract from a synthesized one.
- *
- * assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — a named verb must not silently widen into an
- * unconstrained write over fields its resource never exposed for update.
- */
-export var ResourceOperationRequestContractBreadth;
-(function (ResourceOperationRequestContractBreadth) {
-    /** The operation authored its own request contract, or its family cannot inherit one. */
-    ResourceOperationRequestContractBreadth["AUTHORED"] = "authored";
-    /** A write-like custom verb inherited the resource's whole create/update contract. */
-    ResourceOperationRequestContractBreadth["OVERBROAD_INHERITED_FULL_CONTRACT"] = "overbroad_inherited_full_contract";
-})(ResourceOperationRequestContractBreadth || (ResourceOperationRequestContractBreadth = {}));
 /**
  * Decide whether one configured operation authored the request contract it exposes.
  *

package/dist/esm/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-operation-implementation-coverage.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,oCAAoC,EACpC,kBAAkB,EAClB,8BAA8B,GAG/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAMvE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAN,IAAY,uCAOX;AAPD,WAAY,uCAAuC;IACjD,6HAA6H;IAC7H,sEAA2B,CAAA;IAC3B,oFAAoF;IACpF,0EAA+B,CAAA;IAC/B,iGAAiG;IACjG,4EAAiC,CAAA;AACnC,CAAC,EAPW,uCAAuC,KAAvC,uCAAuC,QAOlD;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,oCAOX;AAPD,WAAY,oCAAoC;IAC9C,yGAAyG;IACzG,uGAA+D,CAAA;IAC/D,0HAA0H;IAC1H,yGAAiE,CAAA;IACjE,gGAAgG;IAChG,6HAAqF,CAAA;AACvF,CAAC,EAPW,oCAAoC,KAApC,oCAAoC,QAO/C;AAWD;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAAwB,IAAI,GAAG,CAAC;IACnE,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAC7D,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CACrC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,2BAA2B,GAAuC,IAAI,GAAG,CAAC;IAC9E,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;CAClC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAuC,IAAI,GAAG,CAAC;IAC7E,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;CAClC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAuC,IAAI,GAAG,CAAC;IAC7E,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;CAC5B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAN,IAAY,uCAKX;AALD,WAAY,uCAAuC;IACjD,yFAAyF;IACzF,gEAAqB,CAAA;IACrB,sFAAsF;IACtF,kHAAuE,CAAA;AACzE,CAAC,EALW,uCAAuC,KAAvC,uCAAuC,QAKlD;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8CAA8C,CAC5D,SAAyD;IAEzD,MAAM,QAAQ,GAA4C;QACxD,OAAO,EAAE,uCAAuC,CAAC,QAAQ;QACzD,sBAAsB,EAAE,EAAE;KAC3B,CAAC;IAEF,IAAI,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3F,IAAI,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,eAAe;QAAE,OAAO,QAAQ,CAAC;IAC5F,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEhE,MAAM,aAAa,GAAG,SAAS,CAAC,qBAAqB,CAAC;IACtD,IAAI,CAAC,aAAa,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtF,IAAI,SAAS,CAAC,mBAAmB,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAE5D,OAAO;QACL,OAAO,EAAE,uCAAuC,CAAC,iCAAiC;QAClF,sBAAsB,EAAE,4BAA4B,CAAC,SAAS,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,SAAyD;IAEzD,IAAI,CAAC,SAAS,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,UAAmB,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAyD;IAEzD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,UAAmB,CAAC,CAAC,CAAC,CAAC;IACnG,KAAK,MAAM,SAAS,IAAI,oCAAoC;QAAE,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB,CAChC,SAAyD;IAEzD,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,SAAS,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,kBAAkB,CAAC,SAAS,CAAC,IAAI,8BAA8B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/E,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,8CAA8C,CAC5D,SAAyD,EACzD,aAA2E;IAE3E,MAAM,eAAe,GAAG,SAAS,CAAC,4BAA4B,CAAC;IAC/D,MAAM,WAAW,GAAmD;QAClE,QAAQ,EAAE,uCAAuC,CAAC,WAAW;QAC7D,uBAAuB,EAAE,EAAE;QAC3B,eAAe;KAChB,CAAC;IACF,MAAM,aAAa,GAAmD;QACpE,QAAQ,EAAE,uCAAuC,CAAC,cAAc;QAChE,uBAAuB,EAAE,EAAE;QAC3B,eAAe;KAChB,CAAC;IAEF,IAAI,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IAChG,IAAI,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,eAAe;QAAE,OAAO,aAAa,CAAC;IACjG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IACjD,IAAI,yBAAyB,CAAC,SAAS,CAAC;QAAE,OAAO,WAAW,CAAC;IAE7D,MAAM,aAAa,GAAG,SAAS,CAAC,qBAAqB,CAAC;IACtD,IAAI,CAAC,aAAa;QAAE,OAAO,aAAa,CAAC;IACzC,IAAI,2BAA2B,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,aAAa,CAAC;IAEzE,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;IAEtE,IAAI,0BAA0B,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,eAAe,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1F,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,WAAW,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE,uCAAuC,CAAC,aAAa;YAC/D,mBAAmB,EAAE,oCAAoC,CAAC,6BAA6B;YACvF,uBAAuB,EAAE,qBAAqB;YAC9C,eAAe;SAChB,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,6DAA6D;IAC7D,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAE3D,IAAI,aAAa,KAAK,qBAAqB,CAAC,IAAI,EAAE,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE,uCAAuC,CAAC,aAAa;YAC/D,mBAAmB,EAAE,oCAAoC,CAAC,8BAA8B;YACxF,uBAAuB,EAAE,qBAAqB;YAC9C,eAAe;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,0BAA0B,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CACjD,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,CAAC,GAAG,CAAC,KAAK,CAAC,CACtD,CAAC;QACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,WAAW,CAAC;QAClD,OAAO;YACL,QAAQ,EAAE,uCAAuC,CAAC,aAAa;YAC/D,mBAAmB,EACjB,oCAAoC,CAAC,wCAAwC;YAC/E,uBAAuB,EAAE,qBAAqB;YAC9C,eAAe;SAChB,CAAC;IACJ,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import {\n  CoreResourceOperation,\n  ResourceOperationVariantType,\n  createOrUpdateMandatoryDiscardFields,\n  isApiCallOperation,\n  isApiCallWithCallbackOperation,\n  type ResourceConfiguration_Operation,\n  type ResourceOperation_UnimplementedAcknowledgement,\n} from '@wildo-ai/saas-models';\nimport { getMergedObjectOrUnionShape } from '@wildo-ai/zod-decorators';\n\nimport type {\n  ResourceOperationCustomImplementationRegistration,\n} from './resource-operation-custom-implementation-registry.backend.service';\n\n/**\n * Whether a configured resource operation can fulfil the contract it declares.\n *\n * # The defect this exists to make impossible\n *\n * A custom operation that declares a `requestDto` no implementation consumes does not fail.\n * It falls through to the generic core path, which persists only fields the resource schema\n * declares. A DTO such as `{ newRole, reason }` names none of them, so the framework validates\n * the body, writes nothing, and answers **HTTP 200 with the unchanged row**.\n *\n * On 2026-08-01 a black-box hostile probe caught `organizationMembers | promote` doing exactly\n * that, and a sweep of the whole catalogue found 41 routed operations sharing the shape — 8\n * CRITICAL and 11 HIGH, including `users | impersonate`, `organizations | suspend` and\n * `applications | transfer`. This is not privilege escalation; nothing escalates. It is an\n * operational-safety and audit-integrity defect, and the destructive direction is the dangerous\n * one: an admin demotes a compromised account, is told 200 OK, and the account keeps its\n * privileges. Every runbook, script, and UI that trusts the 2xx is wrong.\n *\n * # Why one resolver\n *\n * Startup validation and request-time refusal must consume the SAME predicate. If they drift,\n * an operation blessed at boot can still answer 2xx on the first request — which is precisely\n * the state this module was written to end. Mirrors the single-authority contract of\n * `resolveResourceOperationTransactionPersistenceContract`.\n *\n * assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — an interface must not report success for an action\n * it did not perform; monitoring and incident response depend on truthful responses.\n */\nexport enum ResourceOperationImplementationCoverage {\n  /** Something consumes the declared contract: a custom implementation, a declarative side effect, or the core path itself. */\n  SERVICEABLE = 'serviceable',\n  /** Nothing does. Left alone, the operation answers 2xx having performed nothing. */\n  UNSERVICEABLE = 'unserviceable',\n  /** Outside this guard's remit — a core operation, or a variant the service tier never enters. */\n  NOT_APPLICABLE = 'not_applicable',\n}\n\n/**\n * Why an operation was judged {@link ResourceOperationImplementationCoverage.UNSERVICEABLE}.\n * Surfaced verbatim in the startup error so the fix is obvious without re-deriving the analysis.\n */\nexport enum ResourceOperationUnserviceableReason {\n  /** Write-like: no declared request field is a persisted resource-schema field, so the write is empty. */\n  NO_REQUEST_FIELD_IS_PERSISTED = 'no_request_field_is_persisted',\n  /** READ-like: the core read addresses the row by id and consumes no request field, so the declared verb never happens. */\n  READ_CONSUMES_NO_REQUEST_FIELD = 'read_consumes_no_request_field',\n  /** Collection-like: no declared request field is a collection parameter the core path reads. */\n  NO_REQUEST_FIELD_IS_COLLECTION_PARAMETER = 'no_request_field_is_collection_parameter',\n}\n\nexport interface ResourceOperationImplementationCoverageVerdict {\n  readonly coverage: ResourceOperationImplementationCoverage;\n  readonly unserviceableReason?: ResourceOperationUnserviceableReason;\n  /** The declared request fields that reach nothing. Empty when the operation declares no request contract. */\n  readonly unconsumedRequestFields: readonly string[];\n  /** The authored acknowledgement, when the operation declares one. */\n  readonly acknowledgement?: ResourceOperation_UnimplementedAcknowledgement;\n}\n\n/**\n * Collection parameters the generic core path reads off `inputData`.\n *\n * Pinned to the LIST / SEARCH / COUNT arms of `executeCorePersistenceOperation` in\n * `services-registry-handler.backend.service.ts` — these are the only request-body keys a\n * collection operation can influence the outcome with when no custom implementation runs.\n * Adding an arm there without adding its key here would make this guard over-strict.\n */\nconst CORE_COLLECTION_PARAMETER_NAMES: ReadonlySet<string> = new Set([\n  'filter',\n  'page',\n  'limit',\n  'sort',\n  'searchQuery',\n]);\n\nconst CORE_OPERATION_IDENTIFIERS: ReadonlySet<string> = new Set<string>(\n  Object.values(CoreResourceOperation),\n);\n\n/**\n * Core operations whose generic path performs a real state change on its own, so an unconsumed\n * request field is a WEAKER defect than a silent no-op and deliberately out of remit.\n *\n * `DELETE` / `DELETE_MANY` delete the row whether or not the operation reads its\n * `{ reason }` / `{ password }` field. That ignored confirmation field is its own defect class\n * (a missing re-authentication check), not a response that lies about having acted. Folding it in\n * here would conflate two problems and force the wrong remedy. Tracked separately in\n * `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n *\n * The exemplar of that second class was `user_self | delete_account`, REMOVED on 2026-08-01. Its\n * investigation is worth carrying forward, because this exclusion is what let it survive the sweep:\n * a delete-like verb is out of remit here, so nothing mechanical will flag the next one. It\n * discarded its `{ password }` confirmation, declared a scheduled-deletion response no producer\n * could satisfy (HTTP 500 on every call), fired an `onParentDelete` cascade its resource had never\n * opened a core DELETE for — rolling the delete back for some users and destroying others — and\n * contradicted its own resource's `RETAIN_AND_IMPERSONALIZE` retention policy. Data-subject erasure\n * belongs to `eraseSubjectAsSystem`, which ships deliberately without a route.\n */\nconst SELF_ACTING_CORE_OPERATIONS: ReadonlySet<CoreResourceOperation> = new Set([\n  CoreResourceOperation.DELETE,\n  CoreResourceOperation.DELETE_MANY,\n]);\n\nconst WRITE_LIKE_CORE_OPERATIONS: ReadonlySet<CoreResourceOperation> = new Set([\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.CREATE_MANY,\n  CoreResourceOperation.UPDATE,\n  CoreResourceOperation.UPDATE_MANY,\n]);\n\nconst COLLECTION_CORE_OPERATIONS: ReadonlySet<CoreResourceOperation> = new Set([\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.SEARCH,\n  CoreResourceOperation.COUNT,\n]);\n\n/**\n * Whether a custom operation's declared request contract is WIDER than the verb it names.\n *\n * # The defect this exists to make impossible\n *\n * `buildEnhancedRequestDto` synthesizes a request contract when an operation does not author one:\n * for a write-like `resourceOperationLike` that synthesis is the resource's ENTIRE create/update\n * contract. `resourceOperationLike` is therefore doing double duty — it selects the core path that\n * PERSISTS, and it also picks the contract the caller may SEND. The first is what an author wants\n * from a custom verb; the second almost never is.\n *\n * The result is an operation whose name promises one transition while its contract accepts every\n * field on the resource. `applicationApiKeys | deactivate` inherited\n * `{name, description, roles, status, expiresAt}` — so `PUT .../deactivate` could carry\n * `status: active` and do the exact opposite of its name, and could rewrite `roles` on a machine\n * credential even though that resource exposes no core UPDATE and gates roles only when minting.\n * `organizationOAuthClients | regenerate` inherited `redirectUris`.\n *\n * This is NOT the {@link ResourceOperationImplementationCoverage} question. Those operations DO\n * write; several have full custom implementations. They write too much. Conflating the two would\n * force the wrong remedy (an `unimplementedAcknowledgement` on an operation that is implemented)\n * and would corrupt the bidirectional stale-acknowledgement check, so this is a SEPARATE verdict\n * with its own resolver — sharing this module because both answer \"does this operation mean what\n * it says\", and a split would let the two drift.\n *\n * # Why \"authored a contract\" is the whole predicate\n *\n * A narrower rule (\"the contract equals the full update contract\") would be a heuristic, and it\n * would miss an author who pasted the full contract deliberately. Requiring the contract to be\n * AUTHORED makes intent explicit at the declaration site with no new model field and no second\n * acknowledgement list: an author who genuinely wants the whole contract writes it out, and the\n * reviewer sees them do it. Silence is the bug.\n *\n * `hasCustomRequestDto` is set by the factory as `!!variantParams.requestDto` and is already the\n * signal the DTO builder itself uses to tell an authored contract from a synthesized one.\n *\n * assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — a named verb must not silently widen into an\n * unconstrained write over fields its resource never exposed for update.\n */\nexport enum ResourceOperationRequestContractBreadth {\n  /** The operation authored its own request contract, or its family cannot inherit one. */\n  AUTHORED = 'authored',\n  /** A write-like custom verb inherited the resource's whole create/update contract. */\n  OVERBROAD_INHERITED_FULL_CONTRACT = 'overbroad_inherited_full_contract',\n}\n\nexport interface ResourceOperationRequestContractVerdict {\n  readonly breadth: ResourceOperationRequestContractBreadth;\n  /** Every field the caller may send — the inherited contract when overbroad. Empty otherwise. */\n  readonly inheritedRequestFields: readonly string[];\n}\n\n/**\n * Decide whether one configured operation authored the request contract it exposes.\n *\n * Flagged only when ALL hold:\n *\n *  1. it is a CUSTOM operation — a core operation's full contract IS its semantics;\n *  2. the service tier can enter it (`REPOSITORY_ONLY` variants answer no HTTP request);\n *  3. it is not framework-`generatedOperation` — those carry a framework-authored contract;\n *  4. its `resourceOperationLike` is write-like, the only family whose synthesis is the whole\n *     resource contract (`READ` synthesizes nothing; collection families synthesize query\n *     parameters, which are the honest contract for a collection verb);\n *  5. it did not author a `requestDto`.\n */\nexport function resolveResourceOperationRequestContractBreadth(\n  operation: ResourceConfiguration_Operation<any, any, any>,\n): ResourceOperationRequestContractVerdict {\n  const authored: ResourceOperationRequestContractVerdict = {\n    breadth: ResourceOperationRequestContractBreadth.AUTHORED,\n    inheritedRequestFields: [],\n  };\n\n  if (CORE_OPERATION_IDENTIFIERS.has(String(operation.operationIdentifier))) return authored;\n  if (operation.variantType === ResourceOperationVariantType.REPOSITORY_ONLY) return authored;\n  if (operation.generatedOperation !== undefined) return authored;\n\n  const coreOperation = operation.resourceOperationLike;\n  if (!coreOperation || !WRITE_LIKE_CORE_OPERATIONS.has(coreOperation)) return authored;\n  if (operation.hasCustomRequestDto === true) return authored;\n\n  return {\n    breadth: ResourceOperationRequestContractBreadth.OVERBROAD_INHERITED_FULL_CONTRACT,\n    inheritedRequestFields: getDeclaredRequestFieldNames(operation),\n  };\n}\n\nfunction getDeclaredRequestFieldNames(\n  operation: ResourceConfiguration_Operation<any, any, any>,\n): string[] {\n  if (!operation.requestDto) return [];\n  return Object.keys(getMergedObjectOrUnionShape(operation.requestDto as never));\n}\n\n/**\n * Field names a CLIENT-SUPPLIED payload can actually persist on this resource.\n *\n * Read from the resource's `mainSchema`, NOT the operation's `repositoryDto`. `repositoryDto` is\n * computed per-operation at factory time and can be narrowed by the operation's own\n * `requestDto`; using it would make the intersection below trivially non-empty and silently\n * defeat this guard. `mainSchema` is the persistence contract the repository projects onto, and\n * it is what the live 200-no-op reproduction matched.\n *\n * `createOrUpdateMandatoryDiscardFields` (`_id`, `createdAt`, `updatedAt`, `deletedAt`,\n * `_version_db_doc`) are subtracted because `ResourceOperationsHelper.cleanInputData` DELETES them\n * from every create/update payload before validation. They are schema paths, so a naive\n * intersection counts them as writable and the operation reads as serviceable — but the write that\n * follows is still empty.\n *\n * That false negative was real, and it is why this subtraction exists: `user_self | update_profile`\n * and `| update_preferences` declared fields belonging to OTHER resources (`firstName`,\n * `notifications`, …) plus `_id`, so `_id` alone was carrying the serviceable verdict while the\n * operation persisted nothing. Both verbs were REMOVED on 2026-08-01 (the writes belong to\n * `USER_SELF_PROFILES` / `USER_SELF_PREFERENCES`), so they no longer appear in the catalogue — but\n * the subtraction must stay: it is a general property of every create/update payload, and without\n * it the next cross-resource DTO would read as serviceable for exactly the same reason.\n */\nexport function getPersistedFieldNames(\n  operation: ResourceConfiguration_Operation<any, any, any>,\n): ReadonlySet<string> {\n  const persisted = new Set(Object.keys(getMergedObjectOrUnionShape(operation.mainSchema as never)));\n  for (const discarded of createOrUpdateMandatoryDiscardFields) persisted.delete(discarded);\n  return persisted;\n}\n\n/**\n * Declarative side effects that ARE the operation's work, even with no custom implementation\n * and an empty `requestDto`.\n *\n * `organizationMembers | resend` is the canonical case: it declares `requestDto: z.object({})`,\n * registers no custom implementation, and does its entire job — re-mint the invitation accept\n * token, revoke the prior one, re-send the email — through declarative `tokenGeneration`. A\n * registration-only test would flag it as a no-op and brick a working operation, so every\n * framework-executed declarative effect has to count here.\n */\nfunction hasDeclarativeSideEffects(\n  operation: ResourceConfiguration_Operation<any, any, any>,\n): boolean {\n  if (operation.generatedOperation !== undefined) return true;\n  if (operation.basicPrefixOperation !== undefined) return true;\n  if (isApiCallOperation(operation) || isApiCallWithCallbackOperation(operation)) {\n    if (operation.tokenGeneration !== undefined) return true;\n    if (operation.tokenRevocation !== undefined) return true;\n  }\n  return false;\n}\n\n/**\n * Decide whether one configured operation can fulfil its declared contract.\n *\n * An operation is UNSERVICEABLE only when ALL of these hold, in this order:\n *\n *  1. it is a CUSTOM operation — a core operation's semantics are the core path by definition;\n *  2. the service tier can enter it — `REPOSITORY_ONLY` variants are never dispatched through\n *     a service, so they cannot answer an HTTP request at all;\n *  3. no custom-implementation registration is bound to its exact operation path;\n *  4. it declares no framework-executed declarative side effect (see\n *     {@link hasDeclarativeSideEffects});\n *  5. its declared `requestDto` cannot influence the outcome through the generic core path for\n *     its `resourceOperationLike`.\n *\n * Clause 5 is per core-operation family:\n *\n *  - **write-like** (`CREATE` / `CREATE_MANY` / `UPDATE` / `UPDATE_MANY`) — no declared request\n *    field is a persisted resource field. This also covers an empty request contract\n *    (`∅ ∩ X = ∅`): a write that carries nothing writes nothing.\n *  - **`READ`** — the core read addresses the row by id and reads no request field, so any\n *    declared field is wholly unconsumed and the custom verb never happens. An operation\n *    declaring NO request contract is a plain read alias and stays serviceable.\n *  - **collection** (`LIST` / `SEARCH` / `COUNT`) — declares request fields, none of which is a\n *    {@link CORE_COLLECTION_PARAMETER_NAMES} key.\n *  - **`DELETE` / `DELETE_MANY`** — never judged, see {@link SELF_ACTING_CORE_OPERATIONS}.\n *\n * A custom operation with no `resourceOperationLike` is left NOT_APPLICABLE: it cannot reach a\n * generic core path at all, so the dispatcher's own guards own it.\n */\nexport function resolveResourceOperationImplementationCoverage(\n  operation: ResourceConfiguration_Operation<any, any, any>,\n  registrations: readonly ResourceOperationCustomImplementationRegistration[],\n): ResourceOperationImplementationCoverageVerdict {\n  const acknowledgement = operation.unimplementedAcknowledgement;\n  const serviceable: ResourceOperationImplementationCoverageVerdict = {\n    coverage: ResourceOperationImplementationCoverage.SERVICEABLE,\n    unconsumedRequestFields: [],\n    acknowledgement,\n  };\n  const notApplicable: ResourceOperationImplementationCoverageVerdict = {\n    coverage: ResourceOperationImplementationCoverage.NOT_APPLICABLE,\n    unconsumedRequestFields: [],\n    acknowledgement,\n  };\n\n  if (CORE_OPERATION_IDENTIFIERS.has(String(operation.operationIdentifier))) return notApplicable;\n  if (operation.variantType === ResourceOperationVariantType.REPOSITORY_ONLY) return notApplicable;\n  if (registrations.length > 0) return serviceable;\n  if (hasDeclarativeSideEffects(operation)) return serviceable;\n\n  const coreOperation = operation.resourceOperationLike;\n  if (!coreOperation) return notApplicable;\n  if (SELF_ACTING_CORE_OPERATIONS.has(coreOperation)) return notApplicable;\n\n  const declaredRequestFields = getDeclaredRequestFieldNames(operation);\n\n  if (WRITE_LIKE_CORE_OPERATIONS.has(coreOperation)) {\n    const persistedFields = getPersistedFieldNames(operation);\n    const writtenFields = declaredRequestFields.filter((field) => persistedFields.has(field));\n    if (writtenFields.length > 0) return serviceable;\n    return {\n      coverage: ResourceOperationImplementationCoverage.UNSERVICEABLE,\n      unserviceableReason: ResourceOperationUnserviceableReason.NO_REQUEST_FIELD_IS_PERSISTED,\n      unconsumedRequestFields: declaredRequestFields,\n      acknowledgement,\n    };\n  }\n\n  // Below here the operation declaring nothing is a plain alias of its core operation, which is\n  // honest work: there is no client input to silently discard.\n  if (declaredRequestFields.length === 0) return serviceable;\n\n  if (coreOperation === CoreResourceOperation.READ) {\n    return {\n      coverage: ResourceOperationImplementationCoverage.UNSERVICEABLE,\n      unserviceableReason: ResourceOperationUnserviceableReason.READ_CONSUMES_NO_REQUEST_FIELD,\n      unconsumedRequestFields: declaredRequestFields,\n      acknowledgement,\n    };\n  }\n\n  if (COLLECTION_CORE_OPERATIONS.has(coreOperation)) {\n    const consumedFields = declaredRequestFields.filter(\n      (field) => CORE_COLLECTION_PARAMETER_NAMES.has(field),\n    );\n    if (consumedFields.length > 0) return serviceable;\n    return {\n      coverage: ResourceOperationImplementationCoverage.UNSERVICEABLE,\n      unserviceableReason:\n        ResourceOperationUnserviceableReason.NO_REQUEST_FIELD_IS_COLLECTION_PARAMETER,\n      unconsumedRequestFields: declaredRequestFields,\n      acknowledgement,\n    };\n  }\n\n  return notApplicable;\n}\n"]}
+{"version":3,"file":"resource-operation-implementation-coverage.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-operation-implementation-coverage.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,oCAAoC,EACpC,kBAAkB,EAClB,8BAA8B,GAG/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uCAAuC,EACvC,uCAAuC,EACvC,oCAAoC,GACrC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAMvE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,uHAAuH;AACvH,OAAO,EAAE,uCAAuC,EAAE,uCAAuC,EAAE,oCAAoC,EAAE,CAAC;AAWlI;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAAwB,IAAI,GAAG,CAAC;IACnE,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAC7D,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CACrC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,2BAA2B,GAAuC,IAAI,GAAG,CAAC;IAC9E,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;CAClC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAuC,IAAI,GAAG,CAAC;IAC7E,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;IACjC,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,WAAW;CAClC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAuC,IAAI,GAAG,CAAC;IAC7E,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;IAC5B,qBAAqB,CAAC,KAAK;CAC5B,CAAC,CAAC;AA+CH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8CAA8C,CAC5D,SAAyD;IAEzD,MAAM,QAAQ,GAA4C;QACxD,OAAO,EAAE,uCAAuC,CAAC,QAAQ;QACzD,sBAAsB,EAAE,EAAE;KAC3B,CAAC;IAEF,IAAI,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3F,IAAI,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,eAAe;QAAE,OAAO,QAAQ,CAAC;IAC5F,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAEhE,MAAM,aAAa,GAAG,SAAS,CAAC,qBAAqB,CAAC;IACtD,IAAI,CAAC,aAAa,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtF,IAAI,SAAS,CAAC,mBAAmB,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAE5D,OAAO;QACL,OAAO,EAAE,uCAAuC,CAAC,iCAAiC;QAClF,sBAAsB,EAAE,4BAA4B,CAAC,SAAS,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,SAAyD;IAEzD,IAAI,CAAC,SAAS,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,UAAmB,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAyD;IAEzD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,UAAmB,CAAC,CAAC,CAAC,CAAC;IACnG,KAAK,MAAM,SAAS,IAAI,oCAAoC;QAAE,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB,CAChC,SAAyD;IAEzD,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,SAAS,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,kBAAkB,CAAC,SAAS,CAAC,IAAI,8BAA8B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/E,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,8CAA8C,CAC5D,SAAyD,EACzD,aAA2E;IAE3E,MAAM,eAAe,GAAG,SAAS,CAAC,4BAA4B,CAAC;IAC/D,MAAM,WAAW,GAAmD;QAClE,QAAQ,EAAE,uCAAuC,CAAC,WAAW;QAC7D,uBAAuB,EAAE,EAAE;QAC3B,eAAe;KAChB,CAAC;IACF,MAAM,aAAa,GAAmD;QACpE,QAAQ,EAAE,uCAAuC,CAAC,cAAc;QAChE,uBAAuB,EAAE,EAAE;QAC3B,eAAe;KAChB,CAAC;IAEF,IAAI,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IAChG,IAAI,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,eAAe;QAAE,OAAO,aAAa,CAAC;IACjG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IACjD,IAAI,yBAAyB,CAAC,SAAS,CAAC;QAAE,OAAO,WAAW,CAAC;IAE7D,MAAM,aAAa,GAAG,SAAS,CAAC,qBAAqB,CAAC;IACtD,IAAI,CAAC,aAAa;QAAE,OAAO,aAAa,CAAC;IACzC,IAAI,2BAA2B,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,aAAa,CAAC;IAEzE,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;IAEtE,IAAI,0BAA0B,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,eAAe,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1F,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,WAAW,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE,uCAAuC,CAAC,aAAa;YAC/D,mBAAmB,EAAE,oCAAoC,CAAC,6BAA6B;YACvF,uBAAuB,EAAE,qBAAqB;YAC9C,eAAe;SAChB,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,6DAA6D;IAC7D,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAE3D,IAAI,aAAa,KAAK,qBAAqB,CAAC,IAAI,EAAE,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE,uCAAuC,CAAC,aAAa;YAC/D,mBAAmB,EAAE,oCAAoC,CAAC,8BAA8B;YACxF,uBAAuB,EAAE,qBAAqB;YAC9C,eAAe;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,0BAA0B,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CACjD,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,CAAC,GAAG,CAAC,KAAK,CAAC,CACtD,CAAC;QACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,WAAW,CAAC;QAClD,OAAO;YACL,QAAQ,EAAE,uCAAuC,CAAC,aAAa;YAC/D,mBAAmB,EACjB,oCAAoC,CAAC,wCAAwC;YAC/E,uBAAuB,EAAE,qBAAqB;YAC9C,eAAe;SAChB,CAAC;IACJ,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import {\n  CoreResourceOperation,\n  ResourceOperationVariantType,\n  createOrUpdateMandatoryDiscardFields,\n  isApiCallOperation,\n  isApiCallWithCallbackOperation,\n  type ResourceConfiguration_Operation,\n  type ResourceOperation_UnimplementedAcknowledgement,\n} from '@wildo-ai/saas-models';\nimport {\n  ResourceOperationImplementationCoverage,\n  ResourceOperationRequestContractBreadth,\n  ResourceOperationUnserviceableReason,\n} from '@wildo-ai/saas-models';\nimport { getMergedObjectOrUnionShape } from '@wildo-ai/zod-decorators';\n\nimport type {\n  ResourceOperationCustomImplementationRegistration,\n} from './resource-operation-custom-implementation-registry.backend.service';\n\n/**\n * Whether a configured resource operation can fulfil the contract it declares.\n *\n * # The defect this exists to make impossible\n *\n * A custom operation that declares a `requestDto` no implementation consumes does not fail.\n * It falls through to the generic core path, which persists only fields the resource schema\n * declares. A DTO such as `{ newRole, reason }` names none of them, so the framework validates\n * the body, writes nothing, and answers **HTTP 200 with the unchanged row**.\n *\n * On 2026-08-01 a black-box hostile probe caught `organizationMembers | promote` doing exactly\n * that, and a sweep of the whole catalogue found 41 routed operations sharing the shape — 8\n * CRITICAL and 11 HIGH, including `users | impersonate`, `organizations | suspend` and\n * `applications | transfer`. This is not privilege escalation; nothing escalates. It is an\n * operational-safety and audit-integrity defect, and the destructive direction is the dangerous\n * one: an admin demotes a compromised account, is told 200 OK, and the account keeps its\n * privileges. Every runbook, script, and UI that trusts the 2xx is wrong.\n *\n * # Why one resolver\n *\n * Startup validation and request-time refusal must consume the SAME predicate. If they drift,\n * an operation blessed at boot can still answer 2xx on the first request — which is precisely\n * the state this module was written to end. Mirrors the single-authority contract of\n * `resolveResourceOperationTransactionPersistenceContract`.\n *\n * assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — an interface must not report success for an action\n * it did not perform; monitoring and incident response depend on truthful responses.\n */\n/** Re-exported so consumers of this module keep one import site; the vocabularies themselves live in `saas-models`. */\nexport { ResourceOperationImplementationCoverage, ResourceOperationRequestContractBreadth, ResourceOperationUnserviceableReason };\n\nexport interface ResourceOperationImplementationCoverageVerdict {\n  readonly coverage: ResourceOperationImplementationCoverage;\n  readonly unserviceableReason?: ResourceOperationUnserviceableReason;\n  /** The declared request fields that reach nothing. Empty when the operation declares no request contract. */\n  readonly unconsumedRequestFields: readonly string[];\n  /** The authored acknowledgement, when the operation declares one. */\n  readonly acknowledgement?: ResourceOperation_UnimplementedAcknowledgement;\n}\n\n/**\n * Collection parameters the generic core path reads off `inputData`.\n *\n * Pinned to the LIST / SEARCH / COUNT arms of `executeCorePersistenceOperation` in\n * `services-registry-handler.backend.service.ts` — these are the only request-body keys a\n * collection operation can influence the outcome with when no custom implementation runs.\n * Adding an arm there without adding its key here would make this guard over-strict.\n */\nconst CORE_COLLECTION_PARAMETER_NAMES: ReadonlySet<string> = new Set([\n  'filter',\n  'page',\n  'limit',\n  'sort',\n  'searchQuery',\n]);\n\nconst CORE_OPERATION_IDENTIFIERS: ReadonlySet<string> = new Set<string>(\n  Object.values(CoreResourceOperation),\n);\n\n/**\n * Core operations whose generic path performs a real state change on its own, so an unconsumed\n * request field is a WEAKER defect than a silent no-op and deliberately out of remit.\n *\n * `DELETE` / `DELETE_MANY` delete the row whether or not the operation reads its\n * `{ reason }` / `{ password }` field. That ignored confirmation field is its own defect class\n * (a missing re-authentication check), not a response that lies about having acted. Folding it in\n * here would conflate two problems and force the wrong remedy. Tracked separately in\n * `.claude/plans/routed-unimplemented-operations-fail-closed.md`.\n *\n * The exemplar of that second class was `user_self | delete_account`, REMOVED on 2026-08-01. Its\n * investigation is worth carrying forward, because this exclusion is what let it survive the sweep:\n * a delete-like verb is out of remit here, so nothing mechanical will flag the next one. It\n * discarded its `{ password }` confirmation, declared a scheduled-deletion response no producer\n * could satisfy (HTTP 500 on every call), fired an `onParentDelete` cascade its resource had never\n * opened a core DELETE for — rolling the delete back for some users and destroying others — and\n * contradicted its own resource's `RETAIN_AND_IMPERSONALIZE` retention policy. Data-subject erasure\n * belongs to `eraseSubjectAsSystem`, which ships deliberately without a route.\n */\nconst SELF_ACTING_CORE_OPERATIONS: ReadonlySet<CoreResourceOperation> = new Set([\n  CoreResourceOperation.DELETE,\n  CoreResourceOperation.DELETE_MANY,\n]);\n\nconst WRITE_LIKE_CORE_OPERATIONS: ReadonlySet<CoreResourceOperation> = new Set([\n  CoreResourceOperation.CREATE,\n  CoreResourceOperation.CREATE_MANY,\n  CoreResourceOperation.UPDATE,\n  CoreResourceOperation.UPDATE_MANY,\n]);\n\nconst COLLECTION_CORE_OPERATIONS: ReadonlySet<CoreResourceOperation> = new Set([\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.SEARCH,\n  CoreResourceOperation.COUNT,\n]);\n\n/**\n * Whether a custom operation's declared request contract is WIDER than the verb it names.\n *\n * # The defect this exists to make impossible\n *\n * `buildEnhancedRequestDto` synthesizes a request contract when an operation does not author one:\n * for a write-like `resourceOperationLike` that synthesis is the resource's ENTIRE create/update\n * contract. `resourceOperationLike` is therefore doing double duty — it selects the core path that\n * PERSISTS, and it also picks the contract the caller may SEND. The first is what an author wants\n * from a custom verb; the second almost never is.\n *\n * The result is an operation whose name promises one transition while its contract accepts every\n * field on the resource. `applicationApiKeys | deactivate` inherited\n * `{name, description, roles, status, expiresAt}` — so `PUT .../deactivate` could carry\n * `status: active` and do the exact opposite of its name, and could rewrite `roles` on a machine\n * credential even though that resource exposes no core UPDATE and gates roles only when minting.\n * `organizationOAuthClients | regenerate` inherited `redirectUris`.\n *\n * This is NOT the {@link ResourceOperationImplementationCoverage} question. Those operations DO\n * write; several have full custom implementations. They write too much. Conflating the two would\n * force the wrong remedy (an `unimplementedAcknowledgement` on an operation that is implemented)\n * and would corrupt the bidirectional stale-acknowledgement check, so this is a SEPARATE verdict\n * with its own resolver — sharing this module because both answer \"does this operation mean what\n * it says\", and a split would let the two drift.\n *\n * # Why \"authored a contract\" is the whole predicate\n *\n * A narrower rule (\"the contract equals the full update contract\") would be a heuristic, and it\n * would miss an author who pasted the full contract deliberately. Requiring the contract to be\n * AUTHORED makes intent explicit at the declaration site with no new model field and no second\n * acknowledgement list: an author who genuinely wants the whole contract writes it out, and the\n * reviewer sees them do it. Silence is the bug.\n *\n * `hasCustomRequestDto` is set by the factory as `!!variantParams.requestDto` and is already the\n * signal the DTO builder itself uses to tell an authored contract from a synthesized one.\n *\n * assurance-control: WILDO.OPERATIONS.EXECUTION_INTEGRITY — a named verb must not silently widen into an\n * unconstrained write over fields its resource never exposed for update.\n */\nexport interface ResourceOperationRequestContractVerdict {\n  readonly breadth: ResourceOperationRequestContractBreadth;\n  /** Every field the caller may send — the inherited contract when overbroad. Empty otherwise. */\n  readonly inheritedRequestFields: readonly string[];\n}\n\n/**\n * Decide whether one configured operation authored the request contract it exposes.\n *\n * Flagged only when ALL hold:\n *\n *  1. it is a CUSTOM operation — a core operation's full contract IS its semantics;\n *  2. the service tier can enter it (`REPOSITORY_ONLY` variants answer no HTTP request);\n *  3. it is not framework-`generatedOperation` — those carry a framework-authored contract;\n *  4. its `resourceOperationLike` is write-like, the only family whose synthesis is the whole\n *     resource contract (`READ` synthesizes nothing; collection families synthesize query\n *     parameters, which are the honest contract for a collection verb);\n *  5. it did not author a `requestDto`.\n */\nexport function resolveResourceOperationRequestContractBreadth(\n  operation: ResourceConfiguration_Operation<any, any, any>,\n): ResourceOperationRequestContractVerdict {\n  const authored: ResourceOperationRequestContractVerdict = {\n    breadth: ResourceOperationRequestContractBreadth.AUTHORED,\n    inheritedRequestFields: [],\n  };\n\n  if (CORE_OPERATION_IDENTIFIERS.has(String(operation.operationIdentifier))) return authored;\n  if (operation.variantType === ResourceOperationVariantType.REPOSITORY_ONLY) return authored;\n  if (operation.generatedOperation !== undefined) return authored;\n\n  const coreOperation = operation.resourceOperationLike;\n  if (!coreOperation || !WRITE_LIKE_CORE_OPERATIONS.has(coreOperation)) return authored;\n  if (operation.hasCustomRequestDto === true) return authored;\n\n  return {\n    breadth: ResourceOperationRequestContractBreadth.OVERBROAD_INHERITED_FULL_CONTRACT,\n    inheritedRequestFields: getDeclaredRequestFieldNames(operation),\n  };\n}\n\nfunction getDeclaredRequestFieldNames(\n  operation: ResourceConfiguration_Operation<any, any, any>,\n): string[] {\n  if (!operation.requestDto) return [];\n  return Object.keys(getMergedObjectOrUnionShape(operation.requestDto as never));\n}\n\n/**\n * Field names a CLIENT-SUPPLIED payload can actually persist on this resource.\n *\n * Read from the resource's `mainSchema`, NOT the operation's `repositoryDto`. `repositoryDto` is\n * computed per-operation at factory time and can be narrowed by the operation's own\n * `requestDto`; using it would make the intersection below trivially non-empty and silently\n * defeat this guard. `mainSchema` is the persistence contract the repository projects onto, and\n * it is what the live 200-no-op reproduction matched.\n *\n * `createOrUpdateMandatoryDiscardFields` (`_id`, `createdAt`, `updatedAt`, `deletedAt`,\n * `_version_db_doc`) are subtracted because `ResourceOperationsHelper.cleanInputData` DELETES them\n * from every create/update payload before validation. They are schema paths, so a naive\n * intersection counts them as writable and the operation reads as serviceable — but the write that\n * follows is still empty.\n *\n * That false negative was real, and it is why this subtraction exists: `user_self | update_profile`\n * and `| update_preferences` declared fields belonging to OTHER resources (`firstName`,\n * `notifications`, …) plus `_id`, so `_id` alone was carrying the serviceable verdict while the\n * operation persisted nothing. Both verbs were REMOVED on 2026-08-01 (the writes belong to\n * `USER_SELF_PROFILES` / `USER_SELF_PREFERENCES`), so they no longer appear in the catalogue — but\n * the subtraction must stay: it is a general property of every create/update payload, and without\n * it the next cross-resource DTO would read as serviceable for exactly the same reason.\n */\nexport function getPersistedFieldNames(\n  operation: ResourceConfiguration_Operation<any, any, any>,\n): ReadonlySet<string> {\n  const persisted = new Set(Object.keys(getMergedObjectOrUnionShape(operation.mainSchema as never)));\n  for (const discarded of createOrUpdateMandatoryDiscardFields) persisted.delete(discarded);\n  return persisted;\n}\n\n/**\n * Declarative side effects that ARE the operation's work, even with no custom implementation\n * and an empty `requestDto`.\n *\n * `organizationMembers | resend` is the canonical case: it declares `requestDto: z.object({})`,\n * registers no custom implementation, and does its entire job — re-mint the invitation accept\n * token, revoke the prior one, re-send the email — through declarative `tokenGeneration`. A\n * registration-only test would flag it as a no-op and brick a working operation, so every\n * framework-executed declarative effect has to count here.\n */\nfunction hasDeclarativeSideEffects(\n  operation: ResourceConfiguration_Operation<any, any, any>,\n): boolean {\n  if (operation.generatedOperation !== undefined) return true;\n  if (operation.basicPrefixOperation !== undefined) return true;\n  if (isApiCallOperation(operation) || isApiCallWithCallbackOperation(operation)) {\n    if (operation.tokenGeneration !== undefined) return true;\n    if (operation.tokenRevocation !== undefined) return true;\n  }\n  return false;\n}\n\n/**\n * Decide whether one configured operation can fulfil its declared contract.\n *\n * An operation is UNSERVICEABLE only when ALL of these hold, in this order:\n *\n *  1. it is a CUSTOM operation — a core operation's semantics are the core path by definition;\n *  2. the service tier can enter it — `REPOSITORY_ONLY` variants are never dispatched through\n *     a service, so they cannot answer an HTTP request at all;\n *  3. no custom-implementation registration is bound to its exact operation path;\n *  4. it declares no framework-executed declarative side effect (see\n *     {@link hasDeclarativeSideEffects});\n *  5. its declared `requestDto` cannot influence the outcome through the generic core path for\n *     its `resourceOperationLike`.\n *\n * Clause 5 is per core-operation family:\n *\n *  - **write-like** (`CREATE` / `CREATE_MANY` / `UPDATE` / `UPDATE_MANY`) — no declared request\n *    field is a persisted resource field. This also covers an empty request contract\n *    (`∅ ∩ X = ∅`): a write that carries nothing writes nothing.\n *  - **`READ`** — the core read addresses the row by id and reads no request field, so any\n *    declared field is wholly unconsumed and the custom verb never happens. An operation\n *    declaring NO request contract is a plain read alias and stays serviceable.\n *  - **collection** (`LIST` / `SEARCH` / `COUNT`) — declares request fields, none of which is a\n *    {@link CORE_COLLECTION_PARAMETER_NAMES} key.\n *  - **`DELETE` / `DELETE_MANY`** — never judged, see {@link SELF_ACTING_CORE_OPERATIONS}.\n *\n * A custom operation with no `resourceOperationLike` is left NOT_APPLICABLE: it cannot reach a\n * generic core path at all, so the dispatcher's own guards own it.\n */\nexport function resolveResourceOperationImplementationCoverage(\n  operation: ResourceConfiguration_Operation<any, any, any>,\n  registrations: readonly ResourceOperationCustomImplementationRegistration[],\n): ResourceOperationImplementationCoverageVerdict {\n  const acknowledgement = operation.unimplementedAcknowledgement;\n  const serviceable: ResourceOperationImplementationCoverageVerdict = {\n    coverage: ResourceOperationImplementationCoverage.SERVICEABLE,\n    unconsumedRequestFields: [],\n    acknowledgement,\n  };\n  const notApplicable: ResourceOperationImplementationCoverageVerdict = {\n    coverage: ResourceOperationImplementationCoverage.NOT_APPLICABLE,\n    unconsumedRequestFields: [],\n    acknowledgement,\n  };\n\n  if (CORE_OPERATION_IDENTIFIERS.has(String(operation.operationIdentifier))) return notApplicable;\n  if (operation.variantType === ResourceOperationVariantType.REPOSITORY_ONLY) return notApplicable;\n  if (registrations.length > 0) return serviceable;\n  if (hasDeclarativeSideEffects(operation)) return serviceable;\n\n  const coreOperation = operation.resourceOperationLike;\n  if (!coreOperation) return notApplicable;\n  if (SELF_ACTING_CORE_OPERATIONS.has(coreOperation)) return notApplicable;\n\n  const declaredRequestFields = getDeclaredRequestFieldNames(operation);\n\n  if (WRITE_LIKE_CORE_OPERATIONS.has(coreOperation)) {\n    const persistedFields = getPersistedFieldNames(operation);\n    const writtenFields = declaredRequestFields.filter((field) => persistedFields.has(field));\n    if (writtenFields.length > 0) return serviceable;\n    return {\n      coverage: ResourceOperationImplementationCoverage.UNSERVICEABLE,\n      unserviceableReason: ResourceOperationUnserviceableReason.NO_REQUEST_FIELD_IS_PERSISTED,\n      unconsumedRequestFields: declaredRequestFields,\n      acknowledgement,\n    };\n  }\n\n  // Below here the operation declaring nothing is a plain alias of its core operation, which is\n  // honest work: there is no client input to silently discard.\n  if (declaredRequestFields.length === 0) return serviceable;\n\n  if (coreOperation === CoreResourceOperation.READ) {\n    return {\n      coverage: ResourceOperationImplementationCoverage.UNSERVICEABLE,\n      unserviceableReason: ResourceOperationUnserviceableReason.READ_CONSUMES_NO_REQUEST_FIELD,\n      unconsumedRequestFields: declaredRequestFields,\n      acknowledgement,\n    };\n  }\n\n  if (COLLECTION_CORE_OPERATIONS.has(coreOperation)) {\n    const consumedFields = declaredRequestFields.filter(\n      (field) => CORE_COLLECTION_PARAMETER_NAMES.has(field),\n    );\n    if (consumedFields.length > 0) return serviceable;\n    return {\n      coverage: ResourceOperationImplementationCoverage.UNSERVICEABLE,\n      unserviceableReason:\n        ResourceOperationUnserviceableReason.NO_REQUEST_FIELD_IS_COLLECTION_PARAMETER,\n      unconsumedRequestFields: declaredRequestFields,\n      acknowledgement,\n    };\n  }\n\n  return notApplicable;\n}\n"]}

package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-status-transition.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-status-transition.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAGH,OAAO,EACL,gBAAgB,EAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAEpH,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,iHAAiH,CAAC;AACpL,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAgB5G,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AA4BrK;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,0FAA0F;IAC1F,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;GASG;AACH,oBAAY,4BAA4B;IACtC,qDAAqD;IACrD,GAAG,QAAQ;IACX;;;;OAIG;IACH,KAAK,UAAU;CAChB;AAOD,MAAM,MAAM,kCAAkC,GAC1C;IACE,IAAI,EAAE,4BAA4B,CAAC,GAAG,CAAC;IACvC,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,8BAA8B,CAAC;CACxC,GACD;IACE,IAAI,EAAE,4BAA4B,CAAC,KAAK,CAAC;CAC1C,CAAC;AAEN,MAAM,WAAW,kCAAkC;IACjD,kBAAkB,EAAE,gBAAgB,CAAC;IACrC,uDAAuD;IACvD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,wFAAwF;IACxF,UAAU,CAAC,EAAE,kCAAkC,CAAC;IAChD;;;;;;;;;OASG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAmFF;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,kCAAkC,GAC7C,MAAM,EAAE,CAIV;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;CACrD,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2B1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,8CAA8C,CAAC,MAAM,EAAE;IAC3E,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;IACpD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,qDAAqD,CAAC,MAAM,EAAE;IAClF,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;IACpD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,iFAAiF;IACjF,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;CACrF,GAAG,OAAO,CAAC,IAAI,CAAC,CA2ChB;AAyHD;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,kCAAkC,GAC7C,0CAA0C,CAoL5C;AAED,6EAA6E;AAC7E,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,SAAS,kCAAkC,EAAE,GACzD,0CAA0C,EAAE,CAE9C"}
+{"version":3,"file":"resource-status-transition.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/base-classes/services/services/resource-status-transition.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AAGH,OAAO,EAEL,gBAAgB,EAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAEpH,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,iHAAiH,CAAC;AACpL,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAgB5G,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AA4BrK;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,0FAA0F;IAC1F,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;;GASG;AACH,oBAAY,4BAA4B;IACtC,qDAAqD;IACrD,GAAG,QAAQ;IACX;;;;OAIG;IACH,KAAK,UAAU;CAChB;AAOD,MAAM,MAAM,kCAAkC,GAC1C;IACE,IAAI,EAAE,4BAA4B,CAAC,GAAG,CAAC;IACvC,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,8BAA8B,CAAC;CACxC,GACD;IACE,IAAI,EAAE,4BAA4B,CAAC,KAAK,CAAC;CAC1C,CAAC;AAEN,MAAM,WAAW,kCAAkC;IACjD,kBAAkB,EAAE,gBAAgB,CAAC;IACrC,uDAAuD;IACvD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,wFAAwF;IACxF,UAAU,CAAC,EAAE,kCAAkC,CAAC;IAChD;;;;;;;;;OASG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAmFF;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,kCAAkC,GAC7C,MAAM,EAAE,CAIV;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;CACrD,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2B1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,8CAA8C,CAAC,MAAM,EAAE;IAC3E,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;IACpD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,qDAAqD,CAAC,MAAM,EAAE;IAClF,UAAU,EAAE,kCAAkC,CAAC;IAC/C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,EAAE,4CAA4C,CAAC;IACpD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,iFAAiF;IACjF,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;CACrF,GAAG,OAAO,CAAC,IAAI,CAAC,CA2ChB;AA4HD;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,kCAAkC,GAC7C,0CAA0C,CAoL5C;AAED,6EAA6E;AAC7E,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,SAAS,kCAAkC,EAAE,GACzD,0CAA0C,EAAE,CAE9C"}

package/dist/esm/base-classes/services/services/resource-status-transition.custom-impl.backend.service.js

@@ -86,7 +86,7 @@
  * write, and may not retire the last accountable administrative principal of an application or of a
  * tenant.
  */
-import { ErrorCustomMessageReference, ErrorType, ResourceOperationVariantType, } from '@wildo-ai/saas-models';
+import { AdministrativeContinuityBreachDetection, ErrorCustomMessageReference, ErrorType, ResourceOperationVariantType, } from '@wildo-ai/saas-models';
 import { createResourceCustomServiceImplementation, } from '../../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
 import { assertSuperAdminFloorPreservedForTransition, createSuperAdminConferralResolver, isSuperAdminFloorGovernedSubjectResource, } from '../../../security/authorizations/super-admin-floor.backend.utils.js';
 import { assertOrganizationOwnerFloorPreservedForTransition, createOrganizationOwnerConferralResolver, createOrganizationOwnerFloorPopulationContext, isOrganizationOwnerFloorAuthorityBearingResource, isOrganizationOwnerFloorGovernedSubjectResource, reportOrganizationsStrandedByUserDeactivation, membershipTransitionCouldReduceOwners, } from '../../../security/authorizations/organization-owner-floor.backend.utils.js';
@@ -434,6 +434,9 @@ function resolveStatusTransitionFloorGuards(definition, container) {
                     await container.get(SAAS_SERVICE_TYPES.AuditLogsService)
                         .logOrganizationOwnerFloorBreached({
                         organizationId: breach.organizationId,
+                        // A guard SAW this one and let it through, which is what separates it from the boot
+                        // report's observation of a tenant stranded out-of-band.
+                        detectedBy: AdministrativeContinuityBreachDetection.ALLOWED_LIFECYCLE_ACTION,
                         reducedMemberIds: breach.reducedMemberIds,
                         remainingUsableOwners: breach.remainingUsableOwners,
                         operationIdentifier: definition.operationIdentifier,